@diff-review-system/drs 4.0.0-rc.4 → 4.1.0

package/dist/cli/workflow.js

@@ -1,26 +1,34 @@
 import { mkdir, readFile, writeFile } from 'fs/promises';
-import { dirname } from 'path';
+import { dirname, join } from 'path';
 import simpleGit from 'simple-git';
 import chalk from 'chalk';
-import { getDescriberModelOverride, loadWorkflowSourceInfo, normalizeAgentConfig, resolveAgentRunConfig, } from '../lib/config.js';
+import { getDescriberModelOverride, getReviewAgentIds, loadWorkflowSourceInfo, normalizeAgentConfig, resolveAgentRunConfig, } from '../lib/config.js';
 import { resolveWithinWorkingDir } from '../lib/path-utils.js';
 import { parseDiff, getChangedFiles, getFilesWithDiffs } from '../lib/diff-parser.js';
-import { parseValidLinesFromPatch } from '../lib/diff-lines.js';
+import { parseDiffLineInfo } from '../lib/diff-lines.js';
 import { connectToRuntime, executeReview, filterIgnoredFiles, } from '../lib/review-orchestrator.js';
-import { ExitError, setExitHandler } from '../lib/exit.js';
 import { postReviewComments } from '../lib/comment-poster.js';
-import { findExistingCommentById } from '../lib/comment-manager.js';
+import { findExistingCommentById, createIssueFingerprint } from '../lib/comment-manager.js';
 import { removeErrorComment } from '../lib/error-comment-poster.js';
 import { runDescribeIfEnabled } from '../lib/description-executor.js';
 import { buildBaseInstructions } from '../lib/review-core.js';
 import { resolveCursorFixLinkOptions } from '../lib/cursor-fix-link.js';
-import { enforceRepoBranchMatch, getCanonicalDiffCommand, resolveBaseBranch, } from '../lib/repository-validator.js';
+import { extractHtmlDocument, parseArtifactOutputPointer, readArtifactOutputPointer, validateHtmlArtifact, } from '../lib/html-artifact.js';
+import { getCanonicalDiffCommand, resolveBaseBranch } from '../lib/repository-validator.js';
 import { formatCodeQualityReport, generateCodeQualityReport } from '../lib/code-quality-report.js';
 import { createGitHubClient } from '../github/client.js';
 import { GitHubPlatformAdapter } from '../github/platform-adapter.js';
 import { createGitLabClient } from '../gitlab/client.js';
 import { GitLabPlatformAdapter } from '../gitlab/platform-adapter.js';
+import { loadWorkflowArtifact, saveWorkflowArtifact, updateWorkflowArtifact, workflowArtifactExists, } from '../lib/workflow-artifacts.js';
+import { addReviewArtifactFinding, createReviewArtifactPayload, getReviewArtifactStatus, isReviewArtifactPayload, updateReviewArtifactFindings, } from '../lib/review-artifact.js';
 import { runAgent } from './run-agent.js';
+import { TraceCollector } from '../lib/trace-collector.js';
+import { renderTraceHtml } from '../lib/trace-html.js';
+import { buildWorkflowGraph, formatWorkflowGraphMermaid, } from '../lib/workflow/graph.js';
+import { computeActiveWorkflowNodes, createSkippedWorkflowNodeResult, findWorkflowSegmentIndex, getNodeKind, getNodeNeeds, getWorkflowExecutionOrder, getWorkflowExecutionWaves, getWorkflowNodeSkipReason, getWorkflowNodes, hasWorkflowControlNodes, normalizeWorkflowBooleanLike, renderTemplate, runControlWorkflowNode, splitWorkflowSegments, } from '../lib/workflow/planning.js';
+import { getWorkflowInputConfigType } from '../lib/workflow/input.js';
+export { compileWorkflowPlan, } from '../lib/workflow/compiled-plan.js';
 function createWorkflowLock() {
     return { current: Promise.resolve() };
 }
@@ -76,121 +84,80 @@ function getWorkflowPlatformClient(executionContext, platform) {
     executionContext.platformClients[platform] = client;
     return client;
 }
-function getNodeNeeds(node) {
-    if (node.needs === undefined) {
-        return [];
-    }
-    if (!Array.isArray(node.needs)) {
-        throw new Error('Workflow node "needs" must be an array of node ids.');
-    }
-    return node.needs;
-}
-function getWorkflowExecutionOrder(nodes) {
-    const nodeIds = Object.keys(nodes);
-    const visiting = new Set();
-    const visited = new Set();
-    const order = [];
-    function visit(nodeId) {
-        if (visited.has(nodeId)) {
-            return;
-        }
-        if (visiting.has(nodeId)) {
-            throw new Error(`Workflow contains a dependency cycle at node "${nodeId}".`);
-        }
-        const node = nodes[nodeId];
-        if (!node) {
-            throw new Error(`Workflow references unknown node "${nodeId}".`);
-        }
-        visiting.add(nodeId);
-        for (const dependency of getNodeNeeds(node)) {
-            if (!nodes[dependency]) {
-                throw new Error(`Workflow node "${nodeId}" needs unknown node "${dependency}".`);
-            }
-            visit(dependency);
-        }
-        visiting.delete(nodeId);
-        visited.add(nodeId);
-        order.push(nodeId);
-    }
-    for (const nodeId of nodeIds) {
-        visit(nodeId);
-    }
-    return order;
-}
-function getWorkflowNodes(workflowName, workflow) {
-    const nodes = workflow.nodes;
-    if (typeof nodes !== 'object' ||
-        nodes === null ||
-        Array.isArray(nodes) ||
-        Object.keys(nodes).length === 0) {
-        throw new Error(`Workflow "${workflowName}" must define at least one node.`);
-    }
-    return nodes;
-}
-function getWorkflowExecutionWaves(nodes, executionOrder) {
-    const depthByNode = new Map();
-    const waves = [];
-    for (const nodeId of executionOrder) {
-        const node = nodes[nodeId];
-        if (!node) {
-            throw new Error(`Workflow references unknown node "${nodeId}".`);
-        }
-        const depth = getNodeNeeds(node).reduce((maxDepth, dependency) => {
-            return Math.max(maxDepth, (depthByNode.get(dependency) ?? 0) + 1);
-        }, 0);
-        depthByNode.set(nodeId, depth);
-        waves[depth] = waves[depth] ?? [];
-        waves[depth].push(nodeId);
-    }
-    return waves;
-}
-function getPathValue(root, path) {
-    return path.split('.').reduce((current, part) => {
-        if (current === undefined || current === null) {
-            return undefined;
-        }
-        if (typeof current !== 'object') {
-            return undefined;
-        }
-        return current[part];
-    }, root);
-}
-function stringifyTemplateValue(value) {
-    if (value === undefined) {
-        return '';
-    }
-    if (typeof value === 'string') {
-        return value;
-    }
-    return JSON.stringify(value, null, 2);
-}
-function renderTemplate(template, context) {
-    return template.replace(/\{\{\s*([^}]+?)\s*\}\}/g, (_match, rawPath) => {
-        const path = rawPath.trim();
-        const value = getPathValue(context, path);
-        if (value === undefined) {
-            throw new Error(`Unknown workflow template value "{{${path}}}".`);
-        }
-        return stringifyTemplateValue(value);
+async function flushWorkflowTrace(traceCollector, workflowName, inputs, startedAt, workingDir, options) {
+    const workflowTrace = traceCollector.buildWorkflowTrace(workflowName, inputs, startedAt);
+    const scope = {
+        platform: 'local',
+        projectId: workflowName,
+        subject: 'trace',
+    };
+    const savedJson = await saveWorkflowArtifact(workingDir, {
+        kind: 'trace',
+        scope,
+        payload: workflowTrace,
     });
+    const traceHtmlPath = join(dirname(savedJson.path), 'trace.html');
+    const html = renderTraceHtml(workflowTrace);
+    await writeWorkflowFile(workingDir, traceHtmlPath, html);
+    if (!options.jsonOutput) {
+        console.log(chalk.green(`\n✓ Trace saved to ${savedJson.latestPath}`));
+        console.log(chalk.green(`✓ Trace viewer saved to ${traceHtmlPath}`));
+    }
 }
 async function resolveWorkflowInput(key, input, workingDir) {
     if (typeof input === 'string') {
         return input;
     }
-    const hasValue = input.value !== undefined;
+    const hasValue = input.value !== undefined || input.default !== undefined;
     const hasFile = input.file !== undefined;
     if (hasValue && hasFile) {
-        throw new Error(`Workflow input "${key}" cannot define both value and file.`);
+        throw new Error(`Workflow input "${key}" cannot define both value/default and file.`);
     }
     if (hasValue) {
-        return input.value ?? '';
+        return String(input.value ?? input.default ?? '');
     }
     if (hasFile) {
         const inputPath = resolveWithinWorkingDir(workingDir, input.file ?? '', 'read');
         return readFile(inputPath, 'utf-8');
     }
-    throw new Error(`Workflow input "${key}" must define value or file.`);
+    if (input.required === true) {
+        return '';
+    }
+    return '';
+}
+function validateResolvedWorkflowInput(key, input, value) {
+    if (typeof input === 'string') {
+        return;
+    }
+    if (input.required === true && value.trim() === '') {
+        throw new Error(`Workflow input "${key}" is required.`);
+    }
+    const type = getWorkflowInputConfigType(input);
+    if (type === 'boolean') {
+        if (normalizeWorkflowBooleanLike(value) === undefined) {
+            throw new Error(`Workflow input "${key}" must be a boolean value.`);
+        }
+        return;
+    }
+    if (type === 'number') {
+        if (value.trim() === '' || !Number.isFinite(Number(value))) {
+            throw new Error(`Workflow input "${key}" must be a number.`);
+        }
+        return;
+    }
+    if (type === 'enum') {
+        const allowedValues = input.values?.map(String) ?? [];
+        if (allowedValues.length === 0) {
+            throw new Error(`Workflow input "${key}" with type enum must define values.`);
+        }
+        if (!allowedValues.includes(value)) {
+            throw new Error(`Workflow input "${key}" must be one of: ${allowedValues.join(', ')}.`);
+        }
+        return;
+    }
+    if (type !== 'string') {
+        throw new Error(`Workflow input "${key}" has unsupported type "${type}".`);
+    }
 }
 async function resolveWorkflowInputs(workflow, options, workingDir) {
     const values = {};
@@ -204,6 +171,9 @@ async function resolveWorkflowInputs(workflow, options, workingDir) {
         const resolvedPath = resolveWithinWorkingDir(workingDir, filePath, 'read');
         values[key] = await readFile(resolvedPath, 'utf-8');
     }
+    for (const [key, input] of Object.entries(workflow.inputs ?? {})) {
+        validateResolvedWorkflowInput(key, input, values[key] ?? '');
+    }
     return values;
 }
 function resolveAgentsFrom(config, agentsFrom) {
@@ -212,17 +182,6 @@ function resolveAgentsFrom(config, agentsFrom) {
     }
     throw new Error(`Unsupported workflow agentsFrom "${agentsFrom}". ` + 'Currently supported: review.agents.');
 }
-function getNodeKind(node) {
-    const configuredKinds = [node.agent, node.agentsFrom, node.action].filter((value) => value !== undefined).length;
-    if (configuredKinds !== 1) {
-        throw new Error('Workflow node must define exactly one of agent, agentsFrom, or action.');
-    }
-    if (node.agent !== undefined)
-        return 'agent';
-    if (node.agentsFrom !== undefined)
-        return 'agents';
-    return 'action';
-}
 function hasConfiguredAgentPrompt(config, agentId) {
     const runConfig = resolveAgentRunConfig(config, agentId);
     return runConfig.prompt !== undefined || runConfig.promptFile !== undefined;
@@ -247,6 +206,35 @@ async function writeWorkflowFile(workingDir, relativeOutputPath, content) {
     await mkdir(dirname(outputPath), { recursive: true });
     await writeFile(outputPath, content, 'utf-8');
 }
+async function formatWorkflowNodeWriteContent(workingDir, nodeId, writes, content) {
+    if (!/\.html?$/i.test(writes)) {
+        return content;
+    }
+    const pointer = parseArtifactOutputPointer(content);
+    if (pointer) {
+        if (pointer.outputPath !== writes) {
+            throw new Error(`Workflow node "${nodeId}" artifact pointer wrote "${pointer.outputPath}" but workflow expected "${writes}".`);
+        }
+        return readArtifactOutputPointer(workingDir, pointer);
+    }
+    try {
+        const html = extractHtmlDocument(content);
+        validateHtmlArtifact(html);
+        return html;
+    }
+    catch (error) {
+        try {
+            return await readArtifactOutputPointer(workingDir, {
+                outputType: 'artifact_output',
+                outputPath: writes,
+            });
+        }
+        catch {
+            // If the agent did not write a valid artifact itself, surface the response validation error.
+        }
+        throw new Error(`Workflow node "${nodeId}" produced invalid HTML output: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 function renderNodeWritesPath(nodeId, node, context) {
     if (!node.writes) {
         return undefined;
@@ -257,7 +245,7 @@ function renderNodeWritesPath(nodeId, node, context) {
     }
     return writes;
 }
-async function runAgentWorkflowNode(config, nodeId, node, options, workingDir, context) {
+async function runAgentWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext) {
     const agentId = node.agent;
     if (!agentId) {
         throw new Error(`Workflow node "${nodeId}" is missing agent.`);
@@ -267,17 +255,25 @@ async function runAgentWorkflowNode(config, nodeId, node, options, workingDir, c
         throw new Error(`Workflow agent node "${nodeId}" must define input or configure ` +
             `agents.overrides.${agentId}.run.prompt/promptFile.`);
     }
-    const result = await runAgent(config, agentId, createAgentOptions(prompt, options, workingDir));
+    const agentOptions = createAgentOptions(prompt, options, workingDir);
+    if (executionContext?.traceCollector && prompt) {
+        agentOptions.traceCollector = executionContext.traceCollector;
+        executionContext.traceCollector.setContext(nodeId, agentId, prompt);
+    }
+    const result = await runAgent(config, agentId, agentOptions);
     const writes = renderNodeWritesPath(nodeId, node, context);
+    const output = writes
+        ? await formatWorkflowNodeWriteContent(workingDir, nodeId, writes, node.json === true ? JSON.stringify(result, null, 2) : result.response)
+        : result.response;
     if (writes) {
-        await writeWorkflowFile(workingDir, writes, node.json === true ? JSON.stringify(result, null, 2) : result.response);
+        await writeWorkflowFile(workingDir, writes, output);
     }
     return {
         id: nodeId,
         type: 'agent',
         agent: agentId,
         response: result.response,
-        output: result.response,
+        output,
         writes,
     };
 }
@@ -323,9 +319,64 @@ async function runActionWorkflowNode(config, nodeId, node, options, workingDir,
     if (node.action === 'git-add') {
         return runGitAddWorkflowNode(nodeId, node, workingDir, context, executionContext);
     }
+    if (node.action === 'git-branch') {
+        return runGitBranchWorkflowNode(nodeId, node, workingDir, context, executionContext);
+    }
     if (node.action === 'git-commit') {
         return runGitCommitWorkflowNode(nodeId, node, workingDir, context, executionContext);
     }
+    if (node.action === 'git-push') {
+        return runGitPushWorkflowNode(nodeId, node, workingDir, context, executionContext);
+    }
+    if (node.action === 'has-diff') {
+        return runHasDiffWorkflowNode(nodeId, node, workingDir, context, executionContext);
+    }
+    if (node.action === 'stack-guard') {
+        return runStackGuardWorkflowNode(nodeId, node, context);
+    }
+    if (node.action === 'review-threshold') {
+        return runReviewThresholdWorkflowNode(nodeId, node, context);
+    }
+    if (node.action === 'save-artifact') {
+        return runSaveArtifactWorkflowNode(nodeId, node, workingDir, context, executionContext);
+    }
+    if (node.action === 'load-artifact') {
+        return runLoadArtifactWorkflowNode(nodeId, node, workingDir, context, executionContext);
+    }
+    if (node.action === 'artifact-exists') {
+        return runArtifactExistsWorkflowNode(nodeId, node, workingDir, context, executionContext);
+    }
+    if (node.action === 'create-review-artifact') {
+        return runCreateReviewArtifactWorkflowNode(nodeId, node, context);
+    }
+    if (node.action === 'review-artifact-status') {
+        return runReviewArtifactStatusWorkflowNode(nodeId, node, context);
+    }
+    if (node.action === 'review-artifact-add-finding') {
+        return runReviewArtifactAddFindingWorkflowNode(nodeId, node, workingDir, context);
+    }
+    if (node.action === 'review-artifact-update-findings') {
+        return runReviewArtifactUpdateFindingsWorkflowNode(nodeId, node, workingDir, context);
+    }
+    if (node.action === 'verify-fix') {
+        return runVerifyFixWorkflowNode(nodeId, node, workingDir, context);
+    }
+    if (node.action === 'review-artifact-promote-finding') {
+        return runReviewArtifactUpdateFindingsWorkflowNode(nodeId, node, workingDir, context, {
+            disposition: 'confirmed',
+        });
+    }
+    if (node.action === 'review-artifact-resolve-finding') {
+        return runReviewArtifactUpdateFindingsWorkflowNode(nodeId, node, workingDir, context, {
+            state: 'resolved',
+            disposition: 'resolved',
+        });
+    }
+    if (node.action === 'create-change-request' ||
+        node.action === 'create-pr' ||
+        node.action === 'create-mr') {
+        return runCreateChangeRequestWorkflowNode(nodeId, node, context, executionContext);
+    }
     if (node.action === 'change-source') {
         return runChangeSourceWorkflowNode(nodeId, node, workingDir, context, executionContext);
     }
@@ -347,6 +398,9 @@ async function runActionWorkflowNode(config, nodeId, node, options, workingDir,
     if (node.action === 'post-review-comments') {
         return runPostReviewCommentsWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext);
     }
+    if (node.action === 'post-fix-status') {
+        return runPostFixStatusWorkflowNode(nodeId, node, options, workingDir, context, executionContext);
+    }
     throw new Error(`Unsupported workflow action "${node.action}" in node "${nodeId}".`);
 }
 async function runWriteWorkflowNode(nodeId, node, workingDir, context) {
@@ -371,9 +425,13 @@ async function runWriteWorkflowNode(nodeId, node, workingDir, context) {
         writes: relativeOutputPath,
     };
 }
-function getBooleanActionOption(node, key) {
+function getBooleanActionOption(node, key, context) {
     const value = node.with?.[key];
-    return value === true || value === 'true';
+    if (typeof value === 'string' && context) {
+        const rendered = renderTemplate(value, context).trim().toLowerCase();
+        return rendered === 'true' || rendered === '1' || rendered === 'yes';
+    }
+    return value === true || value === 'true' || value === 1;
 }
 function getStringActionOption(node, key, context) {
     const value = node.with?.[key];
@@ -419,6 +477,12 @@ function getPathActionOption(nodeId, node, context, workingDir) {
     }
     return paths;
 }
+function getOptionalPathActionOption(nodeId, node, context, workingDir) {
+    if (!hasActionOption(node, 'paths') && !hasActionOption(node, 'path')) {
+        return undefined;
+    }
+    return getPathActionOption(nodeId, node, context, workingDir);
+}
 async function requireWorkflowGitRepo(nodeId, workingDir, executionContext) {
     const git = getWorkflowGitClient(executionContext, workingDir);
     const isRepo = await git.checkIsRepo();
@@ -433,7 +497,7 @@ async function runGitDiffWorkflowNode(nodeId, node, workingDir, context, executi
     if (!isRepo) {
         throw new Error(`Workflow git-diff node "${nodeId}" must run from a git repository.`);
     }
-    const staged = getBooleanActionOption(node, 'staged');
+    const staged = getBooleanActionOption(node, 'staged', context);
     const diff = staged ? await git.diff(['--cached']) : await git.diff();
     const writes = renderNodeWritesPath(nodeId, node, context);
     if (writes) {
@@ -460,6 +524,24 @@ async function runGitAddWorkflowNode(nodeId, node, workingDir, context, executio
         output: paths,
     };
 }
+async function runGitBranchWorkflowNode(nodeId, node, workingDir, context, executionContext) {
+    const git = await requireWorkflowGitRepo(nodeId, workingDir, executionContext);
+    const name = requireStringActionOption(nodeId, node, 'name', context);
+    const from = getStringActionOption(node, 'from', context)?.trim();
+    const force = getBooleanActionOption(node, 'force', context);
+    const args = ['checkout', force ? '-B' : '-b', name];
+    if (from) {
+        args.push(from);
+    }
+    await git.raw(args);
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `checked out branch ${name}`,
+        output: { branch: name, from, force },
+    };
+}
 async function runGitCommitWorkflowNode(nodeId, node, workingDir, context, executionContext) {
     const git = await requireWorkflowGitRepo(nodeId, workingDir, executionContext);
     const message = requireStringActionOption(nodeId, node, 'message', context);
@@ -484,13 +566,464 @@ async function runGitCommitWorkflowNode(nodeId, node, workingDir, context, execu
         output,
     };
 }
-async function loadLocalChangeSource(nodeId, node, workingDir) {
+async function runGitPushWorkflowNode(nodeId, node, workingDir, context, executionContext) {
+    const git = await requireWorkflowGitRepo(nodeId, workingDir, executionContext);
+    const configuredRemote = getStringActionOption(node, 'remote', context)?.trim();
+    const remote = configuredRemote && configuredRemote.length > 0 ? configuredRemote : 'origin';
+    const branch = requireStringActionOption(nodeId, node, 'branch', context);
+    const configuredRemoteBranch = getStringActionOption(node, 'remoteBranch', context)?.trim();
+    const remoteBranch = configuredRemoteBranch && configuredRemoteBranch.length > 0 ? configuredRemoteBranch : branch;
+    const setUpstream = !hasActionOption(node, 'setUpstream') || getBooleanActionOption(node, 'setUpstream', context);
+    const force = getBooleanActionOption(node, 'force', context);
+    const args = ['push'];
+    if (setUpstream) {
+        args.push('-u');
+    }
+    if (force) {
+        args.push('--force-with-lease');
+    }
+    args.push(remote, `${branch}:${remoteBranch}`);
+    await git.raw(args);
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `pushed ${branch} to ${remote}/${remoteBranch}`,
+        output: { remote, branch, remoteBranch, setUpstream, force },
+    };
+}
+async function runHasDiffWorkflowNode(nodeId, node, workingDir, context, executionContext) {
+    const git = await requireWorkflowGitRepo(nodeId, workingDir, executionContext);
+    const paths = getOptionalPathActionOption(nodeId, node, context, workingDir);
+    const diff = paths ? await git.diff(['--', ...paths]) : await git.diff();
+    const files = paths ?? [];
+    const changed = diff.trim().length > 0;
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: changed ? 'changes found' : 'no changes found',
+        output: { changed, files, bytes: Buffer.byteLength(diff, 'utf8') },
+    };
+}
+function runStackGuardWorkflowNode(nodeId, node, context) {
+    const sourceArtifact = getStringActionOption(node, 'source', context) ?? 'change';
+    const source = context.artifacts[sourceArtifact];
+    if (!isReviewSource(source)) {
+        throw new Error(`Workflow stack-guard node "${nodeId}" needs a ReviewSource artifact.`);
+    }
+    const pullRequest = isPullRequest(source.context.pullRequest)
+        ? source.context.pullRequest
+        : undefined;
+    const sourceBranch = pullRequest?.sourceBranch ?? '';
+    const allowStackedSource = getBooleanActionOption(node, 'allowStackedSource', context);
+    const rawPrefixes = getStringActionOption(node, 'reservedPrefixes', context) ?? 'drs-fix/,drs-guidance/,drs-stack/';
+    const reservedPrefixes = rawPrefixes
+        .split(/[,\n]/)
+        .map((prefix) => prefix.trim())
+        .filter(Boolean);
+    const matchingPrefix = reservedPrefixes.find((prefix) => sourceBranch.startsWith(prefix));
+    const allowed = allowStackedSource || !matchingPrefix;
+    const reason = allowed ? 'allowed' : `source branch uses reserved DRS prefix "${matchingPrefix}"`;
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: reason,
+        output: { allowed, reason, sourceBranch, reservedPrefixes },
+    };
+}
+function severityRank(severity) {
+    const normalized = severity.trim().toUpperCase();
+    if (normalized === 'CRITICAL')
+        return 4;
+    if (normalized === 'HIGH')
+        return 3;
+    if (normalized === 'MEDIUM')
+        return 2;
+    if (normalized === 'LOW')
+        return 1;
+    return 0;
+}
+function runReviewThresholdWorkflowNode(nodeId, node, context) {
+    const reviewArtifact = getStringActionOption(node, 'review', context) ?? 'review';
+    const reviewResult = context.artifacts[reviewArtifact];
+    if (!isReviewResult(reviewResult)) {
+        throw new Error(`Workflow review-threshold node "${nodeId}" needs a ReviewResult artifact.`);
+    }
+    const severity = (getStringActionOption(node, 'severity', context) ?? 'high').toUpperCase();
+    const minIssues = hasActionOption(node, 'minIssues')
+        ? requireNumberActionOption(nodeId, node, 'minIssues', context)
+        : 1;
+    const thresholdRank = severityRank(severity);
+    if (thresholdRank === 0) {
+        throw new Error(`Workflow review-threshold node "${nodeId}" has unsupported severity "${severity}".`);
+    }
+    const matchingIssues = reviewResult.issues.filter((issue) => severityRank(issue.severity) >= thresholdRank);
+    const matched = matchingIssues.length >= minIssues;
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: matched ? `${matchingIssues.length} matching issue(s)` : 'threshold not met',
+        output: { matched, count: matchingIssues.length, severity, minIssues },
+    };
+}
+async function getCurrentBranch(workingDir, executionContext) {
+    const git = await requireWorkflowGitRepo('artifact-scope', workingDir, executionContext);
+    const branch = await git.branch();
+    return branch.current ?? 'unknown';
+}
+async function resolveArtifactScope(nodeId, node, workingDir, context, executionContext) {
+    const sourceArtifact = getStringActionOption(node, 'source', context);
+    const source = sourceArtifact ? context.artifacts[sourceArtifact] : undefined;
+    const reviewSource = isReviewSource(source) ? source : undefined;
+    const sourceTarget = readSourcePostTarget(reviewSource);
+    const explicitPlatform = getStringActionOption(node, 'platform', context);
+    const platform = explicitPlatform ?? sourceTarget.platform ?? 'local';
+    const projectId = getStringActionOption(node, 'project', context) ??
+        getStringActionOption(node, 'projectId', context) ??
+        (hasActionOption(node, 'owner') || hasActionOption(node, 'repo')
+            ? `${requireStringActionOption(nodeId, node, 'owner', context)}/${requireStringActionOption(nodeId, node, 'repo', context)}`
+            : undefined) ??
+        sourceTarget.projectId ??
+        'local';
+    const explicitSubject = getStringActionOption(node, 'subject', context)?.trim();
+    if (explicitSubject) {
+        return { platform, projectId, subject: explicitSubject };
+    }
+    const explicitChangeKind = getStringActionOption(node, 'changeKind', context)?.trim();
+    const explicitChangeNumber = getStringActionOption(node, 'changeNumber', context)?.trim() ??
+        getStringActionOption(node, 'pr', context)?.trim() ??
+        getStringActionOption(node, 'mr', context)?.trim();
+    const sourceChangeKind = sourceTarget.platform === 'gitlab' ? 'mr' : sourceTarget.platform ? 'pr' : undefined;
+    const sourceChangeNumber = sourceTarget.prNumber;
+    const changeKind = explicitChangeKind && explicitChangeKind.length > 0 ? explicitChangeKind : sourceChangeKind;
+    const changeNumber = explicitChangeNumber ?? sourceChangeNumber;
+    if (changeKind && changeNumber !== undefined) {
+        return { platform, projectId, changeKind, changeNumber };
+    }
+    const configuredBranch = getStringActionOption(node, 'branch', context)?.trim();
+    const branch = configuredBranch && configuredBranch.length > 0
+        ? configuredBranch
+        : await getCurrentBranch(workingDir, executionContext);
+    return { platform, projectId, branch };
+}
+function getArtifactPayloadFromNode(nodeId, node, context) {
+    const artifactName = getStringActionOption(node, 'artifact', context);
+    if (artifactName) {
+        if (!Object.prototype.hasOwnProperty.call(context.artifacts, artifactName)) {
+            throw new Error(`Workflow node "${nodeId}" references unknown artifact "${artifactName}".`);
+        }
+        return context.artifacts[artifactName];
+    }
+    const payloadName = getStringActionOption(node, 'payload', context);
+    if (payloadName && Object.prototype.hasOwnProperty.call(context.artifacts, payloadName)) {
+        return context.artifacts[payloadName];
+    }
+    if (payloadName) {
+        try {
+            return JSON.parse(payloadName);
+        }
+        catch {
+            return payloadName;
+        }
+    }
+    throw new Error(`Workflow node "${nodeId}" must define with.artifact or with.payload.`);
+}
+async function runSaveArtifactWorkflowNode(nodeId, node, workingDir, context, executionContext) {
+    const kind = requireStringActionOption(nodeId, node, 'kind', context);
+    const payload = getArtifactPayloadFromNode(nodeId, node, context);
+    const scope = await resolveArtifactScope(nodeId, node, workingDir, context, executionContext);
+    const saved = await saveWorkflowArtifact(workingDir, { kind, scope, payload });
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `saved ${kind} artifact ${saved.artifact.id}`,
+        output: { ...saved.artifact, path: saved.path, latestPath: saved.latestPath },
+    };
+}
+async function runLoadArtifactWorkflowNode(nodeId, node, workingDir, context, executionContext) {
+    const kind = requireStringActionOption(nodeId, node, 'kind', context);
+    const rawId = getStringActionOption(node, 'id', context)?.trim();
+    const id = rawId && rawId.length > 0 ? rawId : undefined;
+    const scope = await resolveArtifactScope(nodeId, node, workingDir, context, executionContext);
+    const loaded = await loadWorkflowArtifact(workingDir, kind, scope, id);
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `loaded ${kind} artifact ${loaded.artifact.id}`,
+        output: { ...loaded.artifact, path: loaded.path },
+    };
+}
+async function runArtifactExistsWorkflowNode(nodeId, node, workingDir, context, executionContext) {
+    const kind = requireStringActionOption(nodeId, node, 'kind', context);
+    const rawId = getStringActionOption(node, 'id', context)?.trim();
+    const id = rawId && rawId.length > 0 ? rawId : undefined;
+    const scope = await resolveArtifactScope(nodeId, node, workingDir, context, executionContext);
+    const exists = await workflowArtifactExists(workingDir, kind, scope, id);
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: exists ? 'artifact exists' : 'artifact missing',
+        output: { exists, kind, scope, id },
+    };
+}
+function runCreateReviewArtifactWorkflowNode(nodeId, node, context) {
+    const reviewArtifact = getStringActionOption(node, 'review', context) ?? 'review';
+    const review = context.artifacts[reviewArtifact];
+    if (!isReviewResult(review)) {
+        throw new Error(`Workflow create-review-artifact node "${nodeId}" needs a ReviewResult artifact.`);
+    }
+    const sourceArtifact = getStringActionOption(node, 'source', context);
+    const source = sourceArtifact ? context.artifacts[sourceArtifact] : undefined;
+    const reviewSource = isReviewSource(source) ? source : undefined;
+    const artifact = createReviewArtifactPayload(review, reviewSource);
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `created review artifact ${artifact.reviewId}`,
+        output: artifact,
+    };
+}
+function getReviewArtifactPayloadFromValue(nodeId, value) {
+    const envelope = value;
+    const payload = envelope && typeof envelope === 'object' && 'payload' in envelope ? envelope.payload : value;
+    if (!isReviewArtifactPayload(payload)) {
+        throw new Error(`Workflow review-artifact-status node "${nodeId}" needs a review artifact payload.`);
+    }
+    return payload;
+}
+function getReviewArtifactEnvelopeFromValue(value) {
+    if (!value || typeof value !== 'object') {
+        return undefined;
+    }
+    const envelope = value;
+    if (envelope.schemaVersion === 1 &&
+        envelope.kind === 'review' &&
+        typeof envelope.id === 'string' &&
+        typeof envelope.createdAt === 'string' &&
+        typeof envelope.updatedAt === 'string' &&
+        envelope.scope &&
+        typeof envelope.scope === 'object' &&
+        isReviewArtifactPayload(envelope.payload)) {
+        return envelope;
+    }
+    return undefined;
+}
+function getReviewArtifactInput(nodeId, node, context) {
+    const artifactName = getStringActionOption(node, 'artifact', context) ?? 'reviewArtifact';
+    const artifactValue = context.artifacts[artifactName];
+    const artifact = getReviewArtifactPayloadFromValue(nodeId, artifactValue);
+    return { artifact, envelope: getReviewArtifactEnvelopeFromValue(artifactValue) };
+}
+async function persistMutatedReviewArtifact(workingDir, payload, envelope) {
+    if (!envelope) {
+        return { output: payload, responseSuffix: '' };
+    }
+    const saved = await updateWorkflowArtifact(workingDir, { artifact: envelope, payload });
+    return {
+        output: { ...saved.artifact, path: saved.path, latestPath: saved.latestPath },
+        responseSuffix: ` and saved ${saved.artifact.id}`,
+    };
+}
+function parseListActionOption(node, key, context) {
+    const value = getStringActionOption(node, key, context)?.trim();
+    if (!value) {
+        return undefined;
+    }
+    return value
+        .split(/[,\n]/)
+        .map((item) => item.trim())
+        .filter(Boolean);
+}
+function parseReviewFindingState(nodeId, value) {
+    if (!value) {
+        return undefined;
+    }
+    if (value === 'open' || value === 'attempted' || value === 'resolved') {
+        return value;
+    }
+    throw new Error(`Workflow node "${nodeId}" has invalid review finding state "${value}".`);
+}
+function parseReviewFindingDisposition(nodeId, value) {
+    if (!value) {
+        return undefined;
+    }
+    if (value === 'confirmed' ||
+        value === 'uncertain' ||
+        value === 'pre_existing' ||
+        value === 'partial' ||
+        value === 'still_open' ||
+        value === 'regression' ||
+        value === 'resolved') {
+        return value;
+    }
+    throw new Error(`Workflow node "${nodeId}" has invalid review finding disposition "${value}".`);
+}
+function parseReviewFindingSource(nodeId, value) {
+    if (!value) {
+        return 'manual';
+    }
+    if (value === 'agent' || value === 'manual' || value === 'external') {
+        return value;
+    }
+    throw new Error(`Workflow node "${nodeId}" has invalid review finding source "${value}".`);
+}
+function isReviewIssue(value) {
+    if (!value || typeof value !== 'object') {
+        return false;
+    }
+    const issue = value;
+    return (typeof issue.severity === 'string' &&
+        typeof issue.category === 'string' &&
+        typeof issue.title === 'string' &&
+        typeof issue.file === 'string' &&
+        typeof issue.problem === 'string' &&
+        typeof issue.solution === 'string');
+}
+function getReviewIssueFromNode(nodeId, node, context) {
+    const issueName = requireStringActionOption(nodeId, node, 'issue', context);
+    const issue = Object.prototype.hasOwnProperty.call(context.artifacts, issueName)
+        ? context.artifacts[issueName]
+        : JSON.parse(issueName);
+    if (!isReviewIssue(issue)) {
+        throw new Error(`Workflow review-artifact-add-finding node "${nodeId}" needs a ReviewIssue.`);
+    }
+    return issue;
+}
+function runReviewArtifactStatusWorkflowNode(nodeId, node, context) {
+    const artifactName = getStringActionOption(node, 'artifact', context) ?? 'reviewArtifact';
+    const artifactValue = context.artifacts[artifactName];
+    const artifact = getReviewArtifactPayloadFromValue(nodeId, artifactValue);
+    const status = getReviewArtifactStatus(artifact);
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `${status.totalFindings} finding(s), ${status.openFindings} open`,
+        output: status,
+    };
+}
+async function runReviewArtifactAddFindingWorkflowNode(nodeId, node, workingDir, context) {
+    const { artifact, envelope } = getReviewArtifactInput(nodeId, node, context);
+    const issue = getReviewIssueFromNode(nodeId, node, context);
+    const source = parseReviewFindingSource(nodeId, getStringActionOption(node, 'source', context));
+    const updated = addReviewArtifactFinding(artifact, issue, source);
+    const persisted = await persistMutatedReviewArtifact(workingDir, updated, envelope);
+    const addedFinding = updated.findings[updated.findings.length - 1];
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `added review finding ${addedFinding?.id ?? 'unknown'}${persisted.responseSuffix}`,
+        output: persisted.output,
+    };
+}
+async function runReviewArtifactUpdateFindingsWorkflowNode(nodeId, node, workingDir, context, defaults = {}) {
+    const { artifact, envelope } = getReviewArtifactInput(nodeId, node, context);
+    const state = parseReviewFindingState(nodeId, getStringActionOption(node, 'state', context) ?? defaults.state);
+    const disposition = parseReviewFindingDisposition(nodeId, getStringActionOption(node, 'disposition', context) ?? defaults.disposition);
+    if (!state && !disposition) {
+        throw new Error(`Workflow node "${nodeId}" must define with.state or with.disposition.`);
+    }
+    const { artifact: updated, updatedIds } = updateReviewArtifactFindings(artifact, {
+        ids: parseListActionOption(node, 'ids', context),
+        fingerprints: parseListActionOption(node, 'fingerprints', context),
+        severity: getStringActionOption(node, 'severity', context)?.trim().toUpperCase(),
+        state,
+        disposition,
+    });
+    const persisted = await persistMutatedReviewArtifact(workingDir, updated, envelope);
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `updated ${updatedIds.length} review finding(s)${persisted.responseSuffix}`,
+        output: {
+            ...(typeof persisted.output === 'object' && persisted.output !== null
+                ? persisted.output
+                : {}),
+            updatedIds,
+        },
+    };
+}
+async function runVerifyFixWorkflowNode(nodeId, node, workingDir, context) {
+    const { artifact, envelope } = getReviewArtifactInput(nodeId, node, context);
+    const reviewArtifact = getStringActionOption(node, 'review', context) ?? 'reReview';
+    const review = context.artifacts[reviewArtifact];
+    if (!isReviewResult(review)) {
+        throw new Error(`Workflow verify-fix node "${nodeId}" needs a ReviewResult.`);
+    }
+    const severity = (getStringActionOption(node, 'severity', context) ?? 'high').toUpperCase();
+    if (severityRank(severity) === 0) {
+        throw new Error(`Workflow verify-fix node "${nodeId}" has unsupported severity "${severity}".`);
+    }
+    const minIssues = hasActionOption(node, 'minIssues')
+        ? requireNumberActionOption(nodeId, node, 'minIssues', context)
+        : 1;
+    const fixChangeName = getStringActionOption(node, 'fixChange', context);
+    const fixChange = fixChangeName ? context.artifacts[fixChangeName] : undefined;
+    const fixSource = isReviewSource(fixChange) ? fixChange : undefined;
+    const reconciliation = reconcileReviewArtifactFindings(artifact, review, {
+        severity,
+        minIssues,
+        fixSource,
+    });
+    const persisted = await persistMutatedReviewArtifact(workingDir, reconciliation.artifact, envelope);
+    const status = getReviewArtifactStatus(reconciliation.artifact);
+    const output = {
+        ...(typeof persisted.output === 'object' && persisted.output !== null ? persisted.output : {}),
+        payload: reconciliation.artifact,
+        verification: {
+            severity,
+            minIssues,
+            shouldContinue: reconciliation.shouldContinue,
+            actionableOpen: reconciliation.actionableOpen,
+            fixFiles: fixSource?.files.length ?? 0,
+            resolved: reconciliation.resolved,
+            partial: reconciliation.partial,
+            stillOpen: reconciliation.stillOpen,
+            regression: reconciliation.regression,
+            statuses: reconciliation.statuses.map((statusItem) => ({
+                id: statusItem.finding.id,
+                fingerprint: statusItem.finding.fingerprint,
+                disposition: statusItem.disposition,
+                severity: statusItem.finding.issue.severity,
+                file: statusItem.finding.issue.file,
+                line: statusItem.finding.issue.line,
+                title: statusItem.finding.issue.title,
+                verificationMissing: statusItem.verificationMissing === true,
+                verificationRationale: statusItem.finding.verification?.rationale,
+            })),
+        },
+        shouldContinue: reconciliation.shouldContinue,
+        actionableOpen: reconciliation.actionableOpen,
+        fixFiles: fixSource?.files.length ?? 0,
+        updatedIds: reconciliation.statuses.map((statusItem) => statusItem.finding.id),
+        status,
+    };
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: reconciliation.shouldContinue
+            ? `${reconciliation.actionableOpen} actionable finding(s) remain${persisted.responseSuffix}`
+            : `fix verification converged${persisted.responseSuffix}`,
+        output,
+    };
+}
+async function loadLocalChangeSource(nodeId, node, workingDir, context) {
     const git = simpleGit({ baseDir: workingDir });
     const isRepo = await git.checkIsRepo();
     if (!isRepo) {
         throw new Error(`Workflow change-source node "${nodeId}" must run from a git repository.`);
     }
-    const staged = getBooleanActionOption(node, 'staged');
+    const staged = getBooleanActionOption(node, 'staged', context);
     const diffText = staged ? await git.diff(['--cached']) : await git.diff();
     const diffs = parseDiff(diffText);
     const changedFiles = getChangedFiles(diffs);
@@ -528,8 +1061,8 @@ async function resolveGitRangeToRef(git) {
 function isStableSemverTag(tag) {
     return /^v?\d+\.\d+\.\d+$/.test(tag);
 }
-async function resolvePreviousGitRangeTag(nodeId, node, git, toRef) {
-    const includePrerelease = getBooleanActionOption(node, 'includePrereleaseFrom');
+async function resolvePreviousGitRangeTag(nodeId, node, git, toRef, context) {
+    const includePrerelease = getBooleanActionOption(node, 'includePrereleaseFrom', context);
     const tagOutput = await git.raw(['tag', '--merged', toRef, '--sort=-v:refname']);
     const tags = tagOutput
         .split('\n')
@@ -544,11 +1077,9 @@ async function resolvePreviousGitRangeTag(nodeId, node, git, toRef) {
 }
 async function resolveGitRangeRefs(nodeId, node, context, git) {
     const configuredToRef = getStringActionOption(node, 'to', context)?.trim();
-    const toRef = configuredToRef ? configuredToRef : await resolveGitRangeToRef(git);
+    const toRef = configuredToRef ?? (await resolveGitRangeToRef(git));
     const configuredFromRef = getStringActionOption(node, 'from', context)?.trim();
-    const fromRef = configuredFromRef
-        ? configuredFromRef
-        : await resolvePreviousGitRangeTag(nodeId, node, git, toRef);
+    const fromRef = configuredFromRef ?? (await resolvePreviousGitRangeTag(nodeId, node, git, toRef, context));
     if (!fromRef) {
         throw new Error(`Workflow node "${nodeId}" could not infer the previous tag for ${toRef}. ` +
             'Provide with.from explicitly.');
@@ -619,11 +1150,68 @@ async function loadGitLabChangeSource(nodeId, node, workingDir, context, executi
     ]);
     return createPlatformChangeSource('gitlab', `GitLab MR ${projectId}!${mrIid}`, projectId, pullRequest, changedFiles, workingDir);
 }
+function combineVerificationPatch(originalPatch, fixPatch) {
+    const sections = [];
+    if (originalPatch) {
+        sections.push(`# Original PR/MR diff\n${originalPatch}`);
+    }
+    if (fixPatch) {
+        sections.push(`# Local fix diff\n${fixPatch}`);
+    }
+    return sections.join('\n\n');
+}
+async function loadFixVerificationChangeSource(nodeId, node, workingDir, context) {
+    const sourceName = getStringActionOption(node, 'source', context) ?? 'change';
+    const source = context.artifacts[sourceName];
+    if (!isReviewSource(source)) {
+        throw new Error(`Workflow fix-verification change-source node "${nodeId}" needs a source ReviewSource artifact.`);
+    }
+    const fixChangeName = getStringActionOption(node, 'fixChange', context) ?? 'fixChange';
+    const fixChange = context.artifacts[fixChangeName];
+    if (!isReviewSource(fixChange)) {
+        throw new Error(`Workflow fix-verification change-source node "${nodeId}" needs a fixChange ReviewSource artifact.`);
+    }
+    const files = [...new Set([...source.files, ...fixChange.files])];
+    const pullRequest = isPullRequest(source.context.pullRequest) ? source.context.pullRequest : null;
+    const baseRef = pullRequest?.targetBranch ?? source.context.baseBranch ?? 'HEAD~1';
+    const realDiffs = await tryGetRealPostFixDiff(workingDir, files, baseRef);
+    return {
+        ...source,
+        name: `${source.name} with local fixes`,
+        files,
+        filesWithDiffs: realDiffs ??
+            files.map((filename) => ({
+                filename,
+                patch: combineVerificationPatch((source.filesWithDiffs ?? []).find((f) => f.filename === filename)?.patch, (fixChange.filesWithDiffs ?? []).find((f) => f.filename === filename)?.patch),
+            })),
+        context: {
+            ...source.context,
+            sourceType: 'fix-verification',
+            fixFiles: fixChange.files,
+        },
+        staged: fixChange.staged,
+    };
+}
+async function tryGetRealPostFixDiff(workingDir, files, baseRef) {
+    try {
+        const git = simpleGit({ baseDir: workingDir });
+        const isRepo = await git.checkIsRepo();
+        if (!isRepo)
+            return undefined;
+        const diffText = await git.diff(['--no-ext-diff', '-M', baseRef, '--', ...files]);
+        if (!diffText.trim())
+            return undefined;
+        return getFilesWithDiffs(parseDiff(diffText));
+    }
+    catch {
+        return undefined;
+    }
+}
 async function runChangeSourceWorkflowNode(nodeId, node, workingDir, context, executionContext) {
     const type = getStringActionOption(node, 'type', context) ?? 'local';
     let source;
     if (type === 'local') {
-        source = await loadLocalChangeSource(nodeId, node, workingDir);
+        source = await loadLocalChangeSource(nodeId, node, workingDir, context);
     }
     else if (type === 'git-range') {
         source = await loadGitRangeChangeSource(nodeId, node, workingDir, context, executionContext);
@@ -634,9 +1222,12 @@ async function runChangeSourceWorkflowNode(nodeId, node, workingDir, context, ex
     else if (type === 'gitlab-mr') {
         source = await loadGitLabChangeSource(nodeId, node, workingDir, context, executionContext);
     }
+    else if (type === 'fix-verification') {
+        source = await loadFixVerificationChangeSource(nodeId, node, workingDir, context);
+    }
     else {
         throw new Error(`Unsupported workflow change-source type "${type}" in node "${nodeId}". ` +
-            'Currently supported: local, git-range, github-pr, gitlab-mr.');
+            'Currently supported: local, git-range, github-pr, gitlab-mr, fix-verification.');
     }
     const writes = renderNodeWritesPath(nodeId, node, context);
     if (writes) {
@@ -724,9 +1315,84 @@ function resolvePostTarget(nodeId, node, context, executionContext, source) {
         changedFiles: sourceTarget.changedFiles,
     };
 }
-function isPullRequest(value) {
-    if (!value || typeof value !== 'object') {
-        return false;
+async function runCreateChangeRequestWorkflowNode(nodeId, node, context, executionContext) {
+    const sourceArtifact = getStringActionOption(node, 'source', context) ?? 'change';
+    const source = isReviewSource(context.artifacts[sourceArtifact])
+        ? context.artifacts[sourceArtifact]
+        : undefined;
+    const sourceTarget = readSourcePostTarget(source);
+    const aliasPlatform = node.action === 'create-pr' ? 'github' : node.action === 'create-mr' ? 'gitlab' : undefined;
+    const explicitPlatform = getStringActionOption(node, 'platform', context);
+    const platform = aliasPlatform ?? explicitPlatform ?? sourceTarget.platform;
+    if (!isWorkflowPlatform(platform)) {
+        throw new Error(`Workflow change-request node "${nodeId}" must resolve with.platform to github or gitlab.`);
+    }
+    const projectId = resolvePostProjectId(nodeId, node, context, sourceTarget);
+    const configuredSourceBranch = getStringActionOption(node, 'sourceBranch', context)?.trim();
+    const configuredHead = getStringActionOption(node, 'head', context)?.trim();
+    const sourceBranch = configuredSourceBranch && configuredSourceBranch.length > 0
+        ? configuredSourceBranch
+        : configuredHead;
+    const configuredTargetBranch = getStringActionOption(node, 'targetBranch', context)?.trim();
+    const configuredBase = getStringActionOption(node, 'base', context)?.trim();
+    const targetBranch = configuredTargetBranch && configuredTargetBranch.length > 0
+        ? configuredTargetBranch
+        : configuredBase;
+    if (!sourceBranch) {
+        throw new Error(`Workflow change-request node "${nodeId}" must define with.sourceBranch.`);
+    }
+    if (!targetBranch) {
+        throw new Error(`Workflow change-request node "${nodeId}" must define with.targetBranch.`);
+    }
+    const title = requireStringActionOption(nodeId, node, 'title', context);
+    const body = getStringActionOption(node, 'body', context);
+    const draft = getBooleanActionOption(node, 'draft', context);
+    const reuseExisting = !hasActionOption(node, 'reuseExisting') ||
+        getBooleanActionOption(node, 'reuseExisting', context);
+    const platformClient = getWorkflowPlatformClient(executionContext, platform);
+    const input = {
+        sourceBranch,
+        targetBranch,
+        title,
+        body,
+        draft,
+    };
+    const existing = reuseExisting
+        ? await platformClient.findChangeRequest?.(projectId, sourceBranch, targetBranch)
+        : undefined;
+    let operation = existing ? 'reused' : 'created';
+    const changeRequest = existing ??
+        (await platformClient.createChangeRequest(projectId, input).catch(async (error) => {
+            if (reuseExisting) {
+                try {
+                    const retryExisting = await platformClient.findChangeRequest?.(projectId, sourceBranch, targetBranch);
+                    if (retryExisting) {
+                        operation = 'reused';
+                        return retryExisting;
+                    }
+                }
+                catch {
+                    // ignore retry failure; fall through to throw original error
+                }
+            }
+            throw error;
+        }));
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `${operation} ${platform} change request #${changeRequest.number}`,
+        output: {
+            platform,
+            projectId,
+            operation,
+            ...changeRequest,
+        },
+    };
+}
+function isPullRequest(value) {
+    if (!value || typeof value !== 'object') {
+        return false;
     }
     const candidate = value;
     return (typeof candidate.number === 'number' &&
@@ -755,19 +1421,24 @@ function createWorkflowLineValidator(platform, source) {
         : [];
     const patchSources = fileChanges.length > 0 ? fileChanges : (source.filesWithDiffs ?? []);
     const validLinesMap = new Map();
+    const changedLinesMap = new Map();
     for (const file of patchSources) {
         if ('status' in file && file.status === 'removed') {
             continue;
         }
         const patch = file.patch;
         if (patch) {
-            validLinesMap.set(file.filename, parseValidLinesFromPatch(patch));
+            const lineInfo = parseDiffLineInfo(patch);
+            validLinesMap.set(file.filename, lineInfo.commentableLines);
+            changedLinesMap.set(file.filename, lineInfo.addedLines);
         }
     }
     return {
         isValidLine(file, line) {
-            const validLines = validLinesMap.get(file);
-            return validLines !== undefined && validLines.has(line);
+            return validLinesMap.get(file)?.has(line) ?? false;
+        },
+        isChangedLine(file, line) {
+            return changedLinesMap.get(file)?.has(line) ?? false;
         },
     };
 }
@@ -896,7 +1567,8 @@ async function runDescribeWorkflowNode(config, nodeId, node, options, workingDir
     if (!target.pullRequest) {
         throw new Error(`Workflow describe node "${nodeId}" needs a platform change-source target.`);
     }
-    const shouldPostDescription = getBooleanActionOption(node, 'post') || getBooleanActionOption(node, 'postDescription');
+    const shouldPostDescription = getBooleanActionOption(node, 'post', context) ||
+        getBooleanActionOption(node, 'postDescription', context);
     const runtimeClient = await connectToRuntime(config, source.workingDir ?? workingDir, {
         debug: options.debug,
         modelOverrides: getDescriberModelOverride(config),
@@ -938,7 +1610,10 @@ async function runPostCommentWorkflowNode(nodeId, node, options, workingDir, con
     const rawBody = node.input === undefined
         ? requireStringActionOption(nodeId, node, 'body', context)
         : renderTemplate(node.input, context);
-    const marker = getStringActionOption(node, 'marker', context)?.trim();
+    const configuredMarker = getStringActionOption(node, 'marker', context)?.trim();
+    const marker = configuredMarker && configuredMarker.length > 0
+        ? configuredMarker
+        : options.idempotencyContext?.idempotencyKey;
     const body = formatMarkedComment(rawBody, marker);
     let operation = 'created';
     if (marker) {
@@ -988,7 +1663,7 @@ async function runPostReviewCommentsWorkflowNode(config, nodeId, node, options,
         ? createWorkflowInlinePosition(target.platform, source)
         : undefined;
     const shouldRemoveErrorComment = !hasActionOption(node, 'removeErrorComment') ||
-        getBooleanActionOption(node, 'removeErrorComment');
+        getBooleanActionOption(node, 'removeErrorComment', context);
     await withWorkflowConsoleSuppressed(executionContext, options.jsonOutput === true, async () => {
         if (shouldRemoveErrorComment) {
             await removeErrorComment(target.platformClient, target.projectId, target.prNumber);
@@ -1015,6 +1690,256 @@ async function runPostReviewCommentsWorkflowNode(config, nodeId, node, options,
         },
     };
 }
+function getFixStatusDisposition(finding) {
+    const disposition = finding.disposition;
+    if (disposition === 'resolved')
+        return 'resolved';
+    if (disposition === 'partial')
+        return 'partial';
+    if (disposition === 'regression')
+        return 'regression';
+    return 'still-open';
+}
+function getVerificationDisposition(finding, verdict, thresholdRank) {
+    if (severityRank(finding.issue.severity) < thresholdRank) {
+        return finding.disposition;
+    }
+    if (!verdict) {
+        if (finding.disposition === 'regression') {
+            return 'regression';
+        }
+        return 'still_open';
+    }
+    return verdict.disposition === 'still_open' ? 'still_open' : verdict.disposition;
+}
+function reconcileReviewArtifactFindings(artifact, reReview, options) {
+    const now = new Date().toISOString();
+    const thresholdRank = severityRank(options.severity);
+    const verdicts = new Map((reReview.verification?.findings ?? []).map((finding) => [finding.id, finding]));
+    const existingFingerprints = new Set(artifact.findings.map((finding) => finding.fingerprint));
+    const reconciledFindings = artifact.findings.map((finding) => {
+        const verdict = verdicts.get(finding.id);
+        const disposition = getVerificationDisposition(finding, verdict, thresholdRank);
+        const issue = isReviewIssue(verdict?.issue) ? verdict.issue : finding.issue;
+        const fingerprint = issue === finding.issue ? finding.fingerprint : createIssueFingerprint(issue);
+        const shouldVerify = severityRank(finding.issue.severity) >= thresholdRank;
+        const verification = shouldVerify
+            ? {
+                disposition: verdict?.disposition ?? 'missing',
+                rationale: verdict?.rationale,
+                verifiedAt: now,
+            }
+            : finding.verification;
+        return {
+            ...finding,
+            issue,
+            fingerprint,
+            state: disposition === 'resolved' ? 'resolved' : 'open',
+            disposition,
+            verification,
+            updatedAt: now,
+        };
+    });
+    for (const issue of reReview.issues) {
+        const fingerprint = createIssueFingerprint(issue);
+        if (existingFingerprints.has(fingerprint)) {
+            continue;
+        }
+        existingFingerprints.add(fingerprint);
+        reconciledFindings.push({
+            id: `R${reconciledFindings.length + 1}`,
+            fingerprint,
+            issue,
+            state: 'open',
+            disposition: 'regression',
+            verification: undefined,
+            source: 'agent',
+            createdAt: now,
+            updatedAt: now,
+        });
+    }
+    const updatedArtifact = { ...artifact, findings: reconciledFindings };
+    const statuses = updatedArtifact.findings.map((finding) => {
+        const disposition = getFixStatusDisposition(finding);
+        const verificationMissing = severityRank(finding.issue.severity) >= thresholdRank && !verdicts.has(finding.id);
+        const diffSnippet = disposition === 'resolved' || disposition === 'regression'
+            ? extractDiffSnippet(options.fixSource, finding.issue.file, finding.issue.line)
+            : undefined;
+        return { finding, disposition, diffSnippet, verificationMissing };
+    });
+    const actionableOpen = updatedArtifact.findings.filter((finding) => finding.state === 'open' &&
+        severityRank(finding.issue.severity) >= thresholdRank &&
+        (finding.disposition === 'still_open' ||
+            finding.disposition === 'partial' ||
+            finding.disposition === 'regression')).length;
+    return {
+        artifact: updatedArtifact,
+        statuses,
+        shouldContinue: actionableOpen >= options.minIssues,
+        actionableOpen,
+        resolved: updatedArtifact.findings.filter((finding) => finding.state === 'resolved').length,
+        partial: updatedArtifact.findings.filter((finding) => finding.disposition === 'partial').length,
+        stillOpen: updatedArtifact.findings.filter((finding) => finding.disposition === 'still_open')
+            .length,
+        regression: updatedArtifact.findings.filter((finding) => finding.disposition === 'regression')
+            .length,
+    };
+}
+function extractDiffSnippet(fixChange, filePath, line) {
+    if (!fixChange?.filesWithDiffs) {
+        return undefined;
+    }
+    const fileWithDiff = fixChange.filesWithDiffs.find((f) => f.filename === filePath);
+    if (!fileWithDiff?.patch) {
+        return undefined;
+    }
+    const lines = fileWithDiff.patch.split('\n');
+    if (!line) {
+        return lines.slice(0, 15).join('\n');
+    }
+    for (let i = 0; i < lines.length; i++) {
+        const hunkMatch = lines[i]?.match(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/);
+        if (!hunkMatch) {
+            continue;
+        }
+        const newStart = Number.parseInt(hunkMatch[1], 10);
+        const newLineCount = hunkMatch[2] ? Number.parseInt(hunkMatch[2], 10) : 1;
+        if (line < newStart || line >= newStart + newLineCount) {
+            continue;
+        }
+        let end = i + 1;
+        while (end < lines.length && !lines[end]?.startsWith('@@')) {
+            end++;
+        }
+        return lines.slice(i, end).join('\n');
+    }
+    return lines.slice(0, 15).join('\n');
+}
+function formatFixStatusComment(statuses, stackedPrUrl) {
+    const lines = ['## Fix Status', ''];
+    if (statuses.length === 0) {
+        lines.push('No findings to report.');
+        return lines.join('\n');
+    }
+    lines.push('| # | Severity | File | Issue | Status |');
+    lines.push('|---|----------|------|-------|--------|');
+    for (let i = 0; i < statuses.length; i++) {
+        const s = statuses[i];
+        const statusIcon = s.disposition === 'resolved'
+            ? '✅ Resolved'
+            : s.disposition === 'partial'
+                ? '🟡 Partial'
+                : s.disposition === 'regression'
+                    ? '🔴 Regression'
+                    : s.disposition === 'attempted'
+                        ? '🔧 Attempted'
+                        : s.verificationMissing
+                            ? '⚠️ Verification Missing'
+                            : '⚪ Still Open';
+        const file = `${s.finding.issue.file}${s.finding.issue.line ? `:${s.finding.issue.line}` : ''}`;
+        lines.push(`| ${i + 1} | ${s.finding.issue.severity} | ${file} | ${s.finding.issue.title} | ${statusIcon} |`);
+    }
+    const resolved = statuses.filter((s) => s.disposition === 'resolved' && s.diffSnippet);
+    if (resolved.length > 0) {
+        lines.push('');
+        lines.push('### Fix Details');
+        for (let i = 0; i < statuses.length; i++) {
+            const s = statuses[i];
+            if (s.disposition === 'resolved' && s.diffSnippet) {
+                lines.push('');
+                lines.push(`**#${i + 1} — ${s.finding.issue.title} (${s.disposition})**`);
+                lines.push('```diff');
+                lines.push(s.diffSnippet);
+                lines.push('```');
+            }
+        }
+    }
+    if (stackedPrUrl) {
+        lines.push('');
+        lines.push(`Stacked fix PR: ${stackedPrUrl}`);
+    }
+    return lines.join('\n');
+}
+async function runPostFixStatusWorkflowNode(nodeId, node, options, workingDir, context, executionContext) {
+    const sourceArtifact = getStringActionOption(node, 'source', context) ?? 'change';
+    const source = isReviewSource(context.artifacts[sourceArtifact])
+        ? context.artifacts[sourceArtifact]
+        : undefined;
+    const target = resolvePostTarget(nodeId, node, context, executionContext, source);
+    const reviewArtifactName = getStringActionOption(node, 'reviewArtifact', context) ?? 'reviewArtifact';
+    const reviewArtifactValue = context.artifacts[reviewArtifactName];
+    let artifactPayload;
+    if (isReviewArtifactPayload(reviewArtifactValue)) {
+        artifactPayload = reviewArtifactValue;
+    }
+    else if (reviewArtifactValue &&
+        typeof reviewArtifactValue === 'object' &&
+        'payload' in reviewArtifactValue) {
+        const payload = reviewArtifactValue.payload;
+        if (isReviewArtifactPayload(payload)) {
+            artifactPayload = payload;
+        }
+    }
+    if (!artifactPayload) {
+        throw new Error(`Workflow post-fix-status node "${nodeId}" needs a review artifact (with.reviewArtifact).`);
+    }
+    const fixReviewName = getStringActionOption(node, 'fixReview', context);
+    const fixReviewResult = fixReviewName ? context.artifacts[fixReviewName] : undefined;
+    const hasReReview = isReviewResult(fixReviewResult);
+    const fixChangeName = getStringActionOption(node, 'fixChange', context);
+    const fixChange = fixChangeName ? context.artifacts[fixChangeName] : undefined;
+    const fixSource = isReviewSource(fixChange) ? fixChange : undefined;
+    const stackedPrUrl = getStringActionOption(node, 'stackedPrUrl', context);
+    const marker = getStringActionOption(node, 'marker', context)?.trim() ?? 'drs-fix-status';
+    const severity = (getStringActionOption(node, 'severity', context) ?? 'high').toUpperCase();
+    const thresholdRank = severityRank(severity);
+    const originalFindings = artifactPayload.findings.filter((finding) => severityRank(finding.issue.severity) >= thresholdRank);
+    const statuses = originalFindings.map((finding) => {
+        if (hasReReview) {
+            const disposition = getFixStatusDisposition(finding);
+            const diffSnippet = disposition === 'resolved' || disposition === 'regression'
+                ? extractDiffSnippet(fixSource, finding.issue.file, finding.issue.line)
+                : undefined;
+            return { finding, disposition, diffSnippet };
+        }
+        const diffSnippet = extractDiffSnippet(fixSource, finding.issue.file, finding.issue.line);
+        return { finding, disposition: 'attempted', diffSnippet };
+    });
+    const body = formatFixStatusComment(statuses, stackedPrUrl);
+    const markedBody = formatMarkedComment(body, marker);
+    let operation = 'created';
+    try {
+        const comments = await target.platformClient.getComments(target.projectId, target.prNumber);
+        const existingComment = findExistingCommentById(comments, marker);
+        if (existingComment) {
+            await withWorkflowConsoleSuppressed(executionContext, options.jsonOutput === true, () => target.platformClient.updateComment(target.projectId, target.prNumber, existingComment.id, markedBody));
+            operation = 'updated';
+        }
+        else {
+            await withWorkflowConsoleSuppressed(executionContext, options.jsonOutput === true, () => target.platformClient.createComment(target.projectId, target.prNumber, markedBody));
+        }
+    }
+    catch (error) {
+        throw new Error(`Workflow post-fix-status node "${nodeId}" failed to post comment: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return {
+        id: nodeId,
+        type: 'action',
+        action: node.action,
+        response: `${operation} fix-status comment on ${target.platform} ${target.projectId}#${target.prNumber}`,
+        output: {
+            platform: target.platform,
+            projectId: target.projectId,
+            prNumber: target.prNumber,
+            operation,
+            resolved: statuses.filter((s) => s.disposition === 'resolved').length,
+            partial: statuses.filter((s) => s.disposition === 'partial').length,
+            stillOpen: statuses.filter((s) => s.disposition === 'still-open').length,
+            regression: statuses.filter((s) => s.disposition === 'regression').length,
+            attempted: statuses.filter((s) => s.disposition === 'attempted').length,
+        },
+    };
+}
 function isReviewSource(value) {
     if (!value || typeof value !== 'object') {
         return false;
@@ -1025,23 +1950,6 @@ function isReviewSource(value) {
         typeof candidate.context === 'object' &&
         candidate.context !== null);
 }
-async function enforceWorkflowReviewTarget(config, source, workingDir) {
-    const platform = typeof source.context.platform === 'string' ? source.context.platform : undefined;
-    if (!isWorkflowPlatform(platform)) {
-        return;
-    }
-    const projectId = typeof source.context.projectId === 'string' ? source.context.projectId : undefined;
-    const pullRequest = isPullRequest(source.context.pullRequest)
-        ? source.context.pullRequest
-        : undefined;
-    if (!projectId || !pullRequest) {
-        throw new Error('Workflow platform review source is missing project or PR/MR metadata.');
-    }
-    await enforceRepoBranchMatch(workingDir, projectId, pullRequest, {
-        skipRepoCheck: config.review.skipRepoCheck,
-        skipBranchCheck: config.review.skipBranchCheck,
-    });
-}
 async function runReviewWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext) {
     const sourceArtifact = getStringActionOption(node, 'source', context) ?? 'change';
     const source = context.artifacts[sourceArtifact];
@@ -1049,10 +1957,46 @@ async function runReviewWorkflowNode(config, nodeId, node, options, workingDir,
         throw new Error(`Workflow review node "${nodeId}" needs a ReviewSource artifact. ` +
             'Set with.source to a change-source output.');
     }
+    const reviewArtifactName = getStringActionOption(node, 'reviewArtifact', context);
+    const reviewArtifactEnvelope = reviewArtifactName
+        ? context.artifacts[reviewArtifactName]
+        : undefined;
+    const reviewArtifact = reviewArtifactName
+        ? getReviewArtifactPayloadFromValue(nodeId, reviewArtifactEnvelope)
+        : undefined;
+    const reviewArtifactPath = reviewArtifactEnvelope && typeof reviewArtifactEnvelope === 'object'
+        ? reviewArtifactEnvelope.path
+        : undefined;
+    const severity = getStringActionOption(node, 'severity', context)?.toUpperCase();
+    const traceCollector = executionContext.traceCollector;
+    const sourceForReview = reviewArtifact
+        ? {
+            ...source,
+            context: {
+                ...source.context,
+                verification: {
+                    artifact: {
+                        reviewId: reviewArtifact.reviewId,
+                        findings: reviewArtifact.findings,
+                    },
+                    artifactPath: reviewArtifactPath,
+                    severity,
+                },
+                traceCollector,
+            },
+        }
+        : {
+            ...source,
+            context: {
+                ...source.context,
+                traceCollector,
+            },
+        };
+    if (traceCollector) {
+        const agentIds = getReviewAgentIds(config);
+        traceCollector.setContext(nodeId, agentIds[0] ?? 'review/unified-reviewer', '');
+    }
     const reviewResult = await withWorkflowLock(executionContext.locks.exit, async () => {
-        const restoreExit = setExitHandler((code) => {
-            throw new ExitError(code);
-        });
         const originalLog = console.log;
         const originalWarn = console.warn;
         if (options.jsonOutput) {
@@ -1060,38 +2004,51 @@ async function runReviewWorkflowNode(config, nodeId, node, options, workingDir,
             console.warn = () => undefined;
         }
         try {
-            await enforceWorkflowReviewTarget(config, source, source.workingDir ?? workingDir);
             return await executeReview(config, {
-                ...source,
-                workingDir: source.workingDir ?? workingDir,
+                ...sourceForReview,
+                workingDir: sourceForReview.workingDir ?? workingDir,
                 debug: options.debug,
                 thinkingLevel: options.thinkingLevel,
             });
         }
-        catch (error) {
-            if (error instanceof ExitError) {
-                throw new Error(`Workflow review node "${nodeId}" failed: all review agents failed.`);
-            }
-            throw error;
-        }
         finally {
             if (options.jsonOutput) {
                 console.log = originalLog;
                 console.warn = originalWarn;
             }
-            restoreExit();
         }
     });
     const writes = renderNodeWritesPath(nodeId, node, context);
     if (writes) {
         await writeWorkflowFile(workingDir, writes, JSON.stringify(reviewResult, null, 2));
     }
+    const explicitArtifactOutput = getStringActionOption(node, 'artifact', context)?.trim();
+    let artifactOutput;
+    if (explicitArtifactOutput) {
+        artifactOutput = explicitArtifactOutput;
+    }
+    else if (!reviewArtifactName) {
+        artifactOutput = `${nodeId}Artifact`;
+    }
+    const outputs = {};
+    const reviewArtifactPayload = createReviewArtifactPayload(reviewResult, source);
+    const scope = await resolveArtifactScope(nodeId, node, workingDir, context, executionContext);
+    const saved = await saveWorkflowArtifact(workingDir, {
+        kind: 'review',
+        scope,
+        payload: reviewArtifactPayload,
+    });
+    const artifactResponse = `\nSaved review artifact ${saved.artifact.id}.`;
+    if (artifactOutput) {
+        outputs[artifactOutput] = { ...saved.artifact, path: saved.path, latestPath: saved.latestPath };
+    }
     return {
         id: nodeId,
         type: 'action',
         action: node.action,
-        response: JSON.stringify(reviewResult.summary, null, 2),
+        response: `${JSON.stringify(reviewResult.summary, null, 2)}${artifactResponse}`,
         output: reviewResult,
+        outputs,
         writes,
     };
 }
@@ -1101,70 +2058,331 @@ function recordNodeArtifact(nodeId, node, result, artifacts) {
     if (node.output) {
         artifacts[node.output] = artifactValue;
     }
+    if (result.outputs) {
+        for (const [name, value] of Object.entries(result.outputs)) {
+            artifacts[name] = value;
+        }
+    }
+}
+function logWorkflowNodeRunning(nodeId, options) {
+    if (!options.jsonOutput) {
+        console.log(chalk.gray(`Running node ${nodeId}...`));
+    }
+}
+function logWorkflowNodeSkipped(nodeId, reason, options) {
+    if (!options.jsonOutput) {
+        console.log(chalk.gray(`Skipping node ${nodeId} (${reason})`));
+    }
+}
+function recordWorkflowNodeResult(nodeId, node, result, nodes, artifacts) {
+    result.status ??= 'success';
+    nodes[nodeId] = result;
+    if (result.status !== 'skipped') {
+        recordNodeArtifact(nodeId, node, result, artifacts);
+    }
+}
+function completeWorkflowNodeResult(result, startedAt) {
+    const completedAt = new Date().toISOString();
+    result.startedAt ??= startedAt;
+    result.completedAt ??= completedAt;
+    result.durationMs ??= Math.max(0, new Date(completedAt).getTime() - new Date(startedAt).getTime());
+    return result;
+}
+async function runWorkflowDagSegment(workflowNodes, nodeIds, activeNodeIds, options, context, nodeExecutor) {
+    const completed = new Set();
+    const segmentNodeIds = new Set(nodeIds);
+    if (activeNodeIds) {
+        for (const nodeId of nodeIds) {
+            if (!activeNodeIds.has(nodeId)) {
+                completed.add(nodeId);
+                if (context.nodes[nodeId] === undefined) {
+                    logWorkflowNodeSkipped(nodeId, 'inactive branch', options);
+                    context.nodes[nodeId] = createSkippedWorkflowNodeResult(nodeId);
+                }
+            }
+        }
+    }
+    while (completed.size < nodeIds.length) {
+        const runnable = nodeIds.filter((nodeId) => {
+            if (completed.has(nodeId))
+                return false;
+            const node = workflowNodes[nodeId];
+            if (!node)
+                return false;
+            return getNodeNeeds(node).every((dependency) => completed.has(dependency) || !segmentNodeIds.has(dependency));
+        });
+        if (runnable.length === 0) {
+            throw new Error('Workflow control runner could not make progress in a DAG segment.');
+        }
+        const settled = await Promise.allSettled(runnable.map(async (nodeId) => {
+            const node = workflowNodes[nodeId];
+            if (!node) {
+                throw new Error(`Workflow references unknown node "${nodeId}".`);
+            }
+            const startedAt = new Date().toISOString();
+            const skipReason = getWorkflowNodeSkipReason(node, context);
+            if (skipReason) {
+                logWorkflowNodeSkipped(nodeId, skipReason, options);
+                return {
+                    nodeId,
+                    node,
+                    result: completeWorkflowNodeResult(createSkippedWorkflowNodeResult(nodeId), startedAt),
+                };
+            }
+            logWorkflowNodeRunning(nodeId, options);
+            const result = await nodeExecutor.runNode(nodeId, node, context);
+            return { nodeId, node, result: completeWorkflowNodeResult(result, startedAt) };
+        }));
+        const firstRejection = settled.find((outcome) => outcome.status === 'rejected');
+        if (firstRejection) {
+            throw firstRejection.reason instanceof Error
+                ? firstRejection.reason
+                : new Error(String(firstRejection.reason));
+        }
+        for (const outcome of settled) {
+            const { nodeId, node, result } = outcome.value;
+            completed.add(nodeId);
+            recordWorkflowNodeResult(nodeId, node, result, context.nodes, context.artifacts);
+        }
+    }
+}
+async function runControlWorkflow(workflowNodes, executionOrder, options, context, nodeExecutor) {
+    await runControlWorkflowFromSegments(workflowNodes, splitWorkflowSegments(workflowNodes, executionOrder), options, context, nodeExecutor);
+}
+async function runControlWorkflowFromSegments(workflowNodes, compiledSegments, options, context, nodeExecutor) {
+    const segments = compiledSegments.map((segment) => segment.type === 'control'
+        ? { type: 'control', nodeId: segment.nodeId }
+        : {
+            type: 'dag',
+            nodeIds: [...segment.nodeIds],
+            ...(segment.activeNodeIds ? { activeNodeIds: new Set(segment.activeNodeIds) } : {}),
+        });
+    let segmentIndex = 0;
+    while (segmentIndex < segments.length) {
+        const segment = segments[segmentIndex];
+        if (segment.type === 'dag') {
+            await runWorkflowDagSegment(workflowNodes, segment.nodeIds, segment.activeNodeIds, options, context, nodeExecutor);
+            segmentIndex += 1;
+            continue;
+        }
+        const node = workflowNodes[segment.nodeId];
+        if (!node) {
+            throw new Error(`Workflow references unknown node "${segment.nodeId}".`);
+        }
+        const skipReason = getWorkflowNodeSkipReason(node, context);
+        if (skipReason) {
+            logWorkflowNodeSkipped(segment.nodeId, skipReason, options);
+        }
+        else {
+            logWorkflowNodeRunning(segment.nodeId, options);
+        }
+        const startedAt = new Date().toISOString();
+        const controlResult = skipReason
+            ? { result: createSkippedWorkflowNodeResult(segment.nodeId) }
+            : runControlWorkflowNode(segment.nodeId, node, context);
+        const { result, nextNodeId, ended } = {
+            ...controlResult,
+            result: completeWorkflowNodeResult(controlResult.result, startedAt),
+        };
+        recordWorkflowNodeResult(segment.nodeId, node, result, context.nodes, context.artifacts);
+        if (ended) {
+            return;
+        }
+        if (!nextNodeId) {
+            segmentIndex += 1;
+            continue;
+        }
+        const targetIndex = findWorkflowSegmentIndex(segments, nextNodeId);
+        if (targetIndex < 0) {
+            throw new Error(`Workflow control node "${segment.nodeId}" targets unknown node "${nextNodeId}".`);
+        }
+        if (node.control !== 'loop' && targetIndex <= segmentIndex) {
+            throw new Error(`Workflow control node "${segment.nodeId}" cannot jump backward to "${nextNodeId}". Use control: loop with maxIterations for repeated execution.`);
+        }
+        const targetSegment = segments[targetIndex];
+        if (targetSegment.type === 'dag') {
+            targetSegment.activeNodeIds = computeActiveWorkflowNodes(workflowNodes, targetSegment.nodeIds, nextNodeId, !(node.control === 'loop' && nextNodeId === node.target));
+        }
+        segmentIndex = targetIndex;
+    }
 }
 function formatWorkflowJson(result) {
     return JSON.stringify(result, null, 2);
 }
 async function runSingleWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext) {
     const kind = getNodeKind(node);
+    if (getWorkflowNodeSkipReason(node, context)) {
+        return createSkippedWorkflowNodeResult(nodeId);
+    }
     if (kind === 'agent') {
-        return runAgentWorkflowNode(config, nodeId, node, options, workingDir, context);
+        return runAgentWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext);
     }
     if (kind === 'agents') {
         return runAgentsWorkflowNode(config, nodeId, node, options, workingDir, context);
     }
+    if (kind === 'control') {
+        throw new Error(`Workflow control node "${nodeId}" cannot run in the static DAG executor.`);
+    }
     return runActionWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext);
 }
+/**
+ * In-process {@link NodeExecutor} that dispatches a single non-control node
+ * to the existing side-effecting runner functions. Constructed once per
+ * workflow run so git/platform clients and locks are shared across nodes.
+ *
+ * The Temporal executor will provide its own NodeExecutor whose `runNode`
+ * schedules a Temporal activity instead of executing in-process.
+ */
+class LocalNodeExecutor {
+    config;
+    options;
+    workingDir;
+    executionContext;
+    constructor(config, options, workingDir, executionContext) {
+        this.config = config;
+        this.options = options;
+        this.workingDir = workingDir;
+        this.executionContext = executionContext;
+    }
+    async runNode(nodeId, node, context) {
+        return runSingleWorkflowNode(this.config, nodeId, node, this.options, this.workingDir, context, this.executionContext);
+    }
+}
+export async function runWorkflowNodeLocally(config, nodeId, node, options, workingDir, context) {
+    const executionContext = {
+        gitClients: new Map(),
+        platformClients: {},
+        traceCollector: options.trace ? new TraceCollector() : undefined,
+        locks: {
+            exit: createWorkflowLock(),
+            console: createWorkflowLock(),
+        },
+    };
+    return runSingleWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext);
+}
 export async function runWorkflow(config, workflowName, options = {}) {
     const workflow = config.workflows?.[workflowName];
     if (!workflow) {
         throw new Error(`Unknown workflow "${workflowName}".`);
     }
     const workflowNodes = getWorkflowNodes(workflowName, workflow);
+    const executionOrder = getWorkflowExecutionOrder(workflowNodes);
+    const executionWaves = getWorkflowExecutionWaves(workflowNodes, executionOrder);
+    return executeWorkflowRun(config, workflowName, workflowNodes, executionOrder, executionWaves, workflow.output, hasWorkflowControlNodes(workflowNodes), options);
+}
+/**
+ * Run a workflow from a previously compiled {@link CompiledWorkflowPlan}.
+ *
+ * The plan supplies the scheduling data (nodes, execution order, waves,
+ * segments, output key) so the caller does not need to reload repo config to
+ * drive execution. `config` is still required because agent/action node
+ * execution needs agent and review configuration that lives outside the
+ * compiled plan.
+ */
+export async function runWorkflowFromCompiledPlan(config, plan, options = {}) {
+    const executionSegments = plan.hasControlNodes ? plan.segments : [];
+    if (plan.hasControlNodes) {
+        const workflowNodes = plan.nodes;
+        const order = plan.executionOrder;
+        return executeWorkflowRun(config, plan.workflowName, workflowNodes, order, plan.waves, plan.output, true, options, executionSegments);
+    }
+    return executeWorkflowRun(config, plan.workflowName, plan.nodes, plan.executionOrder, plan.waves, plan.output, false, options);
+}
+async function executeWorkflowRun(config, workflowName, workflowNodes, executionOrder, executionWaves, workflowOutput, hasControl, options, controlSegments) {
+    const workflow = config.workflows?.[workflowName];
+    if (!workflow) {
+        throw new Error(`Unknown workflow "${workflowName}".`);
+    }
     const workingDir = options.workingDir ?? process.cwd();
     const inputs = await resolveWorkflowInputs(workflow, options, workingDir);
     const nodes = {};
     const artifacts = {};
-    const context = { inputs, nodes, artifacts };
+    const loop = {};
+    const context = { inputs, nodes, artifacts, loop };
     const executionContext = {
         gitClients: new Map(),
         platformClients: {},
+        traceCollector: options.trace ? new TraceCollector() : undefined,
         locks: {
             exit: createWorkflowLock(),
             console: createWorkflowLock(),
         },
     };
-    const executionOrder = getWorkflowExecutionOrder(workflowNodes);
-    const executionWaves = getWorkflowExecutionWaves(workflowNodes, executionOrder);
+    const nodeExecutor = new LocalNodeExecutor(config, options, workingDir, executionContext);
     if (!options.jsonOutput) {
         console.log(chalk.gray(`Running workflow ${workflowName}...\n`));
     }
-    for (const wave of executionWaves) {
-        const results = await Promise.all(wave.map(async (nodeId) => {
-            const node = workflowNodes[nodeId];
-            if (!node) {
-                throw new Error(`Workflow references unknown node "${nodeId}".`);
+    try {
+        if (hasControl) {
+            if (controlSegments) {
+                const internalSegments = controlSegments.map((segment) => segment.type === 'control'
+                    ? { type: 'control', nodeId: segment.nodeId }
+                    : {
+                        type: 'dag',
+                        nodeIds: segment.nodeIds,
+                        ...(segment.activeNodeIds ? { activeNodeIds: new Set(segment.activeNodeIds) } : {}),
+                    });
+                await runControlWorkflowFromSegments(workflowNodes, internalSegments, options, context, nodeExecutor);
             }
-            if (!options.jsonOutput) {
-                console.log(chalk.gray(`Running node ${nodeId}...`));
+            else {
+                await runControlWorkflow(workflowNodes, executionOrder, options, context, nodeExecutor);
+            }
+        }
+        else {
+            for (const wave of executionWaves) {
+                const settled = await Promise.allSettled(wave.map(async (nodeId) => {
+                    const node = workflowNodes[nodeId];
+                    if (!node) {
+                        throw new Error(`Workflow references unknown node "${nodeId}".`);
+                    }
+                    const startedAt = new Date().toISOString();
+                    const skipReason = getWorkflowNodeSkipReason(node, context);
+                    if (skipReason) {
+                        logWorkflowNodeSkipped(nodeId, skipReason, options);
+                        return {
+                            nodeId,
+                            node,
+                            result: completeWorkflowNodeResult(createSkippedWorkflowNodeResult(nodeId), startedAt),
+                        };
+                    }
+                    logWorkflowNodeRunning(nodeId, options);
+                    const result = await nodeExecutor.runNode(nodeId, node, context);
+                    return { nodeId, node, result: completeWorkflowNodeResult(result, startedAt) };
+                }));
+                const firstRejection = settled.find((outcome) => outcome.status === 'rejected');
+                if (firstRejection) {
+                    throw firstRejection.reason instanceof Error
+                        ? firstRejection.reason
+                        : new Error(String(firstRejection.reason));
+                }
+                for (const outcome of settled) {
+                    const { nodeId, node, result } = outcome.value;
+                    recordWorkflowNodeResult(nodeId, node, result, nodes, artifacts);
+                }
+            }
+        }
+    }
+    catch (error) {
+        if (executionContext.traceCollector && executionContext.traceCollector.getTraces().length > 0) {
+            try {
+                await flushWorkflowTrace(executionContext.traceCollector, workflowName, inputs, new Date().toISOString(), workingDir, options);
+            }
+            catch (flushError) {
+                console.error(chalk.yellow('Warning:'), 'Failed to persist workflow trace on failure:', flushError instanceof Error ? flushError.message : String(flushError));
             }
-            const result = await runSingleWorkflowNode(config, nodeId, node, options, workingDir, context, executionContext);
-            return { nodeId, node, result };
-        }));
-        for (const { nodeId, node, result } of results) {
-            nodes[nodeId] = result;
-            recordNodeArtifact(nodeId, node, result, artifacts);
         }
+        throw error;
     }
     const lastNodeId = executionOrder[executionOrder.length - 1];
     const lastNode = workflowNodes[lastNodeId];
-    const outputKey = lastNode.output ?? lastNodeId;
+    const outputKey = workflowOutput ?? lastNode.output ?? lastNodeId;
     const result = {
         timestamp: new Date().toISOString(),
         workflow: workflowName,
         inputs,
         nodes,
         artifacts,
+        loop,
         output: artifacts[outputKey],
     };
     if (options.outputPath) {
@@ -1173,6 +2391,9 @@ export async function runWorkflow(config, workflowName, options = {}) {
             console.log(chalk.green(`\n✓ Workflow output saved to ${options.outputPath}`));
         }
     }
+    if (executionContext.traceCollector && executionContext.traceCollector.getTraces().length > 0) {
+        await flushWorkflowTrace(executionContext.traceCollector, workflowName, inputs, result.timestamp, workingDir, options);
+    }
     if (options.jsonOutput) {
         console.log(formatWorkflowJson(result));
     }
@@ -1203,6 +2424,7 @@ export function listWorkflows(config, options = {}) {
             source: info.source,
             overridden: info.overridesPackaged,
             description: workflow.description,
+            metadata: workflow.metadata,
         };
     })
         .sort((a, b) => a.name.localeCompare(b.name));
@@ -1226,4 +2448,214 @@ export function listWorkflows(config, options = {}) {
     }
     return entries;
 }
+function getWorkflowNodeRoutes(node) {
+    if (node.control === 'loop') {
+        return { target: node.target, exit: node.exit };
+    }
+    if (node.control === 'switch') {
+        return { cases: node.cases, default: node.default };
+    }
+    if (node.control === 'passThrough') {
+        return { target: node.target };
+    }
+    return undefined;
+}
+function formatWorkflowInput(input) {
+    if (typeof input === 'string') {
+        return JSON.stringify(input);
+    }
+    if (input.file !== undefined) {
+        return `file:${input.file}`;
+    }
+    return JSON.stringify(input.value ?? '');
+}
+function buildWorkflowDetail(name, workflow, workingDir) {
+    const sourceInfo = loadWorkflowSourceInfo(workingDir);
+    const info = sourceInfo[name] ?? {
+        source: 'packaged',
+        overridesPackaged: false,
+    };
+    const workflowNodes = getWorkflowNodes(name, workflow);
+    getWorkflowExecutionOrder(workflowNodes);
+    const graph = buildWorkflowGraph(name, workflow);
+    return {
+        name,
+        source: info.source,
+        overridden: info.overridesPackaged,
+        description: workflow.description,
+        metadata: workflow.metadata,
+        inputs: workflow.inputs ?? {},
+        output: workflow.output,
+        nodes: Object.entries(workflowNodes).map(([nodeId, node]) => ({
+            id: nodeId,
+            kind: getNodeKind(node),
+            needs: getNodeNeeds(node),
+            agent: node.agent,
+            agentsFrom: node.agentsFrom,
+            action: node.action,
+            control: node.control,
+            if: node.if,
+            input: node.input,
+            with: node.with,
+            output: node.output,
+            writes: node.writes,
+            json: node.json,
+            routes: getWorkflowNodeRoutes(node),
+        })),
+        graph,
+    };
+}
+export function showWorkflowGraph(config, workflowName, options = {}) {
+    const workflow = config.workflows?.[workflowName];
+    if (!workflow) {
+        throw new Error(`Unknown workflow "${workflowName}".`);
+    }
+    const graph = buildWorkflowGraph(workflowName, workflow);
+    const format = options.format ?? 'text';
+    if (format === 'json') {
+        console.log(JSON.stringify(graph, null, 2));
+    }
+    else if (format === 'mermaid') {
+        console.log(formatWorkflowGraphMermaid(graph));
+    }
+    else {
+        console.log(chalk.bold(`\nWorkflow Graph: ${graph.workflow}\n`));
+        for (const node of graph.nodes) {
+            const outgoing = graph.edges.filter((edge) => edge.source === node.id);
+            const suffix = node.condition ? chalk.yellow(` if ${node.condition}`) : '';
+            console.log(`  ${chalk.white(node.id)} ${chalk.gray(`[${node.kind}]`)}${suffix}`);
+            for (const edge of outgoing) {
+                const edgeLabel = edge.label ? ` ${chalk.gray(`(${edge.label})`)}` : '';
+                const marker = edge.kind === 'control' ? chalk.cyan('~>') : chalk.gray('->');
+                console.log(`    ${marker} ${edge.target}${edgeLabel}`);
+            }
+        }
+        console.log('');
+    }
+    return graph;
+}
+export function showWorkflow(config, workflowName, options = {}) {
+    const workflow = config.workflows?.[workflowName];
+    if (!workflow) {
+        throw new Error(`Unknown workflow "${workflowName}".`);
+    }
+    const detail = buildWorkflowDetail(workflowName, workflow, options.workingDir ?? process.cwd());
+    if (options.json) {
+        console.log(JSON.stringify(detail, null, 2));
+        return detail;
+    }
+    const sourceLabel = detail.source === 'packaged' ? chalk.gray('packaged') : chalk.cyan('project');
+    const overridden = detail.overridden ? ` ${chalk.yellow('(overrides packaged)')}` : '';
+    console.log(chalk.bold(`\nWorkflow: ${detail.name}\n`));
+    console.log(`  Source: ${sourceLabel}${overridden}`);
+    if (detail.description) {
+        console.log(`  Description: ${detail.description}`);
+    }
+    if (detail.output) {
+        console.log(`  Output: ${detail.output}`);
+    }
+    if (detail.metadata) {
+        console.log(`  Metadata: ${JSON.stringify(detail.metadata)}`);
+    }
+    console.log(chalk.bold('\nInputs:'));
+    const inputEntries = Object.entries(detail.inputs);
+    if (inputEntries.length === 0) {
+        console.log(chalk.gray('  (none)'));
+    }
+    else {
+        for (const [key, input] of inputEntries) {
+            console.log(`  ${key}: ${formatWorkflowInput(input)}`);
+        }
+    }
+    console.log(chalk.bold('\nNodes:'));
+    for (const node of detail.nodes) {
+        console.log(`  ${node.id} (${node.kind})`);
+        if (node.needs.length > 0) {
+            console.log(`    needs: ${node.needs.join(', ')}`);
+        }
+        if (node.agent)
+            console.log(`    agent: ${node.agent}`);
+        if (node.agentsFrom)
+            console.log(`    agentsFrom: ${node.agentsFrom}`);
+        if (node.action)
+            console.log(`    action: ${node.action}`);
+        if (node.control)
+            console.log(`    control: ${node.control}`);
+        if (node.if)
+            console.log(`    if: ${node.if}`);
+        if (node.output)
+            console.log(`    output: ${node.output}`);
+        if (node.writes)
+            console.log(`    writes: ${node.writes}`);
+        if (node.input)
+            console.log(`    input: ${node.input.split('\n')[0]}`);
+        if (node.with && Object.keys(node.with).length > 0) {
+            console.log(`    with: ${JSON.stringify(node.with)}`);
+        }
+        if (node.routes && Object.keys(node.routes).length > 0) {
+            console.log(`    routes: ${JSON.stringify(node.routes)}`);
+        }
+    }
+    console.log('');
+    return detail;
+}
+function validateSingleWorkflow(config, workflowName, workingDir) {
+    const workflow = config.workflows?.[workflowName];
+    if (!workflow) {
+        return { name: workflowName, valid: false, error: `Unknown workflow "${workflowName}".` };
+    }
+    try {
+        const sourceInfo = loadWorkflowSourceInfo(workingDir);
+        const workflowNodes = getWorkflowNodes(workflowName, workflow);
+        const executionOrder = getWorkflowExecutionOrder(workflowNodes);
+        return {
+            name: workflowName,
+            valid: true,
+            source: sourceInfo[workflowName]?.source ?? 'packaged',
+            waves: getWorkflowExecutionWaves(workflowNodes, executionOrder),
+        };
+    }
+    catch (error) {
+        return {
+            name: workflowName,
+            valid: false,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+export function validateWorkflows(config, workflowName, options = {}) {
+    const workingDir = options.workingDir ?? process.cwd();
+    const names = workflowName ? [workflowName] : Object.keys(config.workflows ?? {}).sort();
+    const results = names.map((name) => validateSingleWorkflow(config, name, workingDir));
+    if (options.json) {
+        console.log(JSON.stringify(results, null, 2));
+        return results;
+    }
+    console.log(chalk.bold('\nWorkflow Validation:\n'));
+    for (const result of results) {
+        if (result.valid) {
+            console.log(`  ${chalk.green('✓')} ${result.name}`);
+            if (result.waves) {
+                console.log(`    waves: ${result.waves.map((wave) => `[${wave.join(', ')}]`).join(' -> ')}`);
+            }
+        }
+        else {
+            console.log(`  ${chalk.red('✗')} ${result.name}`);
+            console.log(`    ${chalk.red(result.error ?? 'invalid workflow')}`);
+        }
+    }
+    console.log('');
+    return results;
+}
+/**
+ * Default in-process {@link WorkflowExecutor}. Delegates to {@link runWorkflow}.
+ *
+ * The Temporal executor will implement the same interface so `drs workflow run`
+ * can dispatch through either backend once `--executor temporal` is added.
+ */
+export class LocalWorkflowExecutor {
+    async run(config, workflowName, options = {}) {
+        return runWorkflow(config, workflowName, options);
+    }
+}
 //# sourceMappingURL=workflow.js.map