@humwick/server 0.0.0-stage → 0.130.1

package/src/services/workflow-agent-obligation.ts

@@ -0,0 +1,35 @@
+import { stringValue } from "@humwick/sdk";
+import { OpError } from "@humwick/kernel";
+import { workflowEffectId, type WorkflowEffect, type WorkflowRunRecord } from "@humwick/kernel/workflow.pilot";
+import { invoke, live, runAgents, type Supervisor } from "./workflow-supervisor-state";
+
+export async function workflowWaitAgent(sup: Supervisor, run: WorkflowRunRecord): Promise<string | undefined> {
+  const wait = run.awaiting;
+  if (run.status !== "running" || wait?.kind !== "delivery" || run.resuming?.to) return undefined;
+  const ids = wait.effectId ? [wait.effectId] : (["dispatch", "findings"] as const).map((kind) => workflowEffectId(run.id, run.waitSeq, kind));
+  for (const id of ids) {
+    const { effect } = await invoke<{ effect?: WorkflowEffect }>(sup, "getEffect", { id });
+    if (effect?.status !== "done") continue;
+    const to = stringValue(effect.result?.to);
+    if (to) return to;
+    const spawn = stringValue(effect.result?.spawnRequestId);
+    if (spawn) return (await runAgents(sup, run.id)).find((agent) => agent.id === spawn)?.agentId;
+    return undefined;
+  }
+  return undefined;
+}
+
+/** A workflow wait is itself an obligation, including before its Task has an owner. */
+export async function workflowAgentObligation(runId: string, agentId: string): Promise<import("./agent-hang-watchdog").AgentHangObligation | undefined> {
+  const sup = live();
+  if (!sup) return undefined;
+  let run: WorkflowRunRecord;
+  try {
+    run = await invoke<WorkflowRunRecord>(sup, "get", { runId });
+  } catch (error) {
+    if (error instanceof OpError && error.code === "not_found") return undefined;
+    throw error;
+  }
+  if (await workflowWaitAgent(sup, run) !== agentId || !run.awaiting) return undefined;
+  return { kind: "task", key: `workflow:${run.id}:${run.awaiting.key}`, openedAt: run.awaiting.since, subject: `workflow ${run.id} step ${run.step}` };
+}

package/src/services/workflow-auto-start.ts

@@ -0,0 +1,126 @@
+// #3091 — workflows by default: a builder spawn for a Task that lands code starts the project's build-review
+// workflow instead, and its run spawns the builder. One core behind relay_spawn_agent, relay_task_dispatch and
+// POST /api/agents/spawn; `workflow: false` keeps the manual path. review, research and ops Tasks never start one.
+import { WORKFLOW_AUTO_START_NAME, workflowAutoStarts, type WorkflowRunAgent, type WorkflowRunView } from "@humwick/sdk";
+import { getTaskDetailAsync, ValidationError } from "../db";
+import { getAgentProfile } from "../config-store";
+import { McpAuthError, McpNotFoundError } from "../mcp-errors";
+import { ServiceAuthError } from "./errors";
+import { getWorkflowRun, launchWorkflowRun, prepareWorkflowRun, type PreparedWorkflowRun } from "./workflow-runs";
+import type { WorkflowPins } from "./workflow-pins";
+import type { AuthContext } from "./auth-context";
+
+/** A builder spawn as its transport received it: the Task, the opt-out, and every other field the caller set (wire names). */
+export interface BuilderSpawn {
+  taskId: number | undefined;
+  /** `false` spawns by hand. */
+  workflow?: boolean;
+  fields: Record<string, unknown>;
+}
+
+export type BuilderSpawnOutcome =
+  | { started: true; receipt: Record<string, unknown> }
+  /** Spawn by hand; `reason` says why a Task of an auto-start type did not start its workflow. */
+  | { started: false; reason?: string };
+
+/** Fields the build step takes as its pin. */
+const PIN_FIELDS = ["provider", "model", "effort", "orchestratorId", "profile"] as const;
+/** Fields recorded on the Task as its latest steer, which the builder's brief hydrates. */
+const BRIEF_FIELDS = ["steer", "prompt"] as const;
+/** Fields the run sets for its own agents: accepted, and the receipt says they went unused. */
+const UNUSED_FIELDS = ["label", "lifecycle", "reportVerbosity", "spawnRequestId"];
+/** Fields that only shape the call itself. */
+const CALL_FIELDS = ["waitForRegistrationMs", "verbose", "expectReply", "createReview", "requestedVia", "requestedBy"];
+/** Fields accepted with the value the build step uses anyway. */
+const MATCHED_FIELDS: Record<string, (value: unknown) => boolean> = {
+  approvalMode: (value) => value === "open",
+  workspaceMode: (value) => value === "isolated",
+  landBlocked: (value) => value === false,
+  taskless: (value) => value === false,
+};
+/** Resolved with the workflow: the role its build step runs, and the cwd the run reads it in and runs its steps in. */
+const RESOLVED_FIELDS = ["role", "cwd"];
+
+function set(fields: Record<string, unknown>): string[] {
+  return Object.entries(fields).filter(([key, value]) => value !== undefined && !(key === "provider" && value === "auto")).map(([key]) => key);
+}
+
+function taskRepos(task: { repo?: string; issues: Array<{ repo?: string }> }): string[] {
+  return [...task.issues.map((issue) => issue.repo), task.repo].filter((repo): repo is string => Boolean(repo));
+}
+
+function refused(fields: Record<string, unknown>): string[] {
+  const known = [...PIN_FIELDS, ...BRIEF_FIELDS, ...UNUSED_FIELDS, ...CALL_FIELDS, ...RESOLVED_FIELDS] as string[];
+  return set(fields).filter((key) => (key in MATCHED_FIELDS ? !MATCHED_FIELDS[key]!(fields[key]) : !known.includes(key)));
+}
+
+/** relay_spawn_agent and the dispatch tool share this: the coordinator's spawn becomes the run's builder. */
+export async function workflowForBuilderSpawn(spawn: BuilderSpawn, ctx: AuthContext): Promise<BuilderSpawnOutcome> {
+  if (spawn.workflow === false || spawn.taskId === undefined) return { started: false };
+  const task = await getTaskDetailAsync(spawn.taskId);
+  const type = task?.kind === "deliverable" ? task.dispatch?.type : undefined;
+  if (!task || !workflowAutoStarts(type)) return { started: false };
+  const subject = `T${task.id} is a ${type} Task, so this spawn starts workflow ${WORKFLOW_AUTO_START_NAME}, whose run spawns the builder`;
+  const optOut = "pass workflow:false to spawn by hand";
+  if (!taskRepos(task).length) return { started: false, reason: `T${task.id} names no repo, so no workflow can run on it` };
+  const conflicts = refused(spawn.fields);
+  if (conflicts.length) throw new ValidationError(`${subject}; the run cannot honor ${conflicts.map((key) => `${key}=${JSON.stringify(spawn.fields[key])}`).join(", ")}. Drop ${conflicts.length > 1 ? "them" : "it"}, or ${optOut}`);
+  try {
+    // Located as the spawn itself would be: its cwd and host, else the Task's repo root.
+    const { cwd, orchestratorId } = spawn.fields;
+    const prepared = await prepareWorkflowRun({
+      workflow: WORKFLOW_AUTO_START_NAME, taskId: task.id, ...(typeof cwd === "string" && cwd ? { cwd } : {}), ...(typeof orchestratorId === "string" && orchestratorId ? { orchestratorId } : {}),
+    }, ctx);
+    const inputSteps = Object.entries(prepared.read.workflow.definition.steps).filter(([, step]) => step.task === "input");
+    const role = spawn.fields.role;
+    const other = inputSteps.find(([, step]) => role !== undefined && step.role !== role);
+    if (other) throw new ValidationError(`its build step ${other[0]} runs role ${other[1].role}, not ${String(role)}`);
+    const pin = builderPin(spawn.fields);
+    const pins: WorkflowPins | undefined = Object.keys(pin).length ? Object.fromEntries(inputSteps.map(([name]) => [name, pin])) : undefined;
+    const steer = BRIEF_FIELDS.map((key) => spawn.fields[key]).filter((value): value is string => typeof value === "string" && Boolean(value.trim())).join("\n\n");
+    // The call answers for the builder's spawn: one the run cannot dispatch fails it, as a spawn by hand would (#3160).
+    const started = await launchWorkflowRun(prepared, { ...(pins ? { pins } : {}), ...(steer ? { steer } : {}), refuseUndispatched: true }, ctx) as WorkflowRunView & { existing?: true; warnings?: string[] };
+    return { started: true, receipt: await receiptFor(prepared, started, set(spawn.fields).filter((key) => UNUSED_FIELDS.includes(key)), ctx) };
+  } catch (error) {
+    if (error instanceof ServiceAuthError) throw new McpAuthError(`${subject}: ${error.message}; ${optOut}`);
+    if (error instanceof ValidationError || error instanceof McpAuthError || error instanceof McpNotFoundError) error.message = `${subject}: ${error.message}; ${optOut}`;
+    throw error;
+  }
+}
+
+/** The build step's pin from the spawn's own fields, the profile in its stored case. */
+function builderPin(fields: Record<string, unknown>): Record<string, string> {
+  const pin: Record<string, string> = {};
+  for (const key of PIN_FIELDS) {
+    const value = fields[key];
+    if (typeof value === "string" && value && value !== "auto") pin[key] = key === "profile" ? getAgentProfile(value)?.value.name ?? value : value;
+  }
+  return pin;
+}
+
+/** The spawn's receipt: the run, and its builder as a spawn receipt names one (the newest agent of the build step). */
+async function receiptFor(prepared: PreparedWorkflowRun, started: WorkflowRunView & { existing?: true; warnings?: string[] }, ignored: string[], ctx: AuthContext): Promise<Record<string, unknown>> {
+  const { task, read } = prepared;
+  const run = await getWorkflowRun(started.runId, ctx, { verbose: true }) as WorkflowRunView & { agents: WorkflowRunAgent[] };
+  const step = run.steps.find((entry) => read.workflow.definition.steps[entry.name]?.task === "input")!;
+  const agent = run.agents.filter((entry) => entry.step === step.name).at(-1);
+  const profile = step.pin?.profile ?? read.workflow.roles.get(step.role)?.extends;
+  const label = `workflow ${run.workflow} (${run.source ?? "project"}) run ${run.runId}`;
+  const note = started.existing
+    ? `T${task.id} already runs ${label}, which owns its builder: no builder was spawned. relay_workflow_get shows its agents; pass workflow:false to spawn beside it.`
+    : `T${task.id} is a ${task.dispatch?.type} Task, so Relay started ${label}; its run ${agent ? "spawned" : "is spawning"} the builder (role ${step.role} on profile ${profile}). You hear back on a step spawn failure, an escalation or the result. Pass workflow:false to spawn by hand.`;
+  const warnings = [...(started.warnings ?? []), ...(ignored.length ? [`the run sets these for its own agents, so ${ignored.join(", ")} went unused`] : [])];
+  return {
+    ok: true,
+    status: agent?.agentId ? "registered" : "pending",
+    taskId: task.id,
+    workflowRun: {
+      runId: run.runId, workflow: run.workflow, ...(run.source ? { source: run.source } : {}), sha: run.sha, status: run.status, step: run.step,
+      taskType: task.dispatch?.type, ...(started.existing ? { existing: true } : {}),
+      builder: { step: step.name, role: step.role, ...(profile ? { profile } : {}), ...(step.pin ? { pin: step.pin } : {}) },
+    },
+    ...(agent ? { spawnRequestId: agent.spawnRequestId, agentId: agent.agentId ?? null, registered: Boolean(agent.agentId), ...(agent.provider ? { provider: agent.provider } : {}) } : {}),
+    note,
+    ...(warnings.length ? { warnings } : {}),
+  };
+}

package/src/services/workflow-backstop.ts

@@ -0,0 +1,38 @@
+import { createModuleHost } from "@humwick/kernel";
+import { workflow, type WorkflowEffect, type WorkflowRunRecord } from "@humwick/kernel/workflow.pilot";
+import { createGatewayKernelPersistence } from "../db/kernel-persistence-async";
+import { performWorkflowEffect } from "./workflow-effects";
+
+const AUTH = { actor: "kernel:workflow-backstop", grants: ["workflow:admin"] as const };
+
+/** Deliberately independent of the supervisor's ticker and serialized pass, including its timeout path. */
+export async function sweepWorkflowBackstops(input: { now?: number; signal?: AbortSignal } = {}): Promise<Record<string, unknown>> {
+  const persistence = createGatewayKernelPersistence();
+  if (input.signal?.aborted || !await persistence.moduleTableExists("kernel_entity__workflow__run")) return { checked: 0, alerted: 0 };
+  const host = createModuleHost({ persistence });
+  host.register(workflow);
+  await host.whenReady();
+  let cursor: string | undefined;
+  let checked = 0;
+  let alerted = 0;
+  do {
+    const page = await host.invoke(workflow, "openRuns", AUTH, { limit: 100, ...(cursor ? { cursor } : {}) }) as { items: WorkflowRunRecord[]; cursor?: string };
+    for (const run of page.items) {
+      if (input.signal?.aborted) return { checked, alerted, aborted: true };
+      checked++;
+      const now = input.now ?? Date.now();
+      if (run.overdueAt !== undefined && now < run.overdueAt) continue;
+      const result = await host.invoke(workflow, "checkOverdue", AUTH, { runId: run.id, now }) as { created: boolean; effectId?: string };
+      if (result.created) alerted++;
+      // Retry a committed-but-unsent notice after a restart, using the ordinary effect idempotency key.
+      if (!result.effectId) continue;
+      const { effect } = await host.invoke(workflow, "getEffect", AUTH, { id: result.effectId }) as { effect?: WorkflowEffect };
+      if (effect?.status !== "pending") continue;
+      const latest = await host.invoke(workflow, "get", AUTH, { runId: run.id }) as WorkflowRunRecord;
+      const performed = await performWorkflowEffect(latest, effect, [], (op, args) => host.invoke(workflow, op, AUTH, args));
+      await host.invoke(workflow, "settleEffect", AUTH, { id: effect.id, status: "done", result: performed });
+    }
+    cursor = page.cursor;
+  } while (cursor);
+  return { checked, alerted };
+}

package/src/services/workflow-budget.test-fixture.ts

@@ -0,0 +1,10 @@
+/** Three review steps let reported usage cross the cap between ordinary deliveries. */
+export const budgetWorkflowYaml = `steps:
+  first: { role: reviewer, task: input, gate: review }
+  second: { role: reviewer, task: new, gate: review }
+  third: { role: reviewer, task: new, gate: review }
+routes:
+  first: { pass: second, fail: escalate }
+  second: { pass: third, fail: escalate }
+  third: { pass: land, fail: escalate }
+`;

package/src/services/workflow-caller.ts

@@ -0,0 +1,32 @@
+import { stringValue } from "@humwick/sdk";
+import { childWorkflowsEnabled } from "../config";
+import { getAgentProfile } from "../config-store";
+import { getAgent, ValidationError } from "../db";
+import type { TaskDetail } from "../types";
+import { ServiceAuthError } from "./errors";
+import type { AuthContext } from "./auth-context";
+import { canSpawn } from "./spawn-agent";
+import { canControlTaskReviewHold } from "./task-review-hold";
+import { callerGone } from "../db/caller-lifecycle";
+
+export const workflowCallerGone = callerGone;
+
+export function assertWorkflowCallerLive(agentId: string): void {
+  if (workflowCallerGone(agentId)) throw new ValidationError("WORKFLOW_CALLER_GONE: caller is canceled or reaped");
+}
+
+/** Workflow authority delegates execution to Relay, never the caller's direct-spawn capability. */
+export function admitWorkflowCaller(ctx: AuthContext, task: TaskDetail, workflow?: { name: string; source: string }) {
+  const agent = ctx.callerAgentId ? getAgent(ctx.callerAgentId) : null;
+  if (!agent || (!agent.spawnedBy && canSpawn(ctx))) return undefined;
+  if (!childWorkflowsEnabled()) throw new ServiceAuthError("WORKFLOW_DISABLED: child workflows are disabled");
+  assertWorkflowCallerLive(agent.id);
+  if (task.ownerAgentId !== agent.id && task.createdBy !== agent.id && !canControlTaskReviewHold(ctx, task)) throw new ServiceAuthError("WORKFLOW_TASK_FORBIDDEN: caller must own or create the Task");
+  const profile = getAgentProfile(ctx.constraints?.profile ?? stringValue(agent.meta?.profile) ?? "worker")?.value;
+  const policy = profile?.workflows;
+  const maxConcurrentRuns = policy?.maxConcurrentRuns ?? 1;
+  const maxLiveAgents = policy?.maxLiveAgents ?? 2;
+  if (!maxConcurrentRuns || !maxLiveAgents) throw new ValidationError("WORKFLOW_RUN_LIMIT: profile disables workflow runs");
+  if (workflow && workflow.source === "bundled" && !(policy?.allowed ?? ["build-review"]).includes(workflow.name)) throw new ServiceAuthError(`WORKFLOW_NOT_ALLOWED: profile does not allow ${workflow.name}`);
+  return { callerAgentId: agent.id, maxConcurrentRuns, maxLiveAgents };
+}

package/src/services/workflow-catalog.ts

@@ -0,0 +1,43 @@
+// #3120 — GET /api/workflows/catalog: the workflows a project can run, as relay_workflow_start would
+// resolve them now. Its files are read on a host that owns its checkout, at one default-branch commit.
+import { PROJECT_MCP_FILE, PROJECT_ROLES_DIR, PROJECT_WORKFLOWS_DIR, type WorkflowCatalog } from "@humwick/sdk";
+import { rootsForProjectAsync } from "../db";
+import { readHostProjectFiles } from "../project-roles";
+import { workflowCatalog } from "../project-workflows";
+import { hydrateRoleAssets } from "../project-role-assets";
+import type { AuthContext } from "./auth-context";
+import { resolveProjectFilesHost } from "./spawn-project-role";
+
+/** Without a project: the bundled workflows. A project whose files cannot be read keeps the bundled ones
+ *  and says why in `project.error`, never an empty list that looks real. */
+export async function readWorkflowCatalog(input: { projectId?: string }, ctx: AuthContext): Promise<WorkflowCatalog> {
+  if (!input.projectId) return workflowCatalog();
+  const project: NonNullable<WorkflowCatalog["project"]> = { id: input.projectId };
+  const roots = await rootsForProjectAsync(input.projectId);
+  if (!roots.length) return { project: { ...project, error: "the project has no registered checkout (relay_project_add_root)" }, ...workflowCatalog() };
+  let host: ReturnType<typeof resolveProjectFilesHost> | undefined;
+  let cwd = roots[0]!.rootPath;
+  const failures: string[] = [];
+  for (const root of roots) {
+    try {
+      host = resolveProjectFilesHost({ subject: "workflows", cwd: root.rootPath, allowedOrchestratorIds: ctx.constraints?.orchestrators });
+      cwd = root.rootPath;
+      break;
+    } catch (error) {
+      failures.push((error as Error).message);
+    }
+  }
+  if (!host) return { project: { ...project, cwd, error: failures.join("; ") }, ...workflowCatalog() };
+  const located = { ...project, cwd, host: host.id };
+  try {
+    const listed = await readHostProjectFiles(host, cwd, { paths: [PROJECT_MCP_FILE], dir: PROJECT_WORKFLOWS_DIR, dirExt: ".yaml" }, "workflows");
+    // The roles at the same commit, so each workflow is checked against the roles a run would get.
+    const roles = await readHostProjectFiles(host, cwd, { paths: [PROJECT_MCP_FILE], dir: PROJECT_ROLES_DIR, sha: listed.sha }, "workflow roles");
+    return {
+      project: { ...located, ref: listed.ref, sha: listed.sha, ...(listed.fetchError ? { fetchError: listed.fetchError } : {}) },
+      ...workflowCatalog(await hydrateRoleAssets({ ...listed, files: { ...listed.files, ...roles.files } }, request => readHostProjectFiles(host!, cwd, request, "workflow role assets"))),
+    };
+  } catch (error) {
+    return { project: { ...located, error: (error as Error).message }, ...workflowCatalog() };
+  }
+}

package/src/services/workflow-child-proof-worker.ts

@@ -0,0 +1,76 @@
+// Disposable proof entrypoint; run by scripts/proof-3272-child.ts, never by server startup.
+import { RELAY_TOKEN_HEADER } from "@humwick/sdk";
+import assert from "node:assert/strict";
+import { readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { initDb, createDeliverableTask } from "../db";
+import { shutdownGateway } from "../db/gateway";
+import { matchRoute } from "../routes";
+import { startPresenceFlushLoop } from "../db/presence-loop";
+import { announceBranchLanded } from "../branch-landed";
+import { listCommands, getCommand, updateCommand } from "../commands-db";
+import { childWorkflowYaml, settleChildProofStops, installChildProofHost } from "./workflow-child.test-fixture";
+import { createWorkflowRepo, seedWorkflowRelay, builderDelivers, reviewerDelivers, spawnsFor, WF, setFetchedBasePreview } from "./workflow-run.test-fixture";
+import { startWorkflowRun, getWorkflowRun, startWorkflowServing, setWorkflowSupervisorTestOptions, workflowTaskDelivered } from "./workflow-runs";
+import { settleScheduledCommandTimer } from "./scheduler-command";
+
+const db = process.env.CHILD_PROOF_DB!;
+assert(db);
+const phase = process.env.CHILD_PROOF_PHASE;
+const metadataFile = `${db}.proof.json`;
+const ctx = { actor: { id: WF.coordinator, kind: "agent" as const }, callerAgentId: WF.coordinator, scopes: ["*"] };
+initDb(db);
+startPresenceFlushLoop();
+installChildProofHost();
+const relay = Bun.serve({ hostname: "127.0.0.1", port: process.env.CHILD_PROOF_PORT ? Number(process.env.CHILD_PROOF_PORT) : 0, fetch(request) {
+  const route = matchRoute(request.method, new URL(request.url).pathname);
+  return route ? route.handler(request, route.params) : new Response("not found", { status: 404 });
+} });
+if (phase === "crash") {
+  const repo = createWorkflowRepo({ ".agent-relay/workflows/verify-deployed.yaml": childWorkflowYaml,
+    "scripts/check-deployed.ts": 'const {sha} = JSON.parse(process.env.inputs!); const target = await (await fetch(process.env.PROOF_TARGET!)).json(); if (target.sha !== sha) process.exit(1); console.log(JSON.stringify({output:{deployed:true}}));\n' });
+  seedWorkflowRelay(repo.cwd);
+  const task = createDeliverableTask({ title: "process restart proof", intent: "child lands a disposable fix", doneWhen: "checked deployed SHA", branch: WF.branch, repo: WF.repo, createdBy: WF.coordinator, dispatch: { type: "build" } });
+  const root = await startWorkflowRun({ workflow: "verify-deployed", taskId: task.id, inputs: { taskId: task.id } }, ctx);
+  const run = await getWorkflowRun(String(root.runId), ctx, { verbose: true });
+  const childRunId = (run.children as Array<{runId: string}>)[0]!.runId;
+  repo.write("fix.txt", "real process restart proof\n"); repo.commit("fix: disposable restart proof");
+  const sha = await builderDelivers(repo, task.id, "process-proof-build");
+  await reviewerDelivers("pass", "GO", "process-proof-review");
+  repo.git("push", "-q", "origin", "HEAD:main");
+  setFetchedBasePreview({ reapAhead: 0, reapShas: [] });
+  writeFileSync(metadataFile, JSON.stringify({ cwd: repo.cwd, cleanup: dirname(repo.cwd), runId: root.runId, childRunId, taskId: task.id, sha, beforePid: process.pid, beforeUrl: String(relay.url), builderSpawns: spawnsFor("builder").length, reviewerSpawns: spawnsFor("reviewer").length, landCommands: listCommands().filter(c => c.type.startsWith("landing.") || c.type === "workspace.merge").map(c => c.id) }));
+  setWorkflowSupervisorTestOptions({ fault(label) {
+    if (label === "after-child-complete") process.kill(process.pid, "SIGKILL");
+  } });
+  announceBranchLanded({ workspace: { id: WF.workspace, repoRoot: repo.cwd, branch: WF.branch, baseRef: "origin/main", ownerAgentId: WF.builder, orchestratorId: WF.orchestrator }, sourceHeadSha: sha, mergedSha: sha, pushed: true, taskIds: [task.id] });
+  await workflowTaskDelivered();
+  await settleChildProofStops();
+  throw new Error("restart seam was not reached");
+} else {
+  const meta = JSON.parse(readFileSync(metadataFile, "utf8"));
+  seedWorkflowRelay(meta.cwd);
+  const target = Bun.serve({ hostname: "127.0.0.1", port: 0, fetch: () => Response.json({ sha: meta.sha }) });
+  await startWorkflowServing();
+  const before = await getWorkflowRun(meta.runId, ctx, { verbose: true });
+  assert.equal(before.step, "check");
+  assert.equal((before.children as any[]).length, 1);
+  assert.equal((before.children as any[])[0].runId, meta.childRunId);
+  assert.equal(spawnsFor("builder").length, meta.builderSpawns);
+  assert.equal(spawnsFor("reviewer").length, meta.reviewerSpawns);
+  assert.deepEqual(listCommands().filter(c => c.type.startsWith("landing.") || c.type === "workspace.merge").map(c => c.id), meta.landCommands);
+  const commands = listCommands({ type: "scheduler.command" }).filter(c => c.status === "pending");
+  assert.equal(commands.length, 1);
+  const command = commands[0]!;
+  const child = Bun.spawn(["bash", "-o", "pipefail", "-c", String(command.params.command)], { cwd: meta.cwd, env: { ...process.env, ...command.params.env as Record<string, string>, PROOF_TARGET: String(target.url) }, stdout: "pipe", stderr: "pipe" });
+  const [stdoutTail, stderrTail, exitCode] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
+  assert.equal(exitCode, 0, stderrTail);
+  updateCommand(command.id, { status: "succeeded", result: { exitCode, stdoutTail, stderrTail } });
+  await settleScheduledCommandTimer(getCommand(command.id)!); await workflowTaskDelivered();
+  const response = await fetch(new URL(`/api/workflows/runs/${meta.runId}?verbose=true`, relay.url), { headers: { [RELAY_TOKEN_HEADER]: "child-process-proof" } });
+  assert(response.ok);
+  const done = await response.json() as any;
+  assert.equal(done.status, "done"); assert.deepEqual(done.outputs, { landedSha: meta.sha, deployed: true });
+  console.log(JSON.stringify({ proof: "3272-child-process-restart", result: "pass", instance: String(relay.url), beforePid: meta.beforePid, afterPid: process.pid, runId: meta.runId, childRunId: meta.childRunId, checkedLandedSha: meta.sha, output: done.outputs }));
+  target.stop(true); relay.stop(true); await shutdownGateway(); process.exit(0);
+}

package/src/services/workflow-child.test-fixture.ts

@@ -0,0 +1,51 @@
+export const childWorkflowYaml = `version: 2
+inputs:
+  type: object
+  additionalProperties: false
+  required: [taskId]
+  properties:
+    taskId: { type: integer, minimum: 1 }
+outputs:
+  type: object
+  additionalProperties: false
+  required: [landedSha, deployed]
+  properties:
+    landedSha: { type: string, minLength: 1 }
+    deployed: { type: boolean }
+steps:
+  build:
+    workflow: build-review
+    taskId: \${{ inputs.taskId }}
+    inputs: {}
+  check:
+    script: { run: 'bun scripts/check-deployed.ts', host: owner, timeout: 1m }
+    inputs:
+      sha: \${{ steps.build.outputs.landedSha }}
+    output-schema:
+      type: object
+      additionalProperties: false
+      required: [deployed]
+      properties:
+        deployed: { type: boolean }
+    on: { 0: next, default: fail }
+return:
+  landedSha: \${{ steps.build.outputs.landedSha }}
+  deployed: \${{ steps.check.outputs.deployed }}
+`;
+
+
+import { listCommands, updateCommand } from "../commands-db";
+import { workflowTaskDelivered } from "./workflow-runs";
+
+// The proof provider is an emulator: report its shutdown through the ordinary command record.
+export async function settleChildProofStops(): Promise<void> {
+  for (let pass = 0; pass < 3; pass++) {
+    for (const command of listCommands({ type: "agent.shutdown" })) {
+      if (["pending", "accepted", "running"].includes(command.status)) updateCommand(command.id, { status: "succeeded", result: { stopped: true, wasRunning: false, processTreeStopped: true } });
+    }
+    await workflowTaskDelivered();
+  }
+}
+
+import { installWorkflowHost } from "./workflow-run.test-fixture";
+export const installChildProofHost = () => installWorkflowHost({ confirmStops: false });

package/src/services/workflow-ci-main.ts

@@ -0,0 +1,93 @@
+import { correlatedCiIncidents } from "./plan-ci-recovery";
+// #3045 H5 — the `ci-main` step after the land: CI on main for the exact landed commit. The CI monitor's
+// existing tick observes every commit a run waits on (ci_sha_observations); this module only reads that
+// evidence. Red alerts the coordinator once while the run keeps waiting; green on every watch ends the run
+// with CI pass; no watch, or no verdict by the deadline, is "no CI"; a watch that will not run on the commit
+// (#3622) ends it at once as "not triggered", not as a late CI. A later commit's CI never counts.
+
+import { formatWorkflowDuration, waitTimeoutMs } from "@humwick/kernel/workflow-definition";
+import type { WorkflowCiVerdict, WorkflowRunRecord } from "@humwick/kernel/workflow.pilot";
+import { parseGitHubRepositoryRemote } from "../ci/monitor";
+import type { CiFailingJob, CiShaObservation } from "../db/ci-incidents";
+import { getGateway } from "../db/gateway";
+import { canonicalBaseRef } from "../landing-lane-key";
+
+/** The monitor polls every 5 minutes; a watch it has not polled for this long before the wait began is no longer configured. */
+const LIVE_WATCH_WINDOW_MS = 30 * 60_000;
+/** The alert key of red CI on one wait (the kernel scopes it to the wait's seq). */
+const CI_RED_KEY = "ci-red";
+
+type Awaiting = NonNullable<WorkflowRunRecord["awaiting"]>;
+
+export interface CiMainOutcome {
+  /** Ends the wait. */
+  verdict?: WorkflowCiVerdict;
+  /** Red CI on the landed commit: one alert per wait, before any verdict. */
+  red?: { key: string; reason: string; detail: Record<string, unknown> };
+}
+
+function short(sha: string): string {
+  return sha.slice(0, 12);
+}
+
+/** Read the landed commit's CI for a `ci` wait; `baseRef` is the delivered workspace's land target. */
+export async function ciMainOutcome(run: WorkflowRunRecord, wait: Awaiting, now: number, baseRef: string | undefined): Promise<CiMainOutcome> {
+  const sha = wait.sha ?? run.landed?.sha ?? "";
+  const named = run.definition.ciMain?.workflow;
+  const repository = parseGitHubRepositoryRemote((await getGateway().read("workflowTask.rootRemoteUrl", { cwd: run.cwd })) ?? undefined);
+  if (!repository) return { verdict: { status: "none", note: `no CI: ${run.cwd} has no registered github.com remote` } };
+  const branch = baseRef ? canonicalBaseRef(baseRef) : "main";
+  const repo = `${repository.owner}/${repository.repo}`;
+  const where = `${repo}@${branch}${named ? ` (${named})` : ""}`;
+  const watches = (await getGateway().read("ciIncidents.watch.branch", { repository: repo, branch, ...(named ? { workflow: named } : {}) }))
+    .filter((watch) => watch.status !== "missing" && watch.observedAt >= wait.since - LIVE_WATCH_WINDOW_MS);
+  const past = now >= (wait.deadline ?? wait.since + waitTimeoutMs(run.definition, run.step));
+  // A paused/restarting monitor needs the CI wait to survive until its next poll (#3396).
+  if (!watches.length) return past ? { verdict: { status: "none", note: `no CI: no CI monitor watch reports on ${where}` } } : {};
+
+  // Only evidence observed after this wait began counts, so a resumed wait re-checks instead of re-reading.
+  const observed = new Map((await getGateway().read("ciIncidents.sha.list", { headSha: sha, watchKeys: watches.map((watch) => watch.watchKey) }))
+    .filter((row) => row.observedAt >= wait.since).map((row) => [row.watchKey, row] as const));
+  const verdicts = watches.map((watch) => ({ workflow: watch.workflow, row: observed.get(watch.watchKey) }));
+  const red = verdicts.filter((entry) => entry.row?.status === "failing");
+  if (red.length) {
+    const jobs = red.flatMap((entry) => entry.row!.failingJobs ?? []);
+    const url = jobs.find((job) => job.url)?.url ?? red.find((entry) => entry.row!.runUrl)?.row!.runUrl;
+    const verdict: WorkflowCiVerdict = { status: "fail", sha, workflows: red.map((entry) => entry.workflow), ...(url ? { url } : {}) };
+    const incidentIds = await correlatedCiIncidents(red);
+    return { red: { key: incidentIds.length ? `${CI_RED_KEY}:${incidentIds.join(":")}` : CI_RED_KEY, reason: "ci-red", detail: { ci: verdict, jobs, landedSha: sha, incidentIds } }, ...(past ? { verdict } : {}) };
+  }
+  // Every live watch must report: a fast workflow's green says nothing about a slow one still running.
+  // A workflow that will not run on this commit (#3622: path-filtered or skipped) has nothing to report.
+  const settled = (row: CiShaObservation | undefined) => row?.status === "green" || row?.status === "cancelled" || row?.status === "not-triggered";
+  if (verdicts.every((entry) => settled(entry.row))) {
+    const named = (status: CiShaObservation["status"]) => verdicts.filter((entry) => entry.row?.status === status).map((entry) => entry.workflow);
+    const [green, cancelled] = [named("green"), named("cancelled")];
+    if (cancelled.length) return { verdict: { status: "none", sha, note: `no CI: ${cancelled.join(", ")} on ${short(sha)} was cancelled (a newer commit may have superseded it)` } };
+    if (green.length) return { verdict: { status: "pass", sha, workflows: green } };
+    return { verdict: { status: "none", sha, note: `not triggered for this commit: ${named("not-triggered").join(", ")} did not run on ${short(sha)} (path-filtered or skipped)` } };
+  }
+  if (!past) return {};
+  const timeoutMs = wait.deadline !== undefined ? wait.deadline - wait.since : waitTimeoutMs(run.definition, run.step);
+  return { verdict: { status: "none", sha, note: `no CI: ${where} gave no verdict on ${short(sha)} within ${formatWorkflowDuration(timeoutMs)}` } };
+}
+
+/** The coordinator's alert for red CI on the landed commit. */
+export function ciRedLead(label: string, payload: Record<string, unknown>): string[] {
+  const ci = (payload.ci ?? {}) as Partial<WorkflowCiVerdict>;
+  const jobs = Array.isArray(payload.jobs) ? payload.jobs as CiFailingJob[] : [];
+  return [
+    `${label}: CI on main is red on the landed commit ${short(String(payload.landedSha))}: ${(ci.workflows ?? []).join(", ") || "CI"} failed.`,
+    ...(jobs.length ? [`Failing: ${jobs.map((job) => (job.url ? `${job.name} ${job.url}` : job.name)).join("; ")}`] : ci.url ? [`Run: ${ci.url}`] : []),
+    "The run keeps waiting on this commit's CI: a green rerun ends it with CI pass; still red at its deadline, the result reports CI red. Fix main with a new Task; relay_workflow_resume re-checks CI with a fresh deadline.",
+  ];
+}
+
+/** The result's CI line. */
+export function ciResultLine(ci: WorkflowCiVerdict | undefined): string | undefined {
+  if (!ci) return undefined;
+  const at = ci.sha ? ` at ${short(ci.sha)}` : "";
+  if (ci.status === "pass") return `CI on main: pass${at}.`;
+  if (ci.status === "fail") return `CI on main: red${at}${ci.url ? `: ${ci.url}` : ""}.`;
+  return `CI on main: ${ci.note ?? "no CI"}.`;
+}