@inflexa-ai/harness 0.7.1 → 0.7.2

package/dist/contracts/chat-parts.d.ts

@@ -105,8 +105,10 @@ export interface RunStartedPart {
     stepCount: number;
 }
 /** `"pending"` = waiting on dependencies; `"queued"` = dependencies satisfied,
- *  held until in-flight steps free machine-budget capacity. */
-export type StepStatus = "pending" | "queued" | "running" | "completed" | "failed";
+ *  held until in-flight steps free machine-budget capacity; `"skipped"` =
+ *  unreachable — an upstream dependency failed or blocked, so the step can
+ *  never be dispatched. */
+export type StepStatus = "pending" | "queued" | "running" | "completed" | "failed" | "skipped";
 export interface DagStepState {
     id: string;
     name: string;

package/dist/contracts/schemas/chat-parts.d.ts

@@ -135,6 +135,8 @@ export declare const StepStatusSchema: z.ZodEnum<{
     running: "running";
     completed: "completed";
     failed: "failed";
+    skipped: "skipped";
+    queued: "queued";
 }>;
 export declare const DagStepStateSchema: z.ZodObject<{
     id: z.ZodString;
@@ -145,6 +147,8 @@ export declare const DagStepStateSchema: z.ZodObject<{
         running: "running";
         completed: "completed";
         failed: "failed";
+        skipped: "skipped";
+        queued: "queued";
     }>;
     level: z.ZodNumber;
     dependsOn: z.ZodArray<z.ZodString>;
@@ -166,6 +170,8 @@ export declare const DagStatePartSchema: z.ZodObject<{
             running: "running";
             completed: "completed";
             failed: "failed";
+            skipped: "skipped";
+            queued: "queued";
         }>;
         level: z.ZodNumber;
         dependsOn: z.ZodArray<z.ZodString>;
@@ -530,6 +536,8 @@ export declare const CortexChatPartSchema: z.ZodDiscriminatedUnion<[z.ZodObject<
             running: "running";
             completed: "completed";
             failed: "failed";
+            skipped: "skipped";
+            queued: "queued";
         }>;
         level: z.ZodNumber;
         dependsOn: z.ZodArray<z.ZodString>;

package/dist/contracts/schemas/chat-parts.js

@@ -96,7 +96,7 @@ export const RunStartedPartSchema = z.object({
     stepCount: z.number(),
 });
 // ── DAG State ───────────────────────────────────────────────────────
-export const StepStatusSchema = z.enum(["pending", "running", "completed", "failed"]);
+export const StepStatusSchema = z.enum(["pending", "queued", "running", "completed", "failed", "skipped"]);
 export const DagStepStateSchema = z
     .object({
     id: z.string(),

package/dist/provenance/collector.d.ts

@@ -39,6 +39,25 @@ export interface InputClassificationContext {
     stepId?: string;
     runId?: string;
 }
+/**
+ * The outcome of classifying one read: an input edge the step may assert, or
+ * an explicit refusal naming the producing step it would have pointed at.
+ *
+ * A refusal is a value rather than a thrown error or a `data` classification.
+ * Throwing would fail an exec over bookkeeping, and reclassifying as `data`
+ * would launder a sibling's scratch file into an attestable analysis-level
+ * input — a different fabrication, not a fix. The scraped ids ride along
+ * because they are the only thing that makes a drop attributable to a
+ * producing step in a log record.
+ */
+export type ReadClassification = {
+    readonly admissible: true;
+    readonly context: InputClassificationContext;
+} | {
+    readonly admissible: false;
+    readonly refRunId: string;
+    readonly refStepId: string;
+};
 /**
  * Build classification context for a file read using known step metadata.
  *
@@ -50,7 +69,7 @@ export interface InputClassificationContext {
  * any dependsOn entry), this falls back to path extraction — see the
  * prior-run branch below for why.
  */
-export declare function classifyReadPath(relativePath: string, ownStepId: string, ownRunId: string, dependsOn?: string[]): InputClassificationContext;
+export declare function classifyReadPath(relativePath: string, ownStepId: string, ownRunId: string, dependsOn?: string[]): ReadClassification;
 export interface ProvenanceCollectorOptions {
     stepId: string;
     runId: string;
@@ -75,12 +94,26 @@ export declare class ProvenanceCollector {
     private readonly fileToolRecords;
     /** Command execution records, keyed by output path (relative to /artifacts). */
     private readonly commandRecords;
+    /** Refused read paths already narrated, so the same edge is reported once per step. */
+    private readonly narratedRefusals;
     constructor(opts: ProvenanceCollectorOptions);
     /**
      * Set the input file ID map (passed by reference from the data-mount filesystem).
      * Called after construction when the data mount filesystem is available.
      */
     setInputFileIdMap(map: Map<string, string>): void;
+    /**
+     * Claim the right to narrate a refused read, true only the first time this
+     * step sees the path.
+     *
+     * A refusal reports one fact — a lineage edge that will not exist — and the
+     * fact does not change when the same file is read again. Reads dedup within
+     * one frame but not across them, and a step issues many execs against a tree
+     * whose watch set spans the whole analysis, so an undeduped narration is a
+     * steady stream rather than an exception. The signal exists to be noticed;
+     * emitting it at that volume is what teaches a reader to filter it away.
+     */
+    claimRefusalNarration(relativePath: string): boolean;
     /**
      * Track a file read from a read-only mount.
      * Called by sandbox exec provenance frame processing.
@@ -92,8 +125,12 @@ export declare class ProvenanceCollector {
      * @param hash - SHA-256 hash of the file content, or null if file no longer exists
      * @param context - Explicit classification context from the caller. When provided,
      *   the collector uses it directly instead of classifying from the path.
+     * @returns the tracked ref, or `null` when the caller supplied no context and the
+     *   path classifies as inadmissible — an undeclared same-run sibling, which must
+     *   not become an attestation target.
      */
-    trackInputAccess(mountPath: string, relativePath: string, hash: string | null, context?: InputClassificationContext): InputRef;
+    trackInputAccess(mountPath: string, relativePath: string, hash: string | null, context: InputClassificationContext): InputRef;
+    trackInputAccess(mountPath: string, relativePath: string, hash: string | null): InputRef | null;
     /**
      * Record a file tool write (write_file, edit_file).
      * Called after the data-mount filesystem records the artifact.

package/dist/provenance/collector.js

@@ -42,32 +42,45 @@ function inferScriptPath(command, args) {
  */
 export function classifyReadPath(relativePath, ownStepId, ownRunId, dependsOn) {
     if (relativePath.startsWith("data/") || relativePath.startsWith("dataprofile/")) {
-        return { source: "data" };
+        return { admissible: true, context: { source: "data" } };
     }
-    // Own artifacts: runs/{ownRunId}/{ownStepId}/...
-    const ownPrefix = `runs/${ownRunId}/${ownStepId}/`;
-    if (relativePath.startsWith(ownPrefix)) {
-        return { source: "artifacts", stepId: ownStepId, runId: ownRunId };
-    }
-    // Upstream dependencies: runs/{ownRunId}/{depStepId}/...
-    if (dependsOn) {
-        for (const depStepId of dependsOn) {
-            const upstreamPrefix = `runs/${ownRunId}/${depStepId}/`;
-            if (relativePath.startsWith(upstreamPrefix)) {
-                return { source: "upstream", stepId: depStepId, runId: ownRunId };
-            }
-        }
-    }
-    // Same-run sibling step. dependsOn only drives topo-sort ordering, not
-    // read authorization, so a read outside dependsOn is still a valid
-    // upstream input — just extract the stepId from the path.
+    // Everything under this run resolves off ONE segment — the first one after
+    // the run id, which names the step owning that subtree. It is read once and
+    // compared, rather than each case prefix-matching `runs/{runId}/{id}/`
+    // independently, because a trailing separator is not guaranteed to be
+    // present: an `opendir` of a step directory surfaces the bare name. Under
+    // per-case prefixes every such directory read misses its own case and lands
+    // on the refusal below — a step refusing an edge to itself, or to a
+    // dependency it did declare.
     const ownRunPrefix = `runs/${ownRunId}/`;
     if (relativePath.startsWith(ownRunPrefix)) {
         const afterRun = relativePath.slice(ownRunPrefix.length);
         const slashIdx = afterRun.indexOf("/");
-        const stepId = slashIdx > 0 ? afterRun.slice(0, slashIdx) : afterRun;
-        if (stepId) {
-            return { source: "upstream", stepId, runId: ownRunId };
+        const head = slashIdx >= 0 ? afterRun.slice(0, slashIdx) : afterRun;
+        if (head === ownStepId) {
+            return { admissible: true, context: { source: "artifacts", stepId: ownStepId, runId: ownRunId } };
+        }
+        if (dependsOn?.includes(head)) {
+            return { admissible: true, context: { source: "upstream", stepId: head, runId: ownRunId } };
+        }
+        // A same-run step this one never declared. It carries no ordering
+        // guarantee relative to this step: its directory is mounted read-write in
+        // its own container and may be mid-write, or hold a scratch file deleted
+        // before this step reconciles, so nothing observed there is a stable
+        // artifact this step can be said to have consumed. Declaration is the
+        // available proof of stability — the scheduler admits a step only once
+        // every declared dependency has completed, and a completed step never
+        // writes into its tree again. An absent `dependsOn` therefore refuses
+        // every sibling: absence of the declaration is not evidence of stability.
+        //
+        // `head` is the refusal's diagnostic attribution only; unlike the
+        // prior-run branch below it feeds no classification. It is a step id for
+        // any path that descends into a subtree, and a best guess for a bare
+        // name, which the run directory also admits for its own run-scoped files
+        // (`runs/{runId}/synthesis.json`) — indistinguishable from a step
+        // directory by path alone, and refused either way.
+        if (head) {
+            return { admissible: false, refRunId: ownRunId, refStepId: head };
         }
     }
     // Prior-run fallback: a read under `runs/{otherRunId}/...` that is neither
@@ -80,10 +93,10 @@ export function classifyReadPath(relativePath, ownStepId, ownRunId, dependsOn) {
         const priorRunId = parts[1];
         const priorStepId = parts[2];
         if (priorRunId && priorStepId) {
-            return { source: "prior", stepId: priorStepId, runId: priorRunId };
+            return { admissible: true, context: { source: "prior", stepId: priorStepId, runId: priorRunId } };
         }
     }
-    return { source: "data" };
+    return { admissible: true, context: { source: "data" } };
 }
 export class ProvenanceCollector {
     stepId;
@@ -103,6 +116,8 @@ export class ProvenanceCollector {
     fileToolRecords = new Map();
     /** Command execution records, keyed by output path (relative to /artifacts). */
     commandRecords = new Map();
+    /** Refused read paths already narrated, so the same edge is reported once per step. */
+    narratedRefusals = new Set();
     constructor(opts) {
         this.stepId = opts.stepId;
         this.runId = opts.runId;
@@ -117,24 +132,38 @@ export class ProvenanceCollector {
         this.inputFileIdMap = map;
     }
     /**
-     * Track a file read from a read-only mount.
-     * Called by sandbox exec provenance frame processing.
+     * Claim the right to narrate a refused read, true only the first time this
+     * step sees the path.
      *
-     * @param mountPath - The workspace mount path (e.g., "/a1/data" or "/a1" for single-mount)
-     * @param relativePath - Path relative to the mount root; or, for a frame
-     *   report naming somewhere outside the mount, the verbatim absolute path
-     *   (see `stripMountPrefix`)
-     * @param hash - SHA-256 hash of the file content, or null if file no longer exists
-     * @param context - Explicit classification context from the caller. When provided,
-     *   the collector uses it directly instead of classifying from the path.
+     * A refusal reports one fact — a lineage edge that will not exist — and the
+     * fact does not change when the same file is read again. Reads dedup within
+     * one frame but not across them, and a step issues many execs against a tree
+     * whose watch set spans the whole analysis, so an undeduped narration is a
+     * steady stream rather than an exception. The signal exists to be noticed;
+     * emitting it at that volume is what teaches a reader to filter it away.
      */
+    claimRefusalNarration(relativePath) {
+        if (this.narratedRefusals.has(relativePath))
+            return false;
+        this.narratedRefusals.add(relativePath);
+        return true;
+    }
     trackInputAccess(mountPath, relativePath, hash, context) {
         const key = `${mountPath}:${relativePath}`;
         const existing = this.inputAccesses.get(key);
         if (existing)
             return existing;
         // Use explicit context if provided, otherwise fall back to path classification
-        const classification = context ?? classifyReadPath(relativePath, this.stepId, this.runId, this.dependsOn);
+        let classification;
+        if (context) {
+            classification = context;
+        }
+        else {
+            const classified = classifyReadPath(relativePath, this.stepId, this.runId, this.dependsOn);
+            if (!classified.admissible)
+                return null;
+            classification = classified.context;
+        }
         // A still-absolute `relativePath` is a report the caller could not
         // relativize — it names somewhere outside the mount. It rides verbatim:
         // prepending the mount root would forge an in-tree name for a foreign

package/dist/provenance/exec-frame.d.ts

@@ -8,10 +8,20 @@
  * `runs/{priorRunId}/...`) so `classifyReadPath` and the collector's
  * `stepPrefix` normalization see the shapes they expect.
  *
+ * A read naming a same-run sibling this step never declared is refused here,
+ * before it reaches the collector: a ref the collector never holds cannot
+ * become an attestation target, so the edge is unrepresentable rather than
+ * merely filtered downstream. Each refused path is logged once per step — an
+ * edge asserted over a step that was still writing is invisible by nature, so a
+ * silent drop would rebuild exactly the blind spot the refusal exists to close,
+ * while re-narrating a path already reported adds no fact and buries the rest.
+ *
  * Degrades safely: a disabled or absent frame records the command with no
- * inputs and no writes (its outputs fall back to leaves at registration).
- * It never throws — provenance is best-effort and must not fail an exec.
+ * inputs and no writes (its outputs fall back to leaves at registration), and a
+ * frame whose every read is refused still records its command. It never throws —
+ * provenance is best-effort and must not fail an exec.
  */
+import type { Logger } from "../lib/logger.js";
 import type { ProvenanceFrame } from "../sandbox/types.js";
 import { type ProvenanceCollector } from "./collector.js";
 /**
@@ -32,6 +42,8 @@ export interface FeedExecFrameArgs {
     readonly durationMs: number | null;
     /** The frame surfaced on `ExecResult.provenance` (may be absent). */
     readonly provenance?: ProvenanceFrame;
+    /** Diagnostics seam. Left unwired, refusals still happen but go unnarrated. */
+    readonly logger?: Logger;
 }
 /**
  * Translate one exec's frame into a collector record. Per-command input

package/dist/provenance/exec-frame.js

@@ -8,10 +8,20 @@
  * `runs/{priorRunId}/...`) so `classifyReadPath` and the collector's
  * `stepPrefix` normalization see the shapes they expect.
  *
+ * A read naming a same-run sibling this step never declared is refused here,
+ * before it reaches the collector: a ref the collector never holds cannot
+ * become an attestation target, so the edge is unrepresentable rather than
+ * merely filtered downstream. Each refused path is logged once per step — an
+ * edge asserted over a step that was still writing is invisible by nature, so a
+ * silent drop would rebuild exactly the blind spot the refusal exists to close,
+ * while re-narrating a path already reported adds no fact and buries the rest.
+ *
  * Degrades safely: a disabled or absent frame records the command with no
- * inputs and no writes (its outputs fall back to leaves at registration).
- * It never throws — provenance is best-effort and must not fail an exec.
+ * inputs and no writes (its outputs fall back to leaves at registration), and a
+ * frame whose every read is refused still records its command. It never throws —
+ * provenance is best-effort and must not fail an exec.
  */
+import { createNoopLogger } from "../lib/console-logger.js";
 import { classifyReadPath } from "./collector.js";
 /**
  * Strip the `/{resourceId}/` mount prefix from an absolute frame path.
@@ -40,11 +50,24 @@ export function feedExecFrame(args) {
         collector.recordCommandExecution(cmd, [...cmdArgs], code, duration, [], undefined, []);
         return;
     }
+    // Resolved once so the read loop logs unconditionally instead of threading
+    // `?.` through every diagnostic.
+    const logger = (args.logger ?? createNoopLogger()).named("exec-frame");
     const commandReads = [];
     for (const read of provenance.reads) {
         const rel = stripMountPrefix(mountRoot, read.path);
-        const context = classifyReadPath(rel, collector.stepId, collector.runId, collector.dependsOn);
-        commandReads.push(collector.trackInputAccess(mountRoot, rel, null, context));
+        const classification = classifyReadPath(rel, collector.stepId, collector.runId, collector.dependsOn);
+        if (!classification.admissible) {
+            if (collector.claimRefusalNarration(rel)) {
+                logger.warn("refusing lineage edge to an undeclared same-run path", {
+                    path: rel,
+                    refRunId: classification.refRunId,
+                    refStepId: classification.refStepId,
+                });
+            }
+            continue;
+        }
+        commandReads.push(collector.trackInputAccess(mountRoot, rel, null, classification.context));
     }
     const writes = provenance.writes.map((w) => ({
         path: stripMountPrefix(mountRoot, w.path),