akm-cli 0.10.261012-beta → 0.10.261014-beta

package/dist/workflows/exec/step-work.js

@@ -6,7 +6,6 @@
  * decisions, used by the engine on both a fresh run and a resume, so the same
  * frozen plan produces byte-identical unit graphs. Pure except the
  * gate-evaluation journaling; never dispatches and never writes step rows.
- * See docs/architecture/decisions/0002-unit-reuse-and-input-hash-scope.md.
  */
 import { createHash } from "node:crypto";
 import unitPreambleTemplate from "../../assets/prompts/workflow-unit-preamble.md" with { type: "text" };
@@ -119,8 +118,7 @@ export function computeStepWorkList(plan, input) {
     const reducer = root.kind === "map" ? root.reducer : "collect";
     const scope = { params: input.params, stepOutputs: input.stepOutputs };
     // Instructions are ALWAYS the step's body prose, byte-exact — never
-    // templated, never scanned for reference syntax (workflow-format-
-    // unification, spec §2.3). Only `map.over` / `inputs[]`
+    // templated, never scanned for reference syntax. Only `map.over` / `inputs[]`
     // carry the closed reference grammar.
     // Resolve the step's declared `inputs:` ONCE (shared by every unit in this
     // step — map items differ, declared inputs do not): prior-step artifacts
@@ -197,9 +195,9 @@ export function computeStepWorkList(plan, input) {
     const execInputsJson = frozenExec && resolvedInputs.length > 0
         ? (canonicalJson(Object.fromEntries(resolvedInputs.map((entry) => [entry.reference, entry.value]))) ?? "{}")
         : undefined;
-    // P2b Lane A2: the resolved effective task-composition inputs,
+    // The resolved effective task-composition inputs,
     // serialized ONCE here (mirrors execParamsJson/execInputsJson above) —
-    // Lane B's delivery (buildUnitPrompt's "## Task inputs" block,
+    // the delivery (buildUnitPrompt's "## Task inputs" block,
     // buildExecContextEnv's AKM_TASK_INPUTS) reads both back per unit.
     const taskInputsJson = hasTaskInputs ? (canonicalJson(taskInputsResolution.values) ?? "{}") : undefined;
     const ctx = {
@@ -244,13 +242,11 @@ function buildStepWorkUnit(ctx, unitId, item, index) {
             params: input.params,
             ...(isFanOut ? { item, itemIndex: index } : {}),
             ...(resolvedInputs.length > 0 ? { inputs: resolvedInputs } : {}),
-            // P2b Lane B: the composed task's resolved
+            // The composed task's resolved
             // `inputBindings`, when non-empty — see StepWorkUnitContext.taskInputs.
             ...(taskInputs && Object.keys(taskInputs).length > 0 ? { taskInputs } : {}),
             ...(input.gateFeedback ? { gateFeedback: input.gateFeedback } : {}),
-            // An agent or SDK transport's request lowering appends the schema
-            // instruction itself; a direct-LLM unit carries it in its prompt.
-            ...(template.schema && ctx.runner === "llm" ? { schema: template.schema } : {}),
+            // Request lowering appends the schema instruction itself.
             instructions: template.instructions,
         });
     const inputHash = computeUnitInputHash(ctx, item);
@@ -265,7 +261,7 @@ function buildStepWorkUnit(ctx, unitId, item, index) {
         frozenTarget: target,
         environment: template.environment,
         ...(frozenExec ? { execContext: buildExecContextEnv({ ctx, unitId, item, index }) } : {}),
-        ...(target.kind === "command" && target.request.model?.resolved ? { model: target.request.model.resolved } : {}),
+        ...(target.kind === "command" && target.request.model?.model ? { model: target.request.model.model } : {}),
         timeoutMs: ctx.timeoutMs,
         ...(template.schema ? { schema: template.schema } : {}),
         ...(template.retry ? { retry: template.retry } : {}),
@@ -311,7 +307,6 @@ function buildExecContextEnv(args) {
  * to do (names, never secret values). Informational — resume reuses a
  * completed row by unit id. `gateFeedback`/`taskInputs` are included only when
  * present so the loop-1, binding-free preimage keeps its `hashVersion` 7 shape.
- * See docs/architecture/decisions/0002-unit-reuse-and-input-hash-scope.md.
  */
 function computeUnitInputHash(ctx, item) {
     return createHash("sha256")
@@ -837,8 +832,8 @@ function judgeFailureNotes(runId, stepId, cause) {
     return (`Step "${stepId}" could not be verified: ${cause}. ` +
         `This is a verification-judge failure, not a verdict — no gate loop was consumed and the step's ` +
         `journaled units are preserved. Fix the verifier configuration or service, then run ` +
-        `\`akm workflow resume ${runId}\` to re-evaluate the gate against the existing results ` +
-        `without re-dispatching units.`);
+        `\`akm workflow resume ${runId}\` and \`akm workflow run ${runId}\` to re-evaluate the gate ` +
+        `against the existing results without re-dispatching units.`);
 }
 /**
  * Complete a step `blocked` for a verifier-INFRASTRUCTURE failure and return
@@ -944,7 +939,7 @@ export async function finalizeExecutedStep(input) {
     // rejection: block for resume without invoking the gate (no loop consumed).
     if (completionCriteria.some((c) => c.trim().length > 0) && !innerJudge) {
         return blockFinalizedStep(input, "this step declares completion criteria but no verification judge is available " +
-            "(the frozen plan resolves no judge — set workflow.judgeEngine, or restore the judge configuration)");
+            "(the frozen plan resolves no judge — configure a connection or harness with `akm setup`, or restore the judge configuration)");
     }
     // Artifact-judging gate: a criteria-bearing executing step is judged on a
     // summary BUILT FROM the promoted artifact; everything else keeps the machine
@@ -966,7 +961,7 @@ export async function finalizeExecutedStep(input) {
     const summaryJudge = innerJudge
         ? async (prompt) => {
             if (gateTarget) {
-                const engineName = gateTarget.request.engine.name;
+                const engineName = gateTarget.request.target.name;
                 if (!engineName)
                     throw new Error(`Gate ${stepId} has no frozen engine identity.`);
                 gateUnit = {
@@ -975,7 +970,7 @@ export async function finalizeExecutedStep(input) {
                     stepId,
                     loop: gateLoop,
                     engine: engineName,
-                    model: gateTarget.request.model?.resolved ?? null,
+                    model: gateTarget.request.model?.model ?? null,
                     runner: gateTarget.runner.kind,
                     // The gate prefix rides the unit prefix's version — unit and gate
                     // hashVersion are one vocabulary (p3a §0.1; the R-R15 fix moved
@@ -1059,7 +1054,8 @@ export async function finalizeExecutedStep(input) {
     }
     // Judge infrastructure failure: the fail-closed rejection is synthetic, not a
     // verdict. Consume NO gate loop; block the step (and therefore the run) so
-    // `akm workflow resume` retries the gate over the journaled units.
+    // `akm workflow resume` then `akm workflow run` retries the gate over the
+    // journaled units.
     if (rejection && judgeFailed) {
         return blockFinalizedStep(input, judgeFailure ?? "the verification judge failed");
     }

package/dist/workflows/exec/unit-dispatch.js

@@ -2,24 +2,17 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { ConfigError } from "../../core/errors.js";
-import { assertFrozenDirectoryContained } from "../../execution/directory-identity.js";
 import { canonicalResolvedExecutionRequest } from "../../execution/resolved-request.js";
 import { buildExecutionFromWire } from "../../integrations/agent/execution.js";
-import { runExecution, unwrapHarnessReply } from "../../integrations/agent/runner-dispatch.js";
+import { runExecution } from "../../integrations/agent/runner-dispatch.js";
 /** Lower a frozen common request through its frozen runner only. */
 export function prepareWorkflowExecution(request, prompt = request.prompt) {
     const target = request.frozenTarget;
-    if (target.cwdIdentity)
-        assertFrozenDirectoryContained(target.cwdIdentity);
     const wire = JSON.parse(canonicalResolvedExecutionRequest(target.request));
     const command = { ...wire.command, content: prompt };
     const runtime = {
         ...wire.runtime,
-        ...(request.cwd !== undefined
-            ? { workspace: request.cwd }
-            : target.cwdIdentity
-                ? { workspace: target.cwdIdentity.realCwd }
-                : {}),
+        ...(request.cwd !== undefined ? { workspace: request.cwd } : {}),
         ...(request.env !== undefined ? { environment: request.env } : {}),
     };
     wire.command = command;
@@ -63,13 +56,13 @@ export async function dispatchWorkflowExecution(request, feedback) {
     }
     const lowered = prepareWorkflowExecution(request, prompt);
     const notices = lowered.notices.length > 0 ? lowered.notices : undefined;
-    if (request.env && Object.keys(request.env).length > 0 && lowered.runner.kind === "llm") {
+    if (request.env && Object.keys(request.env).length > 0 && lowered.profile === undefined) {
         return {
             ok: false,
             text: "",
             failureReason: "env_unsupported",
             error: `unit ${JSON.stringify(request.unitId)} declares env bindings, which require a child process ` +
-                `(agent or sdk runner) — the "llm" runner cannot inject a per-unit child environment.`,
+                `(a harness or the internal runtime) — a direct model call cannot inject a per-unit child environment.`,
             ...(notices ? { notices } : {}),
         };
     }
@@ -77,11 +70,7 @@ export async function dispatchWorkflowExecution(request, feedback) {
     try {
         const eventSource = forwardedDispatchEventSource(request);
         result = await runExecution(lowered, {
-            runOptions: {
-                stdio: "captured",
-                parseOutput: "text",
-                ...(request.signal ? { signal: request.signal } : {}),
-            },
+            ...(request.signal ? { signal: request.signal } : {}),
             ...(eventSource !== undefined ? { eventSource } : {}),
         });
     }
@@ -96,13 +85,10 @@ export async function dispatchWorkflowExecution(request, feedback) {
             ...(notices ? { notices } : {}),
         };
     }
-    const extraction = result.ok ? unwrapHarnessReply(lowered.runner, result) : undefined;
-    const text = extraction?.text ?? result.stdout;
-    const sessionId = extraction?.sessionId ?? result.sessionId;
     return {
         ok: result.ok,
-        text,
-        ...(sessionId !== undefined ? { sessionId } : {}),
+        text: result.stdout,
+        ...(result.sessionId !== undefined ? { sessionId: result.sessionId } : {}),
         ...(result.reason ? { failureReason: result.reason } : {}),
         ...(result.error ? { error: result.error } : {}),
         ...(result.usage ? { usage: result.usage } : {}),

package/dist/workflows/freeze/environment.js

@@ -1,140 +1,35 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-import fs from "node:fs";
-import path from "node:path";
-import dotenv from "dotenv";
-import { loadAdapterExecutionSource } from "../../commands/command/execution-source-loader.js";
 import { makeBundleRef, parseBundleRef } from "../../core/asset/asset-ref.js";
-import { compareCodePoints, isWithin, toPosix } from "../../core/common.js";
 import { parseEnvRef } from "../../core/env-secret-ref.js";
 import { UsageError } from "../../core/errors.js";
-import { deriveInstallations } from "../../indexer/installations.js";
+import { resolveConceptOwner } from "../../indexer/lookup/adapter-concept-owner.js";
 import { resolveSourceEntries } from "../../indexer/search/search-source.js";
-import { resolveAssetPath } from "../../sources/resolve.js";
-import { SECRET_TOKEN_RE } from "../exec/environment.js";
 /**
- * A step's frozen environment: `pass_env` names, then
- * one value-free descriptor per `unit.env` ref (owner, key set, secret-token
- * names). Values are read at dispatch (`exec/environment.ts`), never frozen.
+ * A step's frozen environment: `pass_env` names, then one bundle-qualified
+ * ref per `unit.env` entry. The env file, its keys and the secrets it names
+ * are read at dispatch (`exec/environment.ts`), never frozen.
  */
 export function freezeEnvironment(source, exec, context) {
     const passThrough = (exec?.passEnv ?? []).map((name) => Object.freeze({ kind: "pass-through", name }));
     const seen = new Set();
     const envRefs = [];
     for (const [precedence, ref] of (source.unit?.env ?? []).entries()) {
-        if (parseEnvRef(ref).type !== "env") {
-            throw new UsageError(`Expected an env ref; got ${ref}.`, "WORKFLOW_SOURCE_INVALID");
-        }
-        const owned = resolveOwnedAssetSync(ref, "env", context);
-        if (seen.has(owned.ref))
+        parseEnvRef(ref);
+        const qualified = qualifyEnvRef(ref, context);
+        if (seen.has(qualified))
             continue;
-        seen.add(owned.ref);
-        const parsed = dotenv.parse(fs.readFileSync(owned.file));
-        const secretNames = new Set();
-        for (const value of Object.values(parsed)) {
-            for (const match of value.matchAll(SECRET_TOKEN_RE))
-                if (match[1])
-                    secretNames.add(match[1]);
-        }
-        envRefs.push(Object.freeze({
-            kind: "env-ref",
-            ref: owned.ref,
-            owner: Object.freeze({
-                bundle: owned.bundle,
-                adapter: owned.adapter,
-                requestedRoot: owned.root,
-                requestedPath: owned.file,
-                relativePath: toPosix(path.relative(owned.root, owned.file)),
-            }),
-            keys: Object.keys(parsed).sort(compareCodePoints),
-            secretNames: [...secretNames].sort(compareCodePoints),
-            precedence,
-        }));
+        seen.add(qualified);
+        envRefs.push(Object.freeze({ kind: "env-ref", ref: qualified, precedence }));
     }
     return [...passThrough, ...envRefs];
 }
-/** Load a command or persona the workflow names, resolved through the workflow's own bundles. */
-export async function workflowExecutionSource(ref, kind, context) {
-    const owned = await resolveOwnedAsset(ref, kind === "command" ? "command" : "agent", context);
-    return kind === "command"
-        ? loadAdapterExecutionSource(owned.ref, "command", { config: context.config })
-        : loadAdapterExecutionSource(owned.ref, "persona", { config: context.config });
-}
-export async function resolveOwnedAsset(ref, type, context) {
-    return resolveOwnedAssetCore(ref, type, context, false);
-}
-export function resolveOwnedAssetSync(ref, type, context) {
-    return resolveOwnedAssetCore(ref, type, context, true);
-}
-function resolveOwnedAssetCore(refInput, type, context, sync) {
+/** Qualify an env ref a step names with the bundle that owns it right now, through the one walk. */
+function qualifyEnvRef(refInput, context) {
     const parsed = parseBundleRef(refInput);
-    const plural = type === "env" ? "env" : `${type}s`;
-    const conceptId = parsed.conceptId.startsWith(`${plural}/`) ? parsed.conceptId : `${plural}/${parsed.conceptId}`;
-    const name = conceptId.slice(plural.length + 1);
-    const direct = parsed.bundle ? configuredOwner(parsed.bundle, context.config) : undefined;
-    const candidates = direct ? [direct] : installedOwners(parsed.bundle, context.config);
-    const findSync = () => {
-        for (const candidate of candidates) {
-            const directory = path.join(candidate.root, plural);
-            for (const extension of assetExtensions(type)) {
-                const file = path.resolve(directory, `${name}${extension}`);
-                if (fs.existsSync(file) && fs.statSync(file).isFile()) {
-                    if (!isWithin(file, candidate.root)) {
-                        throw new UsageError(`${file} resolves outside its owning root.`, "PATH_ESCAPE_VIOLATION");
-                    }
-                    return { ...candidate, ref: makeBundleRef(candidate.bundle, conceptId), file };
-                }
-            }
-        }
+    const match = resolveConceptOwner({ bundle: parsed.bundle, conceptId: parsed.conceptId }, resolveSourceEntries(undefined, context.config), { includeSensitive: true });
+    if (!match)
         throw new UsageError(`Workflow source target ${refInput} was not found.`, "INVALID_FLAG_VALUE");
-    };
-    if (sync)
-        return findSync();
-    return (async () => {
-        for (const candidate of candidates) {
-            try {
-                const file = await resolveAssetPath(candidate.root, type, name);
-                return { ...candidate, ref: makeBundleRef(candidate.bundle, conceptId), file };
-            }
-            catch {
-                // Continue in installation priority order.
-            }
-        }
-        return findSync();
-    })();
-}
-/** Every installed bundle root (or just `bundle`'s), in installation priority order. */
-function installedOwners(bundle, config) {
-    const sources = resolveSourceEntries(undefined, config);
-    const installations = deriveInstallations(sources);
-    return sources.flatMap((source, index) => {
-        const installation = installations[index];
-        if (!installation || (bundle && installation.id !== bundle))
-            return [];
-        return [
-            {
-                bundle: installation.id,
-                root: source.path,
-                adapter: source.adapterId ?? installation.components[0]?.adapter ?? "akm",
-            },
-        ];
-    });
-}
-function configuredOwner(bundle, config) {
-    const entry = config.bundles?.[bundle];
-    if (!entry || typeof entry.path !== "string")
-        return undefined;
-    const components = entry.components ? Object.values(entry.components) : [];
-    const component = components[0];
-    return {
-        bundle,
-        root: path.resolve(entry.path, component?.root ?? "."),
-        adapter: component?.adapter ?? "akm",
-    };
-}
-function assetExtensions(type) {
-    if (type === "env")
-        return ["", ".env"];
-    return ["", ".md"];
+    return makeBundleRef(match.bundleId, parsed.conceptId);
 }

package/dist/workflows/freeze/freeze.js

@@ -4,15 +4,14 @@
 /**
  * Freeze a compiled workflow plan into the plan a run executes. Every step's
  * authored spec resolves through the shared command/task authorities into a
- * frozen `root` (engine, model, timeout, concurrency, dispatch target and
+ * frozen `root` (connection or harness, model, timeout, concurrency, dispatch target and
  * environment descriptors); gates get their judge; the compile-only fields are
  * dropped; the source file's sha256 is recorded. Nothing is published here.
  */
 import { createHash } from "node:crypto";
-import { ConfigError, UsageError } from "../../core/errors.js";
-import { warn } from "../../core/warn.js";
-import { NO_ENGINE_MESSAGE_SUFFIX } from "../../integrations/agent/engine-fallback.js";
-import { resolveExecution } from "../../integrations/agent/execution.js";
+import { SHIPPED_ALIAS } from "../../core/config/model-aliases.js";
+import { UsageError } from "../../core/errors.js";
+import { resolveExecution, shippedAlias } from "../../integrations/agent/execution.js";
 import { checkWorkflowPlan } from "../compile.js";
 import { defaultMapConcurrency, workflowMaxConcurrency } from "../concurrency-policy.js";
 import { canonicalJson } from "../ir/plan-hash.js";
@@ -35,26 +34,16 @@ export async function freezeWorkflow(asset, config, refPath = [asset.ref]) {
         refPath,
         freezeChild: (child, childRefPath) => freezeWorkflow(child, config, childRefPath),
     };
-    let engineAnnouncement;
     const steps = [];
     for (const step of compiled.steps) {
         const { spec, ...frozenStep } = step;
         const source = { ...(spec ?? { source: { path: asset.path, start: 1, end: 1 } }), id: step.stepId };
         const resolved = await resolveStep(source, context);
-        engineAnnouncement ??= resolved.engineAnnouncement;
         const root = frozenRoot(step.stepId, source, resolved, compiled, config);
         let frozenJudge = null;
         if (step.gate.criteria.length > 0) {
             const judge = resolveJudge(source, step.gate.criteria[0] ?? "", context);
-            if (judge) {
-                frozenJudge = judge.target;
-                engineAnnouncement ??= judge.engineAnnouncement;
-            }
-            else {
-                warn(`Workflow step "${step.stepId}" has completion criteria but no verification engine is available ` +
-                    "(set workflow.judgeEngine, defaults.engine, or install an opencode-sdk binary). The step will block " +
-                    "for `akm workflow resume` once it is reached.");
-            }
+            frozenJudge = judge.target;
         }
         steps.push({ ...frozenStep, root, gate: { ...step.gate, frozenJudge } });
     }
@@ -68,7 +57,7 @@ export async function freezeWorkflow(asset, config, refPath = [asset.ref]) {
         sourceHash: asset.sourceHash,
         steps,
     };
-    return { plan, warnings: checked.warnings, ...(engineAnnouncement ? { engineAnnouncement } : {}) };
+    return { plan, warnings: checked.warnings };
 }
 async function resolveStep(source, context) {
     const baseUnit = baseUnitOf(source);
@@ -80,22 +69,15 @@ async function resolveStep(source, context) {
     // A prose step: its body is the `akm/command` literal content (`parser.ts` `stepSpec`).
     return commandDispatch(source, baseUnit, source.with, context);
 }
-/** The gate judge's frozen command target, or undefined when no engine is available and none is configured. */
+/** The gate judge's frozen command target: a model call, so it runs where model work runs. */
 function resolveJudge(source, rubric, context) {
-    const configuredEngine = context.config.workflow?.judgeEngine;
-    try {
-        const prepared = resolveExecution({
-            content: rubric.trim() || "Judge workflow completion.",
-            config: context.config,
-            ...(configuredEngine ? { current: { engine: configuredEngine } } : {}),
-        });
-        return commandResult(source, { onError: "fail", source: source.source }, prepared, context);
-    }
-    catch (err) {
-        if (configuredEngine || !(err instanceof ConfigError && err.message.includes(NO_ENGINE_MESSAGE_SUFFIX)))
-            throw err;
-        return undefined;
-    }
+    const prepared = resolveExecution({
+        content: rubric.trim() || "Judge workflow completion.",
+        config: context.config,
+        layers: [shippedAlias(SHIPPED_ALIAS.judge)],
+        modelWork: true,
+    });
+    return commandResult(source, { onError: "fail", source: source.source }, prepared, context);
 }
 function frozenRoot(stepId, source, resolved, plan, config) {
     const unit = resolved.unit;
@@ -107,7 +89,6 @@ function frozenRoot(stepId, source, resolved, plan, config) {
                 .update(canonicalJson({
                 exec: resolved.target.exec,
                 environment: resolved.environment,
-                cwdIdentity: resolved.target.cwdIdentity,
             }))
                 .digest("hex"),
         }

package/dist/workflows/freeze/step-values.js

@@ -25,17 +25,9 @@ export function freezeExecSpec(source, exec, context) {
         timeoutMs: declared === undefined ? DEFAULT_EXEC_TIMEOUT_MS : declared,
     };
 }
-export function targetConcurrency(runner, config) {
-    if (runner.kind === "llm") {
-        const configured = typeof runner.engine === "string" ? config.engines?.[runner.engine] : undefined;
-        return defaultLlmEngineConcurrency(runner.connection.endpoint, configured?.kind === "llm" ? configured.concurrency : undefined);
-    }
-    if (runner.kind !== "sdk" || !runner.fallbackConnection)
-        return undefined;
-    const selected = typeof runner.engine === "string" ? config.engines?.[runner.engine] : undefined;
-    const fallbackName = selected?.kind === "agent" ? selected.llmEngine : undefined;
-    const fallback = fallbackName ? config.engines?.[fallbackName] : undefined;
-    return defaultLlmEngineConcurrency(runner.fallbackConnection.endpoint, fallback?.kind === "llm" ? fallback.concurrency : undefined);
+/** The fan-out a connection supports (its `concurrency`, else the endpoint's default); a harness sets none. */
+export function targetConcurrency(runner) {
+    return runner.kind === "connection" ? defaultLlmEngineConcurrency(runner.endpoint, runner.concurrency) : undefined;
 }
 /** The request as it may be persisted: its live runtime environment removed. */
 export function durableRequest(request) {
@@ -45,14 +37,15 @@ export function durableRequest(request) {
     wire.runtime = runtime;
     return decodeResolvedExecutionRequest(wire);
 }
-export function executionUnitValues(unit, workspace) {
+export function executionUnitValues(unit) {
     return Object.freeze({
+        ...(unit && Object.hasOwn(unit, "connection") ? { connection: unit.connection } : {}),
+        ...(unit && Object.hasOwn(unit, "harness") ? { harness: unit.harness } : {}),
         ...(unit && Object.hasOwn(unit, "engine") ? { engine: unit.engine } : {}),
         ...(unit && Object.hasOwn(unit, "model") ? { model: unit.model } : {}),
         ...(unit && Object.hasOwn(unit, "llm") ? { inference: unit.llm } : {}),
         ...(unit && Object.hasOwn(unit, "timeoutMs") ? { timeout: unit.timeoutMs } : {}),
         ...(unit && "output" in unit && Object.hasOwn(unit, "output") ? { outputSchema: unit.output } : {}),
-        workspace,
     });
 }
 /** Step ids declared BEFORE `stepId` — the same ordering `map.over` and `inputs:` rely on. */

package/dist/workflows/freeze/targets/child-workflow.js

@@ -11,7 +11,6 @@ import { UsageError } from "../../../core/errors.js";
 import { workflowParamContract } from "../../ir/params.js";
 import { canonicalJson, canonicalPlanJson } from "../../ir/plan-hash.js";
 import { loadWorkflowAsset } from "../../runtime/workflow-asset-loader.js";
-import { resolveOwnedAsset } from "../environment.js";
 import { declaredParamNames, earlierStepIds, } from "../step-values.js";
 import { freezeTaskInputBindings } from "../task-bindings.js";
 /** The child target's own content identity: its ref, embedded plan hash, and bindings. */
@@ -46,10 +45,9 @@ function assertNoCompositionCycle(stepId, childRef, refPath) {
 }
 export async function childWorkflowDispatch(input) {
     const { source, baseUnit, childRefInput, context } = input;
-    // Resolution failures propagate unchanged, in code and shape — the same
-    // authority every other asset reference resolves through.
-    const owned = await resolveOwnedAsset(childRefInput, "workflow", context);
-    const childAsset = await loadWorkflowAsset(owned.ref);
+    // The loader resolves the ref through the one walk, so a missing child fails
+    // like any other missing workflow.
+    const childAsset = await loadWorkflowAsset(childRefInput);
     const childRef = childAsset.ref;
     // The composition cycle check, before any child compilation.
     assertNoCompositionCycle(source.id, childRef, context.refPath);

package/dist/workflows/freeze/targets/command.js

@@ -3,34 +3,28 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { createHash } from "node:crypto";
 import { prepareCommandInvocation } from "../../../commands/command/command-execution.js";
-import { captureFrozenDirectoryIdentity } from "../../../execution/directory-identity.js";
 import { canonicalResolvedExecutionRequest, } from "../../../execution/resolved-request.js";
-import { fallbackAnnouncement } from "../../../integrations/agent/engine-fallback.js";
 import { buildExecution } from "../../../integrations/agent/execution.js";
-import { freezeEnvironment, workflowExecutionSource } from "../environment.js";
+import { freezeEnvironment } from "../environment.js";
 import { durableRequest, executionUnitValues, targetConcurrency, } from "../step-values.js";
 export async function commandDispatch(source, baseUnit, action, context) {
     const prepared = await prepareCommandInvocation({
         action,
         config: context.config,
-        ...(context.plan.defaults
-            ? { invocationDefaults: executionUnitValues(context.plan.defaults, context.asset.sourcePath) }
-            : {}),
+        ...(context.plan.defaults ? { invocationDefaults: executionUnitValues(context.plan.defaults) } : {}),
         inlineContentMode: "literal",
-        current: executionUnitValues(source.unit, context.asset.sourcePath),
-        sourceLoader: (ref, kind) => workflowExecutionSource(ref, kind, context),
+        current: executionUnitValues(source.unit),
     });
     return commandResult(source, baseUnit, prepared, context);
 }
 export function commandResult(source, baseUnit, prepared, context, literals = []) {
     const request = durableRequest(prepared.request);
     const lowered = buildExecution(request, prepared.runner);
-    const cwdIdentity = captureFrozenDirectoryIdentity(context.asset.sourcePath);
     const runner = lowered.runner;
     const unit = {
         ...baseUnit,
-        engine: request.engine.name,
-        ...(request.model ? { model: request.model.resolved } : {}),
+        engine: request.target.name,
+        ...(request.model ? { model: request.model.model } : {}),
         ...(Object.hasOwn(request.runtime, "timeoutMs") ? { timeoutMs: request.runtime.timeoutMs } : {}),
         ...(request.inference ? { llm: request.inference } : {}),
         ...(request.outputSchema ? { output: request.outputSchema } : {}),
@@ -42,15 +36,15 @@ export function commandResult(source, baseUnit, prepared, context, literals = []
         contentHash: createHash("sha256").update(request.command.content).digest("hex"),
         request: JSON.parse(canonicalResolvedExecutionRequest(request)),
         runner,
-        ...(targetConcurrency(runner, context.config) ? { concurrency: targetConcurrency(runner, context.config) } : {}),
-        cwdIdentity,
+        ...(targetConcurrency(runner) ? { concurrency: targetConcurrency(runner) } : {}),
+        // Not a location. akm 0.10.0 and earlier decode a command-only plan and run it in the invoking directory,
+        // but their dispatch refuses a directory identity it cannot verify, so they stop here instead.
+        cwdIdentity: {},
     });
-    const engineAnnouncement = fallbackAnnouncement(prepared.fallbackEngineName, request.engine.name);
     return {
         target,
         environment,
         unit,
         instructions: request.command.content,
-        ...(engineAnnouncement ? { engineAnnouncement } : {}),
     };
 }

package/dist/workflows/freeze/targets/shell.js

@@ -1,7 +1,6 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-import { captureFrozenDirectoryIdentity } from "../../../execution/directory-identity.js";
 import { freezeEnvironment } from "../environment.js";
 import { freezeExecSpec, } from "../step-values.js";
 export function directShell(source, baseUnit, context) {
@@ -9,13 +8,11 @@ export function directShell(source, baseUnit, context) {
     if (!authoredExec)
         throw new Error(`workflow shell step ${source.id} has no argv`);
     const exec = freezeExecSpec(source, authoredExec, context);
-    const cwdIdentity = captureFrozenDirectoryIdentity(context.asset.sourcePath, authoredExec.cwd);
     const environment = Object.freeze(freezeEnvironment(source, authoredExec, context));
     const target = Object.freeze({
         kind: "shell",
         contentHash: "",
         exec,
-        cwdIdentity,
     });
     return {
         target,

package/dist/workflows/freeze/task-bindings.js

@@ -6,7 +6,6 @@
  * {@link freezeTaskInputBindings} classifies an authored `with:` against a
  * child workflow's `params:` contract. A reference's resolved value is
  * validated before each attempt (`exec/step-work.ts`).
- * See docs/architecture/decisions/0008-task-binding-normalization.md.
  */
 import { isRecord } from "../../core/common.js";
 import { UsageError } from "../../core/errors.js";