akm-cli 0.9.31 → 0.10.261002-beta

package/dist/workflows/exec/step-work.js

@@ -109,11 +109,10 @@ function resolveTaskInputBindings(bindings, stepId, scope) {
  */
 export function computeStepWorkList(plan, input) {
     const root = plan.root;
-    // Route-only steps (YAML `route:`) carry no execution subgraph.
     if (!root) {
         return {
             ok: false,
-            error: `Step "${plan.stepId}" has no execution subgraph (a route-only step); the native executor cannot dispatch it.`,
+            error: `Step "${plan.stepId}" has no execution subgraph; the native executor cannot dispatch it.`,
         };
     }
     const template = root.kind === "map" ? root.template : root;
@@ -121,7 +120,7 @@ export function computeStepWorkList(plan, input) {
     const scope = { params: input.params, stepOutputs: input.stepOutputs };
     // Instructions are ALWAYS the step's body prose, byte-exact — never
     // templated, never scanned for reference syntax (workflow-format-
-    // unification, spec §2.3). Only `map.over` / `route.input` / `inputs[]`
+    // unification, spec §2.3). Only `map.over` / `inputs[]`
     // carry the closed reference grammar.
     // Resolve the step's declared `inputs:` ONCE (shared by every unit in this
     // step — map items differ, declared inputs do not): prior-step artifacts
@@ -177,7 +176,7 @@ export function computeStepWorkList(plan, input) {
         : [unitIdFor(template.id, undefined, false, true)];
     const gateLoop = input.gateLoop ?? 1;
     const target = template.frozenTarget;
-    const frozenExec = target.kind === "shell" || target.kind === "script" ? target.exec : undefined;
+    const frozenExec = target.kind === "shell" ? target.exec : undefined;
     const runner = target.kind === "command" ? target.runner.kind : "exec";
     // Taken verbatim from the frozen plan, resolved once at freeze (an exec
     // unit's on its exec spec). A frozen `null` means genuinely unbounded
@@ -271,7 +270,6 @@ function buildStepWorkUnit(ctx, unitId, item, index) {
         ...(template.schema ? { schema: template.schema } : {}),
         ...(template.retry ? { retry: template.retry } : {}),
         onError: template.onError,
-        ...(template.isolation ? { isolation: template.isolation } : {}),
         // the SAME resolved `with:` bindings `taskInputs` already
         // carries, exposed under the name `child-workflow.ts`'s drive contract
         // reads. Absent (never `{}`) when the step binds nothing.
@@ -330,7 +328,8 @@ function computeUnitInputHash(ctx, item) {
         frozenTarget: ctx.target,
         environment: ctx.template.environment,
         schema: ctx.template.schema ?? null,
-        isolation: ctx.template.isolation ?? "none",
+        // Retired `isolation: worktree` field; kept constant so in-flight runs keep their journaled input hashes.
+        isolation: "none",
         ...(ctx.taskInputs !== undefined ? { taskInputs: ctx.taskInputs } : {}),
         ...(ctx.input.gateFeedback ? { gateFeedback: ctx.input.gateFeedback } : {}),
     }))
@@ -422,7 +421,7 @@ function stepTemplate(stepPlan) {
 }
 /**
  * The step ids another step can still read (named by `inputs[]`, `map.over`,
- * or `route.input` — the whole reference surface). A step outside this set
+ * — the whole reference surface). A step outside this set
  * need not keep its artifact in memory once journaled. Derived from the plan alone.
  */
 export function referencedStepIds(plan) {
@@ -437,8 +436,6 @@ export function referencedStepIds(plan) {
             note(step.root.over);
         for (const reference of stepTemplate(step)?.inputs ?? [])
             note(reference);
-        if (step.route)
-            note(step.route.input);
     }
     return referenced;
 }
@@ -830,148 +827,6 @@ export async function journalGateEvaluationFinish(gate, errored, rejection) {
         throw new UsageError(`Gate ${unitId} was already finished; refusing a duplicate terminal write.`);
     }
 }
-/**
- * Resolve a route's input (a single whole-value reference string — `params.x` or
- * `steps.<id>.output…`, with no `${{ }}` delimiters) and pick the branch. No
- * ambient key search. Only primitive values route; the comparison is exact
- * string equality against the declared `when:` matches.
- */
-export function evaluateRoute(route, scope) {
-    const resolved = resolveStepReference(route.input, scope);
-    if (!resolved.ok) {
-        return { ok: false, error: `route input ${route.input} failed to resolve: ${resolved.error.message}` };
-    }
-    const value = resolved.value;
-    if (typeof value === "object" && value !== null) {
-        return {
-            ok: false,
-            error: `route input ${route.input} resolved to a non-primitive value; branches match on strings/numbers/booleans.`,
-        };
-    }
-    const valueString = typeof value === "string" ? value : String(value);
-    // Own-property check: `when` is author-controlled, and a value such as
-    // "constructor" must not resolve through Object.prototype.
-    const selected = Object.hasOwn(route.when, valueString) ? route.when[valueString] : route.defaultStepId;
-    if (!selected) {
-        return {
-            ok: false,
-            error: `value "${valueString}" matched no "when:" branch and the route declares no default.`,
-        };
-    }
-    return { ok: true, value: valueString, selected };
-}
-/**
- * Cascade a SKIPPED router: it never evaluated its route, so every declared
- * target (branches + default) is marked skip-on-reach unless an earlier router
- * already claimed it. Shared by the live skip path and the journal replay.
- */
-export function cascadeSkippedRouter(route, routerId, routeUnselected) {
-    const targets = [...Object.values(route.when), ...(route.defaultStepId ? [route.defaultStepId] : [])];
-    for (const target of targets) {
-        if (!routeUnselected.has(target)) {
-            routeUnselected.set(target, { router: routerId, selected: null });
-        }
-    }
-}
-/**
- * Record one router's decision in the skip bookkeeping: the selected target is
- * protected, every other declared target (branches + default) is marked
- * skip-on-reach unless an earlier router already claimed it. Shared by the live
- * evaluation path and the journal replay.
- */
-export function applyRouteDecision(route, routerId, selected, routeSelected, routeUnselected) {
-    routeSelected.add(selected);
-    const targets = [...Object.values(route.when), ...(route.defaultStepId ? [route.defaultStepId] : [])];
-    for (const target of targets) {
-        if (target !== selected && !routeUnselected.has(target)) {
-            routeUnselected.set(target, { router: routerId, selected });
-        }
-    }
-}
-/**
- * The `stepOutputs` scope a route resolves against: every prior step's recorded
- * evidence plus the just-finished step's fresh evidence — each projected
- * through {@link projectStepOutput}. Same projection as unit templates, so the
- * two scopes cannot drift.
- */
-export function routeStepOutputs(evidence, currentStepId, currentEvidence) {
-    const outputs = {};
-    for (const [stepId, stepEvidence] of Object.entries(evidence)) {
-        if (stepEvidence !== undefined)
-            outputs[stepId] = projectStepOutput(stepEvidence);
-    }
-    outputs[currentStepId] = projectStepOutput(currentEvidence);
-    return outputs;
-}
-/** The `selected` target journaled on a route step's evidence, if well-formed. */
-function journaledRouteSelection(evidence) {
-    const route = evidence?.route;
-    if (typeof route !== "object" || route === null || Array.isArray(route))
-        return undefined;
-    const selected = route.selected;
-    return typeof selected === "string" && selected !== "" ? selected : undefined;
-}
-/** The set of steps a route may legally select: its `when` branches + default. */
-function routeTargets(route) {
-    return new Set([...Object.values(route.when), ...(route.defaultStepId ? [route.defaultStepId] : [])]);
-}
-/** A journaled route decision must name a target the route declares; anything else fails loudly. */
-function assertRouteTargetDeclared(route, stepId, selected, runId) {
-    const targets = routeTargets(route);
-    if (!targets.has(selected)) {
-        throw new UsageError(`Workflow run ${runId} has a completed route step "${stepId}" whose journaled route decision selected ` +
-            `"${selected}", which is not a declared branch or default target of the route (valid targets: ` +
-            `${[...targets].join(", ") || "(none)"}). The route evidence was corrupted or manually edited — refusing to ` +
-            `apply a bogus route decision that would skip the real branch targets. Start a new run.`);
-    }
-}
-/**
- * Replay journaled route decisions into the skip bookkeeping (resume path).
- * For every COMPLETED route step of the frozen plan, in spine order: the
- * journaled decision wins; else a re-derivation from the frozen plan +
- * journaled evidence; else fail loudly. A SKIPPED route step cascades its
- * targets into the skip set exactly as on the live path.
- */
-export function seedJournaledRouteDecisions(plan, state, routeSelected, routeUnselected) {
-    const evidence = {};
-    for (const s of state.workflow.steps)
-        evidence[s.id] = s.evidence;
-    for (const stepPlan of plan.steps) {
-        if (!stepPlan.route)
-            continue;
-        const stepState = state.workflow.steps.find((s) => s.id === stepPlan.stepId);
-        if (!stepState)
-            continue;
-        if (stepState.status === "skipped") {
-            cascadeSkippedRouter(stepPlan.route, stepPlan.stepId, routeUnselected);
-            continue;
-        }
-        if (stepState.status !== "completed")
-            continue;
-        let selected = journaledRouteSelection(stepState.evidence);
-        if (selected !== undefined) {
-            // a stored decision must name a declared target — a bogus one
-            // (tampered/hand-edited evidence) fails loudly rather than seeding a skip
-            // set that buries the real branches.
-            assertRouteTargetDeclared(stepPlan.route, stepPlan.stepId, selected, state.run.id);
-        }
-        if (selected === undefined) {
-            const scope = {
-                params: state.run.params ?? {},
-                stepOutputs: routeStepOutputs(evidence, stepPlan.stepId, stepState.evidence ?? {}),
-            };
-            const decision = evaluateRoute(stepPlan.route, scope);
-            if (decision.ok)
-                selected = decision.selected;
-        }
-        if (selected === undefined) {
-            throw new UsageError(`Workflow run ${state.run.id} has a completed route step "${stepPlan.stepId}" with no journaled route ` +
-                `decision, and the decision cannot be re-derived from the journaled evidence. Refusing to guess which ` +
-                `branch was selected. The run journal is inconsistent; abandon this run and start a new one.`);
-        }
-        applyRouteDecision(stepPlan.route, stepPlan.stepId, selected, routeSelected, routeUnselected);
-    }
-}
 /**
  * The blocked-step notes for a verifier-infrastructure failure (bug: judge
  * outage must not burn the gate budget). Shared by every judge-failure path —
@@ -1050,8 +905,6 @@ async function blockFinalizedStepForChildWorkflow(input, childBlocked) {
  * Perform one completion attempt for an executed step:
  *  - a hard unit failure fails the step (a retryable artifact-schema mismatch
  *    with loops left returns `retry` without a gate row);
- *  - a route decision is evaluated, journaled on the evidence, and applied to
- *    the skip bookkeeping; an unroutable value fails the step;
  *  - the gate judges a summary built from the promoted artifact: a rejection
  *    returns `retry` (loops left) or `gate-exhausted`, a pass `advanced`;
  *  - a judge infrastructure failure is not a verdict: it blocks the step for
@@ -1093,34 +946,12 @@ export async function finalizeExecutedStep(input) {
         return blockFinalizedStep(input, "this step declares completion criteria but no verification judge is available " +
             "(the frozen plan resolves no judge — set workflow.judgeEngine, or restore the judge configuration)");
     }
-    // Route evaluation BEFORE completion: an unroutable value is an
-    // authoring/config failure that must fail the step deterministically.
-    let summaryOverride;
-    if (stepPlan.route) {
-        const scope = {
-            params: input.params,
-            stepOutputs: routeStepOutputs(input.priorEvidence, stepId, result.evidence),
-        };
-        const decision = evaluateRoute(stepPlan.route, scope);
-        if (!decision.ok) {
-            const notes = `Step "${stepId}" route failed: ${decision.error}`;
-            await completeWorkflowStep({ runId, stepId, status: "failed", notes, evidence: result.evidence });
-            return { kind: "failed", summary: notes, routeFailure: true };
-        }
-        applyRouteDecision(stepPlan.route, stepId, decision.selected, input.routeSelected, input.routeUnselected);
-        // Journal the decision on the evidence: resume replays it via
-        // seedJournaledRouteDecisions, so the skip set survives re-invocation.
-        result.evidence.route = { input: stepPlan.route.input, value: decision.value, selected: decision.selected };
-        if (!stepPlan.root) {
-            summaryOverride = `Step "${stepId}" routed on ${stepPlan.route.input}: value "${decision.value}" selected step "${decision.selected}".`;
-        }
-    }
     // Artifact-judging gate: a criteria-bearing executing step is judged on a
     // summary BUILT FROM the promoted artifact; everything else keeps the machine
-    // summary (a route-only step's summary IS its decision).
+    // summary.
     const summary = stepPlan.root && completionCriteria.length > 0
         ? buildArtifactSummary(stepId, result.units, result.evidence)
-        : (summaryOverride ?? result.summary);
+        : result.summary;
     // Journal engine-driven judge calls as unit rows. With no criteria there is
     // no judge invocation or row; a criteria-bearing plan without a judge is a
     // configuration error rather than a silent bypass.
@@ -1233,7 +1064,7 @@ export async function finalizeExecutedStep(input) {
         return blockFinalizedStep(input, judgeFailure ?? "the verification judge failed");
     }
     if (!rejection) {
-        return { kind: "advanced", ...(summaryOverride !== undefined ? { summaryOverride } : {}) };
+        return { kind: "advanced" };
     }
     if (loopsRemaining) {
         return { kind: "retry", gateFeedback: { feedback: rejection.feedback, missing: rejection.missing } };

package/dist/workflows/exec/unit-dispatch.js

@@ -73,16 +73,6 @@ export async function dispatchWorkflowExecution(request, feedback) {
             ...(notices ? { notices } : {}),
         };
     }
-    if (request.cwd && lowered.runner.kind === "llm") {
-        return {
-            ok: false,
-            text: "",
-            failureReason: "isolation_unsupported",
-            error: `unit ${JSON.stringify(request.unitId)} declares isolation: worktree but resolved to the "llm" runner, ` +
-                `which has no working directory to isolate. Use the agent or sdk runner for isolated units.`,
-            ...(notices ? { notices } : {}),
-        };
-    }
     let result;
     try {
         const eventSource = forwardedDispatchEventSource(request);

package/dist/workflows/freeze/environment.js

@@ -12,23 +12,13 @@ import { UsageError } from "../../core/errors.js";
 import { deriveInstallations } from "../../indexer/installations.js";
 import { resolveSourceEntries } from "../../indexer/search/search-source.js";
 import { resolveAssetPath } from "../../sources/resolve.js";
-import { isInferredSecretName } from "../../tasks/log-redaction.js";
 import { SECRET_TOKEN_RE } from "../exec/environment.js";
-import { detectSecretShapedParams } from "../exec/param-secrets.js";
 /**
- * A step's frozen environment: literal `env:` values, `pass_env` names, then
+ * A step's frozen environment: `pass_env` names, then
  * one value-free descriptor per `unit.env` ref (owner, key set, secret-token
  * names). Values are read at dispatch (`exec/environment.ts`), never frozen.
  */
 export function freezeEnvironment(source, exec, context) {
-    const literals = Object.entries(source.env ?? {}).map(([name, raw]) => {
-        const value = String(raw);
-        // A literal is frozen into plan_json; a credential belongs in an env ref, as for task env.
-        if (isInferredSecretName(name) || detectSecretShapedParams({ [name]: value }).length > 0) {
-            throw new UsageError(`Workflow step ${source.id} env.${name} is a secret-shaped literal env value. Store credentials in an env asset (unit.env) rather than workflow source.`, "WORKFLOW_SOURCE_INVALID");
-        }
-        return Object.freeze({ kind: "literal", name, value });
-    });
     const passThrough = (exec?.passEnv ?? []).map((name) => Object.freeze({ kind: "pass-through", name }));
     const seen = new Set();
     const envRefs = [];
@@ -62,7 +52,7 @@ export function freezeEnvironment(source, exec, context) {
             precedence,
         }));
     }
-    return [...literals, ...passThrough, ...envRefs];
+    return [...passThrough, ...envRefs];
 }
 /** Load a command or persona the workflow names, resolved through the workflow's own bundles. */
 export async function workflowExecutionSource(ref, kind, context) {
@@ -143,39 +133,8 @@ function configuredOwner(bundle, config) {
         adapter: component?.adapter ?? "akm",
     };
 }
-const SCRIPT_EXTENSIONS = [
-    "",
-    ".sh",
-    ".ts",
-    ".js",
-    ".py",
-    ".rb",
-    ".go",
-    ".pl",
-    ".php",
-    ".lua",
-    ".r",
-    ".swift",
-    ".kt",
-    ".kts",
-    ".ps1",
-    ".cmd",
-    ".bat",
-];
 function assetExtensions(type) {
-    if (type === "script")
-        return SCRIPT_EXTENSIONS;
     if (type === "env")
         return ["", ".env"];
-    return ["", ".md", ".yml"];
-}
-export function qualifyRef(ref, plural, asset, config) {
-    const parsed = parseBundleRef(ref);
-    if (parsed.bundle)
-        return ref;
-    const bundle = parseBundleRef(asset.ref).bundle ?? config.defaultBundle;
-    if (!bundle)
-        throw new UsageError(`Workflow ref ${ref} has no owning bundle.`, "WORKFLOW_SOURCE_INVALID");
-    const concept = parsed.conceptId.startsWith(`${plural}/`) ? parsed.conceptId : `${plural}/${parsed.conceptId}`;
-    return makeBundleRef(bundle, concept);
+    return ["", ".md"];
 }

package/dist/workflows/freeze/freeze.js

@@ -17,15 +17,10 @@ import { checkWorkflowPlan } from "../compile.js";
 import { defaultMapConcurrency, workflowMaxConcurrency } from "../concurrency-policy.js";
 import { canonicalJson } from "../ir/plan-hash.js";
 import { WORKFLOW_PLAN_VERSION, } from "../plan.js";
-import { classifyWorkflowStepUses } from "../source-semantics.js";
-import { assertChildOutputReferences } from "./child-output-references.js";
-import { qualifyRef } from "./environment.js";
 import { baseUnitOf } from "./step-values.js";
 import { childWorkflowDispatch } from "./targets/child-workflow.js";
 import { commandDispatch, commandResult } from "./targets/command.js";
-import { directScript } from "./targets/script.js";
 import { directShell } from "./targets/shell.js";
-import { taskDispatch } from "./targets/task.js";
 /** Resolve and freeze one workflow (and, recursively, every child it composes). */
 export async function freezeWorkflow(asset, config, refPath = [asset.ref]) {
     const compiled = asset.plan;
@@ -45,12 +40,9 @@ export async function freezeWorkflow(asset, config, refPath = [asset.ref]) {
     for (const step of compiled.steps) {
         const { spec, ...frozenStep } = step;
         const source = { ...(spec ?? { source: { path: asset.path, start: 1, end: 1 } }), id: step.stepId };
-        let root;
-        if (!step.route) {
-            const resolved = await resolveStep(source, context);
-            engineAnnouncement ??= resolved.engineAnnouncement;
-            root = frozenRoot(step.stepId, source, resolved, compiled, config);
-        }
+        const resolved = await resolveStep(source, context);
+        engineAnnouncement ??= resolved.engineAnnouncement;
+        const root = frozenRoot(step.stepId, source, resolved, compiled, config);
         let frozenJudge = null;
         if (step.gate.criteria.length > 0) {
             const judge = resolveJudge(source, step.gate.criteria[0] ?? "", context);
@@ -64,16 +56,14 @@ export async function freezeWorkflow(asset, config, refPath = [asset.ref]) {
                     "for `akm workflow resume` once it is reached.");
             }
         }
-        steps.push({ ...frozenStep, ...(root ? { root } : {}), gate: { ...step.gate, frozenJudge } });
+        steps.push({ ...frozenStep, root, gate: { ...step.gate, frozenJudge } });
     }
-    assertChildOutputReferences(steps);
     const plan = {
         irVersion: WORKFLOW_PLAN_VERSION,
         title: asset.title,
         ...(compiled.params ? { params: compiled.params } : {}),
         ...(compiled.paramSchemas ? { paramSchemas: compiled.paramSchemas } : {}),
         ...(compiled.budget ? { budget: compiled.budget } : {}),
-        ...(compiled.outputs ? { outputs: compiled.outputs } : {}),
         execution: { maxConcurrency: workflowMaxConcurrency(config.workflow?.maxConcurrency) },
         sourceHash: asset.sourceHash,
         steps,
@@ -84,33 +74,11 @@ async function resolveStep(source, context) {
     const baseUnit = baseUnitOf(source);
     if (source.exec)
         return directShell(source, baseUnit, context);
-    if (!source.uses)
-        throw new Error(`workflow step ${source.id} has neither exec nor uses`);
-    const target = classifyWorkflowStepUses(source.uses);
-    if (target.kind === "task")
-        return taskDispatch(source, baseUnit, target.ref, context);
-    if (target.kind === "workflow") {
-        return childWorkflowDispatch({
-            source,
-            baseUnit,
-            childRefInput: target.ref,
-            context,
-            via: "direct",
-            authoredInputs: { kind: "with", value: source.with },
-        });
-    }
-    // `commands/<ref>` and `scripts/<ref>` are not binding surfaces; `akm/command`'s
-    // `with:` is its own argument bag.
-    if (target.kind !== "builtin-command" && source.with !== undefined) {
-        const family = target.kind === "command" ? "commands" : "scripts";
-        throw new UsageError(`Workflow step ${source.id} cannot pass with: to ${family} target ${target.ref}; a ${target.kind} ref is not a binding surface.`, "COMPOSITION_INVALID");
+    if (source.workflow) {
+        return childWorkflowDispatch({ source, baseUnit, childRefInput: source.workflow, context });
     }
-    if (target.kind === "script")
-        return directScript(source, baseUnit, target.ref, context);
-    const action = target.kind === "builtin-command"
-        ? source.with
-        : { ref: qualifyRef(target.ref, "commands", context.asset, context.config) };
-    return commandDispatch(source, baseUnit, action, context);
+    // A prose step: its body is the `akm/command` literal content (`parser.ts` `stepSpec`).
+    return commandDispatch(source, baseUnit, source.with, context);
 }
 /** The gate judge's frozen command target, or undefined when no engine is available and none is configured. */
 function resolveJudge(source, rubric, context) {
@@ -153,7 +121,6 @@ function frozenRoot(stepId, source, resolved, plan, config) {
         ...(unit.retry ? { retry: { max: unit.retry.max, on: [...unit.retry.on] } } : {}),
         onError: unit.onError ?? plan.defaults?.onError ?? "fail",
         ...(unit.env ? { env: [...unit.env] } : {}),
-        isolation: unit.isolation ?? "none",
         source: { ...source.source },
         frozenTarget: target,
         environment: [...resolved.environment],

package/dist/workflows/freeze/targets/child-workflow.js

@@ -1,48 +1,31 @@
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * The one child-workflow resolver. Both composition forms lower here: a direct
- * `uses: workflows/<ref>` step (`via: "direct"`) and a `uses: tasks/<ref>`
- * step whose task targets a workflow (`via: "task"`). It resolves the child,
- * refuses a composition cycle, freezes the child completely through the
- * injected `ResolutionContext.freezeChild`, binds the step's inputs against
- * the child's `params:`, and embeds the frozen child plan in the target.
+ * The one child-workflow resolver (`unit: { workflow: <ref> }`, Experimental).
+ * It resolves the child, refuses a composition cycle, freezes the child
+ * completely through the injected `ResolutionContext.freezeChild`, binds the
+ * step's `with:` against the child's `params:`, and embeds the frozen child
+ * plan in the target.
  */
 import { createHash } from "node:crypto";
 import { parseBundleRef } from "../../../core/asset/asset-ref.js";
 import { UsageError } from "../../../core/errors.js";
-import { warn } from "../../../core/warn.js";
 import { workflowParamContract } from "../../ir/params.js";
 import { canonicalJson, canonicalPlanJson } from "../../ir/plan-hash.js";
 import { loadWorkflowAsset } from "../../runtime/workflow-asset-loader.js";
 import { resolveOwnedAsset } from "../environment.js";
 import { declaredParamNames, earlierStepIds, } from "../step-values.js";
-import { freezeTaskInputBindings, rebindTaskInputBindings } from "../task-bindings.js";
-/** The child target's own content identity: its ref, embedded plan hash, route, and bindings. */
+import { freezeTaskInputBindings } from "../task-bindings.js";
+/** The child target's own content identity: its ref, embedded plan hash, and bindings. */
 function childWorkflowContentHash(fields) {
     return createHash("sha256")
-        .update("akm.workflow.child-workflow\0v1\0")
+        .update("akm.workflow.child-workflow\0v2\0")
         .update(canonicalJson({
         ref: fields.ref,
         planHash: fields.planHash,
-        via: fields.via,
-        taskRef: fields.taskRef ?? null,
         inputBindings: fields.inputBindings.length > 0 ? fields.inputBindings : null,
     }))
         .digest("hex");
 }
-/** A composing step's own `env:` (literal or `unit.env`) cannot reach the child run, so say so. */
-function warnIfStepEnvironment(stepId, childRef, source) {
-    const hasLiteralEnv = Object.keys(source.env ?? {}).length > 0;
-    const hasEnvRefs = (source.unit?.env ?? []).length > 0;
-    if (!hasLiteralEnv && !hasEnvRefs)
-        return;
-    warn(`Workflow step ${stepId} declares env: while composing ${childRef}: a child run carries its own frozen ` +
-        `environment inside its own plan, so this composing step's env: (or unit: env:) is not delivered into it ` +
-        `and has no effect. Set those variables inside ${childRef}'s own source instead.`);
-}
-/** A workflow entry of a composition `refPath` — the only entries a cycle can close through. */
+/** A workflow entry of a composition `refPath`. */
 function isWorkflowRef(ref) {
     try {
         return parseBundleRef(ref).conceptId.startsWith("workflows/");
@@ -62,62 +45,43 @@ function assertNoCompositionCycle(stepId, childRef, refPath) {
         "composing itself, directly or through intermediates.");
 }
 export async function childWorkflowDispatch(input) {
-    const { source, baseUnit, childRefInput, context, via, taskRef, authoredInputs } = input;
-    // resolve + qualify. Resolution failures propagate unchanged,
-    // in code and shape — the same authority every other
-    // composition target (command/script/task) already resolves through.
+    const { source, baseUnit, childRefInput, context } = input;
+    // Resolution failures propagate unchanged, in code and shape — the same
+    // authority every other asset reference resolves through.
     const owned = await resolveOwnedAsset(childRefInput, "workflow", context);
     const childAsset = await loadWorkflowAsset(owned.ref);
     const childRef = childAsset.ref;
-    // Issue 10: an authored env: on the composing step has no path to reach
-    // the child run — warn rather than vanish silently (see
-    // warnIfStepEnvironment's doc comment).
-    warnIfStepEnvironment(source.id, childRef, source);
-    // the composition cycle check, before any child compilation.
+    // The composition cycle check, before any child compilation.
     assertNoCompositionCycle(source.id, childRef, context.refPath);
     // Freeze the child completely; its plan is a pure function of its own source.
-    const childRefPath = via === "task" && taskRef !== undefined ? [...context.refPath, taskRef, childRef] : [...context.refPath, childRef];
-    const child = await context.freezeChild(childAsset, childRefPath);
+    const child = await context.freezeChild(childAsset, [...context.refPath, childRef]);
     // Embed the child plan as plain canonical JSON, exactly as `plan_json` stores it.
     const embeddedPlanJson = canonicalPlanJson(child.plan);
     const frozenPlan = JSON.parse(embeddedPlanJson);
-    // Bind the step's effective inputs against the child's declared params.
-    const inputBindings = authoredInputs.kind === "bindings"
-        ? rebindTaskInputBindings({
-            stepId: source.id,
-            targetRef: childRef,
-            bindings: authoredInputs.value,
-            contract: workflowParamContract(frozenPlan),
-        })
-        : freezeTaskInputBindings({
-            stepId: source.id,
-            targetRef: childRef,
-            with: authoredInputs.value,
-            contract: workflowParamContract(frozenPlan),
-            earlierStepIds: earlierStepIds(context.plan, source.id),
-            declaredParamNames: declaredParamNames(context.plan),
-        });
-    // build the frozen target.
+    // Bind the step's `with:` against the child's declared params.
+    const inputBindings = freezeTaskInputBindings({
+        stepId: source.id,
+        targetRef: childRef,
+        with: source.with,
+        contract: workflowParamContract(frozenPlan),
+        earlierStepIds: earlierStepIds(context.plan, source.id),
+        declaredParamNames: declaredParamNames(context.plan),
+    });
     const planHash = createHash("sha256").update(embeddedPlanJson).digest("hex");
-    const contentHash = childWorkflowContentHash({ ref: childRef, planHash, via, taskRef, inputBindings });
     const target = Object.freeze({
         kind: "child-workflow",
         ref: childRef,
         planHash,
         frozenPlan,
-        contentHash,
-        via,
-        ...(taskRef !== undefined ? { taskRef } : {}),
+        contentHash: childWorkflowContentHash({ ref: childRef, planHash, inputBindings }),
         ...(inputBindings.length > 0 ? { inputBindings } : {}),
     });
     return {
         target,
-        // A child run carries its own frozen environment inside its own plan.
-        // A composing step's own env: cannot reach it, so assertNoStepEnvironment
-        // above rejects one instead of it silently vanishing here.
+        // A child run carries its own frozen environment inside its own plan; the
+        // parser rejects an `env` beside `workflow`, so there is nothing to deliver.
         environment: [],
         unit: baseUnit,
-        instructions: source.instructions ??
-            (via === "task" && taskRef !== undefined ? `Run task ${taskRef}.` : `Run workflow ${childRef}.`),
+        instructions: source.instructions ?? `Run workflow ${childRef}.`,
     };
 }

package/dist/workflows/freeze/targets/command.js

@@ -2,34 +2,21 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { createHash } from "node:crypto";
-import { parseBuiltinCommandAction } from "../../../commands/command/builtin-action.js";
 import { prepareCommandInvocation } from "../../../commands/command/command-execution.js";
-import { PORTABLE_ARGUMENTS_PLACEHOLDER } from "../../../commands/command/portable-template.js";
 import { captureFrozenDirectoryIdentity } from "../../../execution/directory-identity.js";
 import { canonicalResolvedExecutionRequest, } from "../../../execution/resolved-request.js";
 import { fallbackAnnouncement } from "../../../integrations/agent/engine-fallback.js";
 import { buildExecution } from "../../../integrations/agent/execution.js";
 import { freezeEnvironment, workflowExecutionSource } from "../environment.js";
-import { gitIdentity } from "../identity.js";
 import { durableRequest, executionUnitValues, targetConcurrency, } from "../step-values.js";
-function inlineWorkflowCommandAction(action, commandMode) {
-    if (commandMode !== "portable-template")
-        return action;
-    const parsed = parseBuiltinCommandAction(action);
-    if (parsed.kind !== "inline")
-        return action;
-    return { content: parsed.content.split(PORTABLE_ARGUMENTS_PLACEHOLDER).join(parsed.arguments ?? "") };
-}
 export async function commandDispatch(source, baseUnit, action, context) {
     const prepared = await prepareCommandInvocation({
-        action: inlineWorkflowCommandAction(action, source.commandMode),
+        action,
         config: context.config,
         ...(context.plan.defaults
             ? { invocationDefaults: executionUnitValues(context.plan.defaults, context.asset.sourcePath) }
             : {}),
-        ...(source.commandMode === "literal" || source.commandMode === "portable-template"
-            ? { inlineContentMode: "literal" }
-            : {}),
+        inlineContentMode: "literal",
         current: executionUnitValues(source.unit, context.asset.sourcePath),
         sourceLoader: (ref, kind) => workflowExecutionSource(ref, kind, context),
     });
@@ -57,7 +44,6 @@ export function commandResult(source, baseUnit, prepared, context, literals = []
         runner,
         ...(targetConcurrency(runner, context.config) ? { concurrency: targetConcurrency(runner, context.config) } : {}),
         cwdIdentity,
-        ...gitIdentity(baseUnit, cwdIdentity.realRoot),
     });
     const engineAnnouncement = fallbackAnnouncement(prepared.fallbackEngineName, request.engine.name);
     return {