akm-cli 0.9.17-alpha.2 → 0.9.17-alpha.4

package/dist/workflows/runtime/runs.js

@@ -4,7 +4,7 @@
 import { randomUUID } from "node:crypto";
 import { parseBundleRef } from "../../core/asset/asset-ref.js";
 import { loadConfig } from "../../core/config/config.js";
-import { ConfigError, NotFoundError, TransientError, UsageError } from "../../core/errors.js";
+import { ConfigError, NotFoundError, UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { warn } from "../../core/warn.js";
 import { insertEventOnce } from "../../storage/repositories/events-repository.js";
@@ -12,28 +12,25 @@ import { withWorkflowRunsRepo, } from "../../storage/repositories/workflow-runs-
 import { getCurrentWorkflowScopeKey } from "../authoring/scope-key.js";
 import { frozenSummaryJudge } from "../exec/frozen-judge.js";
 import { detectSecretShapedParams } from "../exec/param-secrets.js";
-import { collectWorkflowWarnings } from "../ir/compile.js";
-import { compileResolveFreezeWorkflowV4 } from "../ir/freeze-v4.js";
+import { freezeWorkflow } from "../freeze/freeze.js";
 import { materializeWorkflowParameterFlags, validateWorkflowParams } from "../ir/params.js";
 import { canonicalPlanJson, computePlanHash } from "../ir/plan-hash.js";
 import { clip, WORKFLOW_UNIT_DIAGNOSTIC_CLIP } from "../resource-limits.js";
 import { validateStepSummary } from "../validate-summary.js";
 import { resolveAgentIdentity } from "./agent-identity.js";
-import { evaluateCheckin } from "./checkin.js";
-import { assertRunStatusMatchesSpine, classifyWorkflowRunPlan, frozenStepRows, reconcileWorkflowSpineWithPlan, requireExecutableWorkflowPlan, } from "./plan-classifier.js";
 import { resolveWorkflowRunOutputs } from "./run-outputs.js";
-import { evaluateStaleUnits } from "./unit-checkin.js";
+import { frozenStepRows, readRunPlan } from "./run-plan.js";
 import { canonicalizeWorkflowRefInput, loadWorkflowAsset, resolveWorkflowEntryId } from "./workflow-asset-loader.js";
 /**
  * Membership test for the journaled `runner` column, which is an untyped string.
- * The `Record<IrRuntimeKind, …>` is exhaustiveness-checked, so a new runtime
+ * The `Record<WorkflowRuntimeKind, …>` is exhaustiveness-checked, so a new runtime
  * kind cannot be added to the union without being accepted here too.
  */
 const IR_RUNTIME_KINDS = { llm: true, agent: true, sdk: true, exec: true };
 function runtimeKindOf(runner) {
     return runner !== null && Object.hasOwn(IR_RUNTIME_KINDS, runner) ? runner : null;
 }
-function toUnitDiagnostic(row, stale) {
+function toUnitDiagnostic(row) {
     let diagnostic = null;
     if (row.result_json !== null) {
         // `result_json` is a JSON-encoded value: a bare JSON string for a free-text
@@ -63,10 +60,6 @@ function toUnitDiagnostic(row, stale) {
         diagnostic,
         startedAt: row.started_at,
         finishedAt: row.finished_at,
-        stale: stale !== undefined,
-        staleIdleMs: stale ? (Number.isFinite(stale.idleMs) ? stale.idleMs : null) : null,
-        claimHolder: row.claim_holder,
-        claimExpiresAt: row.claim_expires_at,
         engine: row.engine ?? null,
         runtimeKind: runtimeKindOf(row.runner),
         platform: null,
@@ -74,11 +67,11 @@ function toUnitDiagnostic(row, stale) {
 }
 export async function startWorkflowRun(ref, params = {}, options) {
     const asset = await loadWorkflowAsset(ref);
-    // Frozen plan (redesign addendum, R1): compile the plan ONCE at start and
+    // Frozen plan: compile the plan ONCE at start and
     // persist it on the run row in the same transaction as the insert. Every
     // later invocation executes this snapshot — the asset file is never re-read
     // for an in-flight run; re-planning is an explicit new run.
-    const frozen = await compileResolveFreezeWorkflowV4(asset, loadConfig());
+    const frozen = await freezeWorkflow(asset, loadConfig());
     const plan = frozen.plan;
     if (options?.parameterFlags?.length && Object.keys(params).length > 0) {
         throw new UsageError("Workflow parameters must use either an object or per-parameter flags, not both.");
@@ -89,10 +82,10 @@ export async function startWorkflowRun(ref, params = {}, options) {
     // Non-fatal WARNINGS: untyped-step and undeclared-param advisories surface
     // as `warn()` lines at start (stderr, consistent with the repo's other
     // author-facing warnings) without blocking the run.
-    for (const w of collectWorkflowWarnings(asset.sourceIr)) {
+    for (const w of frozen.warnings) {
         warn(`workflow run: ${asset.path}:${w.line} — ${w.message}`);
     }
-    // Reviewer #12: validate supplied parameters against the frozen param
+    // validate supplied parameters against the frozen param
     // schemas BEFORE creating the run, so a type-mismatched param (e.g. a string
     // for a `{ type: array }` param) is rejected with actionable errors instead
     // of flowing silently into a unit prompt. Programs without declared param
@@ -121,24 +114,10 @@ export async function startWorkflowRun(ref, params = {}, options) {
         // (workflow_ref, scope_key) pair, refuse to create a parallel run unless
         // `force: true` is set. Previously every call inserted unconditionally,
         // so two terminals starting the same workflow could leave two runs racing.
-        // The
-        // active-alias query and all inserts now share this immediate transaction.
-        // #506: arm a file-signal check-in (a timestamp, NOT a background thread —
-        // per the workflow-agent check-in ADR) so a stalled run can be
-        // re-targeted with a `continue` directive. The agent harness + session id
-        // are already resolved above (agentHarness/agentSessionId, from #501).
-        // #942: an active run of this ref may already exist in a DIFFERENT
-        // scope — the incident this issue reports (a scheduled task's cwd and a
-        // human's shell hash to different scope keys, so each believed it held
-        // no active run and each started one). The scope-local uniqueness guard
-        // stays scope-local (a documented, deliberate per-project partition —
-        // see storage-locations.md); this only warns, once, so the operator can
-        // resume or abandon the other run instead of silently accumulating a
-        // second one. `findActiveRunOutsideScope` excludes the caller's own
-        // scope IN SQL (never merely post-filtered) so the caller's own active
-        // run can never sort first under `LIMIT 1` and mask a genuinely different
-        // scope's run — the failure mode a same-scope-inclusive query plus a
-        // post-filter has with `--new`/`--force`.
+        // The active-alias query and all inserts share one immediate transaction.
+        // #942: an active run of this ref in a different scope (e.g. a scheduled
+        // task's cwd vs. a shell) is warned about once; the uniqueness guard stays
+        // scope-local. The query excludes the caller's own scope in SQL.
         const crossScopeActive = repo.findActiveRunOutsideScope(workflowRefs, scopeKey);
         const crossScopeWarning = crossScopeActive
             ? `Workflow ${asset.ref} already has an active run in another scope ` +
@@ -161,7 +140,6 @@ export async function startWorkflowRun(ref, params = {}, options) {
                 updatedAt: now,
                 agentHarness,
                 agentSessionId,
-                checkinArmedAt: now,
             },
             steps: frozenStepRows(plan).map((step) => ({
                 runId,
@@ -173,16 +151,14 @@ export async function startWorkflowRun(ref, params = {}, options) {
             })),
             planJson,
             planHash,
-            revalidateSources: () => frozen.sourceCollector.revalidate(),
         });
         const result = await getWorkflowStatus(runId);
         if (crossScopeWarning)
             result.warnings = [...(result.warnings ?? []), crossScopeWarning];
-        // #13: params are declared non-secret (they are copied verbatim into every
-        // unit prompt and hashed into the unit identity, so they cannot be redacted
-        // without breaking replay determinism). Surface a loud, best-effort warning
-        // when a param LOOKS like a credential so the author moves it to an env
-        // binding. Advisory only — never blocks the start.
+        // Params reach every unit prompt in clear (only the journal scrubs them).
+        // Surface a loud, best-effort warning when a param LOOKS like a credential
+        // so the author moves it to an env binding. Advisory only — never blocks
+        // the start.
         const secretWarnings = detectSecretShapedParams(effectiveParams);
         if (secretWarnings.length > 0)
             result.warnings = [...(result.warnings ?? []), ...secretWarnings];
@@ -203,12 +179,7 @@ export async function getWorkflowStatus(runId, opts) {
             // The honest diagnostic surface (#22): read the unit journal straight and
             // project each row, INCLUDING failures whose diagnostic text the
             // deterministic evidence graph drops. Read-only; never mutates the run.
-            const rows = repo.getUnitsForRun(run.id);
-            // Codex round-3 finding B: run the pure stale-claim evaluator (`now`
-            // injected for deterministic tests) so a unit left `running` by a process
-            // that died surfaces as stale here, not just as raw `running`.
-            const staleById = new Map(evaluateStaleUnits(rows, opts.now ?? Date.now()).map((u) => [u.unitId, u]));
-            detail.units = rows.map((row) => toUnitDiagnostic(row, staleById.get(row.unit_id)));
+            detail.units = repo.getUnitsForRun(run.id).map(toUnitDiagnostic);
         }
         return detail;
     });
@@ -271,9 +242,6 @@ export async function getNextWorkflowStep(specifier, params, options) {
     return withWorkflowRunsRepo(async (repo) => {
         const { run, autoStarted, resumed, startWarnings } = await resolveRunSpecifier(repo, specifier, params, options?.parameterFlags, options?.newRun);
         const steps = readWorkflowRunSteps(repo, run.id);
-        const plan = requireExecutableWorkflowPlan(run);
-        reconcileWorkflowSpineWithPlan(plan, run, steps);
-        assertRunStatusMatchesSpine(run, steps);
         return {
             ...projectNextResult(run, steps),
             ...(autoStarted ? { autoStarted: true } : {}),
@@ -291,15 +259,6 @@ export async function getNextWorkflowStep(specifier, params, options) {
 function projectNextResult(run, steps) {
     const currentStep = resolveCurrentStep(run, steps);
     const done = run.status === "completed" ? true : undefined;
-    // #506: surface a check-in directive through the normal command output when
-    // the run looks stalled. Pure timestamp evaluation — no background thread.
-    const checkin = evaluateCheckin({
-        status: run.status,
-        updatedAt: run.updated_at,
-        checkinArmedAt: run.checkin_armed_at,
-        agentHarness: run.agent_harness,
-        agentSessionId: run.agent_session_id,
-    }) ?? undefined;
     return {
         run: toWorkflowRunSummary(run),
         workflow: {
@@ -309,20 +268,16 @@ function projectNextResult(run, steps) {
         },
         step: currentStep ? toWorkflowRunStepState(currentStep) : null,
         ...(done ? { done } : {}),
-        ...(checkin ? { checkin } : {}),
     };
 }
 export async function resumeWorkflowRun(runId) {
     return withWorkflowRunsRepo((repo) => {
         const run = readWorkflowRunOrPrefix(repo, runId);
-        const storedPlan = requireExecutableWorkflowPlan(run);
         const steps = readWorkflowRunSteps(repo, run.id);
-        reconcileWorkflowSpineWithPlan(storedPlan, run, steps);
         if (run.status === "completed") {
             throw new UsageError(`Workflow run ${run.id} is already completed and cannot be resumed.`);
         }
         if (run.status === "active") {
-            assertRunStatusMatchesSpine(run, steps);
             return buildWorkflowRunDetail(repo, run, steps);
         }
         // blocked or failed → flip back to active and re-open the current step so
@@ -335,9 +290,7 @@ export async function resumeWorkflowRun(runId) {
             repo.markRunActive(run.id, now);
         });
         const updated = { ...run, status: "active", updated_at: now };
-        const refreshedSteps = readWorkflowRunSteps(repo, run.id);
-        assertRunStatusMatchesSpine(updated, refreshedSteps);
-        return buildWorkflowRunDetail(repo, updated, refreshedSteps);
+        return buildWorkflowRunDetail(repo, updated, readWorkflowRunSteps(repo, run.id));
     });
 }
 /**
@@ -372,11 +325,8 @@ export async function abandonWorkflowRun(runId) {
             status: "failed",
             updated_at: now,
             completed_at: now,
-            checkin_armed_at: now,
         };
-        const steps = readWorkflowRunSteps(repo, run.id);
-        const detail = buildWorkflowRunDetail(repo, updated, steps);
-        return detail;
+        return buildWorkflowRunDetail(repo, updated, readWorkflowRunSteps(repo, run.id));
     });
 }
 export async function completeWorkflowStep(input) {
@@ -384,14 +334,10 @@ export async function completeWorkflowStep(input) {
     // the write transaction — a slow/hung LLM must never hold a db write lock.
     const preflight = await withWorkflowRunsRepo((repo) => {
         const run = readWorkflowRun(repo, input.runId);
-        const storedPlan = requireExecutableWorkflowPlan(run);
-        const steps = readWorkflowRunSteps(repo, run.id);
-        reconcileWorkflowSpineWithPlan(storedPlan, run, steps);
-        assertRunStatusMatchesSpine(run, steps);
+        const storedPlan = requireRunPlan(run);
         if (run.status !== "active") {
             throw new UsageError(`Workflow run ${run.id} is ${run.status} and cannot be updated.`);
         }
-        assertLeaseAllowsSpineAdvance(run, input.leaseHolder);
         const existing = repo.getStep(run.id, input.stepId);
         if (!existing) {
             throw new NotFoundError(`Step "${input.stepId}" was not found in workflow run ${run.id}.`);
@@ -433,11 +379,7 @@ export async function completeWorkflowStep(input) {
         }
         const verdict = await validateStepSummary({ stepTitle: preflight.stepPlan.title, completionCriteria: criteria, summary }, judge ?? undefined, input.signal);
         if (!verdict.complete) {
-            // Re-arm the check-in so a subsequent stall is still nudged, but leave the
-            // step pending and return corrective feedback instead of completing.
-            await withWorkflowRunsRepo((repo) => {
-                repo.rearmCheckin(input.runId, new Date().toISOString());
-            });
+            // Leave the step pending and return corrective feedback instead of completing.
             return {
                 ok: false,
                 runId: input.runId,
@@ -455,17 +397,10 @@ export async function completeWorkflowStep(input) {
         let outputWarnings;
         repo.transaction(() => {
             const run = readWorkflowRun(repo, input.runId);
-            const plan = requireExecutableWorkflowPlan(run);
-            const spine = readWorkflowRunSteps(repo, run.id);
-            reconcileWorkflowSpineWithPlan(plan, run, spine);
-            assertRunStatusMatchesSpine(run, spine);
+            const plan = requireRunPlan(run);
             if (run.status !== "active") {
                 throw new UsageError(`Workflow run ${run.id} is ${run.status} and cannot be updated.`);
             }
-            // Re-checked inside the write transaction (like every other preflight
-            // condition): an engine may have claimed the run while the summary gate
-            // above was awaiting its LLM judge.
-            assertLeaseAllowsSpineAdvance(run, input.leaseHolder);
             const existing = repo.getStep(run.id, input.stepId);
             if (!existing) {
                 throw new NotFoundError(`Step "${input.stepId}" was not found in workflow run ${run.id}.`);
@@ -479,13 +414,8 @@ export async function completeWorkflowStep(input) {
             if (input.signal?.aborted)
                 throw interruptionReason(input.signal);
             const completedAt = new Date().toISOString();
-            // The promoted artifact is persisted WHOLE, unclipped (issue C): a
-            // step artifact that does not fit some cap used to be replaced by a
-            // truncation marker at this exact write, and the run looked fine right
-            // up until a LATER invocation (a resume, or any downstream step
-            // referencing it) found the marker instead of the value and failed
-            // permanently, with every prior paid step now unrecoverable. Persisting
-            // the real value here is what makes it readable again on resume.
+            // The promoted artifact is persisted whole, so a resume and every later
+            // reference read the real value.
             const evidenceJson = input.evidence ? JSON.stringify(input.evidence) : null;
             repo.updateStepCompletion({
                 status: input.status,
@@ -498,13 +428,8 @@ export async function completeWorkflowStep(input) {
             });
             refreshedSteps = readWorkflowRunSteps(repo, run.id);
             const state = deriveRunState(refreshedSteps);
-            // P3b (spec §4.3, B-N13): resolve + persist declared outputs INSIDE
-            // this same transaction, immediately after the run is known to have
-            // COMPLETED. A resolution failure throws here, and the transaction
-            // rolls back whole — the step completion included — so the observable
-            // outcome is fail-before-mutation: the step stays pending, the run
-            // stays active, and (since appendEvent runs outside this transaction)
-            // no event is appended.
+            // Declared outputs resolve inside this transaction once the run
+            // completes; a failure rolls the step completion back whole.
             let outputsJson; // undefined = untouched, keep the row's existing value
             if (state.status === "completed" && plan.outputs) {
                 const resolved = resolveWorkflowRunOutputs(plan, refreshedSteps);
@@ -512,14 +437,11 @@ export async function completeWorkflowStep(input) {
                 repo.setRunOutputs(run.id, outputsJson);
                 outputWarnings = resolved.errors;
             }
-            // Re-arm the check-in on every state change: a healthy, progressing run
-            // keeps pushing the stall window forward so the directive never fires.
             repo.updateRunState({
                 status: state.status,
                 currentStepId: state.currentStepId,
                 updatedAt: completedAt,
                 completedAt: state.completedAt,
-                checkinArmedAt: completedAt,
                 runId: run.id,
             });
             updatedRun = {
@@ -528,7 +450,6 @@ export async function completeWorkflowStep(input) {
                 current_step_id: state.currentStepId,
                 updated_at: completedAt,
                 completed_at: state.completedAt,
-                checkin_armed_at: completedAt,
                 ...(outputsJson !== undefined ? { outputs_json: outputsJson } : {}),
             };
         });
@@ -663,48 +584,33 @@ function readWorkflowRunOrPrefix(repo, specifier) {
     const run = findRunByIdOrPrefix(repo, specifier);
     if (!run)
         throw new NotFoundError(`Workflow run "${specifier}" not found.`, "WORKFLOW_NOT_FOUND");
-    return reclaimOrphanedEngineLease(repo, run);
+    return run;
 }
 function readWorkflowRun(repo, runId) {
     const run = repo.getRunById(runId);
     if (!run) {
         throw new NotFoundError(`Workflow run "${runId}" not found.`, "WORKFLOW_NOT_FOUND");
     }
-    return reclaimOrphanedEngineLease(repo, run);
+    return run;
 }
 /**
- * Self-heal a run's engine lease once it has expired — the orphaned-lease
- * case where an engine crashed without releasing it — mirroring the
- * maintenance barrier's self-reclaim of a wedged sentinel, applied at the
- * points a caller actually asks "what is this run's state". Never touches a
- * live lease: {@link WorkflowRunsRepository.reclaimExpiredEngineLease} is a
- * compare-and-swap on the exact (holder, until) this call observed, so a
- * lease renewed or re-acquired between the read and this write is left alone.
+ * The frozen plan a step completion resolves its gate/outputs against. The
+ * engine has already read (or abandoned) the plan before it gets here; this
+ * throw only covers a direct caller completing a step of a run whose plan is
+ * unreadable.
  */
-function reclaimOrphanedEngineLease(repo, run) {
-    const { engine_lease_holder: holder, engine_lease_until: until } = run;
-    if (!holder || !until)
-        return run;
-    const now = new Date().toISOString();
-    if (until >= now)
-        return run;
-    repo.reclaimExpiredEngineLease(run.id, holder, until, now);
-    return { ...run, engine_lease_holder: null, engine_lease_until: null };
+function requireRunPlan(run) {
+    const read = readRunPlan(run);
+    if (read.ok)
+        return read.plan;
+    throw new UsageError(read.newer
+        ? read.problem
+        : `${read.problem} Run 'akm workflow abandon ${run.id}' and start a new run with 'akm workflow run ${run.workflow_ref}'.`);
 }
 function readWorkflowRunSteps(repo, runId) {
     return repo.getStepsForRun(runId);
 }
 function buildWorkflowRunDetail(repo, run, steps) {
-    // Review M1: `workflow status` (and every other detail-shaped response) now
-    // evaluates the check-in, not just `workflow run`. Pure timestamp check —
-    // no background thread (see checkin.ts).
-    const checkin = evaluateCheckin({
-        status: run.status,
-        updatedAt: run.updated_at,
-        checkinArmedAt: run.checkin_armed_at,
-        agentHarness: run.agent_harness,
-        agentSessionId: run.agent_session_id,
-    });
     const children = childRunTree(repo, run.id, run.id);
     return {
         run: toWorkflowRunSummary(run),
@@ -713,39 +619,14 @@ function buildWorkflowRunDetail(repo, run, steps) {
             title: run.workflow_title,
             steps: steps.map(toWorkflowRunStepState),
         },
-        ...(checkin ? { checkin } : {}),
         ...(children ? { children } : {}),
     };
 }
 /**
- * Build the parent-child status tree rooted at `rootRunId`, recursively, for
- * whatever run's children are being listed (`forRunId`) — P3b, spec §4.5.
- * `rootRunId` is threaded unchanged through the recursion, so every blocked
- * node's `resume.then` names the SAME top-of-query run regardless of nesting
- * depth: `akm workflow resume <rootRunId> && akm workflow run <rootRunId>` —
- * never each node's own immediate parent, which the tree's caller has no
- * command for.
- *
- * That command is sufficient to clear a block exactly ONE level deep (the
- * root's own composing step blocked directly on this node) but NOT deeper
- * (code-review round 4, finding 6 / Review log R6 — corrects a false claim
- * this comment used to make here). Re-driving the root does **not** cascade
- * back down through every intermediate composing step: `driveChildWorkflowUnit`
- * (child-workflow.ts) never re-drives a child whose OWN status is `blocked`
- * (row A-22) — no lease is even taken — so a re-drive just RE-OBSERVES the
- * still-blocked status and re-propagates the block upward (an intermediate
- * run is always blocked when a descendant is, row A-21, applied
- * recursively), never reaching the deepest blocked node. Clearing a
- * depth-2-or-deeper block requires resuming EVERY blocked run in the chain,
- * deepest first, then re-running only the root — see "Recovering a blocked
- * child" in docs/guides/run-workflows.md and "Blocked-child recovery" in
- * docs/reference/workflow-schema.md for the worked multi-level sequence.
- * `resume.then` is deliberately not widened to enumerate that chain (no
- * envelope change, no new field) — the docs carry the multi-level sequence
- * instead.
- *
- * Absent, never `[]`, when `forRunId` has no children (P3a's `childRunsOf`
- * order: `created_at, id`).
+ * The parent-child status tree for `forRunId`'s children, recursively. Every
+ * blocked node's `resume.then` names the top-of-query run (`rootRunId`); a
+ * block deeper than one level needs every blocked run resumed, deepest first
+ * (docs/guides/run-workflows.md). Absent, never `[]`, when there are no children.
  */
 function childRunTree(repo, rootRunId, forRunId) {
     const rows = repo.childRunsOf(forRunId);
@@ -755,7 +636,7 @@ function childRunTree(repo, rootRunId, forRunId) {
 }
 function toChildRunNode(repo, rootRunId, row) {
     const spawnedByUnitId = row.parent_unit_id ?? "";
-    // B-36: the parent STEP that spawned it, resolved via the real journaled
+    // the parent STEP that spawned it, resolved via the real journaled
     // unit row — null when that unit row is gone.
     const stepId = row.parent_run_id && row.parent_unit_id
         ? (repo.getUnit(row.parent_run_id, row.parent_unit_id)?.step_id ?? null)
@@ -784,7 +665,6 @@ function toChildRunNode(repo, rootRunId, row) {
     };
 }
 function toWorkflowRunSummary(run) {
-    const plan = classifyWorkflowRunPlan(run);
     return {
         id: run.id,
         workflowRef: run.workflow_ref,
@@ -799,47 +679,15 @@ function toWorkflowRunSummary(run) {
         params: parseJsonObject(run.params_json),
         agentHarness: run.agent_harness ?? null,
         agentSessionId: run.agent_session_id ?? null,
-        planIrVersion: plan.irVersion,
-        executionSupport: plan.support,
-        // Surface the engine lease (holder id + expiry — never workflow-authored
-        // content) so `workflow run`/`status` show which native execution
-        // invocation currently holds the run lease. Gated on `until` still being
-        // in the future: a crashed engine's lease self-expires, and a run
-        // whose holder is provably gone must stop reading as engine-driven the
-        // instant that happens, not just once something next attempts to acquire
-        // it (`readWorkflowRun`/`readWorkflowRunOrPrefix` also reclaim the DB
-        // columns outright on the same condition).
-        ...(run.engine_lease_holder && run.engine_lease_until && run.engine_lease_until >= new Date().toISOString()
-            ? { engineLease: { holder: run.engine_lease_holder, until: run.engine_lease_until } }
-            : {}),
-        // P3b (spec §4.5): all three optional and conditionally spread, so every
+        planIrVersion: run.plan_ir_version ?? null,
+        // P3b: all three optional and conditionally spread, so every
         // pre-existing (non-child, no-outputs-declared) run's envelope is
-        // byte-identical (Stable tier, rows B-27, B-45).
+        // byte-identical.
         ...(run.outputs_json ? { outputs: parseJsonObject(run.outputs_json) ?? {} } : {}),
         ...(run.parent_run_id ? { parentRunId: run.parent_run_id } : {}),
         ...(run.parent_unit_id ? { spawnedByUnitId: run.parent_unit_id } : {}),
     };
 }
-/**
- * Single-driver enforcement (R2 run lease): while a LIVE (unexpired) engine
- * lease is held, only the holding engine may advance the gate spine. Manual
- * A call with no `leaseHolder` — or a stale engine invocation
- * whose lease was claimed by another — is refused with the holder + expiry.
- * An EXPIRED lease never blocks: the engine that held it is presumed dead.
- */
-function assertLeaseAllowsSpineAdvance(run, leaseHolder) {
-    if (!run.engine_lease_holder || !run.engine_lease_until)
-        return;
-    if (leaseHolder === run.engine_lease_holder)
-        return;
-    if (run.engine_lease_until < new Date().toISOString())
-        return; // expired ⇒ claimable, not live
-    // #948 addendum: moved off UsageError (exit 75, not exit 2) — a held lease
-    // is ordinary contention, not a bad command line.
-    throw new TransientError(`Workflow run ${run.id} is being driven by engine ${run.engine_lease_holder} ` +
-        `(run lease expires ${run.engine_lease_until}). The engine owns the step spine while it runs — ` +
-        `wait for it to finish or for the lease to expire before advancing steps manually.`, "RUN_LEASE_HELD");
-}
 function toWorkflowRunStepState(step) {
     return {
         id: step.step_id,

package/dist/workflows/runtime/workflow-asset-loader.js

@@ -1,6 +1,7 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import { createHash } from "node:crypto";
 import fs from "node:fs";
 import { detectAdapterId } from "../../core/adapter/detect-adapter.js";
 import { makeBundleRef, parseBundleRef } from "../../core/asset/asset-ref.js";
@@ -12,8 +13,7 @@ import { deriveInstallations } from "../../indexer/installations.js";
 import { resolveAdapterConceptOwner } from "../../indexer/lookup/adapter-concept-owner.js";
 import { resolveSourceEntries } from "../../indexer/search/search-source.js";
 import { withIndexDb } from "../../storage/repositories/index-db.js";
-import { compileWorkflowSource } from "../source-ir/compile.js";
-import { sourceStepInstructions } from "../source-ir/program.js";
+import { compileWorkflowSource } from "../compile.js";
 /**
  * Build the canonical `workflow_runs.workflow_ref` for an AKM workflow asset.
  */
@@ -36,7 +36,7 @@ export async function canonicalizeWorkflowRefInput(ref) {
     return (await loadWorkflowAsset(ref)).ref;
 }
 /**
- * Resolve a workflow ref and compile its authored bytes into source IR.
+ * Resolve a workflow ref and compile its authored bytes into a plan.
  */
 export async function loadWorkflowAsset(ref) {
     const bundleRef = parseWorkflowRefInput(ref);
@@ -91,8 +91,27 @@ export async function loadWorkflowAsset(ref) {
     const fullRef = workflowAdapterId === "akm-workflow"
         ? makeBundleRef(sourceBundleId, canonicalName)
         : canonicalWorkflowRunRef(sourceBundleId, canonicalName);
-    const sourceIr = compileWorkflowSourceFromDisk(assetPath, resolvedSourcePath);
-    return projectAsset(sourceIr, fullRef, assetPath, resolvedSourcePath, workflowAdapterId, canonicalName);
+    const title = canonicalName.split("/").pop() || canonicalName;
+    const bytes = fs.readFileSync(assetPath);
+    const result = compileWorkflowSource(bytes.toString("utf8"), {
+        path: assetPath,
+        workspaceRoot: resolvedSourcePath,
+        title,
+    });
+    if (!result.ok) {
+        const details = result.errors.map((error) => `  ${error.path}:${error.line} — ${error.message}`).join("\n");
+        const isMultiJob = result.errors.length === 1 && result.errors[0]?.code === "multi-job-unsupported";
+        throw new UsageError(`Workflow source has ${result.errors.length} error(s):\n${details}`, isMultiJob ? "COMPOSITION_INVALID" : "WORKFLOW_SOURCE_INVALID", isMultiJob ? COMPOSITION_INVALID_MULTI_JOB_HINT : undefined);
+    }
+    return {
+        ref: fullRef,
+        path: assetPath,
+        sourcePath: resolvedSourcePath,
+        adapterId: workflowAdapterId,
+        title,
+        plan: result.plan,
+        sourceHash: createHash("sha256").update(bytes).digest("hex"),
+    };
 }
 function ownsNativeWorkflowRuntime(source) {
     return source.adapterId === "akm" || source.adapterId === "akm-workflow";
@@ -120,55 +139,3 @@ export function resolveWorkflowEntryId(_sourcePath, ref, adapterId) {
         return row?.id ?? null;
     });
 }
-function compileWorkflowSourceFromDisk(assetPath, workspaceRoot) {
-    const content = fs.readFileSync(assetPath, "utf8");
-    const result = compileWorkflowSource(content, { path: assetPath, workspaceRoot });
-    if (!result.ok) {
-        // P4-N2's mapping (docs/plans/specs/p4-deletions-closeout.md §3.3.4): this
-        // is the FIRST compile of a workflow's own source that a ref resolves
-        // through (loadWorkflowAsset runs before compileResolveFreezeWorkflowV4),
-        // so it must apply the same code split as the freeze wrapper — otherwise
-        // row B-44's COMPOSITION_INVALID promise never reaches `startWorkflowRun`
-        // callers, which never get past this point on a multi-job source.
-        const details = result.errors.map((error) => `  ${error.path}:${error.line} — ${error.message}`).join("\n");
-        const isMultiJob = result.errors.length === 1 && result.errors[0]?.code === "multi-job-unsupported";
-        const code = isMultiJob ? "COMPOSITION_INVALID" : "WORKFLOW_SOURCE_INVALID";
-        throw new UsageError(`Workflow source has ${result.errors.length} error(s):\n${details}`, code, isMultiJob ? COMPOSITION_INVALID_MULTI_JOB_HINT : undefined);
-    }
-    return result.ir;
-}
-function projectAsset(sourceIr, ref, assetPath, sourcePath, adapterId, canonicalName) {
-    const title = canonicalName.split("/").pop() || canonicalName;
-    return {
-        ref,
-        path: assetPath,
-        sourcePath,
-        adapterId,
-        title,
-        ...(sourceIr.params
-            ? {
-                parameters: Object.entries(sourceIr.params).map(([name, schema]) => {
-                    const description = schema.description;
-                    return { name, ...(typeof description === "string" && description ? { description } : {}) };
-                }),
-            }
-            : {}),
-        steps: sourceIr.jobs.flatMap((job) => job.steps.map((step, sequenceIndex) => ({
-            id: step.id,
-            title: step.id,
-            instructions: step.route ? stepFallbackInstructions(step) : sourceStepInstructions(step),
-            ...(step.gate?.rubric?.trim() ? { completionCriteria: [step.gate.rubric] } : {}),
-            sequenceIndex,
-        }))),
-        sourceIr,
-    };
-}
-/** A route-only step with no body section still needs a non-empty spine instructions string. */
-function stepFallbackInstructions(step) {
-    if (!step.route)
-        return "";
-    const branches = step.route.branches.map((b) => `"${b.match}" -> ${b.stepId}`);
-    if (step.route.defaultStepId !== undefined)
-        branches.push(`default -> ${step.route.defaultStepId}`);
-    return `Route on ${step.route.input}: ${branches.join(", ")}.`;
-}