@haystackeditor/cli 0.15.24 → 0.15.25

package/README.md

@@ -105,6 +105,21 @@ haystack verify hosted status cv_<48-lowercase-hex-characters> \
   --json
 ```
 
+To execute a completed run's exact validated risk plan again, keep the same
+repository and commit pair and pass:
+
+```bash
+haystack verify hosted start owner/repo \
+  --base <40-character-commit-sha> \
+  --head <40-character-commit-sha> \
+  --replay-plan-from cv_<48-lowercase-hex-characters> \
+  --json
+```
+
+A successful replay emits a schema-9 terminal result whose
+`riskPlanReplayReceipt` binds the source run and canonical risk-plan hash. The
+replay does not mint or deliver a planning-model credential.
+
 Agents can use the same production lifecycle over stdio MCP:
 
 ```bash
@@ -116,7 +131,8 @@ The hosted server exposes only `verify_start`, `verify_status`, and
 credentials, repository source, provider metadata, and sandbox mutation are
 not exposed.
 
-Repeat the same exact production launch to detect planner or assessment drift:
+Freeze one production plan and repeat its exact execution to detect executor or
+assessment drift:
 
 ```bash
 haystack verify hosted reproducibility owner/repo \
@@ -126,10 +142,12 @@ haystack verify hosted reproducibility owner/repo \
   --json
 ```
 
-Each run gets a distinct idempotency key derived from one printed series key.
-Pass `--series-key <key>` to resume the same series without creating duplicate
-runs. The report compares stable risk-cell, capability, and comparison IDs.
-Plan drift, assessment drift, timeouts, unsupported receipts, and inconclusive
+The first run creates the source plan; every later run names it through
+`replayPlanFromRunId`. Each run gets a distinct idempotency key derived from one
+printed series key. Pass `--series-key <key>` to resume the same series without
+creating duplicate runs. The report verifies schema-9 replay provenance and
+compares stable risk-cell, capability, and comparison IDs. Missing replay
+provenance, assessment drift, timeouts, unsupported receipts, and inconclusive
 cells all prevent a reproducible verdict and exit 2.
 
 **`haystack setup --json`** speaks NDJSON: events (`question`, `permission`,

package/dist/commands/verify-hosted-mcp.js

@@ -53,6 +53,10 @@ export const HOSTED_VERIFY_TOOLS = [
                     pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$',
                     description: 'Optional stable retry key. Omit to derive it from the exact repository and commits.',
                 },
+                replay_plan_from_run_id: {
+                    ...runIdInput,
+                    description: 'Optional completed owned run whose exact validated risk plan must be replayed.',
+                },
                 account: accountInput,
             },
             required: ['repository', 'base_commit', 'head_commit'],
@@ -120,6 +124,7 @@ function assertToolInputFields(name, input) {
             'base_commit',
             'head_commit',
             'idempotency_key',
+            'replay_plan_from_run_id',
             'repository',
         ]);
         return;
@@ -147,6 +152,7 @@ export async function executeHostedVerifyTool(name, input, context) {
             base: requireInputString(input, 'base_commit'),
             head: requireInputString(input, 'head_commit'),
             idempotencyKey: optionalInputString(input, 'idempotency_key'),
+            replayPlanFrom: optionalInputString(input, 'replay_plan_from_run_id'),
             wait: false,
         }, context.token);
         return buildHostedJson('start', started.state, {

package/dist/commands/verify-hosted-reproducibility.d.ts

@@ -13,7 +13,18 @@ interface HostedReproducibilityRun {
     state: HostedRunState;
     timedOut: boolean;
 }
+interface HostedReproducibilityIdentity {
+    seriesKey: string;
+    repository: string;
+    baseCommit: string;
+    headCommit: string;
+    requestedRuns?: number;
+}
 interface ParsedAssessment {
+    schemaVersion: 8 | 9;
+    riskPlanSha256: string;
+    replaySourceRunId: string | null;
+    replaySourceResultSchemaVersion: 8 | 9 | null;
     planIdentities: Array<{
         cellId: string;
         capabilityId: string | null;
@@ -50,8 +61,13 @@ export interface HostedReproducibilityReport {
     base_commit: string;
     head_commit: string;
     requested_runs: number;
+    launched_runs: number;
+    unstarted_runs: number;
     analyzable_runs: number;
     run_ids: string[];
+    replay_source_run_id: string | null;
+    plan_replay_verified: boolean;
+    planner_reproducibility_tested: false;
     planner_reproducible: boolean;
     assessment_reproducible: boolean;
     reproducible: boolean;
@@ -63,11 +79,7 @@ export interface HostedReproducibilityReport {
     unrunnable_runs: RunFailure[];
 }
 export declare function hostedReproducibilityRunKey(seriesKey: string, repository: string, baseCommit: string, headCommit: string, ordinal: number): string;
-export declare function analyzeHostedReproducibility(runs: HostedReproducibilityRun[], identity: {
-    seriesKey: string;
-    repository: string;
-    baseCommit: string;
-    headCommit: string;
-}): HostedReproducibilityReport;
+export declare function analyzeHostedReproducibility(runs: HostedReproducibilityRun[], identity: HostedReproducibilityIdentity): HostedReproducibilityReport;
+export declare function isHostedReproducibilityReplaySource(run: HostedReproducibilityRun, identity: HostedReproducibilityIdentity): boolean;
 export declare function verifyHostedReproducibilityCommand(repositoryArg: string, options: HostedReproducibilityOptions): Promise<void>;
 export {};

package/dist/commands/verify-hosted-reproducibility.js

@@ -6,6 +6,7 @@ import { hostedPollingOptions, parseHostedRepository, startHostedVerification, w
 const CELL_ID = /^cell_[0-9a-f]{32}$/;
 const CAPABILITY_ID = /^repository_driver_[0-9a-f]{64}$/;
 const COMPARISON_ID = /^driver_comparison_[0-9a-f]{64}$/;
+const RUN_ID = /^cv_[0-9a-f]{48}$/;
 const SHA256 = /^[0-9a-f]{64}$/;
 const SERIES_KEY = /^[A-Za-z0-9][A-Za-z0-9._:-]{7,63}$/;
 const TERMINAL_STATUSES = new Set([
@@ -80,9 +81,20 @@ export function hostedReproducibilityRunKey(seriesKey, repository, baseCommit, h
         .digest('hex');
     return `repro:${digest}`;
 }
+function stable(value) {
+    if (Array.isArray(value))
+        return value.map(stable);
+    if (value && typeof value === 'object') {
+        const object = value;
+        return Object.fromEntries(Object.keys(object)
+            .sort()
+            .map(key => [key, stable(object[key])]));
+    }
+    return value;
+}
 function fingerprint(value) {
     return createHash('sha256')
-        .update(JSON.stringify(value))
+        .update(JSON.stringify(stable(value)))
         .digest('hex');
 }
 function expectedCellStatus(reasonCode) {
@@ -124,11 +136,51 @@ function parseAssessment(state, identity) {
         throw new Error('run identity does not match the requested exact launch');
     }
     const output = record(state.output, 'terminal output');
-    if (output.schemaVersion !== 8
+    if ((output.schemaVersion !== 8 && output.schemaVersion !== 9)
         || output.status !== 'driver_assessment_recorded') {
-        throw new Error('run did not produce a schema-8 driver assessment');
+        throw new Error('run did not produce a schema-8 or schema-9 driver assessment');
     }
     const riskPlan = record(output.riskPlanReceipt, 'risk plan receipt');
+    const riskPlanSha256 = fingerprint(riskPlan);
+    let replaySourceRunId = null;
+    let replaySourceResultSchemaVersion = null;
+    if (output.schemaVersion === 9) {
+        if (output.planningCredentialDelivery !== 'not-required-plan-replay') {
+            throw new Error('schema-9 replay used an invalid planning credential mode');
+        }
+        const replay = record(output.riskPlanReplayReceipt, 'risk plan replay receipt');
+        const fields = Object.keys(replay);
+        if (fields.length !== 6
+            || fields.some(field => ![
+                'schemaVersion',
+                'sourceContentPersisted',
+                'sourceResultSchemaVersion',
+                'sourceRiskPlanReceiptSha256',
+                'sourceRunId',
+                'status',
+            ].includes(field))
+            || replay.schemaVersion !== 1
+            || replay.status !== 'risk_plan_replay_verified'
+            || typeof replay.sourceRunId !== 'string'
+            || !RUN_ID.test(replay.sourceRunId)
+            || (replay.sourceResultSchemaVersion !== 8
+                && replay.sourceResultSchemaVersion !== 9)
+            || replay.sourceRiskPlanReceiptSha256 !== riskPlanSha256
+            || typeof replay.sourceRiskPlanReceiptSha256 !== 'string'
+            || !SHA256.test(replay.sourceRiskPlanReceiptSha256)
+            || replay.sourceContentPersisted !== false) {
+            throw new Error('risk plan replay receipt is malformed');
+        }
+        replaySourceRunId = replay.sourceRunId;
+        replaySourceResultSchemaVersion = replay.sourceResultSchemaVersion;
+    }
+    else if (output.riskPlanReplayReceipt !== undefined) {
+        throw new Error('schema-8 result contains unversioned replay provenance');
+    }
+    else if (output.planningCredentialDelivery
+        !== 'per-command-env-gateway-placeholder') {
+        throw new Error('schema-8 result used an invalid planning credential mode');
+    }
     const assessment = record(output.driverAssessmentReceipt, 'driver assessment receipt');
     const planCells = array(riskPlan.cells, 'risk plan cells');
     const assessmentCells = array(assessment.cells, 'assessment cells');
@@ -219,6 +271,10 @@ function parseAssessment(state, identity) {
         throw new Error('driver assessment overall status is inconsistent');
     }
     return {
+        schemaVersion: output.schemaVersion,
+        riskPlanSha256,
+        replaySourceRunId,
+        replaySourceResultSchemaVersion,
         planIdentities,
         cellIds,
         status: assessment.status,
@@ -317,8 +373,18 @@ export function analyzeHostedReproducibility(runs, identity) {
     }
     const planVariants = groupedPlanVariants(parsed);
     const assessmentVariants = groupedOutcomeVariants(parsed);
-    const plannerReproducible = parsed.length === runs.length && planVariants.length === 1;
-    const assessmentReproducible = plannerReproducible && assessmentVariants.length === 1;
+    const replaySourceRunId = parsed[0]?.runId ?? null;
+    const planReplayVerified = parsed.length === runs.length
+        && parsed.length > 1
+        && parsed[0]?.assessment.schemaVersion === 8
+        && parsed[0]?.assessment.replaySourceRunId === null
+        && parsed.slice(1).every(item => item.assessment.schemaVersion === 9
+            && item.assessment.replaySourceRunId === replaySourceRunId
+            && item.assessment.replaySourceResultSchemaVersion
+                === parsed[0].assessment.schemaVersion
+            && item.assessment.riskPlanSha256
+                === parsed[0].assessment.riskPlanSha256);
+    const assessmentReproducible = planReplayVerified && assessmentVariants.length === 1;
     const planDriftCellIds = driftIds(parsed, assessment => new Map(assessment.planIdentities.map(plan => [
         plan.cellId,
         { capabilityId: plan.capabilityId },
@@ -335,17 +401,25 @@ export function analyzeHostedReproducibility(runs, identity) {
     const inconclusiveCellIds = [...new Set(parsed.flatMap(item => item.assessment.outcomes
             .filter(outcome => outcome.status === 'inconclusive')
             .map(outcome => outcome.cellId)))].sort();
+    const requestedRuns = identity.requestedRuns ?? runs.length;
     return {
         series_key: identity.seriesKey,
         repository: identity.repository,
         base_commit: identity.baseCommit,
         head_commit: identity.headCommit,
-        requested_runs: runs.length,
+        requested_runs: requestedRuns,
+        launched_runs: runs.length,
+        unstarted_runs: Math.max(0, requestedRuns - runs.length),
         analyzable_runs: parsed.length,
         run_ids: runs.map(run => run.state.runId),
-        planner_reproducible: plannerReproducible,
+        replay_source_run_id: replaySourceRunId,
+        plan_replay_verified: planReplayVerified,
+        planner_reproducibility_tested: false,
+        planner_reproducible: false,
         assessment_reproducible: assessmentReproducible,
-        reproducible: assessmentReproducible && inconclusiveCellIds.length === 0,
+        reproducible: planReplayVerified
+            && assessmentReproducible
+            && inconclusiveCellIds.length === 0,
         plan_variants: planVariants,
         assessment_variants: assessmentVariants,
         plan_drift_cell_ids: planDriftCellIds,
@@ -354,11 +428,25 @@ export function analyzeHostedReproducibility(runs, identity) {
         unrunnable_runs: unrunnableRuns,
     };
 }
+export function isHostedReproducibilityReplaySource(run, identity) {
+    if (run.timedOut || run.state.status !== 'complete')
+        return false;
+    try {
+        const assessment = parseAssessment(run.state, identity);
+        return assessment.schemaVersion === 8
+            && assessment.replaySourceRunId === null;
+    }
+    catch {
+        return false;
+    }
+}
 function renderHostedReproducibility(report) {
     const icon = report.reproducible ? chalk.green('✓') : chalk.yellow('!');
     console.log(`${icon} Hosted reproducibility: ${report.reproducible ? 'reproducible' : 'not established'}`);
-    console.log(`  ${chalk.dim('Runs:')} ${report.analyzable_runs}/${report.requested_runs} analyzable`);
+    console.log(`  ${chalk.dim('Runs:')} ${report.analyzable_runs}/${report.requested_runs} analyzable; ${report.launched_runs} launched`);
     console.log(`  ${chalk.dim('Plan variants:')} ${report.plan_variants.length}`);
+    console.log(`  ${chalk.dim('Exact plan replay:')} ${report.plan_replay_verified ? 'verified' : 'not verified'}`);
+    console.log(`  ${chalk.dim('Independent planner reproducibility:')} not tested`);
     console.log(`  ${chalk.dim('Assessment variants:')} ${report.assessment_variants.length}`);
     if (report.plan_drift_cell_ids.length > 0) {
         console.log(`  ${chalk.dim('Plan drift:')} ${report.plan_drift_cell_ids.length} stable cell id(s)`);
@@ -392,6 +480,9 @@ export async function verifyHostedReproducibilityCommand(repositoryArg, options)
             base: options.base,
             head: options.head,
             idempotencyKey: hostedReproducibilityRunKey(seriesKey, repository.fullName, options.base, options.head, index + 1),
+            replayPlanFrom: index === 0
+                ? undefined
+                : runs[0]?.state.runId,
             wait: false,
         }, auth.token);
         let state = started.state;
@@ -406,12 +497,25 @@ export async function verifyHostedReproducibilityCommand(repositoryArg, options)
             timedOut = waited.timedOut;
         }
         runs.push({ state, timedOut });
+        if (index === 0
+            && !isHostedReproducibilityReplaySource(runs[0], {
+                seriesKey,
+                repository: repository.fullName,
+                baseCommit: options.base,
+                headCommit: options.head,
+            })) {
+            if (!options.json) {
+                console.error(chalk.yellow('Source run is not replayable; later runs were not launched.'));
+            }
+            break;
+        }
     }
     const report = analyzeHostedReproducibility(runs, {
         seriesKey,
         repository: repository.fullName,
         baseCommit: options.base,
         headCommit: options.head,
+        requestedRuns,
     });
     if (options.json) {
         process.stdout.write(`${JSON.stringify(withSchema('cloud-verifier', {

package/dist/commands/verify-hosted.d.ts

@@ -2,6 +2,7 @@ export interface HostedStartOptions {
     base: string;
     head: string;
     idempotencyKey?: string;
+    replayPlanFrom?: string;
     account?: string;
     wait?: boolean;
     interval?: string;
@@ -41,7 +42,7 @@ export declare function parseHostedRepository(value: string): {
     repository: string;
     fullName: string;
 };
-export declare function defaultHostedIdempotencyKey(repository: string, baseCommit: string, headCommit: string): string;
+export declare function defaultHostedIdempotencyKey(repository: string, baseCommit: string, headCommit: string, replayPlanFrom?: string): string;
 export declare function hostedPollingOptions(interval: string | undefined, timeout: string | undefined, onStatus?: (state: HostedRunState) => void): HostedPollOptions;
 export declare function startHostedVerification(repositoryArg: string, options: HostedStartOptions, token: string): Promise<{
     state: HostedRunState;

package/dist/commands/verify-hosted.js

@@ -121,9 +121,11 @@ function requireCommit(value, flag) {
     }
     return value;
 }
-export function defaultHostedIdempotencyKey(repository, baseCommit, headCommit) {
+export function defaultHostedIdempotencyKey(repository, baseCommit, headCommit, replayPlanFrom) {
     const digest = createHash('sha256')
-        .update(JSON.stringify([repository, baseCommit, headCommit]))
+        .update(JSON.stringify(replayPlanFrom
+        ? [repository, baseCommit, headCommit, replayPlanFrom]
+        : [repository, baseCommit, headCommit]))
         .digest('hex');
     return `cli:${digest}`;
 }
@@ -153,8 +155,12 @@ export async function startHostedVerification(repositoryArg, options, token) {
     const repository = parseHostedRepository(repositoryArg);
     const baseCommit = requireCommit(options.base, '--base');
     const headCommit = requireCommit(options.head, '--head');
+    const replayPlanFrom = options.replayPlanFrom;
+    if (replayPlanFrom !== undefined && !RUN_ID.test(replayPlanFrom)) {
+        throw new Error('--replay-plan-from must match cv_ followed by 48 lowercase hex characters.');
+    }
     const idempotencyKey = requireIdempotencyKey(options.idempotencyKey
-        ?? defaultHostedIdempotencyKey(repository.fullName, baseCommit, headCommit));
+        ?? defaultHostedIdempotencyKey(repository.fullName, baseCommit, headCommit, replayPlanFrom));
     const response = await haystackJson('/api/agent/cloud-verifier/runs', token, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
@@ -164,6 +170,9 @@ export async function startHostedVerification(repositoryArg, options, token) {
             baseCommit,
             headCommit,
             idempotencyKey,
+            ...(replayPlanFrom
+                ? { replayPlanFromRunId: replayPlanFrom }
+                : {}),
         }),
     });
     const state = parseHostedRunState(response);
@@ -200,7 +209,7 @@ function delay(milliseconds) {
 export async function waitForHostedVerification(runId, token, options) {
     const startedAt = Date.now();
     let lastStatus;
-    while (true) {
+    for (;;) {
         const state = await getHostedVerification(runId, token);
         if (state.status !== lastStatus) {
             options.onStatus?.(state);

package/dist/index.js

@@ -219,6 +219,7 @@ hostedVerify
     .option('--base <sha>', 'Required: exact 40-character lowercase base commit SHA')
     .option('--head <sha>', 'Required: exact 40-character lowercase head commit SHA')
     .option('--idempotency-key <key>', 'Stable retry key (default: deterministic from repository and commits)')
+    .option('--replay-plan-from <run-id>', 'Reuse the exact validated risk plan from a completed owned run')
     .option('--account <login>', 'Use a specific saved Haystack account')
     .option('--no-wait', 'Return after the production workflow is queued')
     .option('--interval <seconds>', 'Polling interval while waiting (default 5)')
@@ -228,9 +229,12 @@ hostedVerify
 The default idempotency key makes an exact retry return the original run. Pass
 --idempotency-key with a new stable key only when you intentionally want a
 fresh production execution of the same commit pair.
+--replay-plan-from requires the same repository and exact commit pair and emits
+a schema-9 terminal receipt with replay provenance.
 
 Examples:
   haystack verify hosted start owner/repo --base <sha> --head <sha>
+  haystack verify hosted start owner/repo --base <sha> --head <sha> --replay-plan-from cv_<48 lowercase hex characters>
   haystack verify hosted start owner/repo --base <sha> --head <sha> --no-wait --json
 `)
     .action(async (repository, _options, cmd) => {
@@ -258,7 +262,7 @@ Example:
 });
 hostedVerify
     .command('reproducibility')
-    .description('Repeat an exact hosted verification and report plan or assessment drift')
+    .description('Replay one exact hosted risk plan and report executor or assessment drift')
     .argument('<repository>', 'Exact GitHub owner/repository name')
     .option('--base <sha>', 'Required: exact 40-character lowercase base commit SHA')
     .option('--head <sha>', 'Required: exact 40-character lowercase head commit SHA')
@@ -269,10 +273,10 @@ hostedVerify
     .option('--timeout <minutes>', 'Maximum wait per run (default 35)')
     .option('--json', 'Versioned machine-readable reproducibility report')
     .addHelpText('after', `
-Every run uses the same repository and exact commit pair with a distinct,
-series-derived idempotency key. The report compares stable risk-cell identities
-and deterministic assessment outcomes; inconclusive cells never count as a
-reproducible verdict.
+The first run creates a fresh risk plan. Every later run replays that exact
+validated plan against the same repository and commit pair with a distinct,
+series-derived idempotency key. A reproducible verdict requires schema-9 replay
+provenance, stable assessment outcomes, and no inconclusive cells.
 
 Example:
   haystack verify hosted reproducibility owner/repo --base <sha> --head <sha> --runs 3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.15.24",
+  "version": "0.15.25",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {