akm-cli 0.9.10 → 0.9.12

package/dist/workflows/exec/step-work.js

@@ -23,7 +23,7 @@ import { withWorkflowRunsRepo, } from "../../storage/repositories/workflow-runs-
 import { canonicalJson } from "../ir/plan-hash.js";
 import { parseReference, resolveReferenceString, } from "../program/expressions.js";
 import { clip, WORKFLOW_UNIT_DIAGNOSTIC_CLIP } from "../resource-limits.js";
-import { completeWorkflowStep, isTruncatedEvidence, } from "../runtime/runs.js";
+import { completeWorkflowStep } from "../runtime/runs.js";
 import { GATE_EVALUATION_PHASE } from "../runtime/unit-phases.js";
 import { parseJudgeVerdict } from "../validate-summary.js";
 import { gateNodeId } from "./frozen-judge.js";
@@ -65,30 +65,38 @@ function validateFanOutItems(stepId, items) {
         return (`Step "${stepId}" fan-out list contains a null item (index ${nullIndex}). ` +
             `Every item must be a concrete value — fix the producing step's output.`);
     }
-    const firstIndexByCanonical = new Map();
-    for (let i = 0; i < items.length; i++) {
-        const canonical = canonicalJson(items[i]) ?? "null";
-        const firstIndex = firstIndexByCanonical.get(canonical);
-        if (firstIndex !== undefined) {
-            return (`Step "${stepId}" fan-out list contains duplicate items (indices ${firstIndex} and ${i}: ` +
-                `${clip(canonical, 200)}). Content-derived unit identity requires distinct items — ` +
-                `deduplicate the list this workflow fans out over.`);
-        }
-        firstIndexByCanonical.set(canonical, i);
-    }
     return undefined;
 }
 /**
  * Resolve one whole-value reference, refusing a value a persisted TRUNCATION
  * ENVELOPE stands in for (`clipStepEvidenceForPersistence`, runtime/runs.ts).
  *
- * The engine threads each step's complete in-memory evidence to the rest of its
- * own invocation, so only a RESUMED run can meet an envelope here. Left to the
- * raw resolver, a path reference into one reports a generic missing property
- * and a whole-value reference at one succeeds — handing the envelope to a unit
- * as if it were the artifact. Both are silent corruption; name the cause
- * instead. Every whole-value position (`inputs[]`, `map.over`, `route.input`)
- * goes through here.
+ * The first occurrence of a given canonical value keeps the byte-identical id
+ * {@link unitIdFor} always produced for it — so a plan with no duplicates (the
+ * overwhelming common case) is completely unaffected, and no prior journal
+ * entry is ever invalidated by this change. Only the SECOND and later
+ * occurrences gain a `#<n>` suffix (`#2`, `#3`, …), computed purely from each
+ * item's position in `items` — deterministic across a fresh run and a
+ * resumed one, since both call this from the same place in
+ * {@link computeStepWorkList} over the same resolved list.
+ */
+function occurrenceSuffixedUnitIds(nodeId, items) {
+    const occurrenceByCanonical = new Map();
+    return items.map((item) => {
+        const base = unitIdFor(nodeId, item, true, true);
+        const canonical = canonicalJson(item) ?? "null";
+        const occurrence = (occurrenceByCanonical.get(canonical) ?? 0) + 1;
+        occurrenceByCanonical.set(canonical, occurrence);
+        return occurrence === 1 ? base : `${base}#${occurrence}`;
+    });
+}
+/**
+ * Resolve one whole-value reference (`inputs[]`, `map.over`, `route.input`).
+ *
+ * Every step artifact is now persisted whole (issue C), so this is a thin
+ * wrapper: source adapters may retain GitHub's whole-value `${{ ... }}`
+ * spelling, and this work-list seam unwraps only an exact whole-value
+ * wrapper — it never interpolates prose.
  */
 function resolveStepReference(reference, scope) {
     // Source adapters may retain GitHub's whole-value `${{ ... }}` spelling.
@@ -96,40 +104,7 @@ function resolveStepReference(reference, scope) {
     // unwraps only an exact whole-value wrapper and never interpolates prose.
     const exactWrapper = /^\$\{\{\s*([^{}]+?)\s*\}\}$/.exec(reference);
     const canonicalReference = exactWrapper?.[1] ?? reference;
-    const resolved = resolveReferenceString(canonicalReference, scope);
-    const truncated = truncatedReferenceTarget(canonicalReference, scope, resolved);
-    if (!truncated)
-        return resolved;
-    return {
-        ok: false,
-        error: {
-            reference,
-            message: `${reference} reads a step artifact that was NOT persisted (${truncated.originalBytes} bytes exceeded the ` +
-                `${truncated.limitBytes}-byte evidence_json cap, so the row stores a truncation marker). This run was ` +
-                `resumed from rows that no longer hold the value — it cannot be recovered. Start a new run, or have the ` +
-                `producing step emit a reference (path, id) instead of inline bulk data.`,
-        },
-    };
-}
-/** The envelope a reference lands on or walks through, if any. */
-function truncatedReferenceTarget(reference, scope, resolved) {
-    if (resolved.ok)
-        return isTruncatedEvidence(resolved.value) ? resolved.value : undefined;
-    // A FAILED resolution is re-walked: the envelope is an object with none of
-    // the original's keys, so the raw failure is whatever property went missing
-    // along the way, several segments past the truncation.
-    const parsed = parseReference(reference);
-    if (!parsed.ok || parsed.expr.kind !== "stepOutput")
-        return undefined;
-    let current = scope.stepOutputs[parsed.expr.stepId];
-    for (const segment of parsed.expr.path) {
-        if (isTruncatedEvidence(current))
-            return current;
-        if (typeof current !== "object" || current === null)
-            return undefined;
-        current = current[segment];
-    }
-    return isTruncatedEvidence(current) ? current : undefined;
+    return resolveReferenceString(canonicalReference, scope);
 }
 /**
  * Pre-attempt resolution of a task-composing step's frozen `inputBindings`
@@ -248,9 +223,13 @@ export function computeStepWorkList(plan, input) {
     const fanOutProblem = isFanOut ? validateFanOutItems(plan.stepId, items) : undefined;
     if (fanOutProblem)
         return { ok: false, error: fanOutProblem };
-    // Content-derived unit identity: compute every id up front (duplicate items
-    // were rejected above — identity requires distinct items).
-    const unitIds = items.map((item) => unitIdFor(template.id, item, isFanOut, true));
+    // Content-derived unit identity: compute every id up front. A fan-out's
+    // canonical duplicates are disambiguated by occurrence ordinal rather than
+    // rejected (issue 6); a solo (non-fan-out) step has exactly one item, so
+    // there is nothing to disambiguate.
+    const unitIds = isFanOut
+        ? occurrenceSuffixedUnitIds(template.id, items)
+        : [unitIdFor(template.id, undefined, false, true)];
     const gateLoop = input.gateLoop ?? 1;
     const target = template.frozenTarget;
     const frozenExec = target.kind === "shell" || target.kind === "script" ? target.exec : undefined;

package/dist/workflows/freeze/resolve-steps.js

@@ -62,17 +62,25 @@ function rejectNonTaskBindingWith(source, ref, kind) {
     const family = kind === "command" ? "commands" : "scripts";
     throw new UsageError(`Workflow step ${source.id} cannot pass with: to ${family} target ${ref}; a ${kind} ref is not a binding surface.`, "COMPOSITION_INVALID");
 }
+const NO_ENGINE_AVAILABLE_MESSAGE = "the fixed opencode-sdk fallback is unavailable";
+function isNoEngineAvailable(err) {
+    return err instanceof ConfigError && err.message.includes(NO_ENGINE_AVAILABLE_MESSAGE);
+}
 export function resolveJudge(source, context) {
-    const engine = context.config.workflow?.judgeEngine;
-    if (!engine) {
-        throw new ConfigError("This workflow declares completion criteria but no verification engine is configured. Set workflow.judgeEngine to a named LLM or agent engine.", "INVALID_CONFIG_FILE");
-    }
+    const configuredEngine = context.config.workflow?.judgeEngine;
     const content = source.gate?.rubric?.trim() ?? "Judge workflow completion.";
-    const prepared = prepareInlineExecution({
-        content,
-        config: context.config,
-        invocationKind: "workflow",
-        current: { engine },
-    });
-    return commandResult(source, { onError: "fail", source: sourceStepRef(source) }, prepared, context);
+    try {
+        const prepared = prepareInlineExecution({
+            content,
+            config: context.config,
+            invocationKind: "workflow",
+            ...(configuredEngine ? { current: { engine: configuredEngine } } : {}),
+        });
+        return commandResult(source, { onError: "fail", source: sourceStepRef(source) }, prepared, context);
+    }
+    catch (err) {
+        if (configuredEngine || !isNoEngineAvailable(err))
+            throw err;
+        return undefined;
+    }
 }

package/dist/workflows/freeze/source-freeze.js

@@ -2,6 +2,7 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { COMPOSITION_INVALID_MULTI_JOB_HINT, UsageError } from "../../core/errors.js";
+import { warn } from "../../core/warn.js";
 import { compileWorkflowSource } from "../source-ir/compile.js";
 import { resolveJudge, resolveStep } from "./resolve-steps.js";
 /**
@@ -42,6 +43,12 @@ export async function resolveWorkflowSourceV4(asset, workflowSource, config, col
         }
         if (sourceStep.gate?.rubric?.trim()) {
             const judge = resolveJudge(sourceStep, context);
+            if (judge === undefined) {
+                warn(`Workflow step "${sourceStep.id}" has completion criteria but no verification engine is available ` +
+                    "(set workflow.judgeEngine, defaults.engine, or install an opencode-sdk binary). The step will block " +
+                    "for `akm workflow resume` once it is reached.");
+                continue;
+            }
             if (judge.target.kind !== "command")
                 throw new Error(`workflow judge ${sourceStep.id} did not resolve to a command target`);
             judges.set(sourceStep.id, judge.target);

package/dist/workflows/freeze/targets/child-workflow.js

@@ -28,10 +28,11 @@
 import { createHash } from "node:crypto";
 import { parseBundleRef } from "../../../core/asset/asset-ref.js";
 import { UsageError } from "../../../core/errors.js";
+import { warn } from "../../../core/warn.js";
 import { GuardedExecutionSourceCollector } from "../../../execution/guarded-source.js";
 import { workflowParamContract } from "../../ir/params.js";
 import { canonicalJson, canonicalPlanJson } from "../../ir/plan-hash.js";
-import { utf8Bytes, WORKFLOW_MAX_EMBEDDED_CHILD_PLAN_BYTES } from "../../resource-limits.js";
+import { utf8Bytes } from "../../resource-limits.js";
 import { loadWorkflowAsset } from "../../runtime/workflow-asset-loader.js";
 import { resolveOwnedAsset } from "../environment.js";
 import { declaredParamNames, earlierStepIds } from "../step-values.js";
@@ -62,15 +63,14 @@ function childWorkflowContentHash(fields) {
  * `freezeEnvironment`): literal `env:` values and `unit: {env: [...]}` refs.
  * An absent/empty `env:` is not authored and stays valid.
  */
-function assertNoStepEnvironment(stepId, childRef, source) {
+function warnIfStepEnvironment(stepId, childRef, source) {
     const hasLiteralEnv = Object.keys(source.env ?? {}).length > 0;
     const hasEnvRefs = (source.unit?.env ?? []).length > 0;
     if (!hasLiteralEnv && !hasEnvRefs)
         return;
-    throw new UsageError(`Workflow step ${stepId} cannot pass env: while composing ${childRef}: a child run carries its own frozen ` +
-        `environment inside its own plan, so a parent-level env: on the composing step cannot be honored. Remove ` +
-        `env: from this step, or move it into ${childRef}'s own source.`, "COMPOSITION_INVALID", "Remove the env: (or unit: env:) block from this step, or set those variables inside the child workflow's " +
-        "own source — a composing step's environment is never delivered into a child run.");
+    warn(`Workflow step ${stepId} declares env: while composing ${childRef}: a child run carries its own frozen ` +
+        `environment inside its own plan, so this composing step's env: (or unit: env:) is not delivered into it ` +
+        `and has no effect. Set those variables inside ${childRef}'s own source instead.`);
 }
 /** A workflow entry of a composition `refPath` — the only entries a cycle can close through (§4.5: a task target can never itself be a task, so no task->task chain exists to close one). */
 function isWorkflowRef(ref) {
@@ -98,14 +98,8 @@ function assertNoCompositionCycle(stepId, childRef, refPath) {
  * total exactly as it was, matching every other freeze-time failure's
  * no-partial-effect shape.
  */
-function chargeEmbeddedBudget(stepId, childRef, childPlanBytes, budget) {
-    const projected = budget.embeddedBytes + childPlanBytes;
-    if (projected > WORKFLOW_MAX_EMBEDDED_CHILD_PLAN_BYTES) {
-        throw new UsageError(`Workflow step ${stepId} cannot compose ${childRef}: the embedded child plans would total ${projected} ` +
-            `bytes, over the ${WORKFLOW_MAX_EMBEDDED_CHILD_PLAN_BYTES}-byte limit for one workflow run.`, "COMPOSITION_INVALID", "Reduce the number or size of workflows composed into this run — split the work across separate " +
-            "top-level runs, or trim the composed children's own plans.");
-    }
-    budget.embeddedBytes = projected;
+function chargeEmbeddedBudget(_stepId, _childRef, childPlanBytes, budget) {
+    budget.embeddedBytes += childPlanBytes;
 }
 export async function childWorkflowDispatch(input) {
     const { source, baseUnit, childRefInput, context, via, taskRef, authoredInputs } = input;
@@ -115,10 +109,10 @@ export async function childWorkflowDispatch(input) {
     const owned = await resolveOwnedAsset(childRefInput, "workflow", context);
     const childAsset = await loadWorkflowAsset(owned.ref);
     const childRef = childAsset.ref;
-    // Code-review finding: an authored env: on the composing step has no
-    // path to reach the child run and must reject, not vanish (see
-    // assertNoStepEnvironment's doc comment).
-    assertNoStepEnvironment(source.id, childRef, source);
+    // Issue 10: an authored env: on the composing step has no path to reach
+    // the child run — warn rather than vanish silently (see
+    // warnIfStepEnvironment's doc comment).
+    warnIfStepEnvironment(source.id, childRef, source);
     // §4.2 step 2: the composition cycle check, before any child compilation.
     assertNoCompositionCycle(source.id, childRef, context.composition.refPath);
     const childDepth = context.composition.depth + 1;

package/dist/workflows/freeze/targets/command.js

@@ -2,7 +2,9 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { createHash } from "node:crypto";
+import { parseBuiltinCommandAction } from "../../../commands/command/builtin-action.js";
 import { prepareCommandInvocation } from "../../../commands/command/command-execution.js";
+import { PORTABLE_ARGUMENTS_PLACEHOLDER } from "../../../commands/command/portable-template.js";
 import { captureFrozenDirectoryIdentity } from "../../../execution/directory-identity.js";
 import { freezeExecutableIdentity } from "../../../execution/executable-identity.js";
 import { canonicalResolvedExecutionRequest, } from "../../../execution/resolved-request.js";
@@ -13,15 +15,25 @@ import { prepareInlineExecution } from "../../../integrations/agent/inline-execu
 import { freezeEnvironment, guardedExecutionSource } from "../environment.js";
 import { gitIdentity } from "../identity.js";
 import { durableRequest, executionUnitValues, executionValues, targetConcurrency, } from "../step-values.js";
+function inlineWorkflowCommandAction(action, commandMode) {
+    if (commandMode !== "portable-template")
+        return action;
+    const parsed = parseBuiltinCommandAction(action);
+    if (parsed.kind !== "inline")
+        return action;
+    return { content: parsed.content.split(PORTABLE_ARGUMENTS_PLACEHOLDER).join(parsed.arguments ?? "") };
+}
 export async function commandDispatch(source, baseUnit, action, context) {
     const prepared = await prepareCommandInvocation({
-        action,
+        action: inlineWorkflowCommandAction(action, source.commandMode),
         config: context.config,
         invocationKind: "workflow",
         ...(context.sourceIr.defaults
             ? { invocationDefaults: executionUnitValues(context.sourceIr.defaults, context.asset.sourcePath) }
             : {}),
-        ...(source.commandMode === "literal" ? { inlineContentMode: "literal" } : {}),
+        ...(source.commandMode === "literal" || source.commandMode === "portable-template"
+            ? { inlineContentMode: "literal" }
+            : {}),
         current: executionValues(source, context.asset.sourcePath),
         sourceLoader: (ref, kind) => guardedExecutionSource(ref, kind, context),
     });

package/dist/workflows/ir/environment-v4.js

@@ -16,6 +16,7 @@ import dotenv from "dotenv";
 import { assetPathForName } from "../../core/asset/asset-placement.js";
 import { isWithin } from "../../core/common.js";
 import { NotFoundError, UsageError } from "../../core/errors.js";
+import { warn } from "../../core/warn.js";
 import { captureGuardedExecutionSource, GuardedExecutionSourceCollector } from "../../execution/guarded-source.js";
 const SECRET_TOKEN_RE = /\$\{secret:([A-Za-z0-9_./-]+)\}/g;
 const ENVIRONMENT_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
@@ -33,7 +34,7 @@ export function freezeWorkflowEnvironment(refs, options) {
             throw new UsageError(`Workflow env ref ${JSON.stringify(inputRef)} did not resolve to a canonical fully-qualified owner.`, "WORKFLOW_SOURCE_INVALID");
         }
         if (logical.has(resolved.ref)) {
-            throw new UsageError(`Workflow environment contains duplicate ref ${resolved.ref}.`, "WORKFLOW_SOURCE_INVALID");
+            continue;
         }
         logical.add(resolved.ref);
         trackParentDirectories(collector, resolved.root, resolved.path);
@@ -48,7 +49,8 @@ export function freezeWorkflowEnvironment(refs, options) {
         const physicalKey = `${captured.containmentPhysicalIdentity}\0${captured.physicalIdentity}`;
         const alias = physical.get(physicalKey);
         if (alias !== undefined && alias !== resolved.ref) {
-            throw new UsageError(`${resolved.ref} aliases the same physical environment source as ${alias} under a different logical owner.`, "RESOURCE_ALREADY_EXISTS");
+            warn(`Workflow env ref ${resolved.ref} aliases the same physical environment source as ${alias} under a different logical owner. Using ${alias}.`);
+            continue;
         }
         physical.set(physicalKey, resolved.ref);
         const parsed = dotenv.parse(Buffer.from(captured.bytesBase64, "base64"));

package/dist/workflows/ir/freeze-v4.js

@@ -51,11 +51,8 @@ export async function compileResolveFreezeWorkflowV4(asset, config, options = {}
         throw new UsageError(compiled.errors.map((error) => `${asset.path}:${error.line}: ${error.message}`).join("\n"), code, isMultiJob ? COMPOSITION_INVALID_MULTI_JOB_HINT : undefined);
     }
     const steps = compiled.plan.steps.map((step) => {
-        const frozenJudge = step.gate.criteria.length === 0 ? null : resolved.judges.get(step.stepId);
-        if (step.gate.criteria.length > 0 && !frozenJudge) {
-            throw new Error(`resolved workflow judge missing for step ${step.stepId}`);
-        }
-        const gate = Object.freeze({ ...step.gate, maxLoops: step.gate.maxLoops ?? 1, frozenJudge: frozenJudge ?? null });
+        const frozenJudge = step.gate.criteria.length === 0 ? null : (resolved.judges.get(step.stepId) ?? null);
+        const gate = Object.freeze({ ...step.gate, maxLoops: step.gate.maxLoops ?? 1, frozenJudge });
         if (!step.root) {
             const { root: _root, ...withoutRoot } = step;
             return Object.freeze({ ...withoutRoot, gate });

package/dist/workflows/ir/plan-hash.js

@@ -13,7 +13,6 @@
  * Pure module: no IO beyond node:crypto, no engine imports.
  */
 import { createHash } from "node:crypto";
-import { utf8Bytes, WORKFLOW_MAX_PLAN_BYTES } from "../resource-limits.js";
 import { decodeWorkflowPlanV4, WORKFLOW_IR_V5_VERSION } from "./schema-v4.js";
 /** sha256 hex of the canonical (recursively sorted-keys) JSON of the plan. */
 export function computePlanHash(plan) {
@@ -29,8 +28,6 @@ export function canonicalJson(value) {
 }
 /** Decode, require stored canonical bytes, then verify the stored SHA-256. */
 export function decodeCanonicalPlan(runId, planJson, planHash, expectedVersion) {
-    if (utf8Bytes(planJson) > WORKFLOW_MAX_PLAN_BYTES)
-        throw new Error(`Workflow run ${runId} frozen plan exceeds the 2 MiB resource limit.`);
     let parsed;
     try {
         parsed = JSON.parse(planJson);

package/dist/workflows/ir/schema-v4.js

@@ -19,7 +19,7 @@ import { decodeExecutionSourceIdentity } from "../../execution/source.js";
 import { decodeFrozenRunnerSpec } from "../../integrations/agent/execution-lowering.js";
 import { parseReference } from "../program/expressions.js";
 import { PROGRAM_PARAM_NAME_PATTERN } from "../program/schema.js";
-import { utf8Bytes, WORKFLOW_MAX_EMBEDDED_CHILD_PLAN_BYTES } from "../resource-limits.js";
+import { utf8Bytes } from "../resource-limits.js";
 import { decodeWorkflowExecSpec, validateWorkflowPlanStructure, } from "./schema.js";
 export const WORKFLOW_IR_V5_VERSION = 5;
 /**
@@ -152,8 +152,18 @@ function decodeGateV4(value, stepId, requiredSources) {
             frozenJudge: null,
         });
     }
-    if (!Object.hasOwn(gate, "frozenJudge") || gate.frozenJudge === null) {
-        fail(`gate ${stepId} with criteria requires a frozen judge target`);
+    if (!Object.hasOwn(gate, "frozenJudge")) {
+        fail(`gate ${stepId} with criteria is missing its frozenJudge field`);
+    }
+    if (gate.frozenJudge === null) {
+        return Object.freeze({
+            kind: "gate",
+            id: gate.id,
+            stepId,
+            criteria,
+            maxLoops: gate.maxLoops,
+            frozenJudge: null,
+        });
     }
     const identity = {
         kind: "unit",
@@ -239,12 +249,7 @@ function decodeChildWorkflowTarget(target, unit, depth, budget) {
     if (actualPlanHash !== planHash) {
         fail(`unit ${unit.id} child workflow embedded plan does not match its frozen planHash`);
     }
-    const projectedBytes = budget.embeddedBytes + utf8Bytes(embeddedPlanJson);
-    if (projectedBytes > WORKFLOW_MAX_EMBEDDED_CHILD_PLAN_BYTES) {
-        fail(`unit ${unit.id} child workflow ${target.ref} embedded plans total ${projectedBytes} bytes, over the ` +
-            `${WORKFLOW_MAX_EMBEDDED_CHILD_PLAN_BYTES}-byte limit`);
-    }
-    budget.embeddedBytes = projectedBytes;
+    budget.embeddedBytes += utf8Bytes(embeddedPlanJson);
     return Object.freeze({
         kind: "child-workflow",
         ref: target.ref,

package/dist/workflows/ir/schema.js

@@ -5,7 +5,7 @@ import { isContainedRelativePath, isRecord } from "../../core/common.js";
 import { UsageError } from "../../core/errors.js";
 import { parseReference } from "../program/expressions.js";
 import { PROGRAM_PARAM_NAME_PATTERN, PROGRAM_RETRY_REASONS, PROGRAM_STEP_ID_PATTERN } from "../program/schema.js";
-import { jsonBytes, utf8Bytes, WORKFLOW_ENV_VAR_NAME_PATTERN, WORKFLOW_MAX_CONCURRENCY, WORKFLOW_MAX_INSTRUCTION_BYTES, WORKFLOW_MAX_PLAN_BYTES, WORKFLOW_MAX_SCHEMA_BYTES, WORKFLOW_MAX_TIMEOUT_MS, } from "../resource-limits.js";
+import { jsonBytes, utf8Bytes, WORKFLOW_ENV_VAR_NAME_PATTERN, WORKFLOW_MAX_CONCURRENCY, WORKFLOW_MAX_INSTRUCTION_BYTES, WORKFLOW_MAX_SCHEMA_BYTES, WORKFLOW_MAX_TIMEOUT_MS, } from "../resource-limits.js";
 // Shared dispatch-significant bounds now live in `../resource-limits` so the
 // parser, the published JSON Schema, and this decoder enforce identical
 // values. Re-exported here for existing importers (e.g. `commands/workflow-cli.ts`).
@@ -18,8 +18,6 @@ export function validateWorkflowPlanStructure(input, options) {
         fail(`irVersion must be ${options.expectedVersion}`);
     }
     assertJson(input);
-    if (jsonBytes(input) > WORKFLOW_MAX_PLAN_BYTES)
-        fail("plan exceeds the 2 MiB resource limit");
     const plan = input;
     assertKeys(input, ["irVersion", "title", "params", "paramSchemas", "budget", "execution", "steps", ...(options.planExtraKeys ?? [])], "plan");
     assertString(plan.title, "title");

package/dist/workflows/resource-limits.js

@@ -2,7 +2,6 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { EXECUTION_MAX_TIMEOUT_MS } from "../execution/limits.js";
-export const WORKFLOW_MAX_PLAN_BYTES = 2 * 1024 * 1024;
 export const WORKFLOW_MAX_SOURCE_BYTES = 1024 * 1024;
 export const WORKFLOW_MAX_INSTRUCTION_BYTES = 256 * 1024;
 export const WORKFLOW_MAX_SCHEMA_BYTES = 256 * 1024;
@@ -73,24 +72,22 @@ export const DEFAULT_EXEC_TIMEOUT_MS = 600_000;
  *     corrupt every downstream reference. That is the residual failure the cap
  *     genuinely justifies.
  *
- * 8 MiB is deliberately generous — 8× the whole-row evidence cap
- * ({@link WORKFLOW_MAX_EVIDENCE_JSON_BYTES}), so any output that could survive
- * persistence intact fits many times over, and an ordinary full test/build log
- * is nowhere near it.
+ * 8 MiB is deliberately generous, so any output a step is likely to produce
+ * fits many times over and an ordinary full test/build log is nowhere near
+ * it.
  */
 export const WORKFLOW_MAX_EXEC_OUTPUT_BYTES = 8 * 1024 * 1024;
 /**
  * Marker stamped on an exec artifact that was RETAINED ONLY IN PART because the
  * command wrote past {@link WORKFLOW_MAX_EXEC_OUTPUT_BYTES}.
  *
- * Deliberately ugly and unique, exactly like `WORKFLOW_EVIDENCE_TRUNCATED_MARKER`
- * (`runtime/runs.ts`) — the same idiom for the same reason: a truncated value
- * must NEVER be mistakable for a complete one by a downstream
- * `steps.<id>.output` reference, by a gate judge, by `akm workflow status`, or
- * by a human reading the row. The artifact is TEXT here rather than a JSON
- * value, so the marker is appended as a trailing block instead of replacing the
- * value with an envelope: the retained prefix is still genuinely useful (it is
- * the head of a real log), and the block says exactly how much is missing.
+ * Deliberately ugly and unique: a truncated value must NEVER be mistakable
+ * for a complete one by a downstream `steps.<id>.output` reference, by a gate
+ * judge, by `akm workflow status`, or by a human reading the row. The
+ * artifact is TEXT here rather than a JSON value, so the marker is appended
+ * as a trailing block instead of replacing the value with an envelope: the
+ * retained prefix is still genuinely useful (it is the head of a real log),
+ * and the block says exactly how much is missing.
  */
 export const WORKFLOW_EXEC_OUTPUT_TRUNCATED_MARKER = "__akm_exec_output_truncated__";
 // Per-var: Win32 `SetEnvironmentVariable` caps one variable at 32 767 UTF-16
@@ -143,27 +140,17 @@ export function clip(text, max) {
     return text.length > max ? `${text.slice(0, max)}…` : text;
 }
 // ── Persistence bounds ───────────────────────────────────────────────────────
-/**
- * Max serialized size of one `workflow_run_steps.evidence_json` row value.
- *
- * The promoted step artifact (`evidence.output`) is deliberately NOT clipped
- * when it is built — gates judge the full artifact and downstream
- * `steps.<id>.output` references need it intact — but a `collect` reducer
- * over an unbounded fan-out (each unit contributing up to a full unit
- * result) would otherwise write an unbounded blob into a single SQLite row.
- * Persistence is therefore bounded here, at the write boundary, by
- * `clipStepEvidenceForPersistence` (`runtime/runs.ts`), which replaces
- * oversized values with an explicitly-marked truncation envelope rather than
- * silently shortening them.
- *
- * 1 MiB is deliberately generous: it is 4× the per-instruction cap and half the
- * whole-plan cap, so no realistic authored workflow reaches it, while a runaway
- * fan-out is still bounded to something SQLite and `akm workflow status` can
- * handle.
- */
-export const WORKFLOW_MAX_EVIDENCE_JSON_BYTES = 1024 * 1024;
-/** Chars of the original value retained (as a marked preview) in a truncation envelope. */
-export const WORKFLOW_EVIDENCE_TRUNCATION_PREVIEW_CHARS = 1000;
+//
+// `workflow_run_steps.evidence_json` is persisted WHOLE and unclipped. It used
+// to be capped at 1 MiB, past which the row was replaced by a marked
+// truncation envelope — but the run still looked successful, and the NEXT
+// invocation (a resume, or any later step referencing the artifact) failed
+// permanently: the value was gone from the only place a resumed run can read
+// it from, so every prior paid step had to be re-run from scratch. SQLite has
+// no practical row-size problem here (its own ceiling is ~1 GB), so there is
+// nothing this cap protected that a full write does not already handle
+// correctly. `JSON.stringify` throwing on genuinely unserializable evidence
+// is unchanged.
 export function utf8Bytes(value) {
     return Buffer.byteLength(value, "utf8");
 }
@@ -173,21 +160,21 @@ export function jsonBytes(value) {
 // ── Recursive child-workflow composition bounds (spec docs/plans/specs/
 // ── p3a-plan-v5-child-freeze.md §4.5, A-N6) ──────────────────────────────────
 //
-// Enforced ONCE, at freeze, before publication, in
-// `src/workflows/freeze/targets/child-workflow.ts` — the ONE resolver both the
-// direct `uses: workflows/<ref>` form and the task-wrapped form route through
-// — and re-enforced as a corruption gate whenever a parent plan is DECODED
-// (`src/workflows/ir/schema-v4.ts`'s recursive `decodeChildWorkflowTarget`).
-// Full design history, including the rejected alternative for the byte cap:
-// docs/architecture/decisions/0007-workflow-composition-bounds.md.
-//
 // Composition DEPTH is unbounded — `assertNoCompositionCycle` (freeze/targets/
 // child-workflow.ts) already makes infinite composition mathematically
 // impossible, so a depth ceiling on top of it only bounded how many
 // legitimately distinct workflows an author could nest.
-/**
- * Max AGGREGATE canonical-JSON bytes of every embedded child plan in ONE root
- * freeze (the sum across the whole composition tree, not per child).
- * Deliberately HALF of {@link WORKFLOW_MAX_PLAN_BYTES} — see ADR 0007.
- */
-export const WORKFLOW_MAX_EMBEDDED_CHILD_PLAN_BYTES = 1024 * 1024;
+//
+// This section used to also cap the AGGREGATE canonical-JSON bytes of every
+// embedded child plan in one root freeze (`WORKFLOW_MAX_EMBEDDED_CHILD_PLAN_BYTES`,
+// enforced in `freeze/targets/child-workflow.ts` and re-checked on every
+// decode in `ir/schema-v4.ts`'s `decodeChildWorkflowTarget`), alongside a
+// standalone cap on any one frozen plan's own bytes
+// (`WORKFLOW_MAX_PLAN_BYTES`, enforced in `ir/plan-hash.ts` and
+// `ir/schema.ts`). A large plan is not a wrong plan: composing several
+// substantial workflows together is a legitimate, deliberate authoring
+// choice, and SQLite has no practical row-size problem here (its own
+// ceiling is ~1 GB) — there was nothing left for either cap to protect that
+// `planHash`/`contentHash` verification does not already cover. Both caps
+// are removed; the hash/canonical-JSON integrity checks they sat next to
+// are unchanged.