ai-delivery-workflow 0.5.0 → 0.5.1

package/lib/project-repair.mjs

@@ -0,0 +1,217 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { parse as parseYaml } from "yaml";
+import { atomicWrite, filesUnder } from "./fs-utils.mjs";
+
+function toPosix(value) {
+  return value.replaceAll("\\", "/");
+}
+
+function sha256(value) {
+  return crypto.createHash("sha256").update(value).digest("hex");
+}
+
+function treeDigest(root) {
+  const hash = crypto.createHash("sha256");
+  for (const file of filesUnder(root)) {
+    hash.update(toPosix(path.relative(root, file)));
+    hash.update("\0");
+    hash.update(fs.readFileSync(file));
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+
+function readStructured(file, label) {
+  try {
+    const text = fs.readFileSync(file, "utf8");
+    const value = path.extname(file).toLowerCase() === ".json" ? JSON.parse(text) : parseYaml(text);
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("expected a mapping");
+    return value;
+  } catch (error) {
+    throw new Error(`Cannot read ${label} (${toPosix(file)}): ${error.message}`);
+  }
+}
+
+function stableValue(value) {
+  if (Array.isArray(value)) return value.map(stableValue);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stableValue(value[key])]));
+}
+
+function stableJson(value) {
+  return JSON.stringify(stableValue(value));
+}
+
+function uniqueSorted(values) {
+  return [...new Set((Array.isArray(values) ? values : []).map(String))].sort();
+}
+
+function unsignedRepairRecord(record) {
+  const unsigned = { ...record };
+  delete unsigned.record_checksum;
+  return unsigned;
+}
+
+function readRepairTransactions(project) {
+  const directory = path.join(project, ".workflow", "control", "repairs", "transactions");
+  const records = [];
+  let previousChecksum = null;
+  for (const file of filesUnder(directory).filter((item) => item.endsWith(".json"))) {
+    const record = readStructured(file, "repair transaction");
+    if (record.schema_version !== 1
+      || !Number.isInteger(record.sequence)
+      || record.sequence !== records.length + 1
+      || record.previous_checksum !== previousChecksum
+      || record.record_checksum !== sha256(stableJson(unsignedRepairRecord(record)))) {
+      throw new Error(`Repair transaction chain is invalid: ${toPosix(path.relative(project, file))}.`);
+    }
+    records.push(record);
+    previousChecksum = record.record_checksum;
+  }
+  return records;
+}
+
+function archiveIterationId(value) {
+  const iterationId = String(value || "");
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(iterationId)) {
+    throw new Error(`Invalid archive iteration ID: ${iterationId || "missing"}.`);
+  }
+  return iterationId;
+}
+
+function verifiedArchiveInvalidations(project, records) {
+  for (const record of records.filter((item) => item.transaction_type === "archive-invalidation")) {
+    const iterationId = archiveIterationId(record.target?.iteration_id);
+    const expectedArchivePath = `.workflow/control/archives/versions/${iterationId}`;
+    const expectedManifestPath = `${expectedArchivePath}/version-manifest.json`;
+    if (record.target.archive_path !== expectedArchivePath
+      || record.target.manifest_path !== expectedManifestPath
+      || !/^[a-f0-9]{64}$/.test(record.target.archive_sha256 || "")
+      || !/^[a-f0-9]{64}$/.test(record.target.manifest_sha256 || "")) {
+      throw new Error(`Archive invalidation target is invalid: ${record.transaction_id}.`);
+    }
+    const archiveDirectory = path.join(project, ...expectedArchivePath.split("/"));
+    const manifestFile = path.join(project, ...expectedManifestPath.split("/"));
+    if (!fs.existsSync(manifestFile)
+      || treeDigest(archiveDirectory) !== record.target.archive_sha256
+      || sha256(fs.readFileSync(manifestFile)) !== record.target.manifest_sha256) {
+      throw new Error(`Invalidated archive ${iterationId} bytes changed after ${record.transaction_id}.`);
+    }
+  }
+}
+
+function repairTransactionPath(sequence, transactionId) {
+  return `.workflow/control/repairs/transactions/${String(sequence).padStart(6, "0")}-${transactionId}.json`;
+}
+
+export function repairProject(project, options = {}) {
+  const root = path.resolve(project);
+  if (!fs.existsSync(root) || !fs.statSync(root).isDirectory()) {
+    throw new Error(`Project directory does not exist: ${root}`);
+  }
+  const iterationId = archiveIterationId(options.invalidateArchive);
+  const reason = String(options.reason || "").trim();
+  const actor = String(options.actor || "").trim();
+  const evidence = uniqueSorted(options.evidence);
+  if (!reason) throw new Error("Archive invalidation requires --reason.");
+  if (!actor.startsWith("human:")) {
+    throw new Error("Archive invalidation requires an explicit human actor through --actor human:<identity>.");
+  }
+  if (evidence.length < 2) {
+    throw new Error("Archive invalidation requires at least two --evidence values for RCA and recovery evidence.");
+  }
+  const archiveDirectory = path.join(root, ".workflow", "control", "archives", "versions", iterationId);
+  const manifestFile = path.join(archiveDirectory, "version-manifest.json");
+  if (!fs.existsSync(manifestFile)) throw new Error(`Version archive not found: ${iterationId}.`);
+  const manifest = readStructured(manifestFile, "version archive manifest");
+  if (manifest.iteration_id !== iterationId) {
+    throw new Error(`Version archive identity mismatch: expected ${iterationId}, found ${manifest.iteration_id || "missing"}.`);
+  }
+  const target = {
+    iteration_id: iterationId,
+    archive_path: toPosix(path.relative(root, archiveDirectory)),
+    manifest_path: toPosix(path.relative(root, manifestFile)),
+    manifest_sha256: sha256(fs.readFileSync(manifestFile)),
+    archive_sha256: treeDigest(archiveDirectory),
+    original_bytes_preserved: true,
+  };
+  const identity = { transaction_type: "archive-invalidation", target, correction: { actor, reason, evidence } };
+  const idempotencyKey = `archive-invalidation:${iterationId}:${sha256(stableJson(identity))}`;
+  const existingTransactions = readRepairTransactions(root);
+  verifiedArchiveInvalidations(root, existingTransactions);
+  const existing = existingTransactions.find((record) => record.idempotency_key === idempotencyKey);
+  const sequence = existing?.sequence || existingTransactions.length + 1;
+  const transactionId = existing?.transaction_id || `REPAIR-${sha256(idempotencyKey).slice(0, 16).toUpperCase()}`;
+  const transactionPath = repairTransactionPath(sequence, transactionId);
+  const report = {
+    command: "repair",
+    action: "archive-invalidation",
+    dry_run: Boolean(options.dryRun),
+    applied: false,
+    forward_only: true,
+    original_bytes_preserved: true,
+    target,
+    actor,
+    reason,
+    evidence,
+    transaction: {
+      transaction_id: transactionId,
+      path: transactionPath,
+      previous_checksum: existing?.previous_checksum || existingTransactions.at(-1)?.record_checksum || null,
+    },
+    eligibility: existing
+      ? { iteration_id: iterationId, current: "invalidated", source_transaction_id: transactionId }
+      : { iteration_id: iterationId, current: "eligible", source_transaction_id: null },
+  };
+  if (report.dry_run || existing) return report;
+
+  const repairRoot = path.join(root, ".workflow", "control", "repairs");
+  const lockFile = path.join(repairRoot, ".repair.lock");
+  fs.mkdirSync(repairRoot, { recursive: true });
+  let lock;
+  try {
+    lock = fs.openSync(lockFile, "wx");
+  } catch (error) {
+    throw new Error(`Repair transaction is locked by another writer: ${error.message}`);
+  }
+  try {
+    const currentTransactions = readRepairTransactions(root);
+    const duplicate = currentTransactions.find((record) => record.idempotency_key === idempotencyKey);
+    if (duplicate) {
+      report.transaction.transaction_id = duplicate.transaction_id;
+      report.transaction.path = repairTransactionPath(duplicate.sequence, duplicate.transaction_id);
+      report.eligibility = { iteration_id: iterationId, current: "invalidated", source_transaction_id: duplicate.transaction_id };
+      return report;
+    }
+    if (currentTransactions.length !== existingTransactions.length
+      || (currentTransactions.at(-1)?.record_checksum || null) !== (existingTransactions.at(-1)?.record_checksum || null)) {
+      throw new Error("Repair transaction revision changed during apply; rerun the command.");
+    }
+    if (treeDigest(archiveDirectory) !== target.archive_sha256
+      || sha256(fs.readFileSync(manifestFile)) !== target.manifest_sha256) {
+      throw new Error(`Version archive changed during repair apply: ${iterationId}.`);
+    }
+    const transaction = {
+      schema_version: 1,
+      sequence,
+      transaction_id: transactionId,
+      transaction_type: "archive-invalidation",
+      idempotency_key: idempotencyKey,
+      occurred_at: new Date().toISOString(),
+      target,
+      correction: { actor, reason, evidence },
+      previous_checksum: existingTransactions.at(-1)?.record_checksum || null,
+    };
+    transaction.record_checksum = sha256(stableJson(transaction));
+    atomicWrite(path.join(root, ...transactionPath.split("/")), `${JSON.stringify(transaction, null, 2)}\n`);
+    report.applied = true;
+    report.transaction.previous_checksum = transaction.previous_checksum;
+    report.eligibility = { iteration_id: iterationId, current: "invalidated", source_transaction_id: transactionId };
+    return report;
+  } finally {
+    if (lock !== undefined) fs.closeSync(lock);
+    fs.rmSync(lockFile, { force: true });
+  }
+}

package/lib/toml-hooks.mjs

@@ -14,7 +14,6 @@ export const HOOK_EVENTS = [
 ];
 
 const HOOK_COMMAND = "node .workflow/tools/hooks/hook-event.mjs";
-const LEGACY_HOOK_COMMAND = "node .ai-delivery/hooks/hook-event.mjs";
 
 function hookBlock(event, newline) {
   return [
@@ -102,9 +101,8 @@ export function mergeHookConfig(existing, { force = false } = {}) {
   const newline = existing.includes("\r\n") ? "\r\n" : "\n";
   let text = existing.trimEnd();
   const actions = [];
-  if (text.includes(LEGACY_HOOK_COMMAND)) {
-    text = text.replaceAll(LEGACY_HOOK_COMMAND, HOOK_COMMAND);
-    actions.push("migrate AI delivery Hook command into .workflow/tools");
+  if (text.includes("node .ai-delivery/hooks/hook-event.mjs")) {
+    throw new Error("Unsupported legacy Hook command; remove the .ai-delivery handler before installing the current Hook.");
   }
   if (force) {
     const refreshed = removeDeliveryHandlerBlocks(text);

package/lib/workflow-manager-governance.mjs

@@ -24,7 +24,6 @@ export const WORKFLOW_MANAGER_GOVERNANCE_SCHEMA_VERSION = "workflow-manager.gove
 const RELATIONS_FILE = ".workflow/control/relations.yaml";
 const SETTINGS_FILE = ".workflow/config/manager-settings.json";
 const RECEIPTS_ROOT = ".workflow/control/receipts";
-const EVENTS_FILE = ".workflow/control/events/workflow-manager-events.jsonl";
 const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,191}$/;
 const SAFE_ENTITY_TYPE = /^[a-z][a-z0-9-]{0,63}$/;
 const RELATION_TYPES = new Set([
@@ -59,18 +58,6 @@ function contained(root, relative) {
   return absolute;
 }
 
-function atomicWrite(file, content) {
-  fs.mkdirSync(path.dirname(file), { recursive: true });
-  const temporary = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
-  fs.writeFileSync(temporary, content, { encoding: "utf8", flag: "wx" });
-  try {
-    fs.renameSync(temporary, file);
-  } catch (error) {
-    fs.rmSync(temporary, { force: true });
-    throw error;
-  }
-}
-
 function requireHuman(actor) {
   if (!/^human:[A-Za-z0-9._@/-]+$/.test(String(actor || ""))) {
     throw new Error("Governed confirmation requires actor human:<identity>");
@@ -92,16 +79,13 @@ function receiptFiles(root) {
 
 function replay(root, action, input, subject = null) {
   if (!input.idempotency_key) return null;
-  const legacyRequestChecksum = checksum({ action, input });
-  const governedRequestChecksum = workflowManagerRequestChecksum(action, input, subject);
+  const expectedRequestChecksum = workflowManagerRequestChecksum(action, input, subject);
   for (const file of receiptFiles(root)) {
     try {
       const receipt = JSON.parse(fs.readFileSync(file, "utf8"));
       if (receipt.action !== action || receipt.idempotency_key !== input.idempotency_key) continue;
-      const legacy = receipt.request_checksum === legacyRequestChecksum;
-      const governed = receipt.request_checksum === governedRequestChecksum
-        && (receipt.subject ?? null) === subject;
-      if (!legacy && !governed) {
+      if (receipt.request_checksum !== expectedRequestChecksum
+          || (receipt.subject ?? null) !== subject) {
         throw new Error("Idempotency key was already used for a different request");
       }
       return receipt;
@@ -112,34 +96,6 @@ function replay(root, action, input, subject = null) {
   return null;
 }
 
-function record(root, action, input, detail = {}) {
-  const timestamp = new Date().toISOString();
-  const receipt = {
-    schema_version: 1,
-    receipt_id: `WMG-${crypto.randomUUID()}`,
-    action,
-    actor: input.actor,
-    idempotency_key: input.idempotency_key || null,
-    request_checksum: checksum({ action, input }),
-    applied_at: timestamp,
-    ...detail,
-  };
-  receipt.receipt_checksum = checksum(receipt);
-  atomicWrite(contained(root, `${RECEIPTS_ROOT}/${receipt.receipt_id}.json`), `${JSON.stringify(receipt, null, 2)}\n`);
-  const event = {
-    schema_version: 1,
-    event_id: `WME-${crypto.randomUUID()}`,
-    type: `workflow-manager.${action}`,
-    occurred_at: timestamp,
-    receipt_id: receipt.receipt_id,
-    subject: detail.subject || null,
-  };
-  const eventFile = contained(root, EVENTS_FILE);
-  fs.mkdirSync(path.dirname(eventFile), { recursive: true });
-  fs.appendFileSync(eventFile, `${JSON.stringify(event)}\n`, "utf8");
-  return { receipt, event };
-}
-
 function relationsDocument(root) {
   const file = contained(root, RELATIONS_FILE);
   if (!fs.existsSync(file)) return { file, document: { schema_version: 1, revision: 0, relations: [] }, checksum: null };

package/lib/workspace.mjs

@@ -4,7 +4,6 @@ import { spawnSync } from "node:child_process";
 import { parse as parseYaml, stringify as stringifyYaml } from "./yaml-runtime.mjs";
 
 export const WORKSPACE_CONFIG = path.join(".workflow", "config", "workspace.yaml");
-export const LEGACY_WORKSPACE_CONFIG = path.join(".ai-delivery", "workspace.yaml");
 
 function toPosix(value) {
   return value.replaceAll("\\", "/");
@@ -114,7 +113,7 @@ function initializeWorkflowRepository(workspaceRoot, branch, remote, heads, acti
     const current = gitBranch(workspaceRoot);
     if (current !== branch) {
       if (gitHasCommit(workspaceRoot)) {
-        throw new Error(`Existing workflow repository must already use ${branch}; automatic migration is not supported.`);
+        throw new Error(`Existing workflow repository must already use ${branch}; automatic branch changes are not supported.`);
       }
       if (!dryRun) runGit(workspaceRoot, ["symbolic-ref", "HEAD", `refs/heads/${branch}`]);
     }
@@ -172,7 +171,7 @@ export function validateCodePath(workspaceRoot, codePath = "code") {
   if (!normalized || normalized.includes("/") || normalized === "." || normalized === "..") {
     throw new Error("Code path must be a relative direct child directory.");
   }
-  if (new Set([".git", ".workflow", ".ai-delivery", ".agents", ".codex"]).has(normalized)) {
+  if (new Set([".git", ".workflow", ".agents", ".codex"]).has(normalized)) {
     throw new Error(`Reserved code path: ${normalized}`);
   }
   const absolute = path.resolve(workspaceRoot, normalized);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-delivery-workflow",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Project-scoped Codex skills and hooks for artifact-driven AI software delivery",
   "type": "module",
   "repository": {
@@ -22,7 +22,7 @@
     "skills"
   ],
   "scripts": {
-    "test": "node --test verification/*.test.mjs",
+    "test": "node --test --test-concurrency=4 verification/*.test.mjs",
     "manager:build": "npm --prefix manager run build",
     "skills:validate": "node bin/validate-skills.mjs",
     "audit:generate": "node audit/generate-all.mjs",

package/skills/ai-delivery-bootstrap/SKILL.md

@@ -44,7 +44,7 @@ The first product question is the safe stopping point. Do not invent the initial
 - `codebase-uninitialized`: use packaged `ai-delivery bootstrap`, review the repository baseline, inventory, context index, and adoption assessment, then invoke `$ai-delivery-define-product` to distinguish observed behavior from intended product behavior.
 - `workflow-interrupted`: do not write bootstrap artifacts. If `runtime.next_action_owner` is `user`, return the recorded `next_action` as the single business question and perform no recovery, activation, checkpoint, task, artifact, or Git mutation. If it is `external`, report the recorded wait condition without mutation. Only an `agent`-owned next action may invoke `$ai-delivery-checkpoint-task recover`, reconcile reality, inspect the pending Evolution queue without applying changes mid-task, and continue `recommended_task_id`. When required input arrives, transfer ownership with both `--next-action-owner agent` and a new idempotent `--next-action`.
 - `workflow-ready`: when a queued task is recommended, first apply the same `next_action_owner` boundary; activate it through `$ai-delivery-checkpoint-task` only when the owner is `agent`. Otherwise use the reported specialist skill or `$ai-delivery-orchestrate` to derive the next development node. Treat `release-ready` versions as completed development evidence, not implicit release intent. Route to `$ai-delivery-orchestrate-release` only when the user explicitly requests a release.
-- `workflow-inconsistent`: stop automatic mutation, run the available project/package doctor internally, report exact conflicts, and obtain a repair decision. An installed project must use packaged `upgrade --dry-run` for managed installation drift and `migrate --dry-run` for legacy schema, task grouping, anchor, or archive conflicts rather than repeat `init`. Structural migration copies legacy-root workflow material, adds explicit task attempts, and preserves lifecycle and scope facts; grouping ambiguities require a source-checksum-bound `--decisions` document with a `human:` actor and rationale. Route an approved premature-archive correction through packaged `repair --invalidate-archive` with a human actor, reason, RCA evidence, and recovery evidence; the original archive remains immutable. Use `upgrade --force` only when the user explicitly approves replacing the reported managed files.
+- `workflow-inconsistent`: stop automatic mutation, run the available project/package doctor internally, report exact conflicts, and obtain an explicit repair decision. Use `upgrade --dry-run` for current managed installation drift; malformed current state, missing anchors, archive conflicts, and checksum drift fail closed until repaired through the governed current-state interface. Use `upgrade --force` only when the user explicitly approves replacing the reported managed files.
 
 ## Brownfield Rules
 

package/skills/ai-delivery-bootstrap/references/bootstrap-contract.md

@@ -28,7 +28,7 @@ After installation, `node .workflow/tools/bootstrap/bootstrap.mjs inspect` is th
 
 `ai-delivery bootstrap <project-root>` may initialize only `empty-uninitialized` and `codebase-uninitialized` projects through the project-scoped installer. Preserve existing code and configuration. On partial or conflicting installation, return `workflow-inconsistent` without writes. `--force` is allowed only after explicit user approval.
 
-For an installed legacy or conflicting state, keep Bootstrap read-only. Use packaged `migrate --dry-run` to report schema conversion, semantic task groups and ambiguities, state/archive conflicts, verified anchors, and exact file changes. A legacy root migration copies `delivery/`, `control/`, and `standards/` into `.workflow/` while preserving source bytes; flat task shards gain explicit attempts with checksummed rollback backups. Resolve grouping ambiguities only through a checksum-bound `--decisions` document with a `human:` actor and rationale. Migration must not activate or close tasks, infer completion, change scope, or rewrite legacy events. Incorrect archives require the separate packaged `repair --invalidate-archive` forward transaction with an explicit human actor, reason, RCA evidence, and recovery evidence; the original archive bytes remain authoritative history.
+For an installed or conflicting state, keep Bootstrap read-only and return `workflow-inconsistent` with the failing path and remediation. Use the packaged `repair --invalidate-archive` forward transaction only for an explicitly identified archive integrity defect; it records a human actor, reason, RCA evidence, and recovery evidence without rewriting immutable history.
 
 For an uninitialized project, generate repository inventory and context artifacts from the first read-only scan snapshot. Do not let installer-generated `AGENTS.md`, `.gitignore`, Hook, skill, standard, or delivery files contaminate the observed pre-install codebase baseline.
 

package/skills/ai-delivery-checkpoint-task/SKILL.md

@@ -11,10 +11,6 @@ Treat explicit task snapshots as authoritative. Treat Hook events as an audit tr
 
 Write portable task state to `.workflow/control/tasks/<task-id>.yaml` and `.workflow/control/checkpoints/<task-id>/<checkpoint-id>.yaml`. Keep only PID, heartbeat, temporary locks, raw Hook events, and unshared context under ignored `.workflow/delivery/runtime/`. Keep durable node documents under `.workflow/iterations/<iteration-id>/<node-id>/`; runtime snapshots never replace registered delivery artifacts. Resolve code branch and commit from `.workflow/config/workspace.yaml` and the nested code repository.
 
-## Legacy Node Boundary
-
-Legacy development nodes are read-only compatibility. `inspect` remains a strictly read-only diagnosis path for historical tasks. `init`, `activate`, `checkpoint`, `finish`, and `archive-version` reject legacy task targets before mutation or Hook dispatch; `recover` refuses to materialize them and `publish` refuses to share them. New tasks use only the `development-seven-node` route, while `R00-release-request` through `R10-release-archive` remain writable.
-
 ## Start Or Resume
 
 1. Locate the project root and shared state root.

package/skills/ai-delivery-checkpoint-task/references/checkpoint-contract.md

@@ -34,7 +34,7 @@ Keep `.workflow/delivery/runtime/` local and ignored. Persist durable stage outp
 
 `task-state.mjs` is the only runtime-state writer. Do not directly edit task JSON, checkpoint JSON, active-task markers, recovery output, or archive indexes. Formal workflow and artifact state belong to `.workflow/tools/state/state.mjs`; do not edit its YAML or JSONL streams directly.
 
-Legacy development nodes are read-only compatibility. `inspect` remains read-only for historical task diagnosis. `init`, `activate`, `checkpoint`, `finish`, and `archive-version` reject legacy task targets before mutation or Hook dispatch; `recover` does not hydrate them and `publish` does not share them. New task contracts use only the `development-seven-node` route, while `R00-release-request` through `R10-release-archive` remain writable.
+Task contracts use the current `development-seven-node` route or the independent `R00-release-request` through `R10-release-archive` release route. `inspect` is read-only diagnosis; `init`, `activate`, `checkpoint`, `finish`, `recover`, `archive-version`, and `publish` operate only on current task contracts.
 
 When the installed Evolution CLI exists, `init`, `activate`, `checkpoint`, `finish`, and `archive-version` emit idempotent schema 1 `task.before`, `task.after`, and `task.failed` events. An approved blocking `task.before` result stops the task command before mutation. Hook dispatch failures otherwise fail open as warnings and never replace checkpoint state as the completion authority.
 
@@ -75,7 +75,7 @@ For an installed dual-repository project, `task-state.mjs` resolves `code_branch
 
 `blockers` represents current unresolved blockers. A `blocked` update replaces that list; any transition to another status clears it. Historical blocker text remains available in prior checkpoints and events.
 
-`next_action_owner` is required in persisted state and has exactly three values: `agent`, `user`, or `external`; only a truly absent field in a legacy snapshot defaults to `agent`, while explicit null, empty, boolean, numeric, or unknown values are invalid. `user` and `external` are zero-mutation wait states. `recover` may report shared wait state but must not hydrate local task or resume files for it. After the required input arrives, `activate` requires both `--next-action-owner agent` and a new idempotent `--next-action`; it may atomically hydrate a missing local runtime snapshot from the matching shared shard and transfer ownership in the same transition. Same-revision local and shared content must have identical semantic checksums. Evidence arrays are ordered sets: replaying an already recorded `--evidence` value does not append a duplicate.
+`next_action_owner` is required in persisted state and has exactly three values: `agent`, `user`, or `external`; explicit null, empty, boolean, numeric, or unknown values are invalid. `user` and `external` are zero-mutation wait states. `recover` may report shared wait state but must not hydrate local task or resume files for it. After the required input arrives, `activate` requires both `--next-action-owner agent` and a new idempotent `--next-action`; it may atomically hydrate a missing local runtime snapshot from the matching shared shard and transfer ownership in the same transition. Same-revision local and shared content must have identical semantic checksums. Evidence arrays are ordered sets: replaying an already recorded `--evidence` value does not append a duplicate.
 
 Pass `--state-root` when worktrees must write to one shared primary state directory. Pass `--worktree` during init so the script writes a local `.workflow/delivery/runtime/active-task.json` marker pointing to that state root. Later `checkpoint`, `finish`, and `recover` commands automatically use the marker's shared state root.
 

package/skills/ai-delivery-checkpoint-task/scripts/hook-event.mjs

@@ -144,15 +144,9 @@ function enforceFrontendGuard(projectRoot, input) {
 }
 
 try {
-  const currentProjectFile = findUp(process.cwd(), path.join(".workflow", "delivery", "project.yaml"));
-  const legacyProjectFile = currentProjectFile
-    ? null
-    : findUp(process.cwd(), path.join("delivery", "project.yaml"));
-  const projectFile = currentProjectFile || legacyProjectFile;
+  const projectFile = findUp(process.cwd(), path.join(".workflow", "delivery", "project.yaml"));
   if (!projectFile) process.exit(0);
-  const projectRoot = currentProjectFile
-    ? path.dirname(path.dirname(path.dirname(projectFile)))
-    : path.dirname(path.dirname(projectFile));
+  const projectRoot = path.dirname(path.dirname(path.dirname(projectFile)));
   const markerFile = path.join(projectRoot, ".workflow", "delivery", "runtime", "active-task.json");
   const marker = fs.existsSync(markerFile) ? JSON.parse(fs.readFileSync(markerFile, "utf8")) : null;
   const raw = await readStdin();

package/skills/ai-delivery-checkpoint-task/scripts/task-state.mjs

@@ -42,19 +42,13 @@ const REPEATABLE_ARGS = new Set([
   "completed-step", "blocker", "evidence", "depends-on", "acceptance", "finding-json",
   "change-set-json",
 ]);
-const LEGACY_DEVELOPMENT_NODE_IDS = new Set([
-  "01-product-discovery",
-  "02-product-definition",
-  "03-architecture-initial",
-  "04-experience-design",
-  "05-architecture-reconcile",
-  "06-platform-preparation",
-  "07-iteration-planning",
-  "08-test-design",
-  "09-development",
-  "10-change-review",
-  "11-candidate-verification",
-  "12-version-closeout",
+const VALID_NODE_IDS = new Set([
+  "00-bootstrap", "01-product-shaping", "02-solution-design", "03-delivery-readiness",
+  "04-implementation", "05-candidate-assurance", "06-version-closeout",
+  "R00-release-request", "R01-version-selection", "R02-release-eligibility", "R03-material-aggregation",
+  "R04-release-candidate", "R05-release-verification", "R06-release-preparation", "R07-production-approval",
+  "R08-production-deployment", "R09-production-verification", "R10-release-archive",
+  "development", "implementation", "planning", "test", "review",
 ]);
 
 function parseArgs(argv) {
@@ -83,10 +77,8 @@ function requireValue(args, key) {
   return value;
 }
 
-function assertNotLegacyDevelopmentNode(node) {
-  if (LEGACY_DEVELOPMENT_NODE_IDS.has(node)) {
-    throw new Error(`Legacy workflow node is read-only: ${node}`);
-  }
+function assertCurrentNode(node) {
+  if (!VALID_NODE_IDS.has(node)) throw new Error(`Unsupported workflow node: ${node}`);
   return node;
 }
 
@@ -720,7 +712,7 @@ function repairChangesSinceBaseline(workflowRoot, baseline) {
 }
 
 function writeSharedTask(runtime, workflowRoot, task) {
-  assertNotLegacyDevelopmentNode(task.node);
+  assertCurrentNode(task.node);
   const sharedFile = sharedTaskFile(workflowRoot, task.task_id);
   let previousRevision = 0;
   if (fs.existsSync(sharedFile)) {
@@ -786,25 +778,15 @@ function normalizeTask(task) {
     task[key] = [...new Set(task[key])];
   }
   task.sequence = parseSequence(task.sequence);
-  task.next_action_owner = parseNextActionOwner(task.next_action_owner);
-  task.responsibility = task.responsibility || task.skill || "agent";
+  task.next_action_owner = parseNextActionOwner(task.next_action_owner, undefined);
+  if (!task.responsibility) throw new Error(`Task ${task.task_id || "unknown"} is missing responsibility.`);
   task.derived_from = task.derived_from || null;
   task.supersedes = task.supersedes || null;
-  if (!Array.isArray(task.attempts)) {
-    const legacyNumber = Number(task.attempt || 0);
-    task.attempts = legacyNumber > 0 && (task.started_at || task.status !== "queued")
-      ? [normalizeAttempt(task.task_id, {
-        number: legacyNumber,
-        status: projectedTaskStatus(task.status, "attempt"),
-        started_at: task.started_at || task.created_at || null,
-        finished_at: CLOSED_STATUS.has(task.status) ? task.finished_at || task.updated_at || null : null,
-      }, legacyNumber)]
-      : [];
-  } else {
-    task.attempts = task.attempts.map((attempt, index) => normalizeAttempt(task.task_id, attempt, index + 1));
+  if (Object.prototype.hasOwnProperty.call(task, "attempt") || !Array.isArray(task.attempts)) {
+    throw new Error(`Task ${task.task_id || "unknown"} must use canonical attempts.`);
   }
+  task.attempts = task.attempts.map((attempt, index) => normalizeAttempt(task.task_id, attempt, index + 1));
   task.change_sets = Array.isArray(task.change_sets) ? task.change_sets.map((item) => normalizeChangeSet(item)) : [];
-  task.attempt = task.attempts.at(-1)?.number || 0;
   return task;
 }
 
@@ -852,7 +834,6 @@ function startAttempt(task, phase, timestamp) {
     time_entries: [],
   }, number);
   task.attempts.push(attempt);
-  task.attempt = number;
   return attempt;
 }
 
@@ -1379,7 +1360,7 @@ function summarizeIteration(tasks, iterationId) {
 function commandInit(args) {
   const taskId = sanitizeId(requireValue(args, "task-id"));
   const iterationId = sanitizeId(requireValue(args, "iteration-id"));
-  const node = assertNotLegacyDevelopmentNode(requireValue(args, "node"));
+  const node = assertCurrentNode(requireValue(args, "node"));
   const { projectRoot, stateRoot, workflowRoot, runtime } = statePaths(args);
   return withTaskLock(runtime, `version.${iterationId}`, () => withTaskLock(runtime, taskId, () => {
     if (fs.existsSync(archivedTaskIndexFile(runtime, taskId))) {
@@ -1424,6 +1405,7 @@ function commandInit(args) {
     const candidateContract = normalizeTask({
       ...(existing || {}),
       ...contractFields,
+      attempts: existing?.attempts || [],
       next_action_owner: existing?.next_action_owner || "agent",
     });
     if (existing) {
@@ -1459,7 +1441,6 @@ function commandInit(args) {
       ...contractFields,
       status,
       sequence: parseSequence(args.sequence ?? existing?.sequence),
-      attempt: 0,
       attempts: [],
       change_sets: [],
       input_artifacts: args["input-artifact"] || existing?.input_artifacts || [],
@@ -1486,7 +1467,7 @@ function commandInit(args) {
     clearTaskMarker(task);
     appendEvent(runtime, taskId, "task-initialized", {
       status: task.status,
-      attempt: task.attempt,
+      attempt_count: task.attempts.length,
       derived_from: task.derived_from,
       supersedes: task.supersedes,
     });
@@ -1557,7 +1538,6 @@ function commandActivate(args) {
       phase.status = "active";
       phase.finished_at = null;
     }
-    task.attempt = attempt.number;
     task.started_at ||= timestamp;
     task.updated_at = timestamp;
     task.finished_at = null;
@@ -1573,7 +1553,7 @@ function commandActivate(args) {
     });
     appendEvent(runtime, taskId, "task-activated", {
       status,
-      attempt: task.attempt,
+      attempt_count: task.attempts.length,
       attempt_id: attempt.attempt_id,
       phase: attempt.phases.at(-1)?.phase || null,
       new_attempt: newAttempt,
@@ -1627,7 +1607,7 @@ function commandUpdate(args, finish = false) {
     writeResume(runtime, task);
     appendEvent(runtime, taskId, finish ? "task-finished" : "task-checkpointed", {
       status,
-      attempt: attempt.number,
+      attempt_number: attempt.number,
       attempt_id: attempt.attempt_id,
       phase: attempt.phases.at(-1)?.phase || null,
     });
@@ -1696,7 +1676,7 @@ function commandArchiveVersion(args) {
       .map((name) => normalizeTask(JSON.parse(fs.readFileSync(path.join(tasksDir, name), "utf8"))))
       .filter((task) => task.iteration_id === iterationId);
     if (!tasks.length) throw new Error(`No tasks found for version: ${iterationId}`);
-    for (const task of tasks) assertNotLegacyDevelopmentNode(task.node);
+    for (const task of tasks) assertCurrentNode(task.node);
     const sharedById = new Map(readSharedTasks(workflowRoot, stateRoot).map((task) => [task.task_id, task]));
     for (const task of tasks) {
       const shared = sharedById.get(task.task_id);
@@ -1795,7 +1775,7 @@ function commandRecover(args) {
   const reportableTasks = selectedTasks
     .filter((task) => !requested || task.task_id === requested)
     .filter((task) => includeClosed || !RECOVERY_COMPLETE_STATUS.has(task.status));
-  for (const task of reportableTasks) assertNotLegacyDevelopmentNode(task.node);
+  for (const task of reportableTasks) assertCurrentNode(task.node);
   for (const task of reportableTasks) {
     if (missingLocalTaskIds.has(task.task_id)) atomicWrite(taskFile(runtime, task.task_id), task);
   }
@@ -1853,7 +1833,7 @@ function commandPublish(args) {
   const checkpointDirectory = path.join(workflowRoot, "control", "checkpoints", taskId);
   if (!fs.existsSync(sharedFile)) throw new Error(`Shared task state not found: ${taskId}`);
   const shared = JSON.parse(fs.readFileSync(sharedFile, "utf8"));
-  assertNotLegacyDevelopmentNode(shared.node);
+  assertCurrentNode(shared.node);
 
   const repository = gitState(stateRoot);
   if (!repository.repository || path.resolve(repository.root).toLowerCase() !== path.resolve(stateRoot).toLowerCase()) {
@@ -1978,7 +1958,7 @@ function assertWritableEvolutionTarget(args, command) {
   if (!new Set(["init", "activate", "checkpoint", "finish", "archive-version"]).has(command)) return;
   if (command === "init") {
     const node = args.node && args.node !== true ? String(args.node) : null;
-    if (node) assertNotLegacyDevelopmentNode(node);
+    if (node) assertCurrentNode(node);
     return;
   }
   const { runtime, workflowRoot, stateRoot } = statePaths(args);
@@ -1990,14 +1970,14 @@ function assertWritableEvolutionTarget(args, command) {
     if (!iterationId || !fs.existsSync(tasksDir)) return;
     for (const name of fs.readdirSync(tasksDir).filter((item) => item.endsWith(".json"))) {
       const task = normalizeTask(JSON.parse(fs.readFileSync(path.join(tasksDir, name), "utf8")));
-      if (task.iteration_id === iterationId) assertNotLegacyDevelopmentNode(task.node);
+      if (task.iteration_id === iterationId) assertCurrentNode(task.node);
     }
     return;
   }
   const taskId = args["task-id"] && args["task-id"] !== true ? sanitizeId(args["task-id"]) : null;
   if (!taskId) return;
   const task = taskSources(runtime, workflowRoot, stateRoot, taskId).task;
-  if (task) assertNotLegacyDevelopmentNode(task.node);
+  if (task) assertCurrentNode(task.node);
 }
 
 function dispatchTaskEvolution(context, phase, result = null, error = null) {