@wichayutdew/pi-workflows 1.0.1 → 2.0.0

package/src/integrations/subagents/child-runtime-policy.ts

@@ -18,6 +18,7 @@ export const childPolicyStep = (policy: ChildStepPolicy): WorkflowStep => ({
   permissions: policy.permissions,
   requires: { tools: [], extensions: [], skills: [] },
   transitions: {},
+  ...(policy.workspace ? { workspace: policy.workspace } : {}),
 });
 
 /**
@@ -25,7 +26,6 @@ export const childPolicyStep = (policy: ChildStepPolicy): WorkflowStep => ({
  * policy.
  */
 export const childSystemPrompt = (policy: ChildStepPolicy): string => {
-  const hasPauseOutcome = policy.pauseOutcomes.length > 0;
   return [
     '# Pi Workflows delegated step',
     '',
@@ -36,7 +36,7 @@ export const childSystemPrompt = (policy: ChildStepPolicy): string => {
     'The parent workflow harness owns orchestration and state transitions.',
     'Perform only this delegated step. Its child-side tool policy is enforced.',
     'When finished, call `structured_output` exactly once and as the only tool call in that message.',
-    'Pass the workflow result as its `value`: outcome, summary, and optional artifact.',
+    'Pass the workflow result as its `value`: outcome, summary, optional artifact, and workspace only when required below.',
     `Valid outcomes: ${policy.outcomes.join(', ')}`,
     `Pause outcomes: ${policy.pauseOutcomes.join(', ') || '(none)'}`,
     `Summary limit: ${policy.summaryMaxChars} characters`,
@@ -45,39 +45,14 @@ export const childSystemPrompt = (policy: ChildStepPolicy): string => {
           `Outcome "${policy.gateSubmitOutcome}" requires the complete gate artifact.`,
         ]
       : []),
-    ...(hasPauseOutcome
+    ...(policy.workspace
       ? [
-          `If the workflow definition or environment is wrong, choose a pause outcome (${policy.pauseOutcomes.join(', ')}).`,
+          `Workspace-binding outcomes: ${policy.workspace.bindOn.join(', ')}`,
+          `For those outcomes, include workspace.cwd as an absolute directory under one allowed root relative to the run-start directory: ${policy.workspace.allowedRoots.join(', ')}`,
+          'For every other outcome, omit workspace.',
         ]
-      : [
-          'If the workflow definition or environment is wrong, do not fabricate success or call the completion tool; end with a concise declarative error so the parent pauses the step.',
-        ]),
+      : ['This step cannot bind a workspace; omit workspace.']),
     'This is a non-interactive workflow child. Never call contact_supervisor, subagent_supervisor, or intercom.',
-    ...(policy.gateSubmitOutcome
-      ? [
-          'Put every unresolved decision in the gate artifact with evidence, options, a recommendation, and an adopted default; do not ask a terminal question.',
-        ]
-      : hasPauseOutcome
-        ? [
-            'Treat the step instructions and incoming handoff as the final execution contract.',
-            'If that contract is missing, stale, or contradictory, finish with a pause outcome and describe the unresolved contract and evidence declaratively in the summary; do not ask a terminal question.',
-          ]
-        : [
-            'Treat the step instructions and incoming handoff as the final execution contract.',
-            'If that contract is missing, stale, or contradictory, do not fabricate success or call the completion tool; end with a concise declarative error so the parent pauses the step. Do not ask a terminal question.',
-          ]),
-    ...(policy.repositoryCwd
-      ? [
-          `Reviewed repository root: ${policy.repositoryCwd}`,
-          ...(policy.bootstrapCwd
-            ? [
-                `Bootstrap directory: ${policy.bootstrapCwd}`,
-                'The reviewed repository root does not exist yet. Run only its exact approved setup command first, then use absolute paths under the reviewed repository root for every edit and write. Never mutate the bootstrap directory.',
-              ]
-            : [
-                'Keep every edit and write inside the reviewed repository root.',
-              ]),
-        ]
-      : []),
+    'Follow the supplied step instructions when choosing one valid outcome; outcome names have no built-in domain meaning.',
   ].join('\n');
 };

package/src/integrations/subagents/child-runtime.ts

@@ -13,8 +13,8 @@ import {
 } from './child-runtime-completion.ts';
 import { DEFAULT_CHILD_RUNTIME_DEPENDENCIES } from './child-runtime-dependencies.ts';
 import {
-  repositoryMutationError,
   verifyChildCapability,
+  verifyChildWorkingDirectory,
   writeChildResult,
 } from './child-runtime-files.ts';
 import { childPolicyStep, childSystemPrompt } from './child-runtime-policy.ts';
@@ -109,6 +109,7 @@ export const registerSubagentChildRuntime = (
           'child agent does not match the delegated workflow policy',
         );
       }
+      verifyChildWorkingDirectory(extracted.policy, dependencies);
       verifyChildCapability({
         policy: extracted.policy,
         childAgent,
@@ -221,7 +222,7 @@ export const registerSubagentChildRuntime = (
       return {
         block: true,
         reason:
-          'workflow children are non-interactive; use structured_output with a pause outcome and describe the unresolved contract in summary',
+          'workflow children are non-interactive; follow the step prompt and use structured_output with one configured valid outcome',
       };
     }
 
@@ -231,7 +232,6 @@ export const registerSubagentChildRuntime = (
       input,
       childPolicyStep(activePolicy),
       pi.getAllTools(),
-      activePolicy.approvedBashCommands ?? [],
     );
     if (!authorization.allowed) {
       return {
@@ -246,18 +246,6 @@ export const registerSubagentChildRuntime = (
       };
     }
 
-    const mutationError = repositoryMutationError({
-      toolName: event.toolName,
-      input,
-      policy: activePolicy,
-      dependencies,
-    });
-    if (mutationError) {
-      return {
-        block: true,
-        reason: mutationError,
-      };
-    }
     freezeToolInput(event.input);
   });
 };

package/src/integrations/subagents/delegated-result.ts

@@ -21,6 +21,7 @@ export const parseDelegatedStepResult = (
       ...(policy.gateSubmitOutcome
         ? { gateSubmitOutcome: policy.gateSubmitOutcome }
         : {}),
+      ...(policy.workspace ? { workspace: policy.workspace } : {}),
     });
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);

package/src/integrations/subagents/diagnostic-format.ts

@@ -26,6 +26,11 @@ export const formatToolFailureDiagnostic = (
           `${hasSuccessfulOutputCorrelation ? 'Successful tool output' : 'Tool error'}: ${diagnostic.output}`,
         ]
       : []),
+    ...(diagnostic.postCompletionWarning
+      ? [
+          `Post-completion watchdog warning: ${diagnostic.postCompletionWarning}`,
+        ]
+      : []),
     ...(diagnostic.correlation === 'latest-before-completion'
       ? [
           'Correlation: latest failed tool call before successful structured_output; terminal text did not identify the call',

package/src/integrations/subagents/diagnostic-types.ts

@@ -4,6 +4,7 @@ export type ToolFailureDiagnostic = {
   readonly tool: string;
   readonly call?: string;
   readonly output?: string;
+  readonly postCompletionWarning?: string;
   readonly replaySafe?: true;
   readonly completionAfterFailure?: true;
   readonly completionValue?: Readonly<Record<string, unknown>>;
@@ -21,7 +22,6 @@ export type DelegationReplayAudit = {
 export type DelegationReplayExpectation = {
   readonly task: string;
   readonly bashPermission: BashPermission;
-  readonly approvedBashCommands: ReadonlyArray<string>;
 };
 
 export type SubagentSessionIdentity = {
@@ -55,6 +55,11 @@ export type RecordedCompletion = {
   readonly value: Readonly<Record<string, unknown>>;
 };
 
+export type RecordedTranscriptWarning = {
+  readonly order: number;
+  readonly content: string;
+};
+
 export type RecordedMessage = {
   readonly order: number;
   readonly value: Readonly<Record<string, unknown>>;
@@ -65,6 +70,7 @@ export type ParsedFailureTranscript = {
   readonly diagnostics: ReadonlyArray<RecordedToolFailure>;
   readonly successfulResults: ReadonlyArray<RecordedToolSuccess>;
   readonly successfulCompletions: ReadonlyArray<RecordedCompletion>;
+  readonly transcriptWarnings: ReadonlyArray<RecordedTranscriptWarning>;
   readonly recordedMessages: ReadonlyArray<RecordedMessage>;
   readonly resultCallIds: ReadonlySet<string>;
   readonly hasValidFalsePositiveProof: boolean;

package/src/integrations/subagents/diagnostics.ts

@@ -11,11 +11,13 @@ export type {
 export { parseToolFailureDiagnostic } from './failure-correlation.ts';
 export { parseDelegationReplayAudit } from './replay-audit.ts';
 export {
+  auditCompletedDelegationTranscript,
   deriveSubagentSessionRoot,
   readDelegationReplayAudit,
   readToolFailureDiagnostic,
 } from './session-diagnostics.ts';
 export type {
+  CompletedDelegationTranscriptAudit,
   SubagentDiagnosticDependencies,
   SubagentDiagnosticFileHandle,
   SubagentDiagnosticFileSnapshot,

package/src/integrations/subagents/failure-correlation.ts

@@ -3,6 +3,7 @@ import type {
   RecordedCompletion,
   RecordedToolCall,
   RecordedToolFailure,
+  RecordedTranscriptWarning,
   ToolFailureDiagnostic,
 } from './diagnostic-types.ts';
 import { parseFailureTranscript } from './failure-transcript.ts';
@@ -40,6 +41,17 @@ const latestMatching = (
   return undefined;
 };
 
+const latestWarningAfter = (
+  warnings: ReadonlyArray<RecordedTranscriptWarning>,
+  order: number,
+): RecordedTranscriptWarning | undefined => {
+  for (let index = warnings.length - 1; index >= 0; index -= 1) {
+    const warning = warnings[index];
+    if (warning && warning.order > order) return warning;
+  }
+  return undefined;
+};
+
 const finalCompletion = (
   completions: ReadonlyArray<RecordedCompletion>,
   latestFailureOrder: number,
@@ -60,6 +72,7 @@ const publicDiagnostic = (
   diagnostics: ReadonlyArray<RecordedToolFailure>,
   recordedCalls: ReadonlyArray<RecordedToolCall>,
   successfulCompletions: ReadonlyArray<RecordedCompletion>,
+  postCompletionWarning: RecordedTranscriptWarning | undefined,
   lastInteractionOrder: number,
   allowCompletionProof: boolean,
   correlation?: ToolFailureDiagnostic['correlation'],
@@ -78,6 +91,9 @@ const publicDiagnostic = (
   );
   return {
     ...result,
+    ...(postCompletionWarning
+      ? { postCompletionWarning: postCompletionWarning.content }
+      : {}),
     ...(isFailureTranscriptReplaySafe({
       calls: recordedCalls,
       diagnostics,
@@ -110,17 +126,30 @@ const hiddenFalsePositiveDiagnostic = (
     resultCallIds,
     successfulCompletions,
     successfulResults,
+    transcriptWarnings,
   } = transcript;
-  if (diagnostics.length > 0) return undefined;
+  const completionOrder = successfulCompletions.at(-1)?.order ?? 0;
+  const postCompletionWarning = latestWarningAfter(
+    transcriptWarnings,
+    completionOrder,
+  );
 
   const falsePositive = reproduceHiddenBashFalsePositive(
     recordedMessages,
     successfulResults,
   );
+  const hasLaterFailure =
+    falsePositive !== undefined &&
+    diagnostics.some(
+      (diagnostic) => diagnostic.order > falsePositive.result.order,
+    );
   const completion = falsePositive
     ? finalCompletion(
         successfulCompletions,
-        falsePositive.result.order,
+        Math.max(
+          falsePositive.result.order,
+          diagnostics.at(-1)?.order ?? falsePositive.result.order,
+        ),
         lastInteractionOrder,
         allowCompletionProof,
       )
@@ -133,6 +162,8 @@ const hiddenFalsePositiveDiagnostic = (
       1 ||
     expectedTool?.toLowerCase() !== 'bash' ||
     !falsePositive ||
+    hasLaterFailure ||
+    postCompletionWarning !== undefined ||
     terminalError !== falsePositive.terminalError ||
     !completion
   ) {
@@ -170,7 +201,13 @@ export const parseToolFailureDiagnostic = (
     lastInteractionOrder,
     recordedCalls,
     successfulCompletions,
+    transcriptWarnings,
   } = parsed;
+  const completionOrder = successfulCompletions.at(-1)?.order ?? 0;
+  const postCompletionWarning = latestWarningAfter(
+    transcriptWarnings,
+    completionOrder,
+  );
   const matchesExpectedTool = (
     diagnostic: Pick<RecordedToolFailure, 'tool'>,
   ): boolean =>
@@ -203,6 +240,7 @@ export const parseToolFailureDiagnostic = (
           diagnostics,
           recordedCalls,
           successfulCompletions,
+          postCompletionWarning,
           lastInteractionOrder,
           allowCompletionProof,
           'latest-before-completion',
@@ -222,12 +260,24 @@ export const parseToolFailureDiagnostic = (
     selected = latestMatching(diagnostics, matchesExpectedTool);
   }
 
+  if (!selected && postCompletionWarning) {
+    selected =
+      latestMatching(diagnostics, matchesExpectedTool) ?? diagnostics.at(-1);
+    if (!selected) {
+      return {
+        tool: expectedTool ?? 'subagent',
+        postCompletionWarning: postCompletionWarning.content,
+      };
+    }
+  }
+
   return selected
     ? publicDiagnostic(
         selected,
         diagnostics,
         recordedCalls,
         successfulCompletions,
+        postCompletionWarning,
         lastInteractionOrder,
         allowCompletionProof,
       )

package/src/integrations/subagents/failure-transcript.ts

@@ -12,8 +12,55 @@ import type {
   RecordedToolCall,
   RecordedToolFailure,
   RecordedToolSuccess,
+  RecordedTranscriptWarning,
 } from './diagnostic-types.ts';
 
+const WATCHDOG_WARNING_TYPE = 'subagent_watchdog_warning';
+const MAX_WARNING_FIELD_CHARS = 600;
+
+const boundedWarningField = (value: string): string => {
+  const normalized = value.trim().replaceAll(/\s+/g, ' ');
+  return normalized.length <= MAX_WARNING_FIELD_CHARS
+    ? normalized
+    : `${normalized.slice(0, MAX_WARNING_FIELD_CHARS - 1)}…`;
+};
+
+const transcriptWarningContent = (
+  entry: Readonly<Record<string, unknown>>,
+): string | undefined => {
+  if (
+    entry.type !== 'custom_message' ||
+    entry.customType !== WATCHDOG_WARNING_TYPE
+  ) {
+    return undefined;
+  }
+  const details = entry.details;
+  if (isDiagnosticRecord(details)) {
+    const fields = [
+      typeof details.summary === 'string' ? details.summary : undefined,
+      typeof details.evidence === 'string' ? details.evidence : undefined,
+      typeof details.recommendedAction === 'string'
+        ? `Recommended action: ${details.recommendedAction}`
+        : undefined,
+    ].filter((field): field is string => Boolean(field?.trim()));
+    if (fields.length > 0) return boundedWarningField(fields.join(' '));
+  }
+  return typeof entry.content === 'string' && entry.content.trim()
+    ? boundedWarningField(entry.content)
+    : 'The child emitted an unresolved watchdog warning after completion.';
+};
+
+const isBenignTerminalAssistant = (
+  message: Readonly<Record<string, unknown>>,
+): boolean =>
+  message.stopReason === 'stop' &&
+  message.errorMessage === undefined &&
+  Array.isArray(message.content) &&
+  message.content.length === 1 &&
+  isDiagnosticRecord(message.content[0]) &&
+  message.content[0].type === 'text' &&
+  message.content[0].text === '';
+
 /**
  * Parses the tool calls, results, completions, and structural evidence needed
  * to correlate a terminal failure.
@@ -26,6 +73,7 @@ export const parseFailureTranscript = (
   const diagnostics: Array<RecordedToolFailure> = [];
   const successfulResults: Array<RecordedToolSuccess> = [];
   const successfulCompletions: Array<RecordedCompletion> = [];
+  const transcriptWarnings: Array<RecordedTranscriptWarning> = [];
   const recordedMessages: Array<RecordedMessage> = [];
   const resultCallIds = new Set<string>();
   let hasValidFalsePositiveProof = true;
@@ -43,6 +91,14 @@ export const parseFailureTranscript = (
       hasValidFalsePositiveProof = false;
       continue;
     }
+    if (isDiagnosticRecord(entry)) {
+      const warning = transcriptWarningContent(entry);
+      if (warning) {
+        transcriptWarnings.push({ order, content: warning });
+        lastInteractionOrder = order;
+        continue;
+      }
+    }
     if (!isDiagnosticRecord(entry) || entry.type !== 'message') continue;
     const message = entry.message;
     if (!isDiagnosticRecord(message)) {
@@ -65,7 +121,9 @@ export const parseFailureTranscript = (
         hasValidFalsePositiveProof = false;
         continue;
       }
-      lastInteractionOrder = order;
+      if (!isBenignTerminalAssistant(message)) {
+        lastInteractionOrder = order;
+      }
       const toolCalls = message.content.filter(
         (item): item is Record<string, unknown> =>
           isDiagnosticRecord(item) &&
@@ -184,6 +242,7 @@ export const parseFailureTranscript = (
     diagnostics,
     successfulResults,
     successfulCompletions,
+    transcriptWarnings,
     recordedMessages,
     resultCallIds,
     hasValidFalsePositiveProof,

package/src/integrations/subagents/replay-audit.ts

@@ -139,7 +139,6 @@ export const parseDelegationReplayAudit = (
           call,
           diagnostics,
           bashPermission: expectation.bashPermission,
-          approvedBashCommands: expectation.approvedBashCommands,
         }),
       ),
     toolCount: recordedCalls.length,

package/src/integrations/subagents/replay-safety.ts

@@ -12,25 +12,16 @@ const REPLAY_SAFE_TOOLS: ReadonlySet<string> = new Set([
   'read',
   'structured_output',
 ]);
-const PRE_EXECUTION_BASH_FAILURES = [
-  'command does not match this step',
-  'environment assignments are not allowed',
-  'not enabled by subagent',
-  'shell operators, substitutions, expansions, and comments are not allowed',
-  'shell wrapper',
-  'substitutions and escapes are not allowed inside double quotes',
-  'trailing bash escape is not allowed',
-  'unterminated bash quote',
-  'unquoted pathname and tilde expansion are not allowed',
-] as const;
 
-const isPreExecutionBashFailure = (output: string | undefined): boolean => {
-  if (!output) return false;
-  const normalizedOutput = output.toLowerCase();
-  return PRE_EXECUTION_BASH_FAILURES.some((fragment) =>
-    normalizedOutput.includes(fragment),
+const isPreExecutionBashFailure = (
+  output: string | undefined,
+  rejectionReason: string | undefined,
+): boolean =>
+  Boolean(
+    output &&
+    rejectionReason &&
+    output.toLowerCase().includes(rejectionReason.toLowerCase()),
   );
-};
 
 /**
  * Returns whether replaying a recorded call cannot repeat a mutation.
@@ -39,29 +30,23 @@ export const isReplaySafeToolCall = ({
   call,
   diagnostics,
   bashPermission,
-  approvedBashCommands = [],
 }: {
   readonly call: RecordedToolCall;
   readonly diagnostics: ReadonlyArray<RecordedToolFailure>;
   readonly bashPermission?: BashPermission;
-  readonly approvedBashCommands?: ReadonlyArray<string>;
 }): boolean => {
   const tool = call.tool.toLowerCase();
   if (REPLAY_SAFE_TOOLS.has(tool)) return true;
   if (tool !== 'bash' || !call.call) return false;
-  if (authorizeBash(call.call, { mode: 'read-only', allow: [] }).allowed) {
-    return true;
-  }
-  if (
-    !bashPermission ||
-    authorizeBash(call.call, bashPermission, approvedBashCommands).allowed
-  ) {
+  if (!bashPermission) {
     return false;
   }
+  const authorization = authorizeBash(call.call, bashPermission);
+  if (authorization.allowed) return false;
   const failure = diagnostics.find(
     (diagnostic) => diagnostic.callId === call.id,
   );
-  return isPreExecutionBashFailure(failure?.output);
+  return isPreExecutionBashFailure(failure?.output, authorization.reason);
 };
 
 /**

package/src/integrations/subagents/session-diagnostics.ts

@@ -16,6 +16,7 @@ import type {
   SubagentSessionIdentity,
   ToolFailureDiagnostic,
 } from './diagnostic-types.ts';
+import { parseFailureTranscript } from './failure-transcript.ts';
 import { parseToolFailureDiagnostic } from './failure-correlation.ts';
 import { parseDelegationReplayAudit } from './replay-audit.ts';
 
@@ -25,6 +26,7 @@ const SESSION_FILE_SUFFIX = '.jsonl';
 const MAX_SESSION_TAIL_BYTES = 1024 * 1024;
 
 export type SubagentDiagnosticPathInspection = {
+  readonly isDirectory: () => boolean;
   readonly isFile: () => boolean;
   readonly isSymbolicLink: () => boolean;
 };
@@ -60,6 +62,16 @@ export type SubagentDiagnosticDependencies = {
   readonly fileSystem: SubagentDiagnosticFileSystem;
 };
 
+export type CompletedDelegationTranscriptAudit =
+  | {
+      readonly verified: true;
+      readonly warning?: string;
+    }
+  | {
+      readonly verified: false;
+      readonly reason: string;
+    };
+
 const DEFAULT_DIAGNOSTIC_DEPENDENCIES = {
   fileSystem: {
     inspect: lstat,
@@ -152,15 +164,41 @@ const readContainedSessionTail = async ({
     return undefined;
   }
 
+  const runDirectory = resolve(trustedRoot, identity.runId);
+  const childDirectory = resolve(runDirectory, `run-${identity.childIndex}`);
   const resolvedSessionFile = resolve(sessionFile);
-  const inspected = await dependencies.fileSystem.inspect(resolvedSessionFile);
-  if (inspected.isSymbolicLink() || !inspected.isFile()) return undefined;
+  const [runDirectoryInfo, childDirectoryInfo, inspected] = await Promise.all([
+    dependencies.fileSystem.inspect(runDirectory),
+    dependencies.fileSystem.inspect(childDirectory),
+    dependencies.fileSystem.inspect(resolvedSessionFile),
+  ]);
+  if (
+    runDirectoryInfo.isSymbolicLink() ||
+    !runDirectoryInfo.isDirectory() ||
+    childDirectoryInfo.isSymbolicLink() ||
+    !childDirectoryInfo.isDirectory() ||
+    inspected.isSymbolicLink() ||
+    !inspected.isFile()
+  ) {
+    return undefined;
+  }
 
   const [canonicalRoot, canonicalSessionFile] = await Promise.all([
     dependencies.fileSystem.realPath(trustedRoot),
     dependencies.fileSystem.realPath(resolvedSessionFile),
   ]);
-  if (!pathIsWithin(canonicalRoot, canonicalSessionFile)) return undefined;
+  const canonicalExpectedSessionFile = resolve(
+    canonicalRoot,
+    identity.runId,
+    `run-${identity.childIndex}`,
+    SESSION_FILE_NAME,
+  );
+  if (
+    !pathIsWithin(canonicalRoot, canonicalSessionFile) ||
+    canonicalSessionFile !== canonicalExpectedSessionFile
+  ) {
+    return undefined;
+  }
 
   const handle =
     await dependencies.fileSystem.openReadOnlyNoFollow(canonicalSessionFile);
@@ -229,6 +267,67 @@ export const readToolFailureDiagnostic = async (
   }
 };
 
+/**
+ * Proves that a completed child transcript ends at one successful structured
+ * result and contains no later watchdog blocker.
+ */
+export const auditCompletedDelegationTranscript = async (
+  sessionFile: string | undefined,
+  trustedRoot: string | undefined,
+  identity: SubagentSessionIdentity | undefined,
+  dependencies: SubagentDiagnosticDependencies = DEFAULT_DIAGNOSTIC_DEPENDENCIES,
+): Promise<CompletedDelegationTranscriptAudit> => {
+  if (!sessionFile || !trustedRoot || !identity) {
+    return {
+      verified: false,
+      reason: 'completed response has no trusted child transcript identity',
+    };
+  }
+  try {
+    const tail = await readContainedSessionTail({
+      sessionFile,
+      trustedRoot,
+      identity,
+      dependencies,
+    });
+    if (!tail) {
+      return {
+        verified: false,
+        reason: 'completed child transcript is missing, unstable, or untrusted',
+      };
+    }
+    const parsed = parseFailureTranscript(tail.content);
+    const completion = parsed.successfulCompletions.at(-1);
+    if (!completion) {
+      return {
+        verified: false,
+        reason:
+          'completed child transcript does not contain a successful structured_output result',
+      };
+    }
+    const warning = parsed.transcriptWarnings.find(
+      (candidate) => candidate.order > completion.order,
+    );
+    if (warning) return { verified: true, warning: warning.content };
+    if (
+      !parsed.hasValidFalsePositiveProof ||
+      completion.order !== parsed.lastInteractionOrder
+    ) {
+      return {
+        verified: false,
+        reason:
+          'completed child transcript has malformed or later terminal interactions',
+      };
+    }
+    return { verified: true };
+  } catch {
+    return {
+      verified: false,
+      reason: 'completed child transcript could not be read safely',
+    };
+  }
+};
+
 /**
  * Reads and audits replay safety from a confined child session file.
  *