@kody-ade/kody-engine 0.4.546 → 0.4.548

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.546",
+      version: "0.4.548",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -2093,11 +2093,13 @@ function parseWorkflowStep(value) {
   const delivery = stringField(raw.delivery);
   const targetFact = stringField(raw.targetFact ?? raw.target_fact);
   const hasInput = Object.hasOwn(raw, "input");
+  const inputs = parseWorkflowInputBindings(raw.inputs);
   const next = parseWorkflowTransitions(raw.next);
   const report = parseReportPublication(raw.report);
   return {
     capability,
     ...hasInput ? { input: raw.input } : {},
+    ...inputs ? { inputs } : {},
     ...id && isSafeStepId(id) ? { id } : {},
     ...action && isSafeSlug(action) ? { action } : {},
     ...evidence ? { evidence } : {},
@@ -2112,6 +2114,15 @@ function parseWorkflowStep(value) {
     ...report ? { report } : {}
   };
 }
+function parseWorkflowInputBindings(value) {
+  if (!isPlainObject(value)) return void 0;
+  const entries = Object.entries(value).flatMap(([name, binding]) => {
+    if (!/^[A-Za-z_][A-Za-z0-9_-]*$/.test(name) || !isPlainObject(binding)) return [];
+    const from = stringField(binding.from);
+    return from ? [[name, { from }]] : [];
+  });
+  return entries.length > 0 ? Object.fromEntries(entries) : void 0;
+}
 function parseWorkflowTransitions(value) {
   const rawTransitions = Array.isArray(value) ? value : value === void 0 ? [] : [value];
   const transitions = rawTransitions.map((raw) => {
@@ -4448,6 +4459,15 @@ function validateWorkflow(value, options = {}) {
     if (step.input !== void 0 && !isJsonValue(step.input)) {
       issue(issues, "invalid_input", `${base}.input`, "workflow step input must be one JSON value");
     }
+    if (step.input !== void 0 && step.inputs !== void 0) {
+      issue(issues, "conflicting_inputs", base, "workflow step cannot declare both input and inputs");
+    }
+    validateInputBindings(
+      step.inputs,
+      `${base}.inputs`,
+      issues,
+      capability ? options.capabilityInputs?.get(capability) : void 0
+    );
   });
   if (!graphMode) return issues;
   const seen = /* @__PURE__ */ new Set();
@@ -4461,11 +4481,24 @@ function validateWorkflow(value, options = {}) {
   }
   const adjacency = /* @__PURE__ */ new Map();
   const explicitEndSources = /* @__PURE__ */ new Set();
+  const capabilitiesByStep = /* @__PURE__ */ new Map();
+  steps.forEach((step) => {
+    const id = text(step?.id);
+    const capability = text(step?.capability ?? step?.action);
+    if (id && capability) capabilitiesByStep.set(id, capability);
+  });
   steps.forEach((step, index) => {
     if (!step) return;
     const id = text(step.id);
     if (!id) return;
     const sourceCapability = text(step.capability ?? step.action);
+    validateInputBindingSources(
+      step.inputs,
+      `steps[${index}].inputs`,
+      issues,
+      capabilitiesByStep,
+      options.capabilityOutputs
+    );
     const transitions = transitionList(step.next);
     adjacency.set(id, []);
     if (transitions.length > maxTransitions) {
@@ -4581,6 +4614,63 @@ function validateWorkflow(value, options = {}) {
   }
   return issues;
 }
+function validateInputBindings(value, path53, issues, declaredInputs) {
+  if (value === void 0) return;
+  const bindings = asRecord(value);
+  if (!bindings || Object.keys(bindings).length === 0) {
+    issue(issues, "invalid_inputs", path53, "workflow step inputs must contain at least one named mapping");
+    return;
+  }
+  for (const [name, value2] of Object.entries(bindings)) {
+    const bindingPath = `${path53}.${name}`;
+    if (!/^[A-Za-z_][A-Za-z0-9_-]*$/.test(name)) {
+      issue(issues, "invalid_input_name", bindingPath, `workflow input name ${name} is invalid`);
+    }
+    if (declaredInputs && !declaredInputs.has(name)) {
+      issue(issues, "undeclared_input", bindingPath, `target capability does not declare input ${name}`);
+    }
+    const binding = asRecord(value2);
+    const from = text(binding?.from);
+    if (!binding || Object.keys(binding).some((field) => field !== "from") || !from || !SAFE_INPUT_SOURCE.test(from)) {
+      issue(
+        issues,
+        "invalid_input_source",
+        `${bindingPath}.from`,
+        "workflow input mapping must read from workflow input/state or a prior step result"
+      );
+    }
+  }
+}
+function validateInputBindingSources(value, path53, issues, capabilitiesByStep, capabilityOutputs) {
+  const bindings = asRecord(value);
+  if (!bindings) return;
+  for (const [name, rawBinding] of Object.entries(bindings)) {
+    const from = text(asRecord(rawBinding)?.from);
+    if (!from?.startsWith("steps.")) continue;
+    const parts = from.split(".");
+    const sourceStep = parts[1];
+    const sourceCapability = sourceStep ? capabilitiesByStep.get(sourceStep) : void 0;
+    if (!sourceStep || !sourceCapability) {
+      issue(
+        issues,
+        "missing_input_step",
+        `${path53}.${name}.from`,
+        `workflow input mapping references missing step ${sourceStep ?? "<none>"}`
+      );
+      continue;
+    }
+    const outputPath = parts.slice(2).join(".");
+    const declaredOutputs = capabilityOutputs?.get(sourceCapability);
+    if (declaredOutputs && !declaredOutputs.has(outputPath)) {
+      issue(
+        issues,
+        "undeclared_step_output",
+        `${path53}.${name}.from`,
+        `workflow input mapping reads ${outputPath}, but step ${sourceStep} does not declare it`
+      );
+    }
+  }
+}
 function formatWorkflowValidationIssues(issues) {
   return issues.map((entry) => `${entry.path}: ${entry.message}`);
 }
@@ -4636,17 +4726,19 @@ function isJsonValue(value) {
 function issue(issues, code, path53, message) {
   issues.push({ code, path: path53, message });
 }
-var SAFE_NAME, SAFE_STEP_ID, SAFE_DATA_PATH, SUPPORTED_STEP_FIELDS, SUPPORTED_TRANSITION_FIELDS;
+var SAFE_NAME, SAFE_STEP_ID, SAFE_DATA_PATH, SAFE_INPUT_SOURCE, SUPPORTED_STEP_FIELDS, SUPPORTED_TRANSITION_FIELDS;
 var init_workflowValidation = __esm({
   "src/workflowValidation.ts"() {
     "use strict";
     SAFE_NAME = /^[a-z][a-z0-9-]*$/;
     SAFE_STEP_ID = /^[A-Za-z][A-Za-z0-9_-]*$/;
     SAFE_DATA_PATH = /^(facts|evidence|artifacts|result|workflow|lastOutcome)(?:\.[A-Za-z_][A-Za-z0-9_-]*)+$/;
+    SAFE_INPUT_SOURCE = /^(?:workflow\.(?:input|facts|evidence)(?:\.[A-Za-z_][A-Za-z0-9_-]*)+|steps\.[A-Za-z][A-Za-z0-9_-]*\.result(?:\.[A-Za-z_][A-Za-z0-9_-]*)+)$/;
     SUPPORTED_STEP_FIELDS = /* @__PURE__ */ new Set([
       "id",
       "capability",
       "input",
+      "inputs",
       "action",
       "evidence",
       "target",
@@ -17743,53 +17835,6 @@ var init_prepareBrowserAuth = __esm({
   }
 });
 
-// src/scripts/prepareSimpleCapabilityRuntime.ts
-function requirementsFrom(ctx) {
-  const raw = ctx.data.capabilityRequirements;
-  return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
-}
-function configureBrowser(profile) {
-  if (!profile.claudeCode.tools.includes("mcp__playwright")) {
-    profile.claudeCode.tools = [...profile.claudeCode.tools, "mcp__playwright"];
-  }
-  if (!profile.claudeCode.mcpServers.some(({ name }) => name === PLAYWRIGHT_SERVER.name)) {
-    profile.claudeCode.mcpServers = [...profile.claudeCode.mcpServers, PLAYWRIGHT_SERVER];
-  }
-}
-function appendPrompt(ctx, section) {
-  const prompt = typeof ctx.data.prompt === "string" ? ctx.data.prompt.trim() : "";
-  ctx.data.prompt = [prompt, section.trim()].filter(Boolean).join("\n\n");
-}
-var PLAYWRIGHT_SERVER, prepareSimpleCapabilityRuntime;
-var init_prepareSimpleCapabilityRuntime = __esm({
-  "src/scripts/prepareSimpleCapabilityRuntime.ts"() {
-    "use strict";
-    init_loadQaContext();
-    PLAYWRIGHT_SERVER = {
-      name: "playwright",
-      command: "npx",
-      args: ["-y", "--package=@playwright/mcp@latest", "--", "playwright-mcp", "--headless"]
-    };
-    prepareSimpleCapabilityRuntime = async (ctx, profile) => {
-      const requirements = requirementsFrom(ctx);
-      if (!requirements.browser) return;
-      configureBrowser(profile);
-      if (!requirements.qaCredentials) return;
-      await loadQaContext(ctx, profile);
-      appendPrompt(
-        ctx,
-        [
-          "## QA authentication",
-          "",
-          String(ctx.data.qaAuthBlock ?? ""),
-          "",
-          "If the changed surface requires authentication and the credentials are missing or the login is rejected, return a blocked result with a safe explanation. Do not include usernames, passwords, tokens, or other credential values in the result."
-        ].join("\n")
-      );
-    };
-  }
-});
-
 // src/capabilityDelivery.ts
 function capabilityDeliveryTarget(input) {
   if (!input || typeof input !== "object" || Array.isArray(input)) return null;
@@ -17901,6 +17946,53 @@ var init_prepareCapabilityDelivery = __esm({
   }
 });
 
+// src/scripts/prepareSimpleCapabilityRuntime.ts
+function requirementsFrom(ctx) {
+  const raw = ctx.data.capabilityRequirements;
+  return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+}
+function configureBrowser(profile) {
+  if (!profile.claudeCode.tools.includes("mcp__playwright")) {
+    profile.claudeCode.tools = [...profile.claudeCode.tools, "mcp__playwright"];
+  }
+  if (!profile.claudeCode.mcpServers.some(({ name }) => name === PLAYWRIGHT_SERVER.name)) {
+    profile.claudeCode.mcpServers = [...profile.claudeCode.mcpServers, PLAYWRIGHT_SERVER];
+  }
+}
+function appendPrompt(ctx, section) {
+  const prompt = typeof ctx.data.prompt === "string" ? ctx.data.prompt.trim() : "";
+  ctx.data.prompt = [prompt, section.trim()].filter(Boolean).join("\n\n");
+}
+var PLAYWRIGHT_SERVER, prepareSimpleCapabilityRuntime;
+var init_prepareSimpleCapabilityRuntime = __esm({
+  "src/scripts/prepareSimpleCapabilityRuntime.ts"() {
+    "use strict";
+    init_loadQaContext();
+    PLAYWRIGHT_SERVER = {
+      name: "playwright",
+      command: "npx",
+      args: ["-y", "--package=@playwright/mcp@latest", "--", "playwright-mcp", "--headless"]
+    };
+    prepareSimpleCapabilityRuntime = async (ctx, profile) => {
+      const requirements = requirementsFrom(ctx);
+      if (!requirements.browser) return;
+      configureBrowser(profile);
+      if (!requirements.qaCredentials) return;
+      await loadQaContext(ctx, profile);
+      appendPrompt(
+        ctx,
+        [
+          "## QA authentication",
+          "",
+          String(ctx.data.qaAuthBlock ?? ""),
+          "",
+          "If the changed surface requires authentication and the credentials are missing or the login is rejected, return a blocked result with a safe explanation. Do not include usernames, passwords, tokens, or other credential values in the result."
+        ].join("\n")
+      );
+    };
+  }
+});
+
 // src/scripts/promoteQaGoal.ts
 var REPORT_JSON_OPEN2, promoteQaGoal;
 var init_promoteQaGoal = __esm({
@@ -18463,45 +18555,6 @@ var init_requirePlanDeviations = __esm({
   }
 });
 
-// src/scripts/retryMissingDeliveryChange.ts
-function claimsChange(output) {
-  if (!output || typeof output !== "object" || Array.isArray(output)) return false;
-  const status = output.status;
-  return status === "fixed" || status === "changed";
-}
-var retryMissingDeliveryChange;
-var init_retryMissingDeliveryChange = __esm({
-  "src/scripts/retryMissingDeliveryChange.ts"() {
-    "use strict";
-    init_commit();
-    init_parseAgentResult();
-    init_parseSimpleCapabilityOutput();
-    retryMissingDeliveryChange = async (ctx, profile) => {
-      if (ctx.data.jobDelivery !== "pull-request") return;
-      if (!claimsChange(ctx.data.capabilityOutput)) return;
-      if (listChangedFiles(ctx.cwd).some((file) => !isForbiddenPath(file))) return;
-      const invoker = ctx.data.__invokeAgent;
-      const prompt = ctx.data.prompt;
-      if (!invoker || !prompt) return;
-      process.stderr.write("[kody] capability claimed a pull-request fix without a file change; retrying once\n");
-      const retry = await invoker(
-        [
-          prompt,
-          "",
-          "# Missing delivery change (retry)",
-          "",
-          "Your previous result claimed the pull request was fixed, but no repository file changed.",
-          "Inspect the supplied input and failure evidence, make the actual repair, and verify it.",
-          "If no safe change is possible, return a blocked result instead of claiming fixed.",
-          "This is the only retry."
-        ].join("\n")
-      );
-      await parseAgentResult2(ctx, profile, retry);
-      await parseSimpleCapabilityOutput(ctx, profile, retry);
-    };
-  }
-});
-
 // src/scripts/resolveArtifacts.ts
 var resolveArtifacts;
 var init_resolveArtifacts = __esm({
@@ -21118,8 +21171,8 @@ var init_scripts = __esm({
     init_postResearchComment();
     init_postReviewResult();
     init_prepareBrowserAuth();
-    init_prepareSimpleCapabilityRuntime();
     init_prepareCapabilityDelivery();
+    init_prepareSimpleCapabilityRuntime();
     init_promoteQaGoal();
     init_publishReport();
     init_recordClassification();
@@ -21127,7 +21180,6 @@ var init_scripts = __esm({
     init_requireDeliveryArtifacts();
     init_requireFeedbackActions();
     init_requirePlanDeviations();
-    init_retryMissingDeliveryChange();
     init_resolveArtifacts();
     init_resolveFlow();
     init_resolvePreviewUrl();
@@ -21226,7 +21278,6 @@ var init_scripts = __esm({
       requireFeedbackActions,
       requireDeliveryArtifacts,
       requirePlanDeviations,
-      retryMissingDeliveryChange,
       verify,
       verifyWithRetry,
       verifyReproFails,
@@ -22499,6 +22550,8 @@ function parseWorkflowRunState(raw) {
     )
   ) : {};
   const facts = state.facts && typeof state.facts === "object" && !Array.isArray(state.facts) ? state.facts : {};
+  const input = state.input && typeof state.input === "object" && !Array.isArray(state.input) ? state.input : void 0;
+  const steps = parseWorkflowSteps(state.steps);
   const evidenceEntries = state.evidence && typeof state.evidence === "object" && !Array.isArray(state.evidence) ? Object.entries(state.evidence).filter((entry) => typeof entry[1] === "boolean") : [];
   const artifacts = Array.isArray(state.artifacts) ? state.artifacts.filter(
     (artifact) => !!artifact && typeof artifact === "object" && typeof artifact.label === "string" && (artifact.url === void 0 || typeof artifact.url === "string") && (artifact.path === void 0 || typeof artifact.path === "string")
@@ -22508,12 +22561,35 @@ function parseWorkflowRunState(raw) {
     ...typeof state.currentStepId === "string" ? { currentStepId: state.currentStepId } : {},
     completedStepIds,
     transitionCounts,
+    ...input ? { input: { ...input } } : {},
+    ...typeof state.definitionHash === "string" && state.definitionHash.trim() ? { definitionHash: state.definitionHash.trim() } : {},
+    ...steps ? { steps } : {},
     facts: { ...facts },
     evidence: Object.fromEntries(evidenceEntries),
     artifacts: artifacts.map((artifact) => ({ ...artifact })),
     ...typeof state.blocker === "string" ? { blocker: state.blocker } : {}
   };
 }
+function parseWorkflowSteps(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const steps = {};
+  for (const [stepId, raw] of Object.entries(value)) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
+    const step = raw;
+    if (step.status !== "running" && step.status !== "completed" && step.status !== "blocked" && step.status !== "failed") {
+      continue;
+    }
+    steps[stepId] = {
+      status: step.status,
+      ...typeof step.capability === "string" ? { capability: step.capability } : {},
+      ...Object.hasOwn(step, "input") ? { input: step.input } : {},
+      ...Object.hasOwn(step, "output") ? { output: step.output } : {},
+      ...typeof step.startedAt === "string" ? { startedAt: step.startedAt } : {},
+      ...typeof step.completedAt === "string" ? { completedAt: step.completedAt } : {}
+    };
+  }
+  return Object.keys(steps).length > 0 ? steps : void 0;
+}
 async function readWorkflowRunState(config, _cwd, workflowId, runId) {
   const tenantId2 = runtimeTenant(config);
   const row = await createStateBackendFromEnv().getWorkflowRun(tenantId2, workflowId, runId);
@@ -22556,6 +22632,7 @@ __export(job_exports, {
   stableJobKey: () => stableJobKey,
   validateJob: () => validateJob
 });
+import { createHash as createHash8 } from "crypto";
 function newJobId(flavor) {
   localJobSeq += 1;
   const runId = process.env.GITHUB_RUN_ID;
@@ -22844,6 +22921,8 @@ async function runLinearCapabilityWorkflow(parent, workflow, capability, base, c
     workflowStepCount: workflow.steps.length,
     workflowIssueNumber: workflowIssueNumber(parent),
     workflowContext: workflowInputContext(parent.cliArgs),
+    workflowInput: state.input ?? {},
+    workflowStepResults: workflowStepResults(state.steps),
     workflowFacts: parent.workflowFacts ?? {},
     workflowStack: [
       ...Array.isArray(base.preloadedData?.workflowStack) ? base.preloadedData.workflowStack.filter((entry) => typeof entry === "string") : [],
@@ -22864,6 +22943,8 @@ async function runLinearCapabilityWorkflow(parent, workflow, capability, base, c
       continue;
     }
     const child = workflowStepToJob(step, parent, chainData, base.cwd);
+    beginWorkflowStep(state, step, child);
+    await checkpoint?.(state);
     process.stdout.write(
       `\u2192 kody: workflow ${capability.slug} step ${index + 1}/${workflow.steps.length} \u2192 ${label}
 
@@ -22883,6 +22964,7 @@ async function runLinearCapabilityWorkflow(parent, workflow, capability, base, c
         workflowContinueOn: step.continueOn ?? []
       }
     });
+    finishWorkflowStep(state, step, result);
     mergeWorkflowResults(state, result.capabilityResults);
     if (result.capabilityOutput && typeof result.capabilityOutput === "object" && !Array.isArray(result.capabilityOutput)) {
       Object.assign(state.facts, result.capabilityOutput);
@@ -22891,6 +22973,7 @@ async function runLinearCapabilityWorkflow(parent, workflow, capability, base, c
     const prUrl = result.prUrl ?? result.taskState?.core.prUrl ?? (typeof chainData.workflowPrUrl === "string" ? chainData.workflowPrUrl : void 0);
     chainData = {
       ...chainData,
+      workflowStepResults: workflowStepResults(state.steps),
       ...result.taskState ? { taskState: result.taskState } : {},
       ...outcome ? { workflowLastOutcome: outcome } : {},
       ...result.capabilityOutput !== void 0 ? {
@@ -22922,6 +23005,7 @@ function isGraphWorkflow(workflow) {
 function workflowError(workflow, base) {
   const projectCapabilitiesRoot = hydratedCapabilitiesRoot(base.cwd);
   const knownCapabilities = /* @__PURE__ */ new Set();
+  const capabilityInputs = /* @__PURE__ */ new Map();
   const capabilityOutputs = /* @__PURE__ */ new Map();
   for (const step of workflow.steps) {
     const action = step.action ?? step.capability;
@@ -22929,10 +23013,14 @@ function workflowError(workflow, base) {
     const resolvedFolder = resolveCapabilityFolder(step.capability, projectCapabilitiesRoot);
     if (!resolvedAction && !resolvedFolder) continue;
     knownCapabilities.add(step.capability);
+    const inputNames = resolvedFolder ? capabilityInputNames(resolvedFolder) : /* @__PURE__ */ new Set();
+    if (inputNames.size > 0) capabilityInputs.set(step.capability, inputNames);
     const outputPaths = resolvedFolder ? capabilityOutputConditionPaths(resolvedFolder.config) : /* @__PURE__ */ new Set();
     if (outputPaths.size > 0) capabilityOutputs.set(step.capability, outputPaths);
   }
-  return formatWorkflowValidationIssues(validateWorkflow(workflow, { knownCapabilities, capabilityOutputs }))[0] ?? null;
+  return formatWorkflowValidationIssues(
+    validateWorkflow(workflow, { knownCapabilities, capabilityInputs, capabilityOutputs })
+  )[0] ?? null;
 }
 function initialWorkflowState(parent, workflow) {
   const prior = parent.workflowState;
@@ -22942,6 +23030,8 @@ function initialWorkflowState(parent, workflow) {
       status: "done",
       completedStepIds: [...prior.completedStepIds],
       transitionCounts: { ...prior.transitionCounts },
+      ...prior.input ? { input: { ...prior.input } } : {},
+      ...prior.steps ? { steps: cloneWorkflowSteps(prior.steps) } : {},
       facts: { ...prior.facts },
       evidence: { ...prior.evidence },
       artifacts: prior.artifacts.map((artifact) => ({ ...artifact }))
@@ -22951,9 +23041,12 @@ function initialWorkflowState(parent, workflow) {
   const currentStepId = prior?.currentStepId ?? firstStepId;
   return {
     status: "running",
+    input: { ...prior?.input ?? workflowInputContext(parent.cliArgs) },
+    definitionHash: prior?.definitionHash ?? workflowDefinitionHash(workflow),
     ...currentStepId ? { currentStepId } : {},
     completedStepIds: [...prior?.completedStepIds ?? []],
     transitionCounts: { ...prior?.transitionCounts ?? {} },
+    steps: cloneWorkflowSteps(prior?.steps ?? {}),
     facts: {
       ...workflowInputContext(parent.cliArgs),
       ...parent.workflowFacts ?? {},
@@ -22975,6 +23068,8 @@ function workflowChainData(parent, capability, base, state) {
     workflowStepCount: capability.config.workflow?.steps.length ?? 0,
     workflowIssueNumber: workflowIssueNumber(parent),
     workflowContext: base.preloadedData?.workflowContext ?? workflowInputContext(parent.cliArgs),
+    workflowInput: state.input ?? {},
+    workflowStepResults: workflowStepResults(state.steps),
     workflowFacts: state.facts,
     workflowEvidence: state.evidence,
     workflowArtifacts: state.artifacts,
@@ -23017,9 +23112,18 @@ async function runGraphCapabilityWorkflow(parent, workflow, capability, base, ch
       const reason = error instanceof Error ? error.message : String(error);
       state.status = "blocked";
       state.blocker = reason;
+      state.steps = state.steps ?? {};
+      state.steps[step.id] = {
+        capability: step.capability,
+        status: "blocked",
+        output: { status: "blocked", summary: reason },
+        completedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
       await checkpoint?.(state);
       return { exitCode: 64, reason, workflowState: state };
     }
+    beginWorkflowStep(state, step, child);
+    await checkpoint?.(state);
     process.stdout.write(
       `\u2192 kody: workflow ${capability.slug} step ${index + 1}/${workflow.steps.length} \u2192 ${label}
 
@@ -23044,6 +23148,7 @@ async function runGraphCapabilityWorkflow(parent, workflow, capability, base, ch
         workflowContinueOn: step.continueOn ?? []
       }
     });
+    finishWorkflowStep(state, step, result);
     mergeWorkflowResults(state, result.capabilityResults);
     if (result.capabilityOutput && typeof result.capabilityOutput === "object" && !Array.isArray(result.capabilityOutput)) {
       Object.assign(state.facts, result.capabilityOutput);
@@ -23201,9 +23306,8 @@ function withWorkflowBoundaryEval(capability, result) {
 function workflowStepToJob(step, parent, chainData, cwd) {
   const action = step.action ?? step.capability;
   const targetNumber = workflowStepTargetNumber(step, parent, chainData);
-  const rawArgs = {
-    ...parent.cliArgs
-  };
+  const mappedInputs = resolveWorkflowStepInputs(step, chainData);
+  const rawArgs = mappedInputs ? { ...mappedInputs } : { ...parent.cliArgs };
   if (step.target === "pr") {
     if (typeof targetNumber !== "number") {
       throw new InvalidJobError(`workflow step ${action} needs a PR target but no prior PR URL is available`);
@@ -23213,7 +23317,7 @@ function workflowStepToJob(step, parent, chainData, cwd) {
     rawArgs.issue = targetNumber;
   }
   const genericInput = capabilityStepInput(
-    step.input ?? chainData.workflowContext ?? chainData.workflowLastOutput ?? genericInputFromArgs(rawArgs),
+    step.input ?? mappedInputs ?? chainData.workflowInput ?? genericInputFromArgs(rawArgs),
     step.target,
     targetNumber
   );
@@ -23236,6 +23340,74 @@ function workflowStepToJob(step, parent, chainData, cwd) {
     ...parent.resultTarget ? { resultTarget: parent.resultTarget } : {}
   };
 }
+function resolveWorkflowStepInputs(step, chainData) {
+  if (!step.inputs) return void 0;
+  const source = {
+    workflow: {
+      input: chainData.workflowInput ?? {},
+      facts: chainData.workflowFacts ?? {},
+      evidence: chainData.workflowEvidence ?? {}
+    },
+    steps: chainData.workflowStepResults ?? {}
+  };
+  const input = {};
+  for (const [name, binding] of Object.entries(step.inputs)) {
+    const value = resolveDottedPath2(source, binding.from);
+    if (value === void 0) {
+      throw new InvalidJobError(`workflow step ${step.id ?? step.capability} needs missing input ${binding.from}`);
+    }
+    input[name] = value;
+  }
+  return input;
+}
+function capabilityInputNames(folder) {
+  const properties = folder.config.inputSchema?.properties;
+  if (!properties || typeof properties !== "object" || Array.isArray(properties)) return /* @__PURE__ */ new Set();
+  return new Set(Object.keys(properties));
+}
+function workflowDefinitionHash(workflow) {
+  return createHash8("sha256").update(stableJson(workflow)).digest("hex");
+}
+function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function cloneWorkflowSteps(steps) {
+  return Object.fromEntries(Object.entries(steps).map(([id, step]) => [id, { ...step }]));
+}
+function workflowStepResults(steps) {
+  return Object.fromEntries(
+    Object.entries(steps ?? {}).map(([id, step]) => [id, Object.hasOwn(step, "output") ? { result: step.output } : {}])
+  );
+}
+function workflowStepAuditInput(job) {
+  if (Object.hasOwn(job.cliArgs, "input")) return genericInputFromArgs(job.cliArgs);
+  return { ...job.cliArgs };
+}
+function beginWorkflowStep(state, step, job) {
+  const id = step.id ?? step.action ?? step.capability;
+  state.steps = state.steps ?? {};
+  state.steps[id] = {
+    capability: step.capability,
+    status: "running",
+    input: workflowStepAuditInput(job),
+    startedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function finishWorkflowStep(state, step, result) {
+  const id = step.id ?? step.action ?? step.capability;
+  const prior = state.steps?.[id];
+  state.steps = state.steps ?? {};
+  state.steps[id] = {
+    ...prior ?? { capability: step.capability, status: "running" },
+    status: result.exitCode === 0 ? "completed" : result.capabilityResults?.at(-1)?.status === "blocked" ? "blocked" : "failed",
+    ...result.capabilityOutput !== void 0 ? { output: result.capabilityOutput } : {},
+    completedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
 function usesGenericCapabilityInput(action, cwd) {
   const inputs = getCapabilityActionInputs(action, hydratedCapabilitiesRoot(cwd));
   return Boolean(inputs?.length === 1 && inputs[0]?.name === "input" && inputs[0]?.flag === "--input");
@@ -23418,10 +23590,10 @@ var init_job = __esm({
     init_config();
     init_definition_paths();
     init_executor();
+    init_kody_api_client();
     init_registry();
     init_runIndex();
     init_publishReport();
-    init_kody_api_client();
     init_simpleCapabilityRuntime();
     init_state_backend();
     init_workflowDefinitions();

package/dist/implementations/types.ts

@@ -595,9 +595,25 @@ export interface Job {
 
 export interface WorkflowRunState {
   status: "running" | "blocked" | "failed" | "done"
+  /** Immutable input supplied when this workflow run started. */
+  input?: Record<string, unknown>
+  /** Hash of the workflow definition used by this run. */
+  definitionHash?: string
   currentStepId?: string
   completedStepIds: string[]
   transitionCounts: Record<string, number>
+  /** Exact per-step handoffs for audit, resume, and debugging. */
+  steps?: Record<
+    string,
+    {
+      capability?: string
+      status: "running" | "completed" | "blocked" | "failed"
+      input?: unknown
+      output?: unknown
+      startedAt?: string
+      completedAt?: string
+    }
+  >
   facts: Record<string, unknown>
   evidence: Record<string, boolean>
   artifacts: Array<{ label: string; url?: string; path?: string }>

package/dist/runtime-services/capability-delivery/profile.json

@@ -81,8 +81,7 @@
       }
     ],
     "postflight": [
-      { "script": "parseSimpleCapabilityOutput" },
-      { "script": "retryMissingDeliveryChange" }
+      { "script": "parseSimpleCapabilityOutput" }
     ]
   },
   "inputArtifacts": [],

package/dist/runtime-services/capability-delivery/prompt.md

@@ -2,8 +2,10 @@
 
 ## Delivery
 
-The delivery wrapper owns git commits, pushes, and pull requests. Do not run
-git or GitHub write commands.
+The delivery wrapper has already checked out the requested target before you
+start. Inspect and edit the current working tree. Do not fetch, checkout, sync,
+merge, commit, push, or run any other git or GitHub write command; the wrapper
+owns those operations.
 
 After completing the capability work, finish with exactly this structure:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.546",
+  "version": "0.4.548",
   "description": "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
   "license": "MIT",
   "type": "module",