@wjarka/cezarion 0.14.5-pr466.721 → 0.14.5-pr467.724

package/README.md

@@ -495,7 +495,7 @@ cez worker destroy <worker-id>
 
 Use `cez worker --help` to list operations and flags, or `cez worker <operation> --help` for one operation. Explicit help prints human-readable text and exits successfully without an active delegation session. Commands otherwise return bounded JSON and a nonzero exit on failure or incomplete cleanup. Spawn requires a committed baseline (`parent-head` or an explicit ref) and pins its SHA at acceptance; dirty parent edits are excluded. Optional `--context '<text>'` or `--context-file <UTF-8-file>` supplies selected context, not the parent's conversation. The two flags are mutually exclusive, and combined task/context text is limited to 100,000 characters. The API also accepts up to 32 pinned-baseline file or parent-attachment references, with at most 8 MiB of copied attachments. Inspect reports worker-local input locations. Reuse a request ID only with the same task, baseline, context, backend, model, effort and workflow when retrying a lost response. There are at most 32 accepted creations per parent, counting destroyed workers, and 32 undelivered steering messages per worker.
 
-`--workflow <name>` runs a catalog workflow inside the worker: the built-in `quick-task` or any `.ai/cezar/workflows/*.yaml` by name, with its agent and check steps, `skill:` bodies and `onFail` loops, so a repo's `review.yaml` becomes a dedicated reviewer. Omitted `--workflow` runs `quick-task` exactly as before. `--backend`, `--model` and `--effort` fill only the steps that leave those fields unset; a step's own `allowedTools`/`bashAllowlist` never widen the parent's grants. An unknown name is refused, and every agent step must resolve to one runner because a worker runs under one accepted provider (mixed-runner chains wait for per-step worker identity, #452).
+`--workflow <name>` runs a catalog workflow inside the worker: the built-in `quick-task` or any `.ai/cezar/workflows/*.yaml` by name, with its agent and check steps, `skill:` bodies and `onFail` loops, so a repo's `review.yaml` becomes a dedicated reviewer. Omitted `--workflow` runs `quick-task` exactly as before. `--backend`, `--model` and `--effort` fill only the steps that leave those fields unset; a step's own `allowedTools`/`bashAllowlist` narrow the parent's grants and never widen them. An unknown name is refused. Agent steps may mix runners: at spawn every agent step is resolved and pinned separately, so an implement-with-codex, review-with-claude chain runs each step under its own runner, account, model, effort and grants. A step's optional `agentProfile` names the account it runs under (an id the registry does not know is refused); same-backend steps otherwise inherit the parent's account and other runners resolve their project/default one. Run-level columns show the first agent step.
 
 Omitted `--backend` inherits the parent's active backend. Same-backend workers inherit omitted model/account/effort; `--backend <claude|codex|opencode|pi|cursor>` selecting another backend resolves that backend's project/default account and model without forwarding another provider's settings. `--model <model>` selects a supported model, subject to existing locks. `--effort <low|medium|high|xhigh|max>` pins reasoning effort on same-backend and mixed-backend spawn; omitted `--effort` still inherits the parent pin on same-backend spawn and drops it on mixed-backend spawn. Accepted identity and grants remain fixed across queuing, restart and Continue, including explicit empty grants. Changing or deleting an account registry entry does not rebind a worker. Missing accepted identity evidence or account homes, incompatible Claude state-file layouts, and conflicting later model locks refuse execution explicitly. Credentials and vendor configuration are never copied; each worker receives its own delegation credential, and unspecified native models stay unspecified.
 

package/dist/automations/types.d.ts

@@ -32,6 +32,7 @@ export declare const automationTaskSchema: z.ZodObject<{
             opencode: "opencode";
             pi: "pi";
         }>>;
+        agentProfile: z.ZodOptional<z.ZodString>;
         allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
         command: z.ZodOptional<z.ZodString>;
@@ -95,6 +96,7 @@ export declare const automationDefinitionSchema: z.ZodObject<{
                 opencode: "opencode";
                 pi: "pi";
             }>>;
+            agentProfile: z.ZodOptional<z.ZodString>;
             allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
             bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
             command: z.ZodOptional<z.ZodString>;

package/dist/contract/automations.d.ts

@@ -73,6 +73,7 @@ export declare const automationTaskSchema: z.ZodObject<{
             opencode: "opencode";
             pi: "pi";
         }>>;
+        agentProfile: z.ZodOptional<z.ZodString>;
         allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
         command: z.ZodOptional<z.ZodString>;
@@ -139,6 +140,7 @@ export declare const automationDefinitionSchema: z.ZodObject<{
                 opencode: "opencode";
                 pi: "pi";
             }>>;
+            agentProfile: z.ZodOptional<z.ZodString>;
             allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
             bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
             command: z.ZodOptional<z.ZodString>;
@@ -298,6 +300,7 @@ export declare const automationListEntrySchema: z.ZodObject<{
                 opencode: "opencode";
                 pi: "pi";
             }>>;
+            agentProfile: z.ZodOptional<z.ZodString>;
             allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
             bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
             command: z.ZodOptional<z.ZodString>;
@@ -447,6 +450,7 @@ export declare const automationsResponseSchema: z.ZodObject<{
                     opencode: "opencode";
                     pi: "pi";
                 }>>;
+                agentProfile: z.ZodOptional<z.ZodString>;
                 allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 command: z.ZodOptional<z.ZodString>;
@@ -581,6 +585,7 @@ export declare const automationResponseSchema: z.ZodObject<{
                     opencode: "opencode";
                     pi: "pi";
                 }>>;
+                agentProfile: z.ZodOptional<z.ZodString>;
                 allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 command: z.ZodOptional<z.ZodString>;
@@ -652,6 +657,7 @@ export declare const automationDetailResponseSchema: z.ZodObject<{
                     opencode: "opencode";
                     pi: "pi";
                 }>>;
+                agentProfile: z.ZodOptional<z.ZodString>;
                 allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 command: z.ZodOptional<z.ZodString>;
@@ -859,6 +865,7 @@ export declare const createAutomationInputSchema: z.ZodObject<{
                 opencode: "opencode";
                 pi: "pi";
             }>>;
+            agentProfile: z.ZodOptional<z.ZodString>;
             allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
             bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
             command: z.ZodOptional<z.ZodString>;
@@ -928,6 +935,7 @@ export declare const updateAutomationInputSchema: z.ZodObject<{
                 opencode: "opencode";
                 pi: "pi";
             }>>;
+            agentProfile: z.ZodOptional<z.ZodString>;
             allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
             bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
             command: z.ZodOptional<z.ZodString>;

package/dist/contract/index.js

@@ -736,6 +736,8 @@ var workflowStepDefSchema = z8.object({
   effort: z8.string().max(32).optional(),
   /** Per-step agent backend override (falls back to the task / config default). */
   runner: runnerSchema.optional(),
+  /** Agent account id for this step (spec 2026-07-29-agent-profiles); resolved per step for owned workers (#452). */
+  agentProfile: z8.string().min(1).max(64).optional(),
   allowedTools: z8.array(z8.string()).optional(),
   bashAllowlist: z8.array(z8.string()).optional(),
   // check step

package/dist/contract/runs.d.ts

@@ -686,6 +686,7 @@ export declare const runRecordSchema: z.ZodObject<{
                 opencode: "opencode";
                 pi: "pi";
             }>>;
+            agentProfile: z.ZodOptional<z.ZodString>;
             allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
             bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
             command: z.ZodOptional<z.ZodString>;
@@ -1262,6 +1263,7 @@ export declare const apiRunSchema: z.ZodObject<{
                 opencode: "opencode";
                 pi: "pi";
             }>>;
+            agentProfile: z.ZodOptional<z.ZodString>;
             allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
             bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
             command: z.ZodOptional<z.ZodString>;
@@ -2085,6 +2087,7 @@ export declare const createRunResponseSchema: z.ZodUnion<readonly [z.ZodObject<{
                 opencode: "opencode";
                 pi: "pi";
             }>>;
+            agentProfile: z.ZodOptional<z.ZodString>;
             allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
             bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
             command: z.ZodOptional<z.ZodString>;
@@ -2654,6 +2657,7 @@ export declare const createRunResponseSchema: z.ZodUnion<readonly [z.ZodObject<{
                     opencode: "opencode";
                     pi: "pi";
                 }>>;
+                agentProfile: z.ZodOptional<z.ZodString>;
                 allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 command: z.ZodOptional<z.ZodString>;
@@ -3430,6 +3434,7 @@ export declare const pickVariantResponseSchema: z.ZodObject<{
                     opencode: "opencode";
                     pi: "pi";
                 }>>;
+                agentProfile: z.ZodOptional<z.ZodString>;
                 allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 command: z.ZodOptional<z.ZodString>;
@@ -3526,6 +3531,7 @@ export declare const createRunInputBaseSchema: z.ZodObject<{
             opencode: "opencode";
             pi: "pi";
         }>>;
+        agentProfile: z.ZodOptional<z.ZodString>;
         allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
         command: z.ZodOptional<z.ZodString>;
@@ -3578,6 +3584,7 @@ export declare const createRunInputSchema: z.ZodObject<{
             opencode: "opencode";
             pi: "pi";
         }>>;
+        agentProfile: z.ZodOptional<z.ZodString>;
         allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
         command: z.ZodOptional<z.ZodString>;

package/dist/contract/skills.d.ts

@@ -621,6 +621,7 @@ export declare const startTodoResponseSchema: z.ZodObject<{
                     opencode: "opencode";
                     pi: "pi";
                 }>>;
+                agentProfile: z.ZodOptional<z.ZodString>;
                 allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 command: z.ZodOptional<z.ZodString>;

package/dist/contract/workflows.d.ts

@@ -29,6 +29,7 @@ export declare const workflowStepDefSchema: z.ZodObject<{
         opencode: "opencode";
         pi: "pi";
     }>>;
+    agentProfile: z.ZodOptional<z.ZodString>;
     allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
     bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
     command: z.ZodOptional<z.ZodString>;
@@ -56,6 +57,7 @@ export declare const workflowDefSchema: z.ZodObject<{
             opencode: "opencode";
             pi: "pi";
         }>>;
+        agentProfile: z.ZodOptional<z.ZodString>;
         allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
         command: z.ZodOptional<z.ZodString>;
@@ -98,6 +100,7 @@ export declare const workflowsResponseSchema: z.ZodObject<{
                 opencode: "opencode";
                 pi: "pi";
             }>>;
+            agentProfile: z.ZodOptional<z.ZodString>;
             allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
             bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
             command: z.ZodOptional<z.ZodString>;
@@ -141,6 +144,7 @@ export declare const saveWorkflowInputSchema: z.ZodObject<{
             opencode: "opencode";
             pi: "pi";
         }>>;
+        agentProfile: z.ZodOptional<z.ZodString>;
         allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
         command: z.ZodOptional<z.ZodString>;
@@ -177,6 +181,7 @@ export declare const parsedWorkflowSchema: z.ZodObject<{
             opencode: "opencode";
             pi: "pi";
         }>>;
+        agentProfile: z.ZodOptional<z.ZodString>;
         allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
         command: z.ZodOptional<z.ZodString>;
@@ -219,6 +224,7 @@ export declare const planResponseSchema: z.ZodObject<{
             opencode: "opencode";
             pi: "pi";
         }>>;
+        agentProfile: z.ZodOptional<z.ZodString>;
         allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
         command: z.ZodOptional<z.ZodString>;

package/dist/delegation/execution-identity.d.ts

@@ -21,9 +21,34 @@ export declare const workerAccountBindingSchema: z.ZodObject<{
     }, z.core.$strict>], "kind">>;
 }, z.core.$strict>;
 export type WorkerAccountBinding = z.infer<typeof workerAccountBindingSchema>;
+/** What one agent step of an owned worker may run under: pinned at acceptance, read at every launch. */
+declare const workerStepIdentityFieldsSchema: z.ZodObject<{
+    account: z.ZodObject<{
+        provider: z.ZodEnum<{
+            claude: "claude";
+            codex: "codex";
+            cursor: "cursor";
+            opencode: "opencode";
+            pi: "pi";
+        }>;
+        profileId: z.ZodString;
+        homePath: z.ZodOptional<z.ZodString>;
+        claudeLayout: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"native">;
+            statePath: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"relocated">;
+        }, z.core.$strict>], "kind">>;
+    }, z.core.$strict>;
+    grants: z.ZodObject<{
+        allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+    model: z.ZodOptional<z.ZodString>;
+    effort: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type WorkerStepIdentity = z.infer<typeof workerStepIdentityFieldsSchema>;
 export declare const acceptedWorkerIdentitySchema: z.ZodObject<{
-    kind: z.ZodLiteral<"accepted">;
-    contextHash: z.ZodOptional<z.ZodString>;
     account: z.ZodObject<{
         provider: z.ZodEnum<{
             claude: "claude";
@@ -47,12 +72,40 @@ export declare const acceptedWorkerIdentitySchema: z.ZodObject<{
     }, z.core.$strict>;
     model: z.ZodOptional<z.ZodString>;
     effort: z.ZodOptional<z.ZodString>;
+    kind: z.ZodLiteral<"accepted">;
+    contextHash: z.ZodOptional<z.ZodString>;
     workflowHash: z.ZodOptional<z.ZodString>;
+    steps: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        account: z.ZodObject<{
+            provider: z.ZodEnum<{
+                claude: "claude";
+                codex: "codex";
+                cursor: "cursor";
+                opencode: "opencode";
+                pi: "pi";
+            }>;
+            profileId: z.ZodString;
+            homePath: z.ZodOptional<z.ZodString>;
+            claudeLayout: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"native">;
+                statePath: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"relocated">;
+            }, z.core.$strict>], "kind">>;
+        }, z.core.$strict>;
+        grants: z.ZodObject<{
+            allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>;
+        model: z.ZodOptional<z.ZodString>;
+        effort: z.ZodOptional<z.ZodString>;
+        stepId: z.ZodString;
+    }, z.core.$strict>>>;
 }, z.core.$strict>;
 export type AcceptedWorkerIdentity = z.infer<typeof acceptedWorkerIdentitySchema>;
+/** The identity one agent step runs under. Explicit entries are authority; a legacy identity answers with its run-level view. */
+export declare function workerStepIdentity(identity: AcceptedWorkerIdentity, stepId: string): WorkerStepIdentity;
 export declare const workerExecutionIdentitySchema: z.ZodUnion<readonly [z.ZodObject<{
-    kind: z.ZodLiteral<"accepted">;
-    contextHash: z.ZodOptional<z.ZodString>;
     account: z.ZodObject<{
         provider: z.ZodEnum<{
             claude: "claude";
@@ -76,7 +129,35 @@ export declare const workerExecutionIdentitySchema: z.ZodUnion<readonly [z.ZodOb
     }, z.core.$strict>;
     model: z.ZodOptional<z.ZodString>;
     effort: z.ZodOptional<z.ZodString>;
+    kind: z.ZodLiteral<"accepted">;
+    contextHash: z.ZodOptional<z.ZodString>;
     workflowHash: z.ZodOptional<z.ZodString>;
+    steps: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        account: z.ZodObject<{
+            provider: z.ZodEnum<{
+                claude: "claude";
+                codex: "codex";
+                cursor: "cursor";
+                opencode: "opencode";
+                pi: "pi";
+            }>;
+            profileId: z.ZodString;
+            homePath: z.ZodOptional<z.ZodString>;
+            claudeLayout: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"native">;
+                statePath: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"relocated">;
+            }, z.core.$strict>], "kind">>;
+        }, z.core.$strict>;
+        grants: z.ZodObject<{
+            allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            bashAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>;
+        model: z.ZodOptional<z.ZodString>;
+        effort: z.ZodOptional<z.ZodString>;
+        stepId: z.ZodString;
+    }, z.core.$strict>>>;
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"internal">;
     workflowHash: z.ZodOptional<z.ZodString>;
@@ -90,3 +171,4 @@ export declare function boundWorkerAccountEnv(binding: WorkerAccountBinding, env
 export declare function workerContextHash(context: WorkerInputRecipe): string;
 /** Canonical schema order, as for the context recipe: key order in the persisted record is immaterial. */
 export declare function workerWorkflowHash(workflow: WorkflowDef): string;
+export {};

package/dist/delegation/execution-identity.js

@@ -23,21 +23,44 @@ export const workerAccountBindingSchema = z.object({
     .refine(binding => binding.provider === 'claude'
     ? binding.claudeLayout !== undefined && (binding.claudeLayout.kind !== 'native' || binding.profileId === 'default')
     : binding.claudeLayout === undefined);
-export const acceptedWorkerIdentitySchema = z.object({
-    kind: z.literal('accepted'),
-    /** Binds new input recipes; absence retains compatibility with pre-context identities. */
-    contextHash: z.string().regex(/^[0-9a-f]{64}$/).optional(),
+// Required private evidence; absent properties and explicit empty grants differ.
+const workerGrantsSchema = z.object({
+    allowedTools: z.array(z.string()).optional(),
+    bashAllowlist: z.array(z.string()).optional(),
+}).strict();
+/** What one agent step of an owned worker may run under: pinned at acceptance, read at every launch. */
+const workerStepIdentityFieldsSchema = z.object({
     account: workerAccountBindingSchema,
-    // Required private evidence; absent properties and explicit empty grants differ.
-    grants: z.object({
-        allowedTools: z.array(z.string()).optional(),
-        bashAllowlist: z.array(z.string()).optional(),
-    }).strict(),
+    grants: workerGrantsSchema,
     model: z.string().min(1).max(512).optional(),
     effort: z.string().min(1).max(128).optional(),
+});
+export const acceptedWorkerIdentitySchema = workerStepIdentityFieldsSchema.extend({
+    kind: z.literal('accepted'),
+    /** Binds new input recipes; absence retains compatibility with pre-context identities. */
+    contextHash: z.string().regex(/^[0-9a-f]{64}$/).optional(),
     /** Binds the public `workflowDef` a catalog worker runs (#451); absent means the built-in quick-task. */
     workflowHash: z.string().regex(/^[0-9a-f]{64}$/).optional(),
+    /**
+     * One entry per agent step of the accepted chain (#452), so a codex step and a claude step
+     * each run under their own account, model, effort and grants. The run-level fields above
+     * hold the FIRST agent step's values: evidence written before this list existed has only
+     * those, and `workerStepIdentity` answers every step from them.
+     */
+    steps: z.array(workerStepIdentityFieldsSchema.extend({ stepId: z.string().min(1) }).strict()).min(1).optional(),
 }).strict();
+/** The identity one agent step runs under. Explicit entries are authority; a legacy identity answers with its run-level view. */
+export function workerStepIdentity(identity, stepId) {
+    if (identity.steps === undefined) {
+        return { account: identity.account, grants: identity.grants,
+            ...(identity.model === undefined ? {} : { model: identity.model }), ...(identity.effort === undefined ? {} : { effort: identity.effort }) };
+    }
+    const entry = identity.steps.find(step => step.stepId === stepId);
+    if (!entry)
+        throw new WorkerIdentityError(`Accepted worker step identity is unavailable for "${stepId}"`);
+    const { stepId: _stepId, ...fields } = entry;
+    return fields;
+}
 export const workerExecutionIdentitySchema = z.union([
     acceptedWorkerIdentitySchema,
     // Only explicitly written by the internal owned-creation primitive. Absence never means legacy.

package/dist/delegation/execution-identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-identity.js","sourceRoot":"","sources":["../../src/delegation/execution-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAA0B,MAAM,8BAA8B,CAAC;AAC/F,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEzE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAoB,MAAM,uBAAuB,CAAC;AAE5E,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAE9H,6FAA6F;AAC7F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACvC,6FAA6F;IAC7F,YAAY,EAAE,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QACzC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;QAC/E,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;KACpD,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC9D,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;IAChC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;KACnE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ;IAC9C,CAAC,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;IACnH,CAAC,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC;AAG1C,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC3B,0FAA0F;IAC1F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAC1D,OAAO,EAAE,0BAA0B;IACnC,iFAAiF;IACjF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC5C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC9C,CAAC,CAAC,MAAM,EAAE;IACX,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC7C,yGAAyG;IACzG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC;IACnD,4BAA4B;IAC5B,gGAAgG;IAChG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CAChH,CAAC,CAAC;AAEH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;CAAG;AAEjD,MAAM,UAAU,oBAAoB,CAAC,OAA6B,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IACtG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACrG,0FAA0F;IAC1F,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACzE,IAAI,CAAC;QAAC,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,oDAAoD,CAAC,CAAC;IACzG,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS;QAC5D,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAoB,EAAE;YAChE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,SAAS,EAAE,mBAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC;IACjF,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ;QAC/G,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAA6B,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IACvG,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,IAAI,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IAC1H,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,iDAAiD,CAAC,CAAC;IAAC,CAAC;IAC7F,IAAI,OAAO,CAAC,YAAY,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAC9C,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,mBAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,SAAS;gBACxG,YAAY,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,sDAAsD,CAAC,CAAC;QAAC,CAAC;QAClG,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,OAA0B;IAC1D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3G,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,kBAAkB,CAAC,QAAqB;IACtD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtG,CAAC"}
+{"version":3,"file":"execution-identity.js","sourceRoot":"","sources":["../../src/delegation/execution-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAA0B,MAAM,8BAA8B,CAAC;AAC/F,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEzE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAoB,MAAM,uBAAuB,CAAC;AAE5E,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAE9H,6FAA6F;AAC7F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACvC,6FAA6F;IAC7F,YAAY,EAAE,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QACzC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;QAC/E,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;KACpD,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC9D,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;IAChC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;KACnE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ;IAC9C,CAAC,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;IACnH,CAAC,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC;AAG1C,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,wGAAwG;AACxG,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,OAAO,EAAE,0BAA0B;IACnC,MAAM,EAAE,kBAAkB;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,8BAA8B,CAAC,MAAM,CAAC;IAChF,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC3B,0FAA0F;IAC1F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAC1D,yGAAyG;IACzG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAC3D;;;;;OAKG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAChH,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,iIAAiI;AACjI,MAAM,UAAU,kBAAkB,CAAC,QAAgC,EAAE,MAAc;IACjF,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM;YACzD,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IAChJ,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,mBAAmB,CAAC,qDAAqD,MAAM,GAAG,CAAC,CAAC;IAC1G,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC;IACnD,4BAA4B;IAC5B,gGAAgG;IAChG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CAChH,CAAC,CAAC;AAEH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;CAAG;AAEjD,MAAM,UAAU,oBAAoB,CAAC,OAA6B,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IACtG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACrG,0FAA0F;IAC1F,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACzE,IAAI,CAAC;QAAC,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,oDAAoD,CAAC,CAAC;IACzG,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS;QAC5D,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAoB,EAAE;YAChE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,SAAS,EAAE,mBAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC;IACjF,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ;QAC/G,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAA6B,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IACvG,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,IAAI,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IAC1H,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,iDAAiD,CAAC,CAAC;IAAC,CAAC;IAC7F,IAAI,OAAO,CAAC,YAAY,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAC9C,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,mBAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,SAAS;gBACxG,YAAY,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,sDAAsD,CAAC,CAAC;QAAC,CAAC;QAClG,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,OAA0B;IAC1D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3G,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,kBAAkB,CAAC,QAAqB;IACtD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtG,CAAC"}

package/dist/delegation/provision.js

@@ -65,7 +65,7 @@ export function provisionDelegationSession(options) {
                 `Reuse the request ID only for the exact same task/baseline/context/backend/model/effort/workflow on a retry.`,
                 `Optional spawn flags: --workflow <name>, --context '<selected text>' or --context-file <local-UTF-8-file> (mutually exclusive), --backend <claude|codex|opencode|pi|cursor>, --model <model>, --effort <low|medium|high|xhigh|max>.`,
                 `--workflow runs a catalog workflow (the built-in quick-task or a .ai/cezar/workflows/*.yaml name) inside the worker, agent and check steps alike; omitted means quick-task with your system prompt.`,
-                `--backend, --model and --effort fill only the steps that leave those fields unset; an unknown name fails, and every agent step must resolve to one runner (mixed-runner chains are refused until #452).`,
+                `--backend, --model and --effort fill only the steps that leave those fields unset; an unknown name fails. Agent steps may mix runners: each step is pinned to its own runner, account, model, effort and grants at spawn, and a step's agentProfile names its account explicitly.`,
                 `Example: spawn --baseline parent-head --request-id <UUID> --backend codex --context 'Inspect only the parser' 'Review parser'.`,
                 `Example: spawn --baseline parent-head --request-id <UUID> --workflow review 'Review the parser change'.`,
                 `Task plus context text is limited to 100,000 characters.`,

package/dist/delegation/provision.js.map

@@ -1 +1 @@
-{"version":3,"file":"provision.js","sourceRoot":"","sources":["../../src/delegation/provision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAA0B,MAAM,cAAc,CAAC;AAC5F,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAI9C,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AACvE,MAAM,UAAU,uBAAuB;IACrC,yFAAyF;IACzF,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9F,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;AACjI,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAA4G;IACrJ,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAO;IACjC,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO;IACvD,MAAM,UAAU,GAAG,uBAAuB,EAAE,CAAC;IAC7C,MAAM,oBAAoB,GAAG;QAC3B,sEAAsE,UAAU,0CAA0C;QAC1H,OAAO,UAAU,sMAAsM;QACvN,OAAO,UAAU,sHAAsH,UAAU,mHAAmH;QACpQ,iIAAiI;QACjI,qQAAqQ;QACrQ,sJAAsJ;QACtJ,gKAAgK;QAChK,iMAAiM;QACjM,iKAAiK;QACjK,8HAA8H;QAC9H,6JAA6J;QAC7J,kFAAkF;KACnF,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEZ,kGAAkG;IAClG,IAAI,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACnK,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC/E,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO;QACL,wBAAwB,EAAE,IAAI;QAC9B,GAAG,EAAE,EAAE,kBAAkB,EAAE,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE;QACrE,YAAY,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,KAAK,QAAQ;YAC7C,CAAC,CAAC;gBACA,wDAAwD,GAAG,CAAC,UAAU,CAAC,WAAW,GAAG;gBACrF,oBAAoB;gBACpB,qFAAqF;gBACrF,yGAAyG;gBACzG,6DAA6D;gBAC7D,yIAAyI;gBACzI,gIAAgI;aACjI,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,CAAC,CAAC;gBACA,+CAA+C;gBAC/C,6DAA6D;gBAC7D,yIAAyI;gBACzI,2DAA2D,UAAU,GAAG;gBACxE,uBAAuB;gBACvB,oBAAoB;gBACpB,OAAO,UAAU,4FAA4F;gBAC7G,8GAA8G;gBAC9G,qOAAqO;gBACrO,qMAAqM;gBACrM,yMAAyM;gBACzM,gIAAgI;gBAChI,yGAAyG;gBACzG,0DAA0D;gBAC1D,wHAAwH;gBACxH,2CAA2C;gBAC3C,0LAA0L;gBAC1L,4CAA4C;gBAC5C,4MAA4M;gBAC5M,8FAA8F;gBAC9F,iFAAiF;gBACjF,qKAAqK;gBACrK,6FAA6F;gBAC7F,+IAA+I;gBAC/I,sIAAsI;gBACtI,4BAA4B;gBAC5B,8GAA8G;gBAC9G,mJAAmJ;gBACnJ,kFAAkF;gBAClF,oIAAoI;gBACpI,oJAAoJ;gBACpJ,4GAA4G;gBAC5G,wEAAwE;gBACxE,wGAAwG;gBACxG,yBAAyB;gBACzB,kFAAkF;gBAClF,8IAA8I;gBAC9I,2CAA2C;gBAC3C,+DAA+D;aAChE,CAAC,IAAI,CAAC,GAAG,CAAC;QACb,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,OAAO,oBAAoB;IACtB,OAAO,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAClC,WAAW,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACxC,SAAS,CAAwD;IACjE,QAAQ,GAAG,IAAI,GAAG,EAA0D,CAAC;IAC7E,MAAM,GAAG,KAAK,CAAC;IACf,MAAM,GAAG,KAAK,CAAC;IACvB,IAAI,GAAG,KAAyB,OAAO,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,KAAK;QAChB,MAAM,UAAU,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC9C,IAAI,iBAAiB,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC;gBAAC,UAAU,CAAC,SAAS,GAAG,MAAM,wBAAwB,CAAC,mBAAmB,CAAC,sBAAsB,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YACvJ,MAAM,CAAC;gBAAC,UAAU,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;QACrC,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IACO,WAAW;QACjB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QAAC,CAAC;IAClH,CAAC;IACD,aAAa,CAAC,OAA0B;QACtC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,EAAE;YAC7D,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,iBAAiB,EAAE;gBAAE,OAAO;YACnE,IAAI,CAAC;gBAAC,OAAO,0BAA0B,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;YAAC,CAAC;YAC1J,MAAM,CAAC;gBAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,KAAK,EAAE,CAAC;YAAC,UAAU,EAAE,CAAC;YACtB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE;gBAAE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,MAAM;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAAE,MAAM,EAAE,CAAC;QAC/D,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAAC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7D,MAAM,SAAS,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;CACF"}
+{"version":3,"file":"provision.js","sourceRoot":"","sources":["../../src/delegation/provision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAA0B,MAAM,cAAc,CAAC;AAC5F,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAI9C,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AACvE,MAAM,UAAU,uBAAuB;IACrC,yFAAyF;IACzF,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9F,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;AACjI,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAA4G;IACrJ,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAO;IACjC,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO;IACvD,MAAM,UAAU,GAAG,uBAAuB,EAAE,CAAC;IAC7C,MAAM,oBAAoB,GAAG;QAC3B,sEAAsE,UAAU,0CAA0C;QAC1H,OAAO,UAAU,sMAAsM;QACvN,OAAO,UAAU,sHAAsH,UAAU,mHAAmH;QACpQ,iIAAiI;QACjI,qQAAqQ;QACrQ,sJAAsJ;QACtJ,gKAAgK;QAChK,iMAAiM;QACjM,iKAAiK;QACjK,8HAA8H;QAC9H,6JAA6J;QAC7J,kFAAkF;KACnF,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEZ,kGAAkG;IAClG,IAAI,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACnK,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC/E,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO;QACL,wBAAwB,EAAE,IAAI;QAC9B,GAAG,EAAE,EAAE,kBAAkB,EAAE,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE;QACrE,YAAY,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,KAAK,QAAQ;YAC7C,CAAC,CAAC;gBACA,wDAAwD,GAAG,CAAC,UAAU,CAAC,WAAW,GAAG;gBACrF,oBAAoB;gBACpB,qFAAqF;gBACrF,yGAAyG;gBACzG,6DAA6D;gBAC7D,yIAAyI;gBACzI,gIAAgI;aACjI,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,CAAC,CAAC;gBACA,+CAA+C;gBAC/C,6DAA6D;gBAC7D,yIAAyI;gBACzI,2DAA2D,UAAU,GAAG;gBACxE,uBAAuB;gBACvB,oBAAoB;gBACpB,OAAO,UAAU,4FAA4F;gBAC7G,8GAA8G;gBAC9G,qOAAqO;gBACrO,qMAAqM;gBACrM,mRAAmR;gBACnR,gIAAgI;gBAChI,yGAAyG;gBACzG,0DAA0D;gBAC1D,wHAAwH;gBACxH,2CAA2C;gBAC3C,0LAA0L;gBAC1L,4CAA4C;gBAC5C,4MAA4M;gBAC5M,8FAA8F;gBAC9F,iFAAiF;gBACjF,qKAAqK;gBACrK,6FAA6F;gBAC7F,+IAA+I;gBAC/I,sIAAsI;gBACtI,4BAA4B;gBAC5B,8GAA8G;gBAC9G,mJAAmJ;gBACnJ,kFAAkF;gBAClF,oIAAoI;gBACpI,oJAAoJ;gBACpJ,4GAA4G;gBAC5G,wEAAwE;gBACxE,wGAAwG;gBACxG,yBAAyB;gBACzB,kFAAkF;gBAClF,8IAA8I;gBAC9I,2CAA2C;gBAC3C,+DAA+D;aAChE,CAAC,IAAI,CAAC,GAAG,CAAC;QACb,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,OAAO,oBAAoB;IACtB,OAAO,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAClC,WAAW,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACxC,SAAS,CAAwD;IACjE,QAAQ,GAAG,IAAI,GAAG,EAA0D,CAAC;IAC7E,MAAM,GAAG,KAAK,CAAC;IACf,MAAM,GAAG,KAAK,CAAC;IACvB,IAAI,GAAG,KAAyB,OAAO,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,KAAK;QAChB,MAAM,UAAU,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC9C,IAAI,iBAAiB,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC;gBAAC,UAAU,CAAC,SAAS,GAAG,MAAM,wBAAwB,CAAC,mBAAmB,CAAC,sBAAsB,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YACvJ,MAAM,CAAC;gBAAC,UAAU,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;QACrC,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IACO,WAAW;QACjB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QAAC,CAAC;IAClH,CAAC;IACD,aAAa,CAAC,OAA0B;QACtC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,EAAE;YAC7D,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,iBAAiB,EAAE;gBAAE,OAAO;YACnE,IAAI,CAAC;gBAAC,OAAO,0BAA0B,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;YAAC,CAAC;YAC1J,MAAM,CAAC;gBAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,KAAK,EAAE,CAAC;YAAC,UAAU,EAAE,CAAC;YACtB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE;gBAAE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,MAAM;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAAE,MAAM,EAAE,CAAC;QAC/D,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAAC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7D,MAAM,SAAS,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;CACF"}

package/dist/delegation/service.js

@@ -6,7 +6,7 @@ import { acceptedWorkerIdentitySchema, workerContextHash, workerWorkflowHash } f
 import { createHash, randomUUID } from 'node:crypto';
 import { conversationSendRequestSchema, conversationInspectRequestSchema, conversationCancelRequestSchema, requestWaitRequestSchema, workerSpawnRequestSchema, workerSteerRequestSchema, workerWaitRequestSchema, workerParamsSchema, workerCancelWaitRequestSchema, } from '../contract/index.js';
 import { workerOutcome } from '../runs/delegation-state.js';
-import { QUICK_TASK_WORKFLOW, stepKind } from '../workflows/types.js';
+import { QUICK_TASK_WORKFLOW, allowedToolsForStep, stepKind } from '../workflows/types.js';
 import { findWorkflow } from '../workflows/load.js';
 import { isAuthenticatedCaller } from './credentials.js';
 import { parseDelegationEffort } from './effort.js';
@@ -15,23 +15,64 @@ import { planOwnedWorkspace, readOwnedDiff, removeOwnedWorkspace, resolveWorkerB
 /**
  * The catalog definition a spawn runs (#451): the built-in quick-task constant when the request
  * names none — never the catalog's `quick-task` entry, so a repo file cannot change the default
- * path — else the named entry. Version one pins one accepted provider per worker, so every agent
- * step must agree on a runner; `backend` is that runner when the chain declares one, otherwise
- * the request's own selection (absent → inherit the parent).
+ * path — else the named entry. Every agent step resolves its own runner and account (#452), so a
+ * chain may mix providers; a chain with no agent step has nothing for a worker to run.
  */
 async function resolveSpawnWorkflow(root, request) {
     if (request.workflow === undefined)
-        return { workflow: QUICK_TASK_WORKFLOW, backend: request.backend };
+        return QUICK_TASK_WORKFLOW;
     const workflow = await findWorkflow(root, request.workflow);
     if (!workflow)
         throw new DelegationPolicyError('invalid_input', `Unknown workflow "${request.workflow}"; the catalog holds the built-in quick-task and .ai/cezar/workflows/*.yaml`);
-    const declared = new Set(workflow.steps.filter(step => stepKind(step) === 'agent').flatMap(step => step.runner ? [step.runner] : []));
-    if (request.backend !== undefined)
-        declared.add(request.backend);
-    if (declared.size > 1) {
-        throw new DelegationPolicyError('invalid_input', `Workflow "${request.workflow}" needs runners ${[...declared].sort().join(', ')}; a worker runs under one accepted provider, so mixed-runner chains wait for per-step worker identity (#452)`);
+    if (!workflow.steps.some(step => stepKind(step) === 'agent'))
+        throw new DelegationPolicyError('invalid_input', `Workflow "${request.workflow}" has no agent step for a worker to run`);
+    return workflow;
+}
+/**
+ * A step's authored tools narrow the parent's grants and never widen them: the parent's
+ * permissions bound every worker session (#430). A step that authors nothing inherits the
+ * parent's grants exactly; an authored list keeps only what the parent may use, where an absent
+ * parent `allowedTools` means the backend's default set and an absent `bashAllowlist` means
+ * unrestricted Bash, which any authored allowlist is narrower than.
+ */
+function narrowGrants(parent, step, runner) {
+    const parentTools = step.allowedTools === undefined ? parent.allowedTools : parent.allowedTools ?? allowedToolsForStep(undefined, runner);
+    const allowedTools = step.allowedTools === undefined ? parent.allowedTools : step.allowedTools.filter(tool => parentTools.includes(tool));
+    const bashAllowlist = step.bashAllowlist === undefined ? parent.bashAllowlist
+        : parent.bashAllowlist === undefined ? [...step.bashAllowlist] : step.bashAllowlist.filter(command => parent.bashAllowlist.includes(command));
+    return { ...(allowedTools === undefined ? {} : { allowedTools: [...allowedTools] }), ...(bashAllowlist === undefined ? {} : { bashAllowlist: [...bashAllowlist] }) };
+}
+/**
+ * Resolve every agent step of the chain once, before acceptance (#452). The spawn selection fills
+ * only what a step leaves unset; a step's own runner, model, effort and account win. Equal
+ * selections share one resolution so a ten-step single-runner chain reads the registry once.
+ */
+async function resolveSpawnSteps(manager, parentId, request, workflow) {
+    const cache = new Map();
+    const resolved = [];
+    for (const step of workflow.steps) {
+        if (stepKind(step) === 'check')
+            continue;
+        const selection = {
+            ...(step.runner ?? request.backend) === undefined ? {} : { backend: step.runner ?? request.backend },
+            ...(step.model ?? request.model) === undefined ? {} : { model: step.model ?? request.model },
+            ...(step.effort ?? request.effort) === undefined ? {} : { effort: step.effort ?? request.effort },
+            ...(step.agentProfile === undefined ? {} : { agentProfile: step.agentProfile }),
+        };
+        const key = JSON.stringify(selection);
+        let pending = cache.get(key);
+        if (!pending) {
+            pending = manager.selectDelegationExecutionSettings(parentId, selection);
+            cache.set(key, pending);
+        }
+        const settings = await pending;
+        resolved.push({ step, settings, grants: narrowGrants({ ...(settings.allowedTools === undefined ? {} : { allowedTools: settings.allowedTools }),
+                ...(settings.bashAllowlist === undefined ? {} : { bashAllowlist: settings.bashAllowlist }) }, step, settings.runner) });
     }
-    return { workflow, backend: [...declared][0] ?? request.backend };
+    return resolved;
+}
+function stepIdentityFields({ settings, grants }) {
+    return { account: settings.accountBinding, grants, ...(settings.model === undefined ? {} : { model: settings.model }), ...(settings.effort === undefined ? {} : { effort: settings.effort }) };
 }
 export const delegationEnabled = () => process.env.CEZ_DELEGATION === '1';
 /** A single controller's shared policy adapter; managers retain scheduling and lifecycle ownership. */
@@ -236,10 +277,13 @@ export class DelegationService {
             }
             authorizeSpawn(caller, parent, project.id);
             const catalog = await resolveSpawnWorkflow(project.root, request);
-            const settings = await project.manager.selectDelegationExecutionSettings(parent.id, { ...request, backend: catalog.backend });
-            const identity = acceptedWorkerIdentitySchema.parse({ kind: 'accepted', account: settings.accountBinding, model: settings.model, effort: settings.effort,
-                grants: { ...(settings.allowedTools === undefined ? {} : { allowedTools: [...settings.allowedTools] }),
-                    ...(settings.bashAllowlist === undefined ? {} : { bashAllowlist: [...settings.bashAllowlist] }) } });
+            const resolvedSteps = await resolveSpawnSteps(project.manager, parent.id, request, catalog);
+            // Run-level fields hold the first agent step (cockpit columns, pre-#452 evidence readers);
+            // the per-step list is what each launch binds.
+            const first = resolvedSteps[0];
+            const settings = first.settings;
+            const identity = acceptedWorkerIdentitySchema.parse({ kind: 'accepted', ...stepIdentityFields(first),
+                steps: resolvedSteps.map(entry => ({ stepId: entry.step.id, ...stepIdentityFields(entry) })) });
             const baselineSha = await resolveWorkerBaseline(project.root, settings.cwd, request.baseline);
             const workspace = await planOwnedWorkspace(project.root, randomUUID(), baselineSha);
             const prepared = request.context === undefined ? undefined : await prepareWorkerContext({
@@ -254,14 +298,19 @@ export class DelegationService {
                 if (current !== project)
                     throw new DelegationPolicyError('denied_scope', 'Worker scope denied');
                 authorizeSpawn(caller, project.store.getRun(parent.id), project.id);
-                // Spawn selection fills only what a step leaves unset; the accepted grants replace step
-                // tools because the parent's permissions bound every worker session. Check steps run
-                // as authored. Authored `effort` already wins per step at execution, and an unset one
-                // falls through to the run-level pin, so it is not written here.
-                const workflowDef = { ...catalog.workflow, steps: catalog.workflow.steps.map(step => stepKind(step) === 'check' ? step : { ...step,
-                        runner: step.runner ?? settings.runner, model: step.model ?? settings.model,
-                        ...(settings.allowedTools === undefined ? {} : { allowedTools: [...settings.allowedTools] }),
-                        ...(settings.bashAllowlist === undefined ? {} : { bashAllowlist: [...settings.bashAllowlist] }),
+                // The public definition carries what each agent step RESOLVED to — runner, account,
+                // model, effort and the narrowed grants — so the bound `workflowDef` and the private
+                // per-step identity describe the same launch and the manager can hold them against each
+                // other. Check steps run as authored.
+                const workflowDef = { ...catalog, steps: catalog.steps.map(step => {
+                        const entry = resolvedSteps.find(candidate => candidate.step === step);
+                        if (!entry)
+                            return step;
+                        const { model: _model, effort: _effort, allowedTools: _tools, bashAllowlist: _bash, ...authored } = step;
+                        return { ...authored, runner: entry.settings.runner, agentProfile: entry.settings.accountBinding.profileId,
+                            ...(entry.settings.model === undefined ? {} : { model: entry.settings.model }),
+                            ...(entry.settings.effort === undefined ? {} : { effort: entry.settings.effort }),
+                            ...entry.grants };
                     }) };
                 const worker = project.store.createOwnedRun({
                     title: request.task.slice(0, 200), task: context ? workerContextTask(request.task, context) : request.task, workflow: workflowDef.name,