akm-cli 0.10.261012-beta → 0.10.261013-beta

package/dist/workflows/freeze/targets/shell.js

@@ -1,7 +1,6 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-import { captureFrozenDirectoryIdentity } from "../../../execution/directory-identity.js";
 import { freezeEnvironment } from "../environment.js";
 import { freezeExecSpec, } from "../step-values.js";
 export function directShell(source, baseUnit, context) {
@@ -9,13 +8,11 @@ export function directShell(source, baseUnit, context) {
     if (!authoredExec)
         throw new Error(`workflow shell step ${source.id} has no argv`);
     const exec = freezeExecSpec(source, authoredExec, context);
-    const cwdIdentity = captureFrozenDirectoryIdentity(context.asset.sourcePath, authoredExec.cwd);
     const environment = Object.freeze(freezeEnvironment(source, authoredExec, context));
     const target = Object.freeze({
         kind: "shell",
         contentHash: "",
         exec,
-        cwdIdentity,
     });
     return {
         target,

package/dist/workflows/parser.js

@@ -35,7 +35,7 @@ import { LineCounter, parseDocument } from "yaml";
 import { bundleRefToString, parseBundleRef } from "../core/asset/asset-ref.js";
 import { parseFrontmatterBlock } from "../core/asset/frontmatter.js";
 import { parseMarkdownToc } from "../core/asset/markdown.js";
-import { isContainedRelativePath, isRecord } from "../core/common.js";
+import { isRecord } from "../core/common.js";
 import { formatExtraParamsIssue, validateExtraParams } from "../core/extra-params.js";
 import { checkJsonSchemaDefinition, JSON_SCHEMA_SUBSET_SUPPORTED_KEYWORDS } from "../core/json-schema.js";
 import { INPUT_NAME_PATTERN } from "../execution/input-contract.js";
@@ -182,7 +182,6 @@ export function parseWorkflow(markdown, source) {
     const ctx = {
         filePath: path,
         errors,
-        ...(source.validateExecCwd ? { validateExecCwd: source.validateExecCwd } : {}),
         lineAt,
         lineAtOffset: (offset) => Math.max(1, lineCounter.linePos(offset).line + lineOffset),
         nodeAt: (p) => (p.length === 0 ? doc.contents : doc.getIn(p, true)),
@@ -829,36 +828,18 @@ function parseExecCommand(ctx, raw, path, stepLabel) {
     return argv;
 }
 /**
- * The optional relative `cwd:`. Rejected here (statically) for absolute paths
- * and `..` segments; containment against the resolved base directory is
- * re-checked at dispatch, so a symlinked subdirectory cannot escape either.
+ * The optional `cwd:`: a non-empty string, relative to the workflow's bundle root or absolute, and
+ * free to carry `${ref}` tokens. Nothing else is checked here; the unit's working directory is
+ * resolved at dispatch.
  */
 function parseExecCwd(ctx, raw, path, stepLabel) {
     if (raw === undefined)
         return undefined;
     if (typeof raw !== "string" || raw.trim() === "") {
-        ctx.err(path, `${stepLabel} "exec.cwd" must be a non-empty relative path inside the unit's working directory.`);
+        ctx.err(path, `${stepLabel} "exec.cwd" must be a non-empty string.`);
         return undefined;
     }
-    const value = raw.trim();
-    if (!isContainedRelativePath(value)) {
-        ctx.err(path, `${stepLabel} "exec.cwd" (${JSON.stringify(value)}) must be a RELATIVE path inside the unit's working ` +
-            `directory — absolute paths, Windows drive letters, "~", and ".." segments are rejected.`);
-        return undefined;
-    }
-    if (ctx.validateExecCwd) {
-        const semantic = ctx.validateExecCwd(value);
-        if (!semantic.ok) {
-            ctx.errors.push({
-                code: semantic.code,
-                line: ctx.lineAt(path),
-                message: semantic.message,
-            });
-            return undefined;
-        }
-        return semantic.value;
-    }
-    return value;
+    return raw.trim();
 }
 function parseMap(ctx, raw, path, stepLabel) {
     if (!isRecord(raw)) {

package/dist/workflows/plan.js

@@ -1,5 +1,9 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-/** Stored plans record this; 0.9.15 and 0.9.16 wrote 5, which still decodes (the 0.9.15 floor, #1091). */
-export const WORKFLOW_PLAN_VERSION = 6;
+/**
+ * Stored plans record this; 0.9.15 and 0.9.16 wrote 5 and early 0.10 wrote 6,
+ * which still decode (the 0.9.15 floor, #1091). 7 stopped freezing locations:
+ * the plan names the refs the engine dereferences, never a directory or file.
+ */
+export const WORKFLOW_PLAN_VERSION = 7;

package/dist/workflows/renderer.js

@@ -9,7 +9,9 @@
  * declares one.
  */
 import { displayRef } from "../core/asset/resolve-ref.js";
+import { isInstalledBundle, resolveRefOwner } from "../core/env-secret-ref.js";
 import { UsageError } from "../core/errors.js";
+import { substituteRefTokens } from "../core/ref-token.js";
 import { compileWorkflowSource, workflowStepInstructions } from "./compile.js";
 function shellQuote(value) {
     return `'${value.replace(/'/g, `'\\''`)}'`;
@@ -25,7 +27,7 @@ function deriveName(ctx) {
     return ext > 0 ? ctx.relPath.slice(0, ext) : ctx.relPath;
 }
 function loadPlan(ctx) {
-    const result = compileWorkflowSource(ctx.content(), { path: ctx.relPath, workspaceRoot: ctx.stashRoot });
+    const result = compileWorkflowSource(ctx.content(), { path: ctx.relPath });
     if (result.ok)
         return result.plan;
     const summary = result.errors.map((e) => `${e.path}:${e.line} — ${e.message}`).join("\n");
@@ -70,10 +72,14 @@ function projectParameters(plan) {
  * It is far smaller than the step `instructions` this same projection
  * already carries whole.
  */
-function summarizeStepOrchestration(step, defaults) {
+export function summarizeStepOrchestration(step, defaults) {
     const spec = step.spec;
     const unit = spec?.unit;
-    const exec = spec?.exec;
+    // A stored plan carries no authored spec: read the same fields off its frozen dispatch.
+    const frozen = spec ? undefined : frozenDispatch(step);
+    const exec = spec ? spec.exec : frozen?.exec;
+    const env = unit?.env ?? frozen?.env;
+    const workflow = spec ? spec.workflow : frozen?.workflow;
     const engine = exec ? undefined : (unit?.engine ?? defaults?.engine);
     const model = exec ? undefined : (unit?.model ?? defaults?.model);
     const timeoutMs = unit?.timeoutMs !== undefined ? unit.timeoutMs : defaults?.timeoutMs;
@@ -93,10 +99,77 @@ function summarizeStepOrchestration(step, defaults) {
             }
             : {}),
         ...(unit?.output !== undefined || step.outputSchema !== undefined ? { hasSchema: true } : {}),
-        ...(unit?.env !== undefined ? { env: [...unit.env] } : {}),
+        ...(env !== undefined ? { env: [...env] } : {}),
+        ...(workflow !== undefined ? { workflow } : {}),
     };
     return Object.keys(summary).length > 0 ? summary : undefined;
 }
+/** The exec argv, env refs and child workflow a frozen step dispatches. */
+function frozenDispatch(step) {
+    const root = step.root;
+    const unit = root?.kind === "map" ? root.template : root;
+    if (!unit)
+        return {};
+    const target = unit.frozenTarget;
+    const env = unit.environment.flatMap((binding) => (binding.kind === "env-ref" ? [binding.ref] : []));
+    return {
+        ...(target.kind === "shell"
+            ? {
+                exec: {
+                    command: [...target.exec.command],
+                    ...(target.exec.cwd !== undefined ? { cwd: target.exec.cwd } : {}),
+                    ...(target.exec.passEnv ? { passEnv: [...target.exec.passEnv] } : {}),
+                },
+            }
+            : {}),
+        ...(env.length > 0 ? { env } : {}),
+        ...(target.kind === "child-workflow" ? { workflow: target.ref } : {}),
+    };
+}
+/**
+ * Add the bundle-qualified ref every `${ref}` token in the argv or cwd, every
+ * `env:` entry and the child `workflow:` resolves to right now, through the
+ * one owner walk (`resolveRefOwner`). A ref no bundle owns lands in
+ * `unresolved` instead; callers decide whether that is an error. No secret
+ * is read and no path is returned.
+ */
+export function resolveOrchestrationRefs(summary) {
+    const refs = [];
+    const unresolved = [];
+    const note = (ref, where) => {
+        let owner;
+        try {
+            owner = resolveRefOwner(ref);
+        }
+        catch {
+            owner = undefined;
+        }
+        if (owner)
+            refs.push({ ref, resolved: owner.ref, in: where });
+        else
+            unresolved.push({ ref, in: where });
+    };
+    const tokens = (values, where) => {
+        const seen = new Set();
+        substituteRefTokens(Object.fromEntries(values.map((value, index) => [String(index), value])), (ref) => {
+            if (!seen.has(ref)) {
+                seen.add(ref);
+                note(ref, where);
+            }
+            return { kind: "path", path: "" };
+        }, isInstalledBundle);
+    };
+    if (summary.exec) {
+        tokens(summary.exec.command, "argv");
+        if (summary.exec.cwd !== undefined)
+            tokens([summary.exec.cwd], "cwd");
+    }
+    for (const ref of summary.env ?? [])
+        note(ref, "env");
+    if (summary.workflow !== undefined)
+        note(summary.workflow, "workflow");
+    return { ...summary, refs, ...(unresolved.length > 0 ? { unresolved } : {}) };
+}
 function projectStepDefinitions(plan) {
     return plan.steps.map((step, sequenceIndex) => {
         const orchestration = summarizeStepOrchestration(step, plan.defaults);

package/dist/workflows/runtime/run-plan.js

@@ -7,15 +7,20 @@
  *
  * {@link decodeWorkflowPlan} accepts every plan shape a release at or above
  * the 0.9.15 floor has stored — irVersion 5 (with its `sourceReadSet` and
- * host-identity fields, which 0.9.15 and 0.9.16 wrote) as well as the current
- * one — and keeps keys it does not know rather than
- * refusing them. It rejects only a plan it cannot run: no steps, a unit with
- * no frozen target, a request that does not decode. `plan_ir_version` and
- * `plan_hash` are informational columns: neither gates execution. A plan that
- * cannot be decoded comes back from {@link readRunPlan} as a `problem`
+ * host-identity fields, which 0.9.15 and 0.9.16 wrote) and irVersion 6 (with
+ * its frozen `cwdIdentity` and env owner paths) as well as the current one —
+ * and keeps keys it does not know rather than refusing them. A stored target
+ * is kept exactly as stored, location fields included: the unit `input_hash`
+ * and the child invocation key derive from the whole target, so dropping them
+ * would make an interrupted run publish a second child after an upgrade.
+ * Dispatch finds the bundle and the env asset by ref and never reads them. It
+ * rejects only a plan it cannot run: no steps, a unit with no frozen target, a
+ * request that does not decode. `plan_hash` is an informational column. A plan
+ * that cannot be decoded comes back from {@link readRunPlan} as a `problem`
  * sentence and the caller decides the remedy (the engine abandons such a run
- * instead of throwing) — except for a plan a NEWER akm froze, which is `newer`
- * and whose problem names upgrading akm as the remedy.
+ * instead of throwing) — except for a plan a NEWER akm froze (`plan_ir_version`
+ * above this release's), which is refused unread as `newer` with a problem that
+ * names upgrading akm as the remedy.
  */
 import { UsageError } from "../../core/errors.js";
 import { warnOnce } from "../../core/warn.js";
@@ -26,6 +31,14 @@ export function readRunPlan(row) {
     if (!row.plan_json)
         return { ok: false, newer: false, problem: `Workflow run ${row.id} has no frozen workflow plan.` };
     const version = row.plan_ir_version ?? null;
+    if (version !== null && version > WORKFLOW_PLAN_VERSION) {
+        return {
+            ok: false,
+            newer: true,
+            problem: `Workflow run ${row.id} was frozen by a newer akm (plan irVersion ${version}) and this akm ` +
+                `(irVersion ${WORKFLOW_PLAN_VERSION}) will not run it. Upgrade akm to continue this run.`,
+        };
+    }
     try {
         const plan = decodeWorkflowPlan(JSON.parse(row.plan_json), {
             ...(row.workflow_ref ? { workflowRef: row.workflow_ref } : {}),
@@ -38,14 +51,6 @@ export function readRunPlan(row) {
     }
     catch (cause) {
         const detail = cause instanceof Error ? cause.message : String(cause);
-        if (version !== null && version > WORKFLOW_PLAN_VERSION) {
-            return {
-                ok: false,
-                newer: true,
-                problem: `Workflow run ${row.id} was frozen by a newer akm (plan irVersion ${version}) and this akm cannot decode it: ` +
-                    `${detail}. Upgrade akm to continue this run.`,
-            };
-        }
         const frozenAs = version === null ? "" : ` (frozen as plan irVersion ${version})`;
         return {
             ok: false,
@@ -166,7 +171,7 @@ function decodeTarget(value, label) {
                 kind: "shell",
                 contentHash: string(target.contentHash, `${label} contentHash`),
                 exec: decodeExec(target.exec, label),
-                cwdIdentity: record(target.cwdIdentity, `${label} cwdIdentity`),
+                ...legacyField(target, "cwdIdentity"),
                 ...optional,
             };
         case "child-workflow":
@@ -203,12 +208,15 @@ function decodeCommandTarget(target, label) {
         request,
         runner,
         ...(concurrency !== undefined ? { concurrency } : {}),
-        ...(target.cwdIdentity && typeof target.cwdIdentity === "object"
-            ? { cwdIdentity: target.cwdIdentity }
-            : {}),
+        ...legacyField(target, "cwdIdentity"),
         ...(inputBindings ? { inputBindings } : {}),
     };
 }
+/** A location field a stored target carries, kept as stored (see the module doc). */
+function legacyField(source, key) {
+    const value = source[key];
+    return value && typeof value === "object" ? { [key]: value } : {};
+}
 function decodeExec(value, label) {
     const exec = record(value, `${label} exec`);
     const command = exec.command;
@@ -246,14 +254,20 @@ function decodeEnvironmentBinding(value, label) {
         return { kind: "pass-through", name: string(binding.name, label) };
     if (binding.kind !== "env-ref")
         fail(`${label} has an unsupported kind`);
+    // Plans before irVersion 7 also carry the env file's owner, key names and secret names: kept as stored,
+    // never read (dispatch reads the env asset by ref).
     const strings = (items) => Array.isArray(items) ? items.filter((item) => typeof item === "string") : [];
     return {
         kind: "env-ref",
         ref: string(binding.ref, `${label} ref`),
-        owner: record(binding.owner, `${label} owner`),
-        keys: strings(binding.keys),
-        secretNames: strings(binding.secretNames),
         precedence: typeof binding.precedence === "number" ? binding.precedence : 0,
+        ...(binding.owner && typeof binding.owner === "object"
+            ? {
+                owner: binding.owner,
+                keys: strings(binding.keys),
+                secretNames: strings(binding.secretNames),
+            }
+            : {}),
     };
 }
 function positiveInteger(value) {

package/dist/workflows/runtime/runs.js

@@ -9,17 +9,17 @@ import { appendEvent } from "../../core/events.js";
 import { warn } from "../../core/warn.js";
 import { insertEventOnce } from "../../storage/repositories/events-repository.js";
 import { withWorkflowRunsRepo, } from "../../storage/repositories/workflow-runs-repository.js";
-import { getCurrentWorkflowScopeKey } from "../authoring/scope-key.js";
-import { frozenSummaryJudge } from "../exec/frozen-judge.js";
+import { frozenSummaryJudge, resolveJudgeCwd } from "../exec/frozen-judge.js";
 import { detectSecretShapedParams } from "../exec/param-secrets.js";
 import { freezeWorkflow } from "../freeze/freeze.js";
 import { applyWorkflowParamDefaults, materializeWorkflowParameterFlags, validateWorkflowParams, } from "../ir/params.js";
 import { canonicalPlanJson, computePlanHash } from "../ir/plan-hash.js";
+import { resolveOrchestrationRefs, summarizeStepOrchestration } from "../renderer.js";
 import { clip, WORKFLOW_UNIT_DIAGNOSTIC_CLIP } from "../resource-limits.js";
 import { validateStepSummary } from "../validate-summary.js";
 import { resolveAgentIdentity } from "./agent-identity.js";
-import { frozenStepRows, readRunPlan } from "./run-plan.js";
-import { canonicalizeWorkflowRefInput, loadWorkflowAsset, resolveWorkflowEntryId } from "./workflow-asset-loader.js";
+import { decodeWorkflowPlan, frozenStepRows, readRunPlan } from "./run-plan.js";
+import { canonicalizeWorkflowRefInput, loadWorkflowAsset } from "./workflow-asset-loader.js";
 /**
  * Membership test for the journaled `runner` column, which is an untyped string.
  * The `Record<WorkflowRuntimeKind, …>` is exhaustiveness-checked, so a new runtime
@@ -98,38 +98,21 @@ export async function startWorkflowRun(ref, params = {}, options) {
     return withWorkflowRunsRepo(async (repo) => {
         const now = new Date().toISOString();
         const runId = randomUUID();
-        const scopeKey = getCurrentWorkflowScopeKey();
         const currentStepId = plan.steps[0]?.stepId ?? null;
-        const workflowEntryId = resolveWorkflowEntryId(asset.sourcePath, asset.ref, asset.adapterId);
         // Capture the invoking harness/session identity for this run. Explicit options
         // win; otherwise fall back to best-effort environment detection. This is
         // identity-only — no background thread or timer is started here.
         const detected = resolveAgentIdentity();
         const agentHarness = options?.agentHarness !== undefined ? options.agentHarness : detected.harness;
         const agentSessionId = options?.agentSessionId !== undefined ? options.agentSessionId : detected.sessionId;
-        // Concurrency guard (#485): if an active run already exists in this
-        // (workflow_ref, scope_key) pair, refuse to create a parallel run unless
-        // `force: true` is set. Previously every call inserted unconditionally,
-        // so two terminals starting the same workflow could leave two runs racing.
-        // The active-alias query and all inserts share one immediate transaction.
-        // #942: an active run of this ref in a different scope (e.g. a scheduled
-        // task's cwd vs. a shell) is warned about once; the uniqueness guard stays
-        // scope-local. The query excludes the caller's own scope in SQL.
-        const crossScopeActive = repo.findActiveRunOutsideScope(workflowRefs, scopeKey);
-        const crossScopeWarning = crossScopeActive
-            ? `Workflow ${asset.ref} already has an active run in another scope ` +
-                `(id ${crossScopeActive.id}, started ${crossScopeActive.created_at}, scope ${crossScopeActive.scope_key ?? "unknown"}); ` +
-                `starting a separate run here. Resume it from anywhere with "akm workflow run ${crossScopeActive.id}" ` +
-                `or free it with "akm workflow abandon ${crossScopeActive.id}".`
-            : undefined;
+        // Starting a ref always starts a run. Other active runs of the same ref
+        // are not an error: name them once, after the start succeeds, so the
+        // operator can continue or abandon the ones they no longer want.
+        const otherActive = repo.listRuns({ workflowRefs, activeOnly: true });
         repo.publishWorkflowRunV4({
-            workflowRefs,
-            ...(options?.force ? { force: true } : {}),
             run: {
                 id: runId,
                 workflowRef: asset.ref,
-                scopeKey,
-                workflowEntryId,
                 workflowTitle: asset.title,
                 paramsJson: JSON.stringify(effectiveParams),
                 currentStepId,
@@ -149,9 +132,12 @@ export async function startWorkflowRun(ref, params = {}, options) {
             planJson,
             planHash,
         });
+        if (otherActive.length > 0) {
+            const ids = otherActive.map((run) => run.id);
+            warn(`Workflow ${asset.ref} already has ${ids.length} active run(s) (${ids.join(", ")}); started another. ` +
+                `Continue one with "akm workflow run ${ids[0]}" or give up on it with "akm workflow abandon ${ids[0]}".`);
+        }
         const result = await getWorkflowStatus(runId);
-        if (crossScopeWarning)
-            result.warnings = [...(result.warnings ?? []), crossScopeWarning];
         // Params reach every unit prompt in clear (only the journal scrubs them).
         // Surface a loud, best-effort warning when a param LOOKS like a credential
         // so the author moves it to an env binding. Advisory only — never blocks
@@ -167,6 +153,16 @@ export async function startWorkflowRun(ref, params = {}, options) {
         return result;
     });
 }
+function decodeStatusPlan(planJson) {
+    if (!planJson)
+        return undefined;
+    try {
+        return decodeWorkflowPlan(JSON.parse(planJson));
+    }
+    catch {
+        return undefined;
+    }
+}
 export async function getWorkflowStatus(runId, opts) {
     return withWorkflowRunsRepo((repo) => {
         const run = readWorkflowRun(repo, runId);
@@ -176,25 +172,32 @@ export async function getWorkflowStatus(runId, opts) {
             // The honest diagnostic surface (#22): read the unit journal straight and
             // project each row, INCLUDING failures whose diagnostic text the
             // deterministic evidence graph drops. Read-only; never mutates the run.
-            detail.units = repo.getUnitsForRun(run.id).map(toUnitDiagnostic);
+            const rows = repo.getUnitsForRun(run.id);
+            // The plan is decoded only to describe a failed unit, read-only: no run
+            // warning (`readRunPlan` says it is "running" an older plan) and no
+            // orchestration when the plan cannot be decoded.
+            const plan = rows.some((row) => row.status === "failed") ? decodeStatusPlan(run.plan_json) : undefined;
+            detail.units = rows.map((row) => {
+                const unit = toUnitDiagnostic(row);
+                const step = row.status === "failed" ? plan?.steps.find((candidate) => candidate.stepId === row.step_id) : undefined;
+                const summary = step ? summarizeStepOrchestration(step, undefined) : undefined;
+                return summary ? { ...unit, orchestration: resolveOrchestrationRefs(summary) } : unit;
+            });
         }
         return detail;
     });
 }
 export async function listWorkflowRuns(input) {
-    const scopeKey = input?.allScopes === true ? null : getCurrentWorkflowScopeKey();
     const activeOnly = input?.activeOnly === true;
     const includeChildren = input?.includeChildren === true;
     if (input?.workflowRef === undefined) {
         return withWorkflowRunsRepo((repo) => ({
             runs: repo
                 .listRuns({
-                scopeKey,
                 ...(activeOnly ? { activeOnly: true } : {}),
                 ...(includeChildren ? { includeChildren: true } : {}),
             })
                 .map(toWorkflowRunSummary),
-            scopeKey,
         }));
     }
     const exactRef = input.workflowRef.trim();
@@ -212,12 +215,11 @@ export async function listWorkflowRuns(input) {
     }
     catch (error) {
         if (parsedExactRef.bundle !== undefined) {
-            const exactRows = await withWorkflowRunsRepo((repo) => repo.listRuns({ scopeKey, workflowRef: exactRef, ...(includeChildren ? { includeChildren: true } : {}) }));
+            const exactRows = await withWorkflowRunsRepo((repo) => repo.listRuns({ workflowRef: exactRef, ...(includeChildren ? { includeChildren: true } : {}) }));
             if (exactRows.length === 0)
                 throw error;
             return {
                 runs: exactRows.filter((row) => !activeOnly || row.status === "active").map(toWorkflowRunSummary),
-                scopeKey,
             };
         }
         if (!(error instanceof NotFoundError))
@@ -226,23 +228,20 @@ export async function listWorkflowRuns(input) {
     return withWorkflowRunsRepo((repo) => ({
         runs: repo
             .listRuns({
-            scopeKey,
             workflowRefs,
             ...(activeOnly ? { activeOnly: true } : {}),
             ...(includeChildren ? { includeChildren: true } : {}),
         })
             .map(toWorkflowRunSummary),
-        scopeKey,
     }));
 }
 export async function getNextWorkflowStep(specifier, params, options) {
     return withWorkflowRunsRepo(async (repo) => {
-        const { run, autoStarted, resumed, startWarnings } = await resolveRunSpecifier(repo, specifier, params, options?.parameterFlags, options?.newRun);
+        const { run, autoStarted, startWarnings } = await resolveRunSpecifier(repo, specifier, params, options?.parameterFlags);
         const steps = readWorkflowRunSteps(repo, run.id);
         return {
             ...projectNextResult(run, steps),
             ...(autoStarted ? { autoStarted: true } : {}),
-            ...(resumed ? { resumed: true } : {}),
             ...(startWarnings?.length ? { startWarnings } : {}),
         };
     });
@@ -348,7 +347,7 @@ export async function completeWorkflowStep(input) {
         const stepPlan = storedPlan.steps.find((step) => step.stepId === input.stepId);
         if (!stepPlan)
             throw new NotFoundError(`Step "${input.stepId}" was not found in workflow run ${run.id}.`);
-        return { existing, plan: storedPlan, stepPlan };
+        return { existing, plan: storedPlan, stepPlan, workflowRef: run.workflow_ref };
     });
     const summary = input.summary?.trim();
     // #506: completing a step requires a summary of the work done.
@@ -365,10 +364,7 @@ export async function completeWorkflowStep(input) {
             ? // Manual completion journals no gate row, so there is no `<stepId>.gate:l<loop>`
                 // identity to agree with — but the dispatch still names the REAL run and
                 // step (frozen-judge falls back to the gate node id for the unit id).
-                frozenSummaryJudge(preflight.stepPlan.gate.frozenJudge, input.signal, undefined, {
-                    runId: input.runId,
-                    stepId: input.stepId,
-                })
+                frozenSummaryJudge(preflight.stepPlan.gate.frozenJudge, input.signal, undefined, { runId: input.runId, stepId: input.stepId }, undefined, resolveJudgeCwd(preflight.stepPlan.gate.frozenJudge, preflight.workflowRef))
             : input.summaryJudge;
         if (criteria.length > 0 && !judge) {
             throw new ConfigError(`Workflow run ${input.runId} has completion criteria for step "${input.stepId}" but its frozen plan has no judge. ` +
@@ -457,57 +453,27 @@ export async function completeWorkflowStep(input) {
         return detail;
     });
 }
-async function resolveRunSpecifier(repo, specifier, params, parameterFlags, forceNew) {
-    const hasParameters = (params && Object.keys(params).length > 0) || (parameterFlags?.length ?? 0) > 0;
+async function resolveRunSpecifier(repo, specifier, params, parameterFlags) {
     const explicitRun = findRunByIdOrPrefix(repo, specifier);
     if (explicitRun) {
-        // `--new` starts a fresh run FROM A REF; it never makes sense against a
-        // run id (or an id prefix), which already names the run to act on (#919).
-        if (forceNew) {
-            throw new UsageError(`--new starts a fresh run from a workflow ref; "${specifier}" already names a run id.`, "INVALID_FLAG_VALUE");
-        }
-        if (hasParameters) {
+        if ((params && Object.keys(params).length > 0) || (parameterFlags?.length ?? 0) > 0) {
             throw new UsageError(`Workflow parameter flags can only be used when starting a new run, not with existing run id "${specifier}".`);
         }
         return { run: explicitRun, autoStarted: false };
     }
-    const scopeKey = getCurrentWorkflowScopeKey();
-    const exactRef = specifier.trim();
-    const parsedExact = parseBundleRef(exactRef);
-    const qualifiedExact = parsedExact.bundle !== undefined && parsedExact.fragment === undefined;
-    const detached = qualifiedExact && !forceNew ? repo.getActiveRunRowForScope(exactRef, scopeKey) : undefined;
+    // A workflow ref always starts a new run; only a run id drives an existing one.
     let ref;
     try {
         ref = await canonicalizeWorkflowSpecifier(specifier);
     }
     catch (error) {
-        if (detached) {
-            if (hasParameters) {
-                throw new UsageError(`Workflow parameter flags can only be set on a new run; ${specifier} is already active ` +
-                    `(id ${detached.id}, scope ${scopeKey}).`, "INVALID_FLAG_VALUE", `Pass --new to start a separate run, or run "akm workflow abandon ${detached.id}" to free up ${specifier} first.`);
-            }
-            return { run: detached, autoStarted: false, resumed: true };
-        }
         if (error instanceof NotFoundError && !specifier.includes(":") && !specifier.includes("/")) {
             throw new NotFoundError(`Workflow run or workflow "${specifier}" not found.`, "WORKFLOW_NOT_FOUND");
         }
         throw error;
     }
-    const active = forceNew ? undefined : repo.getActiveRunRowForScope(await workflowRunRefSet(ref, exactRef), scopeKey);
-    if (active) {
-        if (hasParameters) {
-            throw new UsageError(`Workflow parameter flags can only be set on a new run; ${ref} is already active ` +
-                `(id ${active.id}, scope ${scopeKey}).`, "INVALID_FLAG_VALUE", `Pass --new to start a separate run, or run "akm workflow abandon ${active.id}" to free up ${ref} first.`);
-        }
-        return { run: active, autoStarted: false, resumed: true };
-    }
-    // `force` (#485's own escape hatch) is what lets `--new` create a second
-    // active run for this (ref, scope) pair instead of the concurrency guard
-    // refusing it — the caller explicitly asked for a fresh run, so the guard
-    // that exists to catch an ACCIDENTAL second run does not apply (#919).
     const started = await startWorkflowRun(ref, params ?? {}, {
         ...(parameterFlags !== undefined ? { parameterFlags } : {}),
-        ...(forceNew ? { force: true } : {}),
     });
     return {
         run: readWorkflowRun(repo, started.run.id),
@@ -648,7 +614,6 @@ function toWorkflowRunSummary(run) {
     return {
         id: run.id,
         workflowRef: run.workflow_ref,
-        scopeKey: run.scope_key,
         workflowEntryId: run.workflow_entry_id,
         workflowTitle: run.workflow_title,
         status: run.status,
@@ -733,11 +698,3 @@ function parseJsonArray(value) {
     }
     return undefined;
 }
-export async function getActiveWorkflowRun(scopeKey = getCurrentWorkflowScopeKey()) {
-    return withWorkflowRunsRepo((repo) => {
-        const row = repo.findActiveOrBlockedRunForScope(scopeKey);
-        if (!row)
-            return null;
-        return { runId: row.id, stepId: row.current_step_id, workflowRef: row.workflow_ref };
-    }).catch(() => null); // fail-open: never crash show output due to DB error
-}