akm-cli 0.9.31 → 0.10.26101002-alpha

package/dist/workflows/exec/run-workflow.js

@@ -21,16 +21,15 @@ import { resolveStorageLocations } from "../../storage/locations.js";
 import { withWorkflowRunsConnection, withWorkflowRunsRepo } from "../../storage/repositories/workflow-runs-repository.js";
 import { computePlanHash } from "../ir/plan-hash.js";
 import { decodeWorkflowPlan, readRunPlan } from "../runtime/run-plan.js";
-import { abandonWorkflowRun, completeWorkflowStep, getNextWorkflowStep, resumeWorkflowRun, } from "../runtime/runs.js";
+import { abandonWorkflowRun, getNextWorkflowStep, resumeWorkflowRun } from "../runtime/runs.js";
 import { loadWorkflowAsset } from "../runtime/workflow-asset-loader.js";
 import { frozenSummaryJudge } from "./frozen-judge.js";
 import { mergeLoweringNotices } from "./lowering-notices.js";
 import { defaultUnitDispatcher, executeStepPlan, } from "./native-executor.js";
-// Shared step semantics — route evaluation + cascaded-skip bookkeeping,
-// gate-evaluation journaling, and the whole step-completion path
+// Shared step semantics — gate-evaluation journaling, and the whole step-completion path
 // (`finalizeExecutedStep`) live in step-work.ts as ONE implementation, so the
 // fresh-execution and resume paths cannot drift from each other.
-import { activeGateLoop, blockStepForJudgeFailure, cascadeSkippedRouter, effectiveGateMaxLoops, finalizeExecutedStep, recoverGateFeedback, referencedStepIds, seedJournaledRouteDecisions, } from "./step-work.js";
+import { activeGateLoop, blockStepForJudgeFailure, effectiveGateMaxLoops, finalizeExecutedStep, recoverGateFeedback, referencedStepIds, } from "./step-work.js";
 export async function runWorkflowSteps(options) {
     let target = options.target;
     let params = options.params;
@@ -72,8 +71,8 @@ export async function runWorkflowSteps(options) {
         }
         if (remainingSteps !== undefined) {
             // The step budget is DISTINCT PROCESSED STEPS, not `executed` entries:
-            // gate loops of one step and route-skips must not shrink a retry's
-            // remaining budget (they never counted against maxSteps either).
+            // gate loops of one step must not shrink a retry's remaining budget
+            // (they never counted against maxSteps either).
             remainingSteps -= result.stepsProcessed;
             if (remainingSteps <= 0)
                 return aggregate;
@@ -262,28 +261,6 @@ async function loadAuthoritativeRunPlan(options, next, stored) {
     }
     return stored;
 }
-/**
- * Complete a branch target no completed router selected as `skipped` — no
- * dispatch, no gate loop, and (per the `maxSteps` contract) no step consumed.
- * Returns the re-read spine state so the caller can continue its walk.
- */
-async function skipUnselectedRouteTarget(input) {
-    const { runId, stepId, stepPlan, skipInfo, routeUnselected, executed } = input;
-    // Cascade: a skipped step that is ITSELF a router
-    // never evaluates its route, so none of its declared targets were
-    // selected — mark them all skip-on-reach too (a target another
-    // completed router selects stays protected via routeSelected). Without
-    // this, every branch of the skipped router would run unconditionally.
-    if (stepPlan.route) {
-        cascadeSkippedRouter(stepPlan.route, stepId, routeUnselected);
-    }
-    const notes = skipInfo.selected === null
-        ? `Skipped by route: step "${skipInfo.router}" was itself skipped, so none of its branch targets run.`
-        : `Skipped by route: step "${skipInfo.router}" selected "${skipInfo.selected}".`;
-    executed.push({ stepId, ok: true, unitCount: 0, failedUnits: 0, summary: notes });
-    await completeWorkflowStep({ runId, stepId, status: "skipped", notes });
-    return getNextWorkflowStep(runId);
-}
 /**
  * Seed a step's starting gate loop and feedback from its journaled gate rows,
  * so a run interrupted after a rejection resumes at the next loop with the
@@ -307,41 +284,31 @@ async function recoverGateLoopState(runId, stepPlan) {
  */
 const STEP_FINISHED_KINDS = new Set(["advanced", "failed", "gate-exhausted"]);
 /**
- * One attempt at a step's work. Route-only steps (YAML `route:` — no execution
- * subgraph) dispatch no units; they only decide the spine's path in
- * `finalizeExecutedStep`. Everything else executes its subgraph through the
- * native executor.
+ * One attempt at a step's work: execute its subgraph through the native
+ * executor.
  */
 async function executeStepSubgraph(ctx, loop) {
-    const { options, next, plan, stepPlan, step, evidence } = ctx;
+    const { options, next, plan, stepPlan, evidence } = ctx;
     const { gateLoop, gateFeedback, unitsDispatched, tokensUsed } = loop;
-    return !stepPlan.root && stepPlan.route
-        ? {
-            ok: true,
-            units: [],
-            evidence: {},
-            summary: `Step "${step.id}" is a route step — no units dispatched.`,
-            unitsDispatched,
-        }
-        : await executeStepPlan(stepPlan, {
-            runId: next.run.id,
-            workflowRef: next.run.workflowRef,
-            params: next.run.params ?? {},
-            evidence,
-            unitsDispatched,
-            tokensUsed,
-            // Budget ceilings ride the FROZEN plan: a mid-run
-            // asset edit can never loosen or tighten a run's budget.
-            ...(plan.budget ? { budget: plan.budget } : {}),
-            gateLoop,
-            ...(gateFeedback ? { gateFeedback } : {}),
-            // F-1: threaded to an exec unit's child env;
-            // undefined for every non-task caller (byte-identical, RunWorkflowOptions doc).
-            ...(options.eventSource !== undefined ? { eventSource: options.eventSource } : {}),
-            ...(options.signal ? { signal: options.signal } : {}),
-            ...(options.dispatcher ? { dispatcher: options.dispatcher } : {}),
-            maxConcurrency: Math.min(options.maxConcurrency ?? Number.POSITIVE_INFINITY, plan.execution?.maxConcurrency ?? 1),
-        });
+    return await executeStepPlan(stepPlan, {
+        runId: next.run.id,
+        workflowRef: next.run.workflowRef,
+        params: next.run.params ?? {},
+        evidence,
+        unitsDispatched,
+        tokensUsed,
+        // Budget ceilings ride the FROZEN plan: a mid-run
+        // asset edit can never loosen or tighten a run's budget.
+        ...(plan.budget ? { budget: plan.budget } : {}),
+        gateLoop,
+        ...(gateFeedback ? { gateFeedback } : {}),
+        // F-1: threaded to an exec unit's child env;
+        // undefined for every non-task caller (byte-identical, RunWorkflowOptions doc).
+        ...(options.eventSource !== undefined ? { eventSource: options.eventSource } : {}),
+        ...(options.signal ? { signal: options.signal } : {}),
+        ...(options.dispatcher ? { dispatcher: options.dispatcher } : {}),
+        maxConcurrency: Math.min(options.maxConcurrency ?? Number.POSITIVE_INFINITY, plan.execution?.maxConcurrency ?? 1),
+    });
 }
 /**
  * Drive one step's bounded gate loop: a rejection with loops left re-executes
@@ -349,7 +316,7 @@ async function executeStepSubgraph(ctx, loop) {
  * decision and running budget totals; `ctx.executed` is appended in place.
  */
 async function runStepGateLoop(ctx, gate, totals) {
-    const { options, next, stepPlan, step, evidence, executed, routeSelected, routeUnselected } = ctx;
+    const { options, next, stepPlan, step, executed } = ctx;
     const { summaryJudge } = ctx;
     const { startLoop, maxLoops } = gate;
     let { unitsDispatched, tokensUsed } = totals;
@@ -376,7 +343,7 @@ async function runStepGateLoop(ctx, gate, totals) {
             summary: result.summary,
             ...(result.notices ? { notices: result.notices } : {}),
         });
-        // Route, gate, and advance: the shared completion path, live or resumed.
+        // Gate and advance: the shared completion path, live or resumed.
         let finalize;
         try {
             finalize = await finalizeExecutedStep({
@@ -388,10 +355,6 @@ async function runStepGateLoop(ctx, gate, totals) {
                 gateLoop,
                 loopsRemaining: gateLoop < maxLoops,
                 result,
-                priorEvidence: evidence,
-                params: next.run.params ?? {},
-                routeSelected,
-                routeUnselected,
                 summaryJudge,
                 signal: options.signal,
             });
@@ -413,10 +376,6 @@ async function runStepGateLoop(ctx, gate, totals) {
             // when some later reference can read it (`referencedStepIds`).
             if (ctx.liveEvidenceConsumers.has(step.id))
                 ctx.liveEvidence.set(step.id, result.evidence);
-            // A route-only step's summary IS its decision (finalize surfaces it).
-            if (finalize.summaryOverride !== undefined) {
-                executed[executed.length - 1] = { ...executed[executed.length - 1], summary: finalize.summaryOverride };
-            }
             return outcome({ kind: "advanced" });
         }
         if (finalize.kind === "judge-failed") {
@@ -451,11 +410,6 @@ async function runStepGateLoop(ctx, gate, totals) {
             });
         }
         if (finalize.kind === "failed") {
-            // A route-failure was pushed as ok:true (the units succeeded); reflect
-            // the deterministic route failure in the executed report.
-            if (finalize.routeFailure) {
-                executed[executed.length - 1] = { ...executed[executed.length - 1], ok: false, summary: finalize.summary };
-            }
             return outcome({ kind: "failed" });
         }
         // gate-exhausted: rejected with no loop budget left — stop with feedback.
@@ -486,9 +440,8 @@ liveEvidence) {
     let aborted = false;
     const maxSteps = options.maxSteps ?? Number.POSITIVE_INFINITY;
     // The `maxSteps` budget counts DISTINCT spine steps that finished processing
-    // — never `executed.length`, which grows once per gate-loop iteration and
-    // once per route-skip. A step's whole bounded gate loop consumes ONE step;
-    // a route-skipped step consumes NOTHING (no work was dispatched for it).
+    // — never `executed.length`, which grows once per gate-loop iteration. A
+    // step's whole bounded gate loop consumes ONE step.
     let stepsProcessed = 0;
     let { unitsDispatched, tokensUsed } = await seedRunAccountingFromJournal(next.run.id);
     const plan = await loadAuthoritativeRunPlan(options, next, storedPlan);
@@ -498,16 +451,6 @@ liveEvidence) {
     // and holding every step's for the whole invocation is pure ballast when
     // nothing downstream names it.
     const liveEvidenceConsumers = referencedStepIds(plan);
-    // Route bookkeeping: targets a completed router did NOT select are skipped
-    // when the spine reaches them; a target ANY router selected is protected
-    // (two routers may share a target).
-    const routeSelected = new Set();
-    const routeUnselected = new Map();
-    // Replay journaled route decisions before the spine advances, so a
-    // re-invoked run skips the unselected branches. A done run skips this.
-    if (!next.done) {
-        seedJournaledRouteDecisions(plan, next, routeSelected, routeUnselected);
-    }
     while (!next.done && next.step && next.run.status === "active" && stepsProcessed < maxSteps) {
         // A caller abort (options.signal) is a graceful break.
         if (options.signal?.aborted) {
@@ -520,19 +463,6 @@ liveEvidence) {
             throw new UsageError(`Step "${step.id}" of run ${next.run.id} is not present in its frozen workflow plan (${next.run.workflowRef}). ` +
                 "The run journal is inconsistent; abandon this run and start a new one.");
         }
-        // A branch target no completed router selected → auto-skip, no dispatch.
-        const skipInfo = routeUnselected.get(step.id);
-        if (skipInfo && !routeSelected.has(step.id)) {
-            next = await skipUnselectedRouteTarget({
-                runId: next.run.id,
-                stepId: step.id,
-                stepPlan,
-                skipInfo,
-                routeUnselected,
-                executed,
-            });
-            continue;
-        }
         const evidence = {};
         for (const s of next.workflow.steps)
             evidence[s.id] = liveEvidence.get(s.id) ?? s.evidence;
@@ -589,8 +519,6 @@ liveEvidence) {
             liveEvidence,
             liveEvidenceConsumers,
             executed,
-            routeSelected,
-            routeUnselected,
             summaryJudge,
         }, { startLoop, maxLoops, seededFeedback }, { unitsDispatched, tokensUsed });
         unitsDispatched = outcome.unitsDispatched;

package/dist/workflows/exec/step-work.js

@@ -109,11 +109,10 @@ function resolveTaskInputBindings(bindings, stepId, scope) {
  */
 export function computeStepWorkList(plan, input) {
     const root = plan.root;
-    // Route-only steps (YAML `route:`) carry no execution subgraph.
     if (!root) {
         return {
             ok: false,
-            error: `Step "${plan.stepId}" has no execution subgraph (a route-only step); the native executor cannot dispatch it.`,
+            error: `Step "${plan.stepId}" has no execution subgraph; the native executor cannot dispatch it.`,
         };
     }
     const template = root.kind === "map" ? root.template : root;
@@ -121,7 +120,7 @@ export function computeStepWorkList(plan, input) {
     const scope = { params: input.params, stepOutputs: input.stepOutputs };
     // Instructions are ALWAYS the step's body prose, byte-exact — never
     // templated, never scanned for reference syntax (workflow-format-
-    // unification, spec §2.3). Only `map.over` / `route.input` / `inputs[]`
+    // unification, spec §2.3). Only `map.over` / `inputs[]`
     // carry the closed reference grammar.
     // Resolve the step's declared `inputs:` ONCE (shared by every unit in this
     // step — map items differ, declared inputs do not): prior-step artifacts
@@ -177,7 +176,7 @@ export function computeStepWorkList(plan, input) {
         : [unitIdFor(template.id, undefined, false, true)];
     const gateLoop = input.gateLoop ?? 1;
     const target = template.frozenTarget;
-    const frozenExec = target.kind === "shell" || target.kind === "script" ? target.exec : undefined;
+    const frozenExec = target.kind === "shell" ? target.exec : undefined;
     const runner = target.kind === "command" ? target.runner.kind : "exec";
     // Taken verbatim from the frozen plan, resolved once at freeze (an exec
     // unit's on its exec spec). A frozen `null` means genuinely unbounded
@@ -271,7 +270,6 @@ function buildStepWorkUnit(ctx, unitId, item, index) {
         ...(template.schema ? { schema: template.schema } : {}),
         ...(template.retry ? { retry: template.retry } : {}),
         onError: template.onError,
-        ...(template.isolation ? { isolation: template.isolation } : {}),
         // the SAME resolved `with:` bindings `taskInputs` already
         // carries, exposed under the name `child-workflow.ts`'s drive contract
         // reads. Absent (never `{}`) when the step binds nothing.
@@ -330,7 +328,8 @@ function computeUnitInputHash(ctx, item) {
         frozenTarget: ctx.target,
         environment: ctx.template.environment,
         schema: ctx.template.schema ?? null,
-        isolation: ctx.template.isolation ?? "none",
+        // Retired `isolation: worktree` field; kept constant so in-flight runs keep their journaled input hashes.
+        isolation: "none",
         ...(ctx.taskInputs !== undefined ? { taskInputs: ctx.taskInputs } : {}),
         ...(ctx.input.gateFeedback ? { gateFeedback: ctx.input.gateFeedback } : {}),
     }))
@@ -422,7 +421,7 @@ function stepTemplate(stepPlan) {
 }
 /**
  * The step ids another step can still read (named by `inputs[]`, `map.over`,
- * or `route.input` — the whole reference surface). A step outside this set
+ * — the whole reference surface). A step outside this set
  * need not keep its artifact in memory once journaled. Derived from the plan alone.
  */
 export function referencedStepIds(plan) {
@@ -437,8 +436,6 @@ export function referencedStepIds(plan) {
             note(step.root.over);
         for (const reference of stepTemplate(step)?.inputs ?? [])
             note(reference);
-        if (step.route)
-            note(step.route.input);
     }
     return referenced;
 }
@@ -830,148 +827,6 @@ export async function journalGateEvaluationFinish(gate, errored, rejection) {
         throw new UsageError(`Gate ${unitId} was already finished; refusing a duplicate terminal write.`);
     }
 }
-/**
- * Resolve a route's input (a single whole-value reference string — `params.x` or
- * `steps.<id>.output…`, with no `${{ }}` delimiters) and pick the branch. No
- * ambient key search. Only primitive values route; the comparison is exact
- * string equality against the declared `when:` matches.
- */
-export function evaluateRoute(route, scope) {
-    const resolved = resolveStepReference(route.input, scope);
-    if (!resolved.ok) {
-        return { ok: false, error: `route input ${route.input} failed to resolve: ${resolved.error.message}` };
-    }
-    const value = resolved.value;
-    if (typeof value === "object" && value !== null) {
-        return {
-            ok: false,
-            error: `route input ${route.input} resolved to a non-primitive value; branches match on strings/numbers/booleans.`,
-        };
-    }
-    const valueString = typeof value === "string" ? value : String(value);
-    // Own-property check: `when` is author-controlled, and a value such as
-    // "constructor" must not resolve through Object.prototype.
-    const selected = Object.hasOwn(route.when, valueString) ? route.when[valueString] : route.defaultStepId;
-    if (!selected) {
-        return {
-            ok: false,
-            error: `value "${valueString}" matched no "when:" branch and the route declares no default.`,
-        };
-    }
-    return { ok: true, value: valueString, selected };
-}
-/**
- * Cascade a SKIPPED router: it never evaluated its route, so every declared
- * target (branches + default) is marked skip-on-reach unless an earlier router
- * already claimed it. Shared by the live skip path and the journal replay.
- */
-export function cascadeSkippedRouter(route, routerId, routeUnselected) {
-    const targets = [...Object.values(route.when), ...(route.defaultStepId ? [route.defaultStepId] : [])];
-    for (const target of targets) {
-        if (!routeUnselected.has(target)) {
-            routeUnselected.set(target, { router: routerId, selected: null });
-        }
-    }
-}
-/**
- * Record one router's decision in the skip bookkeeping: the selected target is
- * protected, every other declared target (branches + default) is marked
- * skip-on-reach unless an earlier router already claimed it. Shared by the live
- * evaluation path and the journal replay.
- */
-export function applyRouteDecision(route, routerId, selected, routeSelected, routeUnselected) {
-    routeSelected.add(selected);
-    const targets = [...Object.values(route.when), ...(route.defaultStepId ? [route.defaultStepId] : [])];
-    for (const target of targets) {
-        if (target !== selected && !routeUnselected.has(target)) {
-            routeUnselected.set(target, { router: routerId, selected });
-        }
-    }
-}
-/**
- * The `stepOutputs` scope a route resolves against: every prior step's recorded
- * evidence plus the just-finished step's fresh evidence — each projected
- * through {@link projectStepOutput}. Same projection as unit templates, so the
- * two scopes cannot drift.
- */
-export function routeStepOutputs(evidence, currentStepId, currentEvidence) {
-    const outputs = {};
-    for (const [stepId, stepEvidence] of Object.entries(evidence)) {
-        if (stepEvidence !== undefined)
-            outputs[stepId] = projectStepOutput(stepEvidence);
-    }
-    outputs[currentStepId] = projectStepOutput(currentEvidence);
-    return outputs;
-}
-/** The `selected` target journaled on a route step's evidence, if well-formed. */
-function journaledRouteSelection(evidence) {
-    const route = evidence?.route;
-    if (typeof route !== "object" || route === null || Array.isArray(route))
-        return undefined;
-    const selected = route.selected;
-    return typeof selected === "string" && selected !== "" ? selected : undefined;
-}
-/** The set of steps a route may legally select: its `when` branches + default. */
-function routeTargets(route) {
-    return new Set([...Object.values(route.when), ...(route.defaultStepId ? [route.defaultStepId] : [])]);
-}
-/** A journaled route decision must name a target the route declares; anything else fails loudly. */
-function assertRouteTargetDeclared(route, stepId, selected, runId) {
-    const targets = routeTargets(route);
-    if (!targets.has(selected)) {
-        throw new UsageError(`Workflow run ${runId} has a completed route step "${stepId}" whose journaled route decision selected ` +
-            `"${selected}", which is not a declared branch or default target of the route (valid targets: ` +
-            `${[...targets].join(", ") || "(none)"}). The route evidence was corrupted or manually edited — refusing to ` +
-            `apply a bogus route decision that would skip the real branch targets. Start a new run.`);
-    }
-}
-/**
- * Replay journaled route decisions into the skip bookkeeping (resume path).
- * For every COMPLETED route step of the frozen plan, in spine order: the
- * journaled decision wins; else a re-derivation from the frozen plan +
- * journaled evidence; else fail loudly. A SKIPPED route step cascades its
- * targets into the skip set exactly as on the live path.
- */
-export function seedJournaledRouteDecisions(plan, state, routeSelected, routeUnselected) {
-    const evidence = {};
-    for (const s of state.workflow.steps)
-        evidence[s.id] = s.evidence;
-    for (const stepPlan of plan.steps) {
-        if (!stepPlan.route)
-            continue;
-        const stepState = state.workflow.steps.find((s) => s.id === stepPlan.stepId);
-        if (!stepState)
-            continue;
-        if (stepState.status === "skipped") {
-            cascadeSkippedRouter(stepPlan.route, stepPlan.stepId, routeUnselected);
-            continue;
-        }
-        if (stepState.status !== "completed")
-            continue;
-        let selected = journaledRouteSelection(stepState.evidence);
-        if (selected !== undefined) {
-            // a stored decision must name a declared target — a bogus one
-            // (tampered/hand-edited evidence) fails loudly rather than seeding a skip
-            // set that buries the real branches.
-            assertRouteTargetDeclared(stepPlan.route, stepPlan.stepId, selected, state.run.id);
-        }
-        if (selected === undefined) {
-            const scope = {
-                params: state.run.params ?? {},
-                stepOutputs: routeStepOutputs(evidence, stepPlan.stepId, stepState.evidence ?? {}),
-            };
-            const decision = evaluateRoute(stepPlan.route, scope);
-            if (decision.ok)
-                selected = decision.selected;
-        }
-        if (selected === undefined) {
-            throw new UsageError(`Workflow run ${state.run.id} has a completed route step "${stepPlan.stepId}" with no journaled route ` +
-                `decision, and the decision cannot be re-derived from the journaled evidence. Refusing to guess which ` +
-                `branch was selected. The run journal is inconsistent; abandon this run and start a new one.`);
-        }
-        applyRouteDecision(stepPlan.route, stepPlan.stepId, selected, routeSelected, routeUnselected);
-    }
-}
 /**
  * The blocked-step notes for a verifier-infrastructure failure (bug: judge
  * outage must not burn the gate budget). Shared by every judge-failure path —
@@ -1050,8 +905,6 @@ async function blockFinalizedStepForChildWorkflow(input, childBlocked) {
  * Perform one completion attempt for an executed step:
  *  - a hard unit failure fails the step (a retryable artifact-schema mismatch
  *    with loops left returns `retry` without a gate row);
- *  - a route decision is evaluated, journaled on the evidence, and applied to
- *    the skip bookkeeping; an unroutable value fails the step;
  *  - the gate judges a summary built from the promoted artifact: a rejection
  *    returns `retry` (loops left) or `gate-exhausted`, a pass `advanced`;
  *  - a judge infrastructure failure is not a verdict: it blocks the step for
@@ -1093,34 +946,12 @@ export async function finalizeExecutedStep(input) {
         return blockFinalizedStep(input, "this step declares completion criteria but no verification judge is available " +
             "(the frozen plan resolves no judge — set workflow.judgeEngine, or restore the judge configuration)");
     }
-    // Route evaluation BEFORE completion: an unroutable value is an
-    // authoring/config failure that must fail the step deterministically.
-    let summaryOverride;
-    if (stepPlan.route) {
-        const scope = {
-            params: input.params,
-            stepOutputs: routeStepOutputs(input.priorEvidence, stepId, result.evidence),
-        };
-        const decision = evaluateRoute(stepPlan.route, scope);
-        if (!decision.ok) {
-            const notes = `Step "${stepId}" route failed: ${decision.error}`;
-            await completeWorkflowStep({ runId, stepId, status: "failed", notes, evidence: result.evidence });
-            return { kind: "failed", summary: notes, routeFailure: true };
-        }
-        applyRouteDecision(stepPlan.route, stepId, decision.selected, input.routeSelected, input.routeUnselected);
-        // Journal the decision on the evidence: resume replays it via
-        // seedJournaledRouteDecisions, so the skip set survives re-invocation.
-        result.evidence.route = { input: stepPlan.route.input, value: decision.value, selected: decision.selected };
-        if (!stepPlan.root) {
-            summaryOverride = `Step "${stepId}" routed on ${stepPlan.route.input}: value "${decision.value}" selected step "${decision.selected}".`;
-        }
-    }
     // Artifact-judging gate: a criteria-bearing executing step is judged on a
     // summary BUILT FROM the promoted artifact; everything else keeps the machine
-    // summary (a route-only step's summary IS its decision).
+    // summary.
     const summary = stepPlan.root && completionCriteria.length > 0
         ? buildArtifactSummary(stepId, result.units, result.evidence)
-        : (summaryOverride ?? result.summary);
+        : result.summary;
     // Journal engine-driven judge calls as unit rows. With no criteria there is
     // no judge invocation or row; a criteria-bearing plan without a judge is a
     // configuration error rather than a silent bypass.
@@ -1233,7 +1064,7 @@ export async function finalizeExecutedStep(input) {
         return blockFinalizedStep(input, judgeFailure ?? "the verification judge failed");
     }
     if (!rejection) {
-        return { kind: "advanced", ...(summaryOverride !== undefined ? { summaryOverride } : {}) };
+        return { kind: "advanced" };
     }
     if (loopsRemaining) {
         return { kind: "retry", gateFeedback: { feedback: rejection.feedback, missing: rejection.missing } };

package/dist/workflows/exec/unit-dispatch.js

@@ -73,16 +73,6 @@ export async function dispatchWorkflowExecution(request, feedback) {
             ...(notices ? { notices } : {}),
         };
     }
-    if (request.cwd && lowered.runner.kind === "llm") {
-        return {
-            ok: false,
-            text: "",
-            failureReason: "isolation_unsupported",
-            error: `unit ${JSON.stringify(request.unitId)} declares isolation: worktree but resolved to the "llm" runner, ` +
-                `which has no working directory to isolate. Use the agent or sdk runner for isolated units.`,
-            ...(notices ? { notices } : {}),
-        };
-    }
     let result;
     try {
         const eventSource = forwardedDispatchEventSource(request);

package/dist/workflows/freeze/environment.js

@@ -12,23 +12,13 @@ import { UsageError } from "../../core/errors.js";
 import { deriveInstallations } from "../../indexer/installations.js";
 import { resolveSourceEntries } from "../../indexer/search/search-source.js";
 import { resolveAssetPath } from "../../sources/resolve.js";
-import { isInferredSecretName } from "../../tasks/log-redaction.js";
 import { SECRET_TOKEN_RE } from "../exec/environment.js";
-import { detectSecretShapedParams } from "../exec/param-secrets.js";
 /**
- * A step's frozen environment: literal `env:` values, `pass_env` names, then
+ * A step's frozen environment: `pass_env` names, then
  * one value-free descriptor per `unit.env` ref (owner, key set, secret-token
  * names). Values are read at dispatch (`exec/environment.ts`), never frozen.
  */
 export function freezeEnvironment(source, exec, context) {
-    const literals = Object.entries(source.env ?? {}).map(([name, raw]) => {
-        const value = String(raw);
-        // A literal is frozen into plan_json; a credential belongs in an env ref, as for task env.
-        if (isInferredSecretName(name) || detectSecretShapedParams({ [name]: value }).length > 0) {
-            throw new UsageError(`Workflow step ${source.id} env.${name} is a secret-shaped literal env value. Store credentials in an env asset (unit.env) rather than workflow source.`, "WORKFLOW_SOURCE_INVALID");
-        }
-        return Object.freeze({ kind: "literal", name, value });
-    });
     const passThrough = (exec?.passEnv ?? []).map((name) => Object.freeze({ kind: "pass-through", name }));
     const seen = new Set();
     const envRefs = [];
@@ -62,7 +52,7 @@ export function freezeEnvironment(source, exec, context) {
             precedence,
         }));
     }
-    return [...literals, ...passThrough, ...envRefs];
+    return [...passThrough, ...envRefs];
 }
 /** Load a command or persona the workflow names, resolved through the workflow's own bundles. */
 export async function workflowExecutionSource(ref, kind, context) {
@@ -143,39 +133,8 @@ function configuredOwner(bundle, config) {
         adapter: component?.adapter ?? "akm",
     };
 }
-const SCRIPT_EXTENSIONS = [
-    "",
-    ".sh",
-    ".ts",
-    ".js",
-    ".py",
-    ".rb",
-    ".go",
-    ".pl",
-    ".php",
-    ".lua",
-    ".r",
-    ".swift",
-    ".kt",
-    ".kts",
-    ".ps1",
-    ".cmd",
-    ".bat",
-];
 function assetExtensions(type) {
-    if (type === "script")
-        return SCRIPT_EXTENSIONS;
     if (type === "env")
         return ["", ".env"];
-    return ["", ".md", ".yml"];
-}
-export function qualifyRef(ref, plural, asset, config) {
-    const parsed = parseBundleRef(ref);
-    if (parsed.bundle)
-        return ref;
-    const bundle = parseBundleRef(asset.ref).bundle ?? config.defaultBundle;
-    if (!bundle)
-        throw new UsageError(`Workflow ref ${ref} has no owning bundle.`, "WORKFLOW_SOURCE_INVALID");
-    const concept = parsed.conceptId.startsWith(`${plural}/`) ? parsed.conceptId : `${plural}/${parsed.conceptId}`;
-    return makeBundleRef(bundle, concept);
+    return ["", ".md"];
 }