@deksden-com/dd-flow-cli 0.9.0-beta.89 → 0.9.0-beta.90

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.90
+
+### Patch Changes
+
+- 18e2627: Require settled fan-out stages to complete their semantic decision and invoke
+  the authoritative finish command before assuming a repair exists. Report the
+  controller action that failed to make progress, and hand off repair Work only
+  after an actual lifecycle response registers it.
+- 954c676: Publish the exact CI-tested tarball through a credential-isolated release job, with deterministic test shards, package smoke, trusted candidate receipts, and safe lost-reply recovery.
+
 ## 0.9.0-beta.89
 
 ### Minor Changes

package/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.89",
-  "cli_commit": "e36aabd9160805831809ca27575600fb6db47511",
-  "built_at": "2026-09-21T08:53:05.446Z",
+  "cli_version": "0.9.0-beta.90",
+  "cli_commit": "a4e9733f871af5032fc372d324d8fd0dfd2ec44f",
+  "built_at": "2026-09-21T11:54:11.387Z",
   "built_with_canon": {
     "version": "4.1.1",
     "commit": "d1a6081ab15ab92ac917ff5d037121a40c709db1",

package/dist/services/controller-fanout.js

@@ -4,6 +4,20 @@ import { getFlowRunVariables } from "./runs.js";
 import { dispatchVnextPlanReview } from "./vnext-plan-review.js";
 import { resolveExecutionPolicy } from "./execution-policy.js";
 import { renderDelegationInstructions } from "../harness-runtime/lib/delegation-instructions.mjs";
+function semanticCompletionPrompt(stage, completed) {
+    const task = stage === "plan-review"
+        ? "Classify the reviewer findings, apply every accepted correction in the current PLAN-REVIEW Work, and write the authoritative review decision."
+        : stage === "code-review"
+            ? "Classify the review findings and write or retain the authoritative review decision."
+            : "Integrate the accepted child results and update the Stage's authoritative verification evidence.";
+    return [
+        `All declared ${stage} child Work has settled (${completed} completed).`,
+        task,
+        "Then invoke the exact Stage finish command from the original authoritative packet.",
+        "Only if that command actually returns continuation.kind = repair_required has repair Work been registered; in that case end this Turn immediately so the controller can dispatch it. Otherwise follow the command's actual result.",
+        "Do not create speculative repair Work or start a successor Stage."
+    ].join(" ");
+}
 /** Stage entry acknowledges the packet before the controller issues child commands. */
 export function controllerStageEntryPrompt(stage, command) {
     return [
@@ -45,11 +59,11 @@ export async function nextControllerFanout(context, input) {
         if (fanout.state === "dispatch_required" || fanout.state === "capacity_required")
             return { kind: "wait", reason: "qualified_capacity_required" };
     }
-    const prompt = (text) => ({ kind: "prompt", prompt: text, fingerprint: JSON.stringify({ stage: input.stage, parent: fanout.parent_work_id, state: fanout.state, graph: fanout.graph_revision }) });
+    const prompt = (action, text) => ({ kind: "prompt", action, prompt: text, fingerprint: JSON.stringify({ stage: input.stage, parent: fanout.parent_work_id, state: fanout.state, graph: fanout.graph_revision }) });
     if (fanout.state === "coordinator_required")
-        return prompt(`Continue the current ${input.stage} Stage using its authoritative packet. Materialize only its required Work graph with real dependencies. Do not launch children, finish the Stage, or start a successor. Return after registering the graph; the runtime will dispatch its ready Work.`);
+        return prompt("materialize_graph", `Continue the current ${input.stage} Stage using its authoritative packet. Materialize only its required Work graph with real dependencies. Do not launch children, finish the Stage, or start a successor. Return after registering the graph; the runtime will dispatch its ready Work.`);
     if (fanout.works.failed || fanout.works.cancelled)
-        return prompt(`Some ${input.stage} child Work failed or was cancelled. Inspect its recorded receipts. Choose a legal scoped repair/retry or block the Stage with the concrete reason. Do not relaunch settled siblings or infer success from a child that omitted work finish.`);
+        return prompt("repair_or_block", `Some ${input.stage} child Work failed or was cancelled. Inspect its recorded receipts. Choose a legal scoped repair/retry or block the Stage with the concrete reason. Do not relaunch settled siblings or infer success from a child that omitted work finish.`);
     if (fanout.works.ready.length) {
         const choices = fanout.works.ready.map(work => {
             const payload = context.db.get("SELECT payload_json FROM works WHERE work_id = ?", [work.work_id])?.payload_json;
@@ -69,13 +83,13 @@ export async function nextControllerFanout(context, input) {
         for (const work of wave)
             if (!work.work_id || !work.start_command)
                 throw new AppError("fanout_contract_invalid", "Ready Work omits its trusted start command", 1);
-        return prompt(renderDelegationInstructions({ harness: input.harness, stage: input.stage, capacity, works: wave }));
+        return prompt("dispatch_work", renderDelegationInstructions({ harness: input.harness, stage: input.stage, capacity, works: wave }));
     }
     if (fanout.works.running)
         return { kind: "wait", reason: "work_receipts_pending" };
     if (fanout.works.created)
         throw new AppError("fanout_graph_stalled", "Created Work has no ready or running dependency path", 1);
-    return prompt(`All declared ${input.stage} child Work has settled (${fanout.works.completed} completed). Read the accepted result receipts and continue this Stage's semantic decision under its original packet. A rejected stage finish with repair_required has already registered its repair Work. End this Turn immediately so the controller can launch a fresh child; do not create another repair or invoke its start_command in this coordinator Session. Do not start a successor Stage.`);
+    return prompt("semantic_completion", semanticCompletionPrompt(input.stage, fanout.works.completed));
 }
 /** Normalize provider-observed topology only; never parse assistant prose. */
 export function controllerNativeChildren(receipt, rootSessionId) {

package/dist/services/run-controller.js

@@ -753,7 +753,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
             }
             if (state.last_continuation === fanout.fingerprint)
                 assertNoCorrelatedRejection(context, { projectId: row.project_id, runId: row.run_id, generation: row.generation, stage: next.stage, turn: state.turns });
-            retainControllerContinuation(state, fanout.fingerprint, { code: "fanout_stage_nonprogressing", message: "The coordinator repeated an unchanged Work-graph continuation", details: { stage: next.stage, before: state.last_continuation, after: fanout.fingerprint, controller_turn: state.turns } });
+            retainControllerContinuation(state, fanout.fingerprint, { code: "fanout_stage_nonprogressing", message: "The coordinator repeated an unchanged Work-graph continuation", details: { stage: next.stage, action: fanout.action, before: state.last_continuation, after: fanout.fingerprint, controller_turn: state.turns } });
             saveState(context, row, state);
             await prompt(session, fanout.prompt);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.89",
+  "version": "0.9.0-beta.90",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "bin": {
@@ -22,6 +22,20 @@
     "node": ">=26.0.0",
     "pnpm": ">=10.0.0"
   },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && node scripts/generate-build-info.mjs && node scripts/copy-assets.mjs",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint . --max-warnings=0",
+    "test": "pnpm test:release && pnpm test:integration && pnpm test:runtime-sensitive",
+    "test:release": "node --test scripts/verify-release-build.test.mjs && vitest run --pool=forks --no-file-parallelism test/publish-release.test.ts",
+    "test:integration": "vitest run --pool=forks --no-file-parallelism --exclude test/publish-release.test.ts --exclude test/run-control-worker.test.ts --exclude test/native-adapter-contracts.test.ts",
+    "test:runtime-sensitive": "vitest run --pool=forks --no-file-parallelism test/run-control-worker.test.ts test/native-adapter-contracts.test.ts",
+    "changeset": "changeset",
+    "version-packages": "changeset version",
+    "release:candidate:pack": "node scripts/release-candidate.mjs pack",
+    "release:candidate:accept": "node scripts/release-candidate.mjs accept",
+    "release:publish": "node scripts/publish-release.mjs"
+  },
   "devDependencies": {
     "@changesets/cli": "^2.31.0",
     "@eslint/js": "^9.39.1",
@@ -40,15 +54,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "license": "MIT",
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json && node scripts/generate-build-info.mjs && node scripts/copy-assets.mjs",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint . --max-warnings=0",
-    "test": "vitest run --pool=forks --no-file-parallelism",
-    "changeset": "changeset",
-    "version-packages": "changeset version",
-    "release": "pnpm run build && changeset publish",
-    "release:publish": "node scripts/publish-release.mjs"
-  }
-}
+  "license": "MIT"
+}