akm-cli 0.9.4 → 0.9.6

package/dist/tasks/scheduler-sync.js

@@ -17,7 +17,7 @@ import { WorkflowSourceCollisionError, WorkflowSourceNameError, WorkflowSourceRe
 import { compileWorkflowSource } from "../workflows/source-ir/compile.js";
 import { prepareTaskV3Execution } from "./prepare/prepare.js";
 import { parseSchedule } from "./schedule.js";
-import { assertSchedulerNativeArtifactCardinality, compileTaskSchedulerBindings, compileWorkflowSchedulerBindings, schedulerBindingNativeId, schedulerBindingOrdinal, schedulerNativeArtifactKey, schedulerNativeBindingId, } from "./scheduler-binding.js";
+import { assertSchedulerNativeArtifactCardinality, compileTaskSchedulerBindings, compileWorkflowSchedulerBindings, schedulerBindingNativeId, schedulerBindingOrdinal, schedulerNativeArtifactKey, schedulerNativeArtifactOwner, schedulerNativeBindingId, } from "./scheduler-binding.js";
 import { parseTaskSource } from "./source/parse-task-source.js";
 import { projectTaskSourceV4 } from "./source/project-v4.js";
 import { taskSourceErrorDetail } from "./source-v3.js";
@@ -47,6 +47,7 @@ export async function prepareSchedulerSyncSourceSet(input) {
         desired: compiled.desired,
         sourceSnapshot,
         executableWorkflows: compiled.executableWorkflows,
+        failures: compiled.failures,
     });
 }
 export function finalizeSchedulerSyncPlan(input, prepared) {
@@ -108,35 +109,7 @@ export function finalizeSchedulerSyncPlan(input, prepared) {
         .sort(compareCodePoints);
     for (const id of removed) {
         const current = present.get(id);
-        if (!current?.invocation) {
-            throw nativeArtifactCollision({ nativeId: current?.nativeId ?? schedulerNativeBindingId(id), bindingId: id }, { nativeId: current?.nativeId ?? schedulerNativeBindingId(id) });
-        }
-        const nativeId = exactInstalledNativeId(id, current, inspection.artifacts);
-        const artifact = inspection.artifacts.find((candidate) => candidate.nativeId === nativeId && candidate.bindingId === id);
-        const priorFingerprint = current.signature ?? artifact?.fingerprint;
-        if (!artifact || priorFingerprint === undefined) {
-            throw new UsageError(`Installed scheduler binding ${JSON.stringify(id)} has no exact native fingerprint; refusing removal.`, "RESOURCE_ALREADY_EXISTS");
-        }
-        const logicalSource = installedLogicalSource(current.invocation, coherentInput);
-        const ordinal = schedulerBindingOrdinal(id, logicalSource, current.invocation);
-        if (ordinal === undefined) {
-            throw new UsageError(`Installed scheduler binding ${JSON.stringify(id)} cannot be attributed to an exact schedule ordinal; refusing removal.`, "RESOURCE_ALREADY_EXISTS");
-        }
-        operations.push(Object.freeze({
-            kind: "remove",
-            id,
-            nativeId,
-            expected: freezeRemovalExpectation({
-                state: "present",
-                bindingId: id,
-                nativeId,
-                logicalSource,
-                ordinal,
-                invocation: current.invocation,
-                fingerprint: priorFingerprint,
-            }),
-            ...(current.ownerBundlePath !== undefined ? { ownerBundlePath: current.ownerBundlePath } : {}),
-        }));
+        operations.push(buildSchedulerRemoveOperation(id, current, inspection.artifacts, coherentInput));
     }
     return Object.freeze({
         desired,
@@ -146,6 +119,49 @@ export function finalizeSchedulerSyncPlan(input, prepared) {
         unchanged: Object.freeze(unchanged),
         operations: Object.freeze(operations),
         sourceSnapshot: prepared.sourceSnapshot,
+        failures: prepared.failures,
+    });
+}
+/**
+ * Build the exact removal operation for one installed binding: same
+ * exact-native-fingerprint / ordinal-attribution safety checks
+ * `finalizeSchedulerSyncPlan`'s remove loop always applied, factored out so
+ * `akm task prune` (#851) can build removal operations for entries
+ * `belongsToBundle` structurally can't see (unresolvable ownership) without
+ * re-deriving — or weakening — this logic. Throws the same `UsageError`s a
+ * sync removal would on an inexact match; callers computing prune candidates
+ * should only pass entries they've already independently confirmed are safe
+ * to remove.
+ */
+export function buildSchedulerRemoveOperation(id, current, artifacts, input) {
+    if (!current?.invocation) {
+        throw nativeArtifactCollision({ nativeId: current?.nativeId ?? schedulerNativeBindingId(id), bindingId: id }, { nativeId: current?.nativeId ?? schedulerNativeBindingId(id) });
+    }
+    const nativeId = exactInstalledNativeId(id, current, artifacts);
+    const artifact = artifacts.find((candidate) => candidate.nativeId === nativeId && candidate.bindingId === id);
+    const priorFingerprint = current.signature ?? artifact?.fingerprint;
+    if (!artifact || priorFingerprint === undefined) {
+        throw new UsageError(`Installed scheduler binding ${JSON.stringify(id)} has no exact native fingerprint; refusing removal.`, "RESOURCE_ALREADY_EXISTS");
+    }
+    const logicalSource = installedLogicalSource(current.invocation, input);
+    const ordinal = schedulerBindingOrdinal(id, logicalSource, current.invocation);
+    if (ordinal === undefined) {
+        throw new UsageError(`Installed scheduler binding ${JSON.stringify(id)} cannot be attributed to an exact schedule ordinal; refusing removal.`, "RESOURCE_ALREADY_EXISTS");
+    }
+    return Object.freeze({
+        kind: "remove",
+        id,
+        nativeId,
+        expected: freezeRemovalExpectation({
+            state: "present",
+            bindingId: id,
+            nativeId,
+            logicalSource,
+            ordinal,
+            invocation: current.invocation,
+            fingerprint: priorFingerprint,
+        }),
+        ...(current.ownerBundlePath !== undefined ? { ownerBundlePath: current.ownerBundlePath } : {}),
     });
 }
 function exactInstalledNativeId(logicalId, current, artifacts) {
@@ -190,10 +206,17 @@ export function assertSchedulerNativeArtifactOwnership(desired, installed) {
         const wanted = desiredByKey.get(key);
         if (!wanted)
             continue;
-        if (artifact.nativeId !== schedulerBindingNativeId(wanted) ||
-            artifact.bindingId !== wanted.id ||
-            artifact.invocation === undefined ||
-            !sameInvocation(artifact.invocation, wanted.invocation)) {
+        // Re-derive ownership from the artifact's own invocation content (not the
+        // caller-supplied `bindingId` label) so a proven owner whose invocation
+        // no longer matches the desired shape is an UPDATE, not a refusal — that
+        // reconciliation happens below in finalizeSchedulerSyncPlan. An artifact
+        // whose invocation content does not actually prove it belongs to
+        // `wanted` (unproven, malformed, or a different logical owner) is still
+        // a genuine collision.
+        const provenBindingId = artifact.invocation !== undefined
+            ? schedulerNativeArtifactOwner(artifact.nativeId, artifact.invocation)?.logicalId
+            : undefined;
+        if (artifact.nativeId !== schedulerBindingNativeId(wanted) || provenBindingId !== wanted.id) {
             throw nativeArtifactCollision(desiredArtifact(wanted), artifact);
         }
     }
@@ -252,12 +275,17 @@ async function compileDesiredSourceSet(input, collector) {
     const failures = [];
     await compileTaskSources(input, collector, bindings, failures);
     await compileWorkflowSources(input, collector, bindings, executableWorkflows, failures);
-    if (failures.length > 0) {
-        throw new UsageError(`Scheduler sync rejected the desired source set before mutation:\n${failures.map((failure) => `- ${failure}`).join("\n")}`, "TASK_SOURCE_INVALID");
-    }
+    // Degrade, don't reject (#867): one source that fails to parse/prepare no
+    // longer poisons the whole desired set — it is dropped from `desired` and
+    // reported here instead, so every OTHER task/workflow still reconciles.
+    // Genuinely cross-cutting integrity violations (duplicate ids, native
+    // artifact ownership conflicts, an incoherent backend inspection) are
+    // asserted separately in `finalizeSchedulerSyncPlan` and still hard-fail
+    // the whole sync — this only relaxes the per-source parse/prepare gate.
     return Object.freeze({
         desired: Object.freeze(bindings),
         executableWorkflows: Object.freeze(executableWorkflows.sort((left, right) => compareCodePoints(left.ref, right.ref))),
+        failures: Object.freeze(failures.sort((left, right) => compareCodePoints(left.path, right.path))),
     });
 }
 async function compileTaskSources(input, collector, out, failures) {
@@ -269,6 +297,7 @@ async function compileTaskSources(input, collector, out, failures) {
         const relative = guarded.relativePath;
         const conceptId = relative.slice(0, -4);
         const id = input.adapterId === "akm-task" ? conceptId : path.basename(sourcePath, ".yml");
+        const qualifiedRefForFailure = makeBundleRef(input.bundleName, conceptId);
         try {
             const physicalIdentity = guarded.physicalIdentity;
             const priorOwner = physicalOwners.get(physicalIdentity);
@@ -356,7 +385,7 @@ async function compileTaskSources(input, collector, out, failures) {
             }
         }
         catch (cause) {
-            failures.push(taskFailure(sourcePath, cause));
+            failures.push(taskFailure(sourcePath, qualifiedRefForFailure, cause));
         }
     }
 }
@@ -365,6 +394,8 @@ async function compileWorkflowSources(input, collector, out, evidence, failures)
         return;
     const lookups = enumerateWorkflowLookups(input, collector, failures);
     for (const [canonicalName, sources] of lookups) {
+        const failurePath = sources[0]?.sourcePath ?? canonicalName;
+        const failureRef = makeBundleRef(input.bundleName, input.adapterId === "akm" ? `workflows/${canonicalName}` : canonicalName);
         try {
             if (sources.length > 1) {
                 throw new WorkflowSourceCollisionError(input.adapterId === "akm" ? `workflows/${canonicalName}` : canonicalName, sources.map((source) => source.relativePath));
@@ -427,7 +458,7 @@ async function compileWorkflowSources(input, collector, out, evidence, failures)
             }
         }
         catch (cause) {
-            failures.push(errorMessage(cause));
+            failures.push(workflowFailure(failurePath, failureRef, cause));
         }
     }
 }
@@ -456,7 +487,7 @@ function enumerateWorkflowLookups(input, collector, failures) {
         const stem = authoredName.slice(0, -extension.length).toLowerCase();
         const nestedSuffix = WORKFLOW_EXTENSIONS.find((suffix) => stem.endsWith(suffix));
         if (nestedSuffix) {
-            failures.push(errorMessage(new WorkflowSourceNameError(guarded.relativePath, nestedSuffix)));
+            failures.push(workflowFailure(sourcePath, undefined, new WorkflowSourceNameError(guarded.relativePath, nestedSuffix)));
             continue;
         }
         const canonicalName = canonicalizeWorkflowName(authoredName);
@@ -529,9 +560,13 @@ function assertUniqueInstalledIds(installed) {
         seen.add(binding.id);
     }
 }
-function taskFailure(file, cause) {
+function taskFailure(file, ref, cause) {
     const detail = taskSourceErrorDetail(cause);
-    return detail === errorMessage(cause) ? `${file}: ${detail}` : detail;
+    const reason = detail === errorMessage(cause) ? `${file}: ${detail}` : detail;
+    return Object.freeze({ path: file, ref, reason });
+}
+function workflowFailure(file, ref, cause) {
+    return Object.freeze({ path: file, ...(ref ? { ref } : {}), reason: errorMessage(cause) });
 }
 function errorMessage(cause) {
     return cause instanceof Error ? cause.message : String(cause);

package/dist/tasks/source/bounded-document.js

@@ -53,13 +53,14 @@ import { EXECUTION_MAX_TIMEOUT_MS } from "../../execution/limits.js";
 import { snapshotStrictRecord } from "../../execution/record.js";
 import { WORKFLOW_ENV_VAR_NAME_PATTERN } from "../../workflows/resource-limits.js";
 // ── Resource bounds (D2-N4: owned here, re-exported by source-v3.ts) ───────
-export const TASK_V3_MAX_SOURCE_BYTES = 1024 * 1024;
 export const TASK_V3_MAX_JSON_DEPTH = 64;
 export const TASK_V3_MAX_JSON_NODES = 10_000;
 export const TASK_V3_MAX_COLLECTION_ITEMS = 1024;
 export const TASK_V3_MAX_OBJECT_KEYS = 256;
 export const TASK_V3_MAX_STRING_BYTES = 256 * 1024;
 export const TASK_V3_MAX_SCHEDULES = 64;
+/** Max entries in a task's `redact:` env-name list. */
+export const TASK_V3_MAX_REDACT_NAMES = 32;
 export function own(value, key) {
     return Object.hasOwn(value, key);
 }
@@ -414,9 +415,6 @@ export function readBoundedTaskSourceYaml(input, options) {
     if (typeof input.yaml !== "string") {
         throw new UsageError(`Invalid ${sourceLabel} at ${input.filePath}: source must be a string.`, "TASK_SOURCE_INVALID");
     }
-    if (utf8Bytes(input.yaml) > TASK_V3_MAX_SOURCE_BYTES) {
-        throw new UsageError(`Invalid ${sourceLabel} at ${input.filePath}: source exceeds the 1 MiB (${TASK_V3_MAX_SOURCE_BYTES}-byte) resource limit.`, "TASK_SOURCE_INVALID");
-    }
     const lineCounter = new LineCounter();
     let document;
     try {

package/dist/tasks/source/task-source-v3-frozen.js

@@ -42,8 +42,8 @@ import { parseBuiltinCommandAction } from "../../commands/command/builtin-action
 import { bundleRefToString, parseBundleRef } from "../../core/asset/asset-ref.js";
 import { UsageError } from "../../core/errors.js";
 import { checkJsonSchemaDefinition } from "../../core/json-schema.js";
-import { WORKFLOW_ENV_VAR_NAME_PATTERN, WORKFLOW_MAX_EXEC_PASS_ENV, WORKFLOW_MAX_RETRIES, } from "../../workflows/resource-limits.js";
-import { asRecord, checkKeys, cloneBoundedJson, noGithubExpression, own, parseEnvironment, parseStringArray, parseTimeout, parseTools, presentJsonValue, readBoundedTaskSourceYaml, sourceError, stringField, TASK_V3_MAX_SCHEDULES, validateWorkingDirectory, } from "./bounded-document.js";
+import { WORKFLOW_ENV_VAR_NAME_PATTERN } from "../../workflows/resource-limits.js";
+import { asRecord, checkKeys, cloneBoundedJson, noGithubExpression, own, parseEnvironment, parseStringArray, parseTimeout, parseTools, presentJsonValue, readBoundedTaskSourceYaml, sourceError, stringField, TASK_V3_MAX_REDACT_NAMES, TASK_V3_MAX_SCHEDULES, validateWorkingDirectory, } from "./bounded-document.js";
 export const TASK_V3_SCHEMA_VERSION = 3;
 /** Closed authoring vocabulary. Arbitrary GitHub `{0}` shell templates are not accepted. */
 export const TASK_V3_HOST_SHELLS = ["bash", "sh", "zsh", "pwsh", "powershell", "cmd"];
@@ -146,7 +146,7 @@ function parseAkm(value, ctx) {
         out.timeout = parseTimeout(input.timeout, ctx);
     if (own(input, "redact")) {
         const names = parseStringArray(input.redact, ctx, ["akm", "redact"], {
-            max: WORKFLOW_MAX_EXEC_PASS_ENV,
+            max: TASK_V3_MAX_REDACT_NAMES,
             pattern: WORKFLOW_ENV_VAR_NAME_PATTERN,
         });
         if (new Set(names).size !== names.length)
@@ -160,10 +160,8 @@ function parseAkm(value, ctx) {
         out.maxSteps = input.maxSteps;
     }
     if (own(input, "maxRetries")) {
-        if (!Number.isSafeInteger(input.maxRetries) ||
-            input.maxRetries < 0 ||
-            input.maxRetries > WORKFLOW_MAX_RETRIES) {
-            sourceError(ctx, ["akm", "maxRetries"], `must be an integer from 0 through ${WORKFLOW_MAX_RETRIES}.`);
+        if (!Number.isSafeInteger(input.maxRetries) || input.maxRetries < 0) {
+            sourceError(ctx, ["akm", "maxRetries"], "must be a non-negative safe integer.");
         }
         out.maxRetries = input.maxRetries;
     }

package/dist/tasks/source/task-source-v4.js

@@ -42,10 +42,10 @@ import { applyInputDefaults, INPUT_NAME_PATTERN, validateInputs, } from "../../e
 import { EXECUTION_MAX_TIMEOUT_MS } from "../../execution/limits.js";
 import { classifyTargetRef } from "../../execution/target-ref.js";
 import { detectSecretShapedParams } from "../../workflows/exec/param-secrets.js";
-import { WORKFLOW_ENV_VAR_NAME_PATTERN, WORKFLOW_MAX_EXEC_PASS_ENV, WORKFLOW_MAX_PARAMS, WORKFLOW_MAX_RETRIES, WORKFLOW_MAX_SCHEMA_BYTES, } from "../../workflows/resource-limits.js";
+import { WORKFLOW_ENV_VAR_NAME_PATTERN, WORKFLOW_MAX_SCHEMA_BYTES } from "../../workflows/resource-limits.js";
 import { TASK_V3_HOST_SHELLS, TASK_V3_MAX_SCHEDULES } from "../source-v3.js";
 import { TASK_RUN_RESERVED_FLAG_NAMES, TASK_RUN_SELF_DIAGNOSED_FLAGS } from "../task-run-reserved-flags.js";
-import { asRecord, checkKeys, cloneBoundedJson, noGithubExpression, own, parseEnvironment, parseStringArray, presentJsonValue, readBoundedTaskSourceYaml, sourceError, stringField, utf8Bytes, validateWorkingDirectory, } from "./bounded-document.js";
+import { asRecord, checkKeys, cloneBoundedJson, noGithubExpression, own, parseEnvironment, parseStringArray, presentJsonValue, readBoundedTaskSourceYaml, sourceError, stringField, TASK_V3_MAX_REDACT_NAMES, utf8Bytes, validateWorkingDirectory, } from "./bounded-document.js";
 // ── Closed constants (D1, D2-N3, D2-N7) ─────────────────────────────────────
 export const TASK_SOURCE_V4_VERSION = 4;
 /** The exact, closed top-level key set (D2-N7) — `akm` and `on` are deliberately absent. */
@@ -298,7 +298,7 @@ function parseExecutionControls(input, ctx) {
         out.timeout = parseTimeoutTopLevel(input.timeout, ctx);
     if (own(input, "redact")) {
         const names = parseStringArray(input.redact, ctx, ["redact"], {
-            max: WORKFLOW_MAX_EXEC_PASS_ENV,
+            max: TASK_V3_MAX_REDACT_NAMES,
             pattern: WORKFLOW_ENV_VAR_NAME_PATTERN,
         });
         if (new Set(names).size !== names.length)
@@ -312,10 +312,8 @@ function parseExecutionControls(input, ctx) {
         out.maxSteps = input.maxSteps;
     }
     if (own(input, "maxRetries")) {
-        if (!Number.isSafeInteger(input.maxRetries) ||
-            input.maxRetries < 0 ||
-            input.maxRetries > WORKFLOW_MAX_RETRIES) {
-            sourceError(ctx, ["maxRetries"], `must be an integer from 0 through ${WORKFLOW_MAX_RETRIES}.`);
+        if (!Number.isSafeInteger(input.maxRetries) || input.maxRetries < 0) {
+            sourceError(ctx, ["maxRetries"], "must be a non-negative safe integer.");
         }
         out.maxRetries = input.maxRetries;
     }
@@ -376,9 +374,6 @@ function parseInputDeclaration(name, raw, ctx) {
 function parseInputDeclarations(value, ctx) {
     const input = asRecord(value, ctx, ["inputs"]);
     const names = Object.keys(input);
-    if (names.length > WORKFLOW_MAX_PARAMS) {
-        sourceError(ctx, ["inputs"], `accepts at most ${WORKFLOW_MAX_PARAMS} declared inputs.`);
-    }
     const result = {};
     for (const name of names) {
         if (!INPUT_NAME_PATTERN.test(name)) {

package/dist/tasks/source/task-to-v3.js

@@ -7,9 +7,9 @@ import path from "node:path";
 import { LineCounter, parseDocument, stringify as stringifyYaml } from "yaml";
 import { bundleRefToString, parseBundleRef } from "../../core/asset/asset-ref.js";
 import { formatExtraParamsIssue, validateExtraParams } from "../../core/extra-params.js";
-import { WORKFLOW_ENV_VAR_NAME_PATTERN, WORKFLOW_MAX_EXEC_PASS_ENV, WORKFLOW_MAX_RETRIES, WORKFLOW_MAX_TIMEOUT_MS, } from "../../workflows/resource-limits.js";
+import { WORKFLOW_ENV_VAR_NAME_PATTERN, WORKFLOW_MAX_TIMEOUT_MS } from "../../workflows/resource-limits.js";
 import { validateTaskId } from "../task-id.js";
-import { assertBoundedTaskYamlDocument, TASK_V3_MAX_SOURCE_BYTES } from "./bounded-document.js";
+import { assertBoundedTaskYamlDocument, TASK_V3_MAX_REDACT_NAMES } from "./bounded-document.js";
 import { classifyTaskV3Uses, parseTaskV3Yaml } from "./task-source-v3-frozen.js";
 import { parseTaskSourceV4 } from "./task-source-v4.js";
 const V2_KEYS = new Set([
@@ -61,6 +61,27 @@ const SHELL_ASSIGNMENT_WORD = /^[A-Za-z_][A-Za-z0-9_]*=/;
 function shellStableV2Executable(executable) {
     return executable === "akm" || executable.includes("/");
 }
+/**
+ * `env NAME=value... cmd args...` is env(1) itself resolving and exec'ing
+ * `cmd` via its own PATH search — that lookup happens inside env's execvp()
+ * regardless of whether env was launched by direct execve (v2) or by a host
+ * shell (v3 `run:`). The shell-vs-argv divergence `shellStableV2Executable`
+ * guards against (bare names shadowed by shell aliases/builtins/functions)
+ * therefore does not apply to whatever env ultimately invokes, so skip past
+ * a leading `env` and its `NAME=value` assignments to find the real target.
+ * Returns the original tokens, unchanged, when there is no such target
+ * (e.g. `env` with nothing after its assignments).
+ */
+function skipEnvAssignmentPrefix(tokens) {
+    if (tokens[0] !== "env")
+        return { tokens, envWrapped: false };
+    let index = 1;
+    while (index < tokens.length && SHELL_ASSIGNMENT_WORD.test(tokens[index]))
+        index += 1;
+    if (index >= tokens.length)
+        return { tokens, envWrapped: false };
+    return { tokens: tokens.slice(index), envWrapped: true };
+}
 const KNOWN_PROMPT_REF_FAMILIES = new Set([
     "agents",
     "commands",
@@ -81,15 +102,6 @@ function hash(bytes) {
     return crypto.createHash("sha256").update(bytes).digest("hex");
 }
 function base(input) {
-    const inspectionIdentity = input.inspectionIdentity
-        ? Object.freeze({
-            file: Object.freeze({ ...input.inspectionIdentity.file }),
-            root: Object.freeze({ ...input.inspectionIdentity.root }),
-            ...(input.inspectionIdentity.bundleRoot
-                ? { bundleRoot: Object.freeze({ ...input.inspectionIdentity.bundleRoot }) }
-                : {}),
-        })
-        : undefined;
     return {
         filePath: input.filePath,
         before: Buffer.from(input.bytes),
@@ -98,7 +110,6 @@ function base(input) {
         writable: input.writable,
         ...(input.onDiskWritable !== undefined ? { onDiskWritable: input.onDiskWritable } : {}),
         ...(input.containmentRoot ? { containmentRoot: input.containmentRoot } : {}),
-        ...(inspectionIdentity ? { inspectionIdentity } : {}),
     };
 }
 function blocked(input, reason, detail) {
@@ -124,9 +135,6 @@ function optionalString(value, label) {
     return exactString(value, label);
 }
 function parseLegacyTaskYaml(input) {
-    if (input.bytes.byteLength > TASK_V3_MAX_SOURCE_BYTES) {
-        throw new Error(`task YAML exceeds the 1 MiB (${TASK_V3_MAX_SOURCE_BYTES}-byte) source resource limit`);
-    }
     let source;
     try {
         source = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(input.bytes);
@@ -178,7 +186,7 @@ function validateCommonV2(data) {
     }
     if (data.redact !== undefined && data.redact !== null) {
         if (!Array.isArray(data.redact) ||
-            data.redact.length > WORKFLOW_MAX_EXEC_PASS_ENV ||
+            data.redact.length > TASK_V3_MAX_REDACT_NAMES ||
             data.redact.some((entry) => typeof entry !== "string" || !WORKFLOW_ENV_VAR_NAME_PATTERN.test(entry))) {
             throw new Error("redact must contain only bounded environment variable names");
         }
@@ -310,10 +318,8 @@ function migratedObject(data) {
             akm.maxSteps = data.maxSteps;
         }
         if (data.maxRetries !== undefined && data.maxRetries !== null) {
-            if (!Number.isSafeInteger(data.maxRetries) ||
-                data.maxRetries < 0 ||
-                data.maxRetries > WORKFLOW_MAX_RETRIES) {
-                throw new Error(`maxRetries must be from 0 through ${WORKFLOW_MAX_RETRIES}`);
+            if (!Number.isSafeInteger(data.maxRetries) || data.maxRetries < 0) {
+                throw new Error("maxRetries must be a non-negative integer");
             }
             akm.maxRetries = data.maxRetries;
         }
@@ -348,8 +354,9 @@ function migratedObject(data) {
         if (tokens.length === 0 || tokens.some((token) => !SAFE_V2_COMMAND_TOKEN.test(token))) {
             return "shell-operators-change-v2-literal-argv-semantics";
         }
-        const executable = tokens[0];
-        if (SHELL_ASSIGNMENT_WORD.test(executable) || !shellStableV2Executable(executable)) {
+        const { tokens: targetTokens, envWrapped } = skipEnvAssignmentPrefix(tokens);
+        const executable = targetTokens[0];
+        if (SHELL_ASSIGNMENT_WORD.test(executable) || (!envWrapped && !shellStableV2Executable(executable))) {
             return "shell-command-resolution-changes-v2-literal-argv-semantics";
         }
         output.run = tokens.join(" ");

package/dist/tasks/source/task-to-v4.js

@@ -18,7 +18,7 @@
 import crypto from "node:crypto";
 import path from "node:path";
 import { LineCounter, parseDocument, stringify as stringifyYaml } from "yaml";
-import { assertBoundedTaskYamlDocument, TASK_V3_MAX_SOURCE_BYTES } from "./bounded-document.js";
+import { assertBoundedTaskYamlDocument } from "./bounded-document.js";
 import { classifyTaskV3Uses } from "./task-source-v3-frozen.js";
 import { parseTaskSourceV4 } from "./task-source-v4.js";
 /** The closed v3 top-level key set (`src/tasks/source-v3.ts`'s own, vendored — not exported there). */
@@ -76,15 +76,6 @@ function causeMessage(cause) {
     return cause instanceof Error ? cause.message : String(cause);
 }
 function base(input) {
-    const inspectionIdentity = input.inspectionIdentity
-        ? Object.freeze({
-            file: Object.freeze({ ...input.inspectionIdentity.file }),
-            root: Object.freeze({ ...input.inspectionIdentity.root }),
-            ...(input.inspectionIdentity.bundleRoot
-                ? { bundleRoot: Object.freeze({ ...input.inspectionIdentity.bundleRoot }) }
-                : {}),
-        })
-        : undefined;
     return {
         filePath: input.filePath,
         before: Buffer.from(input.bytes),
@@ -93,7 +84,6 @@ function base(input) {
         writable: input.writable,
         ...(input.onDiskWritable !== undefined ? { onDiskWritable: input.onDiskWritable } : {}),
         ...(input.containmentRoot ? { containmentRoot: input.containmentRoot } : {}),
-        ...(inspectionIdentity ? { inspectionIdentity } : {}),
     };
 }
 function blocked(input, reason, detail) {
@@ -124,9 +114,6 @@ function exactString(value, label, nonempty = false) {
  * away (C-N1).
  */
 function parseV3RawYaml(input) {
-    if (input.bytes.byteLength > TASK_V3_MAX_SOURCE_BYTES) {
-        throw new Error(`task YAML exceeds the 1 MiB (${TASK_V3_MAX_SOURCE_BYTES}-byte) source resource limit`);
-    }
     let source;
     try {
         source = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(input.bytes);

package/dist/tasks/source-v3.js

@@ -1,13 +1,13 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-import { TASK_V3_MAX_SCHEDULES, TASK_V3_MAX_SOURCE_BYTES } from "./source/bounded-document.js";
+import { TASK_V3_MAX_SCHEDULES } from "./source/bounded-document.js";
 // D2-N4 (spec docs/plans/specs/p2a-task-source-v4.md §3.1, §9): re-exported
-// at their EXISTING names so no importer changes. Only the two names a
-// surviving `src` consumer still imports (task-source-v4.ts,
-// commands/tasks/tasks.ts) — every other bounded-document re-export this
-// file used to carry was dropped in P4 §3.2.3.
-export { TASK_V3_MAX_SCHEDULES, TASK_V3_MAX_SOURCE_BYTES };
+// at its EXISTING name so no importer changes. The one name a surviving
+// `src` consumer still imports (task-source-v4.ts) — every other
+// bounded-document re-export this file used to carry was dropped in P4
+// §3.2.3.
+export { TASK_V3_MAX_SCHEDULES };
 export const TASK_EXTENSION = ".yml";
 export const TASK_NEAR_MISS_EXTENSION = ".yaml";
 /** Explain why the near-miss `.yaml` spelling is not a task source. */

package/dist/workflows/exec/native-executor.js

@@ -115,7 +115,7 @@ import { appendEvent } from "../../core/events.js";
 import { validateJsonSchemaSubset } from "../../core/json-schema.js";
 import { runStructured } from "../../core/structured.js";
 import { warn } from "../../core/warn.js";
-import { assertFrozenDirectoryIdentity } from "../../execution/directory-identity.js";
+import { assertFrozenDirectoryContained } from "../../execution/directory-identity.js";
 import { assertFrozenExecutableIdentity } from "../../execution/executable-identity.js";
 import { withWorkflowRunsConnection, withWorkflowRunsRepo, } from "../../storage/repositories/workflow-runs-repository.js";
 import { materializeFrozenWorkflowEnvironment } from "../ir/environment-v4.js";
@@ -132,7 +132,7 @@ import { collectWorkflowDispatchSensitiveValues, redactUnitOutcome } from "./dis
 // and the process-outcome → failure-reason mapping.
 import { runExecUnit } from "./exec-unit.js";
 import { mergeLoweringNotices } from "./lowering-notices.js";
-import { LIFETIME_UNIT_CAP, scheduleUnits, UnitCapExceededError } from "./scheduler.js";
+import { scheduleUnits } from "./scheduler.js";
 // Shared step semantics — the ONE implementation consumed by the engine
 // (this module + run-workflow.ts) on both the fresh-execution and the resume
 // path. This module dispatches; step-work.ts owns the pure decisions.
@@ -142,13 +142,13 @@ import { cleanupFrozenScript, frozenScriptCommand, materializeFrozenScript } fro
 import { enqueueUnitWrite } from "./unit-writer.js";
 import { assertGitWorkTree, cleanupUnitWorktree, createUnitWorktree } from "./worktree.js";
 /**
- * Mutable per-step dispatch budget: the lifetime unit cap PLUS the declared
- * run-level budget ceilings (`budget.max_units` / `budget.max_tokens`,
- * addendum R2). Consumed once per journaled dispatch attempt (including
- * retries); durable-row reuses never touch it — the peer-review fix that
- * keeps large partially-completed fan-outs resumable instead of tripping the
- * cap on `journaled + items`. Token usage accumulates per actual dispatch on
- * top of the journal-seeded run total (reused rows' tokens are already in the
+ * Mutable per-step dispatch budget: the declared run-level budget ceilings
+ * (`budget.max_units` / `budget.max_tokens`, addendum R2). Consumed once per
+ * journaled dispatch attempt (including retries); durable-row reuses never
+ * touch it — the peer-review fix that keeps large partially-completed
+ * fan-outs resumable instead of tripping a pre-batch check on
+ * `journaled + items`. Token usage accumulates per actual dispatch on top of
+ * the journal-seeded run total (reused rows' tokens are already in the
  * seed). Check-and-increment is synchronous, so concurrent units cannot race
  * it; crossing a declared ceiling fires `onExceeded` ONCE (the executor's
  * chained AbortController), aborting pending and in-flight dispatches.
@@ -157,8 +157,6 @@ class DispatchBudget {
     used;
     /** Run-total tokens: journal-seeded input + this step's dispatch usage. */
     tokens;
-    /** Set (once) when a dispatch was refused; the step fails with this message. */
-    capMessage;
     /** Set (once) when a declared budget ceiling was hit; the step fails hard with it. */
     budgetMessage;
     maxUnits;
@@ -185,10 +183,6 @@ class DispatchBudget {
                 `against the workflow's declared budget.max_tokens of ${this.maxTokens} — refusing further dispatch.`);
             return false;
         }
-        if (this.used >= LIFETIME_UNIT_CAP) {
-            this.capMessage ??= new UnitCapExceededError(LIFETIME_UNIT_CAP).message;
-            return false;
-        }
         this.used++;
         return true;
     }
@@ -343,7 +337,7 @@ async function prepareStepDispatchPrerequisites(input) {
         const target = workUnits[0]?.frozenTarget;
         const frozenCwd = target && "cwdIdentity" in target ? target.cwdIdentity : undefined;
         if (frozenCwd)
-            assertFrozenDirectoryIdentity(frozenCwd);
+            assertFrozenDirectoryContained(frozenCwd);
         const base = frozenCwd?.realRoot ?? ctx.workDir ?? process.cwd();
         const preflightWorktree = ctx.preflightWorktree ?? assertGitWorkTree;
         const gitError = preflightWorktree(base);
@@ -464,15 +458,12 @@ async function executeStepPlanInConnection(plan, ctx) {
     // journal-write failures must not erase notices already observed from real
     // dispatches; durable row reuses naturally contribute none.
     const notices = mergeLoweringNotices(...outcomes.map((outcome) => outcome?.notices));
-    // Declared budget ceilings and the lifetime cap are hard backstops: a step
-    // that hit one FAILS regardless of on_error policy (a capped run must never
-    // quietly pass its gate). The budget message names WHICH ceiling tripped.
+    // A declared budget ceiling is a hard backstop: a step that hit one FAILS
+    // regardless of on_error policy (a capped run must never quietly pass its
+    // gate). The budget message names WHICH ceiling tripped.
     if (budget.budgetMessage) {
         return { ...failedStep(budget.used, budget.budgetMessage, notices), tokensUsed: budget.tokens };
     }
-    if (budget.capMessage) {
-        return { ...failedStep(budget.used, budget.capMessage, notices), tokensUsed: budget.tokens };
-    }
     const units = outcomes.map((outcome, index) => outcome ?? {
         unitId: workUnits[index].unitId,
         ok: false,
@@ -597,17 +588,16 @@ async function runUnit(input) {
             });
         }
         const attemptId = attemptIdFor(attempt);
-        // Lifetime cap + declared budget ceilings, consumed per ACTUAL dispatch
-        // (reuses above returned before reaching here). Refusal fails this unit
-        // without journaling a row — nothing was dispatched — and the sticky
-        // capMessage/budgetMessage fails the step.
+        // Declared budget ceilings, consumed per ACTUAL dispatch (reuses above
+        // returned before reaching here). Refusal fails this unit without
+        // journaling a row — nothing was dispatched — and the sticky
+        // budgetMessage fails the step.
         if (!input.budget.tryConsume()) {
-            const budgetHit = input.budget.budgetMessage !== undefined;
             return (outcome ?? {
                 unitId,
                 ok: false,
-                failureReason: budgetHit ? "budget_exceeded" : "unit_cap_exceeded",
-                error: input.budget.budgetMessage ?? input.budget.capMessage ?? "lifetime unit cap exceeded",
+                failureReason: "budget_exceeded",
+                error: input.budget.budgetMessage ?? "budget exceeded",
             });
         }
         outcome = await dispatchJournaledAttempt({
@@ -1055,7 +1045,7 @@ async function dispatchUnit(request, dispatcher) {
 export const defaultUnitDispatcher = async (request, feedback) => {
     const frozenTarget = request.frozenTarget;
     if (frozenTarget.kind === "script") {
-        assertFrozenDirectoryIdentity(frozenTarget.cwdIdentity);
+        assertFrozenDirectoryContained(frozenTarget.cwdIdentity);
         if (frozenTarget.executable) {
             assertFrozenExecutableIdentity(frozenTarget.executable, `unit ${request.unitId} executable`);
         }
@@ -1099,7 +1089,7 @@ export const defaultUnitDispatcher = async (request, feedback) => {
     }
     if (frozenTarget.kind === "shell") {
         if (frozenTarget.cwdIdentity)
-            assertFrozenDirectoryIdentity(frozenTarget.cwdIdentity);
+            assertFrozenDirectoryContained(frozenTarget.cwdIdentity);
         if (frozenTarget.executable) {
             assertFrozenExecutableIdentity(frozenTarget.executable, `unit ${request.unitId} executable`);
         }

package/dist/workflows/exec/run-workflow.js

@@ -332,12 +332,11 @@ function workflowSummaryJudge(options, stepPlan, signal, owner) {
     return frozenSummaryJudge(stepPlan.gate.frozenJudge, signal, options.dispatcher ?? defaultUnitDispatcher, owner, options.eventSource);
 }
 /**
- * Seed the lifetime unit cap AND the budget ceilings from the journal so
- * both are truly per-RUN: a resumed or re-invoked run must not restart the
- * runaway backstop — or a declared `budget` — at zero. The append-only attempt
- * journal is authoritative: dispatch attempts count against
- * `budget.max_units`, and their known tokens count against
- * `budget.max_tokens`. Durable result reuse is free.
+ * Seed the declared budget ceilings from the journal so they are truly
+ * per-RUN: a resumed or re-invoked run must not restart a declared `budget`
+ * at zero. The append-only attempt journal is authoritative: dispatch
+ * attempts count against `budget.max_units`, and their known tokens count
+ * against `budget.max_tokens`. Durable result reuse is free.
  *
  * Gate-evaluation rows (`phase = "gate"`, journaled by the completion-gate
  * judge) are EXCLUDED from the seed: the live path never consumes