@ran-sh/dsh-crew 0.3.8 → 0.4.0

package/src/server.mjs

@@ -6,7 +6,7 @@ import { z } from 'zod';
 import { startJob, waitJob, cancelJob, listJobs, getJob, jobView } from './jobs.mjs';
 import { hubStatus, hub } from './hub-client.mjs';
 import { hubCompatibilityMessage, resolveHubExecutionMode } from './hub-compatibility.mjs';
-import { RUNTIME_VERSION } from './runtime-identity.mjs';
+import { RUNTIME_VERSION, getHubRuntimeIdentity } from './runtime-identity.mjs';
 import { resolveWorkerModel } from './model-routing.mjs';
 import { runtimeActivationMetadata } from './runtime-controls.mjs';
 import { buildConfigReadinessMatrix } from './config-readiness.mjs';
@@ -22,12 +22,32 @@ import {
   shouldAutoReview,
 } from './policy.mjs';
 import { buildMcpWorkflowRuntime } from './mcp-runtime.mjs';
+import { buildReviewTask } from './information-flow.mjs';
+import { projectWorkflowView } from './job-contracts.mjs';
+import { loadRoleProfiles, resolveRoleProfile } from './role-profiles.mjs';
+import { loadWorkspaceContexts, resolveWorkspaceContext, buildWorkspaceTask, addContextReferences, isSafeBranchName } from './workspace-context.mjs';
+import { buildExtensionContract } from './extension-contract.mjs';
+import { assessWorkspaceReadiness } from './workspace-readiness.mjs';
 
 const server = new McpServer({ name: 'dsh-crew', version: RUNTIME_VERSION });
 
 const tierSchema = z.enum(['flash', 'pro']).optional().describe('Legacy worker tier (compatibility only): Flash/Pro now act as a model-class hint, not a role. Prefer role=worker / role=reviewer; the backend resolves the actual provider/model from the Model Policy.');
 const roleSchema = z.enum(['worker', 'reviewer']).optional().describe('Dispatch role: worker executes implementation / fixes / tests / search; reviewer independently reviews a completed implementation. A coding request defaults to worker; reviewer runs on explicit request or via the automatic review workflow.');
 const effortSchema = z.enum(['off', 'high', 'max']).optional().describe('Reasoning effort for the worker. Omit to use the session default.');
+const detailSchema = z.enum(['compact', 'full']).default('compact').describe('compact returns the bounded Result Contract; full explicitly includes raw workflow/candidate details for debugging.');
+const profileSchema = z.string().max(64).optional().describe('Versioned Worker/Reviewer profile id; defaults by role.');
+const workspaceIdSchema = z.string().max(64).optional().describe('Workspace Context id from Crew-owned workspaces.json.');
+const contextRefsSchema = z.array(z.string().max(256)).max(32).optional().describe('Additional workspace-relative instruction references; contents are not copied.');
+const clientJobIdSchema = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/).optional().describe('Optional caller id echoed in events and evidence; Crew still assigns its own workflow id.');
+const workspaceSchema = z.object({
+  repo_root: z.string().optional(),
+  branch: z.string().refine(isSafeBranchName, 'invalid git branch name').optional(),
+  worktree: z.enum(['auto', 'existing', 'none']).optional(),
+}).optional().describe('Per-job workspace overrides. auto isolates coding Workers; existing/none use the supplied workspace.');
+const constraintsSchema = z.object({
+  timeout_seconds: z.number().int().positive().max(7200).optional(),
+  allow_fallback: z.boolean().optional(),
+}).optional().describe('Per-job constraints override profile and session defaults.');
 
 // Session-level configuration. This MCP server process lives exactly as long
 // as one Claude Code / Codex session, so plain memory IS session scope.
@@ -144,29 +164,6 @@ async function resolveMode() {
   return decision.mode;
 }
 
-/** Reviewer prompt built only from structured outcome + sanitized candidate. */
-function buildReviewTask(task, view) {
-  const parts = [
-    'You are the automatic reviewer of a completed worker implementation. REVIEW ONLY: inspect the candidate and report findings. Do NOT modify any files unless the user explicitly asks for fixes.',
-    '',
-    'Original task:',
-    task,
-  ];
-  const o = view?.outcome;
-  if (o) {
-    parts.push('', 'Worker outcome:');
-    parts.push(`task_status=${o.task_status} tests_status=${o.tests_status ?? 'none'} delivery=${o.delivery?.complete ? 'complete' : 'incomplete'}`);
-  }
-  const c = view?.candidate;
-  if (c) {
-    parts.push('', 'Candidate changed files:', Array.isArray(c.changed_files) && c.changed_files.length ? c.changed_files.join('\n') : '(none)');
-    if (c.base_revision) parts.push(`Base revision: ${c.base_revision}`);
-    if (c.patch) parts.push('', 'Candidate patch (sanitized):', String(c.patch).slice(0, 8000));
-  }
-  parts.push('', 'Report: 1) does the implementation satisfy the task, 2) concrete issues (bugs, style, risks), 3) suggested fixes. End your message with ## Review Findings / ## Evidence / ## Risks / ## Verdict (approved | needs changes | rejected).');
-  return parts.join('\n');
-}
-
 const workflowRuntime = buildMcpWorkflowRuntime({
   getSessionConfig: () => sessionConfig,
   resolveMode,
@@ -176,61 +173,107 @@ const workflowRuntime = buildMcpWorkflowRuntime({
   attemptTimeoutMs: () => (sessionConfig.default_timeout_seconds ?? 1800) * 1000,
 });
 
-server.registerTool('dsh_run_worker', {
-  title: 'Run DSH worker (blocking)',
-  description: 'Delegate a task to a DSH (DeepSeek Harness) coding agent and wait for its final result. The worker is a full DSH agent with its own tools and sandbox. Pass role=worker for implementation and role=reviewer for an independent review pass. Disabled roles are refused by the DSH Crew policy; Manual roles only run when explicitly requested. Blocks until the worker finishes.',
-  inputSchema: {
-    task: z.string().describe('Full task description for the worker, self-contained'),
-    role: roleSchema,
-    tier: tierSchema,
-    legacy_tier: tierSchema.describe('Legacy model-class hint (flash | pro), forwarded verbatim by deprecated ds-flash/ds-pro aliases; only influences which model class backs a worker role, never the role gate'),
-    effort: effortSchema,
-    cwd: z.string().optional().describe('Workspace directory for the worker (defaults to current project)'),
-    timeout_seconds: z.number().int().positive().max(7200).optional(),
-  },
-}, async ({ task, role, tier, legacy_tier, effort, cwd, timeout_seconds }) => {
-  if (!sessionConfig.enabled) return dispatchDisabled();
+function dispatchError(code, details = {}) {
+  return { ok: false, response: text({ error: details.error ?? code, code, ...details }) };
+}
+
+function prepareDispatch({ task, role, tier, legacy_tier, effort, cwd, timeout_seconds, profile, workspace_id, context_refs, job_id, workspace: workspaceOverride, constraints }) {
   const globalConfig = currentGlobalConfig();
-  const hint = resolveRoleTierHint(role, legacy_tier ?? tier);
-  if (!hint.ok) return text({ error: hint.error, code: hint.code, note: 'Resolve the conflict on the caller side: pass only role, or only tier.' });
+  const profileRegistry = loadRoleProfiles();
+  if (!profileRegistry.ok) return dispatchError('PROFILE_FILE_INVALID', { errors: profileRegistry.errors });
+  const profileRole = profile ? profileRegistry.profiles?.[profile]?.role : undefined;
+  const requestedRole = role ?? profileRole;
+  const hint = resolveRoleTierHint(requestedRole, legacy_tier ?? tier);
+  if (!hint.ok) return dispatchError(hint.code, { error: hint.error });
   const effRole = hint.role;
+  const resolvedProfile = resolveRoleProfile(profileRegistry, profile, effRole);
+  if (!resolvedProfile.ok) return dispatchError(resolvedProfile.code, resolvedProfile);
+
   let effTier;
   let decision;
-  if (role === undefined) {
+  if (requestedRole === undefined) {
     decision = chooseDefaultTier(globalConfig, legacy_tier ?? tier, sessionConfig);
-    if (!decision.ok) return policyRejection(decision);
+    if (!decision.ok) return { ok: false, response: policyRejection(decision) };
     effTier = decision.tier;
   } else {
     decision = canDispatchRole(globalConfig, effRole, true, sessionConfig);
-    if (!decision.ok) return policyRejection(decision);
+    if (!decision.ok) return { ok: false, response: policyRejection(decision) };
     if (effRole === 'reviewer') effTier = 'pro';
     else if (legacy_tier !== undefined) effTier = legacy_tier;
     else if (tier !== undefined) effTier = tier;
     else { const slot = chooseDefaultTier(globalConfig, undefined, sessionConfig); effTier = slot.ok ? slot.tier : 'flash'; }
   }
-  const workDir = cwd ?? process.cwd();
-  const e = effort ?? sessionConfig.default_effort;
-  const timeout = timeout_seconds ?? sessionConfig.default_timeout_seconds;
 
-  const spec = {
+  const workDir = workspaceOverride?.repo_root ?? cwd ?? process.cwd();
+  const workspace = resolveWorkspaceContext(loadWorkspaceContexts(), { workspace_id, cwd: workDir });
+  if (!workspace.ok) return dispatchError(workspace.code, workspace);
+  const withRefs = addContextReferences(workspace.context, context_refs, { cwd: workDir });
+  if (!withRefs.ok) return dispatchError(withRefs.code);
+  const profileValue = resolvedProfile.profile;
+  const effectiveTimeout = constraints?.timeout_seconds ?? timeout_seconds ?? profileValue.timeout_seconds ?? sessionConfig.default_timeout_seconds;
+  const requestedIsolation = workspaceOverride?.worktree === 'auto'
+    ? 'worktree'
+    : workspaceOverride?.worktree === 'existing' || workspaceOverride?.worktree === 'none'
+      ? 'shared'
+      : profileValue.isolation;
+  return {
+    ok: true,
     role: effRole,
-    delivery: effRole === 'reviewer' ? 'review' : 'coding',
-    model_class_hint: effTier,
-    task,
-    cwd: workDir,
-    effort: e,
-    source: ORCHESTRATOR,
+    timeout: effectiveTimeout,
+    spec: {
+      client_job_id: job_id ?? null,
+      role: effRole,
+      delivery: effRole === 'reviewer' ? 'review' : 'coding',
+      model_class_hint: effTier,
+      task: buildWorkspaceTask(task, withRefs.context),
+      cwd: workDir,
+      effort: effort ?? sessionConfig.default_effort,
+      source: ORCHESTRATOR,
+      profile_id: resolvedProfile.profile_id,
+      requested_isolation: requestedIsolation,
+      workspace_branch: workspaceOverride?.branch ?? withRefs.context?.default_branch ?? null,
+      timeout_seconds: effectiveTimeout,
+      allow_fallback: constraints?.allow_fallback ?? profileValue.fallback,
+      routing: profileValue.routing,
+      review_strictness: profileValue.review_strictness,
+      workspace_context: withRefs.context,
+    },
   };
-  const wf = workflowRuntime.start(spec);
-  await workflowRuntime.wait(wf.id, timeout * 1000);
+}
+
+server.registerTool('dsh_run_worker', {
+  title: 'Run DSH worker (blocking)',
+  description: 'Delegate a task to a DSH (DeepSeek Harness) coding agent and wait for its final result. The worker is a full DSH agent with its own tools and sandbox. Pass role=worker for implementation and role=reviewer for an independent review pass. Disabled roles are refused by the DSH Crew policy; Manual roles only run when explicitly requested. Blocks until the worker finishes.',
+  inputSchema: {
+    task: z.string().describe('Full task description for the worker, self-contained'),
+    role: roleSchema,
+    tier: tierSchema,
+    legacy_tier: tierSchema.describe('Legacy model-class hint (flash | pro), forwarded verbatim by deprecated ds-flash/ds-pro aliases; only influences which model class backs a worker role, never the role gate'),
+    effort: effortSchema,
+    cwd: z.string().optional().describe('Workspace directory for the worker (defaults to current project)'),
+    timeout_seconds: z.number().int().positive().max(7200).optional(),
+    job_id: clientJobIdSchema,
+    workspace: workspaceSchema,
+    constraints: constraintsSchema,
+    profile: profileSchema,
+    workspace_id: workspaceIdSchema,
+    context_refs: contextRefsSchema,
+    detail: detailSchema,
+  },
+}, async ({ task, role, tier, legacy_tier, effort, cwd, timeout_seconds, profile, workspace_id, context_refs, job_id, workspace, constraints, detail }) => {
+  if (!sessionConfig.enabled) return dispatchDisabled();
+  const prepared = prepareDispatch({ task, role, tier, legacy_tier, effort, cwd, timeout_seconds, profile, workspace_id, context_refs, job_id, workspace, constraints });
+  if (!prepared.ok) return prepared.response;
+  const wf = workflowRuntime.start(prepared.spec);
+  await workflowRuntime.wait(wf.id, prepared.timeout * 1000);
   const view = workflowRuntime.get(wf.id, { withResult: true });
   if (view.status === 'running') {
-    return text({ ...view, note: `still running after ${timeout}s; poll with dsh_worker_result`, status: 'running' });
+    return text({ ...projectWorkflowView(view, { detail }), note: `still running after ${prepared.timeout}s; poll with dsh_worker_result`, status: 'running' });
   }
   if (view.phase === 'failed') {
-    return text({ ...view, note: 'workflow failed — see error / error_code.', status: 'failed' });
+    return text({ ...projectWorkflowView(view, { detail }), note: 'workflow failed — see error / error_code.', status: 'failed' });
   }
-  return text({ ...view, note: effRole === 'reviewer' ? 'review complete' : 'workflow complete' });
+  return text({ ...projectWorkflowView(view, { detail }), note: prepared.role === 'reviewer' ? 'review complete' : 'workflow complete' });
 });
 
 server.registerTool('dsh_worker_config', {
@@ -333,6 +376,21 @@ async function buildConfigReport() {
     providerCatalogChecked,
     providerCatalogBody,
   });
+  const roleProfiles = loadRoleProfiles();
+  const workspaceReadiness = await assessWorkspaceReadiness({ cwd: process.cwd() });
+  const extensionContract = buildExtensionContract({
+    config: {
+      ...globalConfig,
+      subagents_enabled: sessionConfig.enabled !== false && globalConfig.subagents_enabled !== false,
+      worker_state: globalConfig.worker_state,
+      review_state: globalConfig.review_state,
+      escalate_on_failure: sessionConfig.escalate_on_failure ?? legacy.escalate_on_failure,
+    },
+    readinessMatrix,
+    workspace: workspaceReadiness,
+    profiles: roleProfiles,
+    runtime: getHubRuntimeIdentity(),
+  });
   return {
     enabled: sessionConfig.enabled,
     default_tier: sessionConfig.default_tier ?? legacy.default_tier,
@@ -371,6 +429,8 @@ async function buildConfigReport() {
     runtime_controls: runtimeControls,
     activation_boundaries: activationBoundaries,
     readiness_matrix: readinessMatrix,
+    role_profiles: roleProfiles,
+    extension_contract: extensionContract,
     hub_reachable: hubCompatibility.reachable,
     hub_compatible: hubCompatibility.compatible,
     hub_compatibility: hubCompatibility,
@@ -387,39 +447,18 @@ server.registerTool('dsh_spawn_worker', {
     legacy_tier: tierSchema.describe('Legacy model-class hint (flash | pro) — only influences the model class backing a worker role, never the role gate'),
     effort: effortSchema,
     cwd: z.string().optional(),
+    job_id: clientJobIdSchema,
+    workspace: workspaceSchema,
+    constraints: constraintsSchema,
+    profile: profileSchema,
+    workspace_id: workspaceIdSchema,
+    context_refs: contextRefsSchema,
   },
-}, async ({ task, role, tier, legacy_tier, effort, cwd }) => {
+}, async ({ task, role, tier, legacy_tier, effort, cwd, profile, workspace_id, context_refs, job_id, workspace, constraints }) => {
   if (!sessionConfig.enabled) return dispatchDisabled();
-  const globalConfig = currentGlobalConfig();
-  const hint = resolveRoleTierHint(role, legacy_tier ?? tier);
-  if (!hint.ok) return text({ error: hint.error, code: hint.code, note: 'Resolve the conflict on the caller side: pass only role, or only tier.' });
-  const effRole = hint.role;
-  let effTier;
-  let decision;
-  if (role === undefined) {
-    decision = chooseDefaultTier(globalConfig, legacy_tier ?? tier, sessionConfig);
-    if (!decision.ok) return policyRejection(decision);
-    effTier = decision.tier;
-  } else {
-    decision = canDispatchRole(globalConfig, effRole, true, sessionConfig);
-    if (!decision.ok) return policyRejection(decision);
-    if (effRole === 'reviewer') effTier = 'pro';
-    else if (legacy_tier !== undefined) effTier = legacy_tier;
-    else if (tier !== undefined) effTier = tier;
-    else { const slot = chooseDefaultTier(globalConfig, undefined, sessionConfig); effTier = slot.ok ? slot.tier : 'flash'; }
-  }
-  const workDir = cwd ?? process.cwd();
-  const e = effort ?? sessionConfig.default_effort;
-  const spec = {
-    role: effRole,
-    delivery: effRole === 'reviewer' ? 'review' : 'coding',
-    model_class_hint: effTier,
-    task,
-    cwd: workDir,
-    effort: e,
-    source: ORCHESTRATOR,
-  };
-  const wf = workflowRuntime.start(spec);
+  const prepared = prepareDispatch({ task, role, tier, legacy_tier, effort, cwd, profile, workspace_id, context_refs, job_id, workspace, constraints });
+  if (!prepared.ok) return prepared.response;
+  const wf = workflowRuntime.start(prepared.spec);
   return text({ ...workflowRuntime.get(wf.id), workflow_id: wf.id, note: 'started in background; poll with dsh_worker_status / dsh_worker_result' });
 });
 
@@ -437,41 +476,45 @@ server.registerTool('dsh_worker_result', {
   inputSchema: {
     job_id: z.string(),
     wait_seconds: z.number().int().min(0).max(7200).default(0).describe('0 = return current state immediately'),
+    after_sequence: z.number().int().min(0).default(0).describe('Return canonical events after this cursor for incremental watch.'),
+    detail: detailSchema,
   },
-}, async ({ job_id, wait_seconds }) => {
+}, async ({ job_id, wait_seconds, after_sequence, detail }) => {
   if (job_id.startsWith('wf-')) {
     if (wait_seconds > 0) await workflowRuntime.wait(job_id, wait_seconds * 1000);
     const view = workflowRuntime.get(job_id, { withResult: true });
     if (!view) return text({ error: `no such workflow: ${job_id}` });
-    return text(view);
+    return text(projectWorkflowView(view, { detail, afterSequence: after_sequence }));
   }
   if (job_id.startsWith('hub-')) {
     const status = await hubStatus();
     if (!status.compatible) return text({ error: hubCompatibilityMessage(status), code: status.code, hub_compatibility: status });
-    return text(await hub.get(job_id, wait_seconds).catch((e) => ({ error: e.message })));
+    const view = await hub.get(job_id, wait_seconds).catch((e) => ({ error: e.message }));
+    return text(projectWorkflowView(view, { detail, afterSequence: after_sequence }));
   }
   if (!getJob(job_id)) return text({ error: `no such job: ${job_id} (expected a wf- workflow id)` });
   const job = await waitJob(job_id, wait_seconds > 0 ? wait_seconds * 1000 : 1);
-  return text(jobView(job, { withResult: true }));
+  return text(projectWorkflowView(jobView(job, { withResult: true }), { detail, afterSequence: after_sequence }));
 });
 
 server.registerTool('dsh_worker_cancel', {
   title: 'Cancel DSH worker',
   description: 'Cancel a worker workflow (stops the active attempt, never starts escalation/review, releases its worktree). Accepts workflow ids (wf-...), Hub attempt ids (hub-...) and legacy standalone ids (job-...).',
-  inputSchema: { job_id: z.string() },
-}, async ({ job_id }) => {
+  inputSchema: { job_id: z.string(), detail: detailSchema },
+}, async ({ job_id, detail }) => {
   if (job_id.startsWith('wf-')) {
     const view = await workflowRuntime.cancel(job_id);
     if (!view) return text({ error: `no such workflow: ${job_id}` });
-    return text({ ...view, note: 'cancelled' });
+    return text({ ...projectWorkflowView(view, { detail }), note: 'cancelled' });
   }
   if (job_id.startsWith('hub-')) {
     const status = await hubStatus();
     if (!status.compatible) return text({ error: hubCompatibilityMessage(status), code: status.code, hub_compatibility: status });
-    return text(await hub.cancel(job_id).catch((e) => ({ error: e.message })));
+    const view = await hub.cancel(job_id).catch((e) => ({ error: e.message }));
+    return text(projectWorkflowView(view, { detail }));
   }
   if (!getJob(job_id)) return text({ error: `no such job: ${job_id} (expected a wf- workflow id)` });
-  return text(jobView(await cancelJob(job_id), { withResult: true }));
+  return text(projectWorkflowView(jobView(await cancelJob(job_id), { withResult: true }), { detail }));
 });
 
 await server.connect(new StdioServerTransport());

package/src/workflow-runtime.mjs

@@ -18,6 +18,7 @@ import { resolveModelPolicy, shouldAutoReview, getRoleState } from './policy.mjs
 import { buildOutcome, decideNextStep, JOB_PHASES, canTransition } from './workflow.mjs';
 import { parseDeliveryReport } from './delivery.mjs';
 import { classifyFailure } from './failure-classification.mjs';
+import { createCanonicalJobEvent } from './job-contracts.mjs';
 
 export const WORKFLOW_ERROR_CODES = {
   ISOLATION_UNAVAILABLE: 'ISOLATION_UNAVAILABLE',
@@ -111,6 +112,19 @@ export function createWorkflowRuntime(adapters, {
   const queue = [];
   let active = 0;
   let maxParallelLimit = normalizeMaxParallel(maxParallel);
+  let nestedIdFactory = null;
+
+  function nextWorkflowId() {
+    if (nestedIdFactory) return nestedIdFactory();
+    const generated = idFactory();
+    // A few embedders provide a factory-builder for deterministic tests.
+    // Normalize that legacy shape once while keeping the public id a string.
+    if (typeof generated === 'function') {
+      nestedIdFactory = generated;
+      return nestedIdFactory();
+    }
+    return generated;
+  }
 
   function log(msg) { logger?.debug?.(`workflow: ${msg}`); }
 
@@ -140,16 +154,38 @@ export function createWorkflowRuntime(adapters, {
     log(`${job.id} ${to}`);
   }
 
+  function recordCanonical(job, type, data = {}, attempt = null, at = clock()) {
+    job.canonical_event_sequence += 1;
+    job.canonical_events.push(createCanonicalJobEvent({
+      jobId: job.id,
+      type,
+      sequence: job.canonical_event_sequence,
+      at,
+      role: job.role,
+      attempt,
+      data,
+    }));
+  }
+
   function createJob(spec) {
     const now = clock();
-    return {
-      id: idFactory(),
+    const job = {
+      id: nextWorkflowId(),
+      client_job_id: spec.client_job_id ?? null,
       role: spec.role ?? 'worker',
       delivery: spec.delivery === 'review' ? 'review' : 'coding',
       model_class_hint: spec.model_class_hint === 'pro' ? 'pro' : spec.model_class_hint === 'flash' ? 'flash' : null,
       original_task: spec.task,
       source: spec.source ?? 'api',
       requested_cwd: spec.cwd,
+      requested_isolation: spec.requested_isolation ?? null,
+      workspace_branch: spec.workspace_branch ?? null,
+      timeout_seconds: spec.timeout_seconds ?? null,
+      profile_id: spec.profile_id ?? null,
+      allow_fallback: spec.allow_fallback !== false,
+      routing: spec.routing ?? 'auto',
+      review_strictness: spec.review_strictness ?? null,
+      workspace_context: spec.workspace_context ? { ...spec.workspace_context } : null,
       effort: spec.effort ?? 'max',
       phase: JOB_PHASES.CREATED,
       status: 'running',
@@ -170,12 +206,16 @@ export function createWorkflowRuntime(adapters, {
       retain_workspace: false,
       workspace_retained: false,
       events: [{ at: now, phase: JOB_PHASES.CREATED, type: 'created' }],
+      canonical_events: [],
+      canonical_event_sequence: 0,
       createdAt: now,
       startedAt: now,
       endedAt: null,
       workspaceHandle: null,
       waiters: [],
     };
+    recordCanonical(job, 'job.created', { client_job_id: job.client_job_id }, null, now);
+    return job;
   }
 
   function releaseSlot() {
@@ -227,6 +267,9 @@ export function createWorkflowRuntime(adapters, {
     job.error = err?.message ?? String(err);
     job.error_code = err?.code ?? err?.policyCode ?? job.error_code ?? null;
     job.phase = JOB_PHASES.FAILED;
+    recordCanonical(job, 'job.failed', {
+      error_code: job.error_code,
+    });
     setTerminal(job);
   }
 
@@ -259,10 +302,7 @@ export function createWorkflowRuntime(adapters, {
       config = adapters.getConfig?.() ?? {};
       const alloc = await adapters.allocateWorkspace?.(job);
       if (alloc && alloc.ok === false) {
-        job.error = alloc.error ?? alloc.reason;
-        job.phase = JOB_PHASES.FAILED;
-        if (alloc.reason) job.error_code = alloc.reason;
-        setTerminal(job);
+        failJob(job, Object.assign(new Error(alloc.error ?? alloc.reason), { code: alloc.reason }));
         return;
       }
       if (alloc && alloc.ok) {
@@ -272,12 +312,16 @@ export function createWorkflowRuntime(adapters, {
         job.base_revision = alloc.base_revision ?? null;
         job.primary_workspace_dirty = alloc.primary_workspace_dirty === true;
       }
+      recordCanonical(job, 'job.started', {
+        isolation: job.isolation,
+        base_revision: job.base_revision,
+      });
       transition(job, JOB_PHASES.RUNNING, 'start');
 
       if (isReviewJob) {
         transition(job, JOB_PHASES.REVIEWING, 'explicit reviewer');
         const before = alloc?.ok && alloc.isolation === 'worktree' ? await safeCapture(adapters, job.execution_cwd, job.base_revision) : null;
-        const reviewTask = adapters.buildReviewTask(job.original_task, null);
+        const reviewTask = adapters.buildReviewTask(job.original_task, null, { strictness: job.review_strictness ?? 'standard' });
         const review = await runReviewerAttempt(job, reviewTask, config, before);
         job.review = review;
         if (job.review) transition(job, JOB_PHASES.READY, 'review complete');
@@ -290,10 +334,20 @@ export function createWorkflowRuntime(adapters, {
       for (;;) {
         if (job.cancelling) { cancelWorkflow(job); return; }
         if (attempt > 0) transition(job, JOB_PHASES.RUNNING, `escalated attempt ${attempt}`);
-        const policy = resolveModelPolicy(config, 'worker', { attempt });
+        const resolvedPolicy = resolveModelPolicy(config, 'worker', { attempt });
+        const fallbackPolicy = job.allow_fallback === false
+          ? { ...resolvedPolicy, escalation: { ...resolvedPolicy.escalation, enabled: false } }
+          : resolvedPolicy;
+        const policy = job.routing === 'stable'
+          ? { ...fallbackPolicy, adaptive: { ...fallbackPolicy.adaptive, enabled: false } }
+          : fallbackPolicy;
         const attemptId = attemptIdFor(adapters, job.id, attempt === 0 ? '' : String(attempt));
         job.current_attempt_id = attemptId;
         job.events.push({ at: clock(), phase: job.phase, type: 'attempt/start', attempt, escalation_reason: escalationReason });
+        recordCanonical(job, 'worker.started', {
+          attempt_id: attemptId,
+          escalation_reason: escalationReason,
+        }, attempt);
         const ar = await adapters.executeAttempt({
           id: attemptId,
           workflowId: job.id,
@@ -302,6 +356,7 @@ export function createWorkflowRuntime(adapters, {
           task: job.original_task,
           cwd: job.execution_cwd,
           effort: job.effort,
+          timeout_seconds: job.timeout_seconds,
           policy,
           source: job.source,
           model_class_hint: job.model_class_hint,
@@ -314,6 +369,18 @@ export function createWorkflowRuntime(adapters, {
         if (job.cancelling) { cancelWorkflow(job); return; }
         const attemptView = attemptRecord(ar, attempt);
         job.attempts.push(attemptView);
+        recordCanonical(job, 'model.selected', {
+          provider: attemptView.provider,
+          model: attemptView.model,
+          source: attemptView.selection_source,
+          fallback_reason: attemptView.selection_trace?.fallback_reason ?? null,
+        }, attempt);
+        recordCanonical(job, 'worker.completed', {
+          attempt_id: attemptView.id,
+          status: attemptView.status,
+          stop_reason: attemptView.stopReason,
+          error_code: attemptView.error_code,
+        }, attempt);
         if (ar.infra === true) {
           failJob(job, Object.assign(new Error(ar.error ?? 'infrastructure failure'), { code: WORKFLOW_ERROR_CODES.ATTEMPT_INFRA_FAILURE }));
           return;
@@ -360,6 +427,11 @@ export function createWorkflowRuntime(adapters, {
           return;
         }
         if (decision.step === 'escalate') {
+          recordCanonical(job, 'model.fallback', {
+            reason: decision.reason,
+            from_attempt: attempt,
+            to_attempt: attempt + 1,
+          }, attempt);
           transition(job, JOB_PHASES.ESCALATING, decision.reason);
           escalationReason = decision.reason;
           attempt += 1;
@@ -368,7 +440,7 @@ export function createWorkflowRuntime(adapters, {
         if (decision.step === 'review') {
           transition(job, JOB_PHASES.REVIEWING, 'automatic review');
           const before = job.candidate;
-          const reviewTask = adapters.buildReviewTask(job.original_task, { outcome, candidate: job.candidate ?? null });
+          const reviewTask = adapters.buildReviewTask(job.original_task, { outcome, candidate: job.candidate ?? null }, { strictness: job.review_strictness ?? 'standard' });
           const review = await runReviewerAttempt(job, reviewTask, config, before, job.execution_cwd, job.base_revision);
           job.review = review;
           transition(job, JOB_PHASES.READY, decision.reason);
@@ -401,6 +473,7 @@ export function createWorkflowRuntime(adapters, {
     const attemptId = attemptIdFor(adapters, job.id, 'review');
     job.current_attempt_id = attemptId;
     job.events.push({ at: clock(), phase: job.phase, type: 'review/start' });
+    recordCanonical(job, 'review.started', { attempt_id: attemptId }, 0);
     const ar = await adapters.executeAttempt({
       id: attemptId,
       workflowId: job.id,
@@ -420,13 +493,30 @@ export function createWorkflowRuntime(adapters, {
     job.current_attempt_id = null;
     const attemptView = { ...attemptRecord(ar, 0), phase: 'review' };
     job.attempts.push(attemptView);
+    recordCanonical(job, 'model.selected', {
+      provider: attemptView.provider,
+      model: attemptView.model,
+      source: attemptView.selection_source,
+      fallback_reason: attemptView.selection_trace?.fallback_reason ?? null,
+    }, 0);
     if (ar.status === 'failed' && attemptView.error_code) job.error_code = attemptView.error_code;
     const afterCandidate = job.isolation === 'worktree' ? await safeCapture(adapters, cwd, baseRevision) : null;
-    return normalizeReview({ attemptResult: ar, beforeCandidate, afterCandidate });
+    const review = normalizeReview({ attemptResult: ar, beforeCandidate, afterCandidate });
+    recordCanonical(job, 'review.completed', {
+      attempt_id: attemptView.id,
+      status: review.status,
+      verdict: review.verdict,
+      error_code: attemptView.error_code,
+    }, 0);
+    return review;
   }
 
   function finalize(job) {
     transition(job, JOB_PHASES.COMPLETED, job.review ? 'reviewed' : 'verified');
+    recordCanonical(job, 'job.completed', {
+      reviewed: !!job.review,
+      task_status: job.outcome?.task_status ?? null,
+    });
     setTerminal(job);
   }
 
@@ -464,6 +554,7 @@ export function createWorkflowRuntime(adapters, {
     if (activeAttempt) adapters.cancelAttempt?.(activeAttempt).catch(() => {});
     job.phase = JOB_PHASES.CANCELLED;
     job.status = 'cancelled';
+    recordCanonical(job, 'job.cancelled', { active_attempt_id: activeAttempt ?? null });
     job.endedAt = clock();
     job.current_attempt_id = null;
     for (const w of job.waiters.splice(0)) w();
@@ -481,6 +572,7 @@ export function createWorkflowRuntime(adapters, {
     });
     const v = {
       id: job.id,
+      client_job_id: job.client_job_id,
       role: job.role,
       phase: job.phase,
       status: job.status,
@@ -488,6 +580,11 @@ export function createWorkflowRuntime(adapters, {
       current_model: job.attempts[job.attempts.length - 1]?.model ?? null,
       model_class_hint: job.model_class_hint,
       source: job.source,
+      profile_id: job.profile_id,
+      routing: job.routing,
+      workspace_context: job.workspace_context ? { ...job.workspace_context } : null,
+      workspace_branch: job.workspace_branch,
+      timeout_seconds: job.timeout_seconds,
       requested_cwd: job.requested_cwd,
       execution_cwd: job.execution_cwd,
       isolation: job.isolation,
@@ -505,6 +602,7 @@ export function createWorkflowRuntime(adapters, {
       decision: job.decision,
       candidate_available: !!job.candidate,
       review_status: job.review ? job.review.status ?? null : null,
+      event_cursor: job.canonical_events.at(-1)?.sequence ?? 0,
     };
     if (withResult) {
       v.child_attempts = job.attempts.map((a) => ({
@@ -520,6 +618,7 @@ export function createWorkflowRuntime(adapters, {
       v.candidate = job.candidate;
       v.review = job.review;
       v.events = job.events;
+      v.canonical_events = job.canonical_events.map((event) => ({ ...event, data: { ...event.data } }));
     }
     return v;
   }