@mingchuno/agent-workflows 0.4.0 → 0.5.0

package/dist/src/adapters/agents.js

@@ -84,6 +84,7 @@ export class SDKAgent {
         const worker = join(dirname(ownPath), `agent-worker.${source ? "ts" : "js"}`);
         let buffer = "", output = "", events = Promise.resolve();
         let eventError;
+        let stderr = "";
         const persistenceFailure = new AbortController();
         try {
             await command(process.execPath, [
@@ -97,6 +98,9 @@ export class SDKAgent {
                     ...(signal ? [signal] : []),
                 ]),
                 captureOutput: false,
+                onStderr: (chunk) => {
+                    stderr = (stderr + chunk).slice(-16_384);
+                },
                 processFile: invocation?.processFile,
                 timeoutMs: invocation
                     ? (invocation.timeoutMs ?? defaultStageTimeoutMs)
@@ -128,6 +132,11 @@ export class SDKAgent {
                             });
                     }
                 },
+            }).catch((error) => {
+                const detail = stderr.trim();
+                throw detail
+                    ? new Error(`${String(error)}\nWorker stderr (last 16 KiB):\n${detail}`)
+                    : error;
             });
             await events;
             if (eventError)

package/dist/src/cli.js

@@ -165,6 +165,9 @@ program
     const record = await store.run(run);
     const invocations = (await store.invocations(run)).filter((item) => !options.invocation || item.id === options.invocation);
     const paths = [
+        ...(!options.invocation
+            ? (record.stageLogs?.map((item) => item.path) ?? [])
+            : []),
         ...invocations.map((item) => item.log),
         ...(!options.invocation
             ? (record.validation?.map((check) => check.log) ?? [])
@@ -180,7 +183,7 @@ program
         }
     }
 }));
-for (const kind of ["pause", "resume", "stop", "retry", "recover"])
+for (const kind of ["pause", "resume", "stop", "recover"])
     program
         .command(`${kind} <target>`)
         .description(`${kind} project or run through the active runner`)
@@ -190,6 +193,16 @@ for (const kind of ["pause", "resume", "stop", "retry", "recover"])
             status: "pending",
         }));
     }));
+program
+    .command("retry <target>")
+    .description("retry a run through the active runner")
+    .option("--refresh-issue", "use the current hosted issue for the new run")
+    .action(async (target, options) => withStore(async (store) => {
+    console.log(JSON.stringify({
+        commandId: await store.request(options.refreshIssue ? "retry-refresh" : "retry", target),
+        status: "pending",
+    }));
+}));
 program
     .command("monitor")
     .option("--notify", "notify when an observed execution reaches an outcome")

package/dist/src/config.d.ts

@@ -51,6 +51,11 @@ export declare const projectSchema: z.ZodObject<{
         args: z.ZodDefault<z.ZodArray<z.ZodString>>;
         timeoutMs: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strict>>>;
+    validationProfiles: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
+        command: z.ZodString;
+        args: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        timeoutMs: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>>>>;
     includeAgentCoAuthors: z.ZodDefault<z.ZodBoolean>;
     agent: z.ZodObject<{
         provider: z.ZodEnum<{
@@ -144,6 +149,11 @@ export declare const configSchema: z.ZodObject<{
             args: z.ZodDefault<z.ZodArray<z.ZodString>>;
             timeoutMs: z.ZodDefault<z.ZodNumber>;
         }, z.core.$strict>>>;
+        validationProfiles: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
+            command: z.ZodString;
+            args: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            timeoutMs: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strict>>>>;
         includeAgentCoAuthors: z.ZodDefault<z.ZodBoolean>;
         agent: z.ZodObject<{
             provider: z.ZodEnum<{

package/dist/src/config.js

@@ -29,6 +29,11 @@ export const stageSchema = z
         : undefined,
 })
     .refine((stage) => stage.prompt === undefined || stage.promptFile === undefined, "Specify either prompt or promptFile, never both");
+const validationCommandSchema = z.strictObject({
+    command: z.string().min(1),
+    args: z.array(z.string()).default([]),
+    timeoutMs: z.number().int().positive().default(defaultValidationTimeoutMs),
+});
 export const projectSchema = z.strictObject({
     id: z.string().regex(/^[a-zA-Z0-9_-]+$/),
     checkout: z.string().min(1),
@@ -49,17 +54,10 @@ export const projectSchema = z.strictObject({
         .includes("{issue}")
         .default("agent/{issue}-{attempt}"),
     pollIntervalMs: z.number().int().min(100).default(30_000),
-    validation: z
-        .array(z.strictObject({
-        command: z.string().min(1),
-        args: z.array(z.string()).default([]),
-        timeoutMs: z
-            .number()
-            .int()
-            .positive()
-            .default(defaultValidationTimeoutMs),
-    }))
-        .default([]),
+    validation: z.array(validationCommandSchema).default([]),
+    validationProfiles: z
+        .record(z.string().regex(/^[a-zA-Z0-9_-]+$/), z.array(validationCommandSchema).min(1))
+        .default({}),
     includeAgentCoAuthors: z.boolean().default(true),
     agent: profileSchema,
     stages: z

package/dist/src/domain.d.ts

@@ -135,6 +135,7 @@ export interface RunRecord {
     attempt: number;
     retryOf?: string;
     issue: Issue;
+    validationProfile?: string;
     outcome: Outcome;
     phase: string;
     createdAt: string;
@@ -152,6 +153,11 @@ export interface RunRecord {
     reviewHead?: string;
     error?: string;
     failedStep?: number;
+    stageLogs?: Array<{
+        executionId: string;
+        step: string;
+        path: string;
+    }>;
     executions?: ExecutionRecord[];
 }
 export declare class BlockedError extends Error {

package/dist/src/invocation.d.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { type Stage } from "./config.js";
-import { type ContributionCandidate, type RunRecord, type Snapshot } from "./domain.js";
+import { type RunRecord } from "./domain.js";
 import { type ChangeEvidence } from "./evidence.js";
 import type { OperationDependencies } from "./operations.js";
 export interface InvocationTask {
@@ -17,9 +17,7 @@ interface StageExecution {
     task: InvocationTask;
     stepId: number;
     dependencies: OperationDependencies;
-    saveImplementationSnapshot: (runId: string, snapshot: Snapshot, provider: string) => Promise<ContributionCandidate | undefined>;
-    acceptContribution: (runId: string, candidate: ContributionCandidate) => Promise<void>;
 }
 /** One logical stage; only returned format errors admit a second response attempt. */
-export declare function invokeStage({ run, name, stage, task, stepId, dependencies, saveImplementationSnapshot, acceptContribution, }: StageExecution): Promise<string>;
+export declare function invokeStage(execution: StageExecution): Promise<string>;
 export {};

package/dist/src/invocation.js

@@ -8,8 +8,46 @@ import { verifyEvidence } from "./evidence.js";
 import { resolveStagePrompt, sha256 } from "./prompts.js";
 const maxInvocationAttempts = 2;
 /** One logical stage; only returned format errors admit a second response attempt. */
-export async function invokeStage({ run, name, stage, task, stepId, dependencies, saveImplementationSnapshot, acceptContribution, }) {
-    const { store, project, agents, signal, workspace, redact } = dependencies;
+export async function invokeStage(execution) {
+    const { run, name, stepId, dependencies } = execution;
+    const directory = join(dependencies.artifacts, run.id);
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const path = join(directory, `stage-${name}-${stepId}.log`);
+    const executionId = run.executions?.at(-1)?.id ?? run.id;
+    await dependencies.store.patchRun(run.id, {
+        stageLogs: [
+            ...(run.stageLogs ?? []).filter((item) => item.executionId !== executionId || item.step !== name),
+            { executionId, step: name, path },
+        ],
+    });
+    const note = (message) => appendFile(path, `${new Date().toISOString()} ${dependencies.redact(message)}\n`, { mode: 0o600 });
+    try {
+        await note(`Preparing ${name} agent stage`);
+        const prepared = await prepareStage(execution, note);
+        await note(`Agent preflight passed: ${prepared.profile.provider}`);
+        let attempt = { number: 1, correction: "" };
+        while (attempt.number <= maxInvocationAttempts) {
+            await note(`Starting invocation ${attempt.number}`);
+            const result = await invokeAttempt(execution, prepared, attempt);
+            if (result.kind === "completed") {
+                await note(`${name} agent stage completed`);
+                return result.output;
+            }
+            attempt = {
+                number: attempt.number + 1,
+                correction: result.correction,
+                contribution: result.contribution,
+            };
+        }
+        throw new Error("Format correction exhausted");
+    }
+    catch (error) {
+        await note(`Failed: ${String(error)}`);
+        throw error;
+    }
+}
+async function refusePreviousInvocations(execution) {
+    const { run, name, stepId, dependencies: { store }, } = execution;
     const previous = (await store.invocations(run.id)).filter((item) => item.stepId === stepId);
     if (previous.length) {
         for (const record of previous) {
@@ -23,11 +61,10 @@ export async function invokeStage({ run, name, stage, task, stepId, dependencies
         }
         throw new BlockedError(`Interrupted agent stage ${name}; inspect existing sessions before explicit retry`);
     }
-    if (!run.snapshot)
-        throw new BlockedError("Missing workspace snapshot");
-    await workspace.verify(project, run.snapshot);
-    if (task.evidence)
-        await verifyEvidence(task.evidence);
+}
+function prepareRequest(execution) {
+    const { run, stage, task, dependencies } = execution;
+    const { project } = dependencies;
     const resolved = resolveStagePrompt(stage, task.defaultPrompt, dependencies.promptBaseDirectory);
     const outputSchema = task.outputContract
         ? z.toJSONSchema(task.outputContract)
@@ -44,6 +81,19 @@ export async function invokeStage({ run, name, stage, task, stepId, dependencies
         contract,
     ].join("\n\n");
     const profile = resolveProfile(project.agent, stage.profile);
+    return { resolved, outputSchema, fullPrompt, profile };
+}
+async function prepareStage(execution, note) {
+    const { run, stage, task, dependencies } = execution;
+    const { project, agents, signal, workspace } = dependencies;
+    await refusePreviousInvocations(execution);
+    if (!run.snapshot)
+        throw new BlockedError("Missing workspace snapshot");
+    await workspace.verify(project, run.snapshot);
+    if (task.evidence)
+        await verifyEvidence(task.evidence);
+    const request = prepareRequest(execution);
+    const { profile } = request;
     const adapter = agents[profile.provider];
     if (!adapter)
         throw new Error(`Missing agent adapter ${profile.provider}`);
@@ -52,115 +102,162 @@ export async function invokeStage({ run, name, stage, task, stepId, dependencies
         signal,
         AbortSignal.timeout(stage.timeoutMs),
     ]);
+    await note(`Validating ${profile.provider} agent profile`);
     const effective = await adapter.validate(profile, invocationSignal);
     const directory = join(dependencies.artifacts, run.id);
     await mkdir(directory, { recursive: true, mode: 0o700 });
-    let correction = "";
-    let pendingContribution;
-    for (let attempt = 1; attempt <= maxInvocationAttempts; attempt++) {
+    return {
+        ...request,
+        adapter,
+        effective,
+        deadline,
+        invocationSignal,
+        directory,
+    };
+}
+async function invokeAttempt(execution, prepared, attempt) {
+    const { run, name, task, stepId, dependencies } = execution;
+    const { store, project, workspace, redact } = dependencies;
+    const { profile, effective, resolved, outputSchema, fullPrompt, directory, invocationSignal, } = prepared;
+    invocationSignal.throwIfAborted();
+    const expected = (await store.run(run.id)).snapshot;
+    await workspace.verify(project, expected);
+    if (task.evidence)
+        await verifyEvidence(task.evidence);
+    const id = randomUUID();
+    const prompt = fullPrompt + attempt.correction;
+    const readOnly = task.readOnly === true || attempt.number === maxInvocationAttempts;
+    const record = {
+        id,
+        runId: run.id,
+        projectId: project.id,
+        step: name,
+        stepId,
+        attempt: attempt.number,
+        provider: profile.provider,
+        sessionId: null,
+        sessionState: "pending",
+        requested: profile,
+        effective,
+        prompt: redact(prompt),
+        taskPrompt: { ...resolved, content: redact(resolved.content) },
+        outputContract: outputSchema
+            ? sha256(JSON.stringify(outputSchema))
+            : undefined,
+        evidence: task.evidence,
+        outcome: "running",
+        startedAt: new Date().toISOString(),
+        log: join(directory, `${id}.jsonl`),
+    };
+    await store.saveInvocation(record);
+    try {
+        invocationSignal.throwIfAborted();
+        const output = await invokeProvider(execution, prepared, {
+            record,
+            prompt,
+            readOnly,
+        });
+        await appendFile(record.log, "", { mode: 0o600 });
         invocationSignal.throwIfAborted();
-        const expected = (await store.run(run.id)).snapshot;
-        await workspace.verify(project, expected);
+        let contribution = attempt.contribution;
+        if (readOnly)
+            await workspace.verify(project, expected);
+        else
+            contribution = await saveImplementationSnapshot(run.id, expected, profile.provider, dependencies);
         if (task.evidence)
             await verifyEvidence(task.evidence);
-        const id = randomUUID();
-        const prompt = fullPrompt + correction;
-        const readOnly = task.readOnly === true || attempt === maxInvocationAttempts;
-        const record = {
-            id,
-            runId: run.id,
-            projectId: project.id,
-            step: name,
-            stepId,
-            attempt,
-            provider: profile.provider,
-            sessionId: null,
-            sessionState: "pending",
-            requested: profile,
-            effective,
-            prompt: redact(prompt),
-            taskPrompt: { ...resolved, content: redact(resolved.content) },
-            outputContract: outputSchema
-                ? sha256(JSON.stringify(outputSchema))
-                : undefined,
-            evidence: task.evidence,
-            outcome: "running",
-            startedAt: new Date().toISOString(),
-            log: join(directory, `${id}.jsonl`),
+        invocationSignal.throwIfAborted();
+        const response = validateResponse(output, task.outputContract);
+        if (response.kind === "invalid") {
+            const correction = await recordInvalidResponse(record, output, response.error, redact);
+            return { kind: "correction", correction, contribution };
+        }
+        if (contribution)
+            await acceptContribution(run.id, contribution, dependencies);
+        record.outcome = "completed";
+        return {
+            kind: "completed",
+            output: redact(task.outputContract ? JSON.stringify(response.parsed) : output),
         };
+    }
+    catch (error) {
+        if (record.outcome === "running")
+            record.outcome = "failed";
+        throw error;
+    }
+    finally {
+        record.finishedAt = new Date().toISOString();
+        if (!record.sessionId)
+            record.sessionState = "unavailable";
         await store.saveInvocation(record);
-        try {
-            invocationSignal.throwIfAborted();
-            const output = await adapter.invoke({
-                id,
-                runId: run.id,
-                step: name,
-                cwd: project.checkout,
-                prompt,
-                profile,
-                outputSchema,
-                processFile: record.log + ".process.json",
-                readOnly,
-                signal: invocationSignal,
-                timeoutMs: Math.max(1, deadline - Date.now()),
-                session: async (sessionId) => {
-                    record.sessionId = sessionId;
-                    record.sessionState = "available";
-                    await store.saveInvocation(record);
-                },
-                event: async (event) => {
-                    await appendFile(record.log, redact(JSON.stringify(event)) + "\n", {
-                        mode: 0o600,
-                    });
-                },
+    }
+}
+async function invokeProvider(execution, prepared, attempt) {
+    const { run, name, dependencies: { project, store, redact }, } = execution;
+    const { adapter, profile, outputSchema, invocationSignal, deadline } = prepared;
+    const { record, prompt, readOnly } = attempt;
+    return adapter.invoke({
+        id: record.id,
+        runId: run.id,
+        step: name,
+        cwd: project.checkout,
+        prompt,
+        profile,
+        outputSchema,
+        processFile: record.log + ".process.json",
+        readOnly,
+        signal: invocationSignal,
+        timeoutMs: Math.max(1, deadline - Date.now()),
+        session: async (sessionId) => {
+            record.sessionId = sessionId;
+            record.sessionState = "available";
+            await store.saveInvocation(record);
+        },
+        event: async (event) => {
+            await appendFile(record.log, redact(JSON.stringify(event)) + "\n", {
+                mode: 0o600,
             });
-            await appendFile(record.log, "", { mode: 0o600 });
-            invocationSignal.throwIfAborted();
-            if (readOnly)
-                await workspace.verify(project, expected);
-            else
-                pendingContribution = await saveImplementationSnapshot(run.id, expected, profile.provider);
-            if (task.evidence)
-                await verifyEvidence(task.evidence);
-            invocationSignal.throwIfAborted();
-            // Only returned output validation failures qualify for correction.
-            let parsed;
-            try {
-                parsed = task.outputContract
-                    ? task.outputContract.parse(JSON.parse(output))
-                    : undefined;
-            }
-            catch (error) {
-                if (!(error instanceof SyntaxError) && !(error instanceof z.ZodError))
-                    throw error;
-                record.outcome = "invalid-output";
-                record.validationError = redact(String(error));
-                await appendFile(record.log, redact(JSON.stringify({
-                    type: "invalid-output",
-                    output,
-                    error: String(error),
-                })) + "\n");
-                if (attempt === maxInvocationAttempts)
-                    throw new Error(`Invalid output after one correction: ${String(error)}`);
-                correction = `\n\nCorrect the prior response format in this fresh inspection-only session. Do not modify files.\nPrior invalid response:\n${output}\nValidation errors:\n${String(error)}`;
-                continue;
-            }
-            if (pendingContribution)
-                await acceptContribution(run.id, pendingContribution);
-            record.outcome = "completed";
-            return redact(task.outputContract ? JSON.stringify(parsed) : output);
-        }
-        catch (error) {
-            if (record.outcome === "running")
-                record.outcome = "failed";
+        },
+    });
+}
+/** Only returned output validation failures qualify for correction. */
+function validateResponse(output, contract) {
+    let parsed;
+    try {
+        parsed = contract ? contract.parse(JSON.parse(output)) : undefined;
+    }
+    catch (error) {
+        if (!(error instanceof SyntaxError) && !(error instanceof z.ZodError))
             throw error;
-        }
-        finally {
-            record.finishedAt = new Date().toISOString();
-            if (!record.sessionId)
-                record.sessionState = "unavailable";
-            await store.saveInvocation(record);
-        }
+        return { kind: "invalid", error };
     }
-    throw new Error("Format correction exhausted");
+    return { kind: "valid", parsed };
+}
+async function recordInvalidResponse(record, output, error, redact) {
+    record.outcome = "invalid-output";
+    record.validationError = redact(String(error));
+    await appendFile(record.log, redact(JSON.stringify({ type: "invalid-output", output, error: String(error) })) + "\n");
+    if (record.attempt === maxInvocationAttempts)
+        throw new Error(`Invalid output after one correction: ${String(error)}`);
+    return `\n\nCorrect the prior response format in this fresh inspection-only session. Do not modify files.\nPrior invalid response:\n${output}\nValidation errors:\n${String(error)}`;
+}
+async function saveImplementationSnapshot(runId, expected, provider, dependencies) {
+    const { workspace, project, store } = dependencies;
+    const snapshot = await workspace.inspect(project);
+    if (snapshot.head !== expected.head || snapshot.branch !== expected.branch)
+        throw new BlockedError("Agent changed branch or committed unexpectedly");
+    await store.patchRun(runId, { snapshot });
+    return snapshot.fingerprint === expected.fingerprint
+        ? undefined
+        : {
+            provider,
+            beforeFiles: expected.files,
+            afterFiles: snapshot.files,
+        };
+}
+async function acceptContribution(runId, candidate, dependencies) {
+    const run = await dependencies.store.run(runId);
+    await dependencies.store.patchRun(runId, {
+        contributionCandidates: [...(run.contributionCandidates ?? []), candidate],
+    });
 }

package/dist/src/operations.d.ts

@@ -25,10 +25,9 @@ export declare class Operations {
     eligible(): Promise<boolean>;
     prepare(): Promise<void>;
     invoke(name: string, stage: Stage, task: InvocationTask): Promise<string>;
-    private saveImplementationSnapshot;
-    private acceptContribution;
     implement(): Promise<void>;
     validate(): Promise<boolean>;
+    private recordValidation;
     private prepareEvidence;
     writePublication(): Promise<void>;
     commit(): Promise<void>;

package/dist/src/operations.js

@@ -9,6 +9,7 @@ import { invokeStage } from "./invocation.js";
 import { defaultStagePrompts } from "./prompts.js";
 import { publicationSteps } from "./recovery.js";
 import { command } from "./runtime/process.js";
+import { selectValidation } from "./validation-selection.js";
 const maxStepAttempts = 3;
 /** Reusable durable coding operations. Call from a registered DBOS workflow. */
 export class Operations {
@@ -76,8 +77,14 @@ export class Operations {
         return this.step("eligibility", async (run) => {
             const { hosting, project } = this.dependencies;
             const issue = await hosting.getIssue(run.issue.number);
-            return (issue.open &&
-                project.labels.every((label) => issue.labels.includes(label)));
+            if (!issue.open ||
+                !project.labels.every((label) => issue.labels.includes(label)))
+                return false;
+            const { profile } = selectValidation(run.issue.body, project);
+            await this.dependencies.store.patchRun(run.id, {
+                validationProfile: profile,
+            });
+            return true;
         });
     }
     async prepare() {
@@ -104,33 +111,8 @@ export class Operations {
             task,
             stepId: DBOS.stepID,
             dependencies: this.dependencies,
-            saveImplementationSnapshot: (runId, expected, provider) => this.saveImplementationSnapshot(runId, expected, provider),
-            acceptContribution: (runId, candidate) => this.acceptContribution(runId, candidate),
         }));
     }
-    async saveImplementationSnapshot(runId, expected, provider) {
-        const { workspace, project, store } = this.dependencies;
-        const snapshot = await workspace.inspect(project);
-        if (snapshot.head !== expected.head || snapshot.branch !== expected.branch)
-            throw new BlockedError("Agent changed branch or committed unexpectedly");
-        await store.patchRun(runId, { snapshot });
-        return snapshot.fingerprint === expected.fingerprint
-            ? undefined
-            : {
-                provider,
-                beforeFiles: expected.files,
-                afterFiles: snapshot.files,
-            };
-    }
-    async acceptContribution(runId, candidate) {
-        const run = await this.dependencies.store.run(runId);
-        await this.dependencies.store.patchRun(runId, {
-            contributionCandidates: [
-                ...(run.contributionCandidates ?? []),
-                candidate,
-            ],
-        });
-    }
     async implement() {
         await this.invoke("implementation", this.dependencies.project.stages.implementation, {
             defaultPrompt: defaultStagePrompts.implementation,
@@ -139,7 +121,7 @@ export class Operations {
     }
     async validate() {
         return this.step("validation", async (run) => {
-            const { project, workspace, store, signal, redact } = this.dependencies;
+            const { project, workspace, signal, redact } = this.dependencies;
             if (!run.snapshot)
                 throw new BlockedError("Missing implementation snapshot");
             await workspace.verify(project, run.snapshot);
@@ -148,7 +130,8 @@ export class Operations {
             const validation = [];
             const directory = join(this.dependencies.artifacts, run.id);
             await mkdir(directory, { recursive: true, mode: 0o700 });
-            for (const [index, check] of project.validation.entries()) {
+            const checks = selectValidation(run.issue.body, project).commands;
+            for (const [index, check] of checks.entries()) {
                 const startedAt = new Date().toISOString();
                 const log = join(directory, `validation-${index}.log`);
                 let captured = "";
@@ -169,25 +152,23 @@ export class Operations {
                     await appendFile(log, redact(captured + "\n" + String(error)), {
                         mode: 0o600,
                     });
-                    validation.push({
+                    await this.recordValidation(run.id, validation, {
                         ...check,
                         exitCode: -1,
                         log,
                         startedAt,
                         finishedAt: new Date().toISOString(),
                     });
-                    await store.patchRun(run.id, { validation });
                     throw error;
                 }
                 await appendFile(log, redact(captured), { mode: 0o600 });
-                validation.push({
+                await this.recordValidation(run.id, validation, {
                     ...check,
                     exitCode: result.exitCode,
                     log,
                     startedAt,
                     finishedAt: new Date().toISOString(),
                 });
-                await store.patchRun(run.id, { validation });
                 if (result.exitCode !== 0)
                     throw new Error(`Validation failed: ${check.command} (exit ${result.exitCode})`);
             }
@@ -195,6 +176,10 @@ export class Operations {
             return true;
         });
     }
+    async recordValidation(runId, validation, result) {
+        validation.push(result);
+        await this.dependencies.store.patchRun(runId, { validation });
+    }
     async prepareEvidence(name, published = false) {
         return this.step(name, async (run) => {
             const { project, workspace, artifacts, signal } = this.dependencies;