akm-cli 0.9.1 → 0.9.2-alpha.2

package/dist/tasks/standalone-script-entry.js

@@ -0,0 +1,5 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/** Fixed private dispatch mode embedded into Bun standalone AKM artifacts. */
+export const STANDALONE_FROZEN_SCRIPT_ARG = "__akm_internal_frozen_script_v1__";

package/dist/tasks/task-id.js

@@ -25,6 +25,9 @@ export function validateTaskId(id) {
     if (TASK_FILE_SUFFIX_RE.test(id)) {
         throw new UsageError(`Task id "${id}" is invalid. Use the bare task id without a .yml or .yaml suffix.`, "INVALID_FLAG_VALUE");
     }
+    if (id.endsWith(".")) {
+        throw new UsageError(`Task id "${id}" is invalid. Trailing periods are not portable across native schedulers.`, "INVALID_FLAG_VALUE");
+    }
     if (WINDOWS_RESERVED_DEVICE_RE.test(id)) {
         throw new UsageError(`Task id "${id}" uses a reserved Windows device name. Choose a different task id.`, "INVALID_FLAG_VALUE");
     }
@@ -33,3 +36,29 @@ export function validateTaskId(id) {
 export function normaliseTaskId(raw) {
     return validateTaskId(raw.trim());
 }
+/**
+ * Validate an adapter component-relative task identity.
+ *
+ * Native `akm` task authoring remains deliberately flat and continues to use
+ * {@link validateTaskId}. The standalone `akm-task` adapter, however, derives
+ * identity from the complete extensionless path beneath its configured
+ * component root. Validate every path segment with the portable task-id rules
+ * without collapsing the `/` separators that distinguish physical owners.
+ */
+export function validateTaskConceptId(id) {
+    if (!id)
+        throw new UsageError("Task id must be non-empty.", "MISSING_REQUIRED_ARGUMENT");
+    if (id.includes("\\")) {
+        throw new UsageError(`Task id "${id}" is invalid. Use canonical forward slashes between path segments.`, "INVALID_FLAG_VALUE");
+    }
+    const segments = id.split("/");
+    if (segments.some((segment) => segment.length === 0)) {
+        throw new UsageError(`Task id "${id}" is invalid. Empty path segments are not allowed.`, "INVALID_FLAG_VALUE");
+    }
+    for (const segment of segments)
+        validateTaskId(segment);
+    return id;
+}
+export function normaliseTaskConceptId(raw) {
+    return validateTaskConceptId(raw.trim());
+}

package/dist/workflows/authoring/authoring.js

@@ -14,7 +14,7 @@ import { canonicalizeWorkflowName, WORKFLOW_EXTENSIONS } from "../../core/recogn
 import { warn } from "../../core/warn.js";
 import { prepareWriteTargetForMutation, resolveWriteTarget, withWriteTargetMutation } from "../../core/write-source.js";
 import { compileWorkflowPlan } from "../ir/compile.js";
-import { parseWorkflow } from "../parser.js";
+import { compileWorkflowSource } from "../source-ir/compile.js";
 const DEFAULT_WORKFLOW_TEMPLATE = renderWorkflowTemplate("New Workflow");
 export function getWorkflowTemplate() {
     return DEFAULT_WORKFLOW_TEMPLATE;
@@ -22,33 +22,33 @@ export function getWorkflowTemplate() {
 export function buildWorkflowTemplate(name) {
     if (!name)
         return DEFAULT_WORKFLOW_TEMPLATE;
-    // Only the H1 is customized. Step ids are STRUCTURAL under the unified format
+    // Only the H1 is customized. Step ids are STRUCTURAL in the Markdown authoring form
     // — each appears in `steps[].id`, as a body `## <id>` heading, and possibly in
     // another step's `inputs:` — so rewriting them from a name would have to patch
     // three places consistently to stay parseable. Generic `first-step`/
     // `second-step` are the author's to rename.
     const customized = renderWorkflowTemplate(humanizeWorkflowName(name));
-    validateWorkflowContent(customized, `<template:${name}>`);
+    validateWorkflowContent(customized, `<template:${name}>.md`);
     return customized;
 }
 /** Parse AND compile `content`, so a create never writes an asset that `show`/`start`/`validate` would then reject. */
 function validateWorkflowContent(content, sourcePath) {
-    const result = parseWorkflow(content, { path: sourcePath });
+    const result = compileWorkflowSource(content, { path: sourcePath });
     if (!result.ok) {
         throw new UsageError(formatWorkflowErrors(sourcePath, result.errors));
     }
-    const compiled = compileWorkflowPlan(result.document, slugifyWorkflowStepId(sourcePath));
+    const compiled = compileWorkflowPlan(result.ir, slugifyWorkflowStepId(sourcePath));
     if (!compiled.ok) {
         throw new UsageError(formatWorkflowErrors(sourcePath, compiled.errors));
     }
 }
-/** Recognized workflow-program suffixes — creating one is a lint-time usage error (workflow-format-unification). */
+/** Peer YAML is executable, but `akm workflow create` emits the Markdown authoring form only. */
 const YAML_SUFFIX_RE = /\.ya?ml$/i;
 export function assertWorkflowMarkdownName(name) {
     if (!YAML_SUFFIX_RE.test(name.trim()))
         return;
-    throw new UsageError(`Workflows are markdown-only now (workflow-format-unification) — "${name}" cannot be created. ` +
-        `Use a plain name (no ".yaml"/".yml" suffix); the orchestration graph lives in the ".md" file's frontmatter.`);
+    throw new UsageError(`akm workflow create is markdown-only: it emits Markdown and cannot create "${name}". ` +
+        `Use a plain name (no ".yaml"/".yml" suffix), or author a peer GitHub-shaped ".yml" workflow directly.`);
 }
 export function createWorkflowAsset(input) {
     assertWorkflowMarkdownName(input.name);
@@ -67,11 +67,10 @@ export function createWorkflowAsset(input) {
         path.isAbsolute(relativeAssetPath)) {
         throw new UsageError(`Resolved workflow path escapes the bundle: "${normalizedName}"`, "PATH_ESCAPE_VIOLATION");
     }
-    // A file whose canonical name matches but whose PATH differs can only be a
-    // case variant now (`upper.MD` vs `upper.md`) — the cross-EXTENSION case this
-    // guard also covered is gone with the unified `.md`-only format. It still
-    // matters: on a case-insensitive filesystem the two spellings are one file,
-    // so writing the target would silently clobber or shadow the existing asset.
+    // A peer `.md` or `.yml` file whose canonical name matches already owns this
+    // ref. Case variants (`upper.MD` vs `upper.md`) may also name one physical
+    // file on a case-insensitive filesystem, so writing the Markdown create
+    // target would silently clobber or shadow the existing asset.
     const shadowing = findExistingWorkflowPaths(typeRoot, normalizedName).find((p) => p !== assetPath);
     if (shadowing !== undefined) {
         throw new UsageError(`Workflow "${normalizedName}" already exists as ${path.relative(stashDir, shadowing)} — the ` +
@@ -159,27 +158,11 @@ export function formatWorkflowErrors(path, errors) {
     const heading = errors.length === 1 ? "Workflow has 1 error:" : `Workflow has ${errors.length} errors:`;
     return [heading, ...lines].join("\n");
 }
-/**
- * Validate a workflow filesystem path.
- *
- * Returns the parse result plus the source-relative path used. Throws
- * `UsageError` only when the target cannot be located on disk; parse
- * failures are returned as `{ ok: false, errors }` so callers can
- * format them however they like.
- */
-export function validateWorkflowSource(target) {
-    const resolved = path.resolve(target);
-    if (!fs.existsSync(resolved)) {
-        throw new UsageError(`Workflow file not found: "${target}".`);
-    }
-    const content = fs.readFileSync(resolved, "utf8");
-    return { path: target, parse: parseWorkflow(content, { path: target }) };
-}
 /**
  * Every file under `typeRoot` whose canonical workflow name equals
- * `normalizedName`. Extension matching is case-INSENSITIVE, so `foo.MD` and
- * `foo.md` both match — the case-variant collision the create path must refuse
- * rather than silently clobber on a case-insensitive filesystem.
+ * `normalizedName`. Peer `.md`/`.yml` extension matching is case-INSENSITIVE,
+ * so both cross-format owners and case variants are returned for the create
+ * path to refuse rather than silently clobber or shadow them.
  */
 function findExistingWorkflowPaths(typeRoot, normalizedName) {
     const parent = path.join(typeRoot, path.dirname(normalizedName));

package/dist/workflows/exec/dispatch-redaction.js

@@ -32,26 +32,32 @@ import { collectSensitiveValues, isEnvPassthroughValueSafeToExpose, redactSensit
  * the set.
  */
 export function collectWorkflowDispatchSensitiveValues(dispatch, env) {
-    const values = new Set(Object.values(env ?? {}));
-    const addCredential = (engine) => {
-        if (!engine)
+    const values = new Set([...Object.values(env ?? {}), ...(dispatch.sensitiveValues ?? [])]);
+    const addCredential = (runner) => {
+        if (!runner)
             return;
-        if (engine.kind === "llm") {
-            for (const name of engine.credential?.names ?? []) {
+        if (runner.kind === "llm") {
+            for (const name of runner.credential?.names ?? []) {
                 const value = process.env[name]?.trim();
                 if (value)
                     values.add(value);
             }
             return;
         }
-        for (const name of engine.envPassthrough) {
+        for (const name of runner.profile.envPassthrough ?? []) {
             const value = process.env[name];
             if (!isEnvPassthroughValueSafeToExpose(name, value) && value)
                 values.add(value);
         }
+        if (runner.kind === "sdk") {
+            for (const name of runner.fallbackCredential?.names ?? []) {
+                const value = process.env[name]?.trim();
+                if (value)
+                    values.add(value);
+            }
+        }
     };
-    addCredential(dispatch.engine);
-    addCredential(dispatch.fallbackEngine);
+    addCredential(dispatch.runner);
     return collectSensitiveValues(values);
 }
 /**

package/dist/workflows/exec/exec-unit.js

@@ -30,8 +30,7 @@
  *   - ALLOWLISTED ENVIRONMENT. The child does NOT inherit akm's environment: it
  *     starts EMPTY and receives exactly {@link EXEC_DEFAULT_ENV_PASSTHROUGH}
  *     plus the unit's `exec.passEnv`, then the resolved `env:` bindings, then
- *     the engine-authored `AKM_*` context. `exec.inheritEnv` opts back into full
- *     inheritance. See {@link childEnv}.
+ *     the engine-authored `AKM_*` context. See {@link childEnv}.
  *
  * Secrets: `env` values reaching this module are already resolved from `env:`
  * bindings by NAME (`resolveEnvBinding`) — the plan never carries inline secrets
@@ -48,7 +47,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { isWithinAsync } from "../../core/common.js";
-import { COMMON_SPAWN_ENV_PASSTHROUGH, collectAllowlistedEnv, supplementPathForSchedulerContext, WIN32_SPAWN_ENV_FLOOR, } from "../../core/spawn-env.js";
+import { COMMON_SPAWN_ENV_PASSTHROUGH, collectAllowlistedEnv, WIN32_SPAWN_ENV_FLOOR } from "../../core/spawn-env.js";
 import { runManagedSubprocess, streamCaptureFailure, } from "../../core/subprocess.js";
 import { warn } from "../../core/warn.js";
 import { execContextLimits, utf8Bytes, WORKFLOW_EXEC_OUTPUT_TRUNCATED_MARKER, WORKFLOW_MAX_EXEC_OUTPUT_BYTES, WORKFLOW_UNIT_DIAGNOSTIC_CLIP, } from "../resource-limits.js";
@@ -113,8 +112,8 @@ const EXEC_STDERR_DIAGNOSTIC_CLIP = WORKFLOW_UNIT_DIAGNOSTIC_CLIP - 500;
  *                     demand, exactly as the agent passthrough list does
  *                     (`integrations/agent/profiles.ts`, DRIFT-6).
  *
- * Deliberately ABSENT and reachable only through `exec.passEnv` / `env:` /
- * `exec.inheritEnv`: credentials of every kind, cloud/CI vars, and the proxy
+ * Deliberately ABSENT and reachable only through `exec.passEnv` / `env:`:
+ * credentials of every kind, cloud/CI vars, and the proxy
  * family (`HTTP_PROXY` & friends) — proxy URLs routinely embed credentials,
  * which is why akm's redaction policy already treats URL-shaped passthrough
  * values as credential-bearing.
@@ -460,9 +459,8 @@ async function isExistingDirectory(candidate) {
 /**
  * The child's environment, in three layers with fixed precedence:
  *
- *   1. the BASE — an allowlist by default ({@link EXEC_DEFAULT_ENV_PASSTHROUGH}
- *      plus the unit's `exec.passEnv` names), or the akm process's whole
- *      environment when the unit opted in with `exec.inheritEnv`;
+ *   1. the BASE — {@link EXEC_DEFAULT_ENV_PASSTHROUGH} plus the unit's
+ *      `exec.passEnv` names;
  *   2. the unit's resolved `env:` bindings;
  *   3. the engine-authored `AKM_*` context, LAST so a workflow-supplied binding
  *      can never shadow the ids/item the engine is telling the command the
@@ -490,14 +488,9 @@ async function isExistingDirectory(candidate) {
  *     {@link collectAllowlistedEnv} does it here, so there is one mechanism to
  *     review instead of two.
  *
- * `inheritEnv` is the honest escape hatch for a command that genuinely needs the
- * caller's whole environment. It passes everything through, PATH included —
- * supplemented for scheduler contexts exactly as {@link collectAllowlistedEnv}
- * does it, because the MORE permissive branch must never hand a command a WORSE
- * PATH than the restrictive default does under cron/launchd.
  */
 function childEnv(exec, bindings, context) {
-    const env = exec.inheritEnv ? inheritedProcessEnv() : collectAllowlistedEnv(execAllowlist(exec));
+    const env = collectAllowlistedEnv(execAllowlist(exec));
     for (const [name, value] of Object.entries(bindings ?? {}))
         env[name] = value;
     for (const [name, value] of Object.entries(context ?? {}))
@@ -508,20 +501,6 @@ function childEnv(exec, bindings, context) {
 function execAllowlist(exec) {
     return exec.passEnv ? [...EXEC_DEFAULT_ENV_PASSTHROUGH, ...exec.passEnv] : [...EXEC_DEFAULT_ENV_PASSTHROUGH];
 }
-/**
- * The akm process's own environment (`exec.inheritEnv`), with the same
- * scheduler-context PATH supplementation {@link collectAllowlistedEnv} applies.
- */
-function inheritedProcessEnv() {
-    const env = {};
-    for (const [name, value] of Object.entries(process.env)) {
-        if (typeof value === "string")
-            env[name] = value;
-    }
-    if (env.PATH !== undefined)
-        env.PATH = supplementPathForSchedulerContext(env.PATH);
-    return env;
-}
 /** `argv[0]` plus its argument count — never the full argv, which can carry values. */
 function describeCommand(command) {
     const rest = command.length - 1;

package/dist/workflows/exec/frozen-judge.js

@@ -2,7 +2,7 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * The gate judge built from a frozen v3 engine catalog.
+ * The gate judge built from the workflow's frozen current execution target.
  *
  * Two contracts this module owns, both of which the rest of the engine already
  * enforces for ordinary units and neither of which the judge may opt out of:
@@ -13,10 +13,10 @@
  *     notes. So the judge outcome goes through the SAME scrub every unit outcome
  *     goes through: {@link collectWorkflowDispatchSensitiveValues} +
  *     {@link withDispatchRedaction} (exec/dispatch-redaction.ts). Nothing about
- *     a judge call reaches durable state before that scrub. BOTH branches below
- *     state it that way — the agent branch wrapping the injected dispatcher, the
- *     llm branch wrapping its own chatCompletion call — so a change to that one
- *     contract cannot reach only one of the two judge paths.
+ *     a judge call reaches durable state before that scrub. Agent and direct-LLM
+ *     judges share one prepared/lowered dispatch request; the manual completion
+ *     path uses the same config-free dispatcher without opening an executor
+ *     import cycle.
  *
  *  2. **Identity.** The dispatch request carries the REAL run/step and the gate's
  *     real node/unit ids — the same ids `journalGateEvaluationStart/Finish` write
@@ -25,17 +25,22 @@
  *     The identity is threaded in from the caller that writes the row
  *     ({@link SummaryJudge}'s `identity` argument); it is never synthesized here.
  *
- * A judge dispatch carries NO `env` bindings: a gate judge is an
- * {@link IrInvocation} (`IrGateNode.judge`), which has no `env` key, so there is
- * nothing authored to thread — and a step's unit `env` is scoped to the WORK,
+ * A judge dispatch carries NO `env` bindings: the normalized gate target has
+ * no environment key, so there is nothing authored to thread — and a step's
+ * unit environment is scoped to the WORK,
  * not to the verifier. Redaction is unaffected: the sensitive-value set below
  * still covers the judge engine's credential and unsafe passthrough values.
+ * Lowering notices are live execution metadata: units expose a typed result,
+ * while judges retain their public string contract and emit only the common
+ * lowerer's prompt/body-free notice projection through `warn()`. Current
+ * result/evidence journal writers intentionally exclude these diagnostics;
+ * this boundary makes no claim about future persistence ownership.
  *
  * @module workflows/exec/frozen-judge
  */
-import { ConfigError } from "../../core/errors.js";
+import { warn } from "../../core/warn.js";
 import { collectWorkflowDispatchSensitiveValues, withDispatchRedaction } from "./dispatch-redaction.js";
-import { materializeFrozenLlm } from "./unit-dispatch.js";
+import { dispatchWorkflowExecution, prepareWorkflowExecution, } from "./unit-dispatch.js";
 /** The gate's node id — identical to what `journalGateEvaluationStart` writes. */
 export function gateNodeId(stepId) {
     return `${stepId}.gate`;
@@ -50,96 +55,59 @@ export function gateNodeId(stepId) {
 function dispatchIdentity(owner, identity) {
     return identity ?? { ...owner, unitId: gateNodeId(owner.stepId) };
 }
-/** Build a gate judge from a v3 catalog entry without consulting live config. */
-export function frozenSummaryJudge(plan, invocation, signal, dispatcher, owner) {
-    if (!invocation)
-        return null;
-    const engine = plan.execution?.engines[invocation.engine];
-    if (!engine)
-        throw new ConfigError(`Frozen gate engine "${invocation.engine}" is unavailable.`, "INVALID_CONFIG_FILE");
-    if (engine.kind === "agent") {
-        if (!dispatcher) {
-            throw new ConfigError(`Frozen agent gate engine "${invocation.engine}" has no unit dispatcher.`, "INVALID_CONFIG_FILE");
+function warnLoweringNotices(...groups) {
+    const emitted = new Set();
+    for (const notices of groups) {
+        for (const notice of notices ?? []) {
+            const key = JSON.stringify([notice.code, notice.severity, notice.adapter, notice.field, notice.message]);
+            if (emitted.has(key))
+                continue;
+            emitted.add(key);
+            warn(`Workflow judge lowering notice (${notice.code}; ${notice.adapter}; ${notice.field}): ${notice.message}`);
         }
-        const fallbackEngine = engine.fallbackLlmEngine ? plan.execution.engines[engine.fallbackLlmEngine] : undefined;
-        const fallback = fallbackEngine?.kind === "llm" ? fallbackEngine : undefined;
-        // Scrub at the seam: every outcome this judge's dispatcher returns — and
-        // every error it throws — is redacted BEFORE the verdict (or the failure
-        // message) can reach the gate row / the blocked step's notes. Identical
-        // contract to the llm branch below and to the unit path, including the
-        // failureReason downgrade when redaction altered it.
-        const dispatch = withDispatchRedaction(dispatcher);
-        return async ({ system, user }, identity) => {
-            const id = dispatchIdentity(owner, identity);
-            // Collected per dispatch, not once per judge: the engine PAIR is fixed at
-            // build time but its secrets are not — they are read from `process.env`,
-            // which the dispatch itself re-reads, so a build-time set would miss a
-            // credential set or rotated between the two reads. Same collector the unit
-            // path uses; see the module doc on why `env` is absent here but the
-            // credential/passthrough values are still collected.
-            const sensitiveValues = collectWorkflowDispatchSensitiveValues({ engine, ...(fallback ? { fallbackEngine: fallback } : {}) }, undefined);
-            const outcome = await dispatch({
-                runId: id.runId,
-                stepId: id.stepId,
-                unitId: id.unitId,
-                nodeId: gateNodeId(id.stepId),
-                prompt: user,
-                systemPrompt: system,
-                engine,
-                ...(fallback ? { fallbackEngine: fallback } : {}),
-                invocation,
-                timeoutMs: invocation.timeoutMs,
-                ...(sensitiveValues.length > 0 ? { sensitiveValues } : {}),
-                ...(signal ? { signal } : {}),
-            });
-            if (!outcome.ok) {
-                throw new Error(outcome.error || `Verification engine "${invocation.engine}" failed.`);
-            }
-            return outcome.text ?? "";
-        };
     }
-    // The llm judge's ONE call, shaped as a {@link UnitDispatcher} so this branch
-    // states its redaction through the SAME {@link withDispatchRedaction} contract
-    // the agent branch above uses — including the throw, which a transport error
-    // takes and which becomes the blocked step's notes (`judgeFailure` in
-    // step-work.ts).
-    //
-    // Inline chatCompletion rather than the injected unit dispatcher ON PURPOSE:
-    // the manual completion path (`runtime/runs.ts`) builds an llm judge with no
-    // dispatcher, and a static runs → native-executor edge would close an import
-    // cycle. The materialization itself is the shared {@link materializeFrozenLlm},
-    // so the two llm dispatch paths cannot drift.
-    const dispatch = withDispatchRedaction(async (request) => {
-        const { chatCompletion } = await import("../../llm/client.js");
-        const text = await chatCompletion(materializeFrozenLlm(engine, invocation), [
-            { role: "system", content: request.systemPrompt ?? "" },
-            { role: "user", content: request.prompt },
-        ], {
-            timeoutMs: request.timeoutMs,
-            ...(signal ? { signal } : {}),
-        });
-        return { ok: true, text };
-    });
+}
+/** Build a gate judge from the normalized frozen target without consulting live config. */
+export function frozenSummaryJudge(target, signal, dispatcher, owner) {
+    if (!target)
+        return null;
+    const dispatch = withDispatchRedaction(dispatcher ?? dispatchWorkflowExecution);
     return async ({ system, user }, identity) => {
         const id = dispatchIdentity(owner, identity);
-        // An llm judge's only secret is its own credential, which
-        // `materializeFrozenLlm` resolves out of `process.env` inside the dispatch
-        // below — so the set is collected here, per dispatch, and cannot predate the
-        // value the call actually authenticates with.
-        const sensitiveValues = collectWorkflowDispatchSensitiveValues({ engine }, undefined);
-        const outcome = await dispatch({
+        const commonRequest = {
             runId: id.runId,
             stepId: id.stepId,
             unitId: id.unitId,
             nodeId: gateNodeId(id.stepId),
+            ...(id.attempt !== undefined ? { attempt: id.attempt } : {}),
+            ...(id.dispatchId !== undefined ? { dispatchId: id.dispatchId } : {}),
             prompt: user,
             systemPrompt: system,
-            engine,
-            invocation,
-            timeoutMs: invocation.timeoutMs,
-            ...(sensitiveValues.length > 0 ? { sensitiveValues } : {}),
             ...(signal ? { signal } : {}),
+        };
+        const request = {
+            ...commonRequest,
+            frozenTarget: target,
+            timeoutMs: target.runner.timeoutMs ?? null,
+        };
+        // Lowering and authorization precede every live credential/passthrough
+        // sample. The injected dispatcher may be a test seam, but it receives the
+        // exact same already-validated request and redaction declaration.
+        const lowered = prepareWorkflowExecution(request);
+        const sensitiveValues = collectWorkflowDispatchSensitiveValues({ runner: target.runner }, undefined);
+        const outcome = await dispatch({
+            ...request,
+            ...(sensitiveValues.length > 0 ? { sensitiveValues } : {}),
         });
-        return outcome.text;
+        if (outcome.usage && id.recordTokens) {
+            id.recordTokens((outcome.usage.inputTokens ?? 0) + (outcome.usage.outputTokens ?? 0) + (outcome.usage.reasoningTokens ?? 0));
+        }
+        // Only the common lowerer's own sanitized notices are loggable here. An
+        // injected dispatcher is not trusted to supply prompt/body-free messages.
+        warnLoweringNotices(lowered.notices);
+        if (!outcome.ok) {
+            throw new Error(outcome.error || `Verification engine "${target.request.engine.name}" failed.`);
+        }
+        return outcome.text ?? "";
     };
 }

package/dist/workflows/exec/lowering-notices.js

@@ -0,0 +1,23 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import { canonicalJson } from "../ir/plan-hash.js";
+/**
+ * Merge safe lowerer diagnostics in first-seen order.
+ *
+ * Notices are live execution metadata only: this helper is deliberately used
+ * by executor/report/output paths, never by result/evidence journal writers.
+ * Canonical JSON includes `details`, so two genuinely different structured
+ * diagnostics are not collapsed merely because their headline fields match.
+ */
+export function mergeLoweringNotices(...groups) {
+    const merged = new Map();
+    for (const group of groups) {
+        for (const notice of group ?? []) {
+            const key = canonicalJson(notice);
+            if (!merged.has(key))
+                merged.set(key, notice);
+        }
+    }
+    return merged.size > 0 ? [...merged.values()] : undefined;
+}