@hasna/workflows 0.2.1 → 0.2.2

package/dist/serve/index.js

@@ -22,7 +22,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/workflows",
-    version: "0.2.1",
+    version: "0.2.2",
     description: "Universal graph workflow app \u2014 graph language (start/step/decision/while/end), three-table store, session WAL, daemon with claims/leases, four lane adapters (claude/codex/cursor/grok), and a full CLI on four surfaces",
     type: "module",
     main: "./dist/index.js",
@@ -98,7 +98,7 @@ var init_package = __esm(() => {
     dependencies: {
       "@anthropic-ai/claude-agent-sdk": "0.3.234",
       "@cursor/sdk": "^1.0.28",
-      "@hasna/contracts": "1.3.3",
+      "@hasna/contracts": "1.3.5",
       "@openai/codex-sdk": "0.160.0",
       commander: "^13.1.0",
       pg: "^8.16.3"
@@ -2732,7 +2732,7 @@ var init_store = __esm(() => {
 // src/wal.ts
 import { Database as Database2 } from "bun:sqlite";
 import { createHash as createHash2 } from "crypto";
-import { appendFileSync, copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, truncateSync, writeFileSync, constants } from "fs";
+import { closeSync, copyFileSync, existsSync as existsSync2, fsyncSync, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync2, renameSync, truncateSync, writeFileSync, constants } from "fs";
 import { basename, dirname, join as join4 } from "path";
 function checksumOf(op) {
   if (op === undefined || op === null)
@@ -2799,8 +2799,20 @@ class SessionWAL {
     const full = { ...op, at };
     const nextSeq = this.nextSeq();
     const entry = { seq: nextSeq, at, checksum: checksumOf(full), op: full };
-    appendFileSync(this.filePath, JSON.stringify(entry) + `
-`, { encoding: "utf8", mode: 384 });
+    const fd = openSync(this.filePath, "a", 384);
+    try {
+      writeFileSync(fd, JSON.stringify(entry) + `
+`, "utf8");
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    const parent = openSync(dirname(this.filePath), "r");
+    try {
+      fsyncSync(parent);
+    } finally {
+      closeSync(parent);
+    }
     return entry;
   }
   nextSeq() {
@@ -2817,7 +2829,9 @@ class SessionWAL {
     let content;
     try {
       content = readFileSync2(this.filePath, "utf8");
-    } catch {
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
       return { entries, torn, repaired, liveClaims: () => new Map };
     }
     if (content.length > MAX_WAL_BYTES) {
@@ -2911,6 +2925,40 @@ var init_wal = __esm(() => {
   MAX_WAL_BYTES = 256 * 1024 * 1024;
 });
 
+// src/journal-directory.ts
+import { accessSync, closeSync as closeSync2, constants as constants2, fstatSync, lstatSync, openSync as openSync2, readFileSync as readFileSync3, readSync } from "fs";
+import { join as join5 } from "path";
+function assertJournalDirectory(dataDir2, identity) {
+  try {
+    if (!lstatSync(dataDir2).isDirectory() || !lstatSync(join5(dataDir2, "sessions")).isDirectory())
+      throw new Error;
+    accessSync(dataDir2, constants2.R_OK | constants2.W_OK | constants2.X_OK);
+    accessSync(join5(dataDir2, "sessions"), constants2.R_OK | constants2.W_OK | constants2.X_OK);
+    const marker = openSync2(join5(dataDir2, ".workflows-data-identity"), constants2.O_RDONLY | constants2.O_NOFOLLOW);
+    try {
+      const stat = fstatSync(marker);
+      if (!stat.isFile() || stat.size > 256 || readFileSync3(marker, "utf8") !== identity + `
+`)
+        throw new Error;
+    } finally {
+      closeSync2(marker);
+    }
+    for (const file of ["workflows.db", "sessions/session.wal"]) {
+      const fd = openSync2(join5(dataDir2, file), constants2.O_RDWR | constants2.O_NOFOLLOW);
+      try {
+        if (!fstatSync(fd).isFile())
+          throw new Error;
+        readSync(fd, Buffer.alloc(1), 0, 1, 0);
+      } finally {
+        closeSync2(fd);
+      }
+    }
+  } catch {
+    throw new Error("configured execution journal identity or accessibility check failed");
+  }
+}
+var init_journal_directory = () => {};
+
 // src/service.ts
 import { createHash as createHash3 } from "crypto";
 import { hostname } from "os";
@@ -2931,6 +2979,14 @@ function envInt(names, fallback) {
   return Number.isFinite(parsed) ? parsed : fallback;
 }
 function resolveWorkflowsConfig(overrides = {}) {
+  const rawLanes = process.env.HASNA_WORKFLOWS_ENABLED_LANES;
+  const enabledLanes = overrides.enabledLanes ?? (rawLanes === undefined ? LANE_KINDS : rawLanes.trim() === "" ? [] : rawLanes.split(",").map((value) => value.trim()));
+  if (!Array.isArray(enabledLanes) || enabledLanes.some((lane) => !LANE_KINDS.includes(lane)) || new Set(enabledLanes).size !== enabledLanes.length) {
+    throw new Error("HASNA_WORKFLOWS_ENABLED_LANES must be a unique comma-separated subset of claude,codex,cursor,grok; an empty value disables model lanes");
+  }
+  const dataIdentity = overrides.dataIdentity ?? process.env.HASNA_WORKFLOWS_DATA_IDENTITY;
+  if (dataIdentity !== undefined && !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(dataIdentity))
+    throw new Error("HASNA_WORKFLOWS_DATA_IDENTITY must be a nonempty data identity of at most 128 characters");
   const originAuth = overrides.originAuth ?? process.env.HASNA_WORKFLOWS_ORIGIN_AUTH;
   if (originAuth !== undefined && !/^[A-Za-z0-9_-]{32,256}$/.test(originAuth))
     throw new Error("HASNA_WORKFLOWS_ORIGIN_AUTH must be a valid gateway origin identity");
@@ -2941,9 +2997,11 @@ function resolveWorkflowsConfig(overrides = {}) {
     apiUrl: overrides.apiUrl ?? envString(["HASNA_WORKFLOWS_API_URL", "WORKFLOWS_API_URL"]),
     apiKey: overrides.apiKey ?? envString(["HASNA_WORKFLOWS_API_KEY", "WORKFLOWS_API_KEY"]),
     originAuth,
+    dataIdentity,
     storageBackend: overrides.storageBackend ?? "postgresql",
     databaseUrl: overrides.databaseUrl ?? envString(["HASNA_WORKFLOWS_DATABASE_URL", "WORKFLOWS_DATABASE_URL"]),
-    databaseSchema: overrides.databaseSchema ?? envString(["HASNA_WORKFLOWS_DATABASE_SCHEMA", "WORKFLOWS_DATABASE_SCHEMA"])
+    databaseSchema: overrides.databaseSchema ?? envString(["HASNA_WORKFLOWS_DATABASE_SCHEMA", "WORKFLOWS_DATABASE_SCHEMA"]),
+    enabledLanes: Object.freeze([...enabledLanes])
   };
 }
 
@@ -2976,16 +3034,52 @@ class WorkflowsService {
   }
   async ready() {
     const checks = { version: "ok", auth: this.config.apiKey ? "ok" : "missing", storage: "not-checked" };
-    if (this.config.apiKey) {
+    if (this.config.dataIdentity !== undefined) {
+      try {
+        this.verifyJournalDirectory();
+        checks.journal = "ok";
+      } catch {
+        checks.journal = "unavailable";
+      }
+    }
+    if (this.config.apiKey && checks.journal !== "unavailable") {
       try {
         checks.storage = await this.withStore(async (store) => (store instanceof PostgresWorkflowsStore ? await store.checkSchema() : (await store.listTables()).sort().join(",") === "memos,run_nodes,runs") ? "ok" : "invalid-schema");
       } catch (error) {
         checks.storage = error instanceof WorkflowRequestError && error.code === "invalid_schema" ? "invalid-schema" : "unavailable";
       }
     }
-    return { ok: checks.auth === "ok" && checks.storage === "ok", service: this.name, version: this.version, checks };
+    return { ok: checks.auth === "ok" && checks.storage === "ok" && checks.journal !== "unavailable", service: this.name, version: this.version, checks };
+  }
+  verifyJournalDirectory() {
+    if (this.config.dataIdentity !== undefined) {
+      try {
+        assertJournalDirectory(this.config.dataDir, this.config.dataIdentity);
+      } catch {
+        throw new WorkflowRequestError("journal_unavailable", "configured execution journal identity or accessibility check failed", 503);
+      }
+    }
+  }
+  assertEnabledGraphLanes(graph) {
+    if (!Array.isArray(graph?.nodes))
+      return;
+    for (const node2 of graph.nodes) {
+      if (node2.type === "step" && !node2.command && !this.config.enabledLanes.includes(node2.lane ?? "claude")) {
+        throw new WorkflowRequestError("lane_disabled", "the workflow contains a model lane disabled by server configuration", 403);
+      }
+    }
+  }
+  async probeLane(kind) {
+    if (this.config.enabledLanes.includes(kind))
+      return probeLane(kind);
+    const sdk = { claude: "@anthropic-ai/claude-agent-sdk", codex: "@openai/codex-sdk", cursor: "@cursor/sdk", grok: "no npm SDK (measured 2026-08-25)" };
+    return { kind, sdk: sdk[kind], wired: false, reason: "disabled by server configuration" };
+  }
+  laneInventory() {
+    return Promise.all(LANE_KINDS.map((kind) => this.probeLane(kind)));
   }
   async openEngineStore(verifySchema = true) {
+    this.verifyJournalDirectory();
     if (this.config.storageBackend === "sqlite")
       return openStore(this.config.dataDir);
     if (this.config.storageBackend !== "postgresql")
@@ -3039,6 +3133,7 @@ class WorkflowsService {
     return this.withStore((store) => store.listRunNodes(id));
   }
   events(id) {
+    this.verifyJournalDirectory();
     return SessionWAL.open(this.config.dataDir).replay({ repair: false }).entries.filter((entry) => ("runId" in entry.op) && entry.op.runId === id);
   }
   cancelRun(id) {
@@ -3055,7 +3150,6 @@ class WorkflowsService {
   }
   async resumeRun(id) {
     const store = await this.openEngineStore();
-    const wal = SessionWAL.open(this.config.dataDir);
     try {
       const run2 = await store.getRun(id);
       if (!run2)
@@ -3063,13 +3157,15 @@ class WorkflowsService {
       if (!["failed", "cancelled", "interrupted"].includes(run2.status))
         throw new WorkflowRequestError("invalid_run_status", "resume requires a failed, cancelled, or interrupted run", 409);
       const context = JSON.parse(run2.contextJson);
+      const graph = context.__wf?.graph;
+      if (!graph)
+        throw new WorkflowRequestError("graph_unavailable", "legacy run needs its original graph registered by the server operator", 409);
+      this.assertEnabledGraphLanes(graph);
+      const wal = SessionWAL.open(this.config.dataDir);
       if (context.__wf?.resumeBlocked || context.__wf?.executionMayBeActive || wal.replay({ repair: false }).liveClaims().has(id))
         throw new WorkflowRequestError("execution_active", "previous execution must finish before resume", 409);
       if (store instanceof PostgresWorkflowsStore && !await store.acquireExecution(id))
         throw new WorkflowRequestError("execution_active", "another executor still owns this run", 409);
-      const graph = context.__wf?.graph;
-      if (!graph)
-        throw new WorkflowRequestError("graph_unavailable", "legacy run needs its original graph registered by the server operator", 409);
       if (!await store.compareRunStatus(id, ["failed", "cancelled", "interrupted"], "pending", { error: null }))
         throw new WorkflowRequestError("run_status_conflict", "run changed before resume", 409);
       for (const node2 of await store.listRunNodes(id)) {
@@ -3083,6 +3179,7 @@ class WorkflowsService {
     }
   }
   sessions(action) {
+    this.verifyJournalDirectory();
     const replay = SessionWAL.open(this.config.dataDir).replay({ repair: false });
     if (action === "list")
       return replay.entries.slice(-100).map(({ seq, at, op }) => ({ seq, at, operation: op.op }));
@@ -3100,6 +3197,7 @@ class WorkflowsService {
     return { ...local, health: this.health(), sessions: this.sessions("pull") };
   }
   daemonStatus() {
+    this.verifyJournalDirectory();
     const replay = SessionWAL.open(this.config.dataDir).replay({ repair: false });
     return { activeClaims: replay.liveClaims().size, mode: "bounded-trigger", continuousDaemon: false };
   }
@@ -3107,6 +3205,7 @@ class WorkflowsService {
     return this.withStore(async (store) => (await store.memoList()).slice(0, 100));
   }
   async triggerRun(graph, context = {}, opts = {}) {
+    this.assertEnabledGraphLanes(graph);
     const store = await this.openEngineStore();
     const wal = SessionWAL.open(this.config.dataDir);
     try {
@@ -3176,6 +3275,9 @@ var init_service = __esm(() => {
   init_postgres_store();
   init_store();
   init_wal();
+  init_journal_directory();
+  init_graph();
+  init_lanes();
   init_version();
   WorkflowRequestError = class WorkflowRequestError extends Error {
     code;
@@ -3486,12 +3588,12 @@ function createRequestHandler(service) {
         return jsonResponse(await service.listRuns({ limit, status }));
       }
       if (path === "/lanes")
-        return jsonResponse(await laneInventory());
+        return jsonResponse(await service.laneInventory());
       if (path.startsWith("/lanes/")) {
         const lane = path.slice("/lanes/".length);
         if (!LANE_KINDS2.includes(lane))
           return jsonResponse({ error: "invalid_lane" }, 400);
-        return jsonResponse(await probeLane(lane));
+        return jsonResponse(await service.probeLane(lane));
       }
       if (path === "/sessions/list")
         return jsonResponse(service.sessions("list"));
@@ -3567,13 +3669,13 @@ var init_server = __esm(() => {
 // src/serve/admin.ts
 var exports_admin = {};
 import { Command } from "commander";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync as renameSync2, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, renameSync as renameSync2, rmSync, writeFileSync as writeFileSync2 } from "fs";
 import { hostname as hostname2 } from "os";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 function loadGraph(file) {
   let raw;
   try {
-    raw = readFileSync3(file, "utf8");
+    raw = readFileSync4(file, "utf8");
   } catch {
     throw new Error(`cannot read graph file ${file}`);
   }
@@ -3666,7 +3768,7 @@ function addReapReports(left, right) {
   return total;
 }
 function writeReport(statusFile, report) {
-  mkdirSync3(join5(statusFile, ".."), { recursive: true });
+  mkdirSync3(join6(statusFile, ".."), { recursive: true });
   let previous = emptyReapReport();
   if (existsSync3(statusFile)) {
     previous = readReport(statusFile).cumulative;
@@ -3686,7 +3788,7 @@ function writeReport(statusFile, report) {
   }
 }
 function readReport(statusFile) {
-  const parsed = JSON.parse(readFileSync3(statusFile, "utf8"));
+  const parsed = JSON.parse(readFileSync4(statusFile, "utf8"));
   if (parsed !== null && typeof parsed === "object") {
     const record = parsed;
     if (record.version === 1 && record.latestCycle !== undefined && record.cumulative !== undefined) {
@@ -3740,11 +3842,11 @@ var init_admin = __esm(() => {
   });
   program.command("init").description("Create the store layout (workflows/, sessions/, workflows.db) and scaffold a sample graph").argument("[file]", "sample graph output path (default <dataDir>/workflows/demo.json)").action((file) => {
     const config = resolveWorkflowsConfig();
-    mkdirSync3(join5(config.dataDir, "workflows"), { recursive: true });
-    mkdirSync3(join5(config.dataDir, SESSIONS_DIR_NAME), { recursive: true });
+    mkdirSync3(join6(config.dataDir, "workflows"), { recursive: true });
+    mkdirSync3(join6(config.dataDir, SESSIONS_DIR_NAME), { recursive: true });
     const store = openStore(config.dataDir);
     store.close();
-    const target = file ?? join5(config.dataDir, "workflows", "demo.json");
+    const target = file ?? join6(config.dataDir, "workflows", "demo.json");
     if (existsSync3(target)) {
       console.error(`refusing to overwrite existing file ${target}`);
       process.exit(1);
@@ -4048,17 +4150,17 @@ var init_admin = __esm(() => {
         }
         case "status": {
           const replay = wal.replay();
-          const pidFile = join5(config.dataDir, "daemon.pid");
-          const pid = existsSync3(pidFile) ? readFileSync3(pidFile, "utf8").trim() : null;
+          const pidFile = join6(config.dataDir, "daemon.pid");
+          const pid = existsSync3(pidFile) ? readFileSync4(pidFile, "utf8").trim() : null;
           const running = pid !== null && processAlive(Number(pid));
           const report = {
             hostname: hostname2(),
             pid: process.pid,
             dataDir: config.dataDir,
             layout: {
-              workflows: existsSync3(join5(config.dataDir, "workflows")),
-              sessions: existsSync3(join5(config.dataDir, SESSIONS_DIR_NAME)),
-              db: existsSync3(join5(config.dataDir, "workflows.db"))
+              workflows: existsSync3(join6(config.dataDir, "workflows")),
+              sessions: existsSync3(join6(config.dataDir, SESSIONS_DIR_NAME)),
+              db: existsSync3(join6(config.dataDir, "workflows.db"))
             },
             store: {
               tables: store.listTables(),
@@ -4122,8 +4224,8 @@ var init_admin = __esm(() => {
   });
   program.command("daemon").description("Run or inspect the daemon").argument("<action>", "start | status | stop").option("--once", "run a single reap cycle and exit (start)").option("--interval-ms <n>", "reap interval (start)", "5000").option("--cycles <n>", "bound on consecutive cycles (start; default infinite until SIGINT)", "0").option("-j, --json", "JSON output").action(async (action, opts) => {
     const config = resolveWorkflowsConfig();
-    const pidFile = join5(config.dataDir, "daemon.pid");
-    const statusFile = join5(config.dataDir, "daemon.status.json");
+    const pidFile = join6(config.dataDir, "daemon.pid");
+    const statusFile = join6(config.dataDir, "daemon.status.json");
     switch (action) {
       case "start": {
         const { store, wal } = openLocal();
@@ -4180,7 +4282,7 @@ var init_admin = __esm(() => {
           return;
         }
         const envelope = readReport(statusFile);
-        const pid = existsSync3(pidFile) ? readFileSync3(pidFile, "utf8").trim() : null;
+        const pid = existsSync3(pidFile) ? readFileSync4(pidFile, "utf8").trim() : null;
         const running = pid !== null && processAlive(Number(pid));
         if (opts.json) {
           console.log(JSON.stringify({ statusVersion: 1, running, pid, lastReap: envelope.latestCycle, cumulative: envelope.cumulative }, null, 2));
@@ -4194,7 +4296,7 @@ var init_admin = __esm(() => {
           console.error("no daemon pid file \u2014 nothing to stop");
           process.exit(1);
         }
-        const pid = Number(readFileSync3(pidFile, "utf8").trim());
+        const pid = Number(readFileSync4(pidFile, "utf8").trim());
         try {
           process.kill(pid, "SIGTERM");
         } catch {
@@ -4292,6 +4394,35 @@ var init_admin = __esm(() => {
 // src/serve/index.ts
 init_service();
 init_server();
+
+// src/serve/journal-lease.ts
+init_journal_directory();
+import { Database as Database3 } from "bun:sqlite";
+import { join as join7 } from "path";
+function acquireJournalServerLease(dataDir2, identity) {
+  assertJournalDirectory(dataDir2, identity);
+  const mutex = new Database3(join7(dataDir2, ".server-lease.sqlite"));
+  try {
+    mutex.exec("PRAGMA busy_timeout = 0");
+    mutex.exec("BEGIN IMMEDIATE");
+  } catch {
+    mutex.close();
+    throw new Error("execution journal is already leased or unavailable; refusing to start another server");
+  }
+  let closed = false;
+  return { close() {
+    if (closed)
+      return;
+    closed = true;
+    try {
+      mutex.exec("ROLLBACK");
+    } finally {
+      mutex.close();
+    }
+  } };
+}
+
+// src/serve/index.ts
 var HELP_TEXT = `workflows-serve \u2014 HTTP server for @hasna/workflows
 
 Usage:
@@ -4314,6 +4445,8 @@ Configuration (env):
   HASNA_WORKFLOWS_DATABASE_URL  required PostgreSQL connection URL
   HASNA_WORKFLOWS_DATABASE_SCHEMA  SQL schema (default workflows)
   HASNA_WORKFLOWS_DATA_DIR  durable execution journal directory
+  HASNA_WORKFLOWS_DATA_IDENTITY  require a verified restored journal and one server writer
+  HASNA_WORKFLOWS_ENABLED_LANES  optional comma-separated model lanes; empty permits command steps only
   WORKFLOWS_ aliases remain supported; database URL aliases must agree`;
 var argv = process.argv.slice(2);
 if (argv[0] === "admin") {
@@ -4342,6 +4475,16 @@ if (argv[0] === "admin") {
       console.error("unknown workflows-serve argument; use --help");
       process.exit(2);
     }
+    let lease;
+    if (service.config.dataIdentity !== undefined) {
+      try {
+        lease = acquireJournalServerLease(service.config.dataDir, service.config.dataIdentity);
+      } catch {
+        console.error("execution journal identity, access or exclusive server lease refused");
+        process.exit(1);
+      }
+      process.once("exit", () => lease?.close());
+    }
     const server = createWorkflowsServer(service);
     console.log(`workflows-serve listening on http://${service.config.host}:${server.port}`);
   }

package/dist/service.js

@@ -1108,7 +1108,7 @@ import { createHash as createHash3 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/workflows",
-  version: "0.2.1",
+  version: "0.2.2",
   description: "Universal graph workflow app \u2014 graph language (start/step/decision/while/end), three-table store, session WAL, daemon with claims/leases, four lane adapters (claude/codex/cursor/grok), and a full CLI on four surfaces",
   type: "module",
   main: "./dist/index.js",
@@ -1184,7 +1184,7 @@ var package_default = {
   dependencies: {
     "@anthropic-ai/claude-agent-sdk": "0.3.234",
     "@cursor/sdk": "^1.0.28",
-    "@hasna/contracts": "1.3.3",
+    "@hasna/contracts": "1.3.5",
     "@openai/codex-sdk": "0.160.0",
     commander: "^13.1.0",
     pg: "^8.16.3"
@@ -2695,7 +2695,7 @@ function openStore(dataDir2) {
 // src/wal.ts
 import { Database as Database2 } from "bun:sqlite";
 import { createHash as createHash2 } from "crypto";
-import { appendFileSync, copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, truncateSync, writeFileSync, constants } from "fs";
+import { closeSync, copyFileSync, existsSync as existsSync2, fsyncSync, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync2, renameSync, truncateSync, writeFileSync, constants } from "fs";
 import { basename, dirname, join as join4 } from "path";
 var WAL_FILE_NAME = "session.wal";
 var SESSIONS_DIR_NAME = "sessions";
@@ -2765,8 +2765,20 @@ class SessionWAL {
     const full = { ...op, at };
     const nextSeq = this.nextSeq();
     const entry = { seq: nextSeq, at, checksum: checksumOf(full), op: full };
-    appendFileSync(this.filePath, JSON.stringify(entry) + `
-`, { encoding: "utf8", mode: 384 });
+    const fd = openSync(this.filePath, "a", 384);
+    try {
+      writeFileSync(fd, JSON.stringify(entry) + `
+`, "utf8");
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    const parent = openSync(dirname(this.filePath), "r");
+    try {
+      fsyncSync(parent);
+    } finally {
+      closeSync(parent);
+    }
     return entry;
   }
   nextSeq() {
@@ -2783,7 +2795,9 @@ class SessionWAL {
     let content;
     try {
       content = readFileSync2(this.filePath, "utf8");
-    } catch {
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
       return { entries, torn, repaired, liveClaims: () => new Map };
     }
     if (content.length > MAX_WAL_BYTES) {
@@ -2873,7 +2887,42 @@ function preserveOriginal(filePath) {
   return backup;
 }
 
+// src/journal-directory.ts
+import { accessSync, closeSync as closeSync2, constants as constants2, fstatSync, lstatSync, openSync as openSync2, readFileSync as readFileSync3, readSync } from "fs";
+import { join as join5 } from "path";
+function assertJournalDirectory(dataDir2, identity) {
+  try {
+    if (!lstatSync(dataDir2).isDirectory() || !lstatSync(join5(dataDir2, "sessions")).isDirectory())
+      throw new Error;
+    accessSync(dataDir2, constants2.R_OK | constants2.W_OK | constants2.X_OK);
+    accessSync(join5(dataDir2, "sessions"), constants2.R_OK | constants2.W_OK | constants2.X_OK);
+    const marker = openSync2(join5(dataDir2, ".workflows-data-identity"), constants2.O_RDONLY | constants2.O_NOFOLLOW);
+    try {
+      const stat = fstatSync(marker);
+      if (!stat.isFile() || stat.size > 256 || readFileSync3(marker, "utf8") !== identity + `
+`)
+        throw new Error;
+    } finally {
+      closeSync2(marker);
+    }
+    for (const file of ["workflows.db", "sessions/session.wal"]) {
+      const fd = openSync2(join5(dataDir2, file), constants2.O_RDWR | constants2.O_NOFOLLOW);
+      try {
+        if (!fstatSync(fd).isFile())
+          throw new Error;
+        readSync(fd, Buffer.alloc(1), 0, 1, 0);
+      } finally {
+        closeSync2(fd);
+      }
+    }
+  } catch {
+    throw new Error("configured execution journal identity or accessibility check failed");
+  }
+}
+
 // src/service.ts
+init_graph();
+init_lanes();
 import { hostname } from "os";
 import { resolveDatabaseUrl } from "@hasna/contracts";
 var DEFAULT_PORT = 8790;
@@ -2894,6 +2943,14 @@ function envInt(names, fallback) {
   return Number.isFinite(parsed) ? parsed : fallback;
 }
 function resolveWorkflowsConfig(overrides = {}) {
+  const rawLanes = process.env.HASNA_WORKFLOWS_ENABLED_LANES;
+  const enabledLanes = overrides.enabledLanes ?? (rawLanes === undefined ? LANE_KINDS : rawLanes.trim() === "" ? [] : rawLanes.split(",").map((value) => value.trim()));
+  if (!Array.isArray(enabledLanes) || enabledLanes.some((lane) => !LANE_KINDS.includes(lane)) || new Set(enabledLanes).size !== enabledLanes.length) {
+    throw new Error("HASNA_WORKFLOWS_ENABLED_LANES must be a unique comma-separated subset of claude,codex,cursor,grok; an empty value disables model lanes");
+  }
+  const dataIdentity = overrides.dataIdentity ?? process.env.HASNA_WORKFLOWS_DATA_IDENTITY;
+  if (dataIdentity !== undefined && !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(dataIdentity))
+    throw new Error("HASNA_WORKFLOWS_DATA_IDENTITY must be a nonempty data identity of at most 128 characters");
   const originAuth = overrides.originAuth ?? process.env.HASNA_WORKFLOWS_ORIGIN_AUTH;
   if (originAuth !== undefined && !/^[A-Za-z0-9_-]{32,256}$/.test(originAuth))
     throw new Error("HASNA_WORKFLOWS_ORIGIN_AUTH must be a valid gateway origin identity");
@@ -2904,9 +2961,11 @@ function resolveWorkflowsConfig(overrides = {}) {
     apiUrl: overrides.apiUrl ?? envString(["HASNA_WORKFLOWS_API_URL", "WORKFLOWS_API_URL"]),
     apiKey: overrides.apiKey ?? envString(["HASNA_WORKFLOWS_API_KEY", "WORKFLOWS_API_KEY"]),
     originAuth,
+    dataIdentity,
     storageBackend: overrides.storageBackend ?? "postgresql",
     databaseUrl: overrides.databaseUrl ?? envString(["HASNA_WORKFLOWS_DATABASE_URL", "WORKFLOWS_DATABASE_URL"]),
-    databaseSchema: overrides.databaseSchema ?? envString(["HASNA_WORKFLOWS_DATABASE_SCHEMA", "WORKFLOWS_DATABASE_SCHEMA"])
+    databaseSchema: overrides.databaseSchema ?? envString(["HASNA_WORKFLOWS_DATABASE_SCHEMA", "WORKFLOWS_DATABASE_SCHEMA"]),
+    enabledLanes: Object.freeze([...enabledLanes])
   };
 }
 
@@ -2939,16 +2998,52 @@ class WorkflowsService {
   }
   async ready() {
     const checks = { version: "ok", auth: this.config.apiKey ? "ok" : "missing", storage: "not-checked" };
-    if (this.config.apiKey) {
+    if (this.config.dataIdentity !== undefined) {
+      try {
+        this.verifyJournalDirectory();
+        checks.journal = "ok";
+      } catch {
+        checks.journal = "unavailable";
+      }
+    }
+    if (this.config.apiKey && checks.journal !== "unavailable") {
       try {
         checks.storage = await this.withStore(async (store) => (store instanceof PostgresWorkflowsStore ? await store.checkSchema() : (await store.listTables()).sort().join(",") === "memos,run_nodes,runs") ? "ok" : "invalid-schema");
       } catch (error) {
         checks.storage = error instanceof WorkflowRequestError && error.code === "invalid_schema" ? "invalid-schema" : "unavailable";
       }
     }
-    return { ok: checks.auth === "ok" && checks.storage === "ok", service: this.name, version: this.version, checks };
+    return { ok: checks.auth === "ok" && checks.storage === "ok" && checks.journal !== "unavailable", service: this.name, version: this.version, checks };
+  }
+  verifyJournalDirectory() {
+    if (this.config.dataIdentity !== undefined) {
+      try {
+        assertJournalDirectory(this.config.dataDir, this.config.dataIdentity);
+      } catch {
+        throw new WorkflowRequestError("journal_unavailable", "configured execution journal identity or accessibility check failed", 503);
+      }
+    }
+  }
+  assertEnabledGraphLanes(graph) {
+    if (!Array.isArray(graph?.nodes))
+      return;
+    for (const node2 of graph.nodes) {
+      if (node2.type === "step" && !node2.command && !this.config.enabledLanes.includes(node2.lane ?? "claude")) {
+        throw new WorkflowRequestError("lane_disabled", "the workflow contains a model lane disabled by server configuration", 403);
+      }
+    }
+  }
+  async probeLane(kind) {
+    if (this.config.enabledLanes.includes(kind))
+      return probeLane(kind);
+    const sdk = { claude: "@anthropic-ai/claude-agent-sdk", codex: "@openai/codex-sdk", cursor: "@cursor/sdk", grok: "no npm SDK (measured 2026-08-25)" };
+    return { kind, sdk: sdk[kind], wired: false, reason: "disabled by server configuration" };
+  }
+  laneInventory() {
+    return Promise.all(LANE_KINDS.map((kind) => this.probeLane(kind)));
   }
   async openEngineStore(verifySchema = true) {
+    this.verifyJournalDirectory();
     if (this.config.storageBackend === "sqlite")
       return openStore(this.config.dataDir);
     if (this.config.storageBackend !== "postgresql")
@@ -3002,6 +3097,7 @@ class WorkflowsService {
     return this.withStore((store) => store.listRunNodes(id));
   }
   events(id) {
+    this.verifyJournalDirectory();
     return SessionWAL.open(this.config.dataDir).replay({ repair: false }).entries.filter((entry) => ("runId" in entry.op) && entry.op.runId === id);
   }
   cancelRun(id) {
@@ -3018,7 +3114,6 @@ class WorkflowsService {
   }
   async resumeRun(id) {
     const store = await this.openEngineStore();
-    const wal = SessionWAL.open(this.config.dataDir);
     try {
       const run2 = await store.getRun(id);
       if (!run2)
@@ -3026,13 +3121,15 @@ class WorkflowsService {
       if (!["failed", "cancelled", "interrupted"].includes(run2.status))
         throw new WorkflowRequestError("invalid_run_status", "resume requires a failed, cancelled, or interrupted run", 409);
       const context = JSON.parse(run2.contextJson);
+      const graph = context.__wf?.graph;
+      if (!graph)
+        throw new WorkflowRequestError("graph_unavailable", "legacy run needs its original graph registered by the server operator", 409);
+      this.assertEnabledGraphLanes(graph);
+      const wal = SessionWAL.open(this.config.dataDir);
       if (context.__wf?.resumeBlocked || context.__wf?.executionMayBeActive || wal.replay({ repair: false }).liveClaims().has(id))
         throw new WorkflowRequestError("execution_active", "previous execution must finish before resume", 409);
       if (store instanceof PostgresWorkflowsStore && !await store.acquireExecution(id))
         throw new WorkflowRequestError("execution_active", "another executor still owns this run", 409);
-      const graph = context.__wf?.graph;
-      if (!graph)
-        throw new WorkflowRequestError("graph_unavailable", "legacy run needs its original graph registered by the server operator", 409);
       if (!await store.compareRunStatus(id, ["failed", "cancelled", "interrupted"], "pending", { error: null }))
         throw new WorkflowRequestError("run_status_conflict", "run changed before resume", 409);
       for (const node2 of await store.listRunNodes(id)) {
@@ -3046,6 +3143,7 @@ class WorkflowsService {
     }
   }
   sessions(action) {
+    this.verifyJournalDirectory();
     const replay = SessionWAL.open(this.config.dataDir).replay({ repair: false });
     if (action === "list")
       return replay.entries.slice(-100).map(({ seq, at, op }) => ({ seq, at, operation: op.op }));
@@ -3063,6 +3161,7 @@ class WorkflowsService {
     return { ...local, health: this.health(), sessions: this.sessions("pull") };
   }
   daemonStatus() {
+    this.verifyJournalDirectory();
     const replay = SessionWAL.open(this.config.dataDir).replay({ repair: false });
     return { activeClaims: replay.liveClaims().size, mode: "bounded-trigger", continuousDaemon: false };
   }
@@ -3070,6 +3169,7 @@ class WorkflowsService {
     return this.withStore(async (store) => (await store.memoList()).slice(0, 100));
   }
   async triggerRun(graph, context = {}, opts = {}) {
+    this.assertEnabledGraphLanes(graph);
     const store = await this.openEngineStore();
     const wal = SessionWAL.open(this.config.dataDir);
     try {