@deksden-com/dd-flow-cli 0.9.0-beta.94 → 0.9.0-beta.95

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.95
+
+### Patch Changes
+
+- Qualify the exact ZCode 0.16.9 / zcode-acp 0.46.7 contract @2 tuple after live public-command receipts, and reject inferred or failed native completion evidence.
+
 ## 0.9.0-beta.94
 
 ### Patch Changes

package/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.94",
-  "cli_commit": "852591e0c29473e4bc7bef90aa2f83d66b8792de",
-  "built_at": "2026-09-22T06:20:13.963Z",
+  "cli_version": "0.9.0-beta.95",
+  "cli_commit": "4c8c5e8456d684a7887c8bfdd1afc24ae874ff6c",
+  "built_at": "2026-09-22T06:50:54.211Z",
   "built_with_canon": {
     "version": "4.1.1",
     "commit": "d1a6081ab15ab92ac917ff5d037121a40c709db1",

package/dist/harness-runtime/DD-ZCODE.md

@@ -18,10 +18,18 @@ closed transport is not proof that its native descendants stopped. The adapter
 must retain causal errors, missing observations and usage completeness rather
 than turn them into successful/zero-valued results.
 
+The bridge marks heuristic ACP completion with
+`_meta.zcodeCompletionEvidence: "inferred"` and exhausted failed turns with
+`"failed"`. dd-zcode rejects these before any post-turn materializing read:
+inferred means `native_outcome_unknown` (not retryable automatically), failed
+means `zcode_turn_not_completed`. This additive evidence does not change the
+acceptance of already-qualified immutable older tuples. Native allocation
+notifications are causal identity evidence, not authorization to replay a turn.
+
 ## Bridge contract
 
 The identity check uses `--dd-harness-version` (`dd-zcode-harness@1` for existing
-qualified builds, `dd-zcode-harness@2` for the native-usage candidate) and
+qualified builds, `dd-zcode-harness@2` for the qualified v0.46.7 bridge) and
 `--dd-harness-commit`, alongside native and bridge versions. This is the current
 mechanism, not a general capability negotiation protocol. `zcodeLifecycleQualification`
 also admits exact native-binary SHA / bridge-commit tuples; a new tuple requires
@@ -56,8 +64,9 @@ remain supported through their existing measured projection. All adapter usage
 paths use the same helper; dd-flow services still own accounting deltas.
 
 Contract support does not admit a new binary/commit tuple automatically. The
-v0.46.7 @2 candidate is not added to production qualification without live
-receipts. Preserve that fail-closed distinction when preparing the next eval.
+v0.46.7 @2 tuple is admitted only for native SHA `500ae84f…f466` and bridge
+commit `f4d47b5…2833`, after a live public-command receipt probe. Preserve that
+fail-closed distinction when preparing later evals.
 
 Future consumer-only retry, recovery, readiness and accounting rules belong
 here or in the owning dd-flow service. Bridge changes are justified when native

package/dist/harness-runtime/lib/dd-zcode.mjs

@@ -752,15 +752,19 @@ async function forwardUsageBestEffort(options, providerSessionId, usage, toolCal
 }
 
 export function zcodeLifecycleQualification(sha256, bridgeCommit, harnessContract) {
-  // Behavioural evidence: dd-eval production-invocations probe, 2026-09-13.
+  // Behavioural evidence: dd-eval production-invocations probes on 2026-09-13
+  // and 2026-09-22. The latter exercised public commands, file-backed JSON,
+  // concurrent children and continuation on bridge contract @2.
   // Pin both providers of native event identity, not a string in the bundle.
   // 60af0d3 adds retainedSubagents without changing native event forwarding.
   const qualifiedTuples = new Map([
     ["e9f1868c0fdb863537ed910ee3828b9be96b8c2fd805473f63b439e1113266b8", new Set(["e0600fe3c46e215695f257e65aa6f674ced998d8", "60af0d31e13076a313d9770f10aa70f7c94742cf"])],
-    ["500ae84fa2cb8dd74c1264e5f3d3709c004c59b58899f1b0c3e205137a0ef466", new Set(["8c0a893f3c26a0b96cb138acf762db84c800298b"])],
+    ["500ae84fa2cb8dd74c1264e5f3d3709c004c59b58899f1b0c3e205137a0ef466", new Set(["8c0a893f3c26a0b96cb138acf762db84c800298b", "f4d47b517073f9bdb8d4eba3d0d59ce66c6a2833"])],
   ]);
   const qualified = qualifiedTuples.get(sha256)?.has(bridgeCommit) === true
-    && harnessContract === ZCODE_HARNESS_CONTRACT;
+    && (bridgeCommit === "f4d47b517073f9bdb8d4eba3d0d59ce66c6a2833"
+      ? harnessContract === "dd-zcode-harness@2"
+      : harnessContract === ZCODE_HARNESS_CONTRACT);
   return { status: qualified ? "qualified" : "unqualified", mechanism: "cli-invocation@1", sha256,
     capabilities: qualified ? ["root", "concurrent_children", "child_continuation"] : [],
     native_nested_children: false, reason: qualified ? null : "native_event_contract_unqualified" };
@@ -851,6 +855,15 @@ export async function promptSessionWithBridge(bridge, options) {
     inactivityMode: "diagnostic",
   });
   const stopReason = typeof turn?.stopReason === "string" ? turn.stopReason : null;
+  const completionEvidence = turn?._meta?.zcodeCompletionEvidence;
+  if (completionEvidence === "inferred" || completionEvidence === "failed") {
+    await bridge.flush();
+    const error = new Error(`ZCode completion is ${completionEvidence}, not a confirmed successful native turn`);
+    error.code = completionEvidence === "inferred" ? "native_outcome_unknown" : "zcode_turn_not_completed";
+    error.retryable = false;
+    error.details = { completion_evidence: completionEvidence, provider_session_id: identity.providerSessionId, adapter_session_id: identity.adapterSessionId };
+    throw error;
+  }
   if (stopReason && stopReason !== "end_turn") {
     // A close can settle the pending prompt before its terminal event. Do not
     // collect live evidence first: ordinary inspection is allowed to recover

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.94",
+  "version": "0.9.0-beta.95",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "bin": {