@deksden-com/dd-flow-cli 0.9.0-beta.9 → 0.9.0-beta.90

package/CHANGELOG.md

@@ -1,5 +1,464 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.90
+
+### Patch Changes
+
+- 18e2627: Require settled fan-out stages to complete their semantic decision and invoke
+  the authoritative finish command before assuming a repair exists. Report the
+  controller action that failed to make progress, and hand off repair Work only
+  after an actual lifecycle response registers it.
+- 954c676: Publish the exact CI-tested tarball through a credential-isolated release job, with deterministic test shards, package smoke, trusted candidate receipts, and safe lost-reply recovery.
+
+## 0.9.0-beta.89
+
+### Minor Changes
+
+- Register aggregate CODE and CODE-REVIEW repairs atomically from all failed receipts, with stable replay identity and stage/attempt/cycle membership. Resolve declared contextual file paths independently of lifecycle authority, retain exact native command rejection causes, and emit shell-safe commands with explicit JSON recovery inputs. Keep historical Work out of current dispatch and block ambiguous legacy fanout execution.
+
+## 0.9.0-beta.88
+
+### Patch Changes
+
+- 5f3806c: Keep managed HITL answer paths inside retained runtime authority, preserve early
+  native CLI failures, and fail controllers conclusively when an answer turn does
+  not resume its assigned pause.
+
+## 0.9.0-beta.87
+
+### Patch Changes
+
+- a49655a: Use separate files for model-authored lifecycle payloads and preserve native
+  shell-composition diagnostics instead of reporting a missing hook receipt.
+
+## 0.9.0-beta.86
+
+### Patch Changes
+
+- 8abe471: Settle invalid managed lifecycle arguments atomically before dispatch and return one safe corrected command.
+
+## 0.9.0-beta.85
+
+### Patch Changes
+
+- fe8f493: Restore runtime-owned response publication options before dispatching a managed lifecycle command, and update the controller fixture to validate the public command contract.
+
+## 0.9.0-beta.84
+
+### Patch Changes
+
+- 644d181: Keep RUN identity, project paths, context files, response destinations and
+  integrity hashes inside retained lifecycle authority instead of asking agents
+  to copy them. Restore those inputs deterministically when the observed command
+  executes, including MERGE apply and repair commands.
+
+## 0.9.0-beta.83
+
+### Patch Changes
+
+- bf69c56: Accept shell-escaped lifecycle path aliases deterministically and render model-facing aliases with stable quoting.
+
+## 0.9.0-beta.82
+
+### Patch Changes
+
+- Keep release registry readback running through delayed npm propagation while still failing authorization errors immediately.
+
+## 0.9.0-beta.81
+
+### Patch Changes
+
+- a48e3de: Canonicalize short and full RUN/Work references across native hook receipts, lifecycle admission, Work settlement, and HITL pause/resume. Keep model-facing commands short while preserving scoped ownership checks and report precise receipt mismatch reasons.
+
+## 0.9.0-beta.75
+
+### Patch Changes
+
+- Use adapter-owned native delegation instructions for Codex and the other
+  supported harnesses, preserving independent child Work ownership and clearer
+  native-session diagnostics across fan-out and recovery.
+
+## 0.9.0-beta.64
+
+### Patch Changes
+
+- Reserve SQLite writes explicitly, retain trusted lifecycle outcomes across harnesses,
+  continuously fence failed managed runs, and recover committed Work start packets and
+  replies without repeating effects. Revalidate stage inputs before acceptance and keep
+  the causal failure when adapter, publication or cleanup also fails. Writer contract 2
+  requires fresh campaign and resource homes; historical contract-1 stores are not
+  implicitly upgraded. Recovery-generation Work starts keep separate immutable packets
+  per WorkSession, preserving the interrupted attempt's evidence.
+
+## 0.9.0-beta.63
+
+### Patch Changes
+
+- Accept the qualified retained-subagent ZCode bridge and settle a control only
+  when a durable startup rejection proves that it created no native resources.
+
+## 0.9.0-beta.62
+
+### Patch Changes
+
+- Verify a controlled native Session with a fresh inspection after cancellation before treating its tree as settled.
+
+## 0.9.0-beta.61
+
+### Patch Changes
+
+- Keep the scope reconciliation contract test type-safe.
+
+## 0.9.0-beta.60
+
+### Patch Changes
+
+- Document and verify explicit reconciliation of a drained runtime scope without automatic observer respawn.
+
+## 0.9.0-beta.59
+
+### Patch Changes
+
+- Keep bundled ZCode close-contract fixtures aligned with retained native topology checks.
+
+## 0.9.0-beta.58
+
+### Patch Changes
+
+- Keep local task artifacts outside the release lint scope.
+
+## 0.9.0-beta.57
+
+### Patch Changes
+
+- Bound recovery observation, expose safe external reconciliation, and require
+  complete non-resident ZCode session-tree evidence before a stopped run settles.
+
+## 0.9.0-beta.56
+
+### Patch Changes
+
+- Keep RUN database and runtime status aligned with pause, stop, controller failures and trusted recovery. Preserve real Stage pauses and terminal results, reject late revival under a recovery fence, roll back status changes after persistence failures, and provide an explicit backed-up legacy status repair tool.
+
+## 0.9.0-beta.55
+
+### Patch Changes
+
+- Require autonomous check evidence, preflight commands in their actual workspace, bind final retry arguments, and settle ZCode cancellation through verified native residency. Retain closed sessions without implicit resume and store growing transcripts in reusable content-addressed chunks.
+
+## 0.9.0-beta.54
+
+### Patch Changes
+
+- Preserve current lifecycle command input, atomically settle retry authority, select current resume commands, and stop ZCode productive admission immediately on fatal identity errors. Reject ambiguous result inputs and keep diagnostic commands read-only.
+
+## 0.9.0-beta.53
+
+### Patch Changes
+
+- Admit managed ZCode lifecycle commands through durable invocation receipts, with exact native identity, bounded waits, retained outcomes and explicit validated retries. Preserve recovery generations, cooperative settlement, immutable recovery evidence and scoped snapshots. Keep Grok native hook responses and stable parent identity, and qualify the installed ZCode native event contract without requiring child hooks. Use Node 26 for the guarded release workflow.
+
+## 0.9.0-beta.52
+
+### Patch Changes
+
+- Distinguish released workspace leases from physical processes during stage-boundary capture, RUN settlement and runtime-scope stop/drain. Preserve active-lease, child-process, physical-identity and exact registration checks instead of waiting forever for a PID on a logical gate.
+
+## 0.9.0-beta.51
+
+### Patch Changes
+
+- Settle a check receipt when its confirmed process identity has exited, even if an older registration has no parent-owner PID.
+
+## 0.9.0-beta.50
+
+### Patch Changes
+
+- 422413d: Keep PLAN, PLAN-REVIEW, CODE and CODE-REVIEW settlement atomic across Work, Session and RUN state, including successor Work registration. Recover accepted CODE stage completion without repeating checks. Enforce coordinator ownership on repeated CODE start and exact reviewer coverage while preserving protocol-local aspect scopes.
+- 422413d: Reuse completed check evidence consistently across CODE, CODE-REVIEW and MERGE,
+  with validated inputs, artifacts, retry handling and concurrent execution guards.
+
+## 0.9.0-beta.49
+
+### Patch Changes
+
+- Treat a completed CODE gate command that returns `code_gate_failed` as terminal
+  recovery evidence, so the coordinator creates the returned repair Work instead
+  of waiting indefinitely or duplicating the aggregate gate.
+
+## 0.9.0-beta.48
+
+### Patch Changes
+
+- Recheck a controller lease after a transient runtime-registry write failure before
+  dispatching more work, while retaining the hard stop for an explicit lease loss.
+
+## 0.9.0-beta.47
+
+### Patch Changes
+
+- Initialize the managed Codex hook home for external worker sessions so their
+  first `work start` receives a trusted session binding.
+
+## 0.9.0-beta.44
+
+### Patch Changes
+
+- Allow a managed native session prompt to run for two hours before the outer
+  adapter watchdog cancels it, while retaining the existing short timeout for
+  non-productive adapter calls.
+
+## 0.9.0-beta.43
+
+### Patch Changes
+
+- 78e3eaf: Keep Codex prompt and inspection receipts compact by returning historical turn
+  identities and statuses without duplicating their item transcripts. Preserve the
+  current result, final answer, native history reference, descendants and observed
+  profile so long-running sessions remain within the bounded adapter reply limit.
+
+## 0.9.0-beta.42
+
+### Patch Changes
+
+- 3e1f87f: Reuse an already accepted RUN pause or stop when draining its EVAL scope, preserving the exact control identity and options without weakening stop or replaying work.
+
+## 0.9.0-beta.41
+
+### Patch Changes
+
+- c30ae89: Run generated Codex hooks with the explicitly selected CLI, or the isolated runtime shim before global installations. Preserve hook input and fail without a global fallback when the selected CLI is unavailable.
+
+## 0.9.0-beta.40
+
+### Patch Changes
+
+- 2b4b714: Admit ordinary managed HITL answers through their exact generation-bound native
+  prompt, preserving pause, Session, raw-answer and prompt integrity. Keep accepted
+  answer intent separate from physical delivery so stop drains native operations
+  and recovery can deliver an unanswered pause without replaying completed work.
+- c5eeb6f: Capture owned Codex home configuration and evidence without copying shared host
+  history or ephemeral helper links. Reuse the provisioned shared-entry contract
+  and retain strict rejection of unrelated external recovery artifact links.
+
+## 0.9.0-beta.39
+
+### Patch Changes
+
+- 803d2d0: Own managed Stage/Work execution, immutable boundary captures, mixed-profile handoffs and operator pause/stop/resume in the shared CLI runtime. Fence productive admission durably, reconcile exact native/process generations, preserve interrupted and unknown outcomes, and resume retained sessions without replaying completed work.
+
+  Control experiment-wide Subject, Judge and probe ownership through one retained resource registry, with detached control/recovery workers and explicit physical drain and release evidence. Require guarded shared-store migration and current runtime bindings; remove dependence on eval-owned productive adapters.
+
+  Discover native Codex children from spawn receipts and release terminal failed provider turns only after a fresh settled-tree observation.
+
+## 0.9.0-beta.38
+
+### Patch Changes
+
+- 44e3c80: Allow control operations to recheck failed provider cleanup after a leaderless process group exits naturally. Coalesce concurrent finalization retries, preserve the original exit and process lease, and keep live or unproven groups blocked without sending them signals.
+
+## 0.9.0-beta.37
+
+### Patch Changes
+
+- Wait for Antigravity provider-exit finalization before acknowledging clean shutdown or replacing the provider, preserving interrupted outcomes and cleanup failures. Treat signal-terminated process leaders as exited when checking remaining group ownership, and release completed initialization timers.
+
+## 0.9.0-beta.36
+
+### Patch Changes
+
+- Scope retained Antigravity tree liveness to its verified daemon shutdown before same-session recovery, preserving native outcomes and immutable prior receipts. New native tool or step activity still blocks overlapping prompt admission.
+
+## 0.9.0-beta.35
+
+### Patch Changes
+
+- Wait for npm registry propagation and verify the annotated tag created by Changesets before completing a guarded release.
+- Keep AGY native outcomes separate from settlement, invalidate old child settlement on new activity, and reserve productive operations before persistence across adapters.
+- Retain process-local native Stop observation in no-flow technical probes without installing project hooks or forwarding flow mutations.
+- Publish Work receipts after the authoritative SQL commit with resumable publication intents; preserve conflicting bytes, resume partial retries, and retain non-restorable diagnostic snapshots when receipts disagree.
+- Freeze the release source/canon tuple, reconcile uncertain publication, verify the isolated and exact global consumer, and retain phase receipts without creating another version on retry.
+
+## 0.9.0-beta.34
+
+### Patch Changes
+
+- Create and verify the immutable annotated Git tag as part of the guarded release publication.
+
+## 0.9.0-beta.33
+
+### Patch Changes
+
+- Add the guarded `release:publish` entrypoint that validates local npm auth,
+  checks the quality gate, verifies the published build metadata, and refreshes
+  the installed runtime before a release is considered complete.
+
+## 0.9.0-beta.32
+
+### Patch Changes
+
+- Reject reviewer results without per-aspect evidence when the Work is finished, and distinguish missing evidence from an aspect-coverage mismatch in legacy stage validation.
+
+## 0.9.0-beta.31
+
+### Patch Changes
+
+- Treat an authoritative fully-idle Antigravity root Stop as settlement evidence
+  for otherwise unobserved native children, while preserving their distinct
+  `settled_by_root` status rather than claiming individual completion.
+
+## 0.9.0-beta.30
+
+### Patch Changes
+
+- Bound Antigravity prompt liveness from the most recent native activity and preserve clean recovery settlement after an expired prompt.
+
+## 0.9.0-beta.29
+
+### Patch Changes
+
+- Recover completed stage boundaries without reopening accepted Work, and reject
+  stale coordinator identities and retired recovery generations.
+
+  Scope Antigravity terminal results and retained accounting to the current
+  conversation progress; preserve OpenCode and ACP provider errors for the actual
+  prompt. Keep configured adapter journals and bundled hook-denial behavior intact.
+
+## 0.9.0-beta.28
+
+### Patch Changes
+
+- Accept an authoritative terminal Antigravity root result when the provider omits a root Stop hook, while retaining fail-closed behavior for an observed non-idle tree.
+
+## 0.9.0-beta.27
+
+### Patch Changes
+
+- Resume retained native sessions from their active coordinator WorkSession, preserving the root launch record and rejecting lifecycle receipts from retired daemons.
+- Propagate Antigravity lifecycle hooks to direct native children while preserving workspace hooks, and settle confirmed Codex system-error turns without losing provider failure evidence.
+
+## 0.9.0-beta.26
+
+### Patch Changes
+
+- Reject interactive terminal input for Work and Stage result submission before routing or lifecycle dispatch. Require a pipe, input redirection, or result file so long JSON cannot be truncated by terminal input limits while progress appears to run indefinitely.
+
+## 0.9.0-beta.25
+
+### Patch Changes
+
+- Publish the final serial CLI test isolation together with the current bundled harness fixes.
+
+## 0.9.0-beta.24
+
+### Patch Changes
+
+- Retain supplemental files written to the check evidence directory in normal and recovered receipts. Keep required artifacts as minimum obligations and exclude symlinks.
+
+  Carry the verified cancellation guards, child settlement and process identity recovery fixes into the bundled harness adapters. Preserve native terminal events when an older Codex turn-page response arrives later.
+
+- Run CLI tests in isolated, serial file processes so process-global test state cannot leak between suites.
+
+## 0.9.0-beta.23
+
+### Minor Changes
+
+- bcfd8cb: Ship the six managed provider adapters with the CLI runtime, including their
+  daemon primitives and public adapter entrypoints. Add frozen mixed-execution
+  policy resolution and durable explicit external Work launch without changing a
+  same-profile external request into native delegation.
+
+## 0.9.0-beta.22
+
+### Patch Changes
+
+- Reject conflicting or ambiguous lifecycle receipts before any harness can
+  mutate a Session binding. Restore a Work-start receipt when its binding
+  fails, so the same verified invocation remains safely retryable.
+
+## 0.9.0-beta.21
+
+### Patch Changes
+
+- Validate every selected engine artifact and execute its pinned snapshot even when its version matches the router. Retain a new recovery interruption before root acknowledgement.
+
+## 0.9.0-beta.20
+
+### Patch Changes
+
+- Verify recovery payloads and workspace drift before resuming, preserve staged Git changes, publish snapshots through a temporary directory, and allow explicit recovery restoration into fresh targets. Fence RUN mutations and late asynchronous Work completion while recovery is active.
+
+## 0.9.0-beta.19
+
+### Patch Changes
+
+- Require a fresh trusted hook receipt from the physical Work owner before terminal stage or Work lifecycle commands can mutate a vNext RUN. Record terminal native-child observations at their originating Stage so unbound delegation is retained as a diagnostic instead of contaminating a later fan-out wave.
+
+## 0.9.0-beta.18
+
+### Patch Changes
+
+- Add Factory Droid harness routing, native lifecycle receipts and physical Session usage ingestion. Preserve child identity and reject conflicting hook replays or inclusive Droid usage to prevent incorrect Work binding and double counting.
+
+## 0.9.0-beta.17
+
+### Patch Changes
+
+- 0dd4da3: Verify current-attempt gate retries, deduplicate equivalent checks across gate references, retain archive locations across interrupted and repeated repairs, and align MERGE environment recovery guidance with source repair.
+
+  Snapshot SQLite consistently with VACUUM INTO and exclude local environment secrets, dependencies and caches from project/workspace snapshots.
+
+  Reconcile native child failures only against unique registered Work/Session attempts, retain non-restorable incomplete snapshots for failed evals, and expose unexpected merge-lane release failures for safe retry.
+
+## 0.9.0-beta.16
+
+### Patch Changes
+
+- Make repair verification causal and retryable, preserve attempt-qualified
+  evidence, expose RUN continuation from persisted lifecycle state, and keep
+  native child ownership bound to the physical harness session.
+
+## 0.9.0-beta.15
+
+### Patch Changes
+
+- Add owned temporary HTTP service supervision with allocated ports and readiness receipts. Prevent duplicate workspace bootstrap processes, retain resources when process ownership is uncertain, and share safe stop behavior between explicit stops and orphan reconciliation.
+
+## 0.9.0-beta.14
+
+### Patch Changes
+
+- Audit runtime recovery: distinguish process owners from children, retain live check resources, await failed check startup cleanup, share managed workspace bootstrap between CODE/MERGE, correct assigned repair examples, and reject publication without canonical build provenance.
+
+## 0.9.0-beta.13
+
+### Patch Changes
+
+- Make long-running CODE checks suspend-safe and prevent an expired lease from
+  stealing a live process. Publish `dd-flow/code-work-result@3`, which unifies
+  repair resolutions with evidence references assigned by the Work packet.
+
+## 0.9.0-beta.12
+
+### Patch Changes
+
+- Return a failed integration gate to an explicit source CODE and independent
+  CODE-REVIEW repair cycle, instead of allowing product repairs in the
+  integration workspace.
+
+## 0.9.0-beta.11
+
+### Patch Changes
+
+- Bind a native Codex subagent Work to the child Thread identifier supplied as
+  `agent_id`, rather than Codex's inherited root hook session identifier.
+
+## 0.9.0-beta.10
+
+### Patch Changes
+
+- 4858f6d: Preserve complete CODE review findings through repair and require one evidenced resolution per assigned finding.
+
 ## 0.9.0-beta.9
 
 ### Patch Changes
@@ -829,6 +1288,7 @@ record` command with the bounded 15-probe contract.
 - 16f68a3: Add router-native engine snapshot commands and routed project-command dispatch.
 
   Also include the runtime/dashboard compatibility wave needed by the current Memory Bank canon:
+
   - target-based dashboard `open`/`refresh` commands and related-command help;
   - persisted FIFO lane waiters and merge wait-acquire specialization;
   - `migration plan/report/verify` evidence helpers for controlled `mb-upgrade` runtime migrations;

package/README.md

@@ -1,9 +1,52 @@
 # dd-flow-cli
 
+## Managed temporary HTTP services
+
+For an interactive scenario, `runtime process start --run <RUN-ID>
+--project-root <absolute-project> --command '<project command>' --ports api
+--ready-port api --ready-path /health --json --progress-jsonl` runs a foreground
+supervisor. The command receives `DD_FLOW_PORT_API`; use it instead of a fixed
+port. Additional comma-separated names receive equivalent environment variables.
+The ready event points to a receipt and logs under the RUN's `runtime/` folder.
+Keep the tool invocation alive, run the scenario using the allocated ports,
+then execute the exact `stop_command` in that receipt and await the supervisor.
+Readiness is not a scenario pass. Keep semantic/scenario evidence separately.
+Never use a broad `pkill`/`killall`. A failed owned stop retains resources.
+
 `dd-flow-cli` is the mechanical control layer for `dd-flow` workflows.
 
 It does not replace Memory Bank prompts and does not make product, design, merge, or verification judgments. Prompts own intent, route selection, planning depth, evidence meaning, and semantic readiness. The CLI owns explicit local state: projects, protocols, Codex session bindings, transitions, worktree records, lanes, locks, merge queue jobs, hook records, and audit events.
 
+## Factory Droid harness
+
+Configure `droid-cli` in `~/.dd-flow/harnesses.json` with absolute
+`adapter_command` (`dd-droid`) and `runtime_command` (`droid`) paths. Agent
+profiles use the `droid` alias; the adapter receives `--droid-bin`.
+
+The controlled adapter sends `dd-flow/droid-tool-event@1` JSON to
+`dd-flow droid event handle --project-root <root> --json`. Events include a
+stable `event_id`, `daemon_id`, `phase` (`before` or `after`), native Session
+identity and parent, absolute Session directory, `Execute` input, observed
+profile and transcript path. Before a lifecycle invocation, the returned
+`hookSpecificOutput.updatedInput` adds its one-use `--hook-event-id` receipt.
+The event ID belongs to the native hook invocation and is reused only for
+transport retries. Session success is established by the Work contract.
+
+`dd-flow droid usage ingest --project-root <root> --json` accepts cumulative
+per-Session counters with explicit `usage_scope: physical_session` and
+`completeness: complete|partial`. Inclusive root counters are rejected;
+partial windows remain unavailable in RUN totals until complete evidence
+arrives. Keep inclusive provider totals in adapter evidence for reconciliation.
+
+## Check evidence
+
+Checks write evidence into their invocation's `DD_FLOW_EVIDENCE_DIR`. Receipts
+retain and hash every regular file in that directory, including nested files.
+`required_artifacts` specifies the minimum files needed to pass, so an empty
+list still permits supplemental screenshots or reports. Missing required files
+fail the check. Symlinks are not followed or registered. The same collection
+rules apply when recovering a detached check from its completion marker.
+
 ## Runtime Model
 
 Root local database:
@@ -409,3 +452,25 @@ pnpm build
 ```
 
 Manual smoke checks should use a temporary `DD_FLOW_HOME` when they do not intentionally inspect the operator's real local state.
+
+### RUN status during recovery
+
+A controller failure pauses the logical RUN without rewriting its Stage/Work
+outcomes. Accepted pause/stop or recovery intent immediately persists `paused` in the RUN row,
+`index_json`, and `run.json`. A trusted recovery acknowledgement restores the
+operational status; an existing Stage/Work pause remains paused. Terminal RUNs
+are never reopened. Physical tree settlement remains a separate control receipt.
+
+Legacy stores with a fenced recovery may still contain `running`. After building,
+inspect one exact RUN with:
+
+```sh
+node tools/repair-paused-run-status.mjs --home /path/to/dd-flow-home --project PRJ-001-project --run RUN-001-eval-subject
+```
+
+Add `--apply` to repair it. This requires the latest recovery to be draining, sealed or resuming, saves the original row and runtime JSON
+beside `run.json`, and changes no schema, engine binding or recovery capture.
+It does not claim physical settlement or alter its receipts. `--cancel-abandoned`
+explicitly cancels an abandoned fixture only when the project directory is absent
+and it has no Work, Session, controller or recovery history. Historical experiment
+engine snapshots remain pinned; rebuild/release the engine for future executions.

package/dist/build-info.json

@@ -1,15 +1,15 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.9",
-  "cli_commit": "7c6e37d05c8039349dee26fb7446abd6dcaef136",
-  "built_at": "2026-09-04T15:11:45.164Z",
+  "cli_version": "0.9.0-beta.90",
+  "cli_commit": "a4e9733f871af5032fc372d324d8fd0dfd2ec44f",
+  "built_at": "2026-09-21T11:54:11.387Z",
   "built_with_canon": {
-    "version": "4.0.1",
-    "commit": "71c62fccbfa32c61ae77874ff42c8f9fb19e9f81",
+    "version": "4.1.1",
+    "commit": "d1a6081ab15ab92ac917ff5d037121a40c709db1",
     "flow_contract": "dd-flow-canonical-2026-08",
-    "repo_root": "/Users/deksden/Documents/_Projects/dd-memorybank",
-    "memorybank_root": "/Users/deksden/Documents/_Projects/dd-memorybank/.memory-bank",
-    "flow_root": "/Users/deksden/Documents/_Projects/dd-memorybank/.memory-bank/dd-flow",
+    "repo_root": "/home/runner/work/dd-flow-cli/dd-flow-cli/dd-memorybank",
+    "memorybank_root": "/home/runner/work/dd-flow-cli/dd-flow-cli/dd-memorybank/.memory-bank",
+    "flow_root": "/home/runner/work/dd-flow-cli/dd-flow-cli/dd-memorybank/.memory-bank/dd-flow",
     "layout": "dot_memory_bank"
   }
 }