@evoclock/pi-agentic-driver 1.1.2 → 2.0.0

package/scripts/enforcement/durable_driver_pi.js

@@ -0,0 +1,254 @@
+// SPDX-FileCopyrightText: 2026 evoclock
+// SPDX-License-Identifier: AGPL-3.0-only
+// Production run ledger. It records outward intent before returning a request to the host.
+import { createHash, randomUUID } from "node:crypto";
+import { realpathSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { Harness, createRegistry, defineDoc } from "@earendil-works/pi-durable";
+import { openNodeSqliteStorage } from "@earendil-works/pi-durable/storage/sqlite/node";
+import { createModels } from "@earendil-works/pi-ai/models";
+import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import durablePackage from "@earendil-works/pi-durable/package.json" with { type: "json" };
+import { claimSeamLock, releaseSeamLock } from "./storage_owner_lock_pi.js";
+
+export const DURABLE_DRIVER_PROTOCOL = "agentic-driver.run.v1";
+const ID = /^[a-zA-Z0-9_-]{1,128}$/;
+const hash = (value) => createHash("sha256").update(value).digest("hex");
+const copy = (value) => JSON.parse(JSON.stringify(value));
+function validateId(value) {
+  if (typeof value !== "string" || !ID.test(value) || ["__proto__", "prototype", "constructor"].includes(value)) {
+    throw new Error("invalid durable identity");
+  }
+  return value;
+}
+function validatePlan(plan) {
+  validateId(plan?.runId);
+  if (!Array.isArray(plan.steps) || !plan.steps.length || plan.steps.length > 64) throw new Error("invalid step plan");
+  const ids = new Set();
+  for (const step of plan.steps) {
+    validateId(step?.id);
+    if (ids.has(step.id) || !["internal", "external"].includes(step.kind)) throw new Error("invalid or repeated step");
+    ids.add(step.id);
+  }
+  if (Object.keys(plan).some((key) => !["runId", "steps"].includes(key)) ||
+      plan.steps.some((step) => Object.keys(step).some((key) => !["id", "kind"].includes(key)))) {
+    throw new Error("unsupported plan field");
+  }
+  return { runId: plan.runId, steps: plan.steps.map(({ id, kind }) => ({ id, kind })) };
+}
+
+/** An exclusive same-owner directory contains state.sqlite. Call close before another process opens it.
+ * Returned external intents are NOT authorization to execute an effect: the host still enforces its own policy.
+ */
+export async function openDurableDriver({ directory }) {
+  if (durablePackage.version !== "1.0.4") throw new Error("pi-durable 1.0.4 required");
+  if (realpathSync(directory) !== directory) throw new Error("canonical storage directory required");
+  const info = statSync(directory);
+  if (!info.isDirectory() || info.uid !== process.getuid() || (info.mode & 0o077) !== 0) {
+    throw new Error("private same-owner storage directory required");
+  }
+  const lease = claimSeamLock(directory);
+  let harness;
+  try {
+    const Runs = defineDoc({ kind: "driver.production-runs", version: 1, scope: "conversation",
+      history: "latest", fork: "initial", initial: () => ({ runs: {} }) });
+    const registry = createRegistry();
+    harness = await Harness.open(await openNodeSqliteStorage(join(directory, "state.sqlite")),
+      { models: createModels(), registry }, BACKGROUND_CONTEXT);
+    const root = await harness.root(BACKGROUND_CONTEXT);
+    // This is the pi-durable scheduler resume, not a reconstructed scheduler or replay of host effects.
+    harness.resume();
+    const owner = randomUUID();
+    let closed = false;
+    const workerFlights = new Set();
+    const ensureOpen = () => { if (closed) throw new Error("durable driver closed"); };
+    const snapshot = async (runId) => {
+      ensureOpen();
+      validateId(runId);
+      const doc = await harness.snapshot(Runs, root.id, BACKGROUND_CONTEXT);
+      const record = doc?.runs?.[runId];
+      return record ? copy(record) : null;
+    };
+    const change = async (runId, update) => {
+      ensureOpen();
+      validateId(runId);
+      return root.commit(async (tx) => {
+        const record = (await tx.doc(Runs, root.id)).runs[runId];
+        if (!record) throw new Error("unknown run");
+        return copy(update(record));
+      }, BACKGROUND_CONTEXT);
+    };
+    return {
+      schema: DURABLE_DRIVER_PROTOCOL,
+      async start(input) {
+        ensureOpen();
+        const plan = validatePlan(input);
+        const digest = hash(JSON.stringify(plan));
+        const receipt = await root.commit(async (tx) => {
+          const runs = (await tx.doc(Runs, root.id)).runs;
+          const previous = Object.hasOwn(runs, plan.runId) ? runs[plan.runId] : null;
+          if (previous) {
+            if (previous.digest !== digest) throw new Error("run identity conflict");
+            return { runId: plan.runId, digest, stepIds: previous.steps.map((step) => step.correlationId ?? step.taskId) };
+          }
+          if (Object.values(runs).filter((run) => ["active", "held"].includes(run.state)).length >= 64) {
+            throw new Error("live run capacity reached; reconciliation required");
+          }
+          const steps = [];
+          for (const item of plan.steps) {
+            const correlationId = hash(`${plan.runId}:${item.id}:${digest}`);
+            steps.push({ ...item, correlationId, state: "pending", requestKey: correlationId });
+          }
+          runs[plan.runId] = { schema: DURABLE_DRIVER_PROTOCOL, digest, runId: plan.runId, state: "active", steps };
+          return { runId: plan.runId, digest, stepIds: steps.map((step) => step.correlationId) };
+        }, BACKGROUND_CONTEXT);
+        harness.resume();
+        return copy(receipt);
+      },
+      status: snapshot,
+      // One external intent covers the complete host-owned invocation. The host owns
+      // its result and action receipts; this ledger never replays an uncertain turn.
+      async invokeWorker({ requestId, goal, transport, signal }) {
+        if (typeof requestId !== "string" || !requestId || requestId.length > 256 ||
+            typeof goal !== "string" || !goal || typeof transport?.invoke !== "function" ||
+            !(signal instanceof AbortSignal)) throw new Error("invalid worker invocation");
+        const runId = hash(`worker:${requestId}`);
+        const stepId = `worker_${hash(JSON.stringify([requestId, goal]))}`;
+        if (workerFlights.has(runId)) throw new Error("worker invocation already active");
+        workerFlights.add(runId);
+        try {
+          await this.start({ runId, steps: [{ id: stepId, kind: "external" }] });
+          const before = await this.status(runId);
+          if (before.state !== "active" || before.steps[0].state !== "pending") {
+            return { runId, state: before.state === "finished" ? "finished" : "held", step: before.steps[0] };
+          }
+          if (signal.aborted) {
+            await this.cancel(runId);
+            return { runId, state: "cancelled" };
+          }
+          const active = await this.resume(runId);
+          const step = active.steps[0];
+          // The intent has committed before crossing the worker boundary.
+          const onAbort = () => { void this.cancel(runId).catch(() => {}); };
+          signal.addEventListener("abort", onAbort, { once: true });
+          try {
+            if (signal.aborted) { await this.cancel(runId); return { runId, state: "cancelled" }; }
+            const delivered = await transport.invoke({ requestId, goal, requestKey: step.requestKey, signal });
+            if (signal.aborted) { await this.cancel(runId); return { runId, state: "cancelled" }; }
+            if (delivered?.verified !== true || typeof delivered.reference !== "string" ||
+                !delivered.reference || delivered.reference.length > 512) {
+              throw new Error("verified worker receipt required");
+            }
+            await this.report(runId, { stepId, requestKey: step.requestKey,
+              receipt: { requestKey: step.requestKey, verified: true, reference: delivered.reference } });
+            return { runId, state: "finished", result: delivered.result };
+          } finally { signal.removeEventListener("abort", onAbort); }
+        } finally { workerFlights.delete(runId); }
+      },
+      // Resume advances only to the first unfinished step. An external intent is persisted
+      // before being returned. After interruption, an unreceipted intent is held, not reissued.
+      async resume(runId) {
+        return change(runId, (run) => {
+          if (run.state !== "active") return run;
+          const step = run.steps.find((item) => item.state !== "finished");
+          if (!step) { run.state = "finished"; return run; }
+          if (step.state === "intent" && step.intentOwner !== owner) {
+            step.state = "held"; run.state = "held"; return run;
+          }
+          if (step.state === "pending") {
+            step.state = step.kind === "external" ? "intent" : "ready";
+            if (step.state === "intent") step.intentOwner = owner;
+          }
+          return run;
+        });
+      },
+      // Only the host can prove an effect was never sent. This is a new attempt with a new key;
+      // an unknown send outcome must remain held and must not use this operation.
+      async release(runId, evidence) {
+        validateId(evidence?.stepId);
+        return change(runId, (run) => {
+          const step = run.steps.find((item) => item.id === evidence.stepId);
+          if (run.state !== "held" || step?.kind !== "external" || step.state !== "held" ||
+              step.requestKey !== evidence.requestKey) throw new Error("unknown held intent");
+          if (evidence.verifiedNotSent !== true || typeof evidence.reference !== "string" ||
+              !evidence.reference || evidence.reference.length > 512 ||
+              Object.keys(evidence).some((key) => !["stepId", "requestKey", "verifiedNotSent", "reference"].includes(key))) {
+            throw new Error("not-sent proof required");
+          }
+          step.releases = [...(step.releases ?? []), { requestKey: step.requestKey, reference: evidence.reference }];
+          step.requestKey = hash(`${step.requestKey}:${randomUUID()}`);
+          step.intentOwner = owner;
+          step.state = "intent";
+          run.state = "active";
+          return run;
+        });
+      },
+      // A report is evidence only. External effects require an independently verified receipt.
+      async report(runId, { stepId, requestKey, receipt }) {
+        validateId(stepId);
+        return change(runId, (run) => {
+          const step = run.steps.find((item) => item.id === stepId);
+          if (!step || step.requestKey !== requestKey) throw new Error("step identity conflict");
+          if (step.state === "finished") {
+            if (JSON.stringify(step.receipt ?? null) !== JSON.stringify(receipt ?? null)) throw new Error("receipt conflict");
+            return run;
+          }
+          if (run.state !== "active" || step !== run.steps.find((item) => item.state !== "finished")) {
+            throw new Error("step is not active");
+          }
+          if (step.kind === "external") {
+            if (step.state !== "intent" || receipt?.requestKey !== requestKey ||
+                receipt?.verified !== true || typeof receipt.reference !== "string" ||
+                !receipt.reference || receipt.reference.length > 512 ||
+                Object.keys(receipt).some((key) => !["requestKey", "verified", "reference"].includes(key))) {
+              throw new Error("verified external receipt required");
+            }
+            step.receipt = copy(receipt);
+          } else if (step.state !== "ready" || receipt !== undefined) {
+            throw new Error("internal step is not ready");
+          }
+          step.state = "finished";
+          if (run.steps.every((item) => item.state === "finished")) run.state = "finished";
+          return run;
+        });
+      },
+      // Reconciliation never sends an effect. A host may provide proof for a held intent;
+      // absence or disagreement leaves the run held for operator review.
+      async reconcile(runId, evidence) {
+        validateId(evidence?.stepId);
+        return change(runId, (run) => {
+          if (run.state === "cancelled") throw new Error("cancelled run cannot reconcile");
+          const step = run.steps.find((item) => item.id === evidence.stepId);
+          if (!step || step.kind !== "external" || step.requestKey !== evidence.requestKey) {
+            throw new Error("unknown external intent");
+          }
+          if (step.state === "finished") {
+            if (evidence.verified === true && evidence.reference === step.receipt?.reference) return run;
+            throw new Error("reconciliation conflict");
+          }
+          if (!["held", "intent"].includes(step.state)) throw new Error("unknown external intent");
+          if (evidence.verified === true && typeof evidence.reference === "string" &&
+              evidence.reference.length > 0 && evidence.reference.length <= 512) {
+            step.receipt = { requestKey: step.requestKey, verified: true, reference: evidence.reference };
+            step.state = "finished";
+            if (run.state !== "cancelled") run.state = run.steps.every((item) => item.state === "finished") ? "finished" : "active";
+          } else { step.state = "held"; if (run.state !== "cancelled") run.state = "held"; }
+          return run;
+        });
+      },
+      async cancel(runId) {
+        return change(runId, (run) => { if (run.state !== "finished") run.state = "cancelled"; return run; });
+      },
+      async close() {
+        if (closed) return;
+        if (workerFlights.size) throw new Error("worker invocation is active");
+        try { await harness.close(BACKGROUND_CONTEXT); }
+        finally { closed = true; releaseSeamLock(lease); }
+      },
+    };
+  } catch (error) {
+    try { if (harness) await harness.close(BACKGROUND_CONTEXT); }
+    finally { releaseSeamLock(lease); }
+    throw error;
+  }
+}

package/scripts/enforcement/herdr_async_dispatch_pi.js

@@ -12,6 +12,7 @@
 import {
   executeHerdrCommunication,
   executeHerdrPromptExchange,
+  inspectHerdrJourneyMarker,
   HERDR_REPORT_MARKERS,
   HERDR_COMMUNICATION_SCHEMA,
   HERDR_COMMUNICATION_ACTIONS,
@@ -21,6 +22,7 @@ import { prepareEnvelopeForExecution, validateEnvelopeForExecution, consumeEnvel
 import { sha256Hex } from "./task_board_core_pi.js";
 import { sessionTaskDisplayId, PROVENANCE_CAPTURE_STATUSES } from "./session_tasks_core_pi.js";
 import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
 
 export const WORKER_DISPATCH_TOOL = "agentic_worker_dispatch";
 export const WORKER_DISPATCH_SCHEMA = "agentic-driver.worker-dispatch.v1";
@@ -43,19 +45,20 @@ export const REVIEW_REQUEST_MARKER = "[REVIEW_REQUESTED]";
 // other terminal state is an observed outcome, and no state is retried.
 export const WORKER_DISPATCH_TERMINAL_STATES = Object.freeze([
   "completed", "exhausted", "role-blocked", "cancelled", "failed", "waiting-approval", "worker-unresponsive",
-  "review_requested",
+  "review_requested", "blocked",
 ]);
 
 export const WORKER_DISPATCH_PARAMETERS = Object.freeze({
   type: "object",
   additionalProperties: false,
   properties: {
-    action: { type: "string", enum: ["dispatch", "pulse"] },
+    action: { type: "string", enum: ["dispatch", "pulse", "journeys"] },
     role: { type: "string", pattern: "^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$", maxLength: 64 },
     mode: { type: "string", enum: WORKER_DISPATCH_MODES },
     autonomy: { type: "string", enum: WORKER_DISPATCH_AUTONOMY_MODES },
     maxSteps: { type: "integer", minimum: 1, maximum: MAX_JOURNEY_STEPS },
     stepPrompt: { type: "string", minLength: 1, maxLength: 8192 },
+    journeyId: { type: "string", pattern: "^[a-zA-Z0-9_-]{1,100}$", maxLength: 100 },
     model: { type: "string", pattern: "^[a-z0-9][a-z0-9._-]{0,63}(?:\\/[a-z0-9][a-z0-9._-]{0,127})*$", maxLength: 192 },
     cast: {
       type: "object",
@@ -70,11 +73,15 @@ export const WORKER_DISPATCH_PARAMETERS = Object.freeze({
       additionalProperties: false,
     },
   },
-  required: ["action", "role"],
+  required: ["action"],
   allOf: [
+    {
+      if: { properties: { action: { const: "pulse" } }, required: ["action"] },
+      then: { required: ["role"] },
+    },
     {
       if: { properties: { action: { const: "dispatch" } }, required: ["action"] },
-      then: { required: ["stepPrompt"] },
+      then: { required: ["role", "stepPrompt"] },
     },
   ],
 });
@@ -296,7 +303,12 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
   const taskStore = typeof options.taskStoreFactory === "function"
     ? options.taskStoreFactory(context) : options.taskStore;
   const spawnReplacement = typeof options.spawnReplacement === "function" ? options.spawnReplacement : null;
-  const journey = { mode, autonomy, role, steps: [], status: "failed", code: null, handoff: null };
+  const journeyId = params.journeyId ?? randomUUID();
+  if (!/^[a-zA-Z0-9_-]{1,100}$/.test(journeyId)) {
+    return failure("dispatch", dispatchError("journey-id-invalid", "invalid journey ID", "denied"));
+  }
+  const persistence = options.journeyStore;
+  const journey = { journeyId, mode, autonomy, role, steps: [], status: "failed", code: null, handoff: null };
   // Snapshot once at journey start; observational evidence never gates or
   // authorizes existing dispatch, replacement, or board execution.
   // Full immutable capture stays local for drift revalidation. The tool
@@ -340,7 +352,7 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
   const finish = async (requestedStatus) => {
     let status = requestedStatus;
     if (board && boardAttemptStarted && !envelopeConsumed) {
-      const reason = ["completed", "exhausted", "cancelled", "failed", "waiting-approval", "role-blocked", "worker-unresponsive", "review_requested"].includes(status)
+      const reason = ["completed", "exhausted", "cancelled", "failed", "blocked", "waiting-approval", "role-blocked", "worker-unresponsive", "review_requested"].includes(status)
         ? status
         : status.startsWith("worker-unresponsive") ? "worker-unresponsive" : "failed";
       let consumed;
@@ -363,6 +375,7 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
       schema: WORKER_DISPATCH_SCHEMA,
       ok: status === "completed" || status === "exhausted" || status === "waiting-approval" || status === "review_requested",
       action: "dispatch",
+      journeyId,
       mode,
       autonomy,
       ...(journey.cast ? { cast: journey.cast } : {}),
@@ -376,7 +389,7 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
       handoff: journey.handoff,
       taskProvenance: projectedTaskProvenance,
       nonAuthorizing: true,
-      persisted: false,
+      persisted: Boolean(persistence),
     };
   };
 
@@ -522,10 +535,23 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
   for (let stepIndex = 1; stepIndex <= maxSteps; stepIndex += 1) {
     if (signal?.aborted) { journey.status = "cancelled"; return finish("cancelled"); }
 
+    // Only in-flight and later checkpoints may skip dispatch checks: their
+    // send is uncertain or already recorded. Admitted has never sent, so
+    // restart must check liveness and obtain native confirmation again.
+    let recovering = false;
+    try {
+      recovering = Boolean(persistence && params.journeyId &&
+        (await persistence.listJourneys()).some((entry) => entry.journeyId === journeyId &&
+          entry.iteration === String(stepIndex) && entry.role === role && entry.state !== "admitted"));
+    } catch (error) {
+      journey.code = "journey-store-conflict";
+      journey.steps.push({ step: stepIndex, taskDisplayId: null, status: "blocked", error: String(error?.message || error).slice(0, 256) });
+      return finish("blocked");
+    }
     // Pulse: liveness and dispatch eligibility, no authority.
     let pulse;
     try {
-      pulse = await workerPulse(role, context, communicationOptions, signal);
+      if (!recovering) pulse = await workerPulse(role, context, communicationOptions, signal);
     } catch (error) {
       journey.status = error?.code === "role_blocked" ? "role-blocked" : "failed";
       journey.code = error?.code || "pulse-failed";
@@ -534,17 +560,17 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
     }
     // The pre-task pulse has not selected a task. Confirmed replacement here
     // cannot be tied to a task identity, so it must not offer a spawn.
-    if (autonomy !== "autonomous" && (!pulse.alive || (!pulse.dispatchEligible && pulse.status !== "blocked"))) {
+    if (!recovering && autonomy !== "autonomous" && (!pulse.alive || (!pulse.dispatchEligible && pulse.status !== "blocked"))) {
       journey.status = "worker-unresponsive";
       journey.code = "worker-unresponsive";
       journey.steps.push({ step: stepIndex, taskDisplayId: null, status: "worker-unresponsive", error: "worker unavailable before task selection" });
       journey.handoff = { attempted: false, reason: "no task selected for confirmed replacement" };
       return finish("worker-unresponsive");
     }
-    if (!pulse.alive) {
+    if (!recovering && !pulse.alive) {
       return handoffToReplacement("worker role is not alive");
     }
-    if (!pulse.dispatchEligible) {
+    if (!recovering && !pulse.dispatchEligible) {
       if (pulse.status === "blocked") {
         journey.status = "role-blocked";
         journey.code = "role_blocked";
@@ -581,9 +607,9 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
       return finish("waiting-approval");
     }
 
-    // Consequential dispatch requires native confirmation, once per step,
-    // unless the initial dispatch explicitly authorized autonomous progression.
-    if (autonomy !== "autonomous") {
+    // Consequential dispatch requires native confirmation before each send;
+    // only a previously committed in-flight or later task is observe-only.
+    if (!recovering && autonomy !== "autonomous") {
       if (!isNativeTuiContext(context) || typeof context?.ui?.confirm !== "function") {
         journey.status = "failed";
         journey.steps.push({ step: stepIndex, taskDisplayId: displayTaskId, status: "failed", error: "native TUI confirmation unavailable" });
@@ -622,17 +648,43 @@ export async function runWorkerJourney(params, context, options = {}, signal) {
       }
     }
 
+    // Commit the effect intent before invoking Herdr. An interrupted intent is
+    // ambiguous: do not replay it just because this process did not see an ack.
+    const requestId = `${journeyId}:${stepIndex}`;
+    const recordId = `jrn-${sha256Hex(requestId).slice(0, 32)}`;
+    const digest = sha256Hex(JSON.stringify({ requestId, role, taskId: task.id, stepPrompt }));
     // One prompt exchange. Any failure is terminal for the journey; there is
     // no invisible retry or resend. The legacy blocking exchange is used
     // deliberately: a journey step is a single prompt→report round-trip, and
     // the tool-facing prompt action is now async delivery-only.
-    const exchange = await executeHerdrPromptExchange(
-      { action: "prompt", role, prompt: `${stepPrompt}\nTask: ${task.id}${task.subject ? ` — ${task.subject}` : ""}`, timeoutMs: 120000 },
-      context,
-      communicationOptions,
-      signal,
+    const send = (stepSignal) => executeHerdrPromptExchange(
+      { action: "prompt", role, prompt: `${stepPrompt}\nTask: ${task.id}${task.subject ? ` — ${task.subject}` : ""}\n[journey:${requestId}]`, timeoutMs: 120000 },
+      context, communicationOptions, stepSignal,
     );
+    let exchange;
+    try {
+      if (persistence) {
+        const step = await persistence.runJourneyStep({ id: recordId, digest, role, repository: context.cwd,
+          createdAt: Date.now(), journeyId, iteration: String(stepIndex), taskId: String(task.id),
+          ...(board?.envelope?.cardId ? { cardId: board.envelope.cardId } : {}) }, {
+          send,
+          observe: (stepSignal) => inspectHerdrJourneyMarker(role, requestId, context, communicationOptions, stepSignal),
+          boundary: (name) => options.journeyBoundary?.(name, { journeyId, requestId }),
+        });
+        exchange = step.state === "verified" ? { ok: true, report: step.report, agentStatus: null }
+          : { ok: false, code: "journey-effect-uncertain" };
+      } else exchange = await send(signal);
+    } catch (error) {
+      journey.code = "journey-store-conflict";
+      journey.steps.push({ step: stepIndex, taskDisplayId: displayTaskId, status: "blocked", error: String(error?.message || error).slice(0, 256) });
+      return finish("blocked");
+    }
     if (exchange.ok !== true) {
+      if (persistence) {
+        journey.code = exchange.code || "journey-effect-uncertain";
+        journey.steps.push({ step: stepIndex, taskDisplayId: displayTaskId, status: "blocked", error: "reconcile exchange before another send" });
+        return finish("blocked");
+      }
       const unresponsive = exchange.code === "prompt_stalled" || exchange.code === "prompt_delivery_unknown" || exchange.code === "process_timeout";
       if (unresponsive) {
         if (autonomy === "autonomous" && castCheck?.authorized) {
@@ -740,7 +792,21 @@ export function registerWorkerDispatchInterface(pi, options = {}) {
           value = failure("pulse", error);
         }
       } else {
-        value = await runWorkerJourney(params ?? {}, context, options, signal);
+        try {
+          const journeyStore = options.getJourneyStore ? await options.getJourneyStore(context) : options.journeyStore;
+          if (params?.action === "journeys") {
+            if (!journeyStore) throw new Error("journey store unavailable");
+            const records = await journeyStore.listJourneys();
+            value = { schema: WORKER_DISPATCH_SCHEMA, ok: true, action: "journeys", nonAuthorizing: true,
+              journeys: records.filter((record) => (!params.role || record.role === params.role) &&
+                (!params.journeyId || record.journeyId === params.journeyId) && record.repository === context.cwd)
+                .map(({ journeyId, iteration, state, taskId, cardId }) => ({ journeyId, iteration, state, taskId, cardId })) };
+          } else {
+            value = await runWorkerJourney(params ?? {}, context, { ...options, journeyStore }, signal);
+          }
+        } catch (error) {
+          value = failure("dispatch", dispatchError("journey-store-unavailable", String(error?.message || error)));
+        }
       }
       return {
         content: [{ type: "text", text: JSON.stringify(value, null, 2) }],

package/scripts/enforcement/herdr_async_seam_pi.js

@@ -1,7 +1,7 @@
 // SPDX-FileCopyrightText: 2026 Julen Gamboa <j.a.r.gamboa@gmail.com>
 // SPDX-License-Identifier: AGPL-3.0-only
 
-// Cross-repo async transport seam (vogelkop phase #47). A versioned,
+// Cross-repo async transport seam. A versioned,
 // non-authorizing submit receipt is accepted immediately after a guarded
 // submission; settlement is observed later through separate poll/observe/read
 // operations. Nothing here retries, resends, or re-prompts: one submission is
@@ -15,13 +15,14 @@
 import { createHash } from "node:crypto";
 import {
   executeHerdrCommunication,
+  expectedRepository,
   reportMarkersForRole,
   HERDR_COMMUNICATION_SCHEMA,
 } from "./herdr_communication_pi.js";
 
 export const ASYNC_DISPATCH_TOOL = "agentic_worker_dispatch_async";
 export const ASYNC_DISPATCH_SCHEMA = "agentic-driver.async-dispatch.v1";
-export const ASYNC_RECEIPT_SCHEMA = "vogelkop.async-transport.receipt.v1";
+export const ASYNC_RECEIPT_SCHEMA = "agentic-driver.async-transport.receipt.v2";
 export const ASYNC_SUBMIT_STATUS = "submitted";
 export const ASYNC_TERMINAL_STATES = Object.freeze([
   "completed", "exhausted", "review_requested", "failed", "cancelled",
@@ -74,7 +75,7 @@ function baseFields(submission) {
     driverSchema: ASYNC_DISPATCH_SCHEMA,
     nonAuthorizing: true,
     authorityCreated: false,
-    persisted: false,
+    persisted: submission.persisted === true,
   };
 }
 
@@ -150,6 +151,88 @@ function getSubmission(id) {
   return submission;
 }
 
+// Explicit OFFLINE opt-in. The store is injected; importing this module never
+// opens SQLite, changes registration, or selects a live transport.
+function offlineOptions(options) {
+  const communication = options.communication ?? options;
+  const store = options.offlinePersistence;
+  if (store?.schema !== "agentic-driver.offline-seam-store.v1" || typeof communication.runProcess !== "function" ||
+      ["get", "reserve", "update"].some((name) => typeof store?.[name] !== "function")) {
+    throw submissionError("offline-persistence-required", "offline store and injected process adapter required", "denied");
+  }
+  return { ...communication, offlinePersistence: store };
+}
+
+function offlineRepository(context) {
+  return expectedRepository(context);
+}
+
+function restoredSubmission(saved) {
+  return { ...saved, submissionId: saved.id, idempotencyKey: saved.digest, persisted: true };
+}
+
+async function persistedSubmission(id, context, options) {
+  offlineOptions(options);
+  if (typeof id !== "string" || !id.trim()) throw submissionError("submission-id-required", "submissionId required", "denied");
+  const saved = await options.offlinePersistence.get("submission", id);
+  if (!saved) throw submissionError("unknown-submission", "no persisted submission is known", "denied");
+  if (saved.repository !== offlineRepository(context)) throw submissionError("repository-mismatch", "submission belongs to another repository", "denied");
+  return restoredSubmission(saved);
+}
+
+async function submitPersistedAsync(params, context, options, signal) {
+  const communication = offlineOptions(options);
+  const repository = offlineRepository(context);
+  const digest = sha256Hex(JSON.stringify({ repository, role: params.role, prompt: params.prompt }));
+  const requestId = options.offlineRequestId ?? digest;
+  if (typeof requestId !== "string" || !/^[a-z0-9-]{1,128}$/.test(requestId)) throw submissionError("request-id-invalid", "bounded offline identity required", "denied");
+  const id = `sub-${sha256Hex(`${repository}\u0000${requestId}`).slice(0, 32)}`;
+  const deliveryIdentity = sha256Hex(`${repository}\u0000${id}`);
+  const deliveryId = `dlv-${deliveryIdentity.slice(0, 16)}-${deliveryIdentity.slice(16, 32)}`;
+  const store = options.offlinePersistence;
+  const reserved = await store.reserve("submission", { id, digest, role: params.role, repository,
+    createdAt: Date.now(), phase: "pending", deliveryId });
+  const record = restoredSubmission(reserved.record);
+  if (!reserved.created) {
+    const accepted = record.phase === "accepted";
+    return { ...submitResult(record, { duplicate: true, inFlight: false, promptSent: false }),
+      ok: accepted, status: accepted ? ASYNC_SUBMIT_STATUS : "held", held: !accepted };
+  }
+  try {
+    await options.offlineBoundary?.("after-submission-intent", { submissionId: id, deliveryId });
+    if ((await store.get("submission", id)).phase !== "pending") throw submissionError("submission-held", "submission held before handoff");
+    const sent = await executeHerdrCommunication({ action: "submit", role: params.role, prompt: params.prompt, timeoutMs: 15000 },
+      context, { ...communication, offlineRequestId: id }, signal);
+    if (!sent.ok || sent.deliveryId !== deliveryId) throw submissionError(sent.code ?? "delivery-unconfirmed", sent.reason ?? "delivery not confirmed; do not resend");
+    const accepted = await store.update("submission", id, digest, { phase: "accepted", acceptedAt: sent.acceptedAt });
+    await options.offlineBoundary?.("after-submission-ack", { submissionId: id, deliveryId });
+    if (accepted.phase !== "accepted") throw submissionError("submission-held", "ack retained for held submission");
+    return submitResult(restoredSubmission(accepted), { duplicate: false, inFlight: false, promptSent: true });
+  } catch (error) {
+    // An intent tombstone is retained even if its transport/ack commit failed.
+    // No automatic retry or role-keyed latest-report fallback can follow.
+    await store.update("submission", id, digest, { phase: "held" });
+    return { ...baseFields(record), ok: false, action: "submit", status: "held", held: true,
+      deliveryId, code: error?.code ?? "delivery-unconfirmed" };
+  }
+}
+
+async function observePersistedAsync(action, params, context, options, signal) {
+  const submission = await persistedSubmission(params?.submissionId, context, options);
+  if (submission.phase !== "accepted") {
+    return { ...baseFields(submission), ok: action !== "read", action, state: "unknown", terminal: false,
+      held: true, code: "delivery-unconfirmed", deliveryId: submission.deliveryId };
+  }
+  const observed = await executeHerdrCommunication({ action: "delivery", deliveryId: submission.deliveryId }, context, offlineOptions(options), signal);
+  const ready = observed.ok === true && observed.deliveryState === "answered";
+  const held = observed.held === true || ["unknown", "failed", "unattributed"].includes(observed.deliveryState);
+  return { ...baseFields(submission), ok: action === "read" ? ready : observed.ok === true, action,
+    state: ready ? "report-ready" : "unknown", terminal: false, held, deliveryId: submission.deliveryId,
+    deliveryState: observed.deliveryState, reportAvailable: ready,
+    ...(action === "read" && ready ? { report: observed.report, reportMarkers: observed.reportMarkers } : {}),
+    ...(!ready && action === "read" ? { code: "report-not-ready" } : {}), observedAt: new Date().toISOString() };
+}
+
 // Async submit: one guarded submission attempt, receipt returned immediately.
 // No settlement wait, no retry, no resend. A repeated idempotencyKey returns
 // the original receipt without sending a second prompt (no duplicate prompt).
@@ -162,6 +245,7 @@ export async function submitAsyncDispatch(params, context, options = {}, signal)
     if (typeof params?.prompt !== "string" || !params.prompt.trim()) {
       throw submissionError("prompt-required", "submit requires non-empty brief text", "denied");
     }
+    if (options.offlinePersistence) return await submitPersistedAsync(params, context, options, signal);
     const keyMaterial = JSON.stringify({ role: params.role, prompt: params.prompt });
     const idempotencyKey = sha256Hex(keyMaterial);
     evictExpired();
@@ -212,6 +296,7 @@ export async function submitAsyncDispatch(params, context, options = {}, signal)
 export async function pollAsyncDispatch(params, context, options = {}, signal) {
   const action = "poll";
   try {
+    if (options.offlinePersistence) return await observePersistedAsync(action, params, context, options, signal);
     const submission = getSubmission(params?.submissionId);
     const observed = await executeHerdrCommunication(
       { action: "get", role: submission.role },
@@ -242,6 +327,7 @@ export async function pollAsyncDispatch(params, context, options = {}, signal) {
 export async function observeAsyncDispatch(params, context, options = {}, signal) {
   const action = "observe";
   try {
+    if (options.offlinePersistence) return await observePersistedAsync(action, params, context, options, signal);
     const submission = getSubmission(params?.submissionId);
     const observed = await executeHerdrCommunication(
       { action: "get", role: submission.role },
@@ -272,6 +358,7 @@ export async function observeAsyncDispatch(params, context, options = {}, signal
 export async function readAsyncDispatch(params, context, options = {}, signal) {
   const action = "read";
   try {
+    if (options.offlinePersistence) return await observePersistedAsync(action, params, context, options, signal);
     const submission = getSubmission(params?.submissionId);
     const read = await executeHerdrCommunication(
       { action: "read", role: submission.role },