@kontextmind/kxm 0.7.96 → 0.7.98

package/plugins/kxm/dist/server.js

@@ -14779,7 +14779,7 @@ var require_dist = __commonJS({
 });
 
 // plugins/kxm/src/hub.ts
-import { createHash as createHash5, createHmac } from "node:crypto";
+import { createHash as createHash5, createHmac as createHmac2 } from "node:crypto";
 import { existsSync as existsSync6 } from "node:fs";
 import { createServer } from "node:http";
 import { isIP } from "node:net";
@@ -15271,6 +15271,10 @@ var READ_ONLY_ONESHOT_ARGS = Object.freeze({
 function oneShotReadOnlyArgs(harness) {
   return Object.hasOwn(READ_ONLY_ONESHOT_ARGS, harness) ? READ_ONLY_ONESHOT_ARGS[harness] : void 0;
 }
+var WRITER_ONESHOT_ARGS = Object.freeze({
+  pi: Object.freeze(["-a", "--no-extensions", "--no-skills", "--no-prompt-templates", "--no-session"]),
+  grok: Object.freeze(["--always-approve", "--no-subagents", "--disable-web-search"])
+});
 var BUILTIN_HARNESSES = Object.freeze([
   {
     id: "pi",
@@ -15650,7 +15654,7 @@ function workflowScopeExtras(operation, assignedCoordinatorName) {
 import { createHash as createHash3, randomUUID as randomUUID2, timingSafeEqual } from "node:crypto";
 
 // plugins/kxm/src/workflow.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash2, createHmac } from "node:crypto";
 
 // plugins/kxm/src/relevance.ts
 var RELEVANCE_STOPWORDS = Object.freeze(/* @__PURE__ */ new Set([
@@ -16572,6 +16576,30 @@ function canonicalWorkflowDefinitionJson(definition) {
 function workflowDefinitionHash(definition) {
   return createHash2("sha256").update(canonicalWorkflowDefinitionJson(definition), "utf8").digest("hex");
 }
+var WORKFLOW_WEBHOOK_SIGNATURE_VERSION = "kxm-webhook-v1";
+var WORKFLOW_WEBHOOK_MAX_SKEW_SECONDS = 300;
+function workflowWebhookSignedMaterial(scope, timestamp, deliveryId, body) {
+  const fields = [
+    WORKFLOW_WEBHOOK_SIGNATURE_VERSION,
+    scope.runId === void 0 ? "start" : "signal",
+    timestamp,
+    deliveryId,
+    scope.definitionId,
+    scope.runId ?? "",
+    scope.signalKey ?? ""
+  ];
+  if (fields.some((field) => /[\r\n]/.test(field))) {
+    throw new ProtocolError(400, "webhook signature fields must not contain line breaks", "webhook_signature_field_invalid");
+  }
+  return Buffer.concat([
+    Buffer.from(`${fields.join("\n")}
+`, "utf8"),
+    typeof body === "string" ? Buffer.from(body, "utf8") : Buffer.from(body)
+  ]);
+}
+function workflowWebhookSignature(secret, scope, timestamp, deliveryId, body) {
+  return `sha256=${createHmac("sha256", secret).update(workflowWebhookSignedMaterial(scope, timestamp, deliveryId, body)).digest("hex")}`;
+}
 function resolveOutcomeRule(stage, outcomeKey) {
   const raw = stage.on?.[outcomeKey];
   return raw === void 0 ? void 0 : normalizeOutcomeValue(raw, `stage ${stage.id} on.${outcomeKey}`);
@@ -16895,6 +16923,13 @@ var HubHttpError = class extends Error {
 };
 
 // plugins/kxm/src/commands.ts
+function forwardedHops(handling) {
+  if (!handling?.length) return void 0;
+  return {
+    hops: Math.max(...handling.map((message) => message.hops)) + 1,
+    maxHops: Math.min(...handling.map((message) => message.maxHops))
+  };
+}
 function requiredString(value, name) {
   if (typeof value !== "string" || value.trim() === "") throw new Error(`${name} is required`);
   return value.trim();
@@ -17024,12 +17059,13 @@ var AGENT_COMMANDS = [
       required: ["target", "content"],
       additionalProperties: false
     },
-    async execute(client, args) {
+    async execute(client, args, context) {
       const delivery = optionalString2(args.delivery);
       const correlationId = optionalString2(args.correlationId);
       const idempotencyKey = optionalString2(args.idempotencyKey);
       const workflowContext = optionalWorkflowContext(args.workflowContext);
       const message = await client.send({
+        ...forwardedHops(context?.handling),
         target: requiredString(args.target, "target"),
         content: requiredString(args.content, "content"),
         ...delivery ? { delivery } : {},
@@ -17107,6 +17143,7 @@ var AGENT_COMMANDS = [
       const targets = Array.isArray(args.targets) ? args.targets.map((t) => requiredString(t, "target")) : [];
       return {
         responses: await client.fanout({
+          ...forwardedHops(context?.handling),
           targets,
           content: requiredString(args.content, "content"),
           ...optionalString2(args.correlationId) ? { correlationId: optionalString2(args.correlationId) } : {},
@@ -19385,6 +19422,9 @@ var DatabaseSync = class {
   }
 };
 
+// plugins/kxm/src/bindings.ts
+var MAX_BINDING_RECORD_BYTES = 256 * 1024;
+
 // plugins/kxm/src/database.ts
 function databaseError(code, file, message) {
   const issue2 = { phase: "semantic", code, file, message };
@@ -21089,20 +21129,59 @@ data: ${JSON.stringify({ type: "ops", project, topic, at: nowIso() })}
     const candidate = payload.webhookEvent ?? payload.event;
     return typeof candidate === "string" && candidate.trim() ? candidate.trim() : void 0;
   }
-  function verifyWebhookSignature(request, body, secret) {
-    const signature = request.headers["x-hub-signature-256"] ?? request.headers["x-hub-signature"];
-    if (typeof signature !== "string") {
-      throw new ProtocolError(401, "webhook signature is required", "webhook_signature_missing");
-    }
+  function requireSha256Signature(signature) {
     const separator = signature.indexOf("=");
     const algorithm = separator > 0 ? signature.slice(0, separator).toLowerCase() : "";
     if (algorithm !== "sha256") {
       throw new ProtocolError(401, "webhook signature must use sha256", "webhook_signature_unsupported");
     }
-    const expected = `sha256=${createHmac("sha256", secret).update(body).digest("hex")}`;
+  }
+  function verifyProviderWebhookSignature(request, body, definition) {
+    if (definition.source === "generic") {
+      throw new ProtocolError(
+        401,
+        "generic workflow webhooks require x-kxm-signature over the timestamp, delivery ID, definition, and body",
+        "webhook_signature_missing"
+      );
+    }
+    const signature = request.headers["x-hub-signature-256"] ?? request.headers["x-hub-signature"];
+    if (typeof signature !== "string") {
+      throw new ProtocolError(401, "webhook signature is required", "webhook_signature_missing");
+    }
+    requireSha256Signature(signature);
+    const expected = `sha256=${createHmac2("sha256", definition.secret).update(body).digest("hex")}`;
     if (!safeTokenEqual(signature, expected)) {
       throw new ProtocolError(401, "webhook signature is invalid", "webhook_signature_invalid");
     }
+    const deliveryHeader = definition.source === "jira" ? request.headers["x-atlassian-webhook-identifier"] : request.headers["x-github-delivery"];
+    return requireString(deliveryHeader, "webhook delivery identifier", { max: 128 });
+  }
+  function verifyKxmWebhookSignature(request, body, secret, scope) {
+    const signature = request.headers["x-kxm-signature"];
+    if (typeof signature !== "string") {
+      throw new ProtocolError(
+        401,
+        "KXM webhooks require x-kxm-signature over the timestamp, delivery ID, route, and body",
+        "webhook_signature_missing"
+      );
+    }
+    requireSha256Signature(signature);
+    const timestamp = request.headers["x-kxm-timestamp"];
+    if (typeof timestamp !== "string" || !/^[0-9]{1,12}$/.test(timestamp)) {
+      throw new ProtocolError(401, "x-kxm-timestamp must be Unix seconds", "webhook_timestamp_invalid");
+    }
+    const deliveryId = requireString(request.headers["x-kxm-delivery-id"], "webhook delivery identifier", { max: 128 });
+    if (!safeTokenEqual(signature, workflowWebhookSignature(secret, scope, timestamp, deliveryId, body))) {
+      throw new ProtocolError(401, "webhook signature is invalid", "webhook_signature_invalid");
+    }
+    if (Math.abs(Date.now() / 1e3 - Number(timestamp)) > WORKFLOW_WEBHOOK_MAX_SKEW_SECONDS) {
+      throw new ProtocolError(
+        401,
+        `webhook timestamp is outside the ${WORKFLOW_WEBHOOK_MAX_SKEW_SECONDS}-second window; re-sign at send time`,
+        "webhook_timestamp_expired"
+      );
+    }
+    return deliveryId;
   }
   function workflowPrompt(definition, runId, payload) {
     const rendered = renderWorkflowPrompt(definition.promptTemplate, payload);
@@ -21125,7 +21204,7 @@ data: ${JSON.stringify({ type: "ops", project, topic, at: nowIso() })}
       stageList,
       "",
       `At every stage, record material knowledge with kxm_workflow_record in one of these categories: ${JOURNAL_CATEGORIES.join(", ")}. Pass the stageId the entry belongs to; the hub binds the attempt and, when you omit area, uses the stage's declared area.`,
-      "Keep repository-local configuration in .kxm/config, logs in .kxm/logs, and durable workflow artifacts in .kxm/assets; never commit runtime logs, state, or secrets.",
+      "Keep reviewed configuration as YAML directly under .kxm/ (such as .kxm/project.yaml and .kxm/workflows/), logs in .kxm/logs, and durable workflow artifacts in .kxm/assets. Never create .kxm/config, which KXM refuses, and never commit runtime logs, .kxm/state, or secrets.",
       "Complete each stage with kxm_workflow_checkpoint. Supply evidence as an object whose keys exactly match the stage's required evidence keys. Unrelated keys never satisfy a requirement. A warning or failure must be corrected and checkpointed again until it passes or the attempt limit is reached.",
       "For a peer-evidence requirement, send or fan out with workflowContext containing this run ID, the exact stage ID, requirement key, and current 1-based attempt. At checkpoint, cite only the returned message IDs under evidenceRefs; the hub derives producer and reply provenance.",
       "When an external system must finish asynchronously, call kxm_workflow_wait with a stable signal key and any already-verified keyed evidence. That evidence is accumulated with the signed callback before the stage can pass; then settle the turn.",
@@ -21463,14 +21542,17 @@ data: ${JSON.stringify({ type: "ops", project, topic, at: nowIso() })}
         const definition = webhookWorkflows2.get(definitionId);
         if (!definition) throw new ProtocolError(404, "webhook workflow not found", "webhook_not_found");
         const rawBody = await readBody(request);
-        verifyWebhookSignature(request, rawBody, definition.signalSecret ?? definition.secret);
+        const deliveryId = verifyKxmWebhookSignature(
+          request,
+          rawBody,
+          definition.signalSecret ?? definition.secret,
+          { definitionId: definition.id, runId, signalKey }
+        );
         const body = parseJsonBody(rawBody);
         const run = workflowRuns.get(runId);
         if (!run || run.definitionId !== definition.id) {
           throw new ProtocolError(404, "workflow run not found", "workflow_not_found");
         }
-        const deliveryHeader = request.headers["x-atlassian-webhook-identifier"] ?? request.headers["x-github-delivery"] ?? request.headers["x-kxm-delivery-id"];
-        const deliveryId = requireString(deliveryHeader, "webhook delivery identifier", { max: 128 });
         const payloadHash = createHash5("sha256").update(rawBody).digest("hex");
         const existingReceipt = run.signalReceipts?.find((receipt2) => receipt2.deliveryId === deliveryId);
         if (existingReceipt) {
@@ -21616,7 +21698,8 @@ data: ${JSON.stringify({ type: "ops", project, topic, at: nowIso() })}
         const definition = webhookWorkflows2.get(definitionId);
         if (!definition) throw new ProtocolError(404, "webhook workflow not found", "webhook_not_found");
         const rawBody = await readBody(request);
-        verifyWebhookSignature(request, rawBody, definition.secret);
+        const bodyOnlySignature = request.headers["x-kxm-signature"] === void 0;
+        const deliveryId = bodyOnlySignature ? verifyProviderWebhookSignature(request, rawBody, definition) : verifyKxmWebhookSignature(request, rawBody, definition.secret, { definitionId: definition.id });
         const payload = parseJsonBody(rawBody);
         const event = webhookEvent(request, payload);
         if (definition.event && event !== definition.event) {
@@ -21627,15 +21710,30 @@ data: ${JSON.stringify({ type: "ops", project, topic, at: nowIso() })}
           response.writeHead(204, { "cache-control": "no-store" }).end();
           return;
         }
-        const deliveryHeader = request.headers["x-atlassian-webhook-identifier"] ?? request.headers["x-github-delivery"] ?? request.headers["x-kxm-delivery-id"];
-        const deliveryId = requireString(deliveryHeader, "webhook delivery identifier", { max: 128 });
+        const payloadHash = createHash5("sha256").update(rawBody).digest("hex");
         const existing = [...workflowRuns.values()].find(
           (run2) => run2.definitionId === definition.id && run2.deliveryId === deliveryId
         );
         if (existing) {
-          json(response, 200, { run: existing, duplicate: true });
+          if (existing.payloadHash !== payloadHash) {
+            throw new ProtocolError(
+              409,
+              "webhook delivery identifier was already used for a different body",
+              "webhook_delivery_conflict"
+            );
+          }
+          json(response, 200, { duplicate: true, runId: existing.id, status: existing.status });
           return;
         }
+        if (bodyOnlySignature && [...workflowRuns.values()].some(
+          (run2) => run2.definitionId === definition.id && run2.payloadHash === payloadHash
+        )) {
+          throw new ProtocolError(
+            409,
+            "this signed body already started a run under another delivery identifier",
+            "webhook_payload_replayed"
+          );
+        }
         const target = findKnownTarget(definition.project, definition.target);
         const createdAt = nowIso();
         const runId = newId("run");
@@ -21685,7 +21783,7 @@ data: ${JSON.stringify({ type: "ops", project, topic, at: nowIso() })}
           definitionId: definition.id,
           source: definition.source,
           deliveryId,
-          payloadHash: createHash5("sha256").update(rawBody).digest("hex"),
+          payloadHash,
           definitionHash: workflowDefinitionHash(definition),
           ...event ? { event } : {},
           project: definition.project,
@@ -21716,7 +21814,7 @@ data: ${JSON.stringify({ type: "ops", project, topic, at: nowIso() })}
           project: definition.project,
           target: target.id
         });
-        json(response, 202, { run, duplicate: false });
+        json(response, 202, { run, runId: run.id, duplicate: false });
         return;
       }
       if (method === "GET" && url.pathname === "/metrics") {
@@ -22656,7 +22754,11 @@ data: ${JSON.stringify({ agent: publicAgent(current, staleAfterMs) })}
         const hops = parseBoundedInteger(body.hops, "hops", 0, 0, 100);
         const maxHops = parseBoundedInteger(body.maxHops, "maxHops", DEFAULT_MAX_HOPS, 1, 20);
         if (hops >= maxHops) {
-          throw new ProtocolError(400, `hop limit reached (${hops}/${maxHops})`, "hop_limit_reached");
+          throw new ProtocolError(
+            400,
+            `hop limit reached (${hops}/${maxHops}): this request would extend a chain of forwarded requests past its limit; answer the inbound request directly`,
+            "hop_limit_reached"
+          );
         }
         const ttlMs = parseBoundedInteger(
           body.ttlMs,

package/plugins/kxm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-plugin",
-  "version": "0.7.96",
+  "version": "0.7.98",
   "private": true,
   "type": "module",
   "engines": {

package/plugins/kxm/skills/kxm-hub-ops/SKILL.md

@@ -15,7 +15,7 @@ invent restart or status subcommands.
 |---|---|---|
 | `kxm hub view` | Check `/health` and `/ready`; exits 1 when the hub is down | `--json` |
 | `kxm tenant status` | Hub metadata and Runtime run state as one labeled view; reads only and never starts the supervisor | `--json` |
-| `kxm backup` | Verified SQLite backup of the hub stores with a hashed manifest | `--out <dir>`, `--json` |
+| `kxm backup` | Verified SQLite backup of the hub store and the Runtime stores with a hashed manifest; exits 1 when the backup is incomplete | `--out <dir>`, `--json` |
 
 ```bash
 kxm hub view --json
@@ -30,8 +30,9 @@ runs have separate ID spaces, so a comparison with no shared ID is
 `unverified`, never agreement.
 
 The durable hub store defaults to `.kxm/state/kxm.db` (`KXM_DATA_PATH`). Do not
-hand-edit it. `kxm backup` does not include the Runtime supervisor's stores
-under the user state root.
+hand-edit it. `kxm backup` also copies the Runtime registry and every
+project's run event store and prompt sidecar under the user state root, so a
+`kxm restore` rolls back every project on the machine, not only this one.
 
 ## Operator steps
 

package/plugins/kxm/skills/kxm-project-setup/SKILL.md

@@ -122,8 +122,9 @@ or store the admin or project token in the conversation. The user enters
   in a workflow step, then run `kxm init` again. Only when
   `.kxm/project.yaml` does not exist yet, ask the user to follow the README's
   move-aside workaround; never do that in a committed project.
-- The template `default` workflow declares `limits.maxAgentTimeMs`, so
-  `kxm runs drive` on it fails with `run_handoff_required`. Use `first`.
+- The template `default` workflow can be driven, but even a simulated drive
+  runs its `npm test` gate, and a live drive spends Claude and Grok and lets
+  Grok edit the checkout. Use `first` for the first run.
 - `kxm run` starts the Runtime supervisor. Stop it with `kxm runtime stop`.
 - Only run workflow IDs that `kxm workflow definitions` lists; any other ID
   fails with `run_workflow_unknown`.

package/plugins/kxm/skills/kxm-routing-improve/SKILL.md

@@ -73,11 +73,14 @@ Never apply a candidate diff yourself or treat `readyForReview` as approval.
 |---|---|---|
 | `kxm routing report` | Compare verified completion, cost, and rework per behavioral configuration | `-f/--file`, `-l/--equivalent-list-cost`, `--list-prices`, `--prices <path>` |
 | `kxm routing benchmark` | Placeholder side-by-side comparison | `--task`, `--arms`, `--runs` |
+| `kxm prices acknowledge` | Stamp the existing `.kxm/prices.yaml` list as today's estimate without fetching vendor rates | `--json` |
 
 `kxm routing report` reads the same sources as `kxm improve`, and
 `routing report --json` includes the `sources`. `kxm routing benchmark` prints
 fixed placeholder figures in this build; never cite them as measured cost or
 quality. Use `kxm routing report` for recorded spend.
+Estimates stay unknown until the catalog carries today's stamp, and a routing
+total is null when any attempt has no cost.
 
 `--equivalent-list-cost` loads the price catalog (`.kxm/prices.yaml`, or
 `--prices <path>`) without a freshness check, so an old catalog quotes old

package/plugins/kxm/skills/kxm-runs/SKILL.md

@@ -7,8 +7,9 @@ description: Create, drive, and inspect local KXM runs. kxm runs drive with --si
 
 `kxm run` creates a run of a project workflow in the local Runtime and starts
 the Runtime supervisor. A created run stays `created` until
-`kxm runs drive` executes it. Do not invent get, create, or logs verbs under
-`runs`.
+`kxm runs drive` executes the pinned plan. Live drive is the default and spends
+an admitted model; `--simulated` is the model-free producer. Do not invent get,
+create, or logs verbs under `runs`.
 
 ## Commands
 
@@ -58,11 +59,11 @@ the receipt's settlement is terminal `completed`.
 - `run_workflow_unknown`: the workflow ID is not a project workflow. Run only
   IDs that `kxm workflow definitions` lists.
 - `run_handoff_required`: the Runtime does not execute a field the workflow
-  uses, so drive fails with `runtime request failed with HTTP 409` and the run
-  stays `preparing`. The template `default` workflow declares
-  `limits.maxAgentTimeMs`, which is one such field. Cancel the run with
-  `kxm runs cancel <runId>` and drive a workflow without the field, such as
-  `first`.
+  uses (such as `limits.maxAgentTimeMs`, which a fresh `kxm init` no longer
+  writes), so drive fails with `runtime request failed with HTTP 409` and the
+  run stays `preparing`. Cancel the run with `kxm runs cancel <runId>` and drive
+  a workflow without the field, such as `first`.
 
 Listing or status alone is not proof that steps ran; a verified receipt is.
+A read-only step that settles `passed` did not author a checkout change.
 `kxm workflow list` shows hub webhook runs, not these runs.

package/plugins/kxm/src/cli/project.ts

@@ -185,36 +185,41 @@ export async function cmdBackup(runtime: Runtime, options: { out?: string | unde
   try {
     const backupOptions = {
       projectRoot: runtime.cwd,
+      env: runtime.env,
       ...(options.out ? { outDir: resolve(runtime.cwd, options.out) } : {}),
     };
     if (runtime.dryRun) {
       const plan = planBackup(backupOptions);
       printPlan(
         runtime,
-        { command: "backup", outDir: plan.outDir, stores: plan.stores },
+        { command: "backup", outDir: plan.outDir, stores: plan.stores, files: plan.files },
         [
-          ...plan.stores.map((store) => ({ action: "write" as const, target: join(plan.outDir, store.backupFile) })),
+          ...[...plan.stores, ...plan.files].map((entry) => ({ action: "write" as const, target: join(plan.outDir, entry.backupFile) })),
           { action: "write", target: join(plan.outDir, "manifest.json") },
         ],
-        `back up ${plan.stores.length} store(s) to ${plan.outDir} (sources are not opened, so their WAL is not checkpointed)`,
+        `back up ${plan.stores.length} store(s) and ${plan.files.length} file(s) to ${plan.outDir} (sources are not opened, so their WAL is not checkpointed)`,
       );
       return 0;
     }
     const { manifest, outDir } = createBackup(backupOptions);
+    const complete = manifest.complete === true;
     const payload = {
-      ok: true,
+      ok: complete,
       command: "backup",
       backupId: manifest.backupId,
       outDir,
       manifest,
     };
     const summary = [
-      `Created SQLite backup with ${manifest.stores.length} store(s):`,
+      complete
+        ? `Created SQLite backup with ${manifest.stores.length} store(s):`
+        : `Backup is incomplete (${manifest.omitted?.length ?? 0} omitted); not ok:`,
       ...manifest.stores.map((s) => `  - ${s.storeId}: ${s.sourcePath} -> ${s.backupFile} (schema v${s.schemaVersion}, ${s.bytes} bytes, sha256 ${s.sha256.slice(0, 12)}...)`),
+      ...(manifest.omitted ?? []).map((id) => `  - omitted ${id}`),
       `Manifest: ${join(outDir, "manifest.json")}`,
     ].join("\n");
     print(runtime.io, runtime.json, payload, summary);
-    return 0;
+    return complete ? 0 : 1;
   } catch (error) {
     if (error instanceof KxmConfigError) {
       print(runtime.io, runtime.json, { ok: false, command: "backup", error: "backup_failed", issues: error.issues }, `backup failed: ${error.message}`);
@@ -236,14 +241,18 @@ export async function cmdRestore(runtime: Runtime, manifestArg: string): Promise
           backupId: plan.backupId,
           manifestPath: plan.manifestPath,
           stores: plan.stores.map(({ storeId, targetPath, schemaVersion }) => ({ storeId, targetPath, schemaVersion })),
+          files: plan.files.map(({ id, targetPath }) => ({ id, targetPath })),
         },
-        plan.stores.flatMap((store) => [
-          { action: "write" as const, target: store.targetPath },
-          ...[`${store.targetPath}-wal`, `${store.targetPath}-shm`]
-            .filter((file) => existsSync(file))
-            .map((file) => ({ action: "delete" as const, target: file })),
-        ]),
-        `restore ${plan.stores.length} store(s) from ${plan.manifestPath}; digests verified against the manifest`,
+        [
+          ...plan.stores.flatMap((store) => [
+            { action: "write" as const, target: store.targetPath },
+            ...[`${store.targetPath}-wal`, `${store.targetPath}-shm`]
+              .filter((file) => existsSync(file))
+              .map((file) => ({ action: "delete" as const, target: file })),
+          ]),
+          ...plan.files.map((file) => ({ action: "write" as const, target: file.targetPath })),
+        ],
+        `restore ${plan.stores.length} store(s) and ${plan.files.length} file(s) from ${plan.manifestPath}; digests verified against the manifest`,
       );
       return 0;
     }

package/plugins/kxm/src/cli/system.ts

@@ -20,7 +20,7 @@ import {
   type RoutingRecord,
   type RoutingRecordV2,
 } from "../routing.ts";
-import { loadPriceCatalog, type PriceCatalog } from "../prices.ts";
+import { acknowledgePriceCatalog, loadPriceCatalog, type PriceCatalog } from "../prices.ts";
 import {
   buildImprovementReport,
   formatImprovementReport,
@@ -59,6 +59,7 @@ import {
 import {
   GUIDE_WORKFLOWS,
   parseGuideSelection,
+  mergeGuideRouteAdmission,
   planGuideSetup,
   renderGuideSetupFiles,
   writeGuideSetupFiles,
@@ -867,8 +868,10 @@ export async function maybeOfferGuideSetup(runtime: Runtime): Promise<void> {
   const plan = planGuideSetup({ inventory, selected });
   const files = renderGuideSetupFiles(runtime.cwd, plan);
   const report = writeGuideSetupFiles(files);
+  const admitted = mergeGuideRouteAdmission(runtime.cwd, plan);
   for (const file of report.written) runtime.io.stdout(`wrote ${file}\n`);
   for (const file of report.existed) runtime.io.stdout(`kept existing ${file} (not overwritten)\n`);
+  for (const selector of admitted) runtime.io.stdout(`admitted route ${selector}\n`);
   for (const skip of plan.skipped) {
     runtime.io.stdout(`skipped ${skip.workflow}/${skip.role}: ${skip.reason}\n`);
   }
@@ -877,6 +880,24 @@ export async function maybeOfferGuideSetup(runtime: Runtime): Promise<void> {
   }
 }
 
+export async function cmdPricesAcknowledge(runtime: Runtime): Promise<number> {
+  try {
+    const catalog = acknowledgePriceCatalog(runtime.cwd);
+    print(runtime.io, runtime.json, {
+      ok: true,
+      command: "prices acknowledge",
+      date: catalog.date,
+      sha256: catalog.sha256,
+      note: "stamped the existing list as today's estimate; vendor rates were not fetched",
+    }, `price catalog stamped ${catalog.date} (list estimate only; vendor rates were not fetched)`);
+    return 0;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    print(runtime.io, runtime.json, { ok: false, command: "prices acknowledge", error: "prices_acknowledge_failed", message }, `prices acknowledge failed: ${message}`);
+    return 1;
+  }
+}
+
 export async function cmdRoutingReport(
   runtime: Runtime,
   options: { file?: string | undefined; equivalentListCost?: boolean | undefined; listPrices?: boolean | undefined; prices?: string | undefined },

package/plugins/kxm/src/cli/workflows.ts

@@ -1,4 +1,4 @@
-import { createHmac, randomUUID } from "node:crypto";
+import { randomUUID } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { basename, join, resolve } from "node:path";
 import { openReadOnlyDatabase } from "../sqlite.ts";
@@ -16,12 +16,14 @@ import {
 import {
   canonicalWorkflowEvidenceKey,
   parseWorkflowDefinitions,
+  workflowWebhookHeaders,
   type WorkflowEvidenceInput,
   type WorkflowJournalEntry,
   type WorkflowRun,
 } from "../workflow.ts";
 import { discoverKxmProjectRoot } from "../project-config.ts";
 import { ensureKxmSupervisor, kxmRuntimeRequest } from "../runtime-supervisor.ts";
+import { projectRuntimeOwnsRun } from "../runtime-store.ts";
 import type { WorkerOutcome } from "../envelope.ts";
 import {
   print,
@@ -67,19 +69,22 @@ export async function postWorkflowStart(input: {
     ? { ...input.payload, event: input.event }
     : input.payload;
   const body = JSON.stringify(payload);
-  const signature = `sha256=${createHmac("sha256", input.secret).update(body).digest("hex")}`;
   const response = await input.fetchImpl(`${input.serverUrl.replace(/\/$/, "")}/v1/webhooks/${encodeURIComponent(input.definitionId)}`, {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      "x-hub-signature-256": signature,
-      "x-kxm-delivery-id": input.deliveryId,
+      ...workflowWebhookHeaders({
+        secret: input.secret,
+        scope: { definitionId: input.definitionId },
+        deliveryId: input.deliveryId,
+        body,
+      }),
       ...(input.event ? { "x-github-event": input.event } : {}),
     },
     body,
   });
   const responseText = (await response.text()).slice(0, 8_000);
-  let parsed: { run?: { id?: string }; duplicate?: boolean } = {};
+  let parsed: { runId?: string; duplicate?: boolean } = {};
   try {
     parsed = JSON.parse(responseText);
   } catch {
@@ -88,7 +93,7 @@ export async function postWorkflowStart(input: {
   if (!response.ok) throw new Error(`workflow_start_http_${response.status}`);
   return {
     status: response.status,
-    ...(parsed.run?.id ? { runId: parsed.run.id } : {}),
+    ...(parsed.runId ? { runId: parsed.runId } : {}),
     duplicate: parsed.duplicate === true,
   };
 }
@@ -536,7 +541,7 @@ export async function cmdSignal(runtime: Runtime, runId: string, signalKey: stri
   }
   const worker = gateOf(runtime, "signal");
   const projectRoot = discoverKxmProjectRoot(runtime.cwd);
-  if (projectRoot && /^run_[a-f0-9]{32}$/i.test(runId)) {
+  if (projectRoot && projectRuntimeOwnsRun(projectRoot, runId, runtime.env)) {
     if (runtime.dryRun) {
       printWorker(runtime, worker, { ok: true, command: "signal", dryRun: true, runId, signalKey, status, summary, evidence }, "would post signal to KXM run");
       return 0;