@inflexa-ai/harness 0.45.1 → 0.46.2

package/dist/tasks/data-profile.js

@@ -17,26 +17,33 @@
  * triggers dedup via the ledger CAS (only one `tryStart/tryRerun/tryRetry`
  * UPDATE wins); each winning attempt starts a workflow under a per-attempt id.
  */
-import { DBOS, Error as DBOSErrors } from "@dbos-inc/dbos-sdk";
+import { errorMessageOf } from "../lib/thrown.js";
+import { textOf } from "../lib/unknown-text.js";
+import { DBOS } from "@dbos-inc/dbos-sdk";
+import { isWorkflowCancellation } from "../runtime/dbos.js";
 import { randomUUID } from "node:crypto";
 import { ResultAsync, err, ok } from "neverthrow";
 import { forStep, forSubAgent } from "../auth/types.js";
+import { presentFirst } from "../lib/present.js";
+import { collapseWhitespace } from "../lib/text.js";
 import { createDataProfilerAgent } from "../agents/sandbox/data-profiler.js";
-import { runToTerminal } from "../loop/run-to-terminal.js";
-import { durableStep } from "../loop/run-step.js";
+import { runWithSalvage } from "../loop/run-loop.js";
+import { recordedInputOf } from "../loop/tool-adapter.js";
 import { createNoopLogger } from "../lib/console-logger.js";
 import { deliverNotice, passGate } from "../lib/hooks.js";
 import { unwrapOrThrow } from "../lib/result.js";
 import { defineTool } from "../tools/define-tool.js";
 import { createDetailResolver } from "../tools/detail-resolver.js";
 import { renderWorkspace } from "../prompts/briefing.js";
-import { keepSuspendingRefusal } from "../sandbox/sandbox-error.js";
-import { cancelSelf, suspensionOfFailure, suspensionOfRefusal, suspensionOfSpawnRefusal } from "../workflows/suspension.js";
+import { keepSuspendingRefusal, SandboxFailure } from "../sandbox/sandbox-error.js";
+import { workPause } from "../workflows/pause.js";
+import { clearPausesOfWork } from "../state/paused-work.js";
 import { toSandboxPath } from "../workspace/paths.js";
 import { estimateDataProfileResources } from "../sandbox/estimate-data-profile-resources.js";
 import { generateExecutionId } from "../sandbox/execution-id.js";
 import { mintSandboxIdentity } from "../sandbox/identity.js";
 import { createVectorStore } from "../state/vector-store.js";
+import { z } from "zod";
 import { ProfileSubmissionSchema } from "../schemas/data-profile-schemas.js";
 import { computeInputSignature } from "../execution/input-signature.js";
 import { readHeaders } from "../input-scan/enrich.js";
@@ -47,7 +54,7 @@ import { scanInputTree } from "../input-scan/scan.js";
 import { PROFILE_INDEX_TYPES, buildProfileIndexEntries } from "./data-profile-index.js";
 import { absorbRecipe, renderAbsorbDelta } from "./data-profile-absorb.js";
 import { formatResolutionErrors, resolveProfileSubmission } from "./data-profile-resolve.js";
-import { completeDataProfile, completeEmptyDataProfile, failDataProfile, loadDataProfileStatus, loadSeedInputFileIds, recordDataProfileWorkflowId, suspendAnalysis, tryRerunDataProfile, tryStartDataProfile, upsertArtifacts, } from "../state/index.js";
+import { completeDataProfile, completeEmptyDataProfile, failDataProfile, loadDataProfileStatus, loadSeedInputFileIds, recordDataProfileWorkflowId, tryRerunDataProfile, tryStartDataProfile, upsertArtifacts, } from "../state/index.js";
 import { elapsedSinceIso, recordRunCompleted } from "../lib/metrics.js";
 import { createProfileActivityEmitter } from "./data-profile-activity.js";
 import { ensureSearchIndex, searchIndexName } from "../workspace/search-config.js";
@@ -64,15 +71,45 @@ const DATA_PROFILE_AGENT_ID = "data-profiler";
 const DEFAULT_DEADLINE_MS = 1_200_000;
 /** Index entries embedded and upserted per round trip. */
 const INDEX_BATCH_SIZE = 256;
+const SUBMIT_PROFILE_TOOL_ID = "submit_profile";
+/** What one call of `submit_profile` tells the agent. */
+const SubmitOutcomeSchema = z.discriminatedUnion("status", [
+    z.object({ status: z.literal("needs_repair"), detail: z.string() }),
+    z.object({
+        status: z.literal("accepted"),
+        groups: z.number(),
+        keptFiles: z.number(),
+        unclassifiedFiles: z.number(),
+        unresolvedOperations: z.number(),
+    }),
+]);
+/** The submissions of a run, in call order, with the outcome that the tool gave each one. */
+function profileSubmissions(steps) {
+    const submissions = [];
+    for (const step of steps) {
+        for (const call of step.calls) {
+            if (call.toolName !== SUBMIT_PROFILE_TOOL_ID || call.output?.outcome !== "ok")
+                continue;
+            const submission = recordedInputOf(ProfileSubmissionSchema, call.input);
+            const outcome = SubmitOutcomeSchema.safeParse(call.output.value);
+            if (submission === undefined || !outcome.success)
+                continue;
+            submissions.push({ submission, accepted: outcome.data.status === "accepted" });
+        }
+    }
+    return submissions;
+}
 /**
- * Submissions the tool accepts: the first, plus one repair.
- *
- * The repair is a FULL resubmit — the agent replaces the whole operation list and nothing
- * is merged into the prior attempt. Past it the resolution stands as it resolved: an
- * operation that still does not resolve produces no group, and its members land in the
- * visible `unclassified` group rather than blocking a profile that gates planning.
+ * The submission that the profile records: the last accepted one, else the last one. A repair is a FULL
+ * resubmit — nothing merges into the prior attempt. The last submission of a run with no accepted one
+ * resolves as final: an operation that still does not resolve produces no group, and its members land in
+ * the visible `unclassified` group rather than blocking a profile that gates planning.
  */
-const MAX_SUBMIT_ROUNDS = 2;
+function selectedSubmission(steps) {
+    const submissions = profileSubmissions(steps);
+    const chosen = submissions.filter((entry) => entry.accepted).at(-1) ?? submissions.at(-1);
+    return chosen === undefined ? undefined : { ...chosen, count: submissions.length };
+}
 /** Where the embedder stages this analysis's inputs (see the data-profile-init spec). */
 const STAGED_INPUT_ROOT = "data/inputs";
 /** Build the canonical artifact path for a staged input file. */
@@ -141,7 +178,7 @@ async function readSetHeaders(args) {
         });
     }
     catch (err) {
-        if (err instanceof DBOSErrors.DBOSWorkflowCancelledError)
+        if (isWorkflowCancellation(err))
             throw err;
         logger.warn("input-scan header readout failed (non-fatal)", logger.errorFields(err));
         return new Map();
@@ -250,7 +287,7 @@ function logProfileMonitoring(logger, args) {
 }
 /**
  * Register the data-profile workflow with DBOS. Returns the registered
- * callable so `triggerDataProfile` can dispatch via `DBOS.startWorkflow`.
+ * callable so `triggerDataProfile` can dispatch it through the run launcher.
  */
 /**
  * Project the workflow deps onto the profiler agent bag. The farm-extension
@@ -266,11 +303,11 @@ export function profilerSandboxAgentDeps(deps, step) {
         embedding: deps.embedding,
         model: deps.model,
         skillsDir: deps.skillsDir,
-        ...(deps.farmLockFile ? { farmLockFile: deps.farmLockFile } : {}),
-        ...(deps.imagePackagesFile ? { imagePackagesFile: deps.imagePackagesFile } : {}),
-        ...(deps.refStorePath ? { refStorePath: deps.refStorePath } : {}),
-        ...(deps.extendAnalysisFarm ? { extendAnalysisFarm: deps.extendAnalysisFarm } : {}),
-        ...(deps.toolOutputStore ? { toolOutputStore: deps.toolOutputStore } : {}),
+        farmLockFile: deps.farmLockFile,
+        imagePackagesFile: deps.imagePackagesFile,
+        refStorePath: deps.refStorePath,
+        extendAnalysisFarm: deps.extendAnalysisFarm,
+        toolOutputStore: deps.toolOutputStore,
         bioKeys: deps.bioKeys,
         step,
     };
@@ -285,26 +322,8 @@ export function registerDataProfileWorkflow(deps) {
  */
 export async function runDataProfileBody(input, deps) {
     const logger = (deps.logger ?? createNoopLogger()).named("data-profile").with({ analysisId: input.analysisId });
-    // Ownership defaults to true for inputs persisted before the field existed
-    // (a #247 workflow recovered across this deploy): those were always
-    // Cortex-owned and must be revoked here.
-    const { analysisId, runSession, ownsMandate = true, stagedInputs } = input; // oss-core-managed-ok
-    const authorization = { runSession, ownsMandate }; // oss-core-managed-ok
-    const revoke = (reason) => deliverNotice(logger, "RunAuthorizer.revoke", deps.runAuthorizer.revoke(authorization, reason));
-    let selfCancelled = false;
-    // A suspension fails the row with the reason of the host, because the profile
-    // ledger has no suspended state and the retry path takes a `failed` row again.
-    const suspendProfile = async (suspension) => {
-        logger.warn("profile suspended", { reason: suspension.reason });
-        await settleTerminalWrite(logger, analysisId, unwrapOrThrow(await failDataProfile(deps.pool, analysisId, suspension.reason)), "failed", deps.notifyDataProfileSettled);
-        await revoke("data-profile-suspended");
-        unwrapOrThrow(await suspendAnalysis(deps.pool, analysisId));
-        await activity.failed(suspension.reason);
-        if (DBOS.workflowID === undefined)
-            return;
-        selfCancelled = true;
-        await cancelSelf("self-cancel-suspended");
-    };
+    const { analysisId, runSession, stagedInputs } = input;
+    const revoke = (reason) => deliverNotice(logger, "RunAuthorizer.revoke", deps.runAuthorizer.revoke(runSession, reason));
     // The profile's activity channel. The write to the stream is bound here, while every phase and
     // phrase lives in the emitter — the phrases are the observable contract of
     // this capability, and a body that composed its own strings is a body they can drift from.
@@ -355,6 +374,17 @@ export async function runDataProfileBody(input, deps) {
         }))));
         const executionId = generateExecutionId(DATA_PROFILE_AGENT_ID);
         const workflowId = DBOS.workflowID ?? `${DATA_PROFILE_RUN_LITERAL}:${executionId}`;
+        // The profile waits in place, with its row `running`: the profile pauses, and it does not fail.
+        const pause = workPause({
+            pool: deps.pool,
+            workId: workflowId,
+            workKind: "profile",
+            analysisId,
+            emit: (part) => DBOS.writeStream("events", part),
+            retryDelaysMs: deps.pauseRetryDelaysMs,
+            run: { session: runSession, authorizer: deps.runAuthorizer },
+            logger,
+        });
         const childSession = forSubAgent(runSession, DATA_PROFILE_AGENT_ID);
         // A resolver rejection fails the workflow loudly (workspace-root-resolution
         // contract) — profiling an analysis whose root cannot be resolved is
@@ -428,9 +458,16 @@ export async function runDataProfileBody(input, deps) {
         // from the agent loop would leave the longest wait of all unreported — the same defect the
         // run panel's activity readout was built to remove.
         await activity.sandboxInit();
-        const spawned = keepSuspendingRefusal(await deps.sandboxClient.createSandbox(forStep(runSession, DATA_PROFILE_STEP_LITERAL), { childWorkflowId: workflowId, resources: estimateDataProfileResources(stagedInputs) }, mintSandboxIdentity(DATA_PROFILE_RUN_LITERAL)));
-        if (spawned.isErr())
-            return await suspendProfile(suspensionOfSpawnRefusal(spawned.error));
+        const spawn = async () => keepSuspendingRefusal(await deps.sandboxClient.createSandbox(forStep(runSession, DATA_PROFILE_STEP_LITERAL), { childWorkflowId: workflowId, resources: estimateDataProfileResources(stagedInputs) }, mintSandboxIdentity(DATA_PROFILE_RUN_LITERAL)));
+        let spawned = await spawn();
+        // A refusal of the label gate with the suspend flag waits in a pause, and the spawn runs again after the
+        // resume. A body that runs outside a workflow cannot wait, thus the refusal fails the profile there.
+        while (spawned.isErr()) {
+            const waited = await pause.forCause({ kind: "host", reason: spawned.error.reason }, 0);
+            if (waited === undefined)
+                throw new SandboxFailure(spawned.error);
+            spawned = await spawn();
+        }
         const sandbox = spawned.value;
         try {
             // Checkpointed clock, not `Date.now()`: one deadline bounds every exec of the
@@ -483,34 +520,26 @@ export async function runDataProfileBody(input, deps) {
                 allowedWritePrefix: profileWritePrefix,
                 deadlineMs: () => deadlineAbs,
             });
-            let accepted = null;
-            let rounds = 0;
             const submitProfileTool = defineTool({
-                id: "submit_profile",
-                description: "Submit the profiling results. Call this tool once after completing all profiling work — it resolves your " +
-                    "operations against the scan, computes every group's membership and counts, and records the profile. " +
-                    "A submission whose operations do not resolve, or that leaves kept files unclaimed, comes back once with " +
-                    "the errors; the repair is a FULL resubmit of the whole operation list.",
+                id: SUBMIT_PROFILE_TOOL_ID,
+                description: "Submit the profiling results. Call this tool after completing all profiling work — it resolves your " +
+                    "operations against the scan, computes every group's membership and counts, and checks the profile. " +
+                    "A submission whose operations do not resolve, or that leaves kept files unclaimed, comes back with " +
+                    "the errors; the repair is a FULL resubmit of the whole operation list. The last accepted submission is the profile.",
                 inputSchema: ProfileSubmissionSchema,
                 describeCall: "none",
-                execute: async (input) => {
-                    rounds++;
-                    // The last round resolves as final: nothing that follows can repair an
-                    // overlap, so a contested file sweeps rather than being awarded to whichever
-                    // operation the agent happened to write first.
-                    const finalRound = rounds >= MAX_SUBMIT_ROUNDS;
-                    const resolution = resolveProfileSubmission(input, detected, briefingMenu, { finalRound });
-                    if (!finalRound && (resolution.errors.length > 0 || resolution.unclaimed.length > 0)) {
-                        return ok({ status: "needs_repair", detail: formatResolutionErrors(resolution) });
+                execute: (input) => {
+                    const resolution = resolveProfileSubmission(input, detected, briefingMenu, { finalRound: false });
+                    if (resolution.errors.length > 0 || resolution.unclaimed.length > 0) {
+                        return Promise.resolve(ok({ status: "needs_repair", detail: formatResolutionErrors(resolution) }));
                     }
-                    accepted = { submission: input, resolution };
-                    return ok({
+                    return Promise.resolve(ok({
                         status: "accepted",
                         groups: resolution.groups.length,
                         keptFiles: resolution.partition.keptFiles,
                         unclassifiedFiles: resolution.partition.unclassifiedFiles,
                         unresolvedOperations: resolution.errors.length,
-                    });
+                    }));
                 },
             });
             const baseAgent = createDataProfilerAgent(sandboxAgentDeps);
@@ -523,37 +552,39 @@ export async function runDataProfileBody(input, deps) {
             // otherwise still read as `Starting sandbox` long after the container was up. The run
             // path's `Running ${agentId}` serves the same purpose at the same point.
             await activity.agentStarting();
-            await runToTerminal(agentDef, [{ role: "user", content: prompt }], childSession, {
+            const run = await runWithSalvage(agentDef, [{ role: "user", content: prompt }], childSession, {
                 provider: deps.provider,
                 signal,
                 // Every tool call the profiler makes becomes live activity. Only `tool-started`
                 // is forwarded: the loop's other events (iteration boundaries, model deltas,
                 // tool completions) describe machinery rather than work, and the panel this
                 // feeds carries a single line whose value is that it always names what is
-                // happening now. Awaited in body order, because `DBOS.writeStream` allocates a
-                // function id and an unawaited write would race the next operation for the
-                // counter and desynchronise the recorded sequence on replay.
+                // happening now. The events of a tool call arrive from inside its step.
                 emit: async (event) => {
                     if (event.type === "tool-started")
-                        await activity.forTool(event.name, event.input, resolveDetail);
+                        await activity.forTool(event.toolUseId, event.name, event.input, resolveDetail);
                 },
-                runStep: durableStep,
-                resolved: () => accepted !== null,
                 invocationId: workflowId,
                 usageRecorder: deps.usageRecorder,
                 toolOutputStore: deps.toolOutputStore,
-                isFatalLoopError: (err) => err instanceof DBOSErrors.DBOSWorkflowCancelledError,
+                pause: pause.afterFailure,
             }, {
-                tools: [submitProfileTool],
-                nudge: "You stopped without calling submit_profile, so no profile was " +
+                tools: [SUBMIT_PROFILE_TOOL_ID],
+                nudge: "You stopped without an accepted submit_profile, so no profile was " +
                     "recorded. Call submit_profile now with your operations on the menu, " +
                     "what each resulting group means, and the dimensions you saw with " +
                     "their observations — base it on the scan and the work you already did.",
+                hasOutcome: (steps) => profileSubmissions(steps).some((entry) => entry.accepted),
             });
-            if (!accepted) {
+            const selected = selectedSubmission(run.steps);
+            if (selected === undefined) {
                 throw new Error("Data profiling failed: agent did not call submit_profile");
             }
-            const { submission, resolution } = accepted;
+            const { submission } = selected;
+            // A submission that no call accepted resolves as final: nothing that follows can repair an
+            // overlap, so a contested file sweeps rather than being awarded to whichever operation the
+            // agent happened to write first. The resolution is pure, thus it gives the answer of the call.
+            const resolution = resolveProfileSubmission(submission, detected, briefingMenu, { finalRound: !selected.accepted });
             // 5. Index into vector store — one entry per group, one per dimension, one per annotated member.
             //
             // Reported as `indexing`, not `persisting`: the contract defines `persisting` as step
@@ -566,7 +597,7 @@ export async function runDataProfileBody(input, deps) {
                 resolution,
                 dimensions: resolution.dimensions,
                 probes: resolution.probes,
-                repairRounds: rounds - 1,
+                repairRounds: selected.count - 1,
                 absorb: absorb.kind,
             });
             // 6. Complete — store the FULL profiler finding plus the input signature for
@@ -591,11 +622,12 @@ export async function runDataProfileBody(input, deps) {
         }
     }
     catch (err) {
-        if (selfCancelled || err instanceof DBOSErrors.DBOSWorkflowCancelledError)
+        if (isWorkflowCancellation(err)) {
+            // `stopDataProfile` writes the row, but only the body holds the run session.
+            await revoke("data-profile-stopped");
             throw err;
-        const suspension = suspensionOfFailure(err);
-        if (suspension !== undefined)
-            return await suspendProfile(suspension);
+        }
+        // A failure with a cause of a pause waited in the loop, thus this one fails the profile.
         logger.error("profile failed", logger.errorFields(err));
         const reason = profileFailureReason(err);
         await settleTerminalWrite(logger, analysisId, unwrapOrThrow(await failDataProfile(deps.pool, analysisId, reason)), "failed", deps.notifyDataProfileSettled);
@@ -646,9 +678,8 @@ export function describeDataProfileStartError(e) {
 }
 /**
  * Resolve the `RunSession` the workflow runs under. Whether the authorization
- * is freshly minted (Cortex-owned) or reused (caller-owned) is decided by the
- * `RunAuthorizer` seam from the opaque auth; this passes that auth straight
- * through and never inspects it.
+ * is freshly minted or reused is decided by the `RunAuthorizer` seam from the
+ * opaque auth; this passes that auth straight through and never inspects it.
  */
 export function authorizeDataProfile(deps, params) {
     const { auth, analysisId } = params;
@@ -681,15 +712,11 @@ export function dataProfileWorkflowId(analysisId, nonce) {
  * supplied the manifest in `params.stagedInputs`; this forwards it into the
  * workflow input. The handle result is not awaited.
  */
-async function startDataProfileWorkflow(deps, params, authorization) {
-    const { runSession, ownsMandate } = authorization; // oss-core-managed-ok
+async function startDataProfileWorkflow(deps, params, runSession) {
     const attemptNonce = randomUUID();
-    await DBOS.startWorkflow(deps.workflow, {
-        workflowID: dataProfileWorkflowId(params.analysisId, attemptNonce),
-    })({
+    await deps.runLauncher.launch(deps.workflow, { workflowId: dataProfileWorkflowId(params.analysisId, attemptNonce) }, {
         analysisId: params.analysisId,
         runSession,
-        ownsMandate, // oss-core-managed-ok
         stagedInputs: params.stagedInputs,
     });
 }
@@ -827,12 +854,8 @@ async function compensateStartFailure(deps, analysisId, phase, cause) {
 async function refuseClaimedProfile(deps, analysisId, phase, refusal) {
     const logger = (deps.logger ?? createNoopLogger()).named("data-profile").with({ analysisId });
     logger.error("the profile was not authorized", { phase, reason: refusal.reason, suspend: refusal.kind === "suspended" });
+    // No work exists yet, thus a refusal with the suspend flag fails the row the same as each other refusal.
     await failClaimedProfile(deps, analysisId, phase, refusal.reason);
-    if (suspensionOfRefusal(refusal) === undefined)
-        return;
-    const marked = await suspendAnalysis(deps.pool, analysisId);
-    if (marked.isErr())
-        logger.error("the analysis was not marked as suspended", { phase, err: marked.error });
 }
 async function failClaimedProfile(deps, analysisId, phase, reason) {
     const logger = (deps.logger ?? createNoopLogger()).named("data-profile").with({ analysisId });
@@ -863,6 +886,26 @@ async function failClaimedProfile(deps, analysisId, phase, reason) {
 export function runDataProfile(deps, params) {
     return new ResultAsync(dispatchClaimedProfile(deps, params, "Retry"));
 }
+/** The ledger error of a profile that a stop ended. A client shows it, and a retry can follow it. */
+export const DATA_PROFILE_STOPPED = "Data profiling was stopped";
+/**
+ * Stop the profile workflow of an analysis, and fail its row. The body passes a cancel through its failure path,
+ * thus the row, the rows of its pauses, and the settled notice converge here. The revoke of the mandate and the
+ * teardown of the sandbox stay in the body, which runs them on its way out. The `running` guard of the row write keeps a profile that settled first.
+ */
+export async function stopDataProfile(deps, analysisId, workflowId) {
+    const logger = (deps.logger ?? createNoopLogger()).named("data-profile").with({ analysisId });
+    await DBOS.cancelWorkflow(workflowId);
+    const cleared = await clearPausesOfWork(deps.pool, workflowId);
+    if (cleared.isErr())
+        logger.warn("the pauses of a stopped profile did not clear", { op: cleared.error.op });
+    const failed = await failDataProfile(deps.pool, analysisId, DATA_PROFILE_STOPPED);
+    if (failed.isErr()) {
+        logger.error("the row of a stopped profile did not fail", { op: failed.error.op });
+        return;
+    }
+    await settleTerminalWrite(logger, analysisId, failed.value, "failed", deps.notifyDataProfileSettled);
+}
 /**
  * Concise, UI-safe failure reason. `data_profile_error` is surfaced verbatim
  * to the frontend, so raw errors — K8s API response bodies, multi-line stack
@@ -871,7 +914,7 @@ export function runDataProfile(deps, params) {
  */
 const PROFILE_ERROR_MAX_LEN = 200;
 function profileFailureReason(err) {
-    const raw = err instanceof Error ? err.message : String(err);
-    const firstLine = raw.split("\n", 1)[0].replace(/\s+/g, " ").trim();
+    const raw = errorMessageOf(err) ?? textOf(err);
+    const firstLine = collapseWhitespace(presentFirst(raw.split("\n", 1), "the first line of the error"));
     return firstLine.length > PROFILE_ERROR_MAX_LEN ? firstLine.slice(0, PROFILE_ERROR_MAX_LEN - 1) + "…" : firstLine || "Data profiling failed";
 }

package/dist/tasks/extract-values.d.ts

@@ -1,52 +1,36 @@
 /**
- * The extraction workflow on the profile rails, and the `ExtractionArm` realization over it.
+ * The extraction pass on the profile rails, and the `ExtractionArm` realization over it.
  *
  * The report resolver falls through to this arm for an over-cap file or a host parse fault. The arm runs one
  * fixed extraction script in an ephemeral sandbox, and it gives back the rows that the script read. No agent
  * loop runs anywhere in this path. A file whose extension names no tabular format never arrives here,
  * because the host decides the format and it refuses the file before the fall-through.
  *
- * The shape matches the data profile (`src/tasks/data-profile.ts`). The authorization mints at the async
- * edge (`triggerExtractValues`) and rides in the workflow input. The body never mints, and it revokes the
- * authorization on every terminal path. The container is ephemeral, and it goes away with the work, thus no
- * standing machine exists.
+ * The pass runs inside the step of the tool call that resolves the report (`sandbox/step-sandbox.ts`), under
+ * the auth of that call, and it mints no mandate. One call can run more than one pass, thus the exec of each
+ * pass takes the key of the step and a hash of its requests. The container is ephemeral, and it goes away
+ * with the work, thus no standing machine exists.
  */
-import { type Result } from "neverthrow";
-import { type AuthContext, type RunSession } from "../auth/types.js";
-import type { RunAuthorizer } from "../execution/run-authorizer.js";
+import type { Result } from "neverthrow";
+import type { AuthContext, Identity } from "../auth/types.js";
 import type { Logger } from "../lib/logger.js";
 import type { ExtractionArm, ExtractionArtifact, ExtractionRequest } from "../report-model/production-resolver.js";
 import type { SandboxClient } from "../sandbox/client.js";
-import { type Suspension } from "../workflows/suspension.js";
+import type { SuspendingRefusal } from "../sandbox/sandbox-error.js";
 import type { ExecRequest, ExecResult } from "../sandbox/types.js";
 import { type ExtractValuesResult } from "./extract-values-script.js";
-export type { ExtractValuesResult } from "./extract-values-script.js";
-/**
- * The body's construction-time deps, closed over at registration. The extraction pass shares the profile's
- * sandbox and authorization rails, thus it draws the same three seams and nothing else.
- */
-export interface ExtractValuesDeps {
+/** The construction deps of the pass. It shares the sandbox rail of the profile. */
+export type ExtractionDeps = {
+    readonly sandboxClient: SandboxClient;
     /** Operational logging seam. An absent logger falls back to a no-op. */
     readonly logger?: Logger;
-    readonly sandboxClient: SandboxClient;
-    readonly runAuthorizer: RunAuthorizer;
-}
-/**
- * The workflow input. It is JSON-serializable, thus DBOS persists it as the workflow's input row. The
- * `RunSession` carries the run authorization. The body reads it and never mints.
- */
-export interface ExtractValuesWorkflowInput {
+};
+/** The caller of one pass: the analysis that it reads, and the identity and the auth of the tool call. */
+export type ExtractionCaller = {
     readonly analysisId: string;
-    readonly runSession: RunSession;
-    /** The fall-through artifacts of one document pass. One submission covers every request. */
-    readonly requests: readonly ExtractionRequest[];
-    /**
-     * True when this workflow owns the run-authorization lifecycle, thus the body revokes on every terminal
-     * path. An input persisted before this field existed reads as absent, and the body defaults it to true,
-     * which matches the prior owned behavior.
-     */
-    readonly ownsMandate?: boolean;
-}
+    readonly identity: Identity;
+    readonly auth: AuthContext;
+};
 /**
  * Build the sandbox exec for one extraction pass. The command runs the fixed script through `python3 -c`.
  * The working directory is the analysis mount, thus a relative request path reads the correct file. The
@@ -65,56 +49,18 @@ export declare function buildExtractionExec(analysisId: string, requests: readon
  * Parse the script output from the exec result. A synthetic failure, a timeout, and a non-zero exit each
  * throw, because each means the script did not emit its map. A stdout that is not the map shape throws too.
  *
- * The function is pure, thus a test asserts the parse without a sandbox. The throw crosses the workflow
- * boundary, and the arm turns it into a rejected promise.
+ * The function is pure, thus a test asserts the parse without a sandbox. The arm turns the throw into a
+ * rejected promise.
  */
 export declare function parseExtractionOutput(result: ExecResult): ExtractValuesResult;
 /**
- * The body, extracted so a test drives it without a registered workflow. It creates the ephemeral
- * container, submits one exec, awaits the result durably, and gives the value map back. It revokes the run
- * authorization on every terminal path, and it tears the container down on both paths.
+ * Run one extraction pass: make the container, run the script on every request, and remove the container.
  *
- * A chat turn awaits this workflow, thus a suspension is the `err` of the result, and the workflow does not
- * cancel (workflow-suspension spec). The body does not mark the analysis: the caller reports the suspension.
+ * A suspending refusal of the spawn is the `err`, and the caller reports it. Each other fault throws.
  */
-export declare function runExtractValuesBody(input: ExtractValuesWorkflowInput, deps: ExtractValuesDeps): Promise<Result<ExtractValuesResult, Suspension>>;
-/**
- * Register the extraction workflow with DBOS. It gives back the registered callable, thus a trigger
- * dispatches with `DBOS.startWorkflow`.
- */
-export declare function registerExtractValuesWorkflow(deps: ExtractValuesDeps): (input: ExtractValuesWorkflowInput) => Promise<Result<ExtractValuesResult, Suspension>>;
-/** The per-attempt workflow id. A fresh nonce keeps each pass under a distinct id. */
-export declare function extractValuesWorkflowId(analysisId: string, nonce: string): string;
-/**
- * The route-side deps for the trigger: the run authorizer, and the registered workflow callable. The body's
- * construction-time deps are closed over at registration, thus the trigger never holds them.
- */
-export interface ExtractValuesTriggerDeps {
-    readonly runAuthorizer: RunAuthorizer;
-    readonly workflow: (input: ExtractValuesWorkflowInput) => Promise<Result<ExtractValuesResult, Suspension>>;
-}
-/** The identity and the requests for one extraction pass. */
-export interface ExtractValuesTriggerParams {
-    readonly auth: AuthContext;
-    readonly analysisId: string;
-    readonly requests: readonly ExtractionRequest[];
-}
-/**
- * The async edge. It authorizes through the `RunAuthorizer`, starts the workflow, and awaits the outcome.
- * The body owns the revoke, thus the trigger holds no lifecycle. A workflow fault and a refused
- * authorization reject the returned promise. A suspension is the `err` of the result: of the workflow, or of
- * an authorization that the host refused with the suspend flag.
- */
-export declare function triggerExtractValues(deps: ExtractValuesTriggerDeps, params: ExtractValuesTriggerParams): Promise<Result<ExtractValuesResult, Suspension>>;
-/** Runs one extraction pass for the bound analysis, and gives the raw value map back, or the suspension. */
-export type ExtractionRunner = (requests: readonly ExtractionRequest[]) => Promise<Result<ExtractValuesResult, Suspension>>;
-/**
- * Bind the trigger to one analysis and one auth context. The result runs one pass with every request in it.
- */
-export declare function bindExtractionTrigger(deps: ExtractValuesTriggerDeps, binding: {
-    readonly auth: AuthContext;
-    readonly analysisId: string;
-}): ExtractionRunner;
+export declare function runExtraction(deps: ExtractionDeps, caller: ExtractionCaller, requests: readonly ExtractionRequest[]): Promise<Result<ExtractValuesResult, SuspendingRefusal>>;
+/** Runs one extraction pass for the bound analysis, and gives the raw value map back, or the refusal of its sandbox. */
+export type ExtractionRunner = (requests: readonly ExtractionRequest[]) => Promise<Result<ExtractValuesResult, SuspendingRefusal>>;
 /**
  * Turn the raw script output into the arm result. A path with rows enters the map. A path with an error
  * drops out, thus the reference at that path reads as an unread artifact, which the seam contract expects.
@@ -125,6 +71,7 @@ export declare function extractionArtifactsFromResult(result: ExtractValuesResul
 /**
  * Make the extraction arm over a runner. One `extract` call makes one run with every request in it, and it
  * gives the value map. A run fault rejects the promise, and the resolver turns the rejection into a failed
- * reference. A suspension is the `err`, and the resolver reports its reason on each reference.
+ * reference. A refusal of the sandbox with the suspend flag is the `err`, and the resolver reports its reason on each
+ * reference.
  */
 export declare function createExtractionArm(run: ExtractionRunner): ExtractionArm;