@provos/ironcurtain 0.11.0 → 0.13.0

package/dist/workflow/workflow-manager.js

@@ -24,6 +24,8 @@ import { loadDefinition } from './definition-loader.js';
 import { getIronCurtainHome } from '../config/paths.js';
 import { loadConfig } from '../config/index.js';
 import { toHumanGateRequestDto, } from './types.js';
+import { sweepContainerSnapshots } from './container-snapshots.js';
+import * as logger from '../logger.js';
 /** Renders an unknown thrown value as a short human-readable string. */
 function describeError(err) {
     if (err instanceof Error)
@@ -39,9 +41,16 @@ export class WorkflowManager {
     orchestrator = null;
     eventBus;
     baseDirOverride;
+    captureTraces;
+    sessionFactoryOverride;
+    enableSnapshotGc;
+    snapshotGcTimer;
     constructor(options) {
         this.eventBus = options.eventBus;
         this.baseDirOverride = options.baseDirOverride;
+        this.captureTraces = options.captureTraces;
+        this.sessionFactoryOverride = options.sessionFactoryOverride;
+        this.enableSnapshotGc = options.enableSnapshotGc ?? false;
     }
     /** Lazily creates the orchestrator on first use. */
     getOrchestrator() {
@@ -50,8 +59,25 @@ export class WorkflowManager {
         }
         return this.orchestrator;
     }
+    /**
+     * Eagerly starts background maintenance (snapshot GC startup sweep +
+     * periodic timer) at daemon boot rather than lazily on the first workflow
+     * request. Without this, a long-lived daemon that never receives a workflow
+     * request would never reclaim aged or orphaned snapshot images. No-op unless
+     * snapshot GC is enabled for this manager.
+     */
+    startBackgroundTasks() {
+        if (this.enableSnapshotGc) {
+            // Forcing orchestrator creation runs startSnapshotGc (sweep + timer).
+            this.getOrchestrator();
+        }
+    }
     /** Clean shutdown of all workflows. */
     async shutdown() {
+        if (this.snapshotGcTimer !== undefined) {
+            clearInterval(this.snapshotGcTimer);
+            this.snapshotGcTimer = undefined;
+        }
         if (this.orchestrator) {
             await this.orchestrator.shutdownAll();
             this.orchestrator = null;
@@ -217,8 +243,11 @@ export class WorkflowManager {
         const baseDir = this.getBaseDir();
         const checkpointStore = new FileCheckpointStore(baseDir);
         this._checkpointStore = checkpointStore;
-        const sessionFactory = createWorkflowSessionFactory();
+        const sessionFactory = this.sessionFactoryOverride ?? createWorkflowSessionFactory();
         const config = loadConfig();
+        if (this.enableSnapshotGc) {
+            this.startSnapshotGc(baseDir, checkpointStore, config.userConfig);
+        }
         const deps = {
             createSession: sessionFactory,
             createWorkflowTab: () => this.createNoOpTab(),
@@ -235,11 +264,33 @@ export class WorkflowManager {
             baseDir,
             checkpointStore,
             userConfig: config.userConfig,
+            // Forward the raw `--capture-traces` daemon flag; the infrastructure
+            // factory resolves it against userConfig (single resolution point).
+            captureTracesOverride: this.captureTraces,
         };
         const orchestrator = new WorkflowOrchestrator(deps);
         orchestrator.onEvent((event) => this.forwardLifecycleEvent(event));
         return orchestrator;
     }
+    startSnapshotGc(baseDir, checkpointStore, userConfig) {
+        if (this.snapshotGcTimer !== undefined)
+            return;
+        const runSweep = () => {
+            // The sweep absorbs the expected "Docker absent" case internally; a
+            // rejection here is genuinely unexpected, so surface it rather than
+            // letting GC die silently.
+            sweepContainerSnapshots({ baseDir, checkpointStore, userConfig }).catch((err) => {
+                logger.warn(`[workflow] snapshot GC sweep failed: ${err instanceof Error ? err.message : String(err)}`);
+            });
+        };
+        runSweep();
+        // Node stores a timer delay in a signed 32-bit int; a delay over ~24.8 days
+        // (2^31-1 ms) overflows and fires every 1ms. Clamp to the max safe delay.
+        const MAX_TIMER_DELAY_MS = 2_147_483_647;
+        const intervalMs = Math.min(MAX_TIMER_DELAY_MS, Math.max(1, userConfig.snapshot.sweepIntervalHours) * 60 * 60 * 1000);
+        this.snapshotGcTimer = setInterval(runSweep, intervalMs);
+        this.snapshotGcTimer.unref();
+    }
     createNoOpTab() {
         return {
             write() { },

package/dist/workflow/workflow-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-manager.js","sourceRoot":"","sources":["../../src/workflow/workflow-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EACL,oBAAoB,GAKrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAGxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAEL,qBAAqB,GAItB,MAAM,YAAY,CAAC;AA2CpB,wEAAwE;AACxE,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAiBD,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,MAAM,OAAO,eAAe;IAClB,YAAY,GAAgC,IAAI,CAAC;IACxC,QAAQ,CAA6B;IACrC,eAAe,CAAqB;IAErD,YAAY,OAA+B;QACzC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IACjD,CAAC;IAED,oDAAoD;IACpD,eAAe;QACb,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,uCAAuC;IACvC,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,wBAAwB,CAAC,eAAuB,EAAE,UAAmB;QACnE,MAAM,aAAa,GAAG,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC/D,IAAI,QAAoB,CAAC;QAEzB,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,GAAG,UAAwB,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,kEAAkE;YAClE,kEAAkE;YAClE,8BAA8B;YAC9B,MAAM,MAAM,GAAG,6BAA6B,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;YAC7E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,mEAAmE;gBACnE,iEAAiE;gBACjE,qEAAqE;gBACrE,kCAAkC;gBAClC,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzC,MAAM,IAAI,KAAK,CAAC,2BAA2B,eAAe,EAAE,CAAC,CAAC;gBAChE,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,iCAAiC,eAAe,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC;QAC/B,CAAC;QAED,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,OAAO,eAAe,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,+BAA+B;QAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC7C,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEtC,wDAAwD;QACxD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAC9E,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC1D,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAChC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;;OASG;IACH,WAAW,CAAC,UAAsB,EAAE,SAAmC;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxC,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAEhF,IAAI,UAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO;gBACL,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,kCAAkC,UAAU,KAAK,aAAa,CAAC,GAAG,CAAC,EAAE;aAC/E,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,2BAA2B,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAClF,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;YAChC,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAChH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzF,CAAC;IAED,2DAA2D;IAC3D,UAAU;QACR,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,IAAI,OAAO,CAAC,kBAAkB,EAAE,EAAE,eAAe,CAAC,CAAC;QACvF,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,kGAAkG;IAClG,kBAAkB;QAChB,4DAA4D;QAC5D,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,0EAA0E;IAC1E,UAAU;IACV,0EAA0E;IAElE,gBAAgB,GAA+B,IAAI,CAAC;IAE5D;;;;;;;;;;;;;;;;OAgBG;IACK,2BAA2B,CACjC,UAAsB,EACtB,UAA0C;QAE1C,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;QAE/C,IAAI,cAAkC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,cAAc,GAAG,kBAAkB,CAAC;QACtC,CAAC;aAAM,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/D,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,qEAAqE;YACrE,oEAAoE;YACpE,6DAA6D;YAC7D,uEAAuE;YACvE,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,OAAO;gBACL,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,+BAA+B,UAAU,eAAe,kBAAkB,GAAG,cAAc,GAAG;aACxG,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,kEAAkE;QAClE,kEAAkE;QAClE,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;QAExD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO;gBACL,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,iCAAiC,cAAc,KAAK,MAAM,CAAC,OAAO,EAAE;aAC9E,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,uEAAuE;QACvE,kDAAkD;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACzE,OAAO;YACL,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,kCAAkC,cAAc,KAAK,MAAM,EAAE;SACvE,CAAC;IACJ,CAAC;IAEO,kBAAkB;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,eAAe,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC;QACxC,MAAM,cAAc,GAAG,4BAA4B,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAE5B,MAAM,IAAI,GAA6B;YACrC,aAAa,EAAE,cAAc;YAC7B,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE;YAC7C,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;gBAClB,MAAM,GAAG,GAAwB,qBAAqB,CAAC,IAAI,CAAC,CAAC;gBAC7D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,sBAAsB,EAAE;oBACzC,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,IAAI,EAAE,GAAG;iBACV,CAAC,CAAC;YACL,CAAC;YACD,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE;gBAClC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;YACP,eAAe;YACf,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;QAEF,MAAM,YAAY,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACpD,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,OAAO,YAAY,CAAC;IACtB,CAAC;IAEO,aAAa;QACnB,OAAO;YACL,KAAK,KAAI,CAAC;YACV,QAAQ,KAAI,CAAC;YACb,KAAK,KAAI,CAAC;SACX,CAAC;IACJ,CAAC;IAED,2DAA2D;IACnD,qBAAqB,CAAC,KAA6B;QACzD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,SAAS;gBACZ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,EAAE;oBACrC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,eAAe,EAAE,KAAK,CAAC,eAAe;iBACvC,CAAC,CAAC;gBACH,MAAM;YACR,KAAK,eAAe;gBAClB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,EAAE;oBAC3C,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;iBACnB,CAAC,CAAC;gBACH,MAAM;YACR,KAAK,WAAW;gBACd,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE;oBACvC,UAAU,EAAE,KAAK,CAAC,UAAU;iBAC7B,CAAC,CAAC;gBACH,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE;oBACpC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;iBACnB,CAAC,CAAC;gBACH,MAAM;YACR,KAAK,aAAa;gBAChB,yCAAyC;gBACzC,MAAM;YACR,KAAK,gBAAgB;gBACnB,2CAA2C;gBAC3C,MAAM;YACR,KAAK,eAAe;gBAClB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,EAAE;oBAC3C,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,OAAO,EAAE,KAAK,CAAC,KAAK;oBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;gBACH,MAAM;YACR,KAAK,iBAAiB;gBACpB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,0BAA0B,EAAE;oBAC7C,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,OAAO,EAAE,KAAK,CAAC,KAAK;oBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;iBACvB,CAAC,CAAC;gBACH,MAAM;YACR,KAAK,qBAAqB;gBACxB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,8BAA8B,EAAE;oBACjD,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,OAAO,EAAE,KAAK,CAAC,KAAK;oBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;gBACH,MAAM;QACV,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"workflow-manager.js","sourceRoot":"","sources":["../../src/workflow/workflow-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EACL,oBAAoB,GAKrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAIxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAEL,qBAAqB,GAItB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AA2CvC,wEAAwE;AACxE,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAqCD,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,MAAM,OAAO,eAAe;IAClB,YAAY,GAAgC,IAAI,CAAC;IACxC,QAAQ,CAA6B;IACrC,eAAe,CAAqB;IACpC,aAAa,CAAsB;IACnC,sBAAsB,CAA8D;IACpF,gBAAgB,CAAU;IACnC,eAAe,CAA6C;IAEpE,YAAY,OAA+B;QACzC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;QAC7D,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC5D,CAAC;IAED,oDAAoD;IACpD,eAAe;QACb,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,oBAAoB;QAClB,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,sEAAsE;YACtE,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACvC,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACnC,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,wBAAwB,CAAC,eAAuB,EAAE,UAAmB;QACnE,MAAM,aAAa,GAAG,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC/D,IAAI,QAAoB,CAAC;QAEzB,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,GAAG,UAAwB,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,kEAAkE;YAClE,kEAAkE;YAClE,8BAA8B;YAC9B,MAAM,MAAM,GAAG,6BAA6B,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;YAC7E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,mEAAmE;gBACnE,iEAAiE;gBACjE,qEAAqE;gBACrE,kCAAkC;gBAClC,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzC,MAAM,IAAI,KAAK,CAAC,2BAA2B,eAAe,EAAE,CAAC,CAAC;gBAChE,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,iCAAiC,eAAe,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC;QAC/B,CAAC;QAED,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,OAAO,eAAe,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,+BAA+B;QAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC7C,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEtC,wDAAwD;QACxD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAC9E,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC1D,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAChC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;;OASG;IACH,WAAW,CAAC,UAAsB,EAAE,SAAmC;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxC,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAEhF,IAAI,UAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO;gBACL,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,kCAAkC,UAAU,KAAK,aAAa,CAAC,GAAG,CAAC,EAAE;aAC/E,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,2BAA2B,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAClF,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;YAChC,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAChH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzF,CAAC;IAED,2DAA2D;IAC3D,UAAU;QACR,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,IAAI,OAAO,CAAC,kBAAkB,EAAE,EAAE,eAAe,CAAC,CAAC;QACvF,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,kGAAkG;IAClG,kBAAkB;QAChB,4DAA4D;QAC5D,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,0EAA0E;IAC1E,UAAU;IACV,0EAA0E;IAElE,gBAAgB,GAA+B,IAAI,CAAC;IAE5D;;;;;;;;;;;;;;;;OAgBG;IACK,2BAA2B,CACjC,UAAsB,EACtB,UAA0C;QAE1C,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;QAE/C,IAAI,cAAkC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,cAAc,GAAG,kBAAkB,CAAC;QACtC,CAAC;aAAM,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/D,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,qEAAqE;YACrE,oEAAoE;YACpE,6DAA6D;YAC7D,uEAAuE;YACvE,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,OAAO;gBACL,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,+BAA+B,UAAU,eAAe,kBAAkB,GAAG,cAAc,GAAG;aACxG,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,kEAAkE;QAClE,kEAAkE;QAClE,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;QAExD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO;gBACL,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,iCAAiC,cAAc,KAAK,MAAM,CAAC,OAAO,EAAE;aAC9E,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,uEAAuE;QACvE,kDAAkD;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACzE,OAAO;YACL,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,kCAAkC,cAAc,KAAK,MAAM,EAAE;SACvE,CAAC;IACJ,CAAC;IAEO,kBAAkB;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,eAAe,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC;QACxC,MAAM,cAAc,GAAG,IAAI,CAAC,sBAAsB,IAAI,4BAA4B,EAAE,CAAC;QACrF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,IAAI,GAA6B;YACrC,aAAa,EAAE,cAAc;YAC7B,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE;YAC7C,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;gBAClB,MAAM,GAAG,GAAwB,qBAAqB,CAAC,IAAI,CAAC,CAAC;gBAC7D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,sBAAsB,EAAE;oBACzC,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,IAAI,EAAE,GAAG;iBACV,CAAC,CAAC;YACL,CAAC;YACD,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE;gBAClC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;YACP,eAAe;YACf,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,qEAAqE;YACrE,oEAAoE;YACpE,qBAAqB,EAAE,IAAI,CAAC,aAAa;SAC1C,CAAC;QAEF,MAAM,YAAY,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACpD,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,OAAO,YAAY,CAAC;IACtB,CAAC;IAEO,eAAe,CACrB,OAAe,EACf,eAAoC,EACpC,UAAuD;QAEvD,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS;YAAE,OAAO;QAC/C,MAAM,QAAQ,GAAG,GAAS,EAAE;YAC1B,oEAAoE;YACpE,oEAAoE;YACpE,2BAA2B;YAC3B,uBAAuB,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACvF,MAAM,CAAC,IAAI,CAAC,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1G,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,QAAQ,EAAE,CAAC;QACX,4EAA4E;QAC5E,0EAA0E;QAC1E,MAAM,kBAAkB,GAAG,aAAa,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CACzB,kBAAkB,EAClB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CACrE,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;IAEO,aAAa;QACnB,OAAO;YACL,KAAK,KAAI,CAAC;YACV,QAAQ,KAAI,CAAC;YACb,KAAK,KAAI,CAAC;SACX,CAAC;IACJ,CAAC;IAED,2DAA2D;IACnD,qBAAqB,CAAC,KAA6B;QACzD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,SAAS;gBACZ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,EAAE;oBACrC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,eAAe,EAAE,KAAK,CAAC,eAAe;iBACvC,CAAC,CAAC;gBACH,MAAM;YACR,KAAK,eAAe;gBAClB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,EAAE;oBAC3C,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;iBACnB,CAAC,CAAC;gBACH,MAAM;YACR,KAAK,WAAW;gBACd,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE;oBACvC,UAAU,EAAE,KAAK,CAAC,UAAU;iBAC7B,CAAC,CAAC;gBACH,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE;oBACpC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;iBACnB,CAAC,CAAC;gBACH,MAAM;YACR,KAAK,aAAa;gBAChB,yCAAyC;gBACzC,MAAM;YACR,KAAK,gBAAgB;gBACnB,2CAA2C;gBAC3C,MAAM;YACR,KAAK,eAAe;gBAClB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,EAAE;oBAC3C,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,OAAO,EAAE,KAAK,CAAC,KAAK;oBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;gBACH,MAAM;YACR,KAAK,iBAAiB;gBACpB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,0BAA0B,EAAE;oBAC7C,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,OAAO,EAAE,KAAK,CAAC,KAAK;oBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;iBACvB,CAAC,CAAC;gBACH,MAAM;YACR,KAAK,qBAAqB;gBACxB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,8BAA8B,EAAE;oBACjD,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,OAAO,EAAE,KAAK,CAAC,KAAK;oBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;gBACH,MAAM;QACV,CAAC;IACH,CAAC;CACF"}

package/dist/workflow/workflows/design-and-code/README.md

@@ -0,0 +1,50 @@
+# Design & Code
+
+A four-phase software workflow that takes a task from **plan → design → implement → review**, with human approval gates between the planning stages and an automated coder–critic loop at the end.
+
+Run it from the web UI (**Start Workflow → `design-and-code`**) or the CLI:
+
+```bash
+ironcurtain workflow start design-and-code "Add a rate limiter to the API gateway"
+```
+
+## What it does
+
+The workflow drives a Docker-isolated `claude-code` agent through distinct roles, persisting its artifacts under `.workflow/` in the workspace and writing code directly at the workspace root.
+
+| Phase | State | Role | Output |
+|-------|-------|------|--------|
+| 1 | `plan` | Project planner — breaks the task into ordered, numbered steps | `.workflow/plan/plan.md` |
+| — | `plan_review` | **Human gate** — approve, request a revision, or abort | — |
+| 2 | `design` | Architect — module structure, interfaces, typed signatures | `.workflow/spec/spec.md` |
+| — | `design_review` | **Human gate** — approve, request a revision, or abort | — |
+| 3 | `implement` | Engineer — writes the code and unit tests, runs them | `src/`, tests |
+| 4 | `review` | Reviewer — checks correctness, edge cases, quality, coverage | `.workflow/reviews/review.md` |
+
+## Human gates
+
+Two gates pause the run for your decision:
+
+- **Plan review** — sign off on the approach before any design work.
+- **Design review** — sign off on the interfaces and types before implementation.
+
+At each gate the presented artifact (`plan` or `spec`) is shown for inspection. Choose **Approve** to advance, **Request Revision** to send the agent back with feedback, or **Abort** to stop.
+
+## The coder–critic loop
+
+After implementation, the **reviewer** judges the code against the spec:
+
+- **`approved`** → the workflow completes (`done`).
+- **`rejected`** → control returns to `implement` with the review feedback, and the cycle repeats.
+
+The loop is bounded by `maxRounds` (**3**). If the reviewer is still rejecting when the limit is reached, the workflow raises an **escalation gate** so a human can approve as-is, force another revision, or abort — it never loops forever.
+
+## At a glance
+
+- **Mode:** Docker (`claude-code` agent, `--network=none`)
+- **Persona:** `global` for every agent state
+- **Max rounds:** 3 (implement ⇄ review)
+- **Artifacts:** `plan`, `spec`, `reviews` — all under `.workflow/`
+- **Terminal states:** `done` (success) · `aborted` (stopped at a gate)
+
+> Tip: write a detailed task description. The planner only sees the task text and whatever already exists in the workspace, so specifics about scope, constraints, and acceptance criteria pay off downstream.

package/dist/workflow/workflows/deterministic-eval-smoke/scripts/format_report.js

@@ -0,0 +1,29 @@
+const fs = require('fs');
+const Ajv = require('ajv');
+
+const evalPath = '/workspace/.workflow/eval.json';
+const reportPath = '/workspace/.workflow/report.md';
+const data = JSON.parse(fs.readFileSync(evalPath, 'utf8'));
+
+const ajv = new Ajv();
+const validate = ajv.compile({
+  type: 'object',
+  required: ['score', 'passed', 'cases', 'dependency'],
+  properties: {
+    score: { type: 'number' },
+    passed: { type: 'boolean' },
+    cases: { type: 'number' },
+    dependency: { const: 'numpy' },
+  },
+});
+
+if (!validate(data)) {
+  console.error(JSON.stringify(validate.errors));
+  process.exit(1);
+}
+
+fs.writeFileSync(
+  reportPath,
+  `# Eval report\n\nscore: ${data.score}\npassed: ${data.passed}\ncases: ${data.cases}\nnode_dependency: ajv\n`,
+);
+console.log('1 test pass');

package/dist/workflow/workflows/deterministic-eval-smoke/scripts/package.json

@@ -0,0 +1,5 @@
+{
+  "dependencies": {
+    "ajv": "^8.17.1"
+  }
+}

package/dist/workflow/workflows/deterministic-eval-smoke/scripts/requirements.txt

@@ -0,0 +1 @@
+numpy

package/dist/workflow/workflows/deterministic-eval-smoke/scripts/run_eval.py

@@ -0,0 +1,41 @@
+import importlib.util
+import json
+import os
+from pathlib import Path
+
+import numpy as np
+
+
+workspace = Path("/workspace")
+candidate_path = workspace / "candidate.py"
+workflow_dir = workspace / ".workflow"
+workflow_dir.mkdir(exist_ok=True)
+
+if not candidate_path.exists():
+    raise SystemExit("missing /workspace/candidate.py")
+
+spec = importlib.util.spec_from_file_location("candidate", candidate_path)
+if spec is None or spec.loader is None:
+    raise SystemExit("failed to load candidate.py")
+module = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(module)
+
+cases = [[], [1, 2, 3], [-5, 10, 12]]
+expected = [0, 6, 17]
+actual = [module.solve(xs) for xs in cases]
+passed = bool(np.array_equal(np.array(actual), np.array(expected)))
+score = 1.0 if passed else 0.0
+
+result = {
+    "score": score,
+    "passed": passed,
+    "cases": len(cases),
+    "actual": actual,
+    "expected": expected,
+    "dependency": "numpy",
+}
+
+(workflow_dir / "eval.json").write_text(json.dumps(result, indent=2) + "\n")
+print(f"{len(cases)} tests pass" if passed else "evaluation failed")
+if not passed:
+    raise SystemExit(1)

package/dist/workflow/workflows/deterministic-eval-smoke/workflow.yaml

@@ -0,0 +1,57 @@
+name: deterministic-eval-smoke
+description: 'TESTING ONLY - minimal agent plus deterministic in-container helper execution.'
+hidden: true
+initial: author
+
+settings:
+  mode: docker
+  dockerAgent: claude-code
+  sharedContainer: true
+  model: anthropic:claude-haiku-4-5
+
+states:
+  author:
+    type: agent
+    description: Write the candidate program that deterministic helpers will evaluate.
+    persona: global
+    prompt: |
+      Create exactly one file at /workspace/candidate.py. It must contain:
+
+      def solve(xs):
+          return sum(xs)
+
+      Do not create additional files. Finish with the required agent_status block.
+    inputs: []
+    outputs: []
+    transitions:
+      - to: evaluate
+
+  evaluate:
+    type: deterministic
+    description: Run the packaged Python evaluator inside the same shared container.
+    container: true
+    run:
+      - ['/opt/workflow-venv/bin/python', '/workflow-scripts/run_eval.py']
+    transitions:
+      - to: report
+        guard: isPassed
+      - to: failed
+
+  report:
+    type: deterministic
+    description: Format the evaluation result with the packaged Node helper.
+    container: true
+    run:
+      - ['node', '/workflow-scripts/format_report.js']
+    transitions:
+      - to: done
+        guard: isPassed
+      - to: failed
+
+  done:
+    type: terminal
+    description: Candidate evaluated and report written.
+
+  failed:
+    type: terminal
+    description: Evaluation failed.

package/dist/workflow/workflows/deterministic-verdict-smoke/scripts/classify.py

@@ -0,0 +1,18 @@
+import json
+import pathlib
+
+ws = pathlib.Path("/workspace")
+out = ws / ".workflow"
+out.mkdir(exist_ok=True)
+task = (ws / "task.txt").read_text().strip().lower() if (ws / "task.txt").exists() else ""
+
+# An "error" task exercises the missing-file -> result_file_error path: the helper
+# exits 0 but writes no result file, so the orchestrator must route to error_terminal.
+if "error" not in task:
+    verdict = "block" if "block" in task else "pass"
+    (out / "result.json").write_text(
+        json.dumps({"verdict": verdict, "payload": {"task": task}, "passed": True}) + "\n"
+    )
+
+# stdout is verdict-blind regardless of branch — routing can only come from the file.
+print("classified")

package/dist/workflow/workflows/deterministic-verdict-smoke/workflow.yaml

@@ -0,0 +1,51 @@
+name: deterministic-verdict-smoke
+description: 'TESTING ONLY - deterministic state routes on a helper-written verdict file.'
+hidden: true
+initial: author
+
+settings:
+  mode: docker
+  dockerAgent: claude-code
+  sharedContainer: true
+  model: anthropic:claude-haiku-4-5
+
+states:
+  author:
+    type: agent
+    description: Record the task verbatim so the deterministic helper can read it.
+    persona: global
+    prompt: |
+      Write the EXACT task text you were given to the file /workspace/task.txt and nothing else.
+      Create no other files. Finish with the required agent_status block.
+    inputs: []
+    outputs: []
+    transitions:
+      - to: classify
+
+  classify:
+    type: deterministic
+    description: Read the task and emit a verdict file the machine routes on.
+    container: true
+    resultFile: .workflow/result.json
+    run:
+      - ['python3', '/workflow-scripts/classify.py']
+    transitions:
+      - to: passed_terminal
+        when: { verdict: pass }
+      - to: blocked_terminal
+        when: { verdict: block }
+      - to: error_terminal
+        when: { verdict: result_file_error }
+      - to: error_terminal
+
+  passed_terminal:
+    type: terminal
+    description: Helper emitted verdict=pass.
+
+  blocked_terminal:
+    type: terminal
+    description: Helper emitted verdict=block.
+
+  error_terminal:
+    type: terminal
+    description: Verdict file missing/malformed or unexpected verdict.

package/dist/workflow/workflows/evolve/README.md

@@ -0,0 +1,66 @@
+# Evolve
+
+A multi-round, evaluator-driven candidate search that runs a tireless AI researcher on a hard problem: each round it **samples a parent, proposes a new candidate, scores it against your evaluator, and distills a transferable lesson** — then repeats, accumulating knowledge until the round budget is spent. It's IronCurtain's packaging of the [ASI-Evolve](scripts/README.md) loop, run by a Docker-isolated `claude-code` agent.
+
+Run it from the web UI (**Start Workflow → `evolve`**) or the CLI:
+
+```bash
+ironcurtain workflow start evolve \
+  "Improve the linear-attention kernel scored by evaluator.py" \
+  --workspace ~/experiments/linear-attention
+```
+
+## The experiment you point it at
+
+Evolve searches over **your** problem. Point `--workspace` at an experiment directory and the `preflight` agent infers the run spec from the files it finds at the workspace root:
+
+| File                                  | Role                                                                                                                         |
+| ------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
+| `input.md` / `README.md`              | **Objective** — what "better" means, one line, taken faithfully from the brief                                               |
+| `evaluator.py`                        | **Scoring contract** — `python evaluator.py <code_path> <results_path>`, writing JSON metrics. This is the fitness function. |
+| `initial_program`                     | _(optional)_ Seed candidate / interface contract the search must respect                                                     |
+| `requirements.txt` / `pyproject.toml` | _(optional)_ Python deps installed into the persistent run venv                                                              |
+| `init_cognition.py`                   | _(optional)_ Domain knowledge / heuristics seeded into the cognition store so the search doesn't start from zero             |
+
+If the workspace is empty, `preflight` falls back to inferring everything from the task description — useful for a quick trial, but a real experiment wants an evaluator. Experiment source files are treated as **read-only**; the run writes only to `.evolve_runs/` and `.workflow/`.
+
+## What it does
+
+After a one-time setup, the orchestrator drives rounds. Each round is a linear pipeline that turns sampled history into one scored, recorded candidate.
+
+| Phase        | State(s)          | Role                                                                                                     | Output                   |
+| ------------ | ----------------- | -------------------------------------------------------------------------------------------------------- | ------------------------ |
+| Setup        | `provision`       | Install the experiment's deps into the persistent venv (idempotent)                                      | provisioned venv         |
+| Setup        | `preflight`       | Infer the run spec, initialize the run, author the cognition seed                                        | run spec, cognition seed |
+| Loop control | `orchestrator`    | Round-boundary controller — enforce the budget and stop conditions; route continue / complete / escalate | —                        |
+| Round        | `sample`          | Sample parent nodes (UCB1 / greedy / random / MAP-Elites) and retrieve relevant cognition                | sampled parents          |
+| Round        | `researcher`      | Evolve one candidate from the sampled parents and retrieved lessons                                      | candidate program        |
+| Round        | `evaluate`        | Run your evaluator on the candidate                                                                      | JSON metrics             |
+| Round        | `analyzer`        | Distill the outcome into a transferable lesson for future rounds                                         | round lesson             |
+| Round        | `analysis_record` | Commit the round (candidate + score + lesson + parents) to the experiment database                       | recorded node            |
+| Wrap-up      | `final_summary`   | Summarize the best candidates and what was learned                                                       | run summary              |
+
+## Human gates
+
+Four gates pause for your decision; each accepts **APPROVE** (continue), **FORCE_REVISION** (loop back with feedback routed into the next agent's prompt), or **ABORT**.
+
+- **`provision_review`** — sign off on the environment setup before any candidate runs.
+- **`preflight_review`** — sign off on the inferred run spec (objective, eval command, budget, cognition seed) before the search starts. This is the most important gate: a wrong objective or eval command wastes the whole budget.
+- **`human_escalation`** — a round got blocked (e.g. the evaluator can't run). Redirect, retry, or stop.
+- **`final_review`** — sign off on the run summary at the end.
+
+## The round loop
+
+The real budget is `run_spec.budget.max_rounds`, inferred at preflight from your experiment brief and enforced by the **orchestrator** — not the `maxRounds: 200` setting, which is only a safety backstop against a wedged pipeline. After each recorded round the orchestrator re-checks the budget and stop conditions and routes to continue, `complete`, or escalate, so the search ends cleanly instead of running forever.
+
+## At a glance
+
+- **Mode:** Docker (`claude-code` agent, `--network=none`, shared container)
+- **Model:** `anthropic:claude-sonnet-4-6`
+- **Persona:** `global` for every agent state
+- **Input:** an experiment directory via `--workspace` (evaluator + objective; optional seed/deps/cognition)
+- **Budget:** `max_rounds` inferred at preflight; `maxRounds: 200` is a backstop only
+- **Run state:** `.evolve_runs/` (experiment DB, cognition store) and `.workflow/` in the workspace
+- **Terminal states:** `done` (budget reached, approved) · `failed` (unrecoverable) · `aborted` (stopped at a gate)
+
+> Tip: the search is only as good as `evaluator.py`. A noisy or too-lenient fitness function makes every candidate look equally good and the loop learns nothing — invest in a scorer that cleanly separates better from worse before kicking off a long run. For the framework behind the loop (cognition store, experiment database, sampling strategies) see [`scripts/README.md`](scripts/README.md).