@intx/workflow-host 0.2.2 → 0.3.0

package/README.md

@@ -95,7 +95,7 @@ The constructor argument shape:
   `require.resolve` / `import.meta.resolve` against the host's own
   package, `@intx/<host>`).
 - `substrateEnv`, `workflowRunRepoId`, `workflowRunRef`,
-  `deploymentId`, `deploymentMailAddress`, `readPrincipal`,
+  `anchorRunId`, `deploymentMailAddress`, `readPrincipal`,
   `deriveStepAddress`, `deriveStepRepoId?`, `ipcKeyPairFactory?` —
   per-deployment configuration the supervisor needs in its closure
   state.
@@ -144,9 +144,61 @@ signed shape as the operator and drain origins.
 `shutdown()` unregisters the mail address, kills the child, and
 disposes subscriptions.
 
-`drain` and `recycle` are stubs in this commit; the full
-implementations land with the drain controller and recycle paths
-respectively.
+`drain(opts)` sends the drain control mail and waits for in-flight
+runs to drain per each step's `drainBehavior`; on the drain-timeout it
+escalates to a signed `CancelRequested{origin: "supervisor-drain"}`.
+
+`recycle(opts)` tears the current child down and stands a fresh one up
+against the SAME deploy tree (same materialized source closure, same
+per-step credential repos). It is strictly orthogonal to redeploy,
+which mints a new deploy tree. Operator, supervisor-policy (max-uptime
+/ max-rss / grants-staleness), and workflow-process-self-initiated
+origins all funnel through the same path.
+
+### Respawn policy
+
+An UNEXPECTED child exit — a crash, OOM, panic, or signal, as opposed
+to a supervisor-initiated shutdown or recycle — is detected by watching
+the child process's `exited`, not the IPC channel: a clean process
+death ends the channel readers without a protocol-level crash callback,
+so `exited` is the only universal death signal. The supervisor
+classifies the exit by cohort generation and lifecycle phase — an exit
+of the current running cohort that no planned teardown owns is
+unexpected.
+
+On an unexpected exit the supervisor, with no external intervention:
+
+1. Replays any mail stranded mid-flight — entries the dead child's
+   in-flight dispatch left in the per-address `processing/` subtree —
+   back into `inbox/` under their original `<receivedAt>-<messageId>`
+   keys. Those keys sort ahead of any mail that arrived during the
+   kill/respawn gap, so the stranded entry is re-dispatched first and
+   FIFO ordering holds across the respawn boundary.
+2. Spawns a fresh workflow-process child against the same deploy tree
+   (reusing the recycle path's respawn machinery) and resumes dispatch.
+
+The respawn is bounded so a persistently-broken child cannot saturate
+the host. Every bound is operator-overridable via
+`WorkflowSupervisorBindings`; the defaults are:
+
+- **Exponential backoff.** Each respawn waits before spawning, starting
+  at `respawnBackoffInitialMs` (1s) and doubling to a
+  `respawnBackoffMaxMs` (30s) cap.
+- **Crash-loop guard.** If the child exits unexpectedly
+  `crashLoopMaxCount` (3) times within `crashLoopWindowMs` (60s), the
+  supervisor stops respawning and latches the deployment to a terminal
+  `crash-looping` state.
+- **Stable-run reset.** Once a crash-respawned child stays up for
+  `crashLoopStableResetMs` (60s), the crash counter and the backoff
+  reset, so a flap followed by stability does not permanently latch.
+
+`crash-looping` is an in-memory, per-process phase — no external reader
+observes it. The durable, externally-queryable signal is the run's
+status: on latch the supervisor (the sole writer of the workflow-run
+repo) commits a `RunFailed` for the deployment's stable run, flipping
+its `workflow_run.status` to `failed` through the same pack path every
+other terminal run uses. External automation that watches run status
+sees the crash-loop as a failed run.
 
 ### Host wiring
 
@@ -208,12 +260,6 @@ without reconstructing the env. The closure looks up the
 originating step's grants by `stepId` and delegates to a
 host-supplied `GrantEvaluator`.
 
-### Placeholders
-
-`DrainController` is a no-op placeholder in this commit; the real
-controller lands separately. `recycle` is a no-op pending the
-recycle path.
-
 ## Hosting the workflow-process child
 
 `@intx/workflow-host` ships the runtime body

package/dist/adapters/repo-store.d.ts

@@ -1,5 +1,5 @@
 import type { Principal, RepoId, RepoStore as SubstrateRepoStore } from "@intx/hub-sessions/substrate";
-import type { RepoStore } from "@intx/workflow";
+import type { RepoStore, WorkflowEvent } from "@intx/workflow";
 export type WorkflowRunRepoStoreOpts = {
     /**
      * Substrate handle the adapter reads from and writes to. The caller
@@ -23,6 +23,18 @@ export type WorkflowRunRepoStoreOpts = {
      * shape the production wiring supplies.
      */
     principal: Principal;
+    /**
+     * Principal used for a control-plane cancel append (a batch that is
+     * entirely `CancelRequested`). The workflow-run kind handler requires a
+     * `CancelRequested` be signed by a `supervisor` principal -- a
+     * `workflow-process` principal may write run-body events but not a cancel.
+     * An in-process child runs under real supervisor authority, so its host
+     * supplies a supervisor principal here while run-body events keep their
+     * `workflow-process` attribution. Absent when the writer issues no
+     * in-process cancel, in which case a cancel fails loud at the push boundary
+     * rather than being silently mis-attributed.
+     */
+    controlPlanePrincipal?: Principal;
     /**
      * Events ref the adapter reads from and writes to. The workflow-run
      * repo layout pins all `runs/<runId>/events/` blobs under a single
@@ -37,3 +49,12 @@ export type WorkflowRunRepoStoreOpts = {
  * routing live in closure.
  */
 export declare function createWorkflowRunRepoStore(opts: WorkflowRunRepoStoreOpts): RepoStore;
+/**
+ * Translate a state-machine `WorkflowEvent` (using `kind` as the
+ * discriminator) into the on-disk envelope shape (`{seq, type,
+ * ...rest}`) the workflow-run kind handler validates and the
+ * substrate's `subscribeKind` helper filters on. Exported so the
+ * supervisor's terminal-commit path encodes a supervisor-authored
+ * `RunFailed` through the same single source of the on-disk shape.
+ */
+export declare function workflowEventToOnDisk(event: WorkflowEvent, seq: number): Record<string, unknown>;

package/dist/adapters/repo-store.js

@@ -61,6 +61,7 @@ const ALL_WORKFLOW_EVENT_TYPES = [
     "AttemptScheduled",
     "SignalAwaited",
     "SignalReceived",
+    "SignalAwaitAbandoned",
     "TimerSet",
     "TimerFired",
     "CancelRequested",
@@ -95,66 +96,60 @@ export function createWorkflowRunRepoStore(opts) {
     };
 }
 async function readAllEventsForRun(opts, runId) {
-    const fs = await import("node:fs/promises");
-    const path = await import("node:path");
-    const dir = opts.substrate.getRepoDir(opts.repoId);
-    const runDir = path.join(dir, RUNS_PREFIX, runId);
+    // Read the committed tree through the substrate, never the working
+    // checkout under `getRepoDir`. `openCommittedReads` pins the ref to its
+    // tip commit and serves every read from the git object store, so an
+    // enumerate-then-read sequence is a single coherent snapshot even while
+    // a concurrent append re-materializes the checkout. The prior
+    // implementation read the working tree directly (raw readdir/readFile)
+    // and raced that materialization: a blob `readdir` had just enumerated
+    // could vanish before `readFile` on a contended filesystem, surfacing a
+    // spurious ENOENT. Reading under the substrate's per-repo write lock was
+    // the alternative considered and rejected -- it would serialize every
+    // read behind the single writer and couple read latency to write
+    // contention, whereas the pinned committed tree is lock-free and already
+    // consistent because every append lands as exactly one commit.
+    const reads = await opts.substrate.openCommittedReads(opts.principal, opts.repoId, opts.ref);
+    // Null mirrors the prior readdir-ENOENT contract: an uninitialised repo
+    // or an unresolved ref holds no runs at all.
+    if (reads === null)
+        return [];
+    const runDir = `${RUNS_PREFIX}/${runId}`;
+    const runChildren = await reads.listDir(runDir);
+    const decoder = new TextDecoder();
     const entries = [];
     // A terminated run is sealed into a single combined `events.jsonl`; an
-    // in-flight run keeps per-event `events/<seq>.json` files. The combined
-    // file's presence selects the read path; the two forms are mutually
-    // exclusive in a run directory.
-    let combinedRaw;
-    try {
-        combinedRaw = await fs.readFile(path.join(runDir, WORKFLOW_RUN_EVENTS_FILE), "utf8");
-    }
-    catch (cause) {
-        if (!isErrnoNotFound(cause))
-            throw cause;
-        combinedRaw = null;
-    }
-    if (combinedRaw !== null) {
-        // The two forms are mutually exclusive; a run carrying both is a
-        // botched seal, and silently reading only the combined file would
-        // mask it, so surface it instead.
-        let perEventPresent = false;
-        try {
-            await fs.access(path.join(runDir, EVENTS_DIR));
-            perEventPresent = true;
-        }
-        catch (cause) {
-            if (!isErrnoNotFound(cause))
-                throw cause;
-        }
-        if (perEventPresent) {
+    // in-flight run keeps per-event `events/<seq>.json` files. The two forms
+    // are mutually exclusive; a run carrying both is a botched seal, and
+    // silently reading only the combined file would mask it, so surface it.
+    const combined = runChildren.find((e) => e.type === "blob" && e.name === WORKFLOW_RUN_EVENTS_FILE);
+    const perEventDir = runChildren.find((e) => e.type === "tree" && e.name === EVENTS_DIR);
+    if (combined !== undefined) {
+        if (perEventDir !== undefined) {
             throw new Error(`workflow-runtime: run ${runId} carries both a combined ${WORKFLOW_RUN_EVENTS_FILE} and a per-event ${EVENTS_DIR}/ directory`);
         }
+        const combinedRaw = decoder.decode(await reads.readBlobByOid(combined.oid));
         for (const line of splitCombinedEventLog(combinedRaw)) {
             entries.push(parseEventEnvelope(line, `${opts.repoId.id}/${runId}/${WORKFLOW_RUN_EVENTS_FILE}`));
         }
         entries.sort((a, b) => a.seq - b.seq);
         return entries.map((e) => e.event);
     }
-    const eventsDir = path.join(runDir, EVENTS_DIR);
-    let filenames;
-    try {
-        filenames = await fs.readdir(eventsDir);
-    }
-    catch (cause) {
-        if (isErrnoNotFound(cause))
-            return [];
-        throw cause;
-    }
-    for (const name of filenames) {
-        const match = EVENT_FILENAME_RE.exec(name);
+    // Per-event form. `listDir` on an absent or non-tree path returns the
+    // empty array, so a run with no events reads as the empty log.
+    const eventBlobs = await reads.listDir(`${runDir}/${EVENTS_DIR}`);
+    for (const child of eventBlobs) {
+        if (child.type !== "blob")
+            continue;
+        const match = EVENT_FILENAME_RE.exec(child.name);
         if (match === null)
             continue;
         const seqStr = match[1];
         if (seqStr === undefined)
             continue;
         const seqFromName = Number.parseInt(seqStr, 10);
-        const raw = await fs.readFile(path.join(eventsDir, name), "utf8");
-        const source = `${opts.repoId.id}/${runId}/${EVENTS_DIR}/${name}`;
+        const raw = decoder.decode(await reads.readBlobByOid(child.oid));
+        const source = `${opts.repoId.id}/${runId}/${EVENTS_DIR}/${child.name}`;
         const entry = parseEventEnvelope(raw, source);
         if (entry.seq !== seqFromName) {
             throw new Error(`workflow-runtime: read ${source} body.seq ${String(entry.seq)} does not match filename seq ${String(seqFromName)}`);
@@ -213,9 +208,11 @@ function onDiskToWorkflowEvent(envelope) {
  * Translate a state-machine `WorkflowEvent` (using `kind` as the
  * discriminator) into the on-disk envelope shape (`{seq, type,
  * ...rest}`) the workflow-run kind handler validates and the
- * substrate's `subscribeKind` helper filters on.
+ * substrate's `subscribeKind` helper filters on. Exported so the
+ * supervisor's terminal-commit path encodes a supervisor-authored
+ * `RunFailed` through the same single source of the on-disk shape.
  */
-function workflowEventToOnDisk(event, seq) {
+export function workflowEventToOnDisk(event, seq) {
     const { kind, seq: _eventSeq, ...rest } = event;
     return { seq, type: kind, ...rest };
 }
@@ -241,9 +238,18 @@ async function appendBatchEvents(opts, runId, events) {
     const lastEvent = events[events.length - 1];
     if (lastEvent === undefined)
         throw new Error("unreachable");
+    // A control-plane cancel append (an isolated `CancelRequested`, which the
+    // kind handler requires be signed by a supervisor principal) is written under
+    // `controlPlanePrincipal` when the host supplied one; every other batch --
+    // including run-body events -- keeps the workflow-process `principal`. A mixed
+    // batch is never a cancel, so it stays on `principal`.
+    const principal = opts.controlPlanePrincipal !== undefined &&
+        events.every((event) => event.kind === "CancelRequested")
+        ? opts.controlPlanePrincipal
+        : opts.principal;
     let seqConflict = null;
     try {
-        await opts.substrate.writeTreePreservingPrefix(opts.principal, opts.repoId, opts.ref, {
+        await opts.substrate.writeTreePreservingPrefix(principal, opts.repoId, opts.ref, {
             preservePrefix: prefix,
             merge: async (existing) => {
                 // The runtime body emits events at `state.lastSeq + 1` and
@@ -336,9 +342,3 @@ async function* subscribeRun(opts, runId, subOpts) {
         yield { seq: entry.event.seq, event };
     }
 }
-function isErrnoNotFound(cause) {
-    if (cause === null || typeof cause !== "object")
-        return false;
-    const code = cause.code;
-    return code === "ENOENT";
-}

package/dist/adapters/spawn-child.d.ts

@@ -1,5 +1,5 @@
-import type { Principal, RepoStore } from "@intx/hub-sessions/substrate";
-import type { SpawnChildWorkflow, WorkflowDefinition } from "@intx/workflow";
+import type { InferenceEvent } from "@intx/types/runtime";
+import type { SpawnChildWorkflow, SpawnSuspendableChild, SuspendableChildHandle, WorkflowDefinition, WorkflowEvent } from "@intx/workflow";
 /**
  * The terminal-status shape the runtime body expects back from a
  * spawn. Mirrored from `SpawnChildWorkflow`'s return type so the
@@ -29,46 +29,75 @@ export type RunChildWorkflow = (input: {
 }) => Promise<{
     terminalStatus: ChildTerminalStatus;
 }>;
-export interface WorkflowSpawnChildOpts {
-    /**
-     * Substrate the deploy orchestrator wrote the workflow asset into.
-     * The adapter reads the workflow envelope through
-     * `substrate.getRepoDir` -- the deploy-time `writeTree` already
-     * materialized the file under the returned directory and a flat
-     * `fs.readFile` does not need to walk the git object database.
-     */
-    substrate: RepoStore;
-    /**
-     * Principal the adapter presents to the substrate for any future
-     * authorize-gated read path. The current implementation does not
-     * gate `getRepoDir` (the substrate documents it as a pure path
-     * computation), but holding the principal in closure keeps the
-     * adapter symmetric with the sibling production adapters and ready
-     * for a future API that surfaces an authorize gate on the same
-     * read path.
-     */
-    principal: Principal;
-    /**
-     * Ref under the workflow asset's repo whose tree holds the
-     * deployed `workflow.json`. Callers typically supply
-     * `"refs/heads/main"` -- the workflow-kind handler enforces the
-     * envelope's structural shape at push time so a deploy ref read
-     * here either yields a valid envelope or surfaces a targeted
-     * parse/validation error.
-     */
-    deployRef: string;
-    /**
-     * Runtime-supplied child execution callback. The adapter delegates
-     * here once the `WorkflowDefinition` is resolved; the supervisor
-     * owns the child `WorkflowRuntimeEnv` and the `runtimeRun`
-     * invocation.
-     */
+/**
+ * Construct the terminal `WorkflowRuntimeEnv.SpawnChildWorkflow` adapter for an
+ * owned childWorkflow import. The child re-evaluated the whole pinned closure
+ * and lifted every inline child to an internal `{ ref }`, so the child
+ * definitions are in hand and already covered by the parent's re-verify.
+ * Resolve each `definitionRef`
+ * from the in-memory `bodies` map and delegate to the runtime-supplied
+ * `runChild`, with NO on-disk round-trip and NO separate per-child re-verify:
+ * materializing the child back out and re-fingerprinting it would round-trip
+ * trusted-in-hand data for no gain, and the closure re-eval on restart
+ * re-derives the same bodies durably. Mirrors
+ * {@link createInMemorySpawnSuspendableChild} but drives the child terminal-only
+ * (await its terminal status) rather than across approval parks.
+ */
+export declare function createInMemorySpawnChild(opts: {
+    bodies: ReadonlyMap<string, WorkflowDefinition>;
     runChild: RunChildWorkflow;
-}
+}): SpawnChildWorkflow;
+/**
+ * Runtime-supplied suspendable child execution callback. The park-aware
+ * analog of {@link RunChildWorkflow}: the supervisor owns the child
+ * `WorkflowRuntimeEnv` construction and the `runtimeRun` invocation and
+ * returns a live `SuspendableChildHandle` the caller drives across the
+ * body's approval parks, rather than awaiting a terminal. The adapter is
+ * the single resolution point that hands the supervisor a concrete
+ * `WorkflowDefinition` alongside the parent attribution the runtime body
+ * produced.
+ */
+export type RunSuspendableChild = (input: {
+    definition: WorkflowDefinition;
+    definitionRef: string;
+    childRunId: string;
+    input: unknown;
+    parentRunId: string;
+    parentStepId: string;
+    signal: AbortSignal;
+    resumeFromEvents?: readonly WorkflowEvent[];
+}, 
+/**
+ * Live inference-event sink for the child's agent steps. Threaded from the
+ * host's per-run funnel (the parent run's event-channel closure) so the
+ * body's inference events reach the hub's live stream instead of being
+ * silently dropped. Per-run durable attribution is unaffected -- the child
+ * runtime commits its events under `runs/<childRunId>/events/` regardless.
+ */
+onEvent: (event: InferenceEvent) => void) => Promise<SuspendableChildHandle>;
+/**
+ * Host-side widening of the runtime {@link SpawnSuspendableChild} contract: the
+ * same input plus the per-run `onEvent` sink the host injects. The runtime
+ * calls the narrow `SpawnSuspendableChild` (no event slot); the host binding
+ * wired into the runtime env closes over the run's funnel and forwards it here,
+ * mirroring how `ChildStepInvoker` widens the runtime `StepInvoker` with
+ * `onEvent`. The runtime contract in `@intx/workflow` stays untouched.
+ */
+export type HostSpawnSuspendableChild = (input: Parameters<SpawnSuspendableChild>[0], onEvent: (event: InferenceEvent) => void) => ReturnType<SpawnSuspendableChild>;
 /**
- * Construct the production `WorkflowRuntimeEnv.SpawnChildWorkflow`
- * adapter. The substrate handle, the principal, the deploy ref, and
- * the runtime-supplied child callback live in closure; the returned
- * callable satisfies the runtime-env interface.
+ * Construct the `WorkflowRuntimeEnv.SpawnSuspendableChild` adapter for the
+ * source-ref (code-sourced) path -- the only deploy lineage. The parent child
+ * re-evaluated the whole pinned closure in one sandbox and re-verified it
+ * against the approved hash -- which already covers every inline onTrigger body
+ * -- so the body definitions are in hand and already proven. Resolve each
+ * `definitionRef` from that in-memory `bodies` map and run it in-process, with
+ * NO disk round-trip and NO separate per-body re-verify: materializing the body
+ * back out and re-fingerprinting it would round-trip trusted-in-hand data for no
+ * gain, and the closure re-eval on restart re-derives the same bodies durably.
+ * The body still runs in the parent's sandbox (in-process today; a stricter
+ * per-body boundary is the deferred, opt-in SandboxBoundary case).
  */
-export declare function createWorkflowSpawnChild(opts: WorkflowSpawnChildOpts): SpawnChildWorkflow;
+export declare function createInMemorySpawnSuspendableChild(opts: {
+    bodies: ReadonlyMap<string, WorkflowDefinition>;
+    runSuspendableChild: RunSuspendableChild;
+}): HostSpawnSuspendableChild;

package/dist/adapters/spawn-child.js

@@ -1,34 +1,34 @@
 // Production `WorkflowRuntimeEnv.SpawnChildWorkflow` adapter.
 //
-// The runtime body sees the spawn callback shape: given a
-// `definitionRef` (a workflow asset's repo id), a parent-allocated
-// `childRunId`, the materialized child input, and parent attribution,
-// settle once the child run reaches a terminal phase. The adapter
-// itself does not execute the child workflow -- it resolves the
-// `definitionRef` into a concrete `WorkflowDefinition` from the
-// workflow repo's deploy ref, then delegates the spawn to a
-// runtime-supplied `runChild` callback. The supervisor wires the
+// The runtime body sees the spawn callback shape: given a `definitionRef`
+// (the internal ref the deploy step assigned when it lifted the authored
+// inline child), a parent-allocated `childRunId`, the materialized child
+// input, and parent attribution, settle once the child run reaches a terminal
+// phase. The adapter itself does not execute the child workflow -- it resolves
+// the `definitionRef` into a concrete `WorkflowDefinition` and delegates the
+// spawn to a runtime-supplied `runChild` callback. The supervisor wires the
 // callback against a child `WorkflowRuntimeEnv` and `runtimeRun`.
 //
-// Resolution path:
-//   1. Build `RepoId { kind: "workflow", id: definitionRef }` against
-//      the substrate the deploy orchestrator wrote the workflow asset
-//      into.
-//   2. Read `workflow.json` from the deploy ref's working tree at
-//      `getRepoDir(repoId)`. The deploy-time `writeTree` materializes
-//      the file on disk under the same path, so a flat `fs.readFile`
-//      against the substrate's repo dir gives the workflow envelope
-//      without dragging in a git object-database read for this commit.
-//      The sibling repo-store and blob-substrate adapters use the same
-//      working-tree-read pattern.
-//   3. Parse as JSON, validate the envelope shape via
-//      `workflowDefinitionEnvelopeSchema`, and surface the parsed
-//      object as a `WorkflowDefinition`. The state-machine-narrowed
-//      primitives are validated by the runtime body downstream; the
-//      adapter does the structural-shape check the workflow-kind
-//      handler already enforces at push time so a tampered-on-disk
-//      tree still surfaces a clear error here rather than crashing
-//      deep inside the runtime.
+// Two spawn types with DIFFERENT trust structures resolve here, so they
+// take different resolution paths -- not one shared resolver that pretends
+// they are the same:
+//
+//   - onTrigger BODY (the suspendable adapter): a body is a section
+//     extracted from the PARENT's own approved definition. Source-ref is the
+//     only deploy lineage, so the body is resolved in-memory from the parent's
+//     re-evaluated closure (`createInMemorySpawnSuspendableChild`), already
+//     covered by the parent's re-verify -- no separate on-disk read and no
+//     separate per-body re-verify.
+//
+//   - childWorkflow (the terminal adapter): an owned import embedded inline in
+//     the parent's definition. It is lifted to an internal `{ ref }` at child
+//     boot and resolved in-memory from the parent's closure map
+//     (`createInMemorySpawnChild`) -- exactly like a source-ref onTrigger
+//     body, with NO on-disk asset and NO separate per-child re-verify (the
+//     parent's re-verify already covers it, since the inline child rides the
+//     parent's hashed projection). The terminal-only drive (await the child's
+//     terminal, no park) is the only thing that distinguishes it from the
+//     suspendable body adapter.
 //
 // Drain coordination is handled by the supervisor's drain primitive
 // (`packages/workflow-host/src/supervisor`), not by this adapter. The
@@ -59,21 +59,31 @@
 // `runChild` does -- but the callback's input shape (`{ definition,
 // childRunId, ... }`) is the seam that makes the scoping unambiguous
 // at the boundary.
-import { type } from "arktype";
-import { workflowDefinitionEnvelopeSchema } from "@intx/hub-sessions/substrate";
-const WORKFLOW_JSON_PATH = "workflow.json";
 /**
- * Construct the production `WorkflowRuntimeEnv.SpawnChildWorkflow`
- * adapter. The substrate handle, the principal, the deploy ref, and
- * the runtime-supplied child callback live in closure; the returned
- * callable satisfies the runtime-env interface.
+ * Construct the terminal `WorkflowRuntimeEnv.SpawnChildWorkflow` adapter for an
+ * owned childWorkflow import. The child re-evaluated the whole pinned closure
+ * and lifted every inline child to an internal `{ ref }`, so the child
+ * definitions are in hand and already covered by the parent's re-verify.
+ * Resolve each `definitionRef`
+ * from the in-memory `bodies` map and delegate to the runtime-supplied
+ * `runChild`, with NO on-disk round-trip and NO separate per-child re-verify:
+ * materializing the child back out and re-fingerprinting it would round-trip
+ * trusted-in-hand data for no gain, and the closure re-eval on restart
+ * re-derives the same bodies durably. Mirrors
+ * {@link createInMemorySpawnSuspendableChild} but drives the child terminal-only
+ * (await its terminal status) rather than across approval parks.
  */
-export function createWorkflowSpawnChild(opts) {
+export function createInMemorySpawnChild(opts) {
     return async ({ definitionRef, childRunId, input, parentRunId, parentStepId, signal, }) => {
         if (signal.aborted) {
             throw abortError(signal);
         }
-        const definition = await resolveDefinition(opts, definitionRef);
+        const definition = opts.bodies.get(definitionRef);
+        if (definition === undefined) {
+            throw new Error(`workflow-runtime: spawn-child has no in-memory childWorkflow ` +
+                `definition for ${JSON.stringify(definitionRef)}; the parent's ` +
+                `closure should have lifted every inline child`);
+        }
         // Re-check the abort signal after the resolution await. The
         // caller can fire `signal.abort()` between the entry-time check
         // and here; without this re-check the child callback would be
@@ -95,42 +105,44 @@ export function createWorkflowSpawnChild(opts) {
         return { terminalStatus: result.terminalStatus };
     };
 }
-async function resolveDefinition(opts, definitionRef) {
-    const repoId = { kind: "workflow", id: definitionRef };
-    const fs = await import("node:fs/promises");
-    const path = await import("node:path");
-    const dir = opts.substrate.getRepoDir(repoId);
-    const workflowPath = path.join(dir, WORKFLOW_JSON_PATH);
-    let raw;
-    try {
-        raw = await fs.readFile(workflowPath, "utf8");
-    }
-    catch (cause) {
-        if (isErrnoNotFound(cause)) {
-            throw new Error(`workflow-runtime: spawn-child cannot resolve definitionRef ${JSON.stringify(definitionRef)}: ${WORKFLOW_JSON_PATH} not present under ${repoId.kind}/${repoId.id} on ${opts.deployRef}`, { cause });
+/**
+ * Construct the `WorkflowRuntimeEnv.SpawnSuspendableChild` adapter for the
+ * source-ref (code-sourced) path -- the only deploy lineage. The parent child
+ * re-evaluated the whole pinned closure in one sandbox and re-verified it
+ * against the approved hash -- which already covers every inline onTrigger body
+ * -- so the body definitions are in hand and already proven. Resolve each
+ * `definitionRef` from that in-memory `bodies` map and run it in-process, with
+ * NO disk round-trip and NO separate per-body re-verify: materializing the body
+ * back out and re-fingerprinting it would round-trip trusted-in-hand data for no
+ * gain, and the closure re-eval on restart re-derives the same bodies durably.
+ * The body still runs in the parent's sandbox (in-process today; a stricter
+ * per-body boundary is the deferred, opt-in SandboxBoundary case).
+ */
+export function createInMemorySpawnSuspendableChild(opts) {
+    return async ({ definitionRef, childRunId, input, parentRunId, parentStepId, signal, resumeFromEvents, }, onEvent) => {
+        if (signal.aborted) {
+            throw abortError(signal);
+        }
+        const definition = opts.bodies.get(definitionRef);
+        if (definition === undefined) {
+            throw new Error(`workflow-runtime: source-ref spawn-child has no in-memory onTrigger ` +
+                `body for ${JSON.stringify(definitionRef)}; the parent's closure ` +
+                `re-eval should have extracted every inline body`);
+        }
+        if (signal.aborted) {
+            throw abortError(signal);
         }
-        throw cause;
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch (cause) {
-        throw new Error(`workflow-runtime: spawn-child read ${WORKFLOW_JSON_PATH} for ${repoId.kind}/${repoId.id} on ${opts.deployRef} is not valid JSON`, { cause });
-    }
-    const validated = workflowDefinitionEnvelopeSchema(parsed);
-    if (validated instanceof type.errors) {
-        throw new Error(`workflow-runtime: spawn-child ${WORKFLOW_JSON_PATH} for ${repoId.kind}/${repoId.id} on ${opts.deployRef} failed envelope validation: ${validated.summary}`);
-    }
-    // The envelope schema enforces the structural shape the workflow
-    // body and state machine consume; the discriminated narrow over
-    // every `Primitive` variant lives downstream (the runtime body
-    // walks the steps and dispatches per-kind). Re-deriving the
-    // primitive narrow here would duplicate `defineWorkflow`'s
-    // validation, and the workflow-kind handler already enforced the
-    // same envelope at push time.
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- WorkflowDefinition's primitive union is narrowed downstream by the runtime body; the envelope schema enforces the structural shape this adapter cares about
-    return validated;
+        return opts.runSuspendableChild({
+            definition,
+            definitionRef,
+            childRunId,
+            input,
+            parentRunId,
+            parentStepId,
+            signal,
+            ...(resumeFromEvents !== undefined ? { resumeFromEvents } : {}),
+        }, onEvent);
+    };
 }
 /**
  * Construct the rejection used when `signal.aborted` short-circuits.
@@ -144,9 +156,3 @@ function abortError(signal) {
         return reason;
     return new DOMException("aborted", "AbortError");
 }
-function isErrnoNotFound(cause) {
-    if (cause === null || typeof cause !== "object")
-        return false;
-    const code = cause.code;
-    return code === "ENOENT";
-}