@mstar-harness/dsh 2.2.0 → 2.3.0

package/dist/client/panel/graph/project-graph.d.ts

@@ -89,28 +89,32 @@ export interface GraphViolation {
     code: string;
     message: string;
 }
-/** Event status coloring: dispatch → dispatched|advisory|denied; settle → ok|error|denied. */
-export type FlowEventStatus = 'dispatched' | 'advisory' | 'denied' | 'ok' | 'error';
+/** Event status coloring: dispatch → dispatched|advisory|denied; settle → ok|error|denied; workflow/unknown rows → unknown (no gate status — honest). */
+export type FlowEventStatus = 'dispatched' | 'advisory' | 'denied' | 'ok' | 'error' | 'unknown';
 /**
  * One projected agent-flow event (spec agent-flow-catalog-graph §2.4 —
- * unchanged by the zone refactor). Every field degrades individually via
- * `guards.ts` — a missing/illegal value becomes `null`/''/`0`/a base status,
- * never a throw and never a guessed value. Rows whose `kind` is not
- * dispatch/settle cannot be classified and are skipped entirely
- * (belt-and-suspenders: the T1 ledger reader already normalizes kind).
+ * unchanged by the zone refactor; plan `20260815-dsh-workflow-ledger` Task 4
+ * adds the workflow kinds + the unknown-kind degradation path). Every field
+ * degrades individually via `guards.ts` — a missing/illegal value becomes
+ * `null`/''/`0`/a base status, never a throw and never a guessed value.
+ * Dispatch/settle rows keep their gate semantics; the three WORKFLOW kinds
+ * project with their run identity (no verdict/outcome → status `unknown`);
+ * any UNKNOWN kind string renders as a GENERIC row — never dropped, never
+ * guessed. Only a row WITHOUT a kind is unclassifiable and skipped.
  */
 export interface FlowEventView {
     /** `${ts}-${kind}-${index}` — stable id (index = position in the projected window). */
     id: string;
     ts: number;
-    kind: 'dispatch' | 'settle';
-    /** `Execute as`; '' for settle rows without a paired identity. */
+    /** The ledger kind verbatim: dispatch | settle | the three workflow kinds | any unknown kind string (generic row). */
+    kind: 'dispatch' | 'settle' | 'workflow-run' | 'workflow-agent' | 'workflow-run-end' | (string & {});
+    /** `Execute as`; '' for settle rows without a paired identity and for workflow/unknown rows. */
     role: string;
     planId: string | null;
     taskId: string | null;
     taskCategory: string | null;
     agent: string | null;
-    /** dispatch → dispatched|advisory|denied; settle → ok|error|denied (spec §2.4). */
+    /** dispatch → dispatched|advisory|denied; settle → ok|error|denied; workflow/unknown → unknown (spec §2.4). */
     status: FlowEventStatus;
     /** `role` ∈ the EXPECTED_ROLE_FLOW role union (spec §2.3 exact-string match). */
     expected: boolean;
@@ -124,6 +128,22 @@ export interface FlowEventView {
     /** Settle rows only (plan `20260811-panel-f4-timeliness` Task 1): the settle carries the PAIRED dispatch's identity (exact pairing). */
     paired?: boolean;
     durationMs: number | null;
+    /** Workflow run identity (workflow-* + unknown rows, when carried; absent otherwise). */
+    readonly runId?: string;
+    /** Workflow run display name (workflow-run rows only). */
+    readonly name?: string;
+    /** The run's member count in the window (workflow-run rows only — the window's `workflow-agent` rows for the runId; absent when 0/truncated, never a 0 guess). */
+    readonly memberCount?: number;
+    /** Run-member 1-based sequence (workflow-agent rows only). */
+    readonly seq?: number;
+    /** Run-member display label (workflow-agent rows only). */
+    readonly label?: string;
+    /** Run-member phase (workflow-agent rows only, when carried). */
+    readonly phase?: string;
+    /** The published member's child session identity (workflow-agent rows only). */
+    readonly childId?: string;
+    /** Terminal workflow run reason (workflow-run-end rows only). */
+    readonly stopReason?: string;
 }
 /**
  * One iteration step (spec §3 + plan 20260812-panel-f5-iteration-zone-fix
@@ -456,9 +476,11 @@ export declare function projectGraph(source: MstarEngineStatusSource | null): Zo
 export declare function projectAgents(source: MstarEngineStatusSource | null, currentStep: number | null): AgentZoneView;
 /** One row of the pairing walk — the identity a PAIRED settle carries (plan
  * `20260811-panel-f4-timeliness` Task 1, spec R1: exact identity pairing,
- * never owner+time guessing). */
+ * never owner+time guessing). The kind is the FULL projected kind union:
+ * workflow/unknown rows are walk no-ops (they carry no paired marker) —
+ * widened so the classify output feeds the walk unchanged. */
 interface PairingRow {
-    kind: 'dispatch' | 'settle';
+    kind: FlowEventView['kind'];
     agent: string | null;
     role?: string;
     planId?: string | null;
@@ -479,11 +501,15 @@ export declare function pairSettleIndexes(rows: readonly PairingRow[]): Readonly
  * `flow.stages` merged into the plan-3 agents projection). Total function:
  * NEVER throws, NEVER fabricates values.
  *
- * - events: the actual events, latest first, ≤50 (dispatch + settle rows);
+ * - events: the actual events, latest first, ≤50 — dispatch, settle, the
+ *   three workflow kinds (run identity: name / member count / stopReason,
+ *   plan `20260815-dsh-workflow-ledger` Task 4) and ANY unknown kind string
+ *   as a generic row (degradation — never dropped, never guessed);
  * - unexpected: DISPATCH events whose role is not in the expected role union
  *   (e.g. `general` / `explore` / `scout`). Settle rows are completion
  *   records — they carry no role at all, so they never flag as unexpected
- *   even though their `expected` field is false ('' ∉ union);
+ *   even though their `expected` field is false ('' ∉ union). Workflow /
+ *   unknown rows are not dispatches → never unexpected either;
  * - settled: EXACT identity pairing via `pairSettleIndexes` (the same walk the
  *   agent-entity status derivation uses; an unpaired settle stays unpaired —
  *   honest). The panel never depends on the pairing's correctness;

package/dist/client/panel/locale.d.ts

@@ -122,7 +122,7 @@ import type { LocaleDictOf } from '@deepseek-ai/dsh-client-ui-slots';
 /** Locale namespace id for the workflow-viz panel. */
 export declare const NS = "mstar-panel";
 /** Panel dictionary keys (union of every translatable string the panel renders). */
-export type PanelKey = 'view.mstar-workflow' | 'tab.tasks' | 'tab.agents' | 'tab.events' | 'page.iteration.not-started' | 'page.iteration.expand' | 'page.iteration.collapse' | 'event-log.section.events' | 'event-log.section.violations' | 'event-log.empty' | 'event-log.empty.events' | 'event-log.empty.violations' | 'event-log.field.role' | 'event-log.field.agent' | 'event-log.field.stage' | 'event-log.field.plan' | 'event-log.field.task' | 'event-log.field.category' | 'event-log.field.time' | 'event-log.field.kind' | 'event-log.field.status' | 'event-log.field.expected' | 'event-log.field.settled' | 'event-log.field.duration' | 'event-log.field.severity' | 'event-log.field.code' | 'event-log.field.message' | 'event-log.kind.dispatch' | 'event-log.kind.settle' | 'event-log.yes' | 'event-log.no' | 'empty.waiting' | 'empty.no-harness' | 'empty.no-harness-hint' | 'watermark.version' | 'watermark.harness' | 'watermark.none' | 'panel.unknown' | 'graph.pass' | 'graph.fail' | 'zone.legend.title' | 'zone.legend.agent-running' | 'zone.legend.agent-settled' | 'zone.legend.agent-idle' | 'zone.iteration.step-label' | 'zone.iteration.step-badge' | 'zone.iteration.step.current' | 'zone.iteration.step.next' | 'zone.iteration.step.done' | 'zone.iteration.step.idle' | 'zone.phase.iteration-start' | 'zone.phase.autonomous-execute' | 'zone.phase.iteration-close' | 'zone.phase.pr-delivery' | 'zone.phase.merge-ready' | 'zone.branches.title' | 'zone.branches.iteration-base' | 'zone.branches.target' | 'zone.branches.spec-integration' | 'zone.tasks.title' | 'zone.tasks.total' | 'zone.tasks.no-plans' | 'zone.tasks.more' | 'zone.tasks.collapse' | 'zone.state.Todo' | 'zone.state.InProgress' | 'zone.state.InReview' | 'zone.state.Done' | 'zone.state.blocked-unknown' | 'zone.agents.title' | 'zone.agents.summary' | 'zone.agents.on-demand' | 'zone.agents.unknown-sub' | 'zone.agents.bucket.implementor' | 'zone.agents.bucket.reviewer' | 'zone.agents.group.phase-1' | 'zone.agents.group.phase-2' | 'zone.agents.group.phase-n' | 'zone.agents.group.plan' | 'zone.agents.group.no-plan' | 'zone.agents.group.plan-more' | 'flow.empty' | 'flow.settle-only' | 'flow.degraded' | 'flow.unexpected' | 'flow.in-flight' | 'flow.settled-ok' | 'flow.error' | 'flow.advisory' | 'flow.denied' | 'state.title' | 'state.plans' | 'state.residuals' | 'state.policy' | 'state.leases' | 'state.knowledge' | 'state.direction' | 'state.none' | 'state.enforcement' | 'state.enforcement.hard' | 'state.enforcement.soft' | 'state.plans.more' | 'state.residual.more' | 'state.policy.push' | 'state.policy.worktree' | 'state.policy.control-worktree' | 'state.knowledge.docs' | 'freshness.last-updated' | 'freshness.refresh-note';
+export type PanelKey = 'view.mstar-workflow' | 'tab.tasks' | 'tab.agents' | 'tab.events' | 'page.iteration.not-started' | 'page.iteration.expand' | 'page.iteration.collapse' | 'event-log.section.events' | 'event-log.section.violations' | 'event-log.empty' | 'event-log.empty.events' | 'event-log.empty.violations' | 'event-log.field.role' | 'event-log.field.agent' | 'event-log.field.stage' | 'event-log.field.plan' | 'event-log.field.task' | 'event-log.field.category' | 'event-log.field.time' | 'event-log.field.kind' | 'event-log.field.status' | 'event-log.field.expected' | 'event-log.field.settled' | 'event-log.field.duration' | 'event-log.field.run-id' | 'event-log.field.name' | 'event-log.field.members' | 'event-log.field.stop-reason' | 'event-log.field.severity' | 'event-log.field.code' | 'event-log.field.message' | 'event-log.kind.dispatch' | 'event-log.kind.settle' | 'event-log.yes' | 'event-log.no' | 'empty.waiting' | 'empty.no-harness' | 'empty.no-harness-hint' | 'watermark.version' | 'watermark.harness' | 'watermark.none' | 'panel.unknown' | 'graph.pass' | 'graph.fail' | 'zone.legend.title' | 'zone.legend.agent-running' | 'zone.legend.agent-settled' | 'zone.legend.agent-idle' | 'zone.iteration.step-label' | 'zone.iteration.step-badge' | 'zone.iteration.step.current' | 'zone.iteration.step.next' | 'zone.iteration.step.done' | 'zone.iteration.step.idle' | 'zone.phase.iteration-start' | 'zone.phase.autonomous-execute' | 'zone.phase.iteration-close' | 'zone.phase.pr-delivery' | 'zone.phase.merge-ready' | 'zone.branches.title' | 'zone.branches.iteration-base' | 'zone.branches.target' | 'zone.branches.spec-integration' | 'zone.tasks.title' | 'zone.tasks.total' | 'zone.tasks.no-plans' | 'zone.tasks.more' | 'zone.tasks.collapse' | 'zone.state.Todo' | 'zone.state.InProgress' | 'zone.state.InReview' | 'zone.state.Done' | 'zone.state.blocked-unknown' | 'zone.agents.title' | 'zone.agents.summary' | 'zone.agents.on-demand' | 'zone.agents.unknown-sub' | 'zone.agents.bucket.implementor' | 'zone.agents.bucket.reviewer' | 'zone.agents.group.phase-1' | 'zone.agents.group.phase-2' | 'zone.agents.group.phase-n' | 'zone.agents.group.plan' | 'zone.agents.group.no-plan' | 'zone.agents.group.plan-more' | 'flow.empty' | 'flow.settle-only' | 'flow.degraded' | 'flow.unexpected' | 'flow.in-flight' | 'flow.settled-ok' | 'flow.error' | 'flow.advisory' | 'flow.denied' | 'state.title' | 'state.plans' | 'state.residuals' | 'state.policy' | 'state.leases' | 'state.knowledge' | 'state.direction' | 'state.none' | 'state.enforcement' | 'state.enforcement.hard' | 'state.enforcement.soft' | 'state.plans.more' | 'state.residual.more' | 'state.policy.push' | 'state.policy.worktree' | 'state.policy.control-worktree' | 'state.knowledge.docs' | 'freshness.last-updated' | 'freshness.refresh-note';
 declare module '@deepseek-ai/dsh-client-ui-slots' {
     interface LocaleNamespaceMap {
         'mstar-panel': PanelKey;

package/dist/client.js

@@ -76,6 +76,10 @@ var zh = {
   "event-log.field.expected": "预期角色",
   "event-log.field.settled": "已结算",
   "event-log.field.duration": "耗时",
+  "event-log.field.run-id": "运行 ID",
+  "event-log.field.name": "运行名称",
+  "event-log.field.members": "成员数",
+  "event-log.field.stop-reason": "停止原因",
   "event-log.field.severity": "严重度",
   "event-log.field.code": "代码",
   "event-log.field.message": "信息",
@@ -187,6 +191,10 @@ var en = {
   "event-log.field.expected": "Expected role",
   "event-log.field.settled": "Settled",
   "event-log.field.duration": "Duration",
+  "event-log.field.run-id": "Run ID",
+  "event-log.field.name": "Run name",
+  "event-log.field.members": "Members",
+  "event-log.field.stop-reason": "Stop reason",
   "event-log.field.severity": "Severity",
   "event-log.field.code": "Code",
   "event-log.field.message": "Message",
@@ -1524,27 +1532,77 @@ function settleStatus(outcome) {
 }
 function flowEventOf(raw, index, stageIndex) {
   const row = raw;
-  const kind = row?.kind;
-  if (kind !== "dispatch" && kind !== "settle")
+  const kind = str(row?.kind);
+  if (kind === null)
     return null;
   const role = str(row?.role) ?? "";
   const matched = stageIndex.get(role);
   const ts = count(row?.ts) ?? 0;
+  if (kind === "dispatch") {
+    return {
+      id: `${ts}-${kind}-${index}`,
+      ts,
+      kind,
+      role,
+      planId: str(row?.planId),
+      taskId: str(row?.taskId),
+      taskCategory: str(row?.taskCategory),
+      agent: str(row?.agent),
+      status: dispatchStatus(row?.verdict),
+      expected: matched !== undefined,
+      stage: matched ?? null,
+      settled: false,
+      durationMs: count(row?.durationMs)
+    };
+  }
+  if (kind === "settle") {
+    return {
+      id: `${ts}-${kind}-${index}`,
+      ts,
+      kind,
+      role,
+      planId: str(row?.planId),
+      taskId: str(row?.taskId),
+      taskCategory: str(row?.taskCategory),
+      agent: str(row?.agent),
+      status: settleStatus(row?.outcome),
+      expected: matched !== undefined,
+      stage: matched ?? null,
+      settled: false,
+      ...row?.paired === true ? { paired: true } : {},
+      durationMs: count(row?.durationMs)
+    };
+  }
+  const runId = str(row?.runId);
+  const name = str(row?.name);
+  const seq = count(row?.seq);
+  const label = str(row?.label);
+  const phase = str(row?.phase);
+  const childId = str(row?.childId);
+  const stopReason = str(row?.stopReason);
   return {
     id: `${ts}-${kind}-${index}`,
     ts,
     kind,
-    role,
-    planId: str(row?.planId),
-    taskId: str(row?.taskId),
-    taskCategory: str(row?.taskCategory),
+    role: "",
+    planId: null,
+    taskId: null,
+    taskCategory: null,
     agent: str(row?.agent),
-    status: kind === "dispatch" ? dispatchStatus(row?.verdict) : settleStatus(row?.outcome),
-    expected: matched !== undefined,
-    stage: matched ?? null,
+    status: "unknown",
+    expected: false,
+    stage: null,
     settled: false,
-    ...kind === "settle" && row?.paired === true ? { paired: true } : {},
-    durationMs: count(row?.durationMs)
+    durationMs: null,
+    ...runId !== null ? { runId } : {},
+    ...kind === "workflow-run" && name !== null ? { name } : {},
+    ...kind === "workflow-agent" ? {
+      ...seq !== null ? { seq } : {},
+      ...label !== null ? { label } : {},
+      ...phase !== null ? { phase } : {},
+      ...childId !== null ? { childId } : {}
+    } : {},
+    ...kind === "workflow-run-end" && stopReason !== null ? { stopReason } : {}
   };
 }
 function pairingKeyOf(row) {
@@ -1572,6 +1630,15 @@ function pairSettleIndexes(rows) {
 function classifyFlowRows(rawEvents) {
   const stageIndex = roleStageIndex();
   const windowed = rawEvents.slice(0, FLOW_EVENT_WINDOW);
+  const memberCounts = new Map;
+  for (const raw of windowed) {
+    const row = raw;
+    if (row?.kind !== "workflow-agent")
+      continue;
+    const runId = str(row.runId);
+    if (runId !== null)
+      memberCounts.set(runId, (memberCounts.get(runId) ?? 0) + 1);
+  }
   const entries = [];
   windowed.forEach((raw, i) => {
     const view = flowEventOf(raw, i, stageIndex);
@@ -1579,6 +1646,14 @@ function classifyFlowRows(rawEvents) {
       return;
     entries.push({ view });
   });
+  for (const entry of entries) {
+    const v = entry.view;
+    if (v.kind !== "workflow-run" || v.runId === undefined)
+      continue;
+    const n = memberCounts.get(v.runId);
+    if (n !== undefined && n > 0)
+      entry.view = { ...v, memberCount: n };
+  }
   return entries;
 }
 function projectFlowEvents(source) {
@@ -3464,6 +3539,9 @@ function AgentCanvasPage({ view, iteration, t, initialPan }) {
 }
 
 // src/client/panel/graph/event-log.ts
+function isWorkflowKind(kind) {
+  return kind === "workflow-run" || kind === "workflow-agent" || kind === "workflow-run-end";
+}
 function taskTag(event) {
   if (event.planId !== null && event.taskId !== null)
     return `${event.planId}#${event.taskId}`;
@@ -3473,7 +3551,7 @@ function taskTag(event) {
     return `#${event.taskId}`;
   return "";
 }
-function eventEntryOf(event) {
+function eventEntryOf(event, runNames) {
   return {
     kind: "event",
     id: event.id,
@@ -3486,11 +3564,19 @@ function eventEntryOf(event) {
     status: event.status,
     settled: event.settled,
     durationMs: event.durationMs,
-    expected: event.expected
+    expected: event.expected,
+    runId: event.runId ?? "",
+    name: event.kind === "workflow-run" && event.name !== undefined ? event.name : event.runId !== undefined ? runNames.get(event.runId) ?? "" : ""
   };
 }
 function eventLogEntries(view) {
-  const entries = view.events.map(eventEntryOf);
+  const runNames = new Map;
+  for (const event of view.events) {
+    if (event.kind === "workflow-run" && event.name !== undefined && event.name !== "") {
+      runNames.set(event.runId ?? "", event.name);
+    }
+  }
+  const entries = view.events.map((event) => eventEntryOf(event, runNames));
   view.violations.forEach((violation, i) => {
     entries.push({
       kind: "violation",
@@ -3892,7 +3978,7 @@ function EventDetailsBody({
       /* @__PURE__ */ jsx_runtime8.jsx(DetailField, {
         field: "kind",
         label: t("event-log.field.kind"),
-        value: entry.eventKind === "dispatch" ? t("event-log.kind.dispatch") : t("event-log.kind.settle")
+        value: entry.eventKind === "dispatch" ? t("event-log.kind.dispatch") : entry.eventKind === "settle" ? t("event-log.kind.settle") : entry.eventKind
       }),
       /* @__PURE__ */ jsx_runtime8.jsx(DetailField, {
         field: "status",
@@ -3902,17 +3988,41 @@ function EventDetailsBody({
       /* @__PURE__ */ jsx_runtime8.jsx(DetailField, {
         field: "expected",
         label: t("event-log.field.expected"),
-        value: entry.eventKind === "settle" ? "" : entry.expected ? t("event-log.yes") : t("event-log.no")
+        value: entry.eventKind === "settle" || isWorkflowKind(entry.eventKind) ? "" : entry.expected ? t("event-log.yes") : t("event-log.no")
       }),
       /* @__PURE__ */ jsx_runtime8.jsx(DetailField, {
         field: "settled",
         label: t("event-log.field.settled"),
-        value: entry.eventKind === "settle" ? "" : entry.settled ? t("event-log.yes") : t("event-log.no")
+        value: entry.eventKind === "settle" || isWorkflowKind(entry.eventKind) ? "" : entry.settled ? t("event-log.yes") : t("event-log.no")
       }),
       /* @__PURE__ */ jsx_runtime8.jsx(DetailField, {
         field: "duration",
         label: t("event-log.field.duration"),
         value: entry.durationMs === null ? "" : `${entry.durationMs}ms`
+      }),
+      isWorkflowKind(entry.eventKind) && /* @__PURE__ */ jsx_runtime8.jsxs(jsx_runtime8.Fragment, {
+        children: [
+          /* @__PURE__ */ jsx_runtime8.jsx(DetailField, {
+            field: "run-id",
+            label: t("event-log.field.run-id"),
+            value: source?.runId ?? ""
+          }),
+          /* @__PURE__ */ jsx_runtime8.jsx(DetailField, {
+            field: "name",
+            label: t("event-log.field.name"),
+            value: entry.name
+          }),
+          /* @__PURE__ */ jsx_runtime8.jsx(DetailField, {
+            field: "members",
+            label: t("event-log.field.members"),
+            value: source?.memberCount !== undefined ? String(source.memberCount) : ""
+          }),
+          /* @__PURE__ */ jsx_runtime8.jsx(DetailField, {
+            field: "stop-reason",
+            label: t("event-log.field.stop-reason"),
+            value: source?.stopReason ?? ""
+          })
+        ]
       })
     ]
   });
@@ -3923,6 +4033,7 @@ function EventLogEventRow({
   t
 }) {
   const time = formatEventTime(entry.ts);
+  const workflowIdentity = isWorkflowKind(entry.eventKind) ? entry.name !== "" ? entry.name : entry.runId !== "" ? entry.runId : "" : "";
   return /* @__PURE__ */ jsx_runtime8.jsx("li", {
     className: event_log_module_default.eventRow,
     "data-event-log-row-kind": "event",
@@ -3942,6 +4053,9 @@ function EventLogEventRow({
                 className: event_log_module_default.settleGlyph,
                 "aria-hidden": "true",
                 children: "✓"
+              }) : workflowIdentity !== "" ? /* @__PURE__ */ jsx_runtime8.jsx("span", {
+                "data-event-log-name": workflowIdentity,
+                children: workflowIdentity
               }) : entry.role !== "" ? entry.role : t("panel.unknown")
             }),
             entry.stage !== "" && /* @__PURE__ */ jsx_runtime8.jsx("span", {

package/dist/gates/_shared.d.ts

@@ -24,10 +24,11 @@ export interface Config {
     enforcement?: 'hard' | 'soft';
     /**
      * Model-facing delegation tool name(s) the dispatch gate matches. The dsh
-     * subagent tool registers as `subagent` by default, but its `toolName`
-     * config may rename instances (tool-subagent README: each instance needs a
-     * distinct name), so the match list is deployment-settable. Defaults to
-     * `['subagent']`.
+     * subagent tool registers as `subagent` by default (its fork sibling
+     * `subagent_fork` carries the same Assignment-shaped args and is gated
+     * too), but the `toolName` config may rename instances (tool-subagent
+     * README: each instance needs a distinct name), so the match list is
+     * deployment-settable. Defaults to `['subagent', 'subagent_fork']`.
      */
     dispatchTools?: string[];
     /**
@@ -68,8 +69,93 @@ export interface Config {
      * per interval). Absent → 60000.
      */
     catalogTtlMs?: number;
+    /**
+     * Taxonomy bridge: mstar role id → fallbacks role id (the
+     * `dsh-llm-fallbacks` role taxonomy). Logging + future rule-driven
+     * interop only — NOT required for persona injection (`rolePersonas` is
+     * the decoration's only payload source). Absent → no bridge mapping.
+     */
+    roleMap?: Record<string, string>;
+    /**
+     * mstar role id → persona text — the subagent decoration's only payload
+     * source (plan `20260814-dsh-fallbacks-integration` Task 2). A
+     * role-matched `subagent/start` registers the persona as the child's
+     * `mstar:role-persona` system-prompt section (agent-scoped on
+     * `Agent.ctx`, unwinds on disposal). Lookup is DIRECT — never gated on
+     * `roleMap` or on the fallbacks mounted state (unmounted → same
+     * injection from Config + one debug log). Absent → no decoration.
+     *
+     * INTERPOLATION CONSTRAINT: dsh system-prompt renders section text with
+     * STRICT `{{variable}}` interpolation and throws on any `{{` paired with a
+     * later `}}` (unknown/malformed/undefined reference), so persona values
+     * MUST NOT contain that pattern — a violating persona would break child
+     * prompt assembly at the child's first render, for EVERY role-matched
+     * dispatch. The Config schema rejects such values at plugin mount with a
+     * clear error (see {@link PERSONA_INTERPOLATION_HAZARD}); a lone `{{` with
+     * no later `}}` is literal prose (safe), and the escape rule is single
+     * braces or rewording. Keep persona text concise; bound its length at
+     * deployment.
+     */
+    rolePersonas?: Record<string, string>;
+    /**
+     * Workflow/ralph gate mode (plan `20260815-dsh-workflow-gate` W-B3, AC-7):
+     * `off` disables the gate entirely (workflow/ralph calls pass through
+     * untouched, NO verdict row); `warn` (default) logs an advisory for
+     * policy-unknown fan-out without ever blocking; `ask` routes first-seen
+     * workflow names through the dsh approval channel (`{kind:'ask'}` —
+     * fail-closed upstream, this gate invents no answerer); `hard` vetoes a
+     * policy-violating fan-out call before any child starts. Absent → 'warn'.
+     */
+    workflowGate?: 'off' | 'warn' | 'ask' | 'hard';
+    /**
+     * Workflow name allowlist (P-a): `meta.name` values treated as KNOWN by
+     * the gate. Empty or absent ⇒ every name is unknown (documented — the
+     * gate is NOT "allow all" by omission). Ralph calls carry no `meta.name`,
+     * so P-a never applies to them.
+     */
+    workflowNames?: string[];
+    /**
+     * Goal-bridge round cap (plan `20260816-dsh-nb2-goal-bridge` Task 2): the
+     * flat `maxGoalRounds` the goal bridge passes to the goals service when it
+     * mirrors the active iteration objective (bounds autonomous Phase 2
+     * loops — the service itself throws on resume past the cap). Absent →
+     * 256 (aligned with the GoalService default and ralph `maxRounds` —
+     * architect decision; see the plan).
+     */
+    maxGoalRounds?: number;
 }
-/** Schemastery configuration schema for the plugin consumer. Object keys are optional by default (`.optional()` is a vendored-fork addition not present in npm schemastery); omitted ARRAY keys would materialize as `[]` (schemastery empty-value default — the tool-subagent `toolFilter` pitfall), so both dispatch keys preserve omission via `.default(undefined)`. */
+/**
+ * dsh system-prompt strict `{{variable}}` interpolation hazard: the renderer
+ * (`renderPrompt` → `interpolate` in `@deepseek-ai/dsh-system-prompt`) scans
+ * section text for `{{` and THROWS on any `{{` paired with a later `}}` in
+ * the same text (unknown variable, malformed group, or undefined value).
+ * Persona text lands in the `mstar:role-persona` section verbatim, so a
+ * persona containing this pattern breaks child prompt assembly at the
+ * child's first render — every role-matched dispatch. The Config schema
+ * rejects such values at validation (plugin mount) with a clear error. The
+ * mirror-default extraction (agent-personas.ts) reuses this constant: a
+ * violating default is WARNED + skipped at extraction, never a boot throw. A
+ * lone `{{` with no later `}}` is literal prose (safe); the escape rule is
+ * single braces or rewording.
+ */
+export declare const PERSONA_INTERPOLATION_HAZARD: RegExp;
+/**
+ * Screen ONE dynamic string before it is embedded into dsh system-prompt
+ * section/context text (plan QC fix wave W-1): break every COMPLETE
+ * `{{...}}` group (the renderer's STRICT `interpolate` throws on any `{{`
+ * paired with a later `}}` — unknown variable, malformed group, undefined
+ * value), while leaving a LONE `{{` without a later `}}` verbatim (upstream
+ * renders it as literal prose — already safe, do not mangle it).
+ *
+ * A complete group is rewritten to `{ {…} }` (a space inside each pair), so
+ * no adjacent `{{`/`}}` survives the renderer scan; the rewrite is re-scanned
+ * because a nested/adjacent brace at either boundary can expose a fresh pair.
+ * The output is plain text the renderer treats as literal — operator-chosen
+ * values (paths, plan/iteration ids, lease fields, compass direction prose)
+ * can never break prompt assembly.
+ */
+export declare function stripInterpolationHazard(text: string): string;
+/** Schemastery configuration schema for the plugin consumer. Object keys are optional by default (`.optional()` is a vendored-fork addition not present in npm schemastery); omitted ARRAY keys would materialize as `[]` (schemastery empty-value default — the tool-subagent `toolFilter` pitfall) and omitted DICT keys would materialize as `{}`, so the dispatch keys and the decoration keys all preserve omission via `.default(undefined)`. */
 export declare const Config: z<Config>;
 /** One violation line for logs and the typed veto message. */
 export declare function formatViolation(violation: ValidationResult): string;
@@ -117,6 +203,19 @@ export declare function resolveSeamHard(harnessDir: string | null, config: Confi
  */
 export declare function resolvePackagedSkillsDir(fileUrl: string): string | undefined;
 export declare function packagedSkillsDir(): string | undefined;
+/**
+ * Resolve the plugin package's own `harness-agents/` mirror (synced from the
+ * repo root by `bundle-assets` at build/postinstall; gitignored) — the
+ * zero-config role-persona default source (plan
+ * `20260815-dsh-fallbacks-personas` Task 3). Same dual-depth probe semantics
+ * as {@link resolvePackagedSkillsDir}: `'../harness-agents'` (dist layout
+ * candidate) then `'../../harness-agents'` (source-layout candidate);
+ * `src/harness-agents` is non-canonical and skipped shallow-first.
+ * @param fileUrl - the module's `import.meta.url` string (or any file URL at
+ * the depth whose layout should be probed).
+ */
+export declare function resolvePackagedAgentsDir(fileUrl: string): string | undefined;
+export declare function packagedAgentsDir(): string | undefined;
 /**
  * Per-workspace `{HARNESS_DIR}` resolution for the plugin.
  *

package/dist/gates/adapter.d.ts

@@ -2,7 +2,8 @@ import { Service, type Context } from '@deepseek-ai/cordis';
 import type { AssignmentFields, GateResult, HostAdapter, IntegrationMergeLease, ValidationResult } from '@mstar-harness/engine';
 import type { ToolExecution } from '@deepseek-ai/dsh-tools';
 import type { HarnessResolver, Config } from './_shared.ts';
-import type { AgentFlowPairing } from './agent-flow.ts';
+import type { AgentFlowPairing, WorkflowVerdictInput } from './agent-flow.ts';
+import { WorkflowAskCache } from './workflow-policy.ts';
 /** Options for {@link DshHostAdapter}. */
 export interface DshHostAdapterOptions {
     /**
@@ -22,6 +23,16 @@ export interface DshHostAdapterOptions {
      * construction) → no pairing registration (record-only).
      */
     readonly pairing?: AgentFlowPairing;
+    /**
+     * The P-c first-seen ask cache (plan `20260815-dsh-workflow-gate`
+     * Task 2): workflow name → resolved decision, apply-scoped. Absent (the
+     * entry relies on this default — `index.ts` constructs the adapter
+     * without it) → the constructor builds ONE cache per adapter per apply,
+     * shared by the gate and any answerer integration via the readonly
+     * property. An explicit instance may be passed to share a specific cache
+     * (host-adapter tests / direct construction).
+     */
+    readonly workflowAskCache?: WorkflowAskCache;
     /**
      * Log sink for `HostAdapter.log`. Defaults to the dsh ctx logger scoped
      * `mstar/host-adapter` (dsh logger naming: `<scope>/<subject>`).
@@ -64,6 +75,14 @@ export declare class DshHostAdapter extends Service implements HostAdapter {
     private readonly resolver;
     private readonly config;
     private readonly pairing;
+    /**
+     * The P-c first-seen ask cache (plan `20260815-dsh-workflow-gate`
+     * Task 2) — apply-scoped with the adapter: the dispatch gate reads it
+     * through `gateDispatch`, and tests/answerer integrations reach the same
+     * instance via `ctx.dshHostAdapter.workflowAskCache`. Dies with the
+     * fiber (no module-level reference — an HMR reload starts a fresh cache).
+     */
+    readonly workflowAskCache: WorkflowAskCache;
     private readonly logSink;
     constructor(ctx: Context, options: DshHostAdapterOptions);
     /**
@@ -98,6 +117,20 @@ export declare class DshHostAdapter extends Service implements HostAdapter {
      * when omitted (external callers) the adapter resolves it itself.
      */
     dispatchGate(prompt: string, exec?: ToolExecution, hard?: boolean): GateResult;
+    /**
+     * Record one workflow/ralph gate verdict row (plan
+     * `20260815-dsh-workflow-gate` Task 4 — the durable ledger row for every
+     * gated workflow/ralph call: verdict + metaName/objective + mode, via the
+     * ledger plan's record path). `gateWorkflow` routes the record through
+     * this adapter method so dispatch.ts stays free of a runtime agent-flow
+     * import (the ledger imports dispatch helpers — the adapter is the
+     * acyclic junction, the same role it plays for `dispatchGate`). The
+     * underlying record is fully try/catch-contained (a failing ledger write
+     * logs and never reaches the gate) — this method never throws.
+     * @param input - the gate's decision identity (harness dir + tool +
+     *   workflow/objective + mode + verdict + code).
+     */
+    recordWorkflowVerdict(input: WorkflowVerdictInput): void;
     /**
      * `HostAdapter.beforeStatusWrite` — see the class doc for the doc-first /
      * on-disk-fallback semantics. Never throws; a failing gate maps to its