@ran-sh/dsh-crew 0.5.6 → 1.0.0

package/src/runtime-identity.mjs

@@ -5,10 +5,20 @@
 // - HUB_PROTOCOL_VERSION changes only when Hub <-> MCP wire semantics become
 //   incompatible.
 //
-// Keep this module pure and dependency-free so Hub, MCP and tests all use the
-// exact same compatibility rules.
+// Keep this module dependency-light so Hub, MCP and tests all use the exact
+// same compatibility rules.
+
+import { randomUUID } from 'node:crypto';
+
+// Production Crew execution is intentionally bound to the isolated 3210 Hub.
+// These fields are public provenance only; no credential or session secret is
+// included in the identity contract.
+export const PRODUCTION_EXECUTION_PLANE = 'hub-3210';
+export const PRODUCTION_PROFILE = 'dsh-crew';
+export const PRODUCTION_LISTEN_PORT = 3210;
+const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '0.5.6';
+export const RUNTIME_VERSION = '1.0.0';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([
@@ -23,10 +33,17 @@ export const HUB_CAPABILITIES = Object.freeze([
   'config',
   'canonical-events',
   'evidence',
-  'profiles',
-  'workspace-context',
-  'extension-contract',
-]);
+  'profiles',
+  'workspace-context',
+  'extension-contract',
+  'provider-inventory',
+  'provider-lifecycle-v1',
+  'provider-health-v1',
+  'provider-probe-stream-v1',
+  'credential-reference-inventory-v1',
+  'credential-purge-v1',
+  'runtime-provenance-v1',
+]);
 
 // Capabilities the current MCP workflow depends on for full Hub execution.
 // Additional capabilities may be advertised without breaking compatibility.
@@ -43,9 +60,12 @@ export const HUB_COMPATIBILITY_CODES = Object.freeze({
   UNREACHABLE: 'HUB_UNREACHABLE',
   HTTP_ERROR: 'HUB_HTTP_ERROR',
   SERVICE_MISMATCH: 'HUB_SERVICE_MISMATCH',
-  PROTOCOL_MISSING: 'HUB_PROTOCOL_MISSING',
-  PROTOCOL_MISMATCH: 'HUB_PROTOCOL_MISMATCH',
-  CAPABILITY_MISSING: 'HUB_CAPABILITY_MISSING',
+  PROTOCOL_MISSING: 'HUB_PROTOCOL_MISSING',
+  PROTOCOL_MISMATCH: 'HUB_PROTOCOL_MISMATCH',
+  CAPABILITY_MISSING: 'HUB_CAPABILITY_MISSING',
+  PROVENANCE_MISSING: 'HUB_PROVENANCE_MISSING',
+  EXECUTION_PLANE_MISMATCH: 'HUB_EXECUTION_PLANE_MISMATCH',
+  LISTEN_PORT_MISMATCH: 'HUB_LISTEN_PORT_MISMATCH',
 });
 
 function normalizedCapabilities(value) {
@@ -59,8 +79,12 @@ export function getHubRuntimeIdentity() {
     surface: 'native-crew-harness',
     ui_role: 'runtime',
     runtime_version: RUNTIME_VERSION,
-    protocol_version: HUB_PROTOCOL_VERSION,
-    capabilities: [...HUB_CAPABILITIES],
+    protocol_version: HUB_PROTOCOL_VERSION,
+    execution_plane: PRODUCTION_EXECUTION_PLANE,
+    profile: PRODUCTION_PROFILE,
+    listen_port: PRODUCTION_LISTEN_PORT,
+    runtime_id: RUNTIME_ID,
+    capabilities: [...HUB_CAPABILITIES],
   };
 }
 
@@ -71,30 +95,51 @@ export function getHubRuntimeIdentity() {
  * `compatible` means the response is from dsh-crew and satisfies the current
  * protocol + required capability contract.
  */
-export function evaluateHubHandshake(body, { requiredCapabilities = REQUIRED_HUB_CAPABILITIES } = {}) {
+export function evaluateHubHandshake(body, { requiredCapabilities = REQUIRED_HUB_CAPABILITIES, strictProduction = false } = {}) {
   const capabilities = normalizedCapabilities(body?.capabilities);
   const base = {
     reachable: true,
     compatible: false,
     service: typeof body?.service === 'string' ? body.service : null,
-    runtime_version: typeof body?.runtime_version === 'string' ? body.runtime_version : null,
-    protocol_version: Number.isInteger(body?.protocol_version) ? body.protocol_version : null,
+    runtime_version: typeof body?.runtime_version === 'string' ? body.runtime_version : null,
+    protocol_version: Number.isInteger(body?.protocol_version) ? body.protocol_version : null,
+    execution_plane: typeof body?.execution_plane === 'string' ? body.execution_plane : null,
+    profile: typeof body?.profile === 'string' ? body.profile : null,
+    listen_port: Number.isInteger(body?.listen_port) ? body.listen_port : null,
+    runtime_id: typeof body?.runtime_id === 'string' ? body.runtime_id : null,
     capabilities,
     missing_capabilities: [],
     code: null,
   };
 
-  if (body?.service !== 'dsh-crew-hub') {
-    return { ...base, code: HUB_COMPATIBILITY_CODES.SERVICE_MISMATCH };
-  }
+  if (body?.service !== 'dsh-crew-hub') {
+    return { ...base, code: HUB_COMPATIBILITY_CODES.SERVICE_MISMATCH };
+  }
+
+  // An explicit execution identity that is not the isolated 3210 Crew plane
+  // must never be accepted as the production Hub. Missing legacy fields remain
+  // compatible with the older protocol contract and are handled below.
+  if (body?.execution_plane !== undefined && body.execution_plane !== PRODUCTION_EXECUTION_PLANE) {
+    return { ...base, code: HUB_COMPATIBILITY_CODES.EXECUTION_PLANE_MISMATCH };
+  }
+  if (body?.listen_port !== undefined && body.listen_port !== PRODUCTION_LISTEN_PORT) {
+    return { ...base, code: HUB_COMPATIBILITY_CODES.LISTEN_PORT_MISMATCH };
+  }
 
   if (!Number.isInteger(body?.protocol_version)) {
     return { ...base, code: HUB_COMPATIBILITY_CODES.PROTOCOL_MISSING };
   }
 
-  if (body.protocol_version !== HUB_PROTOCOL_VERSION) {
-    return { ...base, code: HUB_COMPATIBILITY_CODES.PROTOCOL_MISMATCH };
-  }
+  if (body.protocol_version !== HUB_PROTOCOL_VERSION) {
+    return { ...base, code: HUB_COMPATIBILITY_CODES.PROTOCOL_MISMATCH };
+  }
+
+  if (strictProduction && !(body?.execution_plane === PRODUCTION_EXECUTION_PLANE
+    && body?.profile === PRODUCTION_PROFILE
+    && Number.isInteger(body?.listen_port) && body.listen_port === PRODUCTION_LISTEN_PORT
+    && typeof body?.runtime_id === 'string' && body.runtime_id.trim().length > 0)) {
+    return { ...base, code: HUB_COMPATIBILITY_CODES.PROVENANCE_MISSING };
+  }
 
   const required = normalizedCapabilities(requiredCapabilities);
   const advertised = new Set(capabilities);

package/src/runtime-readiness-snapshot.mjs

@@ -0,0 +1,87 @@
+// Single, bounded readiness projection shared by the Hub extension surface,
+// MCP diagnostics and the client. It consumes already-collected evidence and
+// never performs I/O or carries raw task/result/error/credential content.
+
+const MAX_HEALTH = 128;
+
+function text(value) { return typeof value === 'string' && value.trim() ? value.trim() : null; }
+
+function projectRuntime(runtime) {
+  if (!runtime || typeof runtime !== 'object') return null;
+  return {
+    execution_plane: text(runtime.execution_plane),
+    profile: text(runtime.profile),
+    listen_port: Number.isFinite(Number(runtime.listen_port)) ? Number(runtime.listen_port) : null,
+    runtime_id: text(runtime.runtime_id),
+  };
+}
+
+function projectSelection(value) {
+  if (!value || typeof value !== 'object') return null;
+  const provider = text(value.provider);
+  const model = text(value.model);
+  if (!provider || !model) return null;
+  return { provider, model, ...(text(value.source) ? { source: text(value.source) } : {}) };
+}
+
+function projectHealth(entry) {
+  if (!entry || typeof entry !== 'object') return null;
+  const provider = text(entry.provider);
+  const model = text(entry.model);
+  const state = text(entry.state);
+  if (!provider || !model || !state) return null;
+  return {
+    provider,
+    model,
+    state,
+    ...(text(entry.reason_code) ? { reason_code: text(entry.reason_code) } : {}),
+    ...(Number.isFinite(entry.observed_at) ? { observed_at: entry.observed_at } : {}),
+    ...(Number.isFinite(entry.expires_at) ? { expires_at: entry.expires_at } : {}),
+    fresh: entry.fresh === true,
+  };
+}
+
+function matrixRow(matrix, id) {
+  return Array.isArray(matrix?.rows) ? matrix.rows.find((row) => row?.id === id) ?? null : null;
+}
+
+function projectWorkspace(workspace) {
+  if (!workspace || typeof workspace !== 'object') return null;
+  return {
+    ...(text(workspace.status) ? { status: text(workspace.status) } : {}),
+    ...(text(workspace.reason_code) ? { reason_code: text(workspace.reason_code) } : {}),
+  };
+}
+
+export function buildRuntimeReadinessSnapshot({
+  runtime = null,
+  readinessMatrix = null,
+  selections = {},
+  health = [],
+  jobs = [],
+  workspace = null,
+} = {}) {
+  const projectedHealth = (Array.isArray(health) ? health : []).map(projectHealth).filter(Boolean).slice(0, MAX_HEALTH);
+  const projectedJobs = Array.isArray(jobs) ? jobs : [];
+  const verified = projectedJobs.filter((job) => job?.status === 'done' && job?.task_status === 'success' && job?.delivery_complete === true).length;
+  const workerJobs = projectedJobs.filter((job) => job?.role === 'worker').length;
+  const reviewerJobs = projectedJobs.filter((job) => job?.role === 'reviewer').length;
+  const workerSelection = projectSelection(selections.worker ?? selections.flash);
+  const reviewerSelection = projectSelection(selections.reviewer ?? selections.pro);
+  return {
+    schema_version: 1,
+    runtime: projectRuntime(runtime),
+    readiness_matrix: readinessMatrix && typeof readinessMatrix === 'object' ? structuredClone(readinessMatrix) : null,
+    provider_lifecycle: matrixRow(readinessMatrix, 'provider_lifecycle_consistent'),
+    health: projectedHealth,
+    worker: { selected: workerSelection, health: projectedHealth.filter((entry) => entry.provider === workerSelection?.provider && entry.model === workerSelection?.model) },
+    reviewer: { selected: reviewerSelection, health: projectedHealth.filter((entry) => entry.provider === reviewerSelection?.provider && entry.model === reviewerSelection?.model) },
+    historical_evidence: {
+      job_count: projectedJobs.length,
+      verified_job_count: verified,
+      worker_job_count: workerJobs,
+      reviewer_job_count: reviewerJobs,
+    },
+    workspace: projectWorkspace(workspace),
+  };
+}

package/src/server.mjs

@@ -9,7 +9,8 @@ import { hubCompatibilityMessage, resolveHubExecutionMode } from './hub-compatib
 import { RUNTIME_VERSION, getHubRuntimeIdentity } from './runtime-identity.mjs';
 import { resolveWorkerModel } from './model-routing.mjs';
 import { runtimeActivationMetadata } from './runtime-controls.mjs';
-import { buildConfigReadinessMatrix } from './config-readiness.mjs';
+import { buildConfigReadinessMatrix } from './config-readiness.mjs';
+import { buildRuntimeReadinessSnapshot } from './runtime-readiness-snapshot.mjs';
 import { classifyFailure, classifyFailureCode } from './failure-classification.mjs';
 import {
   normalizeGlobalConfig,
@@ -56,7 +57,9 @@ const constraintsSchema = z.object({
 // Initial values come from the global config (~/.config/dsh-crew/config.json,
 // edited on the DSH settings page); dsh_worker_config overrides per session.
 // All dispatch decisions (dsh_run_worker AND dsh_spawn_worker, hub AND
-// standalone) go through the same policy resolver in src/policy.mjs.
+// production dispatches go through the 3210-only policy resolver in
+// src/policy.mjs; the historical standalone path is retained only for
+// read/migration compatibility and is never selected for execution.
 import { readGlobalConfig } from './install/install.mjs';
 const initialGlobalConfig = normalizeGlobalConfig(readGlobalConfig());
 const legacyDefaults = deriveLegacyConfig(initialGlobalConfig);
@@ -65,7 +68,7 @@ const sessionConfig = {
   enabled: true,
   default_tier: legacyDefaults.default_tier,
   default_effort: legacyDefaults.default_effort,
-  mode: legacyDefaults.mode, // auto | hub | standalone
+  mode: legacyDefaults.mode === 'standalone' ? 'hub' : legacyDefaults.mode, // auto | hub; legacy standalone is migrated to hub
   default_timeout_seconds: legacyDefaults.default_timeout_seconds,
   tier_policy: undefined,
   escalate_on_failure: legacyDefaults.escalate_on_failure,
@@ -83,7 +86,7 @@ function resetSessionConfig() {
     enabled: true,
     default_tier: legacyDefaults.default_tier,
     default_effort: legacyDefaults.default_effort,
-    mode: legacyDefaults.mode,
+    mode: legacyDefaults.mode === 'standalone' ? 'hub' : legacyDefaults.mode,
     default_timeout_seconds: legacyDefaults.default_timeout_seconds,
     tier_policy: undefined,
     escalate_on_failure: legacyDefaults.escalate_on_failure,
@@ -142,9 +145,9 @@ function dispatchDisabled() {
   });
 }
 
-async function resolveMode() {
-  const status = await hubStatus();
-  const decision = resolveHubExecutionMode(sessionConfig.mode, status);
+async function resolveMode() {
+  const status = await hubStatus();
+  const decision = resolveHubExecutionMode(sessionConfig.mode, status, { productionOnly: true });
   if (!decision.ok) {
     throw Object.assign(new Error(decision.error), {
       code: decision.code,
@@ -274,7 +277,7 @@ server.registerTool('dsh_worker_config', {
     enabled: z.boolean().optional().describe('false = refuse all worker dispatch this session'),
     default_tier: z.enum(['flash', 'pro']).optional(),
     default_effort: z.enum(['off', 'high', 'max']).optional(),
-    mode: z.enum(['auto', 'hub', 'standalone']).optional(),
+    mode: z.enum(['auto', 'hub']).optional().describe('Execution mode. Production dispatch always uses the isolated 3210 Crew Harness; standalone is retained only as a legacy read/migration value.'),
     default_timeout_seconds: z.number().int().positive().max(7200).optional(),
     tier_policy: z.enum(['auto', 'flash-only', 'pro-only']).optional().describe('session hard clamp: flash-only / pro-only pin every dispatch to one tier'),
     escalate_on_failure: z.boolean().optional().describe('allow an unverified worker attempt to retry through the stronger model policy (applies to run and spawn)'),
@@ -325,9 +328,13 @@ async function buildConfigReport() {
   let effectiveWorkerProvider = null;
   let effectiveWorkerSelection = { flash: null, pro: null };
   let providerResolutionError;
-  let providerCatalogChecked = false;
-  let providerCatalogBody = null;
-  let hubJobsChecked = false;
+  let providerCatalogChecked = false;
+  let providerCatalogBody = null;
+  let providerInventoryChecked = false;
+  let providerInventoryBody = null;
+  let providerHealthChecked = false;
+  let providerHealthBody = null;
+  let hubJobsChecked = false;
   let hubJobsBody = null;
   const workerProviderMode = globalConfig.worker_provider_mode ?? 'deepseek-official';
   if (workerProviderMode === 'deepseek-official') {
@@ -362,9 +369,31 @@ async function buildConfigReport() {
   } else if (hubCompatibility.reachable) {
     providerResolutionError = hubCompatibilityMessage(hubCompatibility);
   }
-  if (hubCompatibility.compatible) {
-    try {
-      hubJobsChecked = true;
+  if (hubCompatibility.compatible) {
+    try {
+      providerInventoryChecked = true;
+      const inventoryRes = await fetch(`${globalConfig.hub_url}/_dsh/dsh-crew/providers`, { signal: AbortSignal.timeout(800) });
+      providerInventoryBody = inventoryRes.ok
+        ? await inventoryRes.json()
+        : { ok: false, code: 'PROVIDER_INVENTORY_UNAVAILABLE' };
+    } catch {
+      providerInventoryChecked = true;
+      providerInventoryBody = { ok: false, code: 'PROVIDER_INVENTORY_UNAVAILABLE' };
+    }
+  }
+  if (hubCompatibility.compatible) {
+    try {
+      providerHealthChecked = true;
+      const healthRes = await fetch(`${globalConfig.hub_url}/_dsh/dsh-crew/provider-health`, { signal: AbortSignal.timeout(800) });
+      providerHealthBody = healthRes.ok ? await healthRes.json() : { ok: false, code: 'PROVIDER_HEALTH_UNAVAILABLE' };
+    } catch {
+      providerHealthChecked = true;
+      providerHealthBody = { ok: false, code: 'PROVIDER_HEALTH_UNAVAILABLE' };
+    }
+  }
+  if (hubCompatibility.compatible) {
+    try {
+      hubJobsChecked = true;
       const jobsRes = await fetch(`${globalConfig.hub_url}/_dsh/dsh-crew/jobs`, { signal: AbortSignal.timeout(800) });
       hubJobsBody = await jobsRes.json();
     } catch {
@@ -375,14 +404,26 @@ async function buildConfigReport() {
   const readinessMatrix = buildConfigReadinessMatrix({
     hubCompatibility,
     workerProviderMode,
-    providerCatalogChecked,
-    providerCatalogBody,
-    hubJobsChecked,
+    providerCatalogChecked,
+    providerCatalogBody,
+    providerInventoryChecked,
+    providerInventoryBody,
+    providerHealthChecked,
+    providerHealthBody,
+    hubJobsChecked,
     hubJobsBody,
   });
   const roleProfiles = loadRoleProfiles();
-  const workspaceReadiness = await assessWorkspaceReadiness({ cwd: process.cwd() });
-  const extensionContract = buildExtensionContract({
+  const workspaceReadiness = await assessWorkspaceReadiness({ cwd: process.cwd() });
+  const readinessSnapshot = buildRuntimeReadinessSnapshot({
+    runtime: getHubRuntimeIdentity(),
+    readinessMatrix,
+    selections: { worker: effectiveWorkerSelection.worker ?? effectiveWorkerSelection.flash, reviewer: effectiveWorkerSelection.reviewer ?? effectiveWorkerSelection.pro },
+    health: providerHealthBody?.health,
+    jobs: hubJobsBody?.jobs,
+    workspace: workspaceReadiness,
+  });
+  const extensionContract = buildExtensionContract({
     config: {
       ...globalConfig,
       subagents_enabled: sessionConfig.enabled !== false && globalConfig.subagents_enabled !== false,
@@ -390,7 +431,8 @@ async function buildConfigReport() {
       review_state: globalConfig.review_state,
       escalate_on_failure: sessionConfig.escalate_on_failure ?? legacy.escalate_on_failure,
     },
-    readinessMatrix,
+    readinessMatrix,
+    readinessSnapshot,
     workspace: workspaceReadiness,
     profiles: roleProfiles,
     runtime: getHubRuntimeIdentity(),
@@ -432,7 +474,8 @@ async function buildConfigReport() {
     global_defaults: Object.fromEntries(SAFE_GLOBAL_KEYS.map((k) => [k, globalConfig[k]])),
     runtime_controls: runtimeControls,
     activation_boundaries: activationBoundaries,
-    readiness_matrix: readinessMatrix,
+    readiness_matrix: readinessMatrix,
+    readiness_snapshot: readinessSnapshot,
     role_profiles: roleProfiles,
     extension_contract: extensionContract,
     hub_reachable: hubCompatibility.reachable,

package/src/status-shard.mjs

@@ -3,7 +3,7 @@
 // and readers merge all fresh shards. Kills the last-writer-wins race that a
 // single shared status.json had with multiple concurrent writers.
 
-import { writeFileSync, mkdirSync, rmSync, readdirSync, readFileSync } from 'node:fs';
+import { writeFileSync, mkdirSync, rmSync, readdirSync, readFileSync, renameSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 
@@ -21,9 +21,20 @@ export function createShardWriter(kind) {
   return {
     writer,
     publish(jobs) {
+      // Same durability pattern as the profile/workspace registries: write a
+      // same-directory temp file as 0600 and rename it over the shard, so a
+      // reader never observes a partially written shard (parse failures are
+      // silently ignored, which would make the writer look vanished).
       try {
         mkdirSync(SHARD_DIR, { recursive: true });
-        writeFileSync(file, JSON.stringify({ updatedAt: new Date().toISOString(), writer, jobs }, null, 2));
+        const temp = `${file}.tmp-${Date.now()}`;
+        try {
+          writeFileSync(temp, JSON.stringify({ updatedAt: new Date().toISOString(), writer, jobs }, null, 2), { encoding: 'utf8', mode: 0o600 });
+          renameSync(temp, file);
+        } catch (error) {
+          try { rmSync(temp, { force: true }); } catch {}
+          throw error;
+        }
       } catch {}
     },
     dispose: cleanup,

package/src/workflow-runtime.mjs

@@ -15,6 +15,7 @@
 // appear here.
 
 import { resolveModelPolicy, shouldAutoReview, getRoleState } from './policy.mjs';
+import { raceWaiters } from './removable-waiter.mjs';
 import { applyWorkspaceEvidence, buildOutcome, decideNextStep, JOB_PHASES, canTransition } from './workflow.mjs';
 import { parseDeliveryReport } from './delivery.mjs';
 import { classifyFailure } from './failure-classification.mjs';
@@ -298,7 +299,8 @@ export function createWorkflowRuntime(adapters, {
     let config = {};
 
     try {
-      config = adapters.getConfig?.() ?? {};
+      config = adapters.getConfig?.() ?? {};
+      job.review_gate = ['required', 'optional', 'off'].includes(config?.review?.gate) ? config.review.gate : 'required';
       const alloc = await adapters.allocateWorkspace?.(job);
       if (alloc && alloc.ok === false) {
         failJob(job, Object.assign(new Error(alloc.error ?? alloc.reason), { code: alloc.reason }));
@@ -324,6 +326,19 @@ export function createWorkflowRuntime(adapters, {
         const review = await runReviewerAttempt(job, reviewTask, config, before);
         if (job.cancelling) { await cancelWorkflow(job); return; }
         job.review = review;
+        const reviewApproved = review.status === 'done'
+          && review.delivery_complete === true
+          && review.verdict === 'approve';
+        if (!reviewApproved) {
+          const code = review.verdict === 'request_changes'
+            ? 'REVIEW_CHANGES_REQUESTED'
+            : 'REVIEW_INCONCLUSIVE';
+          failJob(job, Object.assign(
+            new Error(`explicit review blocked acceptance: verdict=${review.verdict}, reviewer status=${review.status}, review delivery_complete=${review.delivery_complete === true}`),
+            { code },
+          ));
+          return;
+        }
         if (job.review) transition(job, JOB_PHASES.READY, 'review complete');
         finalize(job);
         return;
@@ -453,6 +468,24 @@ export function createWorkflowRuntime(adapters, {
           const review = await runReviewerAttempt(job, reviewTask, config, before, job.execution_cwd, job.base_revision);
         if (job.cancelling) { await cancelWorkflow(job); return; }
           job.review = review;
+          // The review verdict is an acceptance gate, not a footnote: only a
+          // reviewer that ran to completion, delivered its own auditable
+          // contract, and approved may finalize as COMPLETED. Anything else
+          // fails closed through the existing FAILED machinery so the MCP
+          // surface reports a failed workflow instead of a false "done".
+          const reviewApproved = review.status === 'done'
+            && review.delivery_complete === true
+            && review.verdict === 'approve';
+          if (!reviewApproved && job.review_gate === 'required') {
+            const code = review.verdict === 'request_changes'
+              ? 'REVIEW_CHANGES_REQUESTED'
+              : 'REVIEW_INCONCLUSIVE';
+            failJob(job, Object.assign(
+              new Error(`automatic review blocked acceptance: verdict=${review.verdict}, reviewer status=${review.status}, review delivery_complete=${review.delivery_complete === true}`),
+              { code },
+            ));
+            return;
+          }
           transition(job, JOB_PHASES.READY, decision.reason);
           finalize(job);
           return;
@@ -535,8 +568,9 @@ export function createWorkflowRuntime(adapters, {
       id: ar.id,
       role: ar.role ?? 'worker',
       attempt,
-      provider: ar.provider ?? null,
-      model: ar.model ?? null,
+      provider: ar.provider ?? null,
+      model: ar.model ?? null,
+      execution_context: ar.execution_context ?? null,
       selection_source: ar.selection_source ?? null,
       selection_trace: ar.selection_trace ?? null,
       status: ar.status ?? 'failed',
@@ -594,7 +628,8 @@ export function createWorkflowRuntime(adapters, {
       phase: job.phase,
       status: job.status,
       attempt: job.attempts.length,
-      current_model: job.attempts[job.attempts.length - 1]?.model ?? null,
+      current_model: job.attempts[job.attempts.length - 1]?.model ?? null,
+      execution_context: job.attempts[job.attempts.length - 1]?.execution_context ?? null,
       model_class_hint: job.model_class_hint,
       source: job.source,
       profile_id: job.profile_id,
@@ -619,12 +654,14 @@ export function createWorkflowRuntime(adapters, {
       workspace_retained: job.workspace_retained === true,
       decision: job.decision,
       candidate_available: !!job.candidate,
-      review_status: job.review ? job.review.status ?? null : null,
+      review_status: job.review ? job.review.status ?? null : null,
+      review_gate: job.review_gate ?? 'required',
       event_cursor: job.canonical_events.at(-1)?.sequence ?? 0,
     };
     if (withResult) {
       v.child_attempts = job.attempts.map((a) => ({
-        id: a.id, role: a.role, attempt: a.attempt, provider: a.provider, model: a.model,
+        id: a.id, role: a.role, attempt: a.attempt, provider: a.provider, model: a.model,
+        execution_context: a.execution_context ?? null,
         selection_source: a.selection_source, selection_trace: a.selection_trace ?? null,
         status: a.status, stopReason: a.stopReason,
         outcome_task: a.outcome?.task_status ?? null,
@@ -661,10 +698,7 @@ export function createWorkflowRuntime(adapters, {
     const job = jobs.get(id);
     if (!job) return undefined;
     if (job.status !== 'running') return job;
-    await Promise.race([
-      new Promise((res) => job.waiters.push(res)),
-      timeoutMs > 0 ? new Promise((res) => setTimeout(res, timeoutMs)) : new Promise(() => {}),
-    ]);
+    await raceWaiters(job.waiters, { timeoutMs });
     return job;
   }
 

package/windows/start-dsh-crew.cmd

@@ -51,7 +51,7 @@ exit /b 64
 
 :help
 echo Usage: %~nx0 [--open ^| --background ^| --watch]
-echo   --open        Start both services and open http://127.0.0.1:3080/.
-echo   --background  Start both services silently without opening a browser.
-echo   --watch       Keep both services healthy and restart them after an exit.
+echo   --open        Start the 3080 console and its supervised 3210 backend, then open the console.
+echo   --background  Start the 3080 console and its supervised 3210 backend silently.
+echo   --watch       Keep the 3080 console and supervised 3210 backend healthy.
 exit /b 0

package/windows/start-dsh-crew.ps1

@@ -15,8 +15,8 @@ $logRoot = if ($env:TEMP) { $env:TEMP } else { [System.IO.Path]::GetTempPath() }
 $launcherLog = Join-Path $logRoot 'dsh-crew-launcher.log'
 $startedAt = Get-Date
 $services = @(
-  [pscustomobject]@{ Name = 'Crew backend'; Profile = 'dsh-crew'; Home = $crewHome; Port = 3210; Url = 'http://127.0.0.1:3210'; State = 'pending'; Process = $null; RootPid = $null; RootStartedAtUtcTicks = $null; ListenerPid = $null; ListenerStartedAtUtcTicks = $null; ConsecutiveFailures = 0; LastError = $null },
-  [pscustomobject]@{ Name = 'Official UI'; Profile = 'web'; Home = $officialHome; Port = 3080; Url = 'http://127.0.0.1:3080'; State = 'pending'; Process = $null; RootPid = $null; RootStartedAtUtcTicks = $null; ListenerPid = $null; ListenerStartedAtUtcTicks = $null; ConsecutiveFailures = 0; LastError = $null }
+  [pscustomobject]@{ Name = 'Official UI'; Profile = 'web'; Home = $officialHome; Port = 3080; Url = 'http://127.0.0.1:3080'; ManagedByBridge = $false; State = 'pending'; Process = $null; RootPid = $null; RootStartedAtUtcTicks = $null; ListenerPid = $null; ListenerStartedAtUtcTicks = $null; ConsecutiveFailures = 0; LastError = $null },
+  [pscustomobject]@{ Name = 'Crew backend'; Profile = 'dsh-crew'; Home = $crewHome; Port = 3210; Url = 'http://127.0.0.1:3210'; ManagedByBridge = $true; State = 'pending'; Process = $null; RootPid = $null; RootStartedAtUtcTicks = $null; ListenerPid = $null; ListenerStartedAtUtcTicks = $null; ConsecutiveFailures = 0; LastError = $null }
 )
 
 function Write-LaunchLog {
@@ -44,6 +44,18 @@ function Get-HealthState {
   }
 }
 
+function Start-BridgedCrewService {
+  try {
+    $response = Invoke-WebRequest -UseBasicParsing -Uri 'http://127.0.0.1:3080/_dsh/dsh-crew/ping' -TimeoutSec 5
+    if ($response.StatusCode -ge 200 -and $response.StatusCode -lt 300) {
+      return [pscustomobject]@{ Ready = $true; Error = $null }
+    }
+    return [pscustomobject]@{ Ready = $false; Error = ('3080 bridge returned HTTP {0}.' -f $response.StatusCode) }
+  } catch {
+    return [pscustomobject]@{ Ready = $false; Error = ('3080 bridge could not start the supervised 3210 backend: {0}' -f $_.Exception.Message) }
+  }
+}
+
 function Get-PortState {
   param([int] $Port)
   try {
@@ -175,7 +187,7 @@ function Wait-CrewServices {
       if ($health.Ready) {
         $service.State = 'ready'
         $service.ConsecutiveFailures = 0
-        [void] (Set-TrackedListenerIdentity -Service $service)
+        if (-not $service.ManagedByBridge) { [void] (Set-TrackedListenerIdentity -Service $service) }
         Write-LaunchLog ('{0} ready on {1}; runtime={2}' -f $service.Name, $service.Port, $health.Version)
       } elseif ($service.Process -and $service.Process.HasExited) {
         throw ('{0} exited before becoming ready; PID={1}; exit={2}; last health error: {3}' -f $service.Name, $service.Process.Id, $service.Process.ExitCode, $health.Error)
@@ -184,7 +196,9 @@ function Wait-CrewServices {
     if (@($services | Where-Object State -eq 'starting').Count -gt 0) { Start-Sleep -Milliseconds 500 }
   }
 
-  $notReady = @($services | Where-Object State -ne 'ready')
+  $notReady = @($services | Where-Object {
+    $_.State -ne 'ready' -and -not ($_.ManagedByBridge -and $_.State -eq 'pending')
+  })
   if ($notReady.Count -gt 0) {
     $details = ($notReady | ForEach-Object { '{0}:{1} ({2})' -f $_.Profile, $_.Port, $_.LastError }) -join '; '
     throw "Startup health deadline exceeded: $details"
@@ -193,21 +207,36 @@ function Wait-CrewServices {
 
 function Ensure-CrewServices {
   param([switch] $QuietHealthy)
+  $officialRestarted = $false
 
   foreach ($service in $services) {
     $health = Get-HealthState $service
+    if ($service.ManagedByBridge -and $officialRestarted) {
+      # A restarted 3080 process must re-establish ownership of 3210 through
+      # its own sidecar, even if an old detached listener still answers.
+      $service.State = 'pending'
+      $service.LastError = 'Waiting for the restarted 3080 bridge to claim 3210.'
+      continue
+    }
     if ($health.Ready) {
       $wasReady = $service.State -eq 'ready'
       $service.State = 'ready'
       $service.ConsecutiveFailures = 0
       $service.LastError = $null
-      if (-not $service.ListenerPid) { [void] (Set-TrackedListenerIdentity -Service $service) }
+      if (-not $service.ManagedByBridge -and -not $service.ListenerPid) { [void] (Set-TrackedListenerIdentity -Service $service) }
       if (-not $QuietHealthy -or -not $wasReady) {
         Write-LaunchLog ('{0} already ready on {1}; runtime={2}' -f $service.Name, $service.Port, $health.Version)
       }
       continue
     }
 
+    if ($service.ManagedByBridge) {
+      $service.LastError = $health.Error
+      $service.ConsecutiveFailures += 1
+      $service.State = 'pending'
+      continue
+    }
+
     $service.LastError = $health.Error
     $service.ConsecutiveFailures += 1
     if ($service.Process -and $service.Process.HasExited) {
@@ -242,9 +271,24 @@ function Ensure-CrewServices {
       Write-LaunchLog ('Supervisor detected {0} unavailable on {1}; restarting it.' -f $service.Name, $service.Port) 'WARN'
     }
     Start-CrewService $service
+    if (-not $service.ManagedByBridge) { $officialRestarted = $true }
   }
 
   Wait-CrewServices
+
+  # The 3080 official bridge is the sole owner of the 3210 child. Trigger it
+  # only after 3080 is healthy, then wait on the direct 3210 runtime contract.
+  foreach ($service in ($services | Where-Object ManagedByBridge -eq $true | Where-Object State -ne 'ready')) {
+    $bridge = Start-BridgedCrewService
+    if (-not $bridge.Ready) {
+      $service.LastError = $bridge.Error
+      throw $bridge.Error
+    }
+    $service.State = 'starting'
+    $service.ConsecutiveFailures = 0
+    $service.LastError = $null
+  }
+  if (@($services | Where-Object State -eq 'starting').Count -gt 0) { Wait-CrewServices }
 }
 
 function Start-ServiceSupervisor {