@kb-labs/workflow-daemon 2.94.0 → 2.98.0

package/dist/index.js

@@ -1,19 +1,20 @@
 #!/usr/bin/env node
-import { createServiceBootstrap, platform } from '@kb-labs/core-runtime';
+import { platform, createServiceBootstrap } from '@kb-labs/core-runtime';
+import { makeAssemblyHook } from '@kb-labs/plugin-runtime';
 import { WorkflowEngine, WorkflowService } from '@kb-labs/workflow-engine';
-import { createCorrelatedLogger, registerOpenAPI, HttpObservabilityCollector, createServiceReadyResponse, metricLine } from '@kb-labs/shared-http';
+import { createCorrelatedLogger, getListenOptions, HttpObservabilityCollector, createDaemonServer, createServiceReadyResponse, metricLine } from '@kb-labs/shared-http';
+import { runDaemon } from '@kb-labs/shared-daemon';
 import { logDiagnosticEvent } from '@kb-labs/core-platform';
-import { PluginCronJobSchema, UserCronJobSchema, evaluateExpression, interpolateObject, resolveValue, interpolateString } from '@kb-labs/workflow-contracts';
+import { PluginCronJobSchema, UserCronJobSchema, evaluateExpression, interpolateObject, buildShellSafeCommand, coerceToString, interpolateString } from '@kb-labs/workflow-contracts';
+import { GateHandler } from '@kb-labs/workflow-steps';
 import { SandboxRunner } from '@kb-labs/workflow-runtime';
 import * as cron from 'node-cron';
 import { CronExpressionParser } from 'cron-parser';
-import { stat, readdir, readFile } from 'fs/promises';
+import { stat, readdir, readFile, access } from 'fs/promises';
 import { join, extname, basename } from 'path';
 import YAML from 'yaml';
-import Fastify from 'fastify';
-import cors from '@fastify/cors';
+import { watch } from 'fs';
 import { createRegistry } from '@kb-labs/core-registry';
-import { findRepoRoot } from '@kb-labs/core-sys';
 import { randomUUID } from 'crypto';
 
 async function createWorkflowWorker(options) {
@@ -28,6 +29,11 @@ async function createWorkflowWorker(options) {
     analytics,
     debugMode = process.env["WORKFLOW_DEBUG"] === "true"
   } = options;
+  const wsProvider = platform2.getAdapter("workspace");
+  if (wsProvider && typeof wsProvider.startupCleanup === "function") {
+    wsProvider.startupCleanup().catch(() => {
+    });
+  }
   let isRunning = false;
   let stopRequested = false;
   const runningJobs = /* @__PURE__ */ new Map();
@@ -67,6 +73,14 @@ async function createWorkflowWorker(options) {
       return true;
     }
     claimedJobs.add(jobKey);
+    const waitMs = job.queuedAt ? Date.now() - new Date(job.queuedAt).getTime() : void 0;
+    logger.info("Job picked from queue", {
+      runId: run.id,
+      jobId: job.id,
+      jobName: job.jobName,
+      queuedAt: job.queuedAt,
+      waitMs
+    });
     const jobStartTime = Date.now();
     const jobLogger = createCorrelatedLogger(logger, {
       serviceId: "workflow",
@@ -79,7 +93,8 @@ async function createWorkflowWorker(options) {
       bindings: {
         workflowId: run.id,
         runId: run.id,
-        jobId: job.id
+        jobId: job.id,
+        jobName: job.jobName
       }
     });
     jobLogger.info("Processing job", {
@@ -98,13 +113,13 @@ async function createWorkflowWorker(options) {
     const runTarget = run.metadata?.target;
     const jobTarget = job.target;
     const target = jobTarget ?? runTarget;
-    const wsProvider = platform2.getAdapter("workspace");
-    let runWorkspace = wsProvider ? workspaceRoot : process.env["KB_PROJECT_ROOT"] ?? workspaceRoot;
+    const wsProvider2 = platform2.getAdapter("workspace");
+    let runWorkspace = wsProvider2 ? workspaceRoot : process.env["KB_PROJECT_ROOT"] ?? workspaceRoot;
     let provisionedWorkspaceId;
-    if (wsProvider) {
+    if (wsProvider2) {
       const wsId = `wt_${run.id.slice(0, 8)}`;
       try {
-        const ws = await wsProvider.materialize({
+        const ws = await wsProvider2.materialize({
           workspaceId: wsId,
           sourceRef: "main",
           metadata: { runId: run.id, jobId: job.id },
@@ -150,11 +165,20 @@ async function createWorkflowWorker(options) {
     }
     const jobPromise = (async () => {
       try {
+        let wasCancelled = false;
         for (const step of job.steps) {
           if (step.status === "success") {
             continue;
           }
           const freshRun = await engine.getRun(run.id);
+          if (freshRun?.status === "cancelled") {
+            jobLogger.info("[worker] Run cancelled \u2014 stopping step execution", {
+              runId: run.id,
+              jobId: job.id
+            });
+            wasCancelled = true;
+            break;
+          }
           const exprCtx = {
             env: freshRun?.env ?? {},
             trigger: freshRun?.trigger ?? { type: "manual" },
@@ -181,11 +205,18 @@ async function createWorkflowWorker(options) {
             const rawExpr = condition.trim().replace(/^\$\{\{\s*/, "").replace(/\s*\}\}$/, "");
             const shouldRun = evaluateExpression(rawExpr, exprCtx);
             if (!shouldRun) {
-              jobLogger.info("Step skipped (condition false)", {
+              jobLogger.info("[step] Skipped: condition evaluated to false", {
                 runId: run.id,
                 jobId: job.id,
                 stepId: step.id,
-                condition
+                stepName: step.name,
+                stepIndex: step.index,
+                condition: rawExpr,
+                evaluatedContext: {
+                  inputs: exprCtx.inputs,
+                  steps: exprCtx.steps,
+                  env: exprCtx.env
+                }
               });
               await engine.markStepCompleted(run.id, job.id, step.id, { skipped: true });
               continue;
@@ -204,7 +235,25 @@ async function createWorkflowWorker(options) {
               }
             });
           }
-          const interpolatedWith = step.spec.with ? interpolateObject(step.spec.with, exprCtx) : void 0;
+          let interpolatedWith = step.spec.with ? interpolateObject(step.spec.with, exprCtx) : void 0;
+          if (step.spec.uses === "builtin:shell" && typeof step.spec.with?.["command"] === "string") {
+            const rawCommand = step.spec.with["command"];
+            const { command: safeCommand, shellEnvVars } = buildShellSafeCommand(rawCommand, exprCtx);
+            interpolatedWith = {
+              ...interpolatedWith ?? {},
+              command: safeCommand,
+              env: {
+                ...Object.fromEntries(
+                  Object.entries(interpolatedWith?.["env"] ?? {}).map(([k, v]) => [k, coerceToString(v)])
+                ),
+                ...shellEnvVars
+              }
+            };
+          }
+          const interpolatedEnvRaw = step.spec.env ? interpolateObject(step.spec.env, exprCtx) : void 0;
+          const interpolatedEnv = interpolatedEnvRaw ? Object.fromEntries(
+            Object.entries(interpolatedEnvRaw).map(([k, v]) => [k, coerceToString(v)])
+          ) : void 0;
           if (debugMode && step.spec.with) {
             jobLogger.info("[debug] Step input interpolation", {
               runId: run.id,
@@ -218,7 +267,9 @@ async function createWorkflowWorker(options) {
           const stepLogger = jobLogger.child({
             operation: "workflow.step",
             stepId: step.id,
-            attempt: 1,
+            stepName: step.name,
+            stepIndex: step.index,
+            attempt: job.attempt ?? 1,
             executionId: stepExecutionId,
             spanId: stepExecutionId,
             invocationId: stepExecutionId
@@ -241,153 +292,88 @@ async function createWorkflowWorker(options) {
           });
           if (step.spec.uses === "builtin:approval") {
             if (step.status === "failed") {
-              stepLogger.info("Approval already rejected \u2014 skipping to gate", {
-                runId: run.id,
-                stepId: step.id
-              });
+              stepLogger.info("Approval already rejected \u2014 skipping to gate", { runId: run.id, stepId: step.id });
               continue;
             }
             if (step.status !== "waiting_approval") {
               await engine.markStepWaitingApproval(run.id, job.id, step.id);
             }
-            stepLogger.info("Waiting for approval", {
-              runId: run.id,
-              jobId: job.id,
-              stepId: step.id,
-              context: interpolatedWith
-            });
-            while (!stopRequested) {
-              await sleep(2e3);
-              const currentRun = await engine.getRun(run.id);
-              const currentJob = currentRun?.jobs.find((j) => j.id === job.id);
-              const currentStep = currentJob?.steps.find((s) => s.id === step.id);
-              if (!currentStep || currentStep.status === "success") {
-                stepLogger.info("Approval granted", { runId: run.id, stepId: step.id });
-                break;
-              }
-              if (currentStep.status === "failed") {
-                stepLogger.info("Approval rejected", { runId: run.id, stepId: step.id });
-                break;
-              }
-            }
-            if (stopRequested) {
-              stepLogger.info("Approval wait interrupted by shutdown", { stepId: step.id });
+            const approvalResult = await waitForApproval(
+              engine,
+              run.id,
+              job.id,
+              step,
+              interpolatedWith,
+              () => stopRequested,
+              stepLogger
+            );
+            if (approvalResult === "interrupted") {
               return;
             }
             continue;
           }
           if (step.spec.uses === "builtin:gate") {
             const gateInput = interpolatedWith ?? {};
-            const decisionPath = gateInput.decision;
-            const maxIterations = gateInput.maxIterations ?? 3;
-            const decisionValue = resolveValue(decisionPath, exprCtx);
-            const decisionKey = String(decisionValue);
-            const route = gateInput.routes[decisionKey] ?? gateInput.routes[decisionValue];
-            const action = route ?? gateInput.default ?? "fail";
-            stepLogger.info("Gate evaluation", {
+            const currentIteration = step.metadata?.["iterations"] ?? 0;
+            const sameJobStepIds = job.steps.flatMap(
+              (s) => [s.id, s.spec.id].filter((v) => typeof v === "string")
+            );
+            const jobNames = (freshRun?.jobs ?? run.jobs).map((j) => j.jobName);
+            const validRestartTargets = [...sameJobStepIds, ...jobNames];
+            const decision = new GateHandler().handle(gateInput, exprCtx, currentIteration, validRestartTargets);
+            stepLogger.info("[gate] Evaluating gate decision", {
               runId: run.id,
               stepId: step.id,
-              decision: decisionPath,
-              decisionValue,
-              action: typeof action === "string" ? action : "restart"
+              stepName: step.name,
+              expression: gateInput.decision,
+              action: decision.action,
+              iteration: currentIteration
             });
-            const iterationKey = `gate:${step.spec.id ?? step.id}:iterations`;
-            const metadata = freshRun?.metadata ?? {};
-            const currentIteration = metadata[iterationKey] ?? 0;
-            if (action === "continue") {
-              await engine.markStepCompleted(run.id, job.id, step.id, {
-                decisionValue,
-                action: "continue",
-                iteration: currentIteration
-              });
+            if (decision.action === "continue") {
+              await engine.markStepCompleted(run.id, job.id, step.id, decision.outputs);
               continue;
             }
-            if (action === "fail") {
-              const error = new Error(`Gate failed: decision=${decisionKey}`);
-              await engine.markStepFailed(run.id, job.id, step.id, error, {
-                decisionValue,
-                action: "fail",
-                iteration: currentIteration
-              });
-              throw error;
-            }
-            const restartAction = action;
-            const nextIteration = currentIteration + 1;
-            if (nextIteration >= maxIterations) {
-              const error = new Error(
-                `Gate max iterations reached (${maxIterations}) for step ${step.spec.id ?? step.id}`
-              );
-              await engine.markStepFailed(run.id, job.id, step.id, error, {
-                decisionValue,
-                action: "fail",
-                maxIterationsReached: true,
-                iteration: currentIteration,
-                maxIterations
+            if (decision.action === "fail") {
+              stepLogger.error("[gate] Gate condition failed, aborting job", decision.error, {
+                runId: run.id,
+                stepId: step.id,
+                stepName: step.name
               });
-              throw error;
+              await engine.markStepFailed(run.id, job.id, step.id, decision.error, decision.outputs);
+              throw decision.error;
             }
-            stepLogger.info("Gate triggering restart", {
-              restartFrom: restartAction.restartFrom,
-              iteration: nextIteration,
-              maxIterations
-            });
-            await engine.markStepCompleted(run.id, job.id, step.id, {
-              decisionValue,
-              action: "restart",
-              restartFrom: restartAction.restartFrom,
-              iteration: nextIteration
-            });
-            await engine.updateRun(run.id, (draft) => {
-              const md = draft.metadata ?? {};
-              md[iterationKey] = nextIteration;
-              draft.metadata = md;
-              if (restartAction.context) {
-                const payload = draft.trigger.payload ?? {};
-                Object.assign(payload, restartAction.context);
-                draft.trigger.payload = payload;
-              }
-              return draft;
-            });
-            const stateStore = engine.getStateStore();
-            const scheduler = engine.getScheduler();
-            let foundTarget = false;
-            for (const s of job.steps) {
-              if (s.spec.id === restartAction.restartFrom || s.id === restartAction.restartFrom) {
-                foundTarget = true;
-              }
-              if (foundTarget) {
-                await stateStore.updateStep(run.id, job.id, s.id, (draft) => {
-                  draft.status = "queued";
-                  draft.startedAt = void 0;
-                  draft.finishedAt = void 0;
-                  draft.error = void 0;
-                  draft.outputs = void 0;
-                });
-              }
-            }
-            await stateStore.updateJob(run.id, job.id, (draft) => {
-              draft.status = "queued";
-              draft.startedAt = void 0;
-              draft.finishedAt = void 0;
-            });
-            const updatedRun = await engine.getRun(run.id);
-            const updatedJob = updatedRun?.jobs.find((j) => j.id === job.id);
-            if (updatedJob) {
-              await scheduler.enqueueJob(run.id, updatedJob, updatedJob.priority ?? "normal");
+            if (decision.action === "skip") {
+              await applyGateSkip(engine, run, job, step, decision, stepLogger);
+              return;
             }
+            await applyGateRestart(engine, run, job, step, decision, stepLogger);
             return;
           }
+          const stepStartTime = Date.now();
           await engine.markStepStarted(run.id, job.id, step.id);
           let baseSpec = step.spec;
           if (baseSpec.run && !baseSpec.uses) {
             const { run: rawRun, with: existingWith, ...rest } = baseSpec;
-            const command = typeof rawRun === "string" ? interpolateString(rawRun, exprCtx) : rawRun;
-            baseSpec = { ...rest, uses: "builtin:shell", with: { ...existingWith, command } };
+            const { command, shellEnvVars } = typeof rawRun === "string" ? buildShellSafeCommand(rawRun, exprCtx) : { command: rawRun, shellEnvVars: {} };
+            baseSpec = {
+              ...rest,
+              uses: "builtin:shell",
+              with: { ...existingWith, command, env: { ...existingWith?.["env"] ?? {}, ...shellEnvVars } }
+            };
           }
           if (typeof baseSpec.summary === "string") {
             baseSpec.summary = interpolateString(baseSpec.summary, exprCtx);
           }
-          const interpolatedSpec = interpolatedWith ? { ...baseSpec, with: { ...baseSpec.with ?? {}, ...interpolatedWith } } : baseSpec;
+          const specWithEnv = interpolatedEnv ? { ...baseSpec, with: { ...baseSpec.with ?? {}, env: { ...baseSpec.with?.["env"] ?? {}, ...interpolatedEnv } } } : baseSpec;
+          const interpolatedSpec = interpolatedWith ? {
+            ...specWithEnv,
+            with: {
+              ...specWithEnv.with ?? {},
+              ...interpolatedWith,
+              // spec.env (interpolatedEnv) must survive the spread of interpolatedWith.env
+              ...interpolatedEnv ? { env: { ...interpolatedWith["env"] ?? {}, ...interpolatedEnv } } : {}
+            }
+          } : specWithEnv;
           const result = await runner.execute({
             spec: interpolatedSpec,
             context: {
@@ -395,9 +381,25 @@ async function createWorkflowWorker(options) {
               jobId: job.id,
               stepId: step.id,
               attempt: 1,
-              env: freshRun?.env || {},
-              secrets: {},
-              // TODO: map run.secrets array to Record
+              env: {
+                // KB_PLATFORM_ROOT: where platform code (dist/, node_modules) lives.
+                // Shell steps can use this to reference platform commands when the
+                // worktree doesn't have compiled dist/ directories.
+                KB_PLATFORM_ROOT: workspaceRoot,
+                // KB_WORKSPACE_ROOT: the worktree (or project dir when no worktree is used).
+                // Scripts cd into this path before invoking agents or running git commands.
+                KB_WORKSPACE_ROOT: runWorkspace,
+                ...freshRun?.env || {}
+              },
+              // Secrets resolution not yet implemented: run.secrets contains names only.
+              // When a platform secrets store is available, resolve names → values here.
+              secrets: (() => {
+                const names = freshRun?.secrets ?? [];
+                if (names.length > 0) {
+                  stepLogger.warn("Step declares secrets but secret resolution is not implemented", { secrets: names });
+                }
+                return {};
+              })(),
               logger: {
                 debug: (message, meta) => stepLogger.debug(message, meta),
                 info: (message, meta) => stepLogger.info(message, meta),
@@ -409,21 +411,55 @@ async function createWorkflowWorker(options) {
                 spanId: stepExecutionId,
                 parentSpanId: job.id
               },
+              // stepLogger as loggerOverride: ctx.logger.* in the plugin will use stepLogger
+              // as its base, writing to SQLite with runId/jobId/stepId context.
+              // See: plugins/workflow/docs/adr/0019-log-stream-separation.md
+              loggerOverride: stepLogger,
+              // ui/shell log entries: persist to SQLite with workflow context + publish for SSE.
+              // See: plugins/workflow/docs/adr/0019-log-stream-separation.md
               onLog: (entry2) => {
-                void engine.publishLog(run.id, job.id, step.id, entry2);
+                stepLogger.info(entry2.message, {
+                  stream: entry2.stream,
+                  lineNo: entry2.lineNo,
+                  logSource: entry2.stream === "stderr" ? "stderr" : "stdout"
+                });
+                void engine.publishLog(run.id, job.id, step.id, entry2, step.name);
+              },
+              // ctx.logger.* entries: stepLogger base already wrote to SQLite. Only publish for SSE.
+              // See: plugins/workflow/docs/adr/0019-log-stream-separation.md
+              onLoggerLog: (entry2) => {
+                void engine.publishLog(run.id, job.id, step.id, entry2, step.name);
               }
             },
-            workspace: runWorkspace,
+            // Scripts (.kb/workflows/scripts/*.sh) live in the project root, not the worktree.
+            // Use workspaceRoot as cwd so relative paths like `bash .kb/workflows/scripts/...`
+            // resolve correctly. Scripts that need to operate inside the worktree cd into
+            // KB_WORKSPACE_ROOT themselves (agent scripts, git operations).
+            workspace: workspaceRoot,
             target
           });
           if (result.status === "failed") {
+            const stepDurationMs = Date.now() - stepStartTime;
             const error = new Error(result.error?.message ?? "Step execution failed");
             await engine.markStepFailed(run.id, job.id, step.id, error);
             stepLogger.error("Step failed", error, {
               runId: run.id,
               jobId: job.id,
-              stepId: step.id
+              stepId: step.id,
+              stepName: step.name,
+              uses: step.spec.uses,
+              durationMs: stepDurationMs,
+              resolvedInputs: interpolatedWith,
+              errorCode: result.error?.code
             });
+            if (step.continueOnError) {
+              stepLogger.warn("[step] continueOnError=true \u2014 continuing despite failure", {
+                runId: run.id,
+                jobId: job.id,
+                stepId: step.id
+              });
+              continue;
+            }
             throw error;
           }
           const stepOutputs = result.status === "success" ? result.outputs : void 0;
@@ -442,6 +478,14 @@ async function createWorkflowWorker(options) {
             });
           }
         }
+        if (wasCancelled) {
+          await engine.markJobInterrupted(run.id, job.id);
+          jobLogger.info("Job interrupted due to run cancellation", {
+            runId: run.id,
+            jobId: job.id
+          });
+          return;
+        }
         await engine.markJobCompleted(run.id, job.id);
         const jobDuration = Date.now() - jobStartTime;
         jobLogger.info("Job completed successfully", {
@@ -456,9 +500,9 @@ async function createWorkflowWorker(options) {
           stepCount: job.steps.length
         }).catch(() => {
         });
-        if (provisionedWorkspaceId && wsProvider) {
+        if (provisionedWorkspaceId && wsProvider2) {
           try {
-            await wsProvider.release(provisionedWorkspaceId);
+            await wsProvider2.release(provisionedWorkspaceId);
             jobLogger.info("Workspace released", { workspaceId: provisionedWorkspaceId });
           } catch (releaseErr) {
             jobLogger.warn("Workspace release failed", {
@@ -597,6 +641,231 @@ function sleep(ms) {
     setTimeout(resolve, ms);
   });
 }
+async function waitForApproval(engine, runId, jobId, step, interpolatedWith, isStopRequested, stepLogger) {
+  const approvalTimeoutMs = interpolatedWith?.["timeoutMs"];
+  if (!approvalTimeoutMs) {
+    stepLogger.warn("[approval] No timeout configured \u2014 approval may wait indefinitely", {
+      runId,
+      jobId,
+      stepId: step.id,
+      stepName: step.name
+    });
+  }
+  stepLogger.info("[approval] Waiting for approval", {
+    runId,
+    jobId,
+    stepId: step.id,
+    stepName: step.name,
+    context: interpolatedWith
+  });
+  const approvalStartMs = Date.now();
+  let pollCount = 0;
+  while (!isStopRequested()) {
+    await sleep(2e3);
+    pollCount++;
+    const currentRun = await engine.getRun(runId);
+    if (currentRun?.status === "cancelled") {
+      stepLogger.info("[approval] Run cancelled \u2014 treating as interrupted, NOT approved", {
+        runId,
+        stepId: step.id,
+        stepName: step.name,
+        waitedMs: Date.now() - approvalStartMs
+      });
+      return "interrupted";
+    }
+    const currentJob = currentRun?.jobs.find((j) => j.id === jobId);
+    const currentStep = currentJob?.steps.find((s) => s.id === step.id);
+    if (!currentStep || currentStep.status === "success") {
+      stepLogger.info("[approval] Approval granted", {
+        runId,
+        stepId: step.id,
+        stepName: step.name,
+        waitedMs: Date.now() - approvalStartMs
+      });
+      break;
+    }
+    if (currentStep.status === "failed") {
+      stepLogger.info("[approval] Approval rejected", {
+        runId,
+        stepId: step.id,
+        stepName: step.name,
+        waitedMs: Date.now() - approvalStartMs
+      });
+      break;
+    }
+    if (pollCount % 10 === 0) {
+      stepLogger.info("[approval] Still waiting for approval", {
+        runId,
+        stepId: step.id,
+        stepName: step.name,
+        waitedMs: Date.now() - approvalStartMs,
+        pollCount
+      });
+    }
+  }
+  if (isStopRequested()) {
+    stepLogger.info("Approval wait interrupted by shutdown", { stepId: step.id });
+    return "interrupted";
+  }
+  return "done";
+}
+async function applyGateSkip(engine, run, job, step, decision, stepLogger) {
+  const { skipTo, outputs } = decision;
+  stepLogger.info("[gate] Gate triggered skip-forward", {
+    runId: run.id,
+    stepId: step.id,
+    stepName: step.name,
+    skipTo
+  });
+  const stateStore = engine.getStateStore();
+  const scheduler = engine.getScheduler();
+  await engine.markStepCompleted(run.id, job.id, step.id, outputs);
+  let pastGate = false;
+  for (const s of job.steps) {
+    if (s.id === step.id) {
+      pastGate = true;
+      continue;
+    }
+    if (!pastGate) {
+      continue;
+    }
+    if (s.spec.id === skipTo || s.id === skipTo) {
+      break;
+    }
+    await stateStore.updateStep(run.id, job.id, s.id, (draft) => {
+      draft.status = "success";
+      draft.outputs = { skipped: true };
+      draft.startedAt = (/* @__PURE__ */ new Date()).toISOString();
+      draft.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+    });
+  }
+  const freshRun = await engine.getRun(run.id);
+  const freshJob = freshRun?.jobs.find((j) => j.id === job.id);
+  if (freshJob) {
+    await scheduler.enqueueJob(run.id, freshJob, freshJob.priority ?? "normal");
+  }
+  stepLogger.info("[gate] Skip applied \u2014 re-enqueued job at skipTo target", {
+    runId: run.id,
+    skipTo
+  });
+}
+async function applyGateRestart(engine, run, job, step, decision, stepLogger) {
+  const { restartFrom, context, outputs, nextIteration } = decision;
+  const stepsToReset = [];
+  for (const s of job.steps) {
+    if (s.spec.id === restartFrom || s.id === restartFrom) {
+      stepsToReset.push(s.name ?? s.id);
+    } else if (stepsToReset.length > 0) {
+      stepsToReset.push(s.name ?? s.id);
+    }
+  }
+  stepLogger.warn("[gate] Gate triggered restart", {
+    runId: run.id,
+    stepId: step.id,
+    stepName: step.name,
+    restartFrom,
+    iteration: nextIteration,
+    stepsToReset
+  });
+  const stateStore = engine.getStateStore();
+  const scheduler = engine.getScheduler();
+  await stateStore.updateStep(run.id, job.id, step.id, (draft) => {
+    draft.metadata = { ...draft.metadata ?? {}, iterations: nextIteration };
+  });
+  if (context) {
+    await engine.updateRun(run.id, (draft) => {
+      const payload = draft.trigger.payload ?? {};
+      Object.assign(payload, context);
+      draft.trigger.payload = payload;
+      return draft;
+    });
+  }
+  const sameJobTarget = job.steps.some((s) => s.spec.id === restartFrom || s.id === restartFrom);
+  if (!sameJobTarget) {
+    const fresh = await engine.getRun(run.id) ?? run;
+    const resetNames = /* @__PURE__ */ new Set([restartFrom]);
+    let changed = true;
+    while (changed) {
+      changed = false;
+      for (const j of fresh.jobs) {
+        if (resetNames.has(j.jobName)) {
+          continue;
+        }
+        if ((j.needs ?? []).some((n) => resetNames.has(n))) {
+          resetNames.add(j.jobName);
+          changed = true;
+        }
+      }
+    }
+    for (const rj of fresh.jobs) {
+      if (!resetNames.has(rj.jobName)) {
+        continue;
+      }
+      const pending = (rj.needs ?? []).filter((n) => resetNames.has(n));
+      for (const s of rj.steps) {
+        await stateStore.updateStep(run.id, rj.id, s.id, (draft) => {
+          draft.status = "queued";
+          draft.startedAt = void 0;
+          draft.finishedAt = void 0;
+          draft.error = void 0;
+          draft.outputs = void 0;
+        });
+      }
+      await stateStore.updateJob(run.id, rj.id, (draft) => {
+        draft.status = "queued";
+        draft.startedAt = void 0;
+        draft.finishedAt = void 0;
+        draft.pendingDependencies = [...pending];
+        draft.blocked = pending.length > 0;
+      });
+    }
+    const refreshed = await engine.getRun(run.id);
+    const targetJob = refreshed?.jobs.find((j) => j.jobName === restartFrom);
+    if (targetJob && !targetJob.blocked) {
+      await scheduler.enqueueJob(run.id, targetJob, targetJob.priority ?? "normal");
+    }
+    stepLogger.warn("[gate] Cross-job restart re-enqueued target", {
+      runId: run.id,
+      restartFrom,
+      iteration: nextIteration,
+      resetJobs: [...resetNames]
+    });
+    return;
+  }
+  await engine.markStepCompleted(run.id, job.id, step.id, outputs);
+  let foundTarget = false;
+  for (const s of job.steps) {
+    if (s.spec.id === restartFrom || s.id === restartFrom) {
+      foundTarget = true;
+    }
+    if (foundTarget) {
+      await stateStore.updateStep(run.id, job.id, s.id, (draft) => {
+        draft.status = "queued";
+        draft.startedAt = void 0;
+        draft.finishedAt = void 0;
+        draft.error = void 0;
+        draft.outputs = void 0;
+      });
+    }
+  }
+  await stateStore.updateJob(run.id, job.id, (draft) => {
+    draft.status = "queued";
+    draft.startedAt = void 0;
+    draft.finishedAt = void 0;
+  });
+  const updatedRun = await engine.getRun(run.id);
+  const updatedJob = updatedRun?.jobs.find((j) => j.id === job.id);
+  if (updatedJob) {
+    await scheduler.enqueueJob(run.id, updatedJob, updatedJob.priority ?? "normal");
+    stepLogger.info("[gate] Job re-enqueued for restart", {
+      runId: run.id,
+      jobId: job.id,
+      jobName: job.jobName,
+      iteration: nextIteration,
+      restartFrom
+    });
+  }
+}
 function inferWorkspaceProvisionReasonCode(message) {
   return /ETIMEDOUT|timeout/iu.test(message) ? "workspace_provision_timeout" : "workspace_provision_failed";
 }
@@ -633,7 +902,6 @@ var JobBroker = class {
               id: "execute",
               name: "Execute handler",
               uses,
-              // @ts-expect-error - WorkflowSpec step.with type mismatch
               with: request.input ?? {}
             }
           ]
@@ -641,6 +909,7 @@ var JobBroker = class {
       }
     };
     const run = await this.engine.runFromInline(spec, {
+      trigger: { type: "manual" },
       env: {},
       metadata: request.metadata
     });
@@ -651,20 +920,6 @@ var JobBroker = class {
     });
     return run;
   }
-  /**
-   * Schedule a recurring job with cron expression.
-   * Registers job with CronScheduler (if available).
-   *
-   * NOTE: CronScheduler integration not yet implemented.
-   * This is a placeholder for future implementation.
-   */
-  async schedule(request) {
-    this.logger.warn("CronScheduler not yet implemented", {
-      handler: request.handler,
-      cron: request.cron
-    });
-    throw new Error("CronScheduler not yet implemented");
-  }
   /**
    * Get job status by run ID.
    */
@@ -701,22 +956,38 @@ var JobBroker = class {
     if (!run) {
       return [];
     }
+    const stepNameMap = /* @__PURE__ */ new Map();
+    for (const job of run.jobs ?? []) {
+      for (const step of job.steps ?? []) {
+        if (step.id && step.name) {
+          stepNameMap.set(step.id, step.name);
+        }
+      }
+    }
     const limit = options?.limit ?? 100;
     const offset = options?.offset ?? 0;
     const startTime = run.startedAt ? new Date(run.startedAt).getTime() : Date.now() - 36e5;
     const endTime = run.finishedAt ? new Date(run.finishedAt).getTime() : Date.now();
-    const queryResult = await this.platform.logs.query(
-      {
-        from: startTime,
-        to: endTime,
-        level: options?.level && options.level !== "all" ? options.level : void 0
-      },
-      {
-        limit: 2e3,
-        offset: 0
+    let queryResult = { logs: [] };
+    try {
+      queryResult = await this.platform.logs.query(
+        {
+          from: startTime,
+          to: endTime,
+          level: options?.level && options.level !== "all" ? options.level : void 0
+        },
+        {
+          limit: 2e3,
+          offset: 0
+        }
+      );
+    } catch {
+      this.logger.warn("Log backend unavailable \u2014 returning empty log list for run", { runId });
+    }
+    const filtered = (queryResult.logs ?? []).filter((log) => {
+      if (!log.fields) {
+        return false;
       }
-    );
-    const filtered = queryResult.logs.filter((log) => {
       if (log.fields["runId"] !== runId) {
         return false;
       }
@@ -727,12 +998,18 @@ var JobBroker = class {
     });
     filtered.sort((a, b) => a.timestamp - b.timestamp);
     const page = filtered.slice(offset, offset + limit);
-    return page.map((log) => ({
-      timestamp: new Date(log.timestamp).toISOString(),
-      level: log.level,
-      message: log.message,
-      context: log.fields
-    }));
+    return page.map((log) => {
+      const stepId = log.fields["stepId"];
+      return {
+        timestamp: new Date(log.timestamp).toISOString(),
+        level: log.level,
+        message: log.message,
+        stepId,
+        stepName: stepId ? stepNameMap.get(stepId) : void 0,
+        stream: log.fields["logSource"],
+        context: log.fields
+      };
+    });
   }
 };
 var CronScheduler = class {
@@ -920,7 +1197,6 @@ var CronScheduler = class {
           jobs: job.workflowSpec.jobs,
           env: job.workflowSpec.env
         };
-        console.log("\u{1F50D} CRON SPEC:", JSON.stringify(spec, null, 2));
         this.logger.debug("Running workflow from cron", {
           cronJobId,
           spec: JSON.stringify(spec, null, 2)
@@ -1135,6 +1411,23 @@ var CronScheduler = class {
     });
     this.registeredJobs.clear();
   }
+  /**
+   * Unregister all user-sourced cron jobs (source === 'user'), stopping their
+   * scheduled tasks. Safe to call while the scheduler is running — jobs are
+   * stopped and removed so they can be re-registered by a fresh discovery pass.
+   */
+  clearUserJobs() {
+    const userJobIds = Array.from(this.registeredJobs.keys()).filter((id) => id.startsWith("user:"));
+    for (const cronJobId of userJobIds) {
+      const task = this.scheduledTasks.get(cronJobId);
+      if (task) {
+        task.stop();
+        this.scheduledTasks.delete(cronJobId);
+      }
+      this.registeredJobs.delete(cronJobId);
+    }
+    this.logger.info("Cleared user cron jobs", { count: userJobIds.length });
+  }
 };
 var CronDiscovery = class {
   cliApi;
@@ -1250,6 +1543,92 @@ var CronDiscovery = class {
     return count;
   }
 };
+var WorkflowFileWatcher = class {
+  watchers = [];
+  workflowService;
+  cronDiscovery;
+  cronScheduler;
+  logger;
+  debounceMs;
+  debounceTimer = null;
+  constructor(options) {
+    this.workflowService = options.workflowService;
+    this.cronDiscovery = options.cronDiscovery;
+    this.cronScheduler = options.cronScheduler;
+    this.logger = options.logger;
+    this.debounceMs = options.debounceMs ?? 300;
+    for (const dir of options.watchDirs) {
+      this.startWatcher(dir);
+    }
+  }
+  startWatcher(dir) {
+    access(dir).then(() => {
+      try {
+        const watcher = watch(dir, { persistent: false }, (eventType, filename) => {
+          if (!filename) {
+            return;
+          }
+          if (!filename.endsWith(".yml") && !filename.endsWith(".yaml")) {
+            return;
+          }
+          this.scheduleReload(dir, filename);
+        });
+        watcher.on("error", (err) => {
+          this.logger.warn("WorkflowFileWatcher: watcher error", {
+            dir,
+            error: err instanceof Error ? err.message : String(err)
+          });
+        });
+        this.watchers.push(watcher);
+        this.logger.info("WorkflowFileWatcher: watching directory", { dir });
+      } catch (err) {
+        this.logger.warn("WorkflowFileWatcher: could not start watcher", {
+          dir,
+          error: err instanceof Error ? err.message : String(err)
+        });
+      }
+    }).catch(() => {
+      this.logger.debug("WorkflowFileWatcher: directory does not exist, skipping", { dir });
+    });
+  }
+  scheduleReload(dir, filename) {
+    if (this.debounceTimer) {
+      clearTimeout(this.debounceTimer);
+    }
+    this.debounceTimer = setTimeout(() => {
+      this.debounceTimer = null;
+      this.reload(dir, filename).catch((err) => {
+        this.logger.error(
+          "WorkflowFileWatcher: reload failed",
+          err instanceof Error ? err : void 0,
+          { dir, filename }
+        );
+      });
+    }, this.debounceMs);
+  }
+  async reload(dir, filename) {
+    this.logger.info("WorkflowFileWatcher: YAML change detected, reloading", { dir, filename });
+    await this.workflowService.refreshManifests();
+    this.cronScheduler.clearUserJobs();
+    const discovered = await this.cronDiscovery.discoverAll();
+    this.logger.info("WorkflowFileWatcher: reload complete", {
+      filename,
+      cronJobs: discovered
+    });
+  }
+  /** Stop all watchers and cancel any pending debounce timer. */
+  close() {
+    if (this.debounceTimer) {
+      clearTimeout(this.debounceTimer);
+      this.debounceTimer = null;
+    }
+    for (const watcher of this.watchers) {
+      watcher.close();
+    }
+    this.watchers.length = 0;
+    this.logger.info("WorkflowFileWatcher: stopped");
+  }
+};
 
 // src/host/workflow-host-service.ts
 var TENANT_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
@@ -1349,7 +1728,11 @@ var WorkflowHostService = class {
     return logs;
   }
   async getRunLogs(runId, options) {
-    const logs = await this.options.jobBroker.getRunLogs(runId, options);
+    const resolved = await this.resolveRunId(runId);
+    if (!resolved) {
+      throw new Error("Run not found");
+    }
+    const logs = await this.options.jobBroker.getRunLogs(resolved, options);
     return logs;
   }
   async cancelJob(tenantId, jobId) {
@@ -1373,8 +1756,8 @@ var WorkflowHostService = class {
       error: run.result?.error?.message
     }));
     if (type) {
-      const pattern = type.replace(/\*/g, ".*");
-      const regex = new RegExp(`^${pattern}$`);
+      const escaped = type.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+      const regex = new RegExp(`^${escaped}$`);
       jobs = jobs.filter((job) => regex.test(job.type));
     }
     if (status) {
@@ -1429,6 +1812,15 @@ var WorkflowHostService = class {
     const triggerType = request.trigger?.type === "cron" ? "schedule" : request.trigger?.type === "api" ? "webhook" : "manual";
     const specInputDefs = specInput["inputs"] ?? {};
     const userInputs = request.inputs ?? (request.input && typeof request.input === "object" ? request.input : {});
+    const missingRequired = [];
+    for (const [key, def] of Object.entries(specInputDefs)) {
+      if (def.required && !(key in userInputs) && def.default === void 0) {
+        missingRequired.push(key);
+      }
+    }
+    if (missingRequired.length > 0) {
+      throw new Error(`Missing required input(s): ${missingRequired.join(", ")}`);
+    }
     const resolvedInputs = {};
     for (const [key, def] of Object.entries(specInputDefs)) {
       resolvedInputs[key] = key in userInputs ? userInputs[key] : def.default;
@@ -1446,6 +1838,109 @@ var WorkflowHostService = class {
       status: run.status
     };
   }
+  async rerunWorkflow(runId, request) {
+    const resolved = await this.resolveRunId(runId);
+    const sourceRun = resolved ? await this.options.engine.getRun(resolved) : null;
+    if (!sourceRun) {
+      throw new Error("Run not found");
+    }
+    if (request.failedOnly) {
+      return this.rerunFailedOnly(sourceRun.id, sourceRun);
+    }
+    const workflowId = sourceRun.metadata?.["workflowId"] ?? sourceRun.name;
+    const workflowService = this.requireWorkflowService();
+    const workflow = await workflowService.get(workflowId);
+    if (!workflow) {
+      throw new Error("Workflow not found");
+    }
+    const specInput = workflow.input;
+    const spec = {
+      ...specInput
+    };
+    const resolvedInputs = sourceRun.inputs ?? {};
+    const run = await this.options.engine.runFromSpec(spec, {
+      trigger: {
+        type: "manual",
+        actor: "cli-rerun",
+        payload: resolvedInputs
+      },
+      inputs: resolvedInputs
+    });
+    return {
+      runId: run.id,
+      status: run.status
+    };
+  }
+  /**
+   * failedOnly reruns resume from the source run's snapshot instead of
+   * starting a brand-new run (via runFromSpec + a job-filtered spec), so
+   * completed step outputs from jobs that are not being rerun are carried
+   * forward into the interpolation context instead of being discarded
+   * (see issue #263: `rerun --failed-only` used to redo the whole run).
+   */
+  async rerunFailedOnly(resolvedRunId, sourceRun) {
+    const failedJobNames = new Set(
+      (sourceRun.jobs ?? []).filter((job) => job.status === "failed" || job.status === "interrupted").map((job) => job.jobName)
+    );
+    if (failedJobNames.size === 0) {
+      throw new Error("No failed jobs to rerun");
+    }
+    let fromStepId;
+    for (const job of sourceRun.jobs ?? []) {
+      if (!failedJobNames.has(job.jobName)) {
+        continue;
+      }
+      const unfinishedStep = (job.steps ?? []).find(
+        (s) => s.status !== "success" && s.status !== "skipped"
+      );
+      if (unfinishedStep) {
+        fromStepId = unfinishedStep.id;
+        break;
+      }
+    }
+    if (!fromStepId) {
+      throw new Error(`Cannot determine resume point: no failed step found in run ${sourceRun.id}`);
+    }
+    const run = await this.options.engine.replayRun(resolvedRunId, { fromStepId });
+    if (!run) {
+      throw new Error(
+        `No replay snapshot for run ${resolvedRunId} \u2014 cannot rerun failed steps only. Snapshots are created when a run finishes; check the workflow daemon logs for "Failed to create run snapshot" around that time.`
+      );
+    }
+    return {
+      runId: run.id,
+      status: run.status
+    };
+  }
+  async restartRun(runId, request) {
+    const resolved = await this.resolveRunId(runId);
+    if (!resolved) {
+      throw new Error(`Run not found: ${runId}`);
+    }
+    const currentRun = await this.options.engine.getRun(resolved);
+    if (!currentRun) {
+      throw new Error(`Run not found: ${resolved}`);
+    }
+    if (currentRun.status === "running" || currentRun.status === "queued") {
+      throw new Error(
+        `Cannot restart an active run (status: ${currentRun.status}); cancel it first`
+      );
+    }
+    const run = await this.options.engine.replayRun(resolved, {
+      fromStepId: request.fromStepId,
+      env: request.env
+    });
+    if (!run) {
+      throw new Error(
+        `No replay snapshot for run ${resolved} (status: ${currentRun.status}, finished: ${currentRun.finishedAt ?? "n/a"}). Snapshots are created when a run finishes; if this run finished but has no snapshot, check the workflow daemon logs for "Failed to create run snapshot" around that time.`
+      );
+    }
+    return {
+      runId: run.id,
+      status: run.status,
+      fromStepId: request.fromStepId
+    };
+  }
   registerCron(tenantId, request) {
     this.assertTenantId(tenantId);
     const scheduler = this.requireCronScheduler();
@@ -1580,11 +2075,28 @@ var WorkflowHostService = class {
       pluginId: workflow.pluginId,
       status: workflow.status === "active" ? "active" : "inactive",
       tags: workflow.tags,
-      inputs: workflow.inputSchema
+      inputs: workflow.inputSchema,
+      version: workflow.version,
+      updatedAt: workflow.updatedAt
     };
   }
+  async resolveRunId(idOrPrefix) {
+    const run = await this.options.engine.getRun(idOrPrefix);
+    if (run) {
+      return run.id;
+    }
+    if (idOrPrefix.length <= 8 && !idOrPrefix.includes("-")) {
+      const all = await this.options.engine.getAllRuns();
+      return all.find((r) => r.id.startsWith(idOrPrefix))?.id ?? null;
+    }
+    return null;
+  }
   async getRun(runId) {
-    return await this.options.engine.getRun(runId);
+    const resolved = await this.resolveRunId(runId);
+    if (!resolved) {
+      return null;
+    }
+    return await this.options.engine.getRun(resolved);
   }
   async listRuns(filters) {
     const allRuns = await this.options.engine.getAllRuns();
@@ -1592,21 +2104,40 @@ var WorkflowHostService = class {
     if (filters?.status) {
       runs = runs.filter((run) => run.status === filters.status);
     }
+    if (filters?.workflowId) {
+      runs = runs.filter((run) => run.name === filters.workflowId);
+    }
     runs.sort((a, b) => new Date(b.createdAt ?? 0).getTime() - new Date(a.createdAt ?? 0).getTime());
     const total = runs.length;
     const start = filters?.offset ?? 0;
     const end = filters?.limit ? start + filters.limit : runs.length;
-    return { runs: runs.slice(start, end), total };
+    const page = runs.slice(start, end).map((run) => {
+      const allSteps = (run.jobs ?? []).flatMap((j) => j.steps ?? []);
+      const activeSteps = allSteps.filter(
+        (s) => s.status === "running" || s.status === "waiting_approval"
+      );
+      let currentStepName;
+      if (run.status === "running" && activeSteps.length > 0) {
+        currentStepName = activeSteps.length === 1 ? activeSteps[0].name : `${activeSteps[0].name} (+${activeSteps.length - 1})`;
+      }
+      return {
+        ...run,
+        hasPendingApproval: run.status === "running" && allSteps.some((s) => s.status === "waiting_approval"),
+        currentStepName
+      };
+    });
+    return { runs: page, total };
   }
   async cancelRun(runId) {
-    const run = await this.options.engine.getRun(runId);
+    const resolved = await this.resolveRunId(runId);
+    const run = resolved ? await this.options.engine.getRun(resolved) : null;
     if (!run) {
       throw new Error("Run not found");
     }
     if (run.status !== "running" && run.status !== "queued") {
       throw new Error(`Cannot cancel run with status "${run.status}"`);
     }
-    await this.options.engine.cancelRun(runId);
+    await this.options.engine.cancelRun(resolved);
   }
   requireWorkflowService() {
     if (!this.options.workflowService) {
@@ -1908,7 +2439,7 @@ var KEEP_ALIVE_MS = 3e4;
 var IDLE_TIMEOUT_MS = 6e4;
 function registerWorkflowsAPI(options) {
   const { server, hostService, engine, workflowService, logger, observability } = options;
-  server.post("/api/v1/workflows/refresh", { schema: { tags: ["Workflows"], summary: "Reload workflow definitions from disk" } }, async () => {
+  const reloadHandler = async () => {
     try {
       logger.info("[workflows-api] Refreshing workflows from disk");
       if (workflowService) {
@@ -1923,7 +2454,9 @@ function registerWorkflowsAPI(options) {
       logger.error("[workflows-api] Failed to refresh workflows", error instanceof Error ? error : void 0);
       return { ok: false, error: error instanceof Error ? error.message : String(error) };
     }
-  });
+  };
+  server.post("/api/v1/workflows/reload", { schema: { tags: ["Workflows"], summary: "Reload workflow definitions from disk" } }, reloadHandler);
+  server.post("/api/v1/workflows/refresh", { schema: { tags: ["Workflows"], summary: "Reload workflow definitions from disk (alias for /reload)" } }, reloadHandler);
   server.get("/api/v1/workflows", { schema: { tags: ["Workflows"], summary: "List workflow definitions" } }, async (request, reply) => {
     try {
       const response = await observability.observeOperation("workflow.catalog.list", () => hostService.listWorkflows(request.query));
@@ -1974,6 +2507,9 @@ function registerWorkflowsAPI(options) {
       if (message === "Workflow not found") {
         return fail(reply, 404, message);
       }
+      if (message.startsWith("Missing required input")) {
+        return fail(reply, 400, message);
+      }
       logger.error("[workflows-api] Error running workflow", error instanceof Error ? error : void 0);
       return fail(reply, 500, message);
     }
@@ -1995,13 +2531,54 @@ function registerWorkflowsAPI(options) {
       return fail(reply, 500, message);
     }
   });
+  server.post("/api/v1/runs/:runId/rerun", { schema: { tags: ["Runs"], summary: "Rerun a workflow run" } }, async (request, reply) => {
+    try {
+      const { runId } = request.params;
+      const response = await observability.observeOperation(
+        "workflow.run.rerun",
+        () => hostService.rerunWorkflow(runId, request.body ?? {})
+      );
+      return ok(response);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Failed to rerun workflow";
+      if (message === "Run not found" || message === "Workflow not found") {
+        return fail(reply, 404, message);
+      }
+      if (message === "No failed jobs to rerun") {
+        return fail(reply, 400, message);
+      }
+      logger.error("[workflows-api] Error rerunning workflow", error instanceof Error ? error : void 0);
+      return fail(reply, 500, message);
+    }
+  });
+  server.post("/api/v1/runs/:runId/restart", { schema: { tags: ["Runs"], summary: "Restart a run from a specific step (snapshot-based)" } }, async (request, reply) => {
+    try {
+      const { runId } = request.params;
+      const response = await observability.observeOperation(
+        "workflow.run.restart",
+        () => hostService.restartRun(runId, request.body ?? {})
+      );
+      return ok(response);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Failed to restart run";
+      if (message.includes("not found") || message.includes("snapshot not available")) {
+        return fail(reply, 404, message);
+      }
+      if (message.startsWith("Cannot restart an active run")) {
+        return fail(reply, 409, message);
+      }
+      logger.error("[workflows-api] Error restarting run", error instanceof Error ? error : void 0);
+      return fail(reply, 500, message);
+    }
+  });
   server.get("/api/v1/runs", { schema: { tags: ["Runs"], summary: "List all workflow runs" } }, async (request, reply) => {
     try {
-      const { status, limit, offset } = request.query;
+      const { status, workflowId, limit, offset } = request.query;
       const response = await observability.observeOperation(
         "workflow.run.list",
         () => hostService.listRuns({
           status,
+          workflowId,
           limit: limit ? parseInt(limit, 10) : 50,
           offset: offset ? parseInt(offset, 10) : 0
         })
@@ -2053,7 +2630,8 @@ function registerWorkflowsAPI(options) {
     }
   );
   server.get("/api/v1/runs/:runId/events", { schema: { hide: true } }, async (request, reply) => {
-    const { runId } = request.params;
+    const { runId: rawId } = request.params;
+    const runId = await hostService.resolveRunId(rawId) ?? rawId;
     const run = await observability.observeOperation("workflow.run.events", () => engine.getRun(runId));
     if (!run) {
       return fail(reply, 404, "Run not found");
@@ -2074,7 +2652,7 @@ function registerWorkflowsAPI(options) {
       if (raw.writableEnded) {
         return;
       }
-      raw.write(`event: workflow.event
+      raw.write(`event: ${type}
 `);
       raw.write(`data: ${JSON.stringify({ type, runId, payload, timestamp: (/* @__PURE__ */ new Date()).toISOString() })}
 
@@ -2082,6 +2660,8 @@ function registerWorkflowsAPI(options) {
     };
     sendEvent("run.snapshot", run);
     if (TERMINAL_STATUSES.includes(run.status)) {
+      const terminalType = run.status === "success" ? "run.finished" : run.status === "failed" ? "run.failed" : "run.cancelled";
+      sendEvent(terminalType, run);
       raw.end();
       return;
     }
@@ -2125,11 +2705,11 @@ function registerWorkflowsAPI(options) {
 
 // src/api/approvals-api.ts
 function registerApprovalsAPI(options) {
-  const { server, engine, logger, observability } = options;
+  const { server, hostService, engine, logger, observability } = options;
   server.get("/api/v1/runs/:runId/approvals", { schema: { tags: ["Approvals"], summary: "List pending approvals for a run" } }, async (request, reply) => {
     try {
-      const { runId } = request.params;
-      const run = await observability.observeOperation("workflow.approval.list", () => engine.getRun(runId));
+      const { runId: rawId } = request.params;
+      const run = await observability.observeOperation("workflow.approval.list", () => hostService.getRun(rawId));
       if (!run) {
         return fail(reply, 404, "Run not found");
       }
@@ -2142,13 +2722,13 @@ function registerApprovalsAPI(options) {
               stepId: step.id,
               stepName: step.name,
               specId: step.spec.id,
-              context: step.spec.with ?? {},
+              context: step.resolvedInputs ?? step.spec.with ?? {},
               waitingSince: step.startedAt
             });
           }
         }
       }
-      return ok({ runId, pending });
+      return ok({ runId: run.id, pending });
     } catch (error) {
       logger.error("[approvals-api] Error listing pending approvals", error instanceof Error ? error : void 0);
       return fail(reply, 500, error instanceof Error ? error.message : "Failed to list pending approvals");
@@ -2156,7 +2736,7 @@ function registerApprovalsAPI(options) {
   });
   server.post("/api/v1/runs/:runId/approvals/resolve", { schema: { tags: ["Approvals"], summary: "Approve or reject a pending step" } }, async (request, reply) => {
     try {
-      const { runId } = request.params;
+      const { runId: rawId } = request.params;
       const { jobId, stepId, action, comment, data } = request.body;
       if (!jobId || !stepId || !action) {
         return fail(reply, 400, "Missing required fields: jobId, stepId, action");
@@ -2164,7 +2744,7 @@ function registerApprovalsAPI(options) {
       if (action !== "approve" && action !== "reject") {
         return fail(reply, 400, 'action must be "approve" or "reject"');
       }
-      const run = await observability.observeOperation("workflow.approval.get", () => engine.getRun(runId));
+      const run = await observability.observeOperation("workflow.approval.get", () => hostService.getRun(rawId));
       if (!run) {
         return fail(reply, 404, "Run not found");
       }
@@ -2181,17 +2761,17 @@ function registerApprovalsAPI(options) {
       }
       await observability.observeOperation(
         "workflow.approval.resolve",
-        () => engine.resolveApproval(runId, jobId, stepId, action, data, comment)
+        () => engine.resolveApproval(run.id, jobId, stepId, action, data, comment)
       );
       logger.info("[approvals-api] Approval resolved", {
-        runId,
+        runId: run.id,
         jobId,
         stepId,
         action,
         comment
       });
       return ok({
-        runId,
+        runId: run.id,
         jobId,
         stepId,
         action,
@@ -2278,169 +2858,128 @@ async function createServer(options) {
     cronScheduler,
     logger
   });
-  const server = Fastify({
-    logger: false,
-    // Use platform logger instead
-    bodyLimit: 1048576
-    // 1MB body limit (prevents parsing huge payloads)
-  });
   const isProduction = process.env.NODE_ENV === "production";
-  await registerOpenAPI(server, {
-    title: "KB Labs Workflow Daemon",
-    description: "Background job execution and workflow orchestration API",
-    version: "1.0.0",
-    servers: [{ url: "http://localhost:7778", description: "Local dev" }],
-    ui: !isProduction
-  });
-  const requireAuth = process.env.KB_DAEMON_REQUIRE_AUTH === "true" || isProduction;
+  const requireAuth = process.env.KB_DAEMON_REQUIRE_AUTH === "false" ? false : process.env.KB_DAEMON_REQUIRE_AUTH === "true" || isProduction;
   const daemonApiKey = process.env.KB_DAEMON_API_KEY;
+  const allowedOrigins = process.env.ALLOWED_ORIGINS?.split(",") ?? [
+    "http://localhost:3000",
+    "http://localhost:5173"
+  ];
+  if (requireAuth && !daemonApiKey) {
+    throw new Error(
+      "KB_DAEMON_API_KEY is required when daemon auth is enabled (KB_DAEMON_REQUIRE_AUTH=true or NODE_ENV=production)"
+    );
+  }
   const observability = new HttpObservabilityCollector({
     serviceId: "workflow",
     serviceType: "workflow-daemon",
     version: "1.0.0",
     logsSource: "workflow",
     dependencies: [
-      {
-        serviceId: "state-daemon",
-        required: false,
-        description: "Workflow run and job state storage"
-      }
+      { serviceId: "state-daemon", required: false, description: "Workflow run and job state storage" }
     ]
   });
-  if (requireAuth && !daemonApiKey) {
-    throw new Error(
-      "KB_DAEMON_API_KEY is required when daemon auth is enabled (KB_DAEMON_REQUIRE_AUTH=true or NODE_ENV=production)"
-    );
-  }
-  server.addHook("onRequest", async (request, reply) => {
-    if (!requireAuth) {
-      return;
-    }
-    if (request.url === "/health") {
-      return;
-    }
-    const apiKeyHeader = request.headers["x-api-key"];
-    const authHeader = request.headers.authorization;
-    const bearerToken = typeof authHeader === "string" && authHeader.startsWith("Bearer ") ? authHeader.slice("Bearer ".length).trim() : void 0;
-    const token = (typeof apiKeyHeader === "string" ? apiKeyHeader : void 0) ?? bearerToken;
-    if (!token || token !== daemonApiKey) {
-      reply.code(401).send({ ok: false, error: "Unauthorized" });
-    }
-  });
-  observability.register(server);
-  const allowedOrigins = process.env.ALLOWED_ORIGINS?.split(",") || [
-    "http://localhost:3000",
-    "http://localhost:5173"
-    // Vite dev server
-  ];
-  await server.register(cors, {
-    origin: (origin, callback) => {
-      if (!origin) {
-        const isDevelopment = process.env.NODE_ENV !== "production";
-        if (isDevelopment) {
-          callback(null, true);
+  return createDaemonServer({
+    serviceId: "workflow",
+    logger,
+    observability,
+    bodyLimit: 1048576,
+    skipStandardRoutes: true,
+    openapi: {
+      title: "KB Labs Workflow Daemon",
+      description: "Background job execution and workflow orchestration API"
+    },
+    cors: {
+      origin: (origin, callback) => {
+        if (!origin) {
+          const isDevelopment = process.env.KB_DAEMON_REQUIRE_AUTH === "false" || process.env.NODE_ENV !== "production";
+          if (isDevelopment) {
+            callback(null, true);
+          } else {
+            callback(new Error("Origin header required in production"), false);
+          }
           return;
         }
-        callback(new Error("Origin header required in production"), false);
-        return;
+        if (allowedOrigins.includes(origin)) {
+          callback(null, true);
+        } else {
+          callback(new Error(`Origin ${origin} not allowed by CORS`), false);
+        }
       }
-      if (allowedOrigins.includes(origin)) {
-        callback(null, true);
-      } else {
-        callback(new Error(`Origin ${origin} not allowed by CORS`), false);
+    },
+    onRequest: async (request, reply) => {
+      if (!requireAuth || request.url === "/health") {
+        return;
       }
-    }
-  });
-  registerJobsAPI({
-    server,
-    hostService,
-    logger,
-    observability
-  });
-  registerCronAPI({
-    server,
-    hostService,
-    logger,
-    observability
-  });
-  if (workflowService) {
-    registerWorkflowsAPI({
-      server,
-      hostService,
-      engine,
-      workflowService,
-      logger,
-      observability
-    });
-  }
-  registerApprovalsAPI({
-    server,
-    engine,
-    logger,
-    observability
-  });
-  registerStatsAPI({
-    server,
-    hostService,
-    cronScheduler});
-  server.get("/health", async () => {
-    const metrics = await hostService.getMetrics();
-    const checks = buildWorkflowChecks({ workflowService, cronScheduler, metrics });
-    return {
-      status: checks.some((entry) => entry.status === "error") ? "degraded" : "ok",
-      service: "workflow",
-      ts: Date.now()
-    };
-  });
-  server.get("/ready", async () => {
-    const metrics = await hostService.getMetrics();
-    const checks = buildWorkflowReadinessChecks({ workflowService, cronScheduler, metrics });
-    const hasErrors = checks.some((entry) => entry.status === "error");
-    const hasWarnings = checks.some((entry) => entry.status === "warn");
-    return createServiceReadyResponse({
-      ready: !hasErrors,
-      status: hasErrors ? "initializing" : hasWarnings ? "degraded" : "ready",
-      reason: hasErrors ? "workflow_checks_failed" : "ready",
-      components: {
-        workflowEngine: {
-          ready: true
-        },
-        workflowCatalog: {
-          ready: Boolean(workflowService)
-        },
-        cronScheduler: {
-          ready: Boolean(cronScheduler)
-        }
+      const apiKeyHeader = request.headers["x-api-key"];
+      const authHeader = request.headers.authorization;
+      const bearerToken = typeof authHeader === "string" && authHeader.startsWith("Bearer ") ? authHeader.slice("Bearer ".length).trim() : void 0;
+      const token = (typeof apiKeyHeader === "string" ? apiKeyHeader : void 0) ?? bearerToken;
+      if (!token || token !== daemonApiKey) {
+        reply.code(401).send({ ok: false, error: "Unauthorized" });
       }
-    });
-  });
-  server.get("/metrics", async (_request, reply) => {
-    const metrics = await hostService.getMetrics();
-    const healthStatus = resolveWorkflowHealthStatus();
-    reply.header("Content-Type", "text/plain; version=0.0.4; charset=utf-8");
-    return observability.renderPrometheusMetrics(
-      healthStatus,
-      buildWorkflowMetricLines(metrics)
-    );
-  });
-  server.get("/observability/describe", async () => observability.buildDescribe());
-  server.get("/observability/health", async () => {
-    const metrics = await hostService.getMetrics();
-    const checks = buildWorkflowChecks({ workflowService, cronScheduler, metrics });
-    return observability.buildHealth({
-      status: resolveWorkflowHealthStatus(),
-      checks,
-      topOperations: buildWorkflowTopOperations(metrics, observability.getTopOperations(3)),
-      meta: {
-        workflowServiceEnabled: Boolean(workflowService),
-        cronSchedulerEnabled: Boolean(cronScheduler),
-        cronDiscoveryEnabled: Boolean(cronDiscovery),
-        runs: metrics.runs,
-        jobs: metrics.jobs
+    },
+    registerRoutes: async (server) => {
+      registerJobsAPI({ server, hostService, logger, observability });
+      registerCronAPI({ server, hostService, logger, observability });
+      if (workflowService) {
+        registerWorkflowsAPI({ server, hostService, engine, workflowService, logger, observability });
       }
-    });
+      registerApprovalsAPI({ server, hostService, engine, logger, observability });
+      registerStatsAPI({ server, hostService, cronScheduler});
+      server.get("/health", async () => {
+        const metrics = await hostService.getMetrics();
+        const checks = buildWorkflowChecks({ workflowService, cronScheduler, metrics });
+        return {
+          status: checks.some((entry) => entry.status === "error") ? "degraded" : "ok",
+          service: "workflow",
+          ts: Date.now()
+        };
+      });
+      server.get("/ready", async () => {
+        const metrics = await hostService.getMetrics();
+        const checks = buildWorkflowReadinessChecks({ workflowService, cronScheduler, metrics });
+        const hasErrors = checks.some((entry) => entry.status === "error");
+        const hasWarnings = checks.some((entry) => entry.status === "warn");
+        return createServiceReadyResponse({
+          ready: !hasErrors,
+          status: hasErrors ? "initializing" : hasWarnings ? "degraded" : "ready",
+          reason: hasErrors ? "workflow_checks_failed" : "ready",
+          components: {
+            workflowEngine: { ready: true },
+            workflowCatalog: { ready: Boolean(workflowService) },
+            cronScheduler: { ready: Boolean(cronScheduler) }
+          }
+        });
+      });
+      server.get("/metrics", async (_request, reply) => {
+        const metrics = await hostService.getMetrics();
+        const healthStatus = resolveWorkflowHealthStatus();
+        reply.header("Content-Type", "text/plain; version=0.0.4; charset=utf-8");
+        return observability.renderPrometheusMetrics(
+          healthStatus,
+          buildWorkflowMetricLines(metrics)
+        );
+      });
+      server.get("/observability/describe", async () => observability.buildDescribe());
+      server.get("/observability/health", async () => {
+        const metrics = await hostService.getMetrics();
+        const checks = buildWorkflowChecks({ workflowService, cronScheduler, metrics });
+        return observability.buildHealth({
+          status: resolveWorkflowHealthStatus(),
+          checks,
+          topOperations: buildWorkflowTopOperations(metrics, observability.getTopOperations(3)),
+          meta: {
+            workflowServiceEnabled: Boolean(workflowService),
+            cronSchedulerEnabled: Boolean(cronScheduler),
+            cronDiscoveryEnabled: Boolean(cronDiscovery),
+            runs: metrics.runs,
+            jobs: metrics.jobs
+          }
+        });
+      });
+    }
   });
-  return server;
 }
 function resolveWorkflowHealthStatus(metrics) {
   return "healthy";
@@ -2477,16 +3016,8 @@ function buildWorkflowReadinessChecks(input) {
 function buildWorkflowTopOperations(metrics, httpOperations) {
   return [
     ...httpOperations,
-    {
-      operation: "workflow.runs",
-      count: metrics.runs.total,
-      errorCount: metrics.runs.failed + metrics.runs.cancelled + metrics.runs.dlq
-    },
-    {
-      operation: "workflow.jobs",
-      count: metrics.jobs.total,
-      errorCount: metrics.jobs.failed
-    }
+    { operation: "workflow.runs", count: metrics.runs.total, errorCount: metrics.runs.failed + metrics.runs.cancelled + metrics.runs.dlq },
+    { operation: "workflow.jobs", count: metrics.jobs.total, errorCount: metrics.jobs.failed }
   ].slice(0, 5);
 }
 function buildWorkflowMetricLines(metrics) {
@@ -2513,164 +3044,159 @@ function buildWorkflowMetricLines(metrics) {
     metricLine("service_operation_total", metrics.jobs.failed, { operation: "workflow.jobs", status: "error" })
   ];
 }
-var workerInstance = null;
-var serverInstance = null;
-var cronSchedulerInstance = null;
-async function bootstrap(cwd = process.cwd()) {
-  const repoRoot = await findRepoRoot(cwd);
-  const projectRoot = process.env["KB_PROJECT_ROOT"] ?? repoRoot;
-  await createServiceBootstrap({ appId: "workflow-daemon", repoRoot });
-  if (!platform.isConfigured("workspace")) {
-    process.stderr.write(
-      '[workflow-daemon] WARNING: workspace adapter is not configured.\n[workflow-daemon] Workflows that use isolation: balanced (default) or isolation: strict will fail.\n[workflow-daemon] To fix: set platform.adapters.workspace in kb.config.json.\n[workflow-daemon] To run without a workspace: add "isolation: relaxed" to your workflow YAML.\n'
-    );
-  }
-  if (!platform.isConfigured("environment") && platform.isConfigured("workspace")) {
-    process.stderr.write(
-      "[workflow-daemon] WARNING: environment adapter is not configured.\n[workflow-daemon] Workflows that use isolation: strict will fail.\n[workflow-daemon] To fix: set platform.adapters.environment in kb.config.json.\n"
-    );
-  }
-  const startupRequestId = `workflow-startup-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
-  const startupTraceId = randomUUID();
-  const startupSpanId = randomUUID();
-  const bootstrapLogger = createCorrelatedLogger(platform.logger, {
-    serviceId: "workflow",
-    logsSource: "workflow",
-    layer: "workflow",
-    service: "bootstrap",
-    requestId: startupRequestId,
-    traceId: startupTraceId,
-    operation: "workflow.bootstrap",
-    bindings: {
-      spanId: startupSpanId,
-      invocationId: startupSpanId,
-      executionId: startupSpanId
-    }
-  });
-  const debugMode = process.env["WORKFLOW_DEBUG"] === "true";
-  bootstrapLogger.info("Workflow daemon starting", { repoRoot, projectRoot, debugMode });
-  if (debugMode) {
-    bootstrapLogger.warn(
-      "[WORKFLOW_DEBUG=true] Verbose debug logging is ON \u2014 step inputs, outputs, and expr contexts will be logged. Disable in production (unset WORKFLOW_DEBUG or set to false)."
-    );
-  }
-  const createWorkflowLogger = (service, operation, bindings) => createCorrelatedLogger(platform.logger, {
-    serviceId: "workflow",
-    logsSource: "workflow",
-    layer: "workflow",
-    service,
-    operation,
-    bindings
-  });
-  bootstrapLogger.info("Loading plugin registry snapshot");
-  const cliApi = await createRegistry({
-    root: repoRoot,
-    cache: {
-      ttlMs: 10 * 60 * 1e3
-      // 10 minutes
-    }
-  });
-  await cliApi.initialize();
-  const plugins = await cliApi.listPlugins();
-  bootstrapLogger.info("Plugin registry snapshot loaded", {
-    pluginsFound: plugins.length,
-    pluginIds: plugins.map((p) => `${p.id}@${p.version}`)
-  });
-  bootstrapLogger.info("Creating WorkflowEngine");
-  const engine = new WorkflowEngine({
-    cache: platform.cache,
-    events: platform.eventBus,
-    logger: createWorkflowLogger("engine", "workflow.engine"),
-    snapshotManager: platform.snapshotManager,
-    workspaceRoot: projectRoot
-  });
-  bootstrapLogger.info("Cleaning up stale runs from previous daemon process");
-  await engine.cleanupStaleRuns();
-  bootstrapLogger.info("Resuming interrupted jobs");
-  await engine.resumeInterruptedJobs();
-  bootstrapLogger.info("Creating JobBroker");
-  const jobBroker = new JobBroker(engine, createWorkflowLogger("job-broker", "workflow.job-broker"), platform);
-  bootstrapLogger.info("Creating CronScheduler");
-  const cronScheduler = new CronScheduler({
-    jobBroker,
-    workflowEngine: engine,
-    logger: createWorkflowLogger("cron-scheduler", "workflow.cron-scheduler"),
-    timezone: process.env.WORKFLOW_CRON_TIMEZONE
-  });
-  cronSchedulerInstance = cronScheduler;
-  bootstrapLogger.info("Discovering cron jobs");
-  const cronDiscovery = new CronDiscovery({
-    cliApi,
-    scheduler: cronScheduler,
-    logger: createWorkflowLogger("cron-discovery", "workflow.cron-discovery"),
-    workspaceRoot: projectRoot
-  });
-  const discovered = await cronDiscovery.discoverAll();
-  bootstrapLogger.info("Cron job discovery complete", discovered);
-  bootstrapLogger.info("Creating WorkflowService");
-  const workflowService = new WorkflowService({
-    cliApi,
-    platform,
-    workspaceRoot: projectRoot
-  });
-  bootstrapLogger.info("Creating HTTP server");
-  const server = await createServer({
-    engine,
-    jobBroker,
-    workflowService,
-    cronScheduler,
-    cronDiscovery,
-    logger: createWorkflowLogger("api", "workflow.api")
-  });
-  const port = parseInt(process.env.WORKFLOW_PORT || "7778", 10);
-  await server.listen({ port, host: process.env.WORKFLOW_HOST ?? "0.0.0.0" });
-  bootstrapLogger.info("HTTP API listening", { port });
-  serverInstance = server;
-  bootstrapLogger.info("Creating WorkflowWorker");
-  const worker = await createWorkflowWorker({
-    engine,
-    cliApi,
-    logger: createWorkflowLogger("worker", "workflow.worker"),
-    analytics: platform.analytics,
-    platform,
-    workspaceRoot: projectRoot,
-    concurrency: parseInt(process.env.WORKFLOW_CONCURRENCY || "5", 10),
-    debugMode
-  });
-  workerInstance = worker;
-  bootstrapLogger.info("Starting WorkflowWorker");
-  worker.start().catch((error) => {
-    bootstrapLogger.error("Worker crashed - shutting down daemon", error instanceof Error ? error : void 0);
-    process.kill(process.pid, "SIGTERM");
-  });
-  if (discovered.plugins + discovered.users > 0) {
-    bootstrapLogger.info("Starting CronScheduler");
-    await cronScheduler.start();
-  } else {
-    bootstrapLogger.info("No cron jobs found, skipping CronScheduler start");
-  }
-  bootstrapLogger.info("Workflow daemon started successfully", { port });
-  const shutdown = async (signal) => {
-    bootstrapLogger.warn("Received shutdown signal", { signal });
-    if (cronSchedulerInstance) {
-      await cronSchedulerInstance.stop();
-      cronSchedulerInstance = null;
-    }
-    if (workerInstance) {
-      await workerInstance.stop();
-      workerInstance = null;
-    }
-    if (serverInstance) {
-      await serverInstance.close();
-      serverInstance = null;
-    }
-    await cliApi.dispose();
-    await platform.shutdown();
-    bootstrapLogger.info("Workflow daemon shutdown complete");
-    process.exit(0);
-  };
-  process.on("SIGTERM", () => shutdown("SIGTERM"));
-  process.on("SIGINT", () => shutdown("SIGINT"));
+async function bootstrap(_cwd = process.cwd()) {
+  await runDaemon(
+    {
+      appId: "workflow-daemon",
+      // serviceId in the transport map / devservices is 'workflow' (≠ appId).
+      serviceId: "workflow",
+      defaultPort: 7778,
+      portEnvVar: "WORKFLOW_PORT",
+      defaultHost: "0.0.0.0",
+      hostEnvVar: "WORKFLOW_HOST",
+      async setup({ platform: _p, logger: _l, port, host, repoRoot }) {
+        const projectRoot = process.env["KB_PROJECT_ROOT"] ?? repoRoot;
+        if (!platform.isConfigured("workspace")) {
+          process.stderr.write(
+            '[workflow-daemon] WARNING: workspace adapter is not configured.\n[workflow-daemon] Workflows that use isolation: balanced (default) or isolation: strict will fail.\n[workflow-daemon] To fix: set platform.adapters.workspace in kb.config.json.\n[workflow-daemon] To run without a workspace: add "isolation: relaxed" to your workflow YAML.\n'
+          );
+        }
+        if (!platform.isConfigured("environment") && platform.isConfigured("workspace")) {
+          process.stderr.write(
+            "[workflow-daemon] WARNING: environment adapter is not configured.\n[workflow-daemon] Workflows that use isolation: strict will fail.\n[workflow-daemon] To fix: set platform.adapters.environment in kb.config.json.\n"
+          );
+        }
+        const startupRequestId = `workflow-startup-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
+        const startupTraceId = randomUUID();
+        const startupSpanId = randomUUID();
+        const bootstrapLogger = createCorrelatedLogger(platform.logger, {
+          serviceId: "workflow",
+          logsSource: "workflow",
+          layer: "workflow",
+          service: "bootstrap",
+          requestId: startupRequestId,
+          traceId: startupTraceId,
+          operation: "workflow.bootstrap",
+          bindings: { spanId: startupSpanId, invocationId: startupSpanId, executionId: startupSpanId }
+        });
+        const debugMode = process.env["WORKFLOW_DEBUG"] === "true";
+        bootstrapLogger.info("Workflow daemon starting", { projectRoot, debugMode });
+        if (debugMode) {
+          bootstrapLogger.warn(
+            "[WORKFLOW_DEBUG=true] Verbose debug logging is ON \u2014 step inputs, outputs, and expr contexts will be logged. Disable in production (unset WORKFLOW_DEBUG or set to false)."
+          );
+        }
+        const createWorkflowLogger = (service, operation, bindings) => createCorrelatedLogger(platform.logger, {
+          serviceId: "workflow",
+          logsSource: "workflow",
+          layer: "workflow",
+          service,
+          operation,
+          bindings
+        });
+        bootstrapLogger.info("Loading plugin registry snapshot");
+        const cliApi = await createRegistry({ root: repoRoot, cache: { ttlMs: 10 * 60 * 1e3 } });
+        await cliApi.initialize();
+        const plugins = await cliApi.listPlugins();
+        bootstrapLogger.info("Plugin registry snapshot loaded", {
+          pluginsFound: plugins.length,
+          pluginIds: plugins.map((p) => `${p.id}@${p.version}`)
+        });
+        bootstrapLogger.info("Creating WorkflowEngine");
+        const engine = new WorkflowEngine({
+          cache: platform.cache,
+          events: platform.eventBus,
+          logger: createWorkflowLogger("engine", "workflow.engine"),
+          snapshotManager: platform.snapshotManager,
+          workspaceRoot: projectRoot
+        });
+        bootstrapLogger.info("Cleaning up stale runs from previous daemon process");
+        await engine.cleanupStaleRuns();
+        bootstrapLogger.info("Resuming interrupted jobs");
+        await engine.resumeInterruptedJobs();
+        bootstrapLogger.info("Creating JobBroker");
+        const jobBroker = new JobBroker(
+          engine,
+          createWorkflowLogger("job-broker", "workflow.job-broker"),
+          platform
+        );
+        bootstrapLogger.info("Creating CronScheduler");
+        const cronScheduler = new CronScheduler({
+          jobBroker,
+          workflowEngine: engine,
+          logger: createWorkflowLogger("cron-scheduler", "workflow.cron-scheduler"),
+          timezone: process.env.WORKFLOW_CRON_TIMEZONE
+        });
+        bootstrapLogger.info("Discovering cron jobs");
+        const cronDiscovery = new CronDiscovery({
+          cliApi,
+          scheduler: cronScheduler,
+          logger: createWorkflowLogger("cron-discovery", "workflow.cron-discovery"),
+          workspaceRoot: projectRoot
+        });
+        const discovered = await cronDiscovery.discoverAll();
+        bootstrapLogger.info("Cron job discovery complete", discovered);
+        bootstrapLogger.info("Creating WorkflowService");
+        const workflowService = new WorkflowService({ cliApi, platform, workspaceRoot: projectRoot });
+        workflowService.listAll().catch(
+          (err) => bootstrapLogger.warn("Manifest scanner warmup failed", { err })
+        );
+        bootstrapLogger.info("Starting WorkflowFileWatcher");
+        const fileWatcher = new WorkflowFileWatcher({
+          watchDirs: [
+            join(projectRoot, ".kb", "workflows"),
+            join(projectRoot, ".kb", "jobs")
+          ],
+          workflowService,
+          cronDiscovery,
+          cronScheduler,
+          logger: createWorkflowLogger("file-watcher", "workflow.file-watcher")
+        });
+        bootstrapLogger.info("Creating HTTP server");
+        const server = await createServer({
+          engine,
+          jobBroker,
+          workflowService,
+          cronScheduler,
+          cronDiscovery,
+          logger: createWorkflowLogger("api", "workflow.api")
+        });
+        await server.listen(getListenOptions(port, host));
+        bootstrapLogger.info("HTTP API listening", { port });
+        bootstrapLogger.info("Creating WorkflowWorker");
+        const worker = await createWorkflowWorker({
+          engine,
+          cliApi,
+          logger: createWorkflowLogger("worker", "workflow.worker"),
+          analytics: platform.analytics,
+          platform,
+          workspaceRoot: projectRoot,
+          concurrency: parseInt(process.env.WORKFLOW_CONCURRENCY ?? "5", 10),
+          debugMode
+        });
+        bootstrapLogger.info("Starting WorkflowWorker");
+        worker.start().catch((error) => {
+          bootstrapLogger.error(
+            "Worker crashed - shutting down daemon",
+            error instanceof Error ? error : void 0
+          );
+          process.kill(process.pid, "SIGTERM");
+        });
+        bootstrapLogger.info("Starting CronScheduler");
+        await cronScheduler.start();
+        bootstrapLogger.info("Workflow daemon started successfully", { port });
+        return async () => {
+          bootstrapLogger.warn("Stopping workflow daemon components");
+          fileWatcher.close();
+          await cronScheduler.stop();
+          await worker.stop();
+          await server.close();
+          await cliApi.dispose();
+        };
+      }
+    },
+    (appId, repoRoot) => createServiceBootstrap({ appId, repoRoot, assemblyHook: makeAssemblyHook() })
+  );
 }
 
 // src/index.ts
@@ -2678,7 +3204,8 @@ async function bootstrap(cwd = process.cwd()) {
   try {
     await bootstrap(process.cwd());
   } catch (error) {
-    console.error("Failed to start workflow daemon:", error);
+    process.stderr.write(`[workflow-daemon] FATAL: ${error instanceof Error ? error.message : String(error)}
+`);
     process.exit(1);
   }
 })();