agentxchain 2.130.0 → 2.131.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentxchain",
-  "version": "2.130.0",
+  "version": "2.131.0",
   "description": "CLI for AgentXchain — governed multi-agent software delivery",
   "type": "module",
   "bin": {
@@ -24,7 +24,8 @@
     "dev": "node bin/agentxchain.js",
     "test": "npm run test:vitest && npm run test:node",
     "test:vitest": "vitest run --reporter=verbose",
-    "test:node": "node --test test/*.test.js",
+    "test:beta": "node --test test/beta-tester-scenarios/*.test.js",
+    "test:node": "node --test test/*.test.js test/beta-tester-scenarios/*.test.js",
     "preflight:release": "bash scripts/release-preflight.sh",
     "preflight:release:strict": "bash scripts/release-preflight.sh --strict",
     "check:release-alignment": "node scripts/check-release-alignment.mjs",

package/scripts/check-release-alignment.mjs

@@ -12,12 +12,13 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = join(__dirname, '..', '..');
 
 function usage() {
-  console.error('Usage: node cli/scripts/check-release-alignment.mjs [--target-version <semver>] [--scope prebump|current] [--json]');
+  console.error('Usage: node cli/scripts/check-release-alignment.mjs [--target-version <semver>] [--scope prebump|current] [--json|--report]');
 }
 
 let targetVersion = null;
 let scope = RELEASE_ALIGNMENT_SCOPES.CURRENT;
 let json = false;
+let report = false;
 
 for (let index = 2; index < process.argv.length; index += 1) {
   const arg = process.argv[index];
@@ -45,15 +46,40 @@ for (let index = 2; index < process.argv.length; index += 1) {
     json = true;
     continue;
   }
+  if (arg === '--report') {
+    report = true;
+    continue;
+  }
   console.error(`Error: unknown argument "${arg}"`);
   usage();
   process.exit(1);
 }
 
+if (json && report) {
+  console.error('Error: --json and --report are mutually exclusive');
+  usage();
+  process.exit(1);
+}
+
 const result = validateReleaseAlignment(REPO_ROOT, { targetVersion, scope });
 
 if (json) {
   console.log(JSON.stringify(result, null, 2));
+} else if (report) {
+  const readyCount = result.surfaceResults.filter((surface) => surface.ok).length;
+  const needsUpdateCount = result.surfaceResults.length - readyCount;
+  console.log(
+    `Release alignment report for ${result.targetVersion} (${result.scope}, ${result.checkedSurfaceCount} surfaces).`,
+  );
+  for (const surface of result.surfaceResults) {
+    console.log(`- [${surface.ok ? 'ready' : 'needs update'}] (${surface.surface_id}) ${surface.label}`);
+    for (const error of surface.errors) {
+      console.log(`  - ${error}`);
+    }
+  }
+  console.log(
+    `Summary: ${readyCount} ready, ${needsUpdateCount} need update.`,
+  );
 } else if (result.ok) {
   console.log(`Release alignment OK for ${result.targetVersion} (${result.scope}, ${result.checkedSurfaceCount} surfaces).`);
 } else {

package/scripts/release-preflight.sh

@@ -10,11 +10,13 @@ cd "$CLI_DIR"
 
 STRICT_MODE=0
 PUBLISH_GATE=0
+DRY_RUN=0
 TARGET_VERSION="2.0.0"
 
 usage() {
-  echo "Usage: bash scripts/release-preflight.sh [--strict] [--publish-gate] [--target-version <semver>]" >&2
+  echo "Usage: bash scripts/release-preflight.sh [--strict] [--publish-gate] [--dry-run] [--target-version <semver>]" >&2
   echo "  --publish-gate  Run only release-critical checks (no full test suite). Use in CI publish workflows." >&2
+  echo "  --dry-run       Preview manual release-alignment surfaces without running the full gate." >&2
 }
 
 while [[ $# -gt 0 ]]; do
@@ -28,6 +30,10 @@ while [[ $# -gt 0 ]]; do
       STRICT_MODE=1
       shift
       ;;
+    --dry-run)
+      DRY_RUN=1
+      shift
+      ;;
     --target-version)
       if [[ -z "${2:-}" ]]; then
         echo "Error: --target-version requires a semver argument" >&2
@@ -49,6 +55,12 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 
+if [[ "$DRY_RUN" -eq 1 && "$STRICT_MODE" -eq 1 ]]; then
+  echo "Error: --dry-run cannot be combined with --strict or --publish-gate" >&2
+  usage
+  exit 1
+fi
+
 PASS=0
 FAIL=0
 WARN=0
@@ -84,6 +96,31 @@ else
 fi
 echo ""
 
+if [[ "$DRY_RUN" -eq 1 ]]; then
+  echo "Release Preflight Preview"
+  echo "========================="
+  echo "Mode: DRY RUN (manual release-alignment surfaces only; no git/npm gate checks executed)"
+  echo ""
+  ALIGNMENT_SCRIPT="${SCRIPT_DIR}/check-release-alignment.mjs"
+  if [[ ! -f "$ALIGNMENT_SCRIPT" ]]; then
+    echo "Error: release alignment preview requires ${ALIGNMENT_SCRIPT}" >&2
+    exit 1
+  fi
+  if run_and_capture ALIGNMENT_REPORT node "$ALIGNMENT_SCRIPT" --scope prebump --target-version "$TARGET_VERSION" --report; then
+    ALIGNMENT_STATUS=0
+  else
+    ALIGNMENT_STATUS=$?
+  fi
+  printf '%s\n' "$ALIGNMENT_REPORT"
+  echo ""
+  if [[ "$ALIGNMENT_STATUS" -eq 0 ]]; then
+    echo "PREVIEW COMPLETE: manual release-alignment surfaces are ready for ${TARGET_VERSION}."
+  else
+    echo "PREVIEW COMPLETE: manual release-alignment surfaces still need updates before a real preflight/tag push."
+  fi
+  exit 0
+fi
+
 # 1. Clean working tree
 echo "[1/7] Git status"
 if git diff --quiet HEAD 2>/dev/null && [ -z "$(git ls-files --others --exclude-standard 2>/dev/null)" ]; then
@@ -110,24 +147,37 @@ if [[ "$PUBLISH_GATE" -eq 1 ]]; then
   echo "[3/7] Release-gate tests (targeted subset)"
   # In publish-gate mode, run only release-critical tests to avoid CI hangs.
   # The full test suite is a pre-tag responsibility, not a publish-time gate.
-  GATE_TESTS=(
+  GATE_TEST_PATTERNS=(
     test/release-preflight.test.js
     test/release-docs-content.test.js
     test/release-notes-gate.test.js
     test/release-identity-hardening.test.js
     test/normalized-config.test.js
     test/conformance.test.js
+    test/beta-tester-scenarios/*.test.js
   )
   GATE_TEST_ARGS=()
-  for t in "${GATE_TESTS[@]}"; do
-    if [[ -f "$t" ]]; then
+  shopt -s nullglob
+  for pattern in "${GATE_TEST_PATTERNS[@]}"; do
+    for t in $pattern; do
       GATE_TEST_ARGS+=("$t")
-    fi
+    done
   done
+  shopt -u nullglob
   if [[ ${#GATE_TEST_ARGS[@]} -eq 0 ]]; then
     fail "No release-gate test files found"
   else
-    if run_and_capture TEST_OUTPUT env AGENTXCHAIN_RELEASE_TARGET_VERSION="${TARGET_VERSION}" AGENTXCHAIN_RELEASE_PREFLIGHT=1 node --test "${GATE_TEST_ARGS[@]}"; then
+    BETA_TEST_COUNT=0
+    for t in "${GATE_TEST_ARGS[@]}"; do
+      if [[ "$t" == test/beta-tester-scenarios/*.test.js ]]; then
+        BETA_TEST_COUNT=$((BETA_TEST_COUNT + 1))
+      fi
+    done
+    if [[ "$BETA_TEST_COUNT" -eq 0 ]]; then
+      fail "No beta-tester scenario tests found for release-gate verification"
+      TEST_OUTPUT=""
+      TEST_STATUS=1
+    elif run_and_capture TEST_OUTPUT env AGENTXCHAIN_RELEASE_TARGET_VERSION="${TARGET_VERSION}" AGENTXCHAIN_RELEASE_PREFLIGHT=1 node --test "${GATE_TEST_ARGS[@]}"; then
       TEST_STATUS=0
     else
       TEST_STATUS=$?

package/src/commands/connector.js

@@ -105,6 +105,7 @@ export async function connectorCheckCommand(runtimeId, options = {}) {
   const result = await probeConfiguredConnectors(context.config, {
     runtimeId: runtimeId || null,
     timeoutMs,
+    root: context.root,
     onProbeStart: options.json ? null : (probeRuntimeId, runtime) => {
       console.log(`  ${chalk.dim('…')} Probing ${chalk.bold(probeRuntimeId)} ${chalk.dim(`(${runtime.type})`)}`);
     },

package/src/commands/doctor.js

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync } from 'fs';
-import { execFileSync, execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import { join } from 'path';
 import chalk from 'chalk';
 import { loadConfig, loadLock, findProjectRoot, loadProjectState } from '../lib/config.js';
@@ -20,6 +20,7 @@ import {
 import { detectActiveTurnBindingDrift, detectStateBundleDesync } from '../lib/governed-state.js';
 import { findPendingApprovedIntents } from '../lib/intake.js';
 import { checkCleanBaseline } from '../lib/repo-observer.js';
+import { probeRuntimeSpawnContext } from '../lib/runtime-spawn-context.js';
 
 export async function doctorCommand(opts = {}) {
   const root = findProjectRoot(process.cwd());
@@ -90,7 +91,7 @@ function governedDoctor(root, rawConfig, opts) {
   const runtimes = (normalized && normalized.runtimes) || rawConfig.runtimes || {};
   const rolesByRuntime = buildRolesByRuntime(normalized?.roles || {});
   for (const [rtId, rt] of Object.entries(runtimes)) {
-    const check = checkRuntimeReachable(rtId, rt, rolesByRuntime[rtId] || []);
+    const check = checkRuntimeReachable(root, rtId, rt, rolesByRuntime[rtId] || []);
     checks.push(check);
   }
   const connectorProbe = getConnectorProbeRecommendation(runtimes);
@@ -484,7 +485,7 @@ function buildCliVersionCheck(cliVersionHealth) {
   };
 }
 
-function checkRuntimeReachable(rtId, rt, boundRoleEntries = []) {
+function checkRuntimeReachable(root, rtId, rt, boundRoleEntries = []) {
   const base = { id: `runtime_${rtId}`, name: `Runtime: ${rtId}` };
 
   if (!rt || !rt.type) {
@@ -496,14 +497,8 @@ function checkRuntimeReachable(rtId, rt, boundRoleEntries = []) {
       return attachRuntimeContract({ ...base, level: 'pass', detail: 'Manual runtime (no binary needed)' }, rtId, rt, boundRoleEntries);
 
     case 'local_cli': {
-      const cmd = Array.isArray(rt.command) ? rt.command[0] : (typeof rt.command === 'string' ? rt.command.split(/\s+/)[0] : null);
-      if (!cmd) return attachRuntimeContract({ ...base, level: 'warn', detail: 'No command configured' }, rtId, rt, boundRoleEntries);
-      try {
-        execSync(`command -v ${cmd}`, { stdio: 'ignore' });
-        return attachRuntimeContract({ ...base, level: 'pass', detail: `${cmd} binary found` }, rtId, rt, boundRoleEntries);
-      } catch {
-        return attachRuntimeContract({ ...base, level: 'fail', detail: `${cmd} not found in PATH` }, rtId, rt, boundRoleEntries);
-      }
+      const probe = probeRuntimeSpawnContext(root, rt, { runtimeId: rtId });
+      return attachRuntimeContract({ ...base, level: probe.ok ? 'pass' : 'fail', detail: probe.detail }, rtId, rt, boundRoleEntries);
     }
 
     case 'api_proxy': {
@@ -523,14 +518,8 @@ function checkRuntimeReachable(rtId, rt, boundRoleEntries = []) {
       if (transport === 'streamable_http') {
         return attachRuntimeContract({ ...base, level: 'warn', detail: 'Remote MCP endpoint (cannot verify at doctor time)' }, rtId, rt, boundRoleEntries);
       }
-      const cmd = Array.isArray(rt.command) ? rt.command[0] : (typeof rt.command === 'string' ? rt.command.split(/\s+/)[0] : null);
-      if (!cmd) return attachRuntimeContract({ ...base, level: 'warn', detail: 'No MCP command configured' }, rtId, rt, boundRoleEntries);
-      try {
-        execSync(`command -v ${cmd}`, { stdio: 'ignore' });
-        return attachRuntimeContract({ ...base, level: 'pass', detail: `${cmd} binary found` }, rtId, rt, boundRoleEntries);
-      } catch {
-        return attachRuntimeContract({ ...base, level: 'fail', detail: `${cmd} not found in PATH` }, rtId, rt, boundRoleEntries);
-      }
+      const probe = probeRuntimeSpawnContext(root, rt, { runtimeId: rtId });
+      return attachRuntimeContract({ ...base, level: probe.ok ? 'pass' : 'fail', detail: probe.detail }, rtId, rt, boundRoleEntries);
     }
 
     case 'remote_agent':

package/src/commands/mission.js

@@ -22,6 +22,7 @@ import {
   getWorkstreamStatusSummary,
   launchCoordinatorWorkstream,
   launchWorkstream,
+  retryCoordinatorWorkstream,
   retryWorkstream,
   markWorkstreamOutcome,
   loadAllPlans,
@@ -541,11 +542,6 @@ export async function missionPlanLaunchCommand(planTarget, opts) {
   }
 
   if (mission.coordinator && plan.coordinator_scope) {
-    if (opts.retry) {
-      console.error(chalk.red('--retry is not supported for coordinator-bound mission plans yet.'));
-      process.exit(1);
-    }
-
     const coordinatorConfigResult = loadCoordinatorConfig(mission.coordinator.workspace_path);
     if (!coordinatorConfigResult.ok) {
       console.error(chalk.red('Coordinator config validation failed:'));
@@ -565,6 +561,113 @@ export async function missionPlanLaunchCommand(planTarget, opts) {
       process.exit(1);
     }
 
+    if (opts.retry) {
+      const retry = retryCoordinatorWorkstream(
+        root,
+        mission,
+        plan.plan_id,
+        opts.workstream,
+        coordinatorConfigResult.config,
+        {
+          reason: `mission plan retry ${opts.workstream}`,
+        },
+      );
+      if (!retry.ok) {
+        console.error(chalk.red(retry.error));
+        process.exit(1);
+      }
+
+      const executor = opts._executeGovernedRun || executeGovernedRun;
+      const repoContext = loadProjectContext(retry.retryResult.repo_path);
+      if (!repoContext) {
+        console.error(chalk.red(`Cannot load project context for retried repo at ${retry.retryResult.repo_path}.`));
+        process.exit(1);
+      }
+
+      const runOpts = {
+        autoApprove: !!opts.autoApprove,
+        provenance: {
+          trigger: 'manual',
+          created_by: 'operator',
+          trigger_reason: `mission:${mission.mission_id} workstream:${opts.workstream} coordinator-retry:${retry.retryResult.repo_id}`,
+        },
+      };
+
+      let execution;
+      try {
+        execution = await executor(repoContext, runOpts);
+      } catch (error) {
+        const syncedRetryFailure = synchronizeCoordinatorPlanState(root, mission, retry.plan);
+        console.error(chalk.red(`Coordinator retry execution failed: ${error.message}`));
+        if (opts.json) {
+          console.log(JSON.stringify({
+            dispatch_mode: 'coordinator',
+            retry: true,
+            mission_id: mission.mission_id,
+            plan_id: retry.plan.plan_id,
+            workstream_id: opts.workstream,
+            repo_id: retry.retryResult.repo_id,
+            retried_repo_turn_id: retry.retryResult.failed_turn_id,
+            repo_turn_id: retry.retryResult.reissued_turn_id,
+            workstream_status: syncedRetryFailure.ok
+              ? syncedRetryFailure.plan.workstreams.find((ws) => ws.workstream_id === opts.workstream)?.launch_status || 'needs_attention'
+              : 'needs_attention',
+            launch_record: retry.launchRecord,
+            error: error.message,
+          }, null, 2));
+        }
+        process.exit(1);
+      }
+
+      const syncedRetry = synchronizeCoordinatorPlanState(root, mission, retry.plan);
+      const retriedPlan = syncedRetry.ok ? syncedRetry.plan : retry.plan;
+      const retriedWorkstream = retriedPlan.workstreams.find((ws) => ws.workstream_id === opts.workstream);
+      const retriedLaunchRecord = retriedPlan.launch_records.find(
+        (record) => record.workstream_id === opts.workstream && record.dispatch_mode === 'coordinator',
+      ) || retry.launchRecord;
+
+      if (opts.json) {
+        console.log(JSON.stringify({
+          dispatch_mode: 'coordinator',
+          retry: true,
+          mission_id: mission.mission_id,
+          plan_id: retriedPlan.plan_id,
+          workstream_id: opts.workstream,
+          super_run_id: mission.coordinator.super_run_id,
+          repo_id: retry.retryResult.repo_id,
+          retried_repo_turn_id: retry.retryResult.failed_turn_id,
+          repo_turn_id: retry.retryResult.reissued_turn_id,
+          role: retry.retryResult.role,
+          bundle_path: retry.retryResult.bundle_path,
+          context_ref: retry.retryResult.context_ref,
+          workstream_status: retriedWorkstream?.launch_status || 'launched',
+          launch_record: retriedLaunchRecord,
+          exit_code: execution?.exitCode ?? 0,
+        }, null, 2));
+        if ((execution?.exitCode ?? 0) !== 0) {
+          process.exit(execution.exitCode);
+        }
+        return;
+      }
+
+      console.log(chalk.green(`Retried coordinator workstream ${chalk.bold(opts.workstream)} in ${chalk.bold(retry.retryResult.repo_id)}`));
+      console.log('');
+      console.log(chalk.dim(`  Mission:      ${mission.mission_id}`));
+      console.log(chalk.dim(`  Plan:         ${retriedPlan.plan_id}`));
+      console.log(chalk.dim(`  Super Run:    ${mission.coordinator.super_run_id}`));
+      console.log(chalk.dim(`  Repo:         ${retry.retryResult.repo_id}`));
+      console.log(chalk.dim(`  Old Turn:     ${retry.retryResult.failed_turn_id}`));
+      console.log(chalk.dim(`  New Turn:     ${retry.retryResult.reissued_turn_id}`));
+      console.log(chalk.dim(`  Workstream:   ${retriedWorkstream?.launch_status || 'launched'}`));
+      console.log('');
+      renderPlan(retriedPlan);
+      if ((execution?.exitCode ?? 0) !== 0) {
+        console.error(chalk.red(`Coordinator retry execution ended with exit code ${execution.exitCode}.`));
+        process.exit(execution.exitCode);
+      }
+      return;
+    }
+
     const assignment = selectAssignmentForWorkstream(
       mission.coordinator.workspace_path,
       coordinatorState,

package/src/lib/connector-probe.js

@@ -1,10 +1,9 @@
-import { execFileSync } from 'node:child_process';
-
 import {
   buildProviderHeaders,
   buildProviderRequest,
   PROVIDER_ENDPOINTS,
 } from './adapters/api-proxy-adapter.js';
+import { probeRuntimeSpawnContext } from './runtime-spawn-context.js';
 
 const PROBEABLE_RUNTIME_TYPES = new Set(['local_cli', 'api_proxy', 'mcp', 'remote_agent']);
 const DEFAULT_TIMEOUT_MS = 8_000;
@@ -35,8 +34,8 @@ const KNOWN_CLI_AUTHORITY_FLAGS = [
  * Maps binary name to expected transport.
  */
 const KNOWN_CLI_TRANSPORTS = {
-  claude: 'stdin',
-  codex: 'argv',
+  claude: ['stdin'],
+  codex: ['argv', 'stdin'],
 };
 
 function formatCommand(command, args = []) {
@@ -78,11 +77,6 @@ function commandHead(runtime) {
   return null;
 }
 
-function resolveBinary(command) {
-  const resolver = process.platform === 'win32' ? 'where' : 'which';
-  execFileSync(resolver, [command], { stdio: 'ignore' });
-}
-
 function resolveProviderEndpoint(runtime) {
   if (typeof runtime?.base_url === 'string' && runtime.base_url.trim()) {
     return runtime.base_url.trim();
@@ -153,7 +147,7 @@ async function probeHttp({ url, method = 'GET', headers = {}, body, timeoutMs })
   }
 }
 
-async function probeLocalCommand(runtimeId, runtime, probeKindLabel) {
+async function probeLocalCommand(runtimeId, runtime, probeKindLabel, options = {}) {
   const head = commandHead(runtime);
   const base = {
     runtime_id: runtimeId,
@@ -170,22 +164,22 @@ async function probeLocalCommand(runtimeId, runtime, probeKindLabel) {
     };
   }
 
-  try {
-    resolveBinary(head);
+  const spawnProbe = probeRuntimeSpawnContext(options.root || process.cwd(), runtime, { runtimeId });
+  if (spawnProbe.ok) {
     return {
       ...base,
       level: 'pass',
-      command: head,
-      detail: `${head} is available on PATH`,
-    };
-  } catch {
-    return {
-      ...base,
-      level: 'fail',
-      command: head,
-      detail: `${head} was not found on PATH`,
+      command: spawnProbe.command || head,
+      detail: spawnProbe.detail,
     };
   }
+
+  return {
+    ...base,
+    level: 'fail',
+    command: spawnProbe.command || head,
+    detail: spawnProbe.detail,
+  };
 }
 
 async function probeApiProxy(runtimeId, runtime, timeoutMs) {
@@ -331,6 +325,27 @@ function analyzeLocalCliAuthorityIntent(runtimeId, runtime, roles) {
   if (boundRoles.length === 0) return { warnings };
 
   const authoritativeRoles = boundRoles.filter((r) => r.write_authority === 'authoritative');
+  const isCodex = binaryName === 'codex' || binaryName.endsWith('/codex');
+
+  if (isCodex) {
+    if (commandTokens[1] !== 'exec') {
+      warnings.push({
+        probe_kind: 'command_intent',
+        level: 'warn',
+        detail: 'OpenAI Codex CLI governed local runs should use the non-interactive "exec" subcommand. Top-level "codex" is the interactive entrypoint.',
+        fix: 'Use ["codex", "exec", "--dangerously-bypass-approvals-and-sandbox", "{prompt}"]',
+      });
+    }
+
+    if (commandTokens.includes('--quiet')) {
+      warnings.push({
+        probe_kind: 'command_intent',
+        level: 'warn',
+        detail: 'OpenAI Codex CLI rejects "--quiet" in governed local_cli commands on the current CLI. The command exits before the turn starts.',
+        fix: 'Remove "--quiet" and use ["codex", "exec", "--dangerously-bypass-approvals-and-sandbox", "{prompt}"]',
+      });
+    }
+  }
 
   // Check known CLI authority flags
   const knownCli = KNOWN_CLI_AUTHORITY_FLAGS.find((entry) => binaryName === entry.binary || binaryName.endsWith(`/${entry.binary}`));
@@ -359,7 +374,7 @@ function analyzeLocalCliAuthorityIntent(runtimeId, runtime, roles) {
 
   // Prompt transport validation
   const transport = runtime.prompt_transport || 'dispatch_bundle_only';
-  const knownTransport = KNOWN_CLI_TRANSPORTS[binaryName];
+  const knownTransports = KNOWN_CLI_TRANSPORTS[binaryName];
 
   if (transport === 'argv' && !commandTokens.some((token) => token.includes('{prompt}'))) {
     warnings.push({
@@ -370,13 +385,13 @@ function analyzeLocalCliAuthorityIntent(runtimeId, runtime, roles) {
     });
   }
 
-  if (knownTransport && transport !== knownTransport && transport !== 'dispatch_bundle_only') {
+  if (knownTransports && !knownTransports.includes(transport) && transport !== 'dispatch_bundle_only') {
     const transportLabel = knownCli ? knownCli.label : binaryName;
     warnings.push({
       probe_kind: 'transport_intent',
       level: 'warn',
-      detail: `${transportLabel} typically uses "${knownTransport}" transport, but this runtime is configured with "${transport}"`,
-      fix: `Set prompt_transport to "${knownTransport}" or "dispatch_bundle_only"`,
+      detail: `${transportLabel} typically uses ${knownTransports.map((value) => `"${value}"`).join(' or ')} transport, but this runtime is configured with "${transport}"`,
+      fix: `Set prompt_transport to ${knownTransports.map((value) => `"${value}"`).join(' or ')} or "dispatch_bundle_only"`,
     });
   }
 
@@ -414,7 +429,7 @@ export async function probeConnectorRuntime(runtimeId, runtime, options = {}) {
   }
 
   if (runtime.type === 'local_cli') {
-    const result = await probeLocalCommand(runtimeId, runtime, 'command_presence');
+    const result = await probeLocalCommand(runtimeId, runtime, 'command_presence', options);
     // Add authority-intent and transport analysis when roles are available
     if (roles) {
       const { warnings } = analyzeLocalCliAuthorityIntent(runtimeId, runtime, roles);
@@ -437,7 +452,7 @@ export async function probeConnectorRuntime(runtimeId, runtime, options = {}) {
     if (runtime.transport === 'streamable_http') {
       return probeHttpRuntime(runtimeId, runtime, timeoutMs);
     }
-    return probeLocalCommand(runtimeId, runtime, 'command_presence');
+    return probeLocalCommand(runtimeId, runtime, 'command_presence', options);
   }
 
   return probeHttpRuntime(runtimeId, runtime, timeoutMs);

package/src/lib/connector-validate.js

@@ -22,6 +22,7 @@ import { dispatchMcp } from './adapters/mcp-adapter.js';
 import { dispatchRemoteAgent } from './adapters/remote-agent-adapter.js';
 import { getDispatchPromptPath, getTurnStagingResultPath } from './turn-paths.js';
 import { validateStagedTurnResult } from './turn-result-validator.js';
+import { probeRuntimeSpawnContext } from './runtime-spawn-context.js';
 
 const VALIDATABLE_RUNTIME_TYPES = new Set(['local_cli', 'api_proxy', 'mcp', 'remote_agent']);
 const DEFAULT_VALIDATE_TIMEOUT_MS = 120_000;
@@ -130,6 +131,26 @@ export async function validateConfiguredConnector(sourceRoot, options = {}) {
       };
     }
 
+    if (runtime.type === 'local_cli' || (runtime.type === 'mcp' && (runtime.transport || 'stdio') !== 'streamable_http')) {
+      const spawnProbe = probeRuntimeSpawnContext(scratchRoot, scratchContext.config.runtimes[runtimeId], { runtimeId });
+      if (!spawnProbe.ok) {
+        return {
+          ok: false,
+          exitCode: 1,
+          overall: 'fail',
+          runtime_id: runtimeId,
+          runtime_type: runtime.type,
+          role_id: roleSelection.roleId,
+          timeout_ms: timeoutMs,
+          warnings,
+          dispatch: null,
+          validation: null,
+          error: spawnProbe.detail,
+          scratch_root: scratchRoot,
+        };
+      }
+    }
+
     const initResult = initializeGovernedRun(scratchRoot, scratchContext.config, {
       provenance: {
         trigger: 'connector_validate',

package/src/lib/dashboard/plan-reader.js

@@ -85,6 +85,17 @@ function buildPlanSummary(plan) {
       completed_at: lr.completed_at || null,
       status: lr.status,
       terminal_reason: lr.terminal_reason || null,
+      dispatch_mode: lr.dispatch_mode || null,
+      ...(lr.dispatch_mode === 'coordinator' && Array.isArray(lr.repo_dispatches) ? {
+        repo_dispatches: lr.repo_dispatches.map((rd) => ({
+          repo_id: rd.repo_id,
+          repo_turn_id: rd.repo_turn_id,
+          role: rd.role,
+          dispatched_at: rd.dispatched_at,
+          ...(rd.is_retry ? { is_retry: true, retry_of: rd.retry_of } : {}),
+          ...(rd.retried_at ? { retried_at: rd.retried_at, retry_reason: rd.retry_reason } : {}),
+        })),
+      } : {}),
     })),
   };
 }

package/src/lib/governed-state.js

@@ -2488,7 +2488,8 @@ export function reissueTurn(root, config, opts = {}) {
   const oldRuntimeId = oldTurn.runtime_id;
 
   // Resolve current runtime binding (may have changed in config)
-  const currentRuntimeId = role.runtime;
+  // BUG-25 fix: normalized config uses runtime_id, raw config uses runtime
+  const currentRuntimeId = role.runtime_id || role.runtime;
   const currentRuntime = config.runtimes?.[currentRuntimeId];
   if (!currentRuntime) {
     return { ok: false, error: `Runtime "${currentRuntimeId}" not found in config for role "${roleId}"` };

package/src/lib/mission-plans.js

@@ -6,11 +6,15 @@
  * Plans are NOT protocol-normative.
  */
 
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'fs';
+import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'fs';
 import { randomUUID } from 'crypto';
 import { join } from 'path';
 import { loadChainReport } from './chain-reports.js';
-import { readBarriers, readCoordinatorHistory } from './coordinator-state.js';
+import { writeDispatchBundle } from './dispatch-bundle.js';
+import { loadProjectContext, loadProjectState } from './config.js';
+import { reissueTurn } from './governed-state.js';
+import { emitRunEvent } from './run-events.js';
+import { readBarriers, readCoordinatorHistory, recordCoordinatorDecision } from './coordinator-state.js';
 import { loadCoordinatorConfig } from './coordinator-config.js';
 
 // ── Plan artifact directory ──────────────────────────────────────────────────
@@ -486,6 +490,7 @@ function isAcceptedRepoHistoryEntry(entry) {
 }
 
 const REPO_FAILURE_STATUSES = new Set(['failed_acceptance', 'failed', 'rejected', 'retrying', 'conflicted']);
+const RETRYABLE_COORDINATOR_FAILURE_STATUSES = new Set(['failed', 'failed_acceptance']);
 
 function getLatestRepoDispatches(launchRecord) {
   const latestByRepo = new Map();
@@ -554,6 +559,76 @@ function buildCoordinatorRepoFailures(coordinatorConfig, launchRecord) {
   return failures;
 }
 
+function appendCoordinatorHistoryEntry(workspacePath, entry) {
+  const historyPath = join(workspacePath, '.agentxchain', 'multirepo', 'history.jsonl');
+  mkdirSync(join(workspacePath, '.agentxchain', 'multirepo'), { recursive: true });
+  appendFileSync(historyPath, `${JSON.stringify(entry)}\n`);
+}
+
+function findDependentDispatchAfter(plan, workstreamId, timestamp) {
+  const since = new Date(timestamp || 0).getTime();
+  if (Number.isNaN(since)) return null;
+
+  for (const candidate of plan.workstreams || []) {
+    if (!Array.isArray(candidate.depends_on) || !candidate.depends_on.includes(workstreamId)) {
+      continue;
+    }
+
+    for (const record of plan.launch_records || []) {
+      if (record?.workstream_id !== candidate.workstream_id) {
+        continue;
+      }
+
+      if (record.dispatch_mode === 'coordinator') {
+        for (const dispatch of record.repo_dispatches || []) {
+          const dispatchedAt = new Date(dispatch?.dispatched_at || 0).getTime();
+          if (!Number.isNaN(dispatchedAt) && dispatchedAt > since) {
+            return {
+              workstream_id: candidate.workstream_id,
+              repo_id: dispatch.repo_id || null,
+              dispatched_at: dispatch.dispatched_at || null,
+            };
+          }
+        }
+        continue;
+      }
+
+      const launchedAt = new Date(record.launched_at || 0).getTime();
+      if (!Number.isNaN(launchedAt) && launchedAt > since) {
+        return {
+          workstream_id: candidate.workstream_id,
+          repo_id: null,
+          dispatched_at: record.launched_at || null,
+        };
+      }
+    }
+  }
+
+  return null;
+}
+
+function loadRepoTurnForRetry(repoPath, repoTurnId) {
+  const context = loadProjectContext(repoPath);
+  if (!context) {
+    return { ok: false, error: `Repo at "${repoPath}" is not a loadable governed project.` };
+  }
+
+  const state = loadProjectState(context.root, context.config);
+  if (!state) {
+    return { ok: false, error: `Repo at "${repoPath}" has no governed state.` };
+  }
+
+  const activeTurn = state.active_turns?.[repoTurnId] || null;
+  if (!activeTurn) {
+    return {
+      ok: false,
+      error: `Repo turn "${repoTurnId}" is no longer active. Use repo-local recovery instead of coordinator --retry.`,
+    };
+  }
+
+  return { ok: true, root: context.root, config: context.config, state, activeTurn };
+}
+
 function buildCoordinatorWorkstreamProgress(coordinatorConfig, history, barriers, workstreamId) {
   const coordinatorWorkstream = coordinatorConfig?.workstreams?.[workstreamId];
   if (!coordinatorWorkstream) {
@@ -904,6 +979,188 @@ export function launchCoordinatorWorkstream(root, mission, planId, workstreamId,
   return { ok: true, plan: synced.ok ? synced.plan : plan, workstream: ws, launchRecord };
 }
 
+export function retryCoordinatorWorkstream(root, mission, planId, workstreamId, coordinatorConfig, options = {}) {
+  const plan = loadPlan(root, mission.mission_id, planId);
+  if (!plan) {
+    return { ok: false, error: `Plan not found: ${planId}` };
+  }
+  if (!mission?.coordinator?.workspace_path || !mission?.coordinator?.super_run_id) {
+    return { ok: false, error: 'Mission is not bound to a coordinator run.' };
+  }
+
+  const synced = synchronizeCoordinatorPlanState(root, mission, plan);
+  const workingPlan = synced.ok ? synced.plan : plan;
+  const ws = workingPlan.workstreams.find((candidate) => candidate.workstream_id === workstreamId);
+  if (!ws) {
+    return { ok: false, error: `Workstream not found: ${workstreamId}` };
+  }
+  if (ws.launch_status !== 'needs_attention') {
+    return {
+      ok: false,
+      error: `Workstream ${workstreamId} is not in needs_attention state. Nothing to retry.`,
+    };
+  }
+
+  const launchRecord = getLatestCoordinatorLaunchRecord(workingPlan, workstreamId);
+  if (!launchRecord) {
+    return { ok: false, error: `No coordinator launch record found for workstream ${workstreamId}.` };
+  }
+
+  const latestDispatchesByRepo = new Map(
+    getLatestRepoDispatches(launchRecord).map((dispatch) => [dispatch.repo_id, dispatch]),
+  );
+  const repoFailures = buildCoordinatorRepoFailures(coordinatorConfig, launchRecord);
+  launchRecord.repo_failures = repoFailures;
+
+  if (repoFailures.length === 0) {
+    return { ok: false, error: `Workstream ${workstreamId} has no retryable repo failures.` };
+  }
+
+  const retryableFailures = [];
+  const blockedFailures = [];
+
+  for (const failure of repoFailures) {
+    if (!RETRYABLE_COORDINATOR_FAILURE_STATUSES.has(failure.failure_status)) {
+      blockedFailures.push(`${failure.repo_id} (${failure.failure_status})`);
+      continue;
+    }
+    retryableFailures.push(failure);
+  }
+
+  if (retryableFailures.length === 0) {
+    return {
+      ok: false,
+      error: `No retryable repo failures in workstream ${workstreamId}. Manual intervention required: ${blockedFailures.join(', ')}`,
+    };
+  }
+
+  if (retryableFailures.length > 1) {
+    return {
+      ok: false,
+      error: `Workstream ${workstreamId} has multiple retryable repo failures. Recover them repo-locally one at a time before relaunching the coordinator workstream.`,
+    };
+  }
+
+  const failure = retryableFailures[0];
+  const failedDispatch = latestDispatchesByRepo.get(failure.repo_id);
+  if (!failedDispatch) {
+    return { ok: false, error: `Missing launch metadata for failed repo ${failure.repo_id}.` };
+  }
+
+  const downstreamBlocker = findDependentDispatchAfter(workingPlan, workstreamId, failedDispatch.dispatched_at);
+  if (downstreamBlocker) {
+    return {
+      ok: false,
+      error: `Cannot retry workstream ${workstreamId}: dependent workstream "${downstreamBlocker.workstream_id}" has already dispatched since the failed repo turn.`,
+    };
+  }
+
+  const repoPath = coordinatorConfig?.repos?.[failure.repo_id]?.resolved_path;
+  if (!repoPath) {
+    return { ok: false, error: `Coordinator config has no resolved_path for repo "${failure.repo_id}".` };
+  }
+
+  const repoTurn = loadRepoTurnForRetry(repoPath, failure.repo_turn_id);
+  if (!repoTurn.ok) {
+    return repoTurn;
+  }
+
+  const reason = options.reason || `coordinator retry: ${workstreamId}/${failure.repo_id}`;
+  const reissued = reissueTurn(repoTurn.root, repoTurn.config, {
+    turnId: failure.repo_turn_id,
+    reason,
+  });
+  if (!reissued.ok) {
+    return { ok: false, error: reissued.error };
+  }
+
+  const bundleResult = writeDispatchBundle(repoTurn.root, reissued.state, repoTurn.config, {
+    turnId: reissued.newTurn.turn_id,
+  });
+  if (!bundleResult.ok) {
+    return { ok: false, error: `Turn reissued but dispatch bundle failed: ${bundleResult.error}` };
+  }
+
+  const now = new Date().toISOString();
+  failedDispatch.retried_at = now;
+  failedDispatch.retry_reason = failure.failure_status;
+  launchRecord.repo_dispatches.push({
+    repo_id: failure.repo_id,
+    repo_turn_id: reissued.newTurn.turn_id,
+    role: reissued.newTurn.assigned_role,
+    dispatched_at: now,
+    bundle_path: bundleResult.bundlePath,
+    context_ref: failedDispatch.context_ref || null,
+    is_retry: true,
+    retry_of: failure.repo_turn_id,
+  });
+  launchRecord.status = 'launched';
+  launchRecord.repo_failures = [];
+  ws.launch_status = 'launched';
+
+  const otherNeedsAttention = (workingPlan.workstreams || []).some(
+    (candidate) => candidate.workstream_id !== workstreamId && candidate.launch_status === 'needs_attention',
+  );
+  workingPlan.status = otherNeedsAttention ? 'needs_attention' : 'approved';
+  workingPlan.updated_at = now;
+  writePlanArtifact(root, mission.mission_id, workingPlan);
+
+  appendCoordinatorHistoryEntry(mission.coordinator.workspace_path, {
+    type: 'coordinator_retry',
+    timestamp: now,
+    super_run_id: mission.coordinator.super_run_id,
+    workstream_id: workstreamId,
+    repo_id: failure.repo_id,
+    failed_turn_id: failure.repo_turn_id,
+    reissued_turn_id: reissued.newTurn.turn_id,
+    retry_reason: failure.failure_status,
+  });
+  recordCoordinatorDecision(mission.coordinator.workspace_path, {
+    super_run_id: mission.coordinator.super_run_id,
+    phase: coordinatorConfig?.workstreams?.[workstreamId]?.phase || null,
+  }, {
+    category: 'retry',
+    statement: `Retried ${failure.repo_id} for workstream ${workstreamId}`,
+    repo_id: failure.repo_id,
+    repo_turn_id: reissued.newTurn.turn_id,
+    workstream_id: workstreamId,
+    reason: failure.failure_status,
+    context_ref: failedDispatch.context_ref || null,
+  });
+  emitRunEvent(mission.coordinator.workspace_path, 'coordinator_retry', {
+    run_id: mission.coordinator.super_run_id,
+    phase: coordinatorConfig?.workstreams?.[workstreamId]?.phase || null,
+    status: 'active',
+    turn: { turn_id: reissued.newTurn.turn_id, role_id: reissued.newTurn.assigned_role },
+    payload: {
+      workstream_id: workstreamId,
+      repo_id: failure.repo_id,
+      failed_turn_id: failure.repo_turn_id,
+      reissued_turn_id: reissued.newTurn.turn_id,
+      retry_reason: failure.failure_status,
+      retry_count: launchRecord.repo_dispatches.filter((dispatch) => dispatch.repo_id === failure.repo_id && dispatch.is_retry).length,
+    },
+  });
+
+  const afterRetry = synchronizeCoordinatorPlanState(root, mission, workingPlan);
+  return {
+    ok: true,
+    plan: afterRetry.ok ? afterRetry.plan : workingPlan,
+    workstream: ws,
+    launchRecord,
+    retryResult: {
+      repo_id: failure.repo_id,
+      failed_turn_id: failure.repo_turn_id,
+      reissued_turn_id: reissued.newTurn.turn_id,
+      role: reissued.newTurn.assigned_role,
+      repo_path: repoTurn.root,
+      bundle_path: bundleResult.bundlePath,
+      context_ref: failedDispatch.context_ref || null,
+      retry_reason: failure.failure_status,
+    },
+  };
+}
+
 /**
  * Record the outcome of a launched workstream after its chain completes.
  *

package/src/lib/release-alignment.js

@@ -311,9 +311,23 @@ export function validateReleaseAlignment(repoRoot, { targetVersion, scope = RELE
   const context = getReleaseAlignmentContext(repoRoot, { targetVersion });
   const surfaces = RELEASE_ALIGNMENT_SURFACES.filter((surface) => surface.scopes.includes(scope));
   const errors = [];
+  const surfaceResults = [];
 
   for (const surface of surfaces) {
-    const surfaceErrors = surface.check(context, repoRoot) || [];
+    let surfaceErrors = [];
+    try {
+      surfaceErrors = surface.check(context, repoRoot) || [];
+    } catch (error) {
+      surfaceErrors = [
+        error instanceof Error ? error.message : String(error),
+      ];
+    }
+    surfaceResults.push({
+      surface_id: surface.id,
+      label: surface.label,
+      ok: surfaceErrors.length === 0,
+      errors: surfaceErrors,
+    });
     for (const error of surfaceErrors) {
       errors.push({
         surface_id: surface.id,
@@ -331,6 +345,12 @@ export function validateReleaseAlignment(repoRoot, { targetVersion, scope = RELE
     aggregateEvidenceLine: context.aggregateEvidenceLine,
     checkedSurfaceCount: surfaces.length,
     checkedSurfaceIds: surfaces.map((surface) => surface.id),
+    checkedSurfaces: surfaces.map((surface) => ({
+      id: surface.id,
+      label: surface.label,
+      scopes: [...surface.scopes],
+    })),
+    surfaceResults,
     errors,
   };
 }

package/src/lib/run-events.js

@@ -21,6 +21,7 @@ export const VALID_RUN_EVENTS = [
   'acceptance_failed',
   'turn_reissued',
   'turn_checkpointed',
+  'coordinator_retry',
   'run_blocked',
   'run_completed',
   'escalation_raised',

package/src/lib/runtime-spawn-context.js

@@ -0,0 +1,163 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { basename, join } from 'node:path';
+
+const DEFAULT_PROBE_TIMEOUT_MS = 500;
+const PROMPT_PLACEHOLDER = 'AgentXchain spawn-context probe';
+
+function resolveLocalCliPromptTransport(runtime) {
+  const valid = new Set(['argv', 'stdin', 'dispatch_bundle_only']);
+  if (valid.has(runtime?.prompt_transport)) {
+    return runtime.prompt_transport;
+  }
+
+  const parts = Array.isArray(runtime?.command)
+    ? runtime.command
+    : [runtime?.command, ...(Array.isArray(runtime?.args) ? runtime.args : [])];
+  const hasPrompt = parts.some((part) => typeof part === 'string' && part.includes('{prompt}'));
+  return hasPrompt ? 'argv' : 'dispatch_bundle_only';
+}
+
+function resolveLocalCliInvocation(runtime) {
+  if (!runtime?.command) {
+    return { command: null, args: [] };
+  }
+
+  const transport = resolveLocalCliPromptTransport(runtime);
+
+  if (Array.isArray(runtime.command)) {
+    const first = runtime.command[0] || '';
+    const headParts = typeof first === 'string' && first.includes(' ') ? first.split(/\s+/) : [first];
+    const [command, ...headArgs] = headParts;
+    const rest = [...headArgs, ...runtime.command.slice(1)];
+    const args = transport === 'argv'
+      ? rest.map((arg) => arg === '{prompt}' ? PROMPT_PLACEHOLDER : arg)
+      : rest.filter((arg) => arg !== '{prompt}');
+    return { command, args };
+  }
+
+  const args = transport === 'argv'
+    ? (runtime.args || []).map((arg) => arg === '{prompt}' ? PROMPT_PLACEHOLDER : arg)
+    : (runtime.args || []).filter((arg) => arg !== '{prompt}');
+  return { command: runtime.command, args };
+}
+
+function resolveMcpInvocation(runtime) {
+  if (!runtime?.command) {
+    return { command: null, args: [] };
+  }
+
+  if (Array.isArray(runtime.command)) {
+    const [command, ...args] = runtime.command;
+    return { command, args };
+  }
+
+  return {
+    command: runtime.command,
+    args: Array.isArray(runtime.args) ? runtime.args : [],
+  };
+}
+
+function resolveInvocation(runtime) {
+  if (runtime?.type === 'local_cli') {
+    return resolveLocalCliInvocation(runtime);
+  }
+  return resolveMcpInvocation(runtime);
+}
+
+function buildResolutionFix(command) {
+  const commandValue = String(command || '');
+  const commandBase = basename(commandValue);
+
+  if (commandBase === 'codex' || commandBase === 'codex.exe') {
+    return 'Set "command" to the absolute path, e.g. "/Applications/Codex.app/Contents/Resources/codex", or add Codex to PATH in the dispatch spawn context.';
+  }
+  if (commandValue.includes('~')) {
+    return 'Expand "~" to an absolute path in "command". Shell expansion does not apply to governed dispatch.';
+  }
+  return 'Set "command" to an absolute path or add it to PATH in the dispatch spawn context.';
+}
+
+export function probeRuntimeSpawnContext(root, runtime, options = {}) {
+  const runtimeId = options.runtimeId || null;
+  const cwd = runtime?.cwd ? join(root, runtime.cwd) : root;
+  const { command, args } = resolveInvocation(runtime);
+
+  if (!command) {
+    return {
+      ok: false,
+      runtime_id: runtimeId,
+      command: null,
+      cwd,
+      detail: 'No command configured for the dispatch spawn context.',
+    };
+  }
+
+  if (!existsSync(cwd)) {
+    return {
+      ok: false,
+      runtime_id: runtimeId,
+      command,
+      cwd,
+      detail: `Runtime cwd "${runtime.cwd}" does not exist in the dispatch spawn context.`,
+    };
+  }
+
+  const probe = spawnSync(command, args, {
+    cwd,
+    env: { ...process.env, AGENTXCHAIN_SPAWN_PROBE: '1' },
+    stdio: 'ignore',
+    timeout: options.timeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS,
+    windowsHide: true,
+  });
+
+  if (probe.error) {
+    const errorCode = probe.error.code || 'spawn_error';
+    if (errorCode === 'ETIMEDOUT') {
+      return {
+        ok: true,
+        runtime_id: runtimeId,
+        command,
+        cwd,
+        timed_out: true,
+        detail: `"${command}" launched in the dispatch spawn context but exceeded the short probe timeout. Treating this as resolvable.`,
+      };
+    }
+    if (errorCode === 'ENOENT') {
+      return {
+        ok: false,
+        runtime_id: runtimeId,
+        command,
+        cwd,
+        error_code: errorCode,
+        detail: `"${command}" is not resolvable in the dispatch spawn context. ${buildResolutionFix(command)}`,
+      };
+    }
+    if (errorCode === 'EACCES') {
+      return {
+        ok: false,
+        runtime_id: runtimeId,
+        command,
+        cwd,
+        error_code: errorCode,
+        detail: `"${command}" exists but is not executable in the dispatch spawn context. Mark it executable or point "command" at the real executable path.`,
+      };
+    }
+    return {
+      ok: false,
+      runtime_id: runtimeId,
+      command,
+      cwd,
+      error_code: errorCode,
+      detail: `Dispatch spawn probe failed for "${command}": ${probe.error.message}`,
+    };
+  }
+
+  return {
+    ok: true,
+    runtime_id: runtimeId,
+    command,
+    cwd,
+    detail: `"${command}" is resolvable in the dispatch spawn context.`,
+  };
+}