akm-cli 0.9.0-rc.1 → 0.9.0-rc.2

package/dist/workflows/exec/report.js

@@ -41,13 +41,17 @@ import { randomUUID } from "node:crypto";
 import { UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { validateJsonSchemaSubset } from "../../core/json-schema.js";
+import { acquireMaintenanceActivity } from "../../core/maintenance-barrier.js";
+import { collectSensitiveValues, isEnvPassthroughValueSafeToExpose, redactSensitiveText, redactSensitiveValue, } from "../../core/redaction.js";
 import { withWorkflowRunsRepo, } from "../../storage/repositories/workflow-runs-repository.js";
 import { assertRunParamsSatisfyPlan } from "../ir/params.js";
 import { PROGRAM_RETRY_REASONS } from "../program/schema.js";
+import { requireExecutableWorkflowPlan } from "../runtime/plan-classifier.js";
 import { completeWorkflowStep, getNextWorkflowStep, snapshotRunForDriver, } from "../runtime/runs.js";
 import { UNIT_STALE_MS } from "../runtime/unit-checkin.js";
 import { buildLease, resolveRunId } from "./brief.js";
-import { activeGateLoop, cascadeSkippedRouter, computeStepWorkList, finalizeExecutedStep, isRetryEligibleFailure, parseFrozenPlan, recoverGateFeedback, reduceEmptyStep, reduceStepOutcomes, seedJournaledRouteDecisions, selectUnitAttemptRow, stepOutputsFromEvidence, unitOutcomeFromRow, unitStillNeedsReport, } from "./step-work.js";
+import { frozenSummaryJudge } from "./frozen-judge.js";
+import { activeGateLoop, cascadeSkippedRouter, computeStepWorkList, finalizeExecutedStep, isRetryEligibleFailure, recoverGateFeedback, reduceEmptyStep, reduceStepOutcomes, seedJournaledRouteDecisions, selectUnitAttemptRow, stepOutputsFromEvidence, unitOutcomeFromRow, unitStillNeedsReport, } from "./step-work.js";
 /**
  * Claim time-to-live. Equal to the unit-checkin stale window
  * ({@link UNIT_STALE_MS}) so a claim expires at exactly the moment
@@ -66,14 +70,21 @@ const CLAIM_TTL_MS = UNIT_STALE_MS;
 const FINALIZE_LOCK_TTL_MS = 90_000;
 // ── Entry point ──────────────────────────────────────────────────────────────
 export async function reportWorkflowUnit(input) {
+    const release = await acquireMaintenanceActivity("workflow-report");
+    try {
+        return await reportWorkflowUnitWithBarrier(input);
+    }
+    finally {
+        release();
+    }
+}
+async function reportWorkflowUnitWithBarrier(input) {
     const nowFn = input.now ?? (() => new Date());
     const nowIso = nowFn().toISOString();
     const runId = await resolveRunId(input.target);
     // #14: read the spine, run row, and unit journal in ONE snapshot so the guards
     // below see a consistent point-in-time state (same fix as `brief`).
     const { next, run: runRow, units } = await snapshotRunForDriver(runId);
-    const planJson = runRow.plan_json;
-    const planHash = runRow.plan_hash;
     const leaseHolder = runRow.engine_lease_holder;
     const leaseUntil = runRow.engine_lease_until;
     // Refuse a non-active run: there is no work-list to report against.
@@ -100,7 +111,7 @@ export async function reportWorkflowUnit(input) {
             `moved since you briefed it — a concurrent report/run/manual completion advanced the run. Re-run ` +
             `\`akm workflow brief ${runId}\` and report against the current step.`, "INVALID_FLAG_VALUE");
     }
-    const plan = loadFrozenPlan(runId, planJson, planHash);
+    const plan = requireExecutableWorkflowPlan(runRow);
     // Reviewer #12: the journaled params row must still satisfy the frozen param
     // schemas before report resolves any unit prompt from it — a violation is
     // post-start corruption, refused loudly (mirrors the frozen-plan hash check
@@ -140,14 +151,21 @@ export async function reportWorkflowUnit(input) {
         throw new UsageError(`Unit "${input.unitId}" cannot be resolved (${workUnit.resolved.error}) — it has no dispatchable input to ` +
             `report a result against. This is an authoring/data error in the workflow; fix it and start a new run.`);
     }
+    if (!workUnit.engine || !workUnit.invocation) {
+        throw new UsageError(`Unit "${workUnit.unitId}" has no complete frozen engine attribution.`);
+    }
+    const engineName = workUnit.engine.name;
+    const exactModel = workUnit.invocation.model;
     const inputHash = workUnit.resolved.inputHash;
     const journalId = workUnit.journalBaseId;
+    const sensitiveValues = await collectReportedUnitSensitiveValues(workUnit);
+    const sessionId = input.sessionId === undefined ? undefined : redactSensitiveText(input.sessionId, sensitiveValues);
     // ── running: claim / heartbeat, never advances the spine ───────────────────
     if (input.status === "running") {
         // The claim holder: the driver's --session-id, else a token we mint and
         // return so the driver can reuse it (as --session-id) to heartbeat and
         // finish the SAME claim. First unexpired claim wins.
-        const holder = input.sessionId ?? `claim:${randomUUID()}`;
+        const holder = sessionId ?? `claim:${randomUUID()}`;
         const claimExpiresAt = new Date(nowFn().getTime() + CLAIM_TTL_MS).toISOString();
         const claimed = await withWorkflowRunsRepo((repo) => repo.transaction(() => {
             const existing = repo.getUnit(runId, journalId);
@@ -175,7 +193,8 @@ export async function reportWorkflowUnit(input) {
                 parentUnitId: workUnit.isFanOut ? `${stepState.id}.map` : null,
                 phase: null,
                 runner: workUnit.runner,
-                model: workUnit.model ?? null,
+                engine: engineName,
+                model: exactModel,
                 inputHash,
                 startedAt: nowIso,
                 claimHolder: holder,
@@ -208,7 +227,7 @@ export async function reportWorkflowUnit(input) {
         };
     }
     // ── completed / failed: validate, guard, write, maybe finalize ─────────────
-    const { resultJson, failureReason } = prepareResult(input, workUnit);
+    const { resultJson, failureReason } = prepareResult(input, workUnit, sensitiveValues);
     const thisTokens = input.tokens ?? 0;
     // Guarded write: the idempotent re-report / replay-divergence check and the
     // budget ceiling are evaluated INSIDE the same SQLite transaction as the
@@ -216,7 +235,7 @@ export async function reportWorkflowUnit(input) {
     // one budgeted step) serialize on the write lock — each sees the other's row
     // and the row is always internally consistent.
     const status = input.status;
-    const holder = input.sessionId ?? null;
+    const holder = sessionId ?? null;
     const writeResult = await withWorkflowRunsRepo((repo) => repo.transaction(() => {
         const existing = repo.getUnit(runId, journalId);
         if (existing?.status === "completed") {
@@ -279,7 +298,8 @@ export async function reportWorkflowUnit(input) {
                 parentUnitId: workUnit.isFanOut ? `${stepState.id}.map` : null,
                 phase: null,
                 runner: workUnit.runner,
-                model: workUnit.model ?? null,
+                engine: engineName,
+                model: exactModel,
                 inputHash,
                 startedAt: existing?.started_at ?? nowIso,
             });
@@ -306,7 +326,7 @@ export async function reportWorkflowUnit(input) {
             resultJson,
             tokens: carriedTokens,
             failureReason,
-            sessionId: input.sessionId ?? null,
+            sessionId: sessionId ?? null,
             finishedAt: nowIso,
         });
         // A `tokens-cross` verdict: this unit's OWN tokens push the run total over
@@ -381,7 +401,7 @@ export async function reportWorkflowUnit(input) {
                 byUnit,
                 gateLoop,
                 priorEvidence,
-                summaryJudge: input.summaryJudge,
+                summaryJudge: input.summaryJudge === undefined ? frozenSummaryJudge(plan, stepPlan.gate.judge) : input.summaryJudge,
                 now: nowFn,
                 written: { unitId: journalId, status },
                 recorded: "written",
@@ -444,7 +464,7 @@ export async function reportWorkflowUnit(input) {
         byUnit,
         gateLoop,
         priorEvidence,
-        summaryJudge: input.summaryJudge,
+        summaryJudge: input.summaryJudge === undefined ? frozenSummaryJudge(plan, stepPlan.gate.judge) : input.summaryJudge,
         now: nowFn,
         written: { unitId: journalId, status },
         recorded: idempotent ? "idempotent" : "written",
@@ -471,6 +491,15 @@ export async function reportWorkflowUnit(input) {
  * `finalizeStep` uses) so two concurrent settles/reports cannot double-journal.
  */
 export async function settleWorkflowSpine(input) {
+    const release = await acquireMaintenanceActivity("workflow-report-settle");
+    try {
+        return await settleWorkflowSpineWithBarrier(input);
+    }
+    finally {
+        release();
+    }
+}
+async function settleWorkflowSpineWithBarrier(input) {
     const nowFn = input.now ?? (() => new Date());
     const runId = await resolveRunId(input.target);
     const { next, run: runRow, units } = await snapshotRunForDriver(runId);
@@ -491,7 +520,7 @@ export async function settleWorkflowSpine(input) {
         throw new UsageError(`Workflow run ${runId} is now on step "${next.step.id}", not "${input.expectStep}" (--expect-step). The spine ` +
             `moved since you briefed it — re-run \`akm workflow brief ${runId}\` and settle against the current step.`, "INVALID_FLAG_VALUE");
     }
-    const plan = loadFrozenPlan(runId, runRow.plan_json, runRow.plan_hash);
+    const plan = requireExecutableWorkflowPlan(runRow);
     assertRunParamsSatisfyPlan(runId, plan, next.run.params ?? {});
     // A step with resolvable units is settled ONLY when its work-list is FULLY
     // TERMINAL — every resolvable unit run to a terminal state, nothing left to
@@ -611,6 +640,7 @@ function buildStepContext(runId, plan, next, units) {
         runId,
         params: next.run.params ?? {},
         stepOutputs,
+        engines: plan.execution.engines,
         gateLoop,
         ...(gateFeedback ? { gateFeedback } : {}),
     });
@@ -778,7 +808,7 @@ async function finalizeStep(args) {
             workflowRef: next.run.workflowRef,
             stepPlan,
             stepId: stepState.id,
-            completionCriteria: stepState.completionCriteria ?? [],
+            completionCriteria: stepPlan.gate.criteria,
             gateLoop,
             reduced,
             priorEvidence: args.priorEvidence,
@@ -860,6 +890,7 @@ async function settleSpine(args) {
         const sp = plan.steps.find((s) => s.stepId === step.id);
         if (!sp)
             break;
+        const stepJudge = summaryJudge === undefined ? frozenSummaryJudge(plan, sp.gate.judge) : summaryJudge;
         // A route-skipped target: complete it as skipped, cascading if it is itself
         // a router (identical to the engine loop's skip handling).
         const skipInfo = routeUnselected.get(step.id);
@@ -883,7 +914,7 @@ async function settleSpine(args) {
                 workflowRef: state.run.workflowRef,
                 stepId: step.id,
                 stepPlan: sp,
-                completionCriteria: step.completionCriteria ?? [],
+                completionCriteria: sp.gate.criteria,
                 gateLoop: 1,
                 loopsRemaining: false,
                 result: {
@@ -896,7 +927,7 @@ async function settleSpine(args) {
                 params: state.run.params ?? {},
                 routeSelected,
                 routeUnselected,
-                summaryJudge,
+                summaryJudge: stepJudge,
                 ...leaseArg,
             });
             if (fin.kind !== "advanced")
@@ -919,6 +950,7 @@ async function settleSpine(args) {
                 runId,
                 params: state.run.params ?? {},
                 stepOutputs,
+                engines: plan.execution.engines,
                 gateLoop,
                 ...(gateFeedback ? { gateFeedback } : {}),
             });
@@ -946,14 +978,14 @@ async function settleSpine(args) {
                 workflowRef: state.run.workflowRef,
                 stepPlan: sp,
                 stepId: step.id,
-                completionCriteria: step.completionCriteria ?? [],
+                completionCriteria: sp.gate.criteria,
                 gateLoop,
                 reduced,
                 priorEvidence,
                 params: state.run.params ?? {},
                 routeSelected,
                 routeUnselected,
-                summaryJudge,
+                summaryJudge: stepJudge,
                 ...leaseArg,
             });
             if (completion.kind === "advanced") {
@@ -977,13 +1009,6 @@ async function settleSpine(args) {
     return getNextWorkflowStep(runId);
 }
 // ── Helpers ──────────────────────────────────────────────────────────────────
-function loadFrozenPlan(runId, planJson, planHash) {
-    if (!planJson) {
-        throw new UsageError(`Workflow run ${runId} predates frozen plans (no plan_json on the run row) and cannot be driven by ` +
-            `\`akm workflow report\`. Use engine-driven mode: \`akm workflow run ${runId}\`.`);
-    }
-    return parseFrozenPlan(runId, planJson, planHash);
-}
 /**
  * Normalize a driver-supplied `--failure-reason` to the persisted taxonomy (PR
  * #714 review round 2, #16). An external driver can type ANY string; storing it
@@ -1001,10 +1026,12 @@ function loadFrozenPlan(runId, planJson, planHash) {
  *     unknown external reason is recorded for observability without ever
  *     triggering retry.
  */
-export function normalizeFailureReason(raw) {
+export function normalizeFailureReason(raw, sensitiveValues = []) {
     const trimmed = raw?.trim();
     if (!trimmed)
         return "reported_failure";
+    if (redactSensitiveText(trimmed, sensitiveValues) !== trimmed)
+        return "reported_failure";
     if (PROGRAM_RETRY_REASONS.includes(trimmed))
         return trimmed;
     const slug = trimmed
@@ -1015,11 +1042,13 @@ export function normalizeFailureReason(raw) {
     return `external:${slug || "unknown"}`;
 }
 /** Validate + shape the reported result into what `finishUnit` persists. */
-function prepareResult(input, workUnit) {
+function prepareResult(input, workUnit, sensitiveValues) {
     if (input.status === "failed") {
         return {
-            resultJson: input.resultRaw !== undefined && input.resultRaw !== "" ? JSON.stringify(input.resultRaw) : null,
-            failureReason: normalizeFailureReason(input.failureReason),
+            resultJson: input.resultRaw !== undefined && input.resultRaw !== ""
+                ? JSON.stringify(redactSensitiveText(input.resultRaw, sensitiveValues))
+                : null,
+            failureReason: normalizeFailureReason(input.failureReason, sensitiveValues),
         };
     }
     // completed
@@ -1034,13 +1063,13 @@ function prepareResult(input, workUnit) {
             parsed = JSON.parse(raw);
         }
         catch (err) {
-            throw new UsageError(`Unit "${input.unitId}" result is not valid JSON (its output schema requires a JSON value): ${err instanceof Error ? err.message : String(err)}`, "INVALID_FLAG_VALUE");
+            throw new UsageError(`Unit "${input.unitId}" result is not valid JSON (its output schema requires a JSON value): ${redactSensitiveText(err instanceof Error ? err.message : String(err), sensitiveValues)}`, "INVALID_FLAG_VALUE");
         }
         const errors = validateJsonSchemaSubset(parsed, workUnit.schema);
         if (errors.length > 0) {
-            throw new UsageError(`Unit "${input.unitId}" result failed validation against its declared output schema: ${errors.join("; ")}.`, "INVALID_FLAG_VALUE");
+            throw new UsageError(`Unit "${input.unitId}" result failed validation against its declared output schema: ${redactSensitiveText(errors.join("; "), sensitiveValues)}.`, "INVALID_FLAG_VALUE");
         }
-        return { resultJson: JSON.stringify(parsed), failureReason: null };
+        return { resultJson: JSON.stringify(redactSensitiveValue(parsed, sensitiveValues)), failureReason: null };
     }
     // Free-text unit: journal the text as a JSON string EXACTLY as the executor
     // does — `native-executor.ts` finishUnit uses `outcome.text ? JSON.stringify… :
@@ -1048,7 +1077,38 @@ function prepareResult(input, workUnit) {
     // Matching that keeps the promoted artifact and the dispatch row byte-identical
     // across the engine and report surfaces (the cardinal graph-parity rule), and
     // stays consistent with the FAILED branch above which also maps ""→null.
-    return { resultJson: input.resultRaw ? JSON.stringify(input.resultRaw) : null, failureReason: null };
+    return {
+        resultJson: input.resultRaw ? JSON.stringify(redactSensitiveText(input.resultRaw, sensitiveValues)) : null,
+        failureReason: null,
+    };
+}
+async function collectReportedUnitSensitiveValues(workUnit) {
+    const values = new Set();
+    for (const ref of workUnit.env ?? []) {
+        const { resolveEnvBinding } = await import("../../commands/env/env-binding.js");
+        for (const value of Object.values(resolveEnvBinding(ref).values))
+            values.add(value);
+    }
+    const collectEngine = (engine) => {
+        if (!engine)
+            return;
+        if (engine.kind === "llm") {
+            for (const name of engine.credential?.names ?? []) {
+                const value = process.env[name]?.trim();
+                if (value)
+                    values.add(value);
+            }
+            return;
+        }
+        for (const name of engine.envPassthrough) {
+            const value = process.env[name];
+            if (!isEnvPassthroughValueSafeToExpose(name, value) && value)
+                values.add(value);
+        }
+    };
+    collectEngine(workUnit.engine);
+    collectEngine(workUnit.fallbackEngine);
+    return collectSensitiveValues(values);
 }
 /**
  * Assess the frozen plan's declared budget ceilings for ONE report, seeded from

package/dist/workflows/exec/run-workflow.js

@@ -62,20 +62,33 @@
  */
 import { randomUUID } from "node:crypto";
 import { UsageError } from "../../core/errors.js";
-import { warn } from "../../core/warn.js";
+import { withMaintenanceStartBarrierAsync } from "../../core/maintenance-barrier.js";
 import { disposeDispatchResources } from "../../integrations/agent/runner-dispatch.js";
 import { withWorkflowRunsRepo } from "../../storage/repositories/workflow-runs-repository.js";
 import { assertRunParamsSatisfyPlan } from "../ir/params.js";
+import { computePlanHash } from "../ir/plan-hash.js";
+import { decodeWorkflowPlanV3 } from "../ir/schema.js";
+import { requireExecutableWorkflowPlan } from "../runtime/plan-classifier.js";
 import { completeWorkflowStep, getNextWorkflowStep } from "../runtime/runs.js";
-import { compileWorkflowAssetPlan, loadWorkflowAsset } from "../runtime/workflow-asset-loader.js";
+import { frozenSummaryJudge } from "./frozen-judge.js";
 import { executeStepPlan } from "./native-executor.js";
 // Shared step semantics — route evaluation + cascaded-skip bookkeeping,
 // gate-evaluation journaling, and the whole step-completion path
 // (`finalizeExecutedStep`) live in step-work.ts so the engine loop and the R3
 // brief/report driver protocol share ONE implementation (no drift).
-import { activeGateLoop, cascadeSkippedRouter, finalizeExecutedStep, GATE_EVALUATION_PHASE, parseFrozenPlan, recoverGateFeedback, seedJournaledRouteDecisions, } from "./step-work.js";
+import { activeGateLoop, cascadeSkippedRouter, finalizeExecutedStep, GATE_EVALUATION_PHASE, recoverGateFeedback, seedJournaledRouteDecisions, } from "./step-work.js";
 export async function runWorkflowSteps(options) {
     const next = await getNextWorkflowStep(options.target, options.params);
+    // Version/canonical/hash validation precedes every executable mutation,
+    // including lease acquisition. Historical rows remain inspectable/abandonable.
+    if (!next.done && !options.loadPlan) {
+        await withWorkflowRunsRepo((repo) => {
+            const row = repo.getRunById(next.run.id);
+            if (!row)
+                throw new UsageError(`Workflow run ${next.run.id} was not found.`);
+            requireExecutableWorkflowPlan(row);
+        });
+    }
     // Refuse non-active runs BEFORE any dispatch — completeWorkflowStep would
     // reject the completion anyway, but only after the units already ran (and
     // cost money). Mirror its preflight up front.
@@ -128,7 +141,7 @@ export async function runWorkflowSteps(options) {
             // hanging on the leaked handle. Runs even if lease release itself fails;
             // a teardown-time repository error must not skip dispatch cleanup.
             try {
-                (options.disposeDispatchResources ?? disposeDispatchResources)();
+                await (options.disposeDispatchResources ?? disposeDispatchResources)();
             }
             catch {
                 /* disposal is best-effort; never let cleanup mask the run outcome */
@@ -148,14 +161,14 @@ function leaseExpiry() {
  * arbiter — two racing invocations cannot both win.
  */
 async function acquireRunLease(runId, holder) {
-    await withWorkflowRunsRepo((repo) => {
+    await withMaintenanceStartBarrierAsync(() => withWorkflowRunsRepo((repo) => {
         if (repo.acquireEngineLease(runId, holder, leaseExpiry(), new Date().toISOString()))
             return;
         const row = repo.getRunById(runId);
         throw new UsageError(`Workflow run ${runId} is already being driven by engine ${row?.engine_lease_holder ?? "(unknown)"} ` +
             `(run lease expires ${row?.engine_lease_until ?? "(unknown)"}). A second \`akm workflow run\` would race it — ` +
             `wait for that invocation to finish or for the lease to expire.`);
-    });
+    }));
 }
 /**
  * Renew the lease between steps. Losing the lease mid-run (it expired during
@@ -333,11 +346,14 @@ async function driveRun(options, initial, leaseHolder, heartbeat) {
     const journaledDispatches = journaledUnits.filter((row) => row.phase !== GATE_EVALUATION_PHASE);
     let unitsDispatched = journaledDispatches.reduce((sum, row) => sum + row.attempts, 0);
     let tokensUsed = journaledDispatches.reduce((sum, row) => sum + (row.tokens ?? 0), 0);
-    // One plan per invocation: the test seam receives the workflow ref; the
-    // default reads the run's frozen plan and never touches the asset file.
-    const plan = options.loadPlan
-        ? await options.loadPlan(next.run.workflowRef)
-        : await loadFrozenPlan(next.run.id, next.run.workflowRef);
+    // The decoded/hash-verified row plan is the sole execution authority. The
+    // loader seam may assert an expected plan in tests, but can never replace it.
+    const plan = await loadFrozenPlan(next.run.id, next.run.workflowRef);
+    if (options.loadPlan) {
+        const expected = decodeWorkflowPlanV3(await options.loadPlan(next.run.workflowRef));
+        if (computePlanHash(expected) !== computePlanHash(plan))
+            throw new UsageError(`Injected workflow plan for run ${next.run.id} differs from its frozen plan.`);
+    }
     // Reviewer #12: the journaled params row must still satisfy the frozen param
     // schemas before the engine resolves any unit prompt from it. Applied on ALL
     // THREE driver surfaces (engine here, brief, report) so schema-violating
@@ -475,13 +491,14 @@ async function driveRun(options, initial, leaseHolder, heartbeat) {
                     // Budget ceilings ride the FROZEN plan (addendum R2): a mid-run
                     // asset edit can never loosen or tighten a run's budget.
                     ...(plan.budget ? { budget: plan.budget } : {}),
+                    ...(plan.execution ? { engines: plan.execution.engines } : {}),
                     gateLoop,
                     ...(gateFeedback ? { gateFeedback } : {}),
                     // The heartbeat's signal is the effective dispatch signal: a lost
                     // lease (or a caller abort) aborts in-flight units promptly.
                     ...(dispatchSignal ? { signal: dispatchSignal } : {}),
                     ...(options.dispatcher ? { dispatcher: options.dispatcher } : {}),
-                    ...(options.maxConcurrency !== undefined ? { maxConcurrency: options.maxConcurrency } : {}),
+                    maxConcurrency: Math.min(options.maxConcurrency ?? Number.POSITIVE_INFINITY, plan.execution?.maxConcurrency ?? 1),
                 });
             // If the heartbeat lost the lease WHILE this step dispatched, another
             // engine now owns the run — stop loudly BEFORE finalizing the step
@@ -510,7 +527,7 @@ async function driveRun(options, initial, leaseHolder, heartbeat) {
                 workflowRef: next.run.workflowRef,
                 stepId: step.id,
                 stepPlan,
-                completionCriteria: step.completionCriteria ?? [],
+                completionCriteria: stepPlan.gate.criteria,
                 gateLoop,
                 loopsRemaining: gateLoop < maxLoops,
                 result,
@@ -518,7 +535,7 @@ async function driveRun(options, initial, leaseHolder, heartbeat) {
                 params: next.run.params ?? {},
                 routeSelected,
                 routeUnselected,
-                summaryJudge: options.summaryJudge,
+                summaryJudge: options.summaryJudge === undefined ? frozenSummaryJudge(plan, stepPlan.gate.judge) : options.summaryJudge,
                 ...(options.requireGates ? { requireGates: true } : {}),
                 leaseHolder,
             });
@@ -578,19 +595,15 @@ async function driveRun(options, initial, leaseHolder, heartbeat) {
  *     canonical JSON). A mismatch means the journaled plan was tampered with
  *     or corrupted — fail loudly, never silently recompile. The workflow
  *     asset file is NEVER touched on this path.
- *   - `plan_json` NULL → the run predates frozen plans (created before
- *     migration 006). Warn and fall back to compiling from the live asset,
- *     preserving pre-006 behavior for in-flight legacy runs.
+ * Historical v2/null rows are inspection-only in the engine cutover. They are
+ * never recompiled from a mutable source asset.
  */
-async function loadFrozenPlan(runId, workflowRef) {
+async function loadFrozenPlan(runId, _workflowRef) {
     const row = await withWorkflowRunsRepo((repo) => {
         const run = repo.getRunById(runId);
-        return run ? { planJson: run.plan_json, planHash: run.plan_hash } : undefined;
+        return run;
     });
-    if (row?.planJson) {
-        return parseFrozenPlan(runId, row.planJson, row.planHash);
-    }
-    warn(`Workflow run ${runId} predates frozen plans (no plan_json on the run row); ` +
-        `compiling the plan from the live asset ${workflowRef}. New runs freeze their plan at start.`);
-    return compileWorkflowAssetPlan(await loadWorkflowAsset(workflowRef));
+    if (!row)
+        throw new UsageError(`Workflow run ${runId} was not found.`);
+    return requireExecutableWorkflowPlan(row);
 }

package/dist/workflows/exec/scheduler.js

@@ -6,13 +6,12 @@
  *
  * A thin policy layer over `core/concurrent.ts` (`concurrentMap`) — the
  * existing semaphore-bounded pool is generalized, not forked. The scheduler
- * owns the engine-wide limits the plan requires:
+ * owns the limits the plan requires:
  *
- *   - Engine-wide concurrency cap, applied on top of whatever per-step
- *     concurrency the workflow declares. The cap is the `workflow.maxConcurrency`
- *     akm config setting when set (clamped to
- *     `[1, WORKFLOW_MAX_CONCURRENCY_CEILING]`), else the CPU-derived default
- *     `min(16, cores − 2)` (the original Claude-Code-matching formula).
+ *   - The effective width is the minimum of the map request, the frozen
+ *     workflow cap, the selected LLM engine's frozen cap (when applicable),
+ *     and the current host's CPU-derived safety cap. Reapplying host safety at
+ *     dispatch matters when a frozen run resumes on a smaller machine.
  *   - Cooperative cancellation via AbortSignal (workers stop claiming items;
  *     the same signal is passed into each dispatch so in-flight units can be
  *     preempted too).
@@ -24,9 +23,10 @@
  * units impossible to resume (peer review R1). Only work that really
  * dispatches consumes the cap.
  */
-import os from "node:os";
 import { concurrentMap } from "../../core/concurrent.js";
-import { loadConfig } from "../../core/config/config.js";
+import { cpuDerivedUnitConcurrency, workflowMaxConcurrency } from "../concurrency-policy.js";
+import { WORKFLOW_MAX_MAP_EXPANSION } from "../resource-limits.js";
+export { clampMaxConcurrency, cpuDerivedUnitConcurrency, WORKFLOW_MAX_CONCURRENCY_CEILING, } from "../concurrency-policy.js";
 /**
  * Hard ceiling on an EXPLICIT `workflow.maxConcurrency`. A user value above
  * this is clamped down (not rejected) so a config shared across machines with
@@ -34,32 +34,6 @@ import { loadConfig } from "../../core/config/config.js";
  * 64 is deliberately far above any sane fan-out width — it exists only to keep
  * a fat-fingered `100000` from spawning a runaway pool.
  */
-export const WORKFLOW_MAX_CONCURRENCY_CEILING = 64;
-/**
- * CPU-derived engine cap used when `workflow.maxConcurrency` is unset — the
- * original `min(16, cores−2)` formula (matching Claude Code), floored at 1.
- */
-export function cpuDerivedUnitConcurrency(cpuCount = os.cpus()?.length ?? 4) {
-    return Math.min(16, Math.max(1, cpuCount - 2));
-}
-/** Clamp an explicit configured value into `[1, WORKFLOW_MAX_CONCURRENCY_CEILING]`. */
-export function clampMaxConcurrency(value) {
-    return Math.min(WORKFLOW_MAX_CONCURRENCY_CEILING, Math.max(1, Math.floor(value)));
-}
-/**
- * Read `workflow.maxConcurrency` from config, fail-open to `undefined` (use the
- * CPU default) on any load error or a non-numeric value. Kept side-effect-free
- * and defensive: the scheduler must never fail a run because config is unwell.
- */
-function configuredMaxConcurrency() {
-    try {
-        const value = loadConfig().workflow?.maxConcurrency;
-        return typeof value === "number" && Number.isFinite(value) ? value : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
 /**
  * Engine-wide ceiling on concurrent units. Precedence:
  *   1. An explicit `workflow.maxConcurrency` config value, clamped to
@@ -72,13 +46,11 @@ function configuredMaxConcurrency() {
  * @param configured Explicit config value seam (defaults to reading config);
  *                   pass `undefined` explicitly to force the CPU path in a test.
  */
-export function maxUnitConcurrency(cpuCount = os.cpus()?.length ?? 4, configured = configuredMaxConcurrency()) {
-    if (configured !== undefined)
-        return clampMaxConcurrency(configured);
-    return cpuDerivedUnitConcurrency(cpuCount);
+export function maxUnitConcurrency(cpuCount, configured) {
+    return workflowMaxConcurrency(configured, cpuCount);
 }
 /** Lifetime unit cap per run — a runaway-loop backstop, far above real use. */
-export const LIFETIME_UNIT_CAP = 1000;
+export const LIFETIME_UNIT_CAP = WORKFLOW_MAX_MAP_EXPANSION;
 export class UnitCapExceededError extends Error {
     constructor(cap) {
         super(`workflow run exceeded the lifetime unit cap (${cap}). Aborting dispatch — check for a runaway fan-out.`);
@@ -94,7 +66,6 @@ export class UnitCapExceededError extends Error {
  * resume stay free.
  */
 export async function scheduleUnits(items, dispatch, options = {}) {
-    const cap = options.maxConcurrency ?? maxUnitConcurrency();
-    const concurrency = Math.max(1, Math.min(options.concurrency ?? 1, cap));
+    const concurrency = Math.max(1, Math.min(options.concurrency ?? 1, options.maxConcurrency ?? Number.POSITIVE_INFINITY, options.llmConcurrency ?? Number.POSITIVE_INFINITY, options.hostConcurrency ?? cpuDerivedUnitConcurrency()));
     return concurrentMap(items, dispatch, concurrency, { signal: options.signal });
 }