akm-cli 0.9.2-alpha.4 → 0.9.2

package/dist/workflows/runtime/run-outputs.js

@@ -0,0 +1,103 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * Declared-output resolution and the exported result (P3b, spec
+ * docs/plans/specs/p3b-child-executor.md §4.3, §4.4).
+ *
+ * Pure; no IO. `resolveWorkflowRunOutputs` reads PERSISTED step rows (never
+ * live in-memory evidence — `completeWorkflowStep` sees only the current
+ * step's; a resumed run has nothing else to rebuild the scope from, B-N12)
+ * and fails loudly, by name, when a declared output's source artifact was
+ * replaced by a truncation envelope at persistence.
+ *
+ * This module must stay IMPORT-CYCLE-FREE with `./runs.ts` (which imports
+ * it): `WORKFLOW_EVIDENCE_TRUNCATED_MARKER`'s value is therefore reproduced
+ * locally rather than imported — the same "reproduce across a boundary
+ * rather than import" idiom `ir/schema-v4.ts` already uses for
+ * `CHILD_WORKFLOW_DECODE_MAX_DEPTH`.
+ */
+import { validateJsonSchemaSubset } from "../../core/json-schema.js";
+import { parseReference, resolveReferenceString } from "../program/expressions.js";
+/** Mirrors `runs.ts`'s `WORKFLOW_EVIDENCE_TRUNCATED_MARKER` byte-for-byte — see this file's header for why it is reproduced, not imported. */
+const EVIDENCE_TRUNCATED_MARKER = "__akm_evidence_truncated__";
+function isTruncatedEvidenceValue(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        value[EVIDENCE_TRUNCATED_MARKER] === true);
+}
+/** Project a step artifact out of its persisted evidence — mirrors `exec/step-work.ts`'s `projectStepOutput`. */
+function projectStepOutput(evidence) {
+    return Object.hasOwn(evidence, "output") ? evidence.output : evidence;
+}
+/**
+ * Resolve a plan's declared `outputs:` from a run's PERSISTED step rows, in
+ * declaration order (the frozen plan's `outputs` keys are already
+ * sorted-unique, `ir/schema-v4.ts`'s `decodeWorkflowOutputs`). Every failure
+ * mode is collected (not stopped-at-first) so a completion failure names
+ * every offending output at once.
+ */
+export function resolveWorkflowRunOutputs(plan, steps) {
+    const stepOutputs = {};
+    for (const row of steps) {
+        if (!row.evidence_json)
+            continue;
+        let evidence;
+        try {
+            evidence = JSON.parse(row.evidence_json);
+        }
+        catch {
+            continue;
+        }
+        stepOutputs[row.step_id] = projectStepOutput(evidence);
+    }
+    const scope = { params: {}, stepOutputs };
+    const errors = [];
+    const outputs = {};
+    for (const [name, declaration] of Object.entries(plan.outputs ?? {})) {
+        const parsed = parseReference(declaration.from);
+        if (!parsed.ok || parsed.expr.kind !== "stepOutput") {
+            errors.push(`output "${name}": "${declaration.from}" is not a valid step-output reference.`);
+            continue;
+        }
+        const rootValue = Object.hasOwn(stepOutputs, parsed.expr.stepId) ? stepOutputs[parsed.expr.stepId] : undefined;
+        if (isTruncatedEvidenceValue(rootValue)) {
+            errors.push(`output "${name}" reads step "${parsed.expr.stepId}"'s artifact, which was truncated — it exceeded the ` +
+                `evidence persistence cap and was not stored.`);
+            continue;
+        }
+        const resolved = resolveReferenceString(declaration.from, scope);
+        if (!resolved.ok) {
+            errors.push(`output "${name}": ${resolved.error.message}`);
+            continue;
+        }
+        if (isTruncatedEvidenceValue(resolved.value)) {
+            errors.push(`output "${name}" reads step "${parsed.expr.stepId}"'s artifact, which was truncated — it exceeded the ` +
+                `evidence persistence cap and was not stored.`);
+            continue;
+        }
+        if (declaration.schema) {
+            const schemaErrors = validateJsonSchemaSubset(resolved.value, declaration.schema);
+            if (schemaErrors.length > 0) {
+                for (const schemaError of schemaErrors)
+                    errors.push(`output "${name}": ${schemaError}`);
+                continue;
+            }
+        }
+        outputs[name] = resolved.value;
+    }
+    if (errors.length > 0)
+        return { ok: false, errors };
+    return { ok: true, outputs };
+}
+/**
+ * What a completed run EXPORTS: the resolved declared outputs, or
+ * `{runId, status}` metadata when the plan declared none. The `{runId,
+ * status}` form is synthesized on read and never stored (row B-25).
+ */
+export function workflowRunExportedResult(row) {
+    if (row.outputs_json) {
+        return JSON.parse(row.outputs_json);
+    }
+    return { runId: row.id, status: row.status };
+}

package/dist/workflows/runtime/runs.js

@@ -21,6 +21,7 @@ import { validateStepSummary } from "../validate-summary.js";
 import { resolveAgentIdentity } from "./agent-identity.js";
 import { evaluateCheckin } from "./checkin.js";
 import { assertWorkflowSpineMatchesPlan, classifyWorkflowRunPlan, frozenStepRows, requireExecutableWorkflowPlan, } from "./plan-classifier.js";
+import { resolveWorkflowRunOutputs } from "./run-outputs.js";
 import { evaluateStaleUnits } from "./unit-checkin.js";
 import { canonicalizeWorkflowRefInput, loadWorkflowAsset, resolveWorkflowEntryId } from "./workflow-asset-loader.js";
 /**
@@ -176,7 +177,7 @@ export async function getWorkflowStatus(runId, opts) {
     return withWorkflowRunsRepo((repo) => {
         const run = readWorkflowRun(repo, runId);
         const steps = readWorkflowRunSteps(repo, run.id);
-        const detail = buildWorkflowRunDetail(run, steps);
+        const detail = buildWorkflowRunDetail(repo, run, steps);
         if (opts?.includeUnits) {
             // The honest diagnostic surface (#22): read the unit journal straight and
             // project each row, INCLUDING failures whose diagnostic text the
@@ -197,9 +198,16 @@ export async function hasWorkflowRun(runId) {
 export async function listWorkflowRuns(input) {
     const scopeKey = getCurrentWorkflowScopeKey();
     const activeOnly = input?.activeOnly === true;
+    const includeChildren = input?.includeChildren === true;
     if (input?.workflowRef === undefined) {
         return withWorkflowRunsRepo((repo) => ({
-            runs: repo.listRuns({ scopeKey, ...(activeOnly ? { activeOnly: true } : {}) }).map(toWorkflowRunSummary),
+            runs: repo
+                .listRuns({
+                scopeKey,
+                ...(activeOnly ? { activeOnly: true } : {}),
+                ...(includeChildren ? { includeChildren: true } : {}),
+            })
+                .map(toWorkflowRunSummary),
         }));
     }
     const exactRef = input.workflowRef.trim();
@@ -217,7 +225,7 @@ export async function listWorkflowRuns(input) {
     }
     catch (error) {
         if (parsedExactRef.bundle !== undefined) {
-            const exactRows = await withWorkflowRunsRepo((repo) => repo.listRuns({ scopeKey, workflowRef: exactRef }));
+            const exactRows = await withWorkflowRunsRepo((repo) => repo.listRuns({ scopeKey, workflowRef: exactRef, ...(includeChildren ? { includeChildren: true } : {}) }));
             if (exactRows.length === 0)
                 throw error;
             return {
@@ -229,7 +237,12 @@ export async function listWorkflowRuns(input) {
     }
     return withWorkflowRunsRepo((repo) => ({
         runs: repo
-            .listRuns({ scopeKey, workflowRefs, ...(activeOnly ? { activeOnly: true } : {}) })
+            .listRuns({
+            scopeKey,
+            workflowRefs,
+            ...(activeOnly ? { activeOnly: true } : {}),
+            ...(includeChildren ? { includeChildren: true } : {}),
+        })
             .map(toWorkflowRunSummary),
     }));
 }
@@ -286,7 +299,7 @@ export async function resumeWorkflowRun(runId) {
             throw new UsageError(`Workflow run ${run.id} is already completed and cannot be resumed.`);
         }
         if (run.status === "active") {
-            return buildWorkflowRunDetail(run, steps);
+            return buildWorkflowRunDetail(repo, run, steps);
         }
         // blocked or failed → flip back to active and re-open the current step so
         // it can be reclassified (completed, failed, skipped) after resuming.
@@ -299,7 +312,7 @@ export async function resumeWorkflowRun(runId) {
         });
         const updated = { ...run, status: "active", updated_at: now };
         const refreshedSteps = readWorkflowRunSteps(repo, run.id);
-        return buildWorkflowRunDetail(updated, refreshedSteps);
+        return buildWorkflowRunDetail(repo, updated, refreshedSteps);
     });
 }
 /**
@@ -337,7 +350,7 @@ export async function abandonWorkflowRun(runId) {
             checkin_armed_at: now,
         };
         const steps = readWorkflowRunSteps(repo, run.id);
-        const detail = buildWorkflowRunDetail(updated, steps);
+        const detail = buildWorkflowRunDetail(repo, updated, steps);
         return detail;
     });
 }
@@ -575,6 +588,23 @@ export async function completeWorkflowStep(input) {
             });
             refreshedSteps = readWorkflowRunSteps(repo, run.id);
             const state = deriveRunState(refreshedSteps);
+            // P3b (spec §4.3, B-N13): resolve + persist declared outputs INSIDE
+            // this same transaction, immediately after the run is known to have
+            // COMPLETED. A resolution failure throws here, and the transaction
+            // rolls back whole — the step completion included — so the observable
+            // outcome is fail-before-mutation: the step stays pending, the run
+            // stays active, and (since appendEvent runs outside this transaction)
+            // no event is appended.
+            let outputsJson; // undefined = untouched, keep the row's existing value
+            if (state.status === "completed" && plan.outputs) {
+                const resolved = resolveWorkflowRunOutputs(plan, refreshedSteps);
+                if (!resolved.ok) {
+                    throw new UsageError(`Workflow run ${run.id} completed its final step but its declared outputs could not be resolved:\n` +
+                        resolved.errors.map((e) => `  - ${e}`).join("\n"), "WORKFLOW_OUTPUT_INVALID");
+                }
+                outputsJson = JSON.stringify(resolved.outputs);
+                repo.setRunOutputs(run.id, outputsJson);
+            }
             // Re-arm the check-in on every state change: a healthy, progressing run
             // keeps pushing the stall window forward so the directive never fires.
             repo.updateRunState({
@@ -592,9 +622,10 @@ export async function completeWorkflowStep(input) {
                 updated_at: completedAt,
                 completed_at: state.completedAt,
                 checkin_armed_at: completedAt,
+                ...(outputsJson !== undefined ? { outputs_json: outputsJson } : {}),
             };
         });
-        const detail = buildWorkflowRunDetail(updatedRun, refreshedSteps);
+        const detail = buildWorkflowRunDetail(repo, updatedRun, refreshedSteps);
         // #11: emit `workflow_step_completed` ONLY for a genuine `completed`
         // transition; every other non-pending status (failed/skipped/blocked)
         // carries the honest `workflow_step_updated` name. The status is ALWAYS
@@ -693,7 +724,7 @@ function readWorkflowRun(repo, runId) {
 function readWorkflowRunSteps(repo, runId) {
     return repo.getStepsForRun(runId);
 }
-function buildWorkflowRunDetail(run, steps) {
+function buildWorkflowRunDetail(repo, run, steps) {
     // Review M1: `workflow status` (and every other detail-shaped response) now
     // evaluates the check-in, not just `workflow run`. Pure timestamp check —
     // no background thread (see checkin.ts).
@@ -704,6 +735,7 @@ function buildWorkflowRunDetail(run, steps) {
         agentHarness: run.agent_harness,
         agentSessionId: run.agent_session_id,
     });
+    const children = childRunTree(repo, run.id, run.id);
     return {
         run: toWorkflowRunSummary(run),
         workflow: {
@@ -712,6 +744,73 @@ function buildWorkflowRunDetail(run, steps) {
             steps: steps.map(toWorkflowRunStepState),
         },
         ...(checkin ? { checkin } : {}),
+        ...(children ? { children } : {}),
+    };
+}
+/**
+ * Build the parent-child status tree rooted at `rootRunId`, recursively, for
+ * whatever run's children are being listed (`forRunId`) — P3b, spec §4.5.
+ * `rootRunId` is threaded unchanged through the recursion, so every blocked
+ * node's `resume.then` names the SAME top-of-query run regardless of nesting
+ * depth: `akm workflow resume <rootRunId> && akm workflow run <rootRunId>` —
+ * never each node's own immediate parent, which the tree's caller has no
+ * command for.
+ *
+ * That command is sufficient to clear a block exactly ONE level deep (the
+ * root's own composing step blocked directly on this node) but NOT deeper
+ * (code-review round 4, finding 6 / Review log R6 — corrects a false claim
+ * this comment used to make here). Re-driving the root does **not** cascade
+ * back down through every intermediate composing step: `driveChildWorkflowUnit`
+ * (child-workflow.ts) never re-drives a child whose OWN status is `blocked`
+ * (row A-22) — no lease is even taken — so a re-drive just RE-OBSERVES the
+ * still-blocked status and re-propagates the block upward (an intermediate
+ * run is always blocked when a descendant is, row A-21, applied
+ * recursively), never reaching the deepest blocked node. Clearing a
+ * depth-2-or-deeper block requires resuming EVERY blocked run in the chain,
+ * deepest first, then re-running only the root — see "Recovering a blocked
+ * child" in docs/guides/run-workflows.md and "Blocked-child recovery" in
+ * docs/reference/workflow-schema.md for the worked multi-level sequence.
+ * `resume.then` is deliberately not widened to enumerate that chain (no
+ * envelope change, no new field) — the docs carry the multi-level sequence
+ * instead.
+ *
+ * Absent, never `[]`, when `forRunId` has no children (P3a's `childRunsOf`
+ * order: `created_at, id`).
+ */
+function childRunTree(repo, rootRunId, forRunId) {
+    const rows = repo.childRunsOf(forRunId);
+    if (rows.length === 0)
+        return undefined;
+    return rows.map((row) => toChildRunNode(repo, rootRunId, row));
+}
+function toChildRunNode(repo, rootRunId, row) {
+    const spawnedByUnitId = row.parent_unit_id ?? "";
+    // B-36: the parent STEP that spawned it, resolved via the real journaled
+    // unit row — null when that unit row is gone.
+    const stepId = row.parent_run_id && row.parent_unit_id
+        ? (repo.getUnit(row.parent_run_id, row.parent_unit_id)?.step_id ?? null)
+        : null;
+    const children = childRunTree(repo, rootRunId, row.id);
+    return {
+        runId: row.id,
+        workflowRef: row.workflow_ref,
+        workflowTitle: row.workflow_title,
+        status: row.status,
+        spawnedByUnitId,
+        stepId,
+        currentStepId: row.current_step_id,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+        ...(row.status === "blocked"
+            ? {
+                resume: {
+                    command: `akm workflow resume ${row.id}`,
+                    // biome-ignore lint/suspicious/noThenProperty: mirrors spec §4.5's real WorkflowChildRunNode.resume.then field name
+                    then: `akm workflow resume ${rootRunId} && akm workflow run ${rootRunId}`,
+                },
+            }
+            : {}),
+        ...(children ? { children } : {}),
     };
 }
 function toWorkflowRunSummary(run) {
@@ -738,6 +837,12 @@ function toWorkflowRunSummary(run) {
         ...(run.engine_lease_holder && run.engine_lease_until
             ? { engineLease: { holder: run.engine_lease_holder, until: run.engine_lease_until } }
             : {}),
+        // P3b (spec §4.5): all three optional and conditionally spread, so every
+        // pre-existing (non-child, no-outputs-declared) run's envelope is
+        // byte-identical (Stable tier, rows B-27, B-45).
+        ...(run.outputs_json ? { outputs: parseJsonObject(run.outputs_json) ?? {} } : {}),
+        ...(run.parent_run_id ? { parentRunId: run.parent_run_id } : {}),
+        ...(run.parent_unit_id ? { spawnedByUnitId: run.parent_unit_id } : {}),
     };
 }
 /**

package/dist/workflows/runtime/workflow-asset-loader.js

@@ -5,7 +5,7 @@ import fs from "node:fs";
 import { detectAdapterId } from "../../core/adapter/detect-adapter.js";
 import { makeBundleRef, parseBundleRef } from "../../core/asset/asset-ref.js";
 import { loadConfig } from "../../core/config/config.js";
-import { NotFoundError, UsageError } from "../../core/errors.js";
+import { COMPOSITION_INVALID_MULTI_JOB_HINT, NotFoundError, UsageError } from "../../core/errors.js";
 import { getDbPath } from "../../core/paths.js";
 import { canonicalizeWorkflowName } from "../../core/recognition-util.js";
 import { deriveInstallations } from "../../indexer/installations.js";
@@ -24,10 +24,10 @@ export function canonicalWorkflowRunRef(bundle, canonicalName) {
 export function parseWorkflowRefInput(ref) {
     const parsed = parseBundleRef(ref.trim());
     if (parsed.fragment !== undefined) {
-        throw new UsageError(`Export fragment "#${parsed.fragment}" is not accepted in a workflow ref.`, "INVALID_FLAG_VALUE");
+        throw new UsageError(`Export fragment "#${parsed.fragment}" is not accepted in a workflow ref.`, "TARGET_REF_INVALID");
     }
     if (parsed.conceptId.startsWith("workflow:")) {
-        throw new UsageError(`Invalid workflow ref "${ref.trim()}". Use [bundle//]conceptId, such as workflows/release.`, "INVALID_FLAG_VALUE");
+        throw new UsageError(`Invalid workflow ref "${ref.trim()}". Use [bundle//]conceptId, such as workflows/release.`, "TARGET_REF_INVALID");
     }
     return parsed;
 }
@@ -50,7 +50,7 @@ export async function loadWorkflowAsset(ref) {
         return [{ source, bundleId }];
     });
     if (bundleRef.bundle && searchSources.length === 0) {
-        throw new UsageError(`Bundle "${bundleRef.bundle}" was not found among configured sources.`, "INVALID_FLAG_VALUE");
+        throw new UsageError(`Bundle "${bundleRef.bundle}" was not found among configured sources.`, "WORKFLOW_SOURCE_INVALID");
     }
     let assetPath;
     let sourcePath;
@@ -80,7 +80,7 @@ export async function loadWorkflowAsset(ref) {
         if (rejectedSource) {
             const sourceName = rejectedSource.bundleId;
             const adapterId = rejectedSource.source.adapterId ?? "unassigned";
-            throw new UsageError(`Bundle "${sourceName}" uses adapter "${adapterId}", which does not support native workflow execution.`, "INVALID_FLAG_VALUE");
+            throw new UsageError(`Bundle "${sourceName}" uses adapter "${adapterId}", which does not support native workflow execution.`, "WORKFLOW_SOURCE_INVALID");
         }
         throw new NotFoundError(`Workflow not found for ref: ${ref}`);
     }
@@ -124,8 +124,16 @@ function compileWorkflowSourceFromDisk(assetPath, workspaceRoot) {
     const content = fs.readFileSync(assetPath, "utf8");
     const result = compileWorkflowSource(content, { path: assetPath, workspaceRoot });
     if (!result.ok) {
+        // P4-N2's mapping (docs/plans/specs/p4-deletions-closeout.md §3.3.4): this
+        // is the FIRST compile of a workflow's own source that a ref resolves
+        // through (loadWorkflowAsset runs before compileResolveFreezeWorkflowV4),
+        // so it must apply the same code split as the freeze wrapper — otherwise
+        // row B-44's COMPOSITION_INVALID promise never reaches `startWorkflowRun`
+        // callers, which never get past this point on a multi-job source.
         const details = result.errors.map((error) => `  ${error.path}:${error.line} — ${error.message}`).join("\n");
-        throw new UsageError(`Workflow source has ${result.errors.length} error(s):\n${details}`);
+        const isMultiJob = result.errors.length === 1 && result.errors[0]?.code === "multi-job-unsupported";
+        const code = isMultiJob ? "COMPOSITION_INVALID" : "WORKFLOW_SOURCE_INVALID";
+        throw new UsageError(`Workflow source has ${result.errors.length} error(s):\n${details}`, code, isMultiJob ? COMPOSITION_INVALID_MULTI_JOB_HINT : undefined);
     }
     return result.ir;
 }

package/dist/workflows/source-files.js

@@ -40,7 +40,7 @@ export class WorkflowSourceDomainError extends WorkflowSourceRejectionError {
         const sortedCollisions = [...collidingSourcePaths].sort(comparePaths);
         const code = issues.some((issue) => issue.code === "PATH_ESCAPE_VIOLATION")
             ? "PATH_ESCAPE_VIOLATION"
-            : "INVALID_FLAG_VALUE";
+            : "WORKFLOW_SOURCE_INVALID";
         const collisionDetail = sortedCollisions.length > 1 ? ` Valid owners also collide: ${sortedCollisions.join(", ")}.` : "";
         super(`Workflow "${canonicalName}" has an invalid source ownership domain across candidates: ${sortedPaths.join(", ")}. ` +
             `Problems: ${issues.map((issue) => issue.message).join(" ")}${collisionDetail} ` +
@@ -53,7 +53,7 @@ export class WorkflowSourceDomainError extends WorkflowSourceRejectionError {
 export class WorkflowSourceIdentityError extends UsageError {
     constructor(ref, indexedPath, authoritativePath) {
         super(`Indexed workflow source identity for "${ref}" points to ${indexedPath}, but the authoritative source is ${authoritativePath}. ` +
-            "Refusing the stale index/cache identity; run `akm index --full` to reconcile it.", "INVALID_FLAG_VALUE");
+            "Refusing the stale index/cache identity; run `akm index --full` to reconcile it.", "WORKFLOW_SOURCE_INVALID");
         this.name = "WorkflowSourceIdentityError";
         Object.setPrototypeOf(this, new.target.prototype);
     }
@@ -61,7 +61,7 @@ export class WorkflowSourceIdentityError extends UsageError {
 export class WorkflowSourceNameError extends WorkflowSourceRejectionError {
     constructor(sourcePath, nestedSuffix) {
         super(`Workflow source filename ${sourcePath} has an extensionless stem ending in recognized workflow suffix "${nestedSuffix}". ` +
-            "Nested workflow suffixes are invalid; remove the inner .md or .yml suffix instead of relying on repeated stripping.", "INVALID_FLAG_VALUE", [sourcePath]);
+            "Nested workflow suffixes are invalid; remove the inner .md or .yml suffix instead of relying on repeated stripping.", "WORKFLOW_SOURCE_INVALID", [sourcePath]);
         this.name = "WorkflowSourceNameError";
         Object.setPrototypeOf(this, new.target.prototype);
     }
@@ -69,14 +69,14 @@ export class WorkflowSourceNameError extends WorkflowSourceRejectionError {
 export class WorkflowSourceLinkIdentityError extends WorkflowSourceRejectionError {
     constructor(sourcePath, targetPath) {
         super(`Workflow source ${sourcePath} resolves through a symlink to ${targetPath} with a different source format. ` +
-            "The authored workflow path and resolved source must use the same .md or .yml format.", "INVALID_FLAG_VALUE", [sourcePath]);
+            "The authored workflow path and resolved source must use the same .md or .yml format.", "WORKFLOW_SOURCE_INVALID", [sourcePath]);
         this.name = "WorkflowSourceLinkIdentityError";
         Object.setPrototypeOf(this, new.target.prototype);
     }
 }
 export class WorkflowSourceLinkResolutionError extends WorkflowSourceRejectionError {
     constructor(sourcePath) {
-        super(`Workflow source symlink ${sourcePath} cannot be resolved to a regular file.`, "INVALID_FLAG_VALUE", [
+        super(`Workflow source symlink ${sourcePath} cannot be resolved to a regular file.`, "WORKFLOW_SOURCE_INVALID", [
             sourcePath,
         ]);
         this.name = "WorkflowSourceLinkResolutionError";

package/dist/workflows/source-ir/compare.js

@@ -0,0 +1,17 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * Locale-independent code-point ordering, shared by the workflow source-IR
+ * lane (job `needs` canonicalization) and `akm lint` (name sorting).
+ *
+ * Split out of the deleted `source-ir/ordering.ts` (P4 §3.3, docs/plans/specs/
+ * p4-deletions-closeout.md): that file's other export,
+ * `canonicalTopologicalJobs`, existed only to order MULTIPLE ready jobs —
+ * moot once the adapter confines a workflow source to exactly one job. This
+ * comparator has an unrelated consumer (`src/commands/lint/index.ts`) and
+ * survives on its own.
+ */
+export function compareWorkflowSourceCodePoints(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}

package/dist/workflows/source-ir/compile.js

@@ -3,13 +3,14 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import path from "node:path";
 import { parseFrontmatterBlock } from "../../core/asset/frontmatter.js";
-import { classifyTaskV3Triggers, classifyTaskV3Uses } from "../../tasks/source-v3.js";
 import { parseWorkflow } from "../parser.js";
 import { projectExecCore } from "../program/schema.js";
 import { parseGithubWorkflowSource } from "./github-yaml.js";
 import { sourceFailureResult, WorkflowSourceFailure } from "./result.js";
 import { decodeWorkflowSourceIrV1, } from "./schema.js";
 import { canonicalizeWorkflowWorkingDirectory, WorkflowSourceSemanticError } from "./semantics.js";
+import { classifyWorkflowYamlTriggers } from "./triggers.js";
+import { classifyWorkflowSourceUses } from "./uses.js";
 export { looksLikeGithubWorkflowSource } from "./github-yaml.js";
 export function compileGithubWorkflowSource(source, options) {
     try {
@@ -17,8 +18,8 @@ export function compileGithubWorkflowSource(source, options) {
             ok: true,
             ir: decodeWorkflowSourceIrV1(parseGithubWorkflowSource(source, {
                 ...options,
-                classifyUses: options.classifyUses ?? classifyTaskV3Uses,
-                classifyTriggers: options.classifyTriggers ?? classifyTaskV3Triggers,
+                classifyUses: options.classifyUses ?? classifyWorkflowSourceUses,
+                classifyTriggers: options.classifyTriggers ?? classifyWorkflowYamlTriggers,
             }), {
                 workspaceRoot: options.workspaceRoot,
             }),
@@ -67,6 +68,9 @@ export function compileMarkdownWorkflowSource(source, options) {
             ...(parsed.document.description ? { description: parsed.document.description } : {}),
             ...(parsed.document.tags ? { tags: [...parsed.document.tags] } : {}),
             ...(parsed.document.params ? { params: jsonClone(parsed.document.params) } : {}),
+            ...(parsed.document.outputs
+                ? { outputs: jsonClone(parsed.document.outputs) }
+                : {}),
             ...(parsed.document.defaults
                 ? { defaults: jsonClone(parsed.document.defaults) }
                 : {}),

package/dist/workflows/source-ir/github-yaml.js

@@ -3,7 +3,6 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { isAlias, isMap, isScalar, isSeq, LineCounter, parseDocument } from "yaml";
 import { utf8Bytes, WORKFLOW_MAX_SOURCE_BYTES } from "../resource-limits.js";
-import { canonicalTopologicalJobs } from "./ordering.js";
 import { WorkflowSourceFailure } from "./result.js";
 import { WORKFLOW_SOURCE_HOST_SHELLS, } from "./schema.js";
 import { canonicalizeWorkflowCron, canonicalizeWorkflowRun, canonicalizeWorkflowWorkingDirectory, classifyWorkflowStepUses, validateWorkflowBuiltinCommand, WorkflowSourceSemanticError, } from "./semantics.js";
@@ -387,7 +386,7 @@ function verifyOwnerTriggerPlan(reader, root, onNode, triggers, options) {
                 binding.source === `on.schedule[${expected.ordinal}].cron`);
         });
     if (!matches) {
-        throw new WorkflowSourceFailure("trigger-classifier-drift", "The workflow trigger parser disagrees with the canonical task-v3 trigger classifier.", reader.span(onNode));
+        throw new WorkflowSourceFailure("trigger-classifier-drift", "The workflow trigger parser disagrees with the canonical workflow YAML trigger classifier.", reader.span(onNode));
     }
 }
 function validateCron(reader, cron, node) {
@@ -398,19 +397,34 @@ function validateCron(reader, cron, node) {
         semanticReaderFail(reader, cause, node);
     }
 }
+/**
+ * The ONE place a job-count or job-dependency policy is enforced (P4 §3.3,
+ * docs/plans/specs/p4-deletions-closeout.md): AKM's YAML adapter accepts a
+ * familiar GitHub-step-shaped `name:`/`on:`/`jobs:` document, but requires
+ * exactly one job (brief §10) — it is an AKM workflow format executed by
+ * AKM's native engine, not a GitHub Actions graph. Job ordering, dependency
+ * validation and the 256-job bound all existed only to support MULTIPLE
+ * jobs; they are gone with the machinery, not relocated.
+ */
 function parseJobs(reader, node, options) {
     const fields = reader.arbitraryFields(node, "workflow.jobs");
-    if (fields.size === 0 || fields.size > 256) {
-        reader.fail("job-count-limit", "workflow.jobs must contain 1 through 256 jobs.", node);
-    }
-    const jobs = [...fields.entries()].map(([id, pair]) => parseJob(reader, id, pair, options));
-    const ordered = canonicalTopologicalJobs(jobs);
-    if (ordered.ok)
-        return ordered.jobs;
-    if (ordered.kind === "missing") {
-        throw new WorkflowSourceFailure("missing-job-dependency", `Job ${ordered.job.id} needs missing job ${ordered.dependency}.`, ordered.job.source);
-    }
-    throw new WorkflowSourceFailure("job-dependency-cycle", "Workflow jobs contain a dependency cycle.", ordered.job.source);
+    let first;
+    let second;
+    for (const entry of fields) {
+        if (!first)
+            first = entry;
+        else if (!second)
+            second = entry;
+    }
+    if (fields.size !== 1 || !first) {
+        reader.fail("multi-job-unsupported", `AKM workflow YAML requires exactly one job; this document declares ${fields.size}. AKM's YAML is an AKM workflow format executed by AKM's native engine, not GitHub Actions — split the jobs into separate workflows.`, second ? second[1].key : node);
+    }
+    const [id, pair] = first;
+    const job = parseJob(reader, id, pair, options);
+    if (job.needs.length > 0) {
+        reader.fail("multi-job-unsupported", `Job ${job.id} declares needs, but an AKM workflow has exactly one job; remove needs.`, pair.key);
+    }
+    return [job];
 }
 function parseJob(reader, id, pair, options) {
     const node = pair.value;
@@ -450,9 +464,10 @@ function parseNeeds(reader, pair, jobId) {
     for (const need of values)
         if (!SOURCE_ID.test(need))
             reader.fail("invalid-job-id", `Invalid needs id ${need}.`, pair.value);
-    if (new Set(values).size !== values.length) {
-        reader.fail("duplicate-job-dependency", `Job ${jobId} has duplicate needs entries.`, pair.value);
-    }
+    // Duplicate-entry checking (code duplicate-job-dependency) deleted with the
+    // rest of the multi-job dependency machinery (P4 §3.3): ANY non-empty
+    // needs — duplicated or not — is multi-job-unsupported at the caller
+    // (parseJobs), since a single-job workflow has nothing to depend on.
     return values.sort();
 }
 function parseStep(reader, node, jobId, index, stepIds, options) {
@@ -487,7 +502,18 @@ function parseUsesStep(reader, usesPair, fields, options, common) {
     }
     const uses = reader.string(usesPair.value, "step.uses");
     const target = classifyUses(reader, uses, usesPair.value, options.classifyUses ?? classifyWorkflowSourceUses);
-    const withValues = parseScalarMap(reader, fields.get("with"), "step.with", INPUT_KEY, true);
+    // A-N3 (P2b, docs/plans/specs/p2b-input-bindings.md §1.7), widened in P3a
+    // (docs/plans/specs/p3a-plan-v5-child-freeze.md §4.2 step 7, row B-10) to
+    // ALSO cover a workflows/<ref> target: a tasks/<ref> or workflows/<ref>
+    // step's with: may bind any JSON value the composed target's declared
+    // input/param needs (an object/array literal, or a {from: "..."}
+    // reference) — decoding it through the scalar-only parseScalarMap would
+    // reject the very shapes both A-N3 and A-N8 exist to accept before
+    // decodeWorkflowSourceIrV1 (schema.ts) is ever reached. Every other target
+    // keeps the byte-identical scalar-only grammar.
+    const withValues = target.kind === "task" || target.kind === "workflow"
+        ? parsePlainMap(reader, fields.get("with"), "step.with", INPUT_KEY)
+        : parseScalarMap(reader, fields.get("with"), "step.with", INPUT_KEY, true);
     const commandMode = target.kind === "builtin-command"
         ? validateBuiltinCommand(reader, withValues, fields.get("with")?.value ?? usesPair.value)
         : undefined;
@@ -560,6 +586,27 @@ function parseScalarMap(reader, pair, context, keyPattern, allowNull) {
     }
     return out;
 }
+/**
+ * Like {@link parseScalarMap} but accepts an arbitrary JSON value per key —
+ * a task-composition with: binding may be the declared input's own shape (an
+ * object/array literal, or a `{from: "..."}` reference), not just a scalar
+ * (A-N3). Depth/node bounds are already enforced document-wide by
+ * `checkTree`/`rejectAliases` before any field-level parsing runs, so this
+ * adds no new bound. `decodeWorkflowSourceIrV1` (schema.ts) decides what a
+ * declared input actually accepts.
+ */
+function parsePlainMap(reader, pair, context, keyPattern) {
+    if (!pair)
+        return undefined;
+    const fields = reader.arbitraryFields(pair.value, context);
+    const out = {};
+    for (const [key, valuePair] of fields) {
+        if (!keyPattern.test(key))
+            reader.fail("invalid-mapping-key", `${context} has invalid key ${JSON.stringify(key)}.`, valuePair.key);
+        out[key] = reader.plain(valuePair.value, `${context}.${key}`);
+    }
+    return out;
+}
 function wholeSourceSpan(source, filePath) {
     return { path: filePath, start: 1, end: Math.max(1, source.split(/\r?\n/).length) };
 }