@sublang/slc 0.5.0 → 0.7.0

package/dist/runner.js

@@ -7,7 +7,7 @@
  * pipeline, computes artifact paths, then runs each phase through `runPhase`,
  * stopping at the first failure with its report. The resolver and executor are
  * injected so a host wires the real pipeline resolution and Cligent agent while
- * tests supply fakes. See specs/dev/pipeline.md and specs/dev/phase-execution.md.
+ * tests supply fakes. See specs/packages/pipeline.md and specs/packages/phase-execution.md.
  */
 import { mkdir, readFile, stat } from 'node:fs/promises';
 import { dirname, join, relative, resolve, sep } from 'node:path';
@@ -15,19 +15,22 @@ import { fileURLToPath } from 'node:url';
 import { artifactDir, planArtifacts, parseSource } from './artifacts.js';
 import { encodeLocator, invalidateBuildHistory, loadBuildHistory, recordBuild, verifiedInput, } from './build-history.js';
 import { emitEntryModule } from './entry-module.js';
-import { unresolvableRelativeImports } from './emitted-imports.js';
+import { reconcileLinkObjectImportSpecifiers, unresolvableRelativeImports, } from './emitted-imports.js';
 import { messageOf } from './errors.js';
 import { assertSafeTarget, formatFailureReport, pathsAlias, runPhase, } from './execution.js';
-import { hashBytes, isHash } from './hash.js';
+import { compareUtf8, hashBytes, isHash } from './hash.js';
 import { parseInvocation } from './invocation.js';
 import { unifiedLineDiff } from './line-diff.js';
 import { linkedArtifactPath, loadLinkFile } from './link.js';
-import { deriveClosure } from './pin-closure.js';
+import { inspectClosureWithDeclaration, } from './pin-closure.js';
+import { PIN_INPUTS_FILE } from './pin-inputs.js';
+import { resolvePinPath } from './pin-paths.js';
 import { evaluatePin, evaluatePinFile, hashTree } from './pin-currency.js';
 import { PINS_FILE, PinError, loadPinFile, } from './pins.js';
 import { loadPipeline, resolvePipeline, } from './pipeline.js';
 import { defaultPlaybookLinkTarget, isReservedPipeline } from './resolver.js';
-import { emitFsmCoverageTest, emitFsmIntrospectionTest, emitGearsFsmConformanceTest, emitPromptContractTest, } from './verify.js';
+import { readPlaybookRuntimeDeclaration, } from './runtime-contract.js';
+import { artifactSchemaForPlaybookProvenance, emitFsmCoverageTest, emitFsmIntrospectionTest, emitGearsFsmConformanceTest, emitPromptContractTest, findMachineConfig, loadFsmModule, loadLinkedModuleForVerification, playbookProvenanceForLinkTarget, resolveArtifactSchemaForVerification, } from './verify.js';
 import { VERIFIER_SUPPORT_MODULE, emitVerifierSupport, verifierSupportFiles, } from './verify-support.js';
 /**
  * Parses argv and runs the requested pipeline, phase, or link end-to-end.
@@ -46,7 +49,7 @@ export async function runSlc(argv, deps) {
         switch (invocation.kind) {
             case 'full':
                 // The reserved playbook pipeline supplies a default link target
-                // (SELFHOST-13): a bare full run becomes a full-link against the
+                // (self-hosting-13): a bare full run becomes a full-link against the
                 // installed @sublang/playbook runtime contract module (DR-014).
                 if (invocation.pipeline === 'playbook') {
                     return await runFullLink({
@@ -136,7 +139,7 @@ async function runSinglePhase(invocation, deps) {
         entry: pipeline.phases[0] === phase,
     });
     if (raw) {
-        // A named phase cannot normalize (PIPE-37), so a raw entry source has no
+        // A named phase cannot normalize (pipeline-37), so a raw entry source has no
         // path into the phase's declared source format here.
         return failure(`source "${invocation.source}" is a raw input; run the full pipeline to normalize it`);
     }
@@ -207,7 +210,7 @@ async function runFullLink(invocation, deps) {
     const normalize = invocation.normalize || raw;
     const artDir = artifactDir(cwd, basename, invocation.pipeline);
     await mkdir(artDir, { recursive: true });
-    // Compile chain: the exit artifact becomes the object artifact (PIPE-15).
+    // Compile chain: the exit artifact becomes the object artifact (pipeline-15).
     const plan = planArtifacts({ phases: pipeline.phases, basename, artDir });
     const compileSteps = buildCompileSteps({
         pipeline,
@@ -252,6 +255,7 @@ async function runFullLink(invocation, deps) {
         plan,
         artDir,
         basename,
+        linkTarget: resolve(cwd, invocation.linkTarget),
     };
     return executeSteps(steps, pipeline, deps, {
         incremental: incrementalRun(invocation, artDir, source),
@@ -270,7 +274,7 @@ async function runFullLink(invocation, deps) {
                     ],
                 };
             }
-            // Entry-module emission (DR-014, SELFHOST-15): only the playbook
+            // Entry-module emission (DR-014, self-hosting-15): only the playbook
             // pipeline, only with the linked artifact at its canonical path.
             if (verified.ok && entryPath !== null && gearsPlan !== undefined) {
                 await guardTarget(entryPath);
@@ -292,7 +296,7 @@ async function runFullLink(invocation, deps) {
                         diagnostics: [
                             ...verified.diagnostics,
                             `entry module ${entryPath} has unresolvable relative imports: ` +
-                                `${missing.join(', ')} (VERIFY-18)`,
+                                `${missing.join(', ')} (verification-18)`,
                         ],
                     };
                 }
@@ -310,11 +314,11 @@ function runCwd(deps) {
  * After a reserved-pipeline full run produces a `gears` intermediate and an `fsm`
  * object at their canonical `<basename>.playbook/` locations, emits the
  * artifact-local checker support plus compilation-correctness tests beside
- * them as `slc` output, appending their paths to the outputs (VERIFY-2,
- * VERIFY-4;
+ * them as `slc` output, appending their paths to the outputs (verification-2,
+ * verification-4;
  * [DR-009](../decisions/009-slc-playbook-pipeline-compilation.md)).
  * Non-reserved pipelines, runs without a gears+fsm pair, and runs whose `fsm` was
- * relocated out of that directory by `-o` (PIPE-8) are left unchanged, so an
+ * relocated out of that directory by `-o` (pipeline-8) are left unchanged, so an
  * emitted test never imports a file that was not written beside it. A test whose
  * emission needs the produced `fsm` imported (the pinned introspection) degrades
  * to a diagnostic when the artifact cannot be loaded, leaving the run outcome
@@ -329,6 +333,22 @@ async function emitVerification(result, ctx, guardTarget) {
     const fsm = ctx.plan.find((artifact) => artifact.phase.target.format === 'fsm');
     if (fsm === undefined)
         throw new Error('verification plan lost its FSM');
+    const provenance = ctx.linkTarget === undefined
+        ? undefined
+        : await playbookProvenanceForLinkTarget(ctx.linkTarget);
+    // A provenance outside the exact historical map is schema evidence only
+    // through the installed engine's own declaration (DR-028); an unreadable
+    // engine simply supplies no signal, and the emission reports the gap.
+    const runtimeDeclaration = ctx.linkTarget === undefined ||
+        artifactSchemaForPlaybookProvenance(provenance) !== undefined
+        ? undefined
+        : await linkTargetRuntimeDeclaration(ctx.linkTarget);
+    const evidence = {
+        ...(provenance === undefined ? {} : { provenance }),
+        ...(runtimeDeclaration === undefined ? {} : { runtimeDeclaration }),
+    };
+    const schemaResolution = await resolveVerificationSchema(ctx, evidence);
+    const artifactSchema = schemaResolution.artifactSchema;
     const outputs = [...result.outputs];
     const diagnostics = [...result.diagnostics];
     if (guardTarget !== undefined) {
@@ -344,6 +364,8 @@ async function emitVerification(result, ctx, guardTarget) {
         artifactDir: ctx.artDir,
         basename: ctx.basename,
         verifyModule: VERIFIER_SUPPORT_MODULE,
+        ...(artifactSchema === undefined ? {} : { artifactSchema }),
+        schemaFindings: schemaResolution.findings,
     }));
     try {
         if (guardTarget !== undefined) {
@@ -366,6 +388,8 @@ async function emitVerification(result, ctx, guardTarget) {
             artifactDir: ctx.artDir,
             basename: ctx.basename,
             verifyModule: VERIFIER_SUPPORT_MODULE,
+            ...(artifactSchema === undefined ? {} : { artifactSchema }),
+            ...evidence,
         });
         outputs.push(promptContract.path);
         diagnostics.push(...promptContract.diagnostics.map((diagnostic) => `verification: ${diagnostic}`));
@@ -390,6 +414,43 @@ async function emitVerification(result, ctx, guardTarget) {
     }
     return { ...result, outputs, diagnostics };
 }
+/** Reads the link target's engine declaration; unreadable is no evidence. */
+async function linkTargetRuntimeDeclaration(linkTarget) {
+    try {
+        return await readPlaybookRuntimeDeclaration(linkTarget);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Reconciles every schema witness available from one just-built artifact. */
+async function resolveVerificationSchema(ctx, evidence) {
+    const fsmPath = join(ctx.artDir, `${ctx.basename}.fsm.ts`);
+    let config;
+    try {
+        config = findMachineConfig(await loadFsmModule(fsmPath));
+    }
+    catch {
+        // Broken FSM loading already degrades the generated derivation checks to
+        // diagnostics; reviewed provenance remains usable conformance evidence.
+    }
+    let linked;
+    try {
+        linked = (await loadLinkedModuleForVerification({
+            linkedPath: join(ctx.artDir, `${ctx.basename}.playbook.ts`),
+            fsmPath,
+        }));
+    }
+    catch {
+        // A missing module supplies no signal; prompt emission reports an
+        // unloadable module through its existing diagnostic.
+    }
+    return resolveArtifactSchemaForVerification({
+        ...evidence,
+        ...(config === undefined ? {} : { config }),
+        ...(linked === undefined ? {} : { linked }),
+    });
+}
 /** Exact deterministic writes attempted by {@link emitVerification}. */
 function verificationHostTargets(ctx) {
     if (!isReservedPipeline(ctx.pipeline))
@@ -493,15 +554,35 @@ function compileStep(pipeline, phase, source, target) {
 }
 /**
  * Runs steps in order, selecting interpreted or compiled execution per phase from
- * the pin index and stopping at the first failure with its report (PHEXEC-9,
- * PHEXEC-27). An unparseable pin file fails the run closed before any phase.
+ * the pin index and stopping at the first failure with its report (phase-execution-9,
+ * phase-execution-27). An unparseable pin file fails the run closed before any phase.
  */
 async function executeSteps(steps, pipeline, deps, opts = {}) {
     const complete = opts.complete ?? (async (result) => result);
-    const pinInputs = new Set([join(pipeline.dir, PINS_FILE)]);
+    const pinInputs = new Set([
+        join(pipeline.dir, PINS_FILE),
+        join(pipeline.dir, PIN_INPUTS_FILE),
+    ]);
     let pinFile;
     try {
         pinFile = (await loadPinFile(pipeline.dir)).file;
+        if (pinFile !== undefined) {
+            const verdicts = await evaluatePinFile(pipeline.dir, pinFile, {
+                observePath: (path) => pinInputs.add(resolve(path)),
+            });
+            const malformed = Object.entries(verdicts).find(([, verdict]) => verdict.status === 'malformed');
+            if (malformed !== undefined) {
+                return {
+                    ok: false,
+                    outputs: [],
+                    diagnostics: [
+                        `pin is malformed: ${malformed[1].status === 'malformed'
+                            ? malformed[1].reason
+                            : 'invalid pin index'}`,
+                    ],
+                };
+            }
+        }
     }
     catch (error) {
         if (error instanceof PinError) {
@@ -509,23 +590,6 @@ async function executeSteps(steps, pipeline, deps, opts = {}) {
         }
         throw error;
     }
-    if (pinFile !== undefined) {
-        const verdicts = await evaluatePinFile(pipeline.dir, pinFile, {
-            observePath: (path) => pinInputs.add(resolve(path)),
-        });
-        const malformed = Object.entries(verdicts).find(([, verdict]) => verdict.status === 'malformed');
-        if (malformed !== undefined) {
-            return {
-                ok: false,
-                outputs: [],
-                diagnostics: [
-                    `pin is malformed: ${malformed[1].status === 'malformed'
-                        ? malformed[1].reason
-                        : 'invalid pin index'}`,
-                ],
-            };
-        }
-    }
     const definitions = [
         ...new Set([
             ...chainDefinitions(pipeline),
@@ -586,7 +650,7 @@ async function executeSteps(steps, pipeline, deps, opts = {}) {
         const stepDeclared = declaredByStep[index];
         const identity = state === undefined
             ? null
-            : await stepIdentity(step, state, index, stepDeclared.complete ? stepDeclared.paths : null);
+            : await stepIdentity(step, state, index, stepDeclared.complete ? stepDeclared : null);
         const mode = state === undefined
             ? { mode: 'ordinary' }
             : await selectStepMode(step, index, target, identity, state);
@@ -598,7 +662,7 @@ async function executeSteps(steps, pipeline, deps, opts = {}) {
             }
             let reasons;
             try {
-                reasons = await reusePinFailure(step.pinKey, pipeline.dir, pinFile);
+                reasons = await reusePinFailure(step, pipeline.dir, pinFile);
             }
             catch (error) {
                 reasons = [messageOf(error)];
@@ -627,7 +691,7 @@ async function executeSteps(steps, pipeline, deps, opts = {}) {
             });
             continue;
         }
-        // In-run progress (DR-019, CLI-32): announce the phase, then report its
+        // In-run progress (DR-019, cli-32): announce the phase, then report its
         // outcome with the elapsed time.
         const startedAt = Date.now();
         deps.progress?.({ kind: 'phase-start', phase: step.phase, target });
@@ -638,14 +702,15 @@ async function executeSteps(steps, pipeline, deps, opts = {}) {
             elapsedMs: Date.now() - startedAt,
         });
         // Selecting a compiled executor can throw rather than return a verdict —
-        // notably an unmapped pinned Playbook provenance, which the host factory
-        // rejects (PHEXEC-30). That is the same fail-closed family as a stale pin,
+        // notably a pinned link target whose installed engine declares no
+        // supported contract, which the host factory rejects (phase-execution-30).
+        // That is the same fail-closed family as a stale pin,
         // so it is reported through the phase-failure path; letting it unwind
         // would strand the phase-start line with no terminal event and drop the
-        // phase and target from the report (CLI-4, CLI-32, PHEXEC-27).
+        // phase and target from the report (cli-4, cli-32, phase-execution-27).
         let selection;
         try {
-            selection = await selectExecutor(step.phase, step.pinKey, pipeline.dir, pinFile, deps);
+            selection = await selectExecutor(step, pipeline.dir, pinFile, deps);
         }
         catch (error) {
             selection = { kind: 'fail', reasons: [messageOf(error)] };
@@ -695,30 +760,35 @@ async function executeSteps(steps, pipeline, deps, opts = {}) {
             return { ok: false, outputs, diagnostics };
         }
         diagnostics.push(...result.diagnostics);
-        // A linked module that cannot resolve its own relative imports cannot
-        // load under `playbook run`; fail the link rather than report success
-        // for a dead artifact (VERIFY-18).
+        // Settle an agent-chosen `.js`/`.ts` link-object edge from the sibling that
+        // currently exists (pipeline-40), then keep rejecting every genuinely
+        // unresolved import (verification-18).
         if (step.phase === 'link' &&
             (step.targetExt === '.ts' || step.targetExt === '.js')) {
             let missing;
             try {
-                missing = await unresolvableRelativeImports(step.request.kind === 'link' ? step.request.linked : target);
+                const linked = step.request.kind === 'link' ? step.request.linked : target;
+                const rewrites = await reconcileLinkObjectImportSpecifiers(linked, step.request.kind === 'link' ? step.request.objects : []);
+                diagnostics.push(...rewrites.map(({ from, to }) => `linked module ${linked} reconciled link-object import ` +
+                    `${JSON.stringify(from)} to ${JSON.stringify(to)} (pipeline-40)`));
+                missing = await unresolvableRelativeImports(linked);
             }
             catch (error) {
-                // A target that cannot even be read is a dead artifact too — a
-                // directory at the linked path passes the DR-003 existence and
-                // extension checks and then fails the read. Fail the link here so
-                // every started phase still reaches a terminal event (CLI-32).
+                // A target that cannot be reconciled and checked is a dead artifact
+                // too. Fail the link here so every started phase still reaches a
+                // terminal event (cli-32).
                 fail();
-                diagnostics.push(`linked module ${target} could not be read: ${messageOf(error)} — ` +
-                    'an emitted module that cannot load fails the link (VERIFY-18)');
+                diagnostics.push(`linked module ${target} could not be settled and checked: ` +
+                    `${messageOf(error)} — ` +
+                    'post-link completion and load integrity are mandatory ' +
+                    '(pipeline-40, verification-18)');
                 return { ok: false, outputs, diagnostics };
             }
             if (missing.length > 0) {
                 fail();
                 diagnostics.push(`linked module ${target} has unresolvable relative imports: ` +
                     `${missing.join(', ')} — an emitted module that cannot load ` +
-                    'fails the link (VERIFY-18)');
+                    'fails the link (verification-18)');
                 return { ok: false, outputs, diagnostics };
             }
         }
@@ -758,7 +828,7 @@ async function executeSteps(steps, pipeline, deps, opts = {}) {
             ? { outcome: 'up-to-date' }
             : {}),
     };
-    const completed = await complete(selected, guardCompletionTarget);
+    const completed = await complete(selected, guardCompletionTarget, pinFile);
     return state === undefined
         ? completed
         : publishIncremental(completed, state, steps);
@@ -832,7 +902,8 @@ async function stepIdentity(step, state, index, declared) {
                 inputs: [
                     hashBytes(chainedInput),
                     ...rootHashes,
-                    ...(await Promise.all(declared.map(async (path) => hashBytes(await readFile(path))))),
+                    ...declared.declarationHashes,
+                    ...(await Promise.all(declared.paths.map(async (path) => hashBytes(await readFile(path))))),
                 ],
             };
         }
@@ -842,7 +913,8 @@ async function stepIdentity(step, state, index, declared) {
             inputs.push(framedHash('object', encodeLocator(state.artDir, path), hashBytes(await readFile(path))));
         }
         inputs.push(hashBytes(await readFile(step.request.definitionPath)));
-        inputs.push(...(await Promise.all(declared.map(async (path) => hashBytes(await readFile(path))))));
+        inputs.push(...declared.declarationHashes);
+        inputs.push(...(await Promise.all(declared.paths.map(async (path) => hashBytes(await readFile(path))))));
         const linkTarget = resolve(step.request.linkTarget);
         const targetInfo = await stat(linkTarget);
         let targetKind;
@@ -872,36 +944,73 @@ async function stepIdentity(step, state, index, declared) {
     }
 }
 async function stepDeclaredInputs(step, pipeline, pinFile) {
-    const roots = step.request.kind === 'compile'
-        ? [step.request.definitionPath, ...(step.request.references ?? [])]
-        : [step.request.definitionPath];
+    const roots = [
+        { path: step.request.definitionPath, phase: step.pinKey },
+    ];
+    if (step.request.kind === 'compile') {
+        for (const reference of step.request.references ?? []) {
+            roots.push({ path: reference });
+        }
+    }
     return declaredInputPaths(pipeline, pinFile, roots);
 }
 /** Current local semantic-input closure for definitions and references. */
 async function declaredInputPaths(pipeline, pinFile, roots) {
     const boundary = pinFile?.pathBoundary.path ?? '.';
-    const base = new Set(roots.map((path) => resolve(path)));
+    const base = new Set(roots.map((root) => resolve(root.path)));
     const seen = new Set(base);
     const inputs = [];
+    const declarationHashes = [];
     let complete = true;
     const normalize = resolve(normalizeDefinitionPath());
     for (const root of roots) {
-        const absolute = resolve(root);
+        const absolute = resolve(root.path);
         if (!absolute.toLowerCase().endsWith('.md') || absolute === normalize) {
             continue;
         }
         const locator = relative(pipeline.dir, absolute).split(sep).join('/');
-        const closure = new Set();
+        let closure;
         try {
-            await deriveClosure(pipeline.dir, boundary, locator, (path) => closure.add(path));
+            closure = await inspectClosureWithDeclaration(pipeline.dir, boundary, locator, root.phase);
         }
         catch {
-            // This derivation exists only for incremental identity and best-effort
-            // target protection. Pin generation/currency remain fail-closed, while an
-            // otherwise interpretable phase degrades to Ordinary execution.
+            // An unexpected inspection failure still degrades runner-only identity
+            // to Ordinary execution; structured PinError outcomes retain safe paths.
             complete = false;
+            continue;
         }
-        for (const path of closure) {
+        if (!closure.complete) {
+            // An incomplete closure is unusable for identity, but every independently
+            // resolved in-boundary member remains protected from output aliasing.
+            complete = false;
+            for (const path of closure.paths) {
+                const absolutePath = resolve(path);
+                if (seen.has(absolutePath))
+                    continue;
+                seen.add(absolutePath);
+                inputs.push(absolutePath);
+            }
+            continue;
+        }
+        if (closure.declaration === 'sidecar' && root.phase !== undefined) {
+            const members = [...closure.paths]
+                .map((path) => resolve(path))
+                .filter((path) => path !== absolute)
+                .map((path) => ({
+                path,
+                locator: relative(pipeline.dir, path).split(sep).join('/'),
+            }))
+                .sort((left, right) => compareUtf8(left.locator, right.locator));
+            declarationHashes.push(framedHash('sidecar-closure-v1', root.phase, ...members.map((member) => member.locator)));
+            for (const member of members) {
+                if (seen.has(member.path))
+                    continue;
+                seen.add(member.path);
+                inputs.push(member.path);
+            }
+            continue;
+        }
+        for (const path of closure.paths) {
             const absolutePath = resolve(path);
             if (seen.has(absolutePath))
                 continue;
@@ -909,7 +1018,7 @@ async function declaredInputPaths(pipeline, pinFile, roots) {
             inputs.push(absolutePath);
         }
     }
-    return { paths: inputs, complete };
+    return { paths: inputs, declarationHashes, complete };
 }
 async function selectStepMode(step, index, target, identity, state) {
     if (state.rebuild || state.history === null || identity === null) {
@@ -960,15 +1069,33 @@ function sameHashes(left, right) {
     return (left.length === right.length &&
         left.every((hash, index) => hash === right[index]));
 }
-async function reusePinFailure(pinKey, pipelineDir, pinFile) {
-    const record = ownPin(pinFile, pinKey);
-    if (pinFile === undefined || pinKey === undefined || record === undefined) {
+async function reusePinFailure(step, pipelineDir, pinFile) {
+    const record = ownPin(pinFile, step.pinKey);
+    if (pinFile === undefined ||
+        step.pinKey === undefined ||
+        record === undefined) {
         return null;
     }
-    const verdict = await evaluatePin(pipelineDir, pinFile, pinKey, record);
-    return verdict.status === 'current'
-        ? null
-        : [`pin is ${verdict.status}: ${verdict.reason}`];
+    const verdict = await evaluatePin(pipelineDir, pinFile, step.pinKey, record);
+    if (verdict.status !== 'current') {
+        return [`pin is ${verdict.status}: ${verdict.reason}`];
+    }
+    const definitionIssue = await currentPinDefinitionIssue(step, pipelineDir, pinFile, record);
+    return definitionIssue === null ? null : [definitionIssue];
+}
+/**
+ * Keeps external-definition pinning dormant until pipeline discovery selects
+ * the same physical definition (phase-execution-27; DR-026).
+ */
+async function currentPinDefinitionIssue(step, pipelineDir, pinFile, record) {
+    const recorded = resolvePinPath(pipelineDir, pinFile.pathBoundary.path, record.definition.path, 'definition');
+    const selected = resolve(step.request.definitionPath);
+    if (await pathsAlias(recorded, selected))
+        return null;
+    const selectedLocator = relative(pipelineDir, selected).split(sep).join('/');
+    return (`pin-recorded definition "${record.definition.path}" does not match ` +
+        `selected pipeline definition "${selectedLocator}"; ` +
+        'external-definition execution remains disabled until pipeline resolution selects the same physical definition');
 }
 /**
  * Removes any complete snapshot that could otherwise bless this target after
@@ -1051,29 +1178,39 @@ function historyDiagnostic(result, reason) {
     };
 }
 /**
- * Selects a phase's execution strategy from the pin index (PHEXEC-27; DR-005,
+ * Selects a phase's execution strategy from the pin index (phase-execution-27; DR-005,
  * DR-007): a phase with no pin interprets, a current pin runs its compiled
  * artifact, and a stale or malformed pin fails closed and is never silently
  * interpreted.
  */
-async function selectExecutor(phase, pinKey, pipelineDir, pinFile, deps) {
-    const record = ownPin(pinFile, pinKey);
-    if (pinFile === undefined || pinKey === undefined || record === undefined) {
+async function selectExecutor(step, pipelineDir, pinFile, deps) {
+    const record = ownPin(pinFile, step.pinKey);
+    if (pinFile === undefined ||
+        step.pinKey === undefined ||
+        record === undefined) {
         return { kind: 'run', executor: deps.executor };
     }
-    const verdict = await evaluatePin(pipelineDir, pinFile, pinKey, record);
+    const verdict = await evaluatePin(pipelineDir, pinFile, step.pinKey, record);
     if (verdict.status === 'current') {
+        const definitionIssue = await currentPinDefinitionIssue(step, pipelineDir, pinFile, record);
+        if (definitionIssue !== null) {
+            return { kind: 'fail', reasons: [definitionIssue] };
+        }
         if (deps.compiled === undefined) {
             return {
                 kind: 'fail',
                 reasons: [
-                    `phase "${phase}" is pinned to a compiled artifact, but this host has no compiled executor configured`,
+                    `phase "${step.phase}" is pinned to a compiled artifact, but this host has no compiled executor configured`,
                 ],
             };
         }
         return {
             kind: 'run',
-            executor: deps.compiled({ phase: pinKey, pipelineDir, record }),
+            executor: await deps.compiled({
+                phase: step.pinKey,
+                pipelineDir,
+                record,
+            }),
         };
     }
     return {
@@ -1103,7 +1240,7 @@ async function requireLink(pipeline, reference) {
         throw new Error(`pipeline "${reference}" has no link phase`);
     }
     // `loadLinkFile` relaxes the ## Link Targets requirement intrinsically for
-    // Playbook's `playbook` linked format (DR-002, DR-009, PIPE-11), so the
+    // Playbook's `playbook` linked format (DR-002, DR-009, pipeline-11), so the
     // requirement does not depend on how the pipeline reference resolved.
     return loadLinkFile(pipeline.linkFile);
 }