@deksden-com/dd-flow-cli 0.9.0-beta.17 → 0.9.0-beta.19

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.19
+
+### Patch Changes
+
+- Require a fresh trusted hook receipt from the physical Work owner before terminal stage or Work lifecycle commands can mutate a vNext RUN. Record terminal native-child observations at their originating Stage so unbound delegation is retained as a diagnostic instead of contaminating a later fan-out wave.
+
+## 0.9.0-beta.18
+
+### Patch Changes
+
+- Add Factory Droid harness routing, native lifecycle receipts and physical Session usage ingestion. Preserve child identity and reject conflicting hook replays or inclusive Droid usage to prevent incorrect Work binding and double counting.
+
 ## 0.9.0-beta.17
 
 ### Patch Changes

package/README.md

@@ -17,6 +17,27 @@ Never use a broad `pkill`/`killall`. A failed owned stop retains resources.
 
 It does not replace Memory Bank prompts and does not make product, design, merge, or verification judgments. Prompts own intent, route selection, planning depth, evidence meaning, and semantic readiness. The CLI owns explicit local state: projects, protocols, Codex session bindings, transitions, worktree records, lanes, locks, merge queue jobs, hook records, and audit events.
 
+## Factory Droid harness
+
+Configure `droid-cli` in `~/.dd-flow/harnesses.json` with absolute
+`adapter_command` (`dd-droid`) and `runtime_command` (`droid`) paths. Agent
+profiles use the `droid` alias; the adapter receives `--droid-bin`.
+
+The controlled adapter sends `dd-flow/droid-tool-event@1` JSON to
+`dd-flow droid event handle --project-root <root> --json`. Events include a
+stable `event_id`, `daemon_id`, `phase` (`before` or `after`), native Session
+identity and parent, absolute Session directory, `Execute` input, observed
+profile and transcript path. Before a lifecycle invocation, the returned
+`hookSpecificOutput.updatedInput` adds its one-use `--hook-event-id` receipt.
+The event ID belongs to the native hook invocation and is reused only for
+transport retries. Session success is established by the Work contract.
+
+`dd-flow droid usage ingest --project-root <root> --json` accepts cumulative
+per-Session counters with explicit `usage_scope: physical_session` and
+`completeness: complete|partial`. Inclusive root counters are rejected;
+partial windows remain unavailable in RUN totals until complete evidence
+arrives. Keep inclusive provider totals in adapter evidence for reconciliation.
+
 ## Runtime Model
 
 Root local database:

package/dist/build-info.json

@@ -1,11 +1,11 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.17",
-  "cli_commit": "162dd994d19c0d454a2ad6b7b62abd70c3e848d6",
-  "built_at": "2026-09-06T00:16:19.328Z",
+  "cli_version": "0.9.0-beta.19",
+  "cli_commit": "02648aa2db37e9332089ca941b06f5735b563496",
+  "built_at": "2026-09-06T13:33:22.164Z",
   "built_with_canon": {
-    "version": "4.0.4",
-    "commit": "ced59c19d0a4062146a1dc4ccb977e10284a2fe4",
+    "version": "4.0.6",
+    "commit": "2aafb30d23e3f646b736b7ead25438cab97b16bf",
     "flow_contract": "dd-flow-canonical-2026-08",
     "repo_root": "/Users/deksden/Documents/_Projects/dd-memorybank",
     "memorybank_root": "/Users/deksden/Documents/_Projects/dd-memorybank/.memory-bank",

package/dist/cli/help.js

@@ -38,6 +38,7 @@ Core commands:
   codex home/hooks/hook         Manage Codex homes, hooks, and hook events.
   zcode event/usage             Ingest trusted zcode-acp lifecycle and usage evidence.
   grok event/usage              Ingest trusted Grok Build lifecycle and usage evidence.
+  droid event/usage             Ingest trusted Factory Droid lifecycle and physical usage evidence.
   opencode event/usage          Ingest trusted OpenCode lifecycle and usage evidence.
   agy event/usage               Ingest trusted Antigravity CLI lifecycle and usage evidence.
   worktree plan/create/status   Record Worktrunk-backed feature worktrees.
@@ -154,7 +155,8 @@ Usage:
   dd-flow run status <RUN-ID|RUN-short-id> --project-root <root> --json
   dd-flow run list --project-root <root> --json
   dd-flow run prepare-vnext-specify --project-root <root> --slug <slug> --json
-  dd-flow run snapshot create <RUN-ID|RUN-short-id> (--stage-entry <stage>|--candidate|--incomplete) --project-root <root> --output <directory> --json
+  dd-flow run recovery inspect|begin|seal|capture|resume <RUN-ID|RUN-short-id> --project-root <root> --json
+  dd-flow run snapshot create <RUN-ID|RUN-short-id> (--stage-entry <stage>|--candidate|--incomplete|--recovery-id <RCV-ID>) --project-root <root> --output <directory> --json
   dd-flow run snapshot restore --snapshot <directory> --project-root <prepared-root> --json
   dd-flow run snapshot bootstrap create --project-root <root> --output <directory> --json
   dd-flow run snapshot bootstrap restore --snapshot <directory> --project-root <prepared-root> --json
@@ -169,7 +171,7 @@ Usage:
 
 RUN-* is the execution envelope for one concrete flow launch. Semantic truth remains in protocol, experiment, DEF, scenario, evidence, and Memory Bank documents. New run artifacts are stored under DD_FLOW_HOME/projects/<PRJ-ID-slug>/runs/<RUN-ID-slug>/ with one run.json projection and an append-only timeline.jsonl. Timeline is the compact full run report: summary is always present, while --hide may suppress bulky sections. Use \`dd-flow stat usage --run …\` to reread registered local Codex transcript counters and tool-call facts and refresh the current usage projection; unavailable data is explicit rather than zero.
 
-run prepare-vnext-specify allocates an otherwise unstarted vNext RUN for the canonical SPECIFY entry checkpoint. run snapshot is the eval-only checkpoint boundary: it snapshots one quiescent RUN, its dedicated DD_FLOW_HOME, and the exact project tree including its Git repository, then restores them into a fresh dedicated runtime. It is not a general runtime backup command and fails closed for a shared runtime.
+run prepare-vnext-specify allocates an otherwise unstarted vNext RUN for the canonical SPECIFY entry checkpoint. run recovery makes an interrupted RUN read-only, requires an explicit settled-tree receipt, captures immutable recovery evidence, then explicitly returns delegated Work to the ready graph. run snapshot is the eval-only checkpoint boundary: it snapshots one quiescent RUN, its dedicated DD_FLOW_HOME, and the exact project tree including its Git repository, then restores them into a fresh dedicated runtime. It is not a general runtime backup command and fails closed for a shared runtime.
 
 Examples:
   dd-flow run start --project-root "$PWD" --flow-kind mb_sdlc --subject-type protocol --subject-id PRT-001-demo --slug demo --json
@@ -191,6 +193,7 @@ Usage:
   dd-flow stage fanout status <RUN-ID|RUN-short-id> --project-root <root> --stage <name> --json
   dd-flow stage fanout dispatch <RUN-ID|RUN-short-id> --project-root <root> --stage <name> --json
   dd-flow stage fanout reconcile <RUN-ID> --project-root <root> --stage <name> --observations-file <native-observations.json> --json
+  dd-flow stage native observe <RUN-ID> --project-root <root> --stage <name> --observations-file <native-observations.json> --json
   dd-flow stage finish <RUN-ID|RUN-short-id> --project-root <root> --stage <name> [--semantic-file <RUN-local-json>] --json
   dd-flow stage finish <RUN-ID|RUN-short-id> --project-root <root> --stage specify (--result-file <RUN-local-specify.json>|--result-stdin) --outcome <specified|failed|cancelled> --json
 
@@ -549,6 +552,17 @@ Usage:
 
 Both payloads are read from stdin. The event adapter retains lifecycle identity;
 the usage adapter retains cumulative provider counters for RUN accounting.`
+    ],
+    [
+        "droid event",
+        `dd-flow droid event - ingest a controlled Factory Droid Execute hook
+
+Usage:
+  dd-flow droid event handle --project-root <root> --json
+  dd-flow droid usage ingest --project-root <root> --json
+
+Reads trusted adapter JSON from stdin. Usage requires physical_session scope and explicit completeness.
+`
     ],
     [
         "opencode event",

package/dist/cli/run-cli.js

@@ -10,7 +10,7 @@ import { blockPlanItem, completePlanItem, getPlanStatus, skipPlanItem, startPlan
 import { cancelMergeQueueJob, claimNextMergeJob, claimMergeJob, claimMergeBundle, completeMergeBundle, completeMergeJob, failMergeBundle, failMergeJob, getMergeBundleStatus, getMergeQueueStatus, noteMergeJob, waitNextMergeJob } from "../services/merge-queue.js";
 import { getMergeWorkerStatus, oneShotMergeClaim, startMergeWorker, stopProjectMergeWorker } from "../services/merge-worker.js";
 import { cleanupApply, cleanupScan } from "../services/cleanup.js";
-import { getCodexHomeStatus, getCodexHooksStatus, handleCodexHook, handleAgyEvent, handleGrokEvent, handleOpenCodeEvent, handleZcodeEvent, isolatedDdFlowHomeFromHookStdin, claimBootstrapHookEvent, findRecentMatchingHookEvent, stageStartMatchKey, initCodexHome, installCodexHooks, planCodexHome, printCodexHomeEnv, printCodexHooks, removeCodexHome, removeCodexHooks } from "../services/hooks.js";
+import { getCodexHomeStatus, getCodexHooksStatus, handleCodexHook, handleAgyEvent, handleDroidEvent, handleGrokEvent, handleOpenCodeEvent, handleZcodeEvent, isolatedDdFlowHomeFromHookStdin, claimBootstrapHookEvent, findRecentMatchingHookEvent, stageStartMatchKey, initCodexHome, installCodexHooks, planCodexHome, printCodexHomeEnv, printCodexHooks, removeCodexHome, removeCodexHooks } from "../services/hooks.js";
 import { bootstrapWorktree, closeWorktree, createWorktreeRecord, getWorktreeStatus, planWorktree } from "../services/worktrees.js";
 import { acquireLaneLock, cancelLaneWaiter, checkLaneWorkspace, getLaneWaiters, getLaneStatus, heartbeatLaneLock, releaseLaneLock, setLaneWorkspace, waitAcquireLaneLock, waitForLaneLock } from "../services/lanes.js";
 import { getProjectConfigStatus, setProjectConfigValue } from "../services/config.js";
@@ -26,7 +26,7 @@ import { attachFlowRunStage, completeFlowRun, completeFlowRunStage, getFlowRunSe
 import { previewNextEntityId } from "../services/ids.js";
 import { validateSchema } from "../services/schema-validation.js";
 import { preflightMemoryPermissions } from "../services/memory-permissions.js";
-import { ingestAgyUsage, ingestGrokUsage, ingestOpenCodeUsage, ingestZcodeUsage } from "../services/usage.js";
+import { ingestDroidUsage, ingestAgyUsage, ingestGrokUsage, ingestOpenCodeUsage, ingestZcodeUsage } from "../services/usage.js";
 import { applyMigration, assessMigrationImpact, assertUpgradeRunStorageReady, planMigration, verifyMigrationReport } from "../services/migrations.js";
 import { publishProjectSummary } from "../services/project-summary.js";
 import { requireProjectByRoot } from "../services/projects.js";
@@ -41,14 +41,15 @@ import { addVnextCodeRepair, finishVnextCode, startVnextCode } from "../services
 import { addVnextCodeReviewRepair, finishVnextCodeReview, isVnextCodeReviewRun, startVnextCodeReview } from "../services/vnext-code-review.js";
 import { applyVnextMerge, finishVnextMerge, getVnextMergeRequest, isVnextMergeRun, repairVnextMerge, routeVnextMergeRequest, startVnextMerge } from "../services/vnext-merge.js";
 import { mergeServerStatus, serveMergeRequests, stopMergeServer } from "../services/merge-server.js";
-import { getVnextFanoutStatus, reconcileVnextFanout } from "../services/vnext-fanout.js";
+import { getVnextFanoutStatus, observeVnextNativeChildren, reconcileVnextFanout } from "../services/vnext-fanout.js";
 import { pauseStageForUser, resumeStageAfterUser } from "../services/stage-pause.js";
 import { blockStageForRuntime, unblockStageAfterRuntimeRepair } from "../services/stage-blocker.js";
 import { classifyCliOperation, requiresExplicitUpgradeAuthorization } from "../services/cli-operation-classifier.js";
 import { renderWorkerPrompt } from "../services/prompts.js";
 import { finishStage, startStage } from "../services/stage-lifecycle.js";
-import { addWorkBatch, cancelWork, deleteWork, failWork, finishWork, listWorks, mutateWorkDeps, retryWork, showWork, startWork } from "../services/work-registry.js";
+import { addWorkBatch, assertStageLifecycleOwner, assertWorkLifecycleOwner, cancelWork, deleteWork, failWork, finishWork, listWorks, mutateWorkDeps, retryWork, showWork, startWork } from "../services/work-registry.js";
 import { createEvalBootstrapSnapshot, createEvalRunSnapshot, prepareVnextSpecifyRun, restoreEvalBootstrapSnapshot, restoreEvalRunSnapshot } from "../services/eval-snapshots.js";
+import { beginRunRecovery, inspectRunRecovery, recordRecoveryCapture, resumeRunRecovery, sealRunRecovery } from "../services/run-recovery.js";
 import { loadExternalStageContext } from "../services/stage-context.js";
 import { stopManagedProcess, confirmManagedProcess, finishManagedProcess, heartbeatManagedProcess, managedProcessStatus, reconcileExpiredManagedProcesses, registerManagedProcess } from "../services/managed-processes.js";
 import { startRuntimeService } from "../services/runtime-service.js";
@@ -670,6 +671,11 @@ async function dispatch(args, context, io, scopeProjectRoot = null, classificati
         }
         throw new AppError("usage", "Use: dd-flow stage fanout <status|dispatch|reconcile> <RUN> --stage <stage> --project-root <path>; reconcile requires --observations-file <native-observations.json>", 2);
     }
+    if (family === "stage" && command === "native") {
+        if (requiredPosition(parsed, 0, "native action") !== "observe")
+            throw new AppError("usage", "Use: dd-flow stage native observe <RUN> --stage <stage> --observations-file <native-observations.json> --project-root <path>", 2);
+        return observeVnextNativeChildren(context, { projectRoot: requiredScopeProjectRoot(scopeProjectRoot, "stage native observe"), runId: requiredPosition(parsed, 1, "run-id"), stage: requiredOption(parsed, "stage"), observations: JSON.parse(fs.readFileSync(requiredOption(parsed, "observations-file"), "utf8")) });
+    }
     if (family === "run" && command === "capacity") {
         if (requiredPosition(parsed, 0, "capacity action") !== "record")
             throw new AppError("usage", "Use: dd-flow run capacity record <RUN> --available-slots <0..15> --project-root <path>", 2);
@@ -765,11 +771,18 @@ async function dispatch(args, context, io, scopeProjectRoot = null, classificati
         const resultStdin = hasOption(parsed, "result-stdin");
         if (Boolean(resultFile) === resultStdin)
             throw new AppError("usage", "work finish requires exactly one of --result-file or --result-stdin", 2);
+        const workId = requiredPosition(parsed, 0, "work-id");
+        const projectRoot = requiredScopeProjectRoot(scopeProjectRoot, "work finish");
+        assertWorkLifecycleOwner(context, { workId, projectRoot, operation: "work_finish", ...(optionalOption(parsed, "hook-event-id") ? { hookEventId: optionalOption(parsed, "hook-event-id") } : {}) });
         const result = resultFile ? fs.readFileSync(path.resolve(resultFile), "utf8") : await readStdin(io.stdin);
-        return await finishWork(context, requiredPosition(parsed, 0, "work-id"), result, commandProgress(io, output));
+        return await finishWork(context, workId, result, commandProgress(io, output));
+    }
+    if (family === "work" && command === "fail") {
+        const workId = requiredPosition(parsed, 0, "work-id");
+        const projectRoot = requiredScopeProjectRoot(scopeProjectRoot, "work fail");
+        assertWorkLifecycleOwner(context, { workId, projectRoot, operation: "work_fail", ...(optionalOption(parsed, "hook-event-id") ? { hookEventId: optionalOption(parsed, "hook-event-id") } : {}) });
+        return failWork(context, workId, requiredOption(parsed, "reason"));
     }
-    if (family === "work" && command === "fail")
-        return failWork(context, requiredPosition(parsed, 0, "work-id"), requiredOption(parsed, "reason"));
     if (family === "work" && command === "cancel")
         return cancelWork(context, requiredPosition(parsed, 0, "work-id"), requiredOption(parsed, "reason"));
     if (family === "work" && command === "retry")
@@ -882,8 +895,17 @@ async function dispatch(args, context, io, scopeProjectRoot = null, classificati
         const resultStdin = hasOption(parsed, "result-stdin");
         const retryCheckId = optionalOption(parsed, "retry-check");
         const retryReason = optionalOption(parsed, "reason");
+        const hookEventId = optionalOption(parsed, "hook-event-id");
         if (retryCheckId && !retryReason?.trim())
             throw new AppError("usage", "--retry-check requires --reason explaining the recovered environment", 2);
+        const protectedLifecycle = (stage === "specify" && isVnextSpecifyRun(context, { projectRoot, runId }))
+            || (stage === "protocolize" && isVnextProtocolizeRun(context, { projectRoot, runId }))
+            || (stage === "plan" && isVnextPlanRun(context, { projectRoot, runId }))
+            || (stage === "plan-review" && isVnextPlanReviewRun(context, { projectRoot, runId }))
+            || (stage === "code" && isVnextPlanRun(context, { projectRoot, runId }))
+            || (stage === "code-review" && isVnextCodeReviewRun(context, { projectRoot, runId }));
+        if (protectedLifecycle)
+            assertStageLifecycleOwner(context, { projectRoot, runId, stage, operation: "stage_finish", ...(hookEventId ? { hookEventId } : {}) });
         if (stage === "specify" && isVnextSpecifyRun(context, { projectRoot, runId })) {
             const outcome = optionalOption(parsed, "outcome");
             if (!outcome || !["specified", "failed", "cancelled"].includes(outcome)) {
@@ -949,11 +971,23 @@ async function dispatch(args, context, io, scopeProjectRoot = null, classificati
     if (family === "stage" && command === "pause") {
         if (!hasOption(parsed, "question-stdin"))
             throw new AppError("usage", "stage pause requires --question-stdin", 2);
+        const projectRoot = requiredOption(parsed, "project-root");
+        const runId = requiredPosition(parsed, 0, "run-id");
+        const stage = requiredOption(parsed, "stage");
+        const workId = requiredOption(parsed, "work");
+        const protectedLifecycle = (stage === "specify" && isVnextSpecifyRun(context, { projectRoot, runId }))
+            || (stage === "protocolize" && isVnextProtocolizeRun(context, { projectRoot, runId }))
+            || (stage === "plan" && isVnextPlanRun(context, { projectRoot, runId }))
+            || (stage === "plan-review" && isVnextPlanReviewRun(context, { projectRoot, runId }))
+            || (stage === "code" && isVnextPlanRun(context, { projectRoot, runId }))
+            || (stage === "code-review" && isVnextCodeReviewRun(context, { projectRoot, runId }));
+        if (protectedLifecycle)
+            assertStageLifecycleOwner(context, { projectRoot, runId, stage, workId, operation: "stage_pause", ...(optionalOption(parsed, "hook-event-id") ? { hookEventId: optionalOption(parsed, "hook-event-id") } : {}) });
         return pauseStageForUser(context, {
-            projectRoot: requiredOption(parsed, "project-root"),
-            runId: requiredPosition(parsed, 0, "run-id"),
-            stage: requiredOption(parsed, "stage"),
-            workId: requiredOption(parsed, "work"),
+            projectRoot,
+            runId,
+            stage,
+            workId,
             question: await readStdin(io.stdin)
         });
     }
@@ -1070,6 +1104,16 @@ async function dispatch(args, context, io, scopeProjectRoot = null, classificati
             throw new AppError("usage", "Unknown opencode usage action", 2);
         return ingestOpenCodeUsage(context, { projectRoot: requiredOption(parsed, "project-root"), stdin: await readStdin(io.stdin) });
     }
+    if (family === "droid" && command === "event") {
+        if (requiredPosition(parsed, 0, "droid event action") !== "handle")
+            throw new AppError("usage", "Unknown droid event action", 2);
+        return handleDroidEvent(context, { projectRoot: requiredOption(parsed, "project-root"), stdin: await readStdin(io.stdin) });
+    }
+    if (family === "droid" && command === "usage") {
+        if (requiredPosition(parsed, 0, "droid usage action") !== "ingest")
+            throw new AppError("usage", "Unknown droid usage action", 2);
+        return ingestDroidUsage(context, { projectRoot: requiredOption(parsed, "project-root"), stdin: await readStdin(io.stdin) });
+    }
     if (family === "agy" && command === "event")
         return dispatchAgyEvent(context, parsed, await readStdin(io.stdin));
     if (family === "agy" && command === "usage") {
@@ -1419,6 +1463,22 @@ function dispatchSession(context, command, parsed) {
     throw new AppError("usage", `Unknown session command: ${command ?? "<empty>"}`, 2);
 }
 function dispatchRun(context, command, parsed) {
+    if (command === "recovery") {
+        const action = requiredPosition(parsed, 0, "recovery action");
+        const projectRoot = requiredOption(parsed, "project-root");
+        const runId = requiredPosition(parsed, 1, "run-id");
+        if (action === "inspect")
+            return inspectRunRecovery(context, { projectRoot, runId });
+        if (action === "begin")
+            return beginRunRecovery(context, { projectRoot, runId, interruption: requiredOption(parsed, "interruption-json") });
+        if (action === "seal")
+            return sealRunRecovery(context, { projectRoot, runId, recoveryId: requiredOption(parsed, "recovery-id"), settlement: requiredOption(parsed, "settlement-json") });
+        if (action === "capture")
+            return recordRecoveryCapture(context, { projectRoot, runId, recoveryId: requiredOption(parsed, "recovery-id"), capturePath: requiredOption(parsed, "capture-path") });
+        if (action === "resume")
+            return resumeRunRecovery(context, { projectRoot, runId, recoveryId: requiredOption(parsed, "recovery-id") });
+        throw new AppError("usage", "Use: dd-flow run recovery inspect|begin|seal|capture|resume", 2);
+    }
     if (command === "snapshot") {
         const action = requiredPosition(parsed, 0, "snapshot action");
         if (action === "bootstrap") {
@@ -1438,9 +1498,10 @@ function dispatchRun(context, command, parsed) {
         if (action === "create") {
             const candidate = parsed.options.has("candidate");
             const incomplete = parsed.options.has("incomplete");
+            const recoveryId = optionalOption(parsed, "recovery-id");
             const stageEntry = optionalOption(parsed, "stage-entry");
-            if (Number(candidate) + Number(incomplete) + Number(stageEntry !== undefined) !== 1)
-                throw new AppError("usage", "Use exactly one of --candidate, --incomplete or --stage-entry", 2);
+            if (Number(candidate) + Number(incomplete) + Number(stageEntry !== undefined) + Number(recoveryId !== undefined) !== 1)
+                throw new AppError("usage", "Use exactly one of --candidate, --incomplete, --recovery-id or --stage-entry", 2);
             const input = {
                 projectRoot: requiredOption(parsed, "project-root"),
                 runId: requiredPosition(parsed, 1, "run-id"),
@@ -1448,6 +1509,8 @@ function dispatchRun(context, command, parsed) {
             };
             if (incomplete)
                 return createEvalRunSnapshot(context, { ...input, incomplete: true });
+            if (recoveryId)
+                return createEvalRunSnapshot(context, { ...input, recoveryId });
             return candidate
                 ? createEvalRunSnapshot(context, { ...input, candidate: true })
                 : createEvalRunSnapshot(context, { ...input, stageEntry: stageEntry });
@@ -2372,7 +2435,7 @@ function projectRootForMutation(context, args, result, resolvedScope) {
     if (family === "opencode" && ((command === "event" && requiredPosition(parsed, 0, "opencode event action") === "handle") || command === "usage")) {
         return requiredOption(parsed, "project-root");
     }
-    if (family === "agy" && ((command === "event" && requiredPosition(parsed, 0, "agy event action") === "handle") || command === "usage"))
+    if (["agy", "droid"].includes(family ?? "") && ((command === "event" && requiredPosition(parsed, 0, `${family} event action`) === "handle") || command === "usage"))
         return requiredOption(parsed, "project-root");
     if (family === "codex" && command === "hooks") {
         const action = requiredPosition(parsed, 0, "codex hooks action");

package/dist/schemas/agent-profile.schema.json

@@ -7,7 +7,7 @@
   "properties": {
     "schema_id": {"const": "dd-flow/agent-profile@1"},
     "id": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$"},
-    "harness": {"enum": ["codex", "zcode", "agy", "opencode", "grok"]},
+    "harness": {"enum": ["codex", "zcode", "agy", "opencode", "grok", "droid"]},
     "provider": {"type": "string", "minLength": 1},
     "model": {"type": "string", "minLength": 1},
     "reasoning": {"type": "string", "minLength": 1},

package/dist/services/cli-operation-classifier.js

@@ -106,6 +106,8 @@ function isRouterNative(args) {
         || (first === "zcode" && args[1] === "usage" && args[2] === "ingest")
         || (first === "grok" && args[1] === "event" && args[2] === "handle")
         || (first === "grok" && args[1] === "usage" && args[2] === "ingest")
+        || (first === "droid" && args[1] === "event" && args[2] === "handle")
+        || (first === "droid" && args[1] === "usage" && args[2] === "ingest")
         || (first === "opencode" && args[1] === "event" && args[2] === "handle")
         || (first === "opencode" && args[1] === "usage" && args[2] === "ingest")
         || (first === "agy" && args[1] === "event" && args[2] === "handle")

package/dist/services/eval-snapshots.js

@@ -55,7 +55,13 @@ export function createEvalRunSnapshot(context, input) {
     const project = requireProjectByRoot(context, projectRoot);
     const status = getFlowRunStatus(context, { projectRoot, runId: input.runId });
     assertDedicatedHome(context, project.id, input.runId);
-    if (input.incomplete) { /* Forensic evidence is not an accepted or restorable boundary. */ }
+    const recovery = typeof input.recoveryId === "string";
+    if (recovery) {
+        const guard = context.db.get("SELECT status, recovery_id FROM run_recovery_guards WHERE project_id = ? AND run_id = ? AND recovery_id = ?", [project.id, input.runId, input.recoveryId]);
+        if (!guard || guard.status !== "sealed")
+            throw new AppError("recovery_invalid_state", "Recovery snapshots require the matching sealed recovery guard", 1, { run_id: input.runId, recovery_id: input.recoveryId ?? null, status: guard?.status ?? null });
+    }
+    if (input.incomplete || recovery) { /* Recovery captures only after the runner seals all writers. */ }
     else if (input.candidate)
         assertTerminalCandidate(status.index.stage_runs ?? []);
     else if (input.stageEntry)
@@ -66,7 +72,7 @@ export function createEvalRunSnapshot(context, input) {
     const activeChildren = input.candidate
         ? context.db.get("SELECT COUNT(*) AS count FROM works WHERE project_id = ? AND run_id = ? AND parent_work_id IS NOT NULL AND status IN ('created', 'running', 'paused')", [project.id, input.runId])?.count ?? 0
         : context.db.get("SELECT COUNT(*) AS count FROM works WHERE project_id = ? AND run_id = ? AND parent_work_id IS NOT NULL AND (status IN ('running', 'paused') OR (status = 'created' AND (? IS NULL OR COALESCE(result_schema, '') NOT LIKE ?)))", [project.id, input.runId, allowedCreatedResultSchema, allowedCreatedResultSchema ? `${allowedCreatedResultSchema}@%` : ""])?.count ?? 0;
-    if (!input.incomplete && activeChildren > 0)
+    if (!input.incomplete && !recovery && activeChildren > 0)
         throw new AppError("snapshot_not_quiescent", `${input.candidate ? "Candidate" : "Stage-entry"} snapshot requires no active child Work`, 1, { run_id: input.runId, active_children: activeChildren });
     const output = path.resolve(input.output);
     if (fs.existsSync(output))
@@ -103,9 +109,9 @@ export function createEvalRunSnapshot(context, input) {
         project_id: project.id,
         project_root: projectRoot,
         dd_flow_home: context.ddFlowHome,
-        purpose: input.incomplete ? "incomplete" : input.candidate ? "candidate" : "stage_entry",
-        stage_entry: input.incomplete || input.candidate ? null : input.stageEntry,
-        ...(input.incomplete ? { consistency: "sqlite_read_snapshot_files_copied_nonatomically", active_child_work_count: activeChildren, restorable: false } : {}),
+        purpose: input.incomplete ? "incomplete" : recovery ? "recovery" : input.candidate ? "candidate" : "stage_entry",
+        stage_entry: input.incomplete || recovery || input.candidate ? null : input.stageEntry,
+        ...(input.incomplete ? { consistency: "sqlite_read_snapshot_files_copied_nonatomically", active_child_work_count: activeChildren, restorable: false } : recovery ? { recovery_id: input.recoveryId, consistency: "sealed_writer_barrier_required", active_child_work_count: activeChildren, restorable: "same-runtime-or-explicit-restore" } : {}),
         created_at: context.now(),
         runtime_sha256: treeHash(path.join(output, "runtime")),
         project_sha256: treeHash(path.join(output, "project")),
@@ -129,6 +135,8 @@ export function restoreEvalRunSnapshot(context, input) {
     const manifest = readManifest(snapshot);
     if (manifest.purpose === "incomplete")
         throw new AppError("snapshot_incomplete_not_restorable", "Incomplete snapshot is forensic evidence, not a stage-entry fixture", 1, { snapshot });
+    if (manifest.purpose === "recovery")
+        throw new AppError("snapshot_recovery_requires_explicit_restore", "Recovery snapshots require the recovery runner; they are not a generic stage-entry fixture", 1, { snapshot });
     if (manifest.purpose === "candidate")
         throw new AppError("snapshot_candidate_not_restorable", "A terminal candidate snapshot is evidence, not a stage-entry fixture", 1, { snapshot });
     if (!manifest.stage_entry)
@@ -383,7 +391,7 @@ function readManifest(snapshot) {
     if (!fs.existsSync(file))
         throw new AppError("snapshot_missing", "Snapshot manifest is missing", 1, { snapshot });
     const value = JSON.parse(fs.readFileSync(file, "utf8"));
-    if (value.schema_id !== "dd-flow/eval-run-snapshot@5" || !value.run_id || !value.project_root || !value.dd_flow_home || typeof value.purpose !== "string" || !["stage_entry", "candidate", "incomplete"].includes(value.purpose) || (value.purpose === "stage_entry" && !value.stage_entry) || (value.purpose !== "stage_entry" && value.stage_entry !== null) || !value.runtime_sha256 || !value.project_sha256 || !value.project_git || !value.workspace)
+    if (value.schema_id !== "dd-flow/eval-run-snapshot@5" || !value.run_id || !value.project_root || !value.dd_flow_home || typeof value.purpose !== "string" || !["stage_entry", "candidate", "incomplete", "recovery"].includes(value.purpose) || (value.purpose === "stage_entry" && !value.stage_entry) || (value.purpose !== "stage_entry" && value.stage_entry !== null) || !value.runtime_sha256 || !value.project_sha256 || !value.project_git || !value.workspace)
         throw new AppError("snapshot_invalid", "Snapshot manifest is invalid", 1, { snapshot });
     if (!value.project_git.branch || !value.project_git.head || !value.project_git.bundle_sha256)
         throw new AppError("snapshot_invalid", "Snapshot project Git metadata is incomplete", 1, { snapshot });

package/dist/services/harness-config.js

@@ -10,6 +10,7 @@ export function harnessKey(value) {
         zcode: "zcode-acp", "zcode-acp": "zcode-acp",
         grok: "grok-acp", "grok-acp": "grok-acp",
         agy: "antigravity-cli", "antigravity-cli": "antigravity-cli",
+        droid: "droid-cli", "droid-cli": "droid-cli",
         opencode: "opencode-server", "opencode-server": "opencode-server"
     };
     const resolved = keys[value];
@@ -60,6 +61,7 @@ export function harnessRuntimeArguments(ddFlowHome, harness) {
         "zcode-acp": "--zcode-acp-bin",
         "grok-acp": "--grok-bin",
         "antigravity-cli": "--agy-bin",
+        "droid-cli": "--droid-bin",
         "opencode-server": "--opencode-bin"
     };
     return [option[key], runtime];