clinkx 0.2.3 → 1.0.0

package/clinkx-workflows/dist/workflow-tools.js

@@ -5,23 +5,27 @@
  * - Standalone STDIO server (ClinkSession child process backend)
  * - In-process integration (LocalClinkBackend via root ClinkX)
  *
- * The `registerWorkflowTools()` function registers three tools on a Server:
+ * The `registerWorkflowTools()` function registers five tools on a Server:
  * - run_workflow: start a new workflow execution
  * - resume_workflow: resume a failed/cancelled run
  * - list_workflows: list available workflow definitions
+ * - workflow_run_status: read workflow run progress/result
+ * - cancel_workflow: cancel a live or orphaned workflow run
  *
  * The caller provides a `createBackend` factory that determines how clink
  * calls are dispatched — either via child process or in-process.
  */
 import { CallToolRequestSchema, ListToolsRequestSchema, ErrorCode, McpError, } from "@modelcontextprotocol/sdk/types.js";
+import { existsSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
 import { loadWorkflow, listWorkflowCatalog } from "./loader.js";
 import { WorkflowEngine } from "./engine.js";
-import { WorkflowStateStore } from "./state.js";
+import { readRunStateForStatus, reapRunCancelled, WorkflowStateStore } from "./state.js";
+import { parseContextBuilderLifecycleStateV1, } from "./context-builder-lifecycle-contract.js";
 import { validateRunId } from "./run-id.js";
-import { getTemplatesPath } from "./config.js";
+import { getMaxPromptBytes, getRunStateDir, getTemplatesPath, getWorkflowsContextDefault, getWorkflowsContextDefaultCurator, getWorkflowsMaxConcurrentAsync, resolveWorkspaceRoot, } from "./config.js";
 import { WorkflowCancellationError, } from "./errors.js";
 import { shutdownCoordinator } from "./shutdown.js";
-import { basename } from "node:path";
 import { logger } from "./logger.js";
 import { createValidatorRegistry } from "./validators/index.js";
 import { deriveDecisiveFailure } from "./run-summary-derived.js";
@@ -29,20 +33,93 @@ import { buildRunSummaryOrUndefined, buildFailureRunSummary } from "./run-summar
 import { extractCard } from "./run-summary/cards/index.js";
 import { renderWorkflowReceipt } from "./workflow-receipt.js";
 import { supportsRuntimeMembers, COUNCIL_RUNTIME_MEMBER_WORKFLOWS, expandCouncilComposition } from "./council-expander.js";
+import { resolveWorkflowContextMode, WorkflowContextModeResolverError, } from "./context-mode-resolver.js";
+import { WorkflowDelegateValidationError } from "./delegate-validate.js";
+import { contextSearchTermsValidationError, contextSeedSourceValidationError, resolveSeedSource, } from "./seed-terms.js";
+import { LEGACY_PLAN_REVIEW_RECEIPTS_WORKFLOW_NAME, PLAN_REVIEW_RECEIPTS_WORKFLOW, admitCouncilPlanReview, assertPlanReviewPromptBudget, isPlanReviewRunState, } from "./plan-review/admission.js";
+import { PLAN_REVIEW_V1_CLI_NAMES } from "./plan-review/contract.js";
+import { buildCouncilPlanReviewDiscovery } from "./plan-review/discovery.js";
+import { expandCouncilPlanReview } from "./plan-review/expander.js";
+import { buildPlanReviewContextPolicy, findRejectedPlanContextAnchors, } from "./plan-review/context-policy.js";
+import { PLAN_SNAPSHOT_RELPATH, persistCanonicalPlanSnapshot, readCanonicalPlanSnapshot, writeExecutionContractSnapshot, } from "./plan-review/snapshot.js";
+import { deriveSeatMappings, reconstructPlanReviewCallBindings, } from "./plan-review/run-state.js";
+import { restorePlanReviewRun, } from "./plan-review/resume.js";
+import { PlanReviewStageError } from "./plan-review/stage-error.js";
+import { CouncilPlanReviewErrorSchema, createPlanReviewPublicationError, inspectPlanReviewPublication, } from "./plan-review/publication.js";
+import { validatePlanReviewCallBindings, validatePlanReviewPreparedInputPolicy, } from "./plan-review/runtime-policy.js";
+import { ContainedFilePolicyError, readContainedRelativeFile, } from "./contained-file.js";
+import { createDashboardRunReader } from "./dashboard/read-model.js";
+async function inspectLegacyWorkflowSessionLogGeneration(runDir, runId) {
+    try {
+        const result = await createDashboardRunReader().inspectGeneration?.(dirname(runDir), runId);
+        if (result?.kind === "present")
+            return result.runGeneration;
+        logger.debug({
+            run_id: runId,
+            reason: result === undefined ? "unsupported" : result.kind,
+        }, "workflow session-log generation unavailable; capture disabled");
+    }
+    catch {
+        logger.debug({ run_id: runId, reason: "inspection_failed" }, "workflow session-log generation unavailable; capture disabled");
+    }
+    return undefined;
+}
+/**
+ * Allowed roots for reading the caller's `plan_file`.
+ *
+ * Deliberately the workspace root ONLY. The state/artifact dirs are
+ * artifact-only roots — they are where runtime-owned output goes, never a
+ * source of reviewable plan text.
+ */
+function planFileAllowedRoots() {
+    return [resolveWorkspaceRoot()];
+}
+function createPreflightOnlyBackend(advertisedCliNames) {
+    return {
+        cliNames: [...(advertisedCliNames ?? [])],
+        roleNames: [],
+        isTerminated: false,
+        hasChildDied: false,
+        connect: async () => { },
+        callTool: async () => {
+            throw new Error("preflight-only backend cannot dispatch provider calls");
+        },
+        terminate: async () => { },
+    };
+}
 // ---------------------------------------------------------------------------
 // Admission control
 // ---------------------------------------------------------------------------
-let activeMutex = null;
-function acquireMutex(runId) {
-    if (activeMutex != null) {
-        throw new McpError(ErrorCode.InvalidRequest, `A workflow is already running (run_id: "${activeMutex.runId}", started: ${activeMutex.startedAt}). ` +
-            `Wait for it to complete or cancel it before starting another. ` +
-            `Only one workflow can run at a time per server instance.`);
-    }
-    activeMutex = { runId, startedAt: new Date().toISOString() };
+const activeRuns = new Map();
+/**
+ * In-process registry of AbortControllers for live async runs, keyed by run_id.
+ * cancel_workflow aborts the controller to drive the run's own cancellation
+ * unwind. Registered at async admission (foreground) and deleted in the detached
+ * run's finally (a delete on an absent key is a harmless no-op, so the
+ * synchronous run path is unaffected).
+ */
+const cancelRegistry = new Map();
+export function resolveWorkflowAsyncAdmissionCap(options) {
+    const injected = options?.asyncAdmissionCap;
+    if (typeof injected === "number" &&
+        Number.isSafeInteger(injected) &&
+        injected >= 1) {
+        return injected;
+    }
+    return getWorkflowsMaxConcurrentAsync();
+}
+function acquireMutex(runId, options) {
+    if (activeRuns.has(runId)) {
+        throw new McpError(ErrorCode.InvalidParams, `run_id ${runId} already running`);
+    }
+    const maxConcurrent = resolveWorkflowAsyncAdmissionCap(options);
+    if (activeRuns.size >= maxConcurrent) {
+        throw new McpError(ErrorCode.InvalidRequest, `max ${maxConcurrent} concurrent workflow(s); retry later`);
+    }
+    activeRuns.set(runId, { startedAt: new Date().toISOString() });
 }
-function releaseMutex() {
-    activeMutex = null;
+function releaseMutex(runId) {
+    activeRuns.delete(runId);
 }
 export function parseMembersOverride(raw, knownCliNames) {
     if (raw == null)
@@ -125,6 +202,44 @@ export function parseChairmanOverride(raw, knownCliNames) {
     }
     return trimmed;
 }
+/**
+ * Point a generic-council caller at the input shape the workflow actually takes.
+ *
+ * Appended by the boundary decorator wrapping the whole pre-mutex admission
+ * block, so it rides on ANY `InvalidParams` rejection of a generic-shaped
+ * `plan-review-receipts` request — not only the `members`/`chairman` roster
+ * gates. A generic `user_request`-shaped caller can trip several independent
+ * pre-state checks (the roster-override parsers themselves, the two roster
+ * gates, unknown `user_request`/`cb_delegate` variables, context-mode and root
+ * validation, the conditional `cb_task` seed, task-secret validation, and the
+ * missing typed `plan_review`); whichever fires first now names the
+ * destination, instead of the caller re-submitting and being told something
+ * different each round trip.
+ *
+ * The decorator is gated on a RAW-`args` shape predicate, not on parsed
+ * values, specifically because a parser throw means no parsed value exists
+ * yet: `parseMembersOverride` rejects `[]` and unknown `cli_name`s before
+ * `parsedMembers` is ever bound, and that is exactly a case the hint must
+ * cover.
+ *
+ * Deliberately a HINT appended to the existing message, not a reordered check.
+ * Hoisting the `plan_review` requirement above the roster gate would mask
+ * malformed roster overrides behind a missing-contract error, and split the
+ * requirement from its authoritative mirror in `admitCouncilPlanReview`. The
+ * decorator changes no ordering, so that reasoning still holds.
+ */
+function planReviewShapeHint() {
+    return (`. ${PLAN_REVIEW_RECEIPTS_WORKFLOW} takes a typed "plan_review" contract instead:` +
+        ` the roster is plan_review.seats[] and the chairman is plan_review.chairman_seat` +
+        ` (a seat_id, not an adapter name). It declares neither a "user_request" nor a` +
+        ` "cb_delegate" variable, and its "cb_task" seed is conditionally required:` +
+        ` trimmed-nonblank whenever context preflight is available (the default` +
+        ` deployment), and genuinely optional only on a server where preflight is` +
+        ` unavailable. It is driven by the plan-review-loop skill, not a generic` +
+        ` council template. For a generic members/chairman/user_request plan review` +
+        ` without the typed contract, use the "council-plan-review" workflow; the` +
+        ` typed plan_review contract belongs only to "plan-review-receipts".`);
+}
 // ---------------------------------------------------------------------------
 // Variable validation (6-6)
 // ---------------------------------------------------------------------------
@@ -136,7 +251,8 @@ function formatExpectedVariables(schema) {
     }
     return parts.length > 0 ? `Expected variables: ${parts.join(", ")}` : "";
 }
-function validateVariables(supplied, schema) {
+/** @internal Shared with the compiled producer-fixture admission check. */
+export function validateVariables(supplied, schema) {
     const resolved = {};
     const errors = [];
     for (const [name, def] of Object.entries(schema)) {
@@ -174,6 +290,65 @@ function validateVariables(supplied, schema) {
     }
     return resolved;
 }
+function validateContextBuilderAnchorSufficiency(variables, runner, contextDefault, defaultCurator) {
+    if (runner == null) {
+        return undefined;
+    }
+    let policy;
+    try {
+        // Throws on an invalid cb_context_mode / cb_delegate combination (surfaced
+        // below as -32602). The resolved policy is also returned for admission-time
+        // checks that must stay inert under soft off.
+        policy = resolveWorkflowContextMode(variables["cb_context_mode"], contextDefault, true, variables["cb_delegate"], defaultCurator);
+    }
+    catch (error) {
+        if (error instanceof WorkflowContextModeResolverError ||
+            error instanceof WorkflowDelegateValidationError) {
+            throw new McpError(ErrorCode.InvalidParams, error.message);
+        }
+        throw error;
+    }
+    const cbRoots = readStringArrayForAnchorCheck(variables["cb_roots"]);
+    // Eager allowlist validation: explicit cb_roots are validated whenever
+    // provided, including soft off. Out-of-allowlist roots are rejected at the
+    // boundary as -32602. The disabled hard kill never reaches this validator.
+    if (cbRoots.length > 0) {
+        try {
+            runner.assertRootsAllowed(cbRoots);
+        }
+        catch (err) {
+            throw new McpError(ErrorCode.InvalidParams, err instanceof Error ? err.message : String(err));
+        }
+    }
+    // policy.preflightDisabled is unreachable here: this validator early-returns
+    // when runner == null and always resolves with preflightEnabled:true, so the
+    // resolver never returns a disabled policy on this path.
+    return policy;
+}
+function validateContextSeedSourceAtAdmission(variables, policy) {
+    if (policy == null) {
+        return;
+    }
+    const cbTask = typeof variables["cb_task"] === "string"
+        ? variables["cb_task"]
+        : undefined;
+    const userRequest = typeof variables["user_request"] === "string"
+        ? variables["user_request"]
+        : undefined;
+    const seedSource = resolveSeedSource(cbTask, userRequest);
+    const seedSourceError = contextSeedSourceValidationError(seedSource);
+    if (seedSourceError != null) {
+        throw new McpError(ErrorCode.InvalidParams, seedSourceError);
+    }
+    const searchTerms = readStringArrayForAnchorCheck(variables["cb_search_terms"]);
+    const searchTermsError = contextSearchTermsValidationError(searchTerms);
+    if (searchTermsError != null) {
+        throw new McpError(ErrorCode.InvalidParams, searchTermsError);
+    }
+}
+function readStringArrayForAnchorCheck(value) {
+    return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : [];
+}
 function validateVariableType(name, value, expectedType) {
     switch (expectedType) {
         case "string":
@@ -597,6 +772,37 @@ function finalizeWorkflowPresentation(options) {
     }
     return content;
 }
+/**
+ * Wire projection of the warn-only duplicate-replay signal recorded at
+ * `WorkflowStateStore.create()` (failure investigation F6). Additive and
+ * advisory: identical snapshot hashes do NOT imply an identical outcome —
+ * workspace content is not covered by the hashes and providers are
+ * nondeterministic — so this field never gates admission or execution.
+ * Defensive optional access: partial store mocks may omit the property.
+ */
+function buildDuplicateOfFailedRunField(store) {
+    const signal = store?.duplicateOfFailedRun;
+    if (signal === undefined || signal === null)
+        return undefined;
+    return {
+        run_id: signal.runId,
+        ...(signal.completedAt !== undefined ? { completed_at: signal.completedAt } : {}),
+    };
+}
+/**
+ * Appends the duplicate-replay signal as a trailing additive content block on
+ * sync run_workflow results (success and error). No block is added when no
+ * signal was detected, so existing content ordering is untouched.
+ */
+function appendDuplicateReplayBlock(content, store) {
+    const duplicateOfFailedRun = buildDuplicateOfFailedRunField(store);
+    if (duplicateOfFailedRun === undefined)
+        return;
+    content.push({
+        type: "text",
+        text: JSON.stringify({ duplicate_of_failed_run: duplicateOfFailedRun }),
+    });
+}
 // ---------------------------------------------------------------------------
 // Actionable error formatting (5-6)
 // ---------------------------------------------------------------------------
@@ -655,15 +861,46 @@ function formatWorkflowError(runId, error, store, workflowSource) {
     let nextAction = "";
     if (store != null) {
         const isResumable = state?.resumable === true;
-        nextAction = isResumable
-            ? `Use resume_workflow with run_id "${runId}" to retry from the last checkpoint.`
-            : `Start a new run with run_workflow (this run is not resumable — set CLINKX_WORKFLOWS_CHILD_CONFIG_PATH for resumable runs).`;
+        const isTerminalPlanReview = state != null &&
+            isPlanReviewRunState(state) &&
+            (state.status === "failed" ||
+                state.status === "cancelled" ||
+                state.status === "succeeded");
+        nextAction = isTerminalPlanReview
+            ? `Start a new run with run_workflow and a new run_id; terminal plan-review-receipts runs are immutable.`
+            : isResumable
+                ? `Use resume_workflow with run_id "${runId}" to retry from the last checkpoint.`
+                : `Start a new run with run_workflow (this run is not resumable — set CLINKX_WORKFLOWS_CHILD_CONFIG_PATH for resumable runs).`;
     }
     return (`Workflow failed [run_id: ${runId}]${sourceLabel}${location}` +
         (retryCount > 0 ? ` (after ${String(retryCount)} retries)` : "") +
         `: ${message}${metaBlock}` +
         (nextAction !== "" ? `\n\n${nextAction}` : ""));
 }
+function toCouncilPlanReviewError(runId, error) {
+    if (!(error instanceof PlanReviewStageError)) {
+        return undefined;
+    }
+    return CouncilPlanReviewErrorSchema.parse({
+        schema_version: "council-plan-review-error-v1",
+        run_id: runId,
+        execution_status: "failed",
+        stage: error.stage,
+        error: {
+            reason: error.reason,
+            detail: error.message.slice(0, 2_048),
+        },
+    });
+}
+async function markWorkflowFailed(store, runId, error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const planReviewError = toCouncilPlanReviewError(runId, error);
+    if (planReviewError === undefined) {
+        await store.markFailed(message);
+        return;
+    }
+    await store.markFailed(message, undefined, planReviewError);
+}
 function getCallEntryByLocation(stages, location) {
     const dotIndex = location.indexOf(".");
     if (dotIndex === -1) {
@@ -704,30 +941,350 @@ async function executeRunWorkflow(server, options, args, signal, progressToken)
     const knownCliNames = options.availableCliNames != null
         ? new Set(options.availableCliNames)
         : undefined;
-    const parsedMembers = parseMembersOverride(args["members"], knownCliNames);
-    const parsedChairman = parseChairmanOverride(args["chairman"], knownCliNames);
-    if (parsedMembers != null && !COUNCIL_RUNTIME_MEMBER_WORKFLOWS.has(workflow)) {
-        throw new McpError(ErrorCode.InvalidParams, `members parameter is not supported for workflow "${workflow}"`);
+    // Read RAW `args`, not parsed values: `parseMembersOverride` throws on `[]`
+    // and on an unknown `cli_name`, so in exactly the cases the hint exists to
+    // cover, `parsedMembers` is never bound.
+    const genericShaped = workflow === PLAN_REVIEW_RECEIPTS_WORKFLOW &&
+        (args["plan_review"] == null ||
+            args["members"] != null ||
+            args["chairman"] != null);
+    // Declarations hoisted out of the decorator's try so the bindings stay in
+    // scope for the post-admission code below; the assignments and their order
+    // are unchanged.
+    let parsedMembers;
+    let parsedChairman;
+    let resolvedVariables;
+    let initialContextPolicy;
+    let planReviewAdmission;
+    try {
+        parsedMembers = parseMembersOverride(args["members"], knownCliNames);
+        parsedChairman = parseChairmanOverride(args["chairman"], knownCliNames);
+        if (parsedMembers != null && !COUNCIL_RUNTIME_MEMBER_WORKFLOWS.has(workflow)) {
+            throw new McpError(ErrorCode.InvalidParams, `members parameter is not supported for workflow "${workflow}"`);
+        }
+        if (parsedChairman != null && !COUNCIL_RUNTIME_MEMBER_WORKFLOWS.has(workflow)) {
+            throw new McpError(ErrorCode.InvalidParams, `chairman parameter is not supported for workflow "${workflow}"`);
+        }
+        resolvedVariables = validateVariables(variables, loaded.definition.variables);
+        // When the runner is absent (preflight disabled / hard kill), the boundary
+        // validator is inert. Skip it WITHOUT evaluating the context-default env
+        // parsers — getWorkflowsContextDefaultCurator() throws on empty env, and a
+        // runner-less run_workflow must never trip context env parsing.
+        let contextPolicy;
+        if (options.contextBuilderRunner != null) {
+            contextPolicy = validateContextBuilderAnchorSufficiency(resolvedVariables, options.contextBuilderRunner, options.contextDefault ?? getWorkflowsContextDefault(), options.defaultCurator ?? getWorkflowsContextDefaultCurator());
+        }
+        validateContextSeedSourceAtAdmission(resolvedVariables, contextPolicy);
+        initialContextPolicy = contextPolicy ?? resolveWorkflowContextMode(undefined, options.contextDefault ?? "off", false, undefined, options.defaultCurator);
+        if (options.contextBuilderRunner != null) {
+            try {
+                options.contextBuilderRunner.assertTaskSecretsAllowed(resolvedVariables);
+            }
+            catch (err) {
+                if (err instanceof McpError) {
+                    throw err;
+                }
+                throw new McpError(ErrorCode.InvalidParams, err instanceof Error ? err.message : String(err));
+            }
+        }
+        const planReviewCliNames = options.planReviewAvailableCliNames ?? options.availableCliNames;
+        planReviewAdmission = admitCouncilPlanReview({
+            workflow,
+            planReview: args["plan_review"],
+            variables: resolvedVariables,
+            ...(planReviewCliNames !== undefined
+                ? { availableCliNames: planReviewCliNames }
+                : {}),
+        });
     }
-    if (parsedChairman != null && !COUNCIL_RUNTIME_MEMBER_WORKFLOWS.has(workflow)) {
-        throw new McpError(ErrorCode.InvalidParams, `chairman parameter is not supported for workflow "${workflow}"`);
+    catch (err) {
+        // Append the hint by MUTATING the caught error and rethrowing that same
+        // instance. Do NOT re-wrap it in `new McpError(err.code, err.message + …)`:
+        // the SDK constructor prefixes its argument with `MCP error <code>: `, so
+        // `err.message` already carries that prefix and re-constructing emits it
+        // twice on the wire (`MCP error -32602: MCP error -32602: …`). Mutating in
+        // place also preserves `code`, `data`, and the original stack.
+        if (genericShaped && err instanceof McpError && err.code === ErrorCode.InvalidParams) {
+            err.message = `${err.message}${planReviewShapeHint()}`;
+        }
+        throw err;
     }
-    const resolvedVariables = validateVariables(variables, loaded.definition.variables);
-    acquireMutex(runId);
-    let store = null;
+    // A-7: reject caller context anchors that resolve to the bound plan or any
+    // plan-workspace PLAN.md. Pre-mutex, so a rejected request creates no state:
+    // the caller must not be able to hand actors a MUTABLE plan alongside the
+    // immutable snapshot.
+    let planReviewPlan;
+    if (planReviewAdmission !== undefined) {
+        const contextPolicy = buildPlanReviewContextPolicy(planReviewAdmission.input.plan_file);
+        const rejected = findRejectedPlanContextAnchors(contextPolicy, resolvedVariables, resolveWorkspaceRoot());
+        if (rejected.length > 0) {
+            throw new McpError(ErrorCode.InvalidParams, `plan-review-receipts forbids plan context anchors; reviewers receive only the immutable snapshot. Offending entries: ${rejected
+                .map((entry) => `${entry.variable}: ${entry.path}`)
+                .join(", ")}`);
+        }
+        planReviewPlan = {
+            admission: planReviewAdmission,
+            contextPolicy,
+            // Deterministic, runtime-owned: the definition must name the snapshot
+            // before `create()` makes the run dir, so the path is derived rather than
+            // discovered. A post-create guard asserts the store agrees.
+            snapshotAbsolutePath: join(getRunStateDir(runId), PLAN_SNAPSHOT_RELPATH),
+        };
+    }
+    acquireMutex(runId, options);
+    const isAsync = args["async"] === true;
+    if (isAsync) {
+        // Everything between acquireMutex and the detached spawn must release the
+        // mutex on ANY throw, or the run slot leaks permanently (bricks the server
+        // at the default cap of 1).
+        let store;
+        let effectiveDefinition;
+        let initializedPlanReview;
+        let preparedSnapshot;
+        try {
+            const runDir = getRunStateDir(runId);
+            if (existsSync(runDir)) {
+                throw new McpError(ErrorCode.InvalidParams, `run_id ${runId} already has persisted state at ${runDir}`);
+            }
+            // Read + digest-verify the plan BEFORE composing: the expander inlines
+            // the snapshot text, so it must exist by expansion time (D9).
+            preparedSnapshot = planReviewPlan === undefined
+                ? undefined
+                : await preparePlanReviewSnapshot(planReviewPlan);
+            // Expand composition ONCE in the foreground; the detached run reuses it.
+            effectiveDefinition = expandRunWorkflowDefinition(loaded.normalized, workflow, parsedMembers, parsedChairman, planReviewPlan, preparedSnapshot);
+            // Create the durable, pollable state record in the FOREGROUND so a failure
+            // here surfaces synchronously (a real error, never a false "running").
+            try {
+                store = await WorkflowStateStore.create({
+                    runId,
+                    definition: effectiveDefinition,
+                    variables: resolvedVariables,
+                    debugKeepArtifacts: debug,
+                    async: true,
+                    initialContextPolicy,
+                });
+            }
+            catch (err) {
+                throw new McpError(ErrorCode.InternalError, `Failed to initialize async run ${runId}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            // A-10: the async acknowledgement is a durability boundary. A caller
+            // cannot observe `running` until every plan-review snapshot and the
+            // strict typed state subtree have committed successfully.
+            if (planReviewPlan !== undefined) {
+                initializedPlanReview = await initializePlanReviewRunState(store, planReviewPlan, effectiveDefinition, preparedSnapshot);
+            }
+        }
+        catch (err) {
+            if (store !== undefined && planReviewPlan !== undefined) {
+                try {
+                    try {
+                        await markWorkflowFailed(store, runId, err);
+                    }
+                    catch (markFailedError) {
+                        logger.warn({ err: markFailedError }, "markFailed during async initialization error handling failed");
+                    }
+                    const errorText = formatWorkflowError(runId, err, store, {
+                        source: loaded.source,
+                        sourcePath: loaded.sourcePath,
+                    });
+                    let failureSummary;
+                    if (receipt) {
+                        try {
+                            failureSummary = buildFailureRunSummary(store);
+                        }
+                        catch (summaryError) {
+                            logger.warn({ err: summaryError }, "failure summary construction failed, omitting receipt");
+                        }
+                    }
+                    const content = finalizeWorkflowPresentation({
+                        outputText: errorText,
+                        receipt,
+                        debug,
+                        summary: failureSummary,
+                        debugBlock: debug ? buildErrorDebugBlock(runId, store) : undefined,
+                    });
+                    return { content, isError: true };
+                }
+                finally {
+                    try {
+                        await store.close();
+                    }
+                    catch (closeError) {
+                        logger.warn({ err: closeError }, "store.close() failed during async initialization cleanup");
+                    }
+                    releaseMutex(runId);
+                }
+            }
+            releaseMutex(runId);
+            throw err;
+        }
+        if (store === undefined || effectiveDefinition === undefined) {
+            releaseMutex(runId);
+            throw new McpError(ErrorCode.InternalError, `Failed to initialize async run ${runId}`);
+        }
+        const detached = new AbortController();
+        cancelRegistry.set(runId, detached);
+        void runWorkflowDetached(server, options, workflow, runId, resolvedVariables, debug, receipt, validatorRegistry, loaded, parsedMembers, parsedChairman, true, detached.signal, undefined, store, effectiveDefinition, undefined, initializedPlanReview, initialContextPolicy).catch((err) => {
+            if (err instanceof WorkflowCancellationError) {
+                logger.info({ runId }, "workflow run cancelled");
+                return;
+            }
+            logger.error({ err, runId }, "detached async run failed");
+        });
+        // Additive-only ack shape: base {run_id, status:"running"} is unchanged;
+        // the duplicate-replay field appears only when detected (warn-only, F6).
+        const duplicateOfFailedRun = buildDuplicateOfFailedRunField(store);
+        return {
+            content: [{
+                    type: "text",
+                    text: JSON.stringify({
+                        run_id: runId,
+                        status: "running",
+                        ...(duplicateOfFailedRun !== undefined
+                            ? { duplicate_of_failed_run: duplicateOfFailedRun }
+                            : {}),
+                    }),
+                }],
+        };
+    }
+    return await runWorkflowDetached(server, options, workflow, runId, resolvedVariables, debug, receipt, validatorRegistry, loaded, parsedMembers, parsedChairman, false, signal, progressToken, undefined, undefined, planReviewPlan, undefined, initialContextPolicy);
+}
+async function preparePlanReviewSnapshot(plan) {
+    try {
+        const canonical = await readCanonicalPlanSnapshot({
+            planFile: plan.admission.input.plan_file,
+            allowedRoots: planFileAllowedRoots(),
+            claimedDigest: plan.admission.input.digest,
+        });
+        // Fail fast on a roster that cannot fit its own prompts. This is caller
+        // sizing, not a TOCTOU: it is deterministic and pre-state.
+        //
+        // It raises `McpError(-32602)`, which the re-throw below deliberately lets
+        // escape rather than carrying as `{ok:false}` — but the CODE only reaches
+        // the caller on the ASYNC path. `executeWorkflowRun` wraps the sync path in
+        // its generic failure handler, so the same error surfaces there as an
+        // `isError` TEXT result carrying the message but NOT the code. Do not
+        // describe this as "-32602" unqualified; the invariant that holds on BOTH
+        // paths is: no run directory, no persisted state, no provider work.
+        assertPlanReviewPromptBudget({
+            seatCount: plan.admission.execution_contract.seats.length,
+            snapshotBytes: canonical.canonicalBytes.byteLength,
+            maxPromptBytes: getMaxPromptBytes(),
+        });
+        return { ok: true, canonical };
+    }
+    catch (err) {
+        if (err instanceof McpError)
+            throw err;
+        return { ok: false, error: err };
+    }
+}
+/**
+ * A-5/A-6: materialize the immutable snapshot + persisted execution contract
+ * into runtime-owned storage and commit the typed plan-review subtree, all
+ * BEFORE any seat is dispatched.
+ *
+ * A failure here is a post-state PRE-SEAT failure: the run is marked `failed`
+ * with the offending `stage`, and no result sidecar is ever attempted.
+ */
+async function initializePlanReviewRunState(store, plan, definition, prepared) {
+    // Raise a carried read/verify failure now that state exists, so a swapped or
+    // unreadable plan is a `failed` run rather than a pre-state rejection.
+    if (!prepared.ok)
+        throw prepared.error;
+    const contract = plan.admission.execution_contract;
+    const snapshot = await persistCanonicalPlanSnapshot(store.runDir, prepared.canonical);
+    if (snapshot.absolutePath !== plan.snapshotAbsolutePath) {
+        throw new PlanReviewStageError("snapshot", `Snapshot path ${snapshot.absolutePath} does not match the runtime-owned path derived for this run (${plan.snapshotAbsolutePath})`);
+    }
+    const persistedContract = await writeExecutionContractSnapshot(store.runDir, contract);
+    const state = {
+        schema_version: "council-plan-review-state-v1",
+        execution_contract_path: persistedContract.relPath,
+        execution_contract_sha256: persistedContract.sha256,
+        execution_contract_digest: plan.admission.execution_contract_digest,
+        snapshot_path: snapshot.relPath,
+        snapshot_sha256: snapshot.sha256,
+        plan_digest: snapshot.planDigest,
+        seat_mappings: deriveSeatMappings(contract),
+        call_bindings: reconstructPlanReviewCallBindings(contract, resolvePlanReviewChairmanCallId(definition)),
+        context_policy: plan.contextPolicy,
+    };
+    validatePlanReviewCallBindings(definition, state.call_bindings);
+    await store.commitPlanReviewState(state);
+    return state;
+}
+/** The chairman stage's call id, read from the normalized definition. */
+function resolvePlanReviewChairmanCallId(definition) {
+    const stage = definition.stages.find((entry) => entry.id === "chairman");
+    const callId = stage?.calls[0]?.id;
+    if (callId === undefined) {
+        throw new PlanReviewStageError("execution_contract", "Plan-review definition has no chairman call");
+    }
+    return callId;
+}
+function expandRunWorkflowDefinition(definition, workflow, parsedMembers, parsedChairman, planReviewPlan, 
+/**
+ * The already-verified snapshot. This function must NEVER read `plan_file`:
+ * the text it inlines is the digest-verified canonical copy or nothing.
+ */
+preparedSnapshot) {
+    if (planReviewPlan !== undefined) {
+        return expandCouncilPlanReview(definition, planReviewPlan.admission.execution_contract, 
+        // On a carried read failure the run is already doomed; expand without a
+        // snapshot so the store can be created and mark the run `failed`.
+        //
+        // The verified snapshot is passed WHOLE rather than flattened to `.text`:
+        // the expander's guard re-checks the digest-bearing shape, which a bare
+        // string cannot carry. This is the single read — never re-read `plan_file`.
+        preparedSnapshot?.ok === true ? preparedSnapshot.canonical : undefined);
+    }
+    return parsedMembers != null || parsedChairman != null
+        ? expandCouncilComposition(definition, parsedMembers, workflow, parsedChairman)
+        : definition;
+}
+async function runWorkflowDetached(server, options, workflow, runId, resolvedVariables, debug, receipt, validatorRegistry, loaded, parsedMembers, parsedChairman, isAsync, signal, progressToken, preCreatedStore, preExpandedDefinition, planReviewPlan, preInitializedPlanReview, initialContextPolicy) {
+    let store = preCreatedStore ?? null;
     let backend = null;
     let reporter;
+    let shutdownHandle;
+    let releaseLifecycleBinding;
+    let initializedPlanReview = preInitializedPlanReview;
     try {
-        const effectiveDefinition = (parsedMembers != null || parsedChairman != null)
-            ? expandCouncilComposition(loaded.normalized, parsedMembers ?? undefined, workflow, parsedChairman)
-            : loaded.normalized;
-        // Create state store (resumable if child config path is set)
-        store = await WorkflowStateStore.create({
-            runId,
-            definition: effectiveDefinition,
-            variables: resolvedVariables,
-            debugKeepArtifacts: debug,
-        });
+        // The async admission path already expanded the composition (and read the
+        // snapshot) in the foreground; reuse both to avoid redundant work and a
+        // second `plan_file` read.
+        const preparedSnapshot = preExpandedDefinition !== undefined ||
+            planReviewPlan === undefined
+            ? undefined
+            : await preparePlanReviewSnapshot(planReviewPlan);
+        const effectiveDefinition = preExpandedDefinition ??
+            expandRunWorkflowDefinition(loaded.normalized, workflow, parsedMembers, parsedChairman, planReviewPlan, preparedSnapshot);
+        // Create state store (resumable if child config path is set) unless the
+        // async admission path already created it in the foreground.
+        if (store == null) {
+            store = await WorkflowStateStore.create({
+                runId,
+                definition: effectiveDefinition,
+                variables: resolvedVariables,
+                debugKeepArtifacts: debug,
+                async: isAsync,
+                initialContextPolicy,
+            });
+        }
+        releaseLifecycleBinding = options.contextBuilderLifecycleRouter?.bind(runId, store);
+        // A-5/A-6: snapshot + contract + typed subtree land here — after state
+        // exists, before the backend is even created, so a snapshot/digest failure
+        // is a `failed` RunState with zero seats dispatched (never a result
+        // sidecar, never a pre-state -32602).
+        if (planReviewPlan !== undefined && preparedSnapshot !== undefined) {
+            initializedPlanReview = await initializePlanReviewRunState(store, planReviewPlan, effectiveDefinition, preparedSnapshot);
+        }
+        const sessionLogGeneration = store.sessionLogGeneration ??
+            await inspectLegacyWorkflowSessionLogGeneration(store.runDir, runId);
+        if (signal.aborted)
+            throw new WorkflowCancellationError();
         // Create backend via factory
         backend = options.createBackend(runId);
         await backend.connect();
@@ -741,7 +1298,7 @@ async function executeRunWorkflow(server, options, args, signal, progressToken)
                 controller.abort(new WorkflowCancellationError());
             }, { once: true });
         }
-        shutdownCoordinator.register(backend, controller, async () => {
+        shutdownHandle = shutdownCoordinator.register(backend, controller, async () => {
             if (store != null) {
                 await store.markCancelled();
             }
@@ -773,12 +1330,30 @@ async function executeRunWorkflow(server, options, args, signal, progressToken)
             variables: resolvedVariables,
             validatorRegistry,
             runId,
+            sessionLogGeneration,
             runDir: storeRef.runDir,
             signal: controller.signal,
             hooks,
+            contextBuilderRunner: options.contextBuilderRunner,
+            contextDefault: options.contextDefault,
+            defaultCurator: options.defaultCurator,
+            commitPreflightContext: storeRef.commitPreflightContext?.bind(storeRef),
+            initialContextPolicy,
+            ...(initializedPlanReview !== undefined
+                ? {
+                    planReviewContextPolicy: initializedPlanReview.context_policy,
+                    planReviewCallBindings: initializedPlanReview.call_bindings,
+                    commitPlanReviewContextProvenance: storeRef.commitPlanReviewContextProvenance?.bind(storeRef),
+                    terminalResultPolicy: {
+                        kind: "plan_review_artifacts",
+                        project: storeRef.projectPlanReviewTerminalResult.bind(storeRef),
+                    },
+                }
+                : {}),
         });
         const result = await engine.execute();
-        shutdownCoordinator.unregister();
+        if (shutdownHandle !== undefined)
+            shutdownCoordinator.unregister(shutdownHandle);
         // Build summary (fail-open)
         let summary;
         if (receipt) {
@@ -797,16 +1372,29 @@ async function executeRunWorkflow(server, options, args, signal, progressToken)
             summary,
             debugBlock: debug ? buildDebugBlock(runId, result, store) : undefined,
         });
+        appendDuplicateReplayBlock(content, store);
         return { content };
     }
     catch (error) {
-        shutdownCoordinator.unregister();
+        if (shutdownHandle !== undefined)
+            shutdownCoordinator.unregister(shutdownHandle);
         if (error instanceof WorkflowCancellationError) {
             if (store != null) {
                 await store.markCancelled();
             }
             throw error;
         }
+        // Persist a terminal "failed" record for post-admission setup failures
+        // (e.g. backend.connect() / engine construction). Idempotent: the engine
+        // already persists "failed" for in-engine failures, so this won't clobber.
+        if (store != null) {
+            try {
+                await markWorkflowFailed(store, runId, error);
+            }
+            catch (err) {
+                logger.warn({ err }, "markFailed during error handling failed");
+            }
+        }
         const errorText = formatWorkflowError(runId, error, store, {
             source: loaded.source,
             sourcePath: loaded.sourcePath,
@@ -828,9 +1416,11 @@ async function executeRunWorkflow(server, options, args, signal, progressToken)
             summary: failureSummary,
             debugBlock: debug && store != null ? buildErrorDebugBlock(runId, store) : undefined,
         });
+        appendDuplicateReplayBlock(content, store);
         return { content, isError: true };
     }
     finally {
+        releaseLifecycleBinding?.();
         reporter?.stop();
         try {
             if (backend != null && !backend.isTerminated) {
@@ -848,7 +1438,8 @@ async function executeRunWorkflow(server, options, args, signal, progressToken)
         catch (cleanupErr) {
             logger.warn({ err: cleanupErr }, "store.close() failed during cleanup");
         }
-        releaseMutex();
+        cancelRegistry.delete(runId);
+        releaseMutex(runId);
     }
 }
 async function executeResumeWorkflow(server, options, args, signal, progressToken) {
@@ -864,18 +1455,133 @@ async function executeResumeWorkflow(server, options, args, signal, progressToke
     catch {
         throw new McpError(ErrorCode.InvalidParams, `Invalid run_id "${runId}". Must match [A-Za-z0-9_-]{1,64}.`);
     }
-    acquireMutex(runId);
+    // Plan-review terminal state is authoritative even while the detached run's
+    // finally still owns the in-process mutex. Read it before duplicate-run
+    // arbitration so terminal-before-cleanup never leaks as "already running".
+    // Any read/validation error is retried by WorkflowStateStore.resume under the
+    // run lock, preserving the existing error surface for corrupt generic state.
+    let persistedBeforeMutex;
+    try {
+        persistedBeforeMutex = await readRunStateForStatus(runId);
+    }
+    catch {
+        persistedBeforeMutex = null;
+    }
+    const persistedState = persistedBeforeMutex?.state;
+    if (persistedState != null &&
+        isPlanReviewRunState(persistedState) &&
+        (persistedState.status === "failed" ||
+            persistedState.status === "cancelled" ||
+            persistedState.status === "succeeded")) {
+        const error = new Error(`Run ${runId} is terminal (${persistedState.status}) and cannot be resumed; start a new run instead.`);
+        return {
+            content: finalizeWorkflowPresentation({
+                outputText: formatWorkflowError(runId, error, null),
+                receipt,
+                debug,
+                summary: undefined,
+                debugBlock: undefined,
+            }),
+            isError: true,
+        };
+    }
+    acquireMutex(runId, options);
     let store = null;
     let backend = null;
     let reporter;
+    let shutdownHandle;
+    let releaseLifecycleBinding;
     try {
         const resumeOptions = {
             runId,
             debugKeepArtifacts: debug,
         };
         store = await WorkflowStateStore.resume(resumeOptions);
+        releaseLifecycleBinding = options.contextBuilderLifecycleRouter?.bind(runId, store);
         const validatorRegistry = createValidatorRegistry();
-        // Create backend via factory
+        const initialContextPolicy = store.runState.initialContextPolicy ??
+            reconstructLegacyInitialContextPolicy(store.runState, options.defaultCurator);
+        // A-5 resume fidelity: the persisted contract + snapshot are the SOLE
+        // inputs — `plan_file` is never re-read and caller input is never
+        // re-parsed. Decode + hash-verify + RECOMPUTE before the engine exists, so
+        // a corrupt contract fails post-state/pre-seat rather than dispatching
+        // seats under unverified (or absent) per-call bindings.
+        // Typed detection is by PERSISTED plan-review state presence, not the
+        // definition name alone: legacy runs persisted under the pre-rename name
+        // "council-plan-review" (which now names the GENERIC plan-review council)
+        // must keep routing through the typed restore path, while a new generic
+        // council-plan-review run (no plan_review_state) must never enter it. A
+        // tampered generic run that smuggles in a plan_review_state subtree fails
+        // closed downstream: restorePlanReviewRun / validatePlanReviewCallBindings
+        // reject any definition whose stages/calls do not match the contract.
+        const persistedPlanReview = store.runState.plan_review_state;
+        let restoredPlanReview;
+        if (store.definition.name === PLAN_REVIEW_RECEIPTS_WORKFLOW &&
+            persistedPlanReview === undefined) {
+            throw new PlanReviewStageError("execution_contract", "Persisted plan-review-receipts run is missing plan_review_state");
+        }
+        if (persistedPlanReview !== undefined &&
+            store.definition.name !== PLAN_REVIEW_RECEIPTS_WORKFLOW &&
+            store.definition.name !== LEGACY_PLAN_REVIEW_RECEIPTS_WORKFLOW_NAME) {
+            throw new PlanReviewStageError("execution_contract", `Persisted workflow "${store.definition.name}" cannot carry plan_review_state`);
+        }
+        if (persistedPlanReview !== undefined) {
+            restoredPlanReview = await restorePlanReviewRun(store.runDir, persistedPlanReview, resolvePlanReviewChairmanCallId(store.definition));
+            const bindingsByCall = validatePlanReviewCallBindings(store.definition, restoredPlanReview.call_bindings);
+            /**
+             * DELIBERATELY the FIRST of two identical checks; `WorkflowEngine`'s
+             * constructor runs the same one. This is not drift.
+             *
+             * The engine's copy is the load-bearing seam: it is the one no caller can
+             * bypass, and it is what a future construction path would inherit. This
+             * copy buys ORDERING — it rejects tampered state before `createBackend` /
+             * `connect`, so a doomed resume never spawns a provider process. The
+             * function is pure and cheap over a handful of prepared inputs, so paying
+             * twice costs nothing measurable and removing EITHER one loses a real
+             * property. If you are here to delete a redundant call: don't.
+             */
+            validatePlanReviewPreparedInputPolicy(store.resume.preparedInputs ?? new Map(), bindingsByCall, {
+                // From the SAME read that re-verified the snapshot above (D9).
+                snapshotText: restoredPlanReview.snapshot.text,
+                contextPolicy: restoredPlanReview.state.context_policy,
+            });
+        }
+        // Make this resume attempt durable before its preflight gate. Generic runs
+        // otherwise remain in the prior terminal state, causing markFailed /
+        // markCancelled to suppress a new pre-dispatch outcome as "idempotent".
+        await store.beginResumeAttempt();
+        const sessionLogGeneration = store.sessionLogGeneration ??
+            await inspectLegacyWorkflowSessionLogGeneration(store.runDir, runId);
+        if (signal.aborted)
+            throw new WorkflowCancellationError();
+        if (store.runState.workflow_context === undefined) {
+            const preflightEngine = new WorkflowEngine({
+                definition: store.definition,
+                session: createPreflightOnlyBackend(options.availableCliNames),
+                variables: store.variables,
+                validatorRegistry,
+                runId,
+                runDir: store.runDir,
+                signal,
+                resume: store.resume,
+                contextBuilderRunner: options.contextBuilderRunner,
+                contextDefault: options.contextDefault,
+                defaultCurator: options.defaultCurator,
+                commitPreflightContext: store.commitPreflightContext.bind(store),
+                requireContextPreflight: true,
+                initialContextPolicy,
+                ...(restoredPlanReview === undefined
+                    ? {}
+                    : {
+                        planReviewContextPolicy: restoredPlanReview.state.context_policy,
+                        planReviewCallBindings: restoredPlanReview.call_bindings,
+                        planReviewSnapshotText: restoredPlanReview.snapshot.text,
+                        commitPlanReviewContextProvenance: store.commitPlanReviewContextProvenance.bind(store),
+                    }),
+            });
+            await preflightEngine.prepareContextPreflight(signal);
+        }
+        // Create backend only after the resume context gate has committed or bypassed.
         backend = options.createBackend(runId);
         await backend.connect();
         // Wire up shutdown coordinator
@@ -888,7 +1594,7 @@ async function executeResumeWorkflow(server, options, args, signal, progressToke
                 controller.abort(new WorkflowCancellationError());
             }, { once: true });
         }
-        shutdownCoordinator.register(backend, controller, async () => {
+        shutdownHandle = shutdownCoordinator.register(backend, controller, async () => {
             await store.markCancelled();
         });
         // Build engine hooks with progress reporter
@@ -922,13 +1628,36 @@ async function executeResumeWorkflow(server, options, args, signal, progressToke
             variables: store.variables,
             validatorRegistry,
             runId,
+            sessionLogGeneration,
             runDir: store.runDir,
             signal: controller.signal,
             hooks: rpt != null ? hooks : store.hooks,
             resume: store.resume,
+            contextBuilderRunner: options.contextBuilderRunner,
+            contextDefault: options.contextDefault,
+            defaultCurator: options.defaultCurator,
+            commitPreflightContext: store.commitPreflightContext?.bind(store),
+            restoredWorkflowContext: store.runState.workflow_context,
+            requireContextPreflight: false,
+            initialContextPolicy,
+            // A-7: replay the SAME enforced exclusion on resume, reconstructed from
+            // persisted state rather than re-derived from caller variables.
+            ...(restoredPlanReview !== undefined
+                ? {
+                    planReviewContextPolicy: restoredPlanReview.state.context_policy,
+                    planReviewCallBindings: restoredPlanReview.call_bindings,
+                    planReviewSnapshotText: restoredPlanReview.snapshot.text,
+                    commitPlanReviewContextProvenance: store.commitPlanReviewContextProvenance?.bind(store),
+                    terminalResultPolicy: {
+                        kind: "plan_review_artifacts",
+                        project: store.projectPlanReviewTerminalResult.bind(store),
+                    },
+                }
+                : {}),
         });
         const result = await engine.execute();
-        shutdownCoordinator.unregister();
+        if (shutdownHandle !== undefined)
+            shutdownCoordinator.unregister(shutdownHandle);
         // Build summary (fail-open)
         let summary;
         if (receipt) {
@@ -950,13 +1679,24 @@ async function executeResumeWorkflow(server, options, args, signal, progressToke
         return { content };
     }
     catch (error) {
-        shutdownCoordinator.unregister();
+        if (shutdownHandle !== undefined)
+            shutdownCoordinator.unregister(shutdownHandle);
         if (error instanceof WorkflowCancellationError) {
             if (store != null) {
                 await store.markCancelled();
             }
             throw error;
         }
+        // Persist a terminal "failed" record for post-admission setup failures.
+        // Idempotent: won't clobber an engine-emitted terminal status.
+        if (store != null) {
+            try {
+                await markWorkflowFailed(store, runId, error);
+            }
+            catch (err) {
+                logger.warn({ err }, "markFailed during error handling failed");
+            }
+        }
         const errorText = formatWorkflowError(runId, error, store);
         // Build failure summary (fail-open)
         let failureSummary;
@@ -978,6 +1718,7 @@ async function executeResumeWorkflow(server, options, args, signal, progressToke
         return { content, isError: true };
     }
     finally {
+        releaseLifecycleBinding?.();
         reporter?.stop();
         try {
             if (backend != null && !backend.isTerminated) {
@@ -995,28 +1736,435 @@ async function executeResumeWorkflow(server, options, args, signal, progressToke
         catch (cleanupErr) {
             logger.warn({ err: cleanupErr }, "store.close() failed during cleanup");
         }
-        releaseMutex();
+        releaseMutex(runId);
     }
 }
-function executeListWorkflows(workflowsPath, availableCliNames) {
-    const workflows = listWorkflowCatalog(workflowsPath);
+// ---------------------------------------------------------------------------
+// Sidecar access (atomic, fd-based, cheap-poll-safe)
+// ---------------------------------------------------------------------------
+/**
+ * Thrown for genuine containment-policy violations (absolute outputPath or an
+ * escape past the run directory). These MUST reject even on a cheap default
+ * poll. Everything else (missing file, fs race, permission) is swallowed on the
+ * cheap path so liveness polling never throws for a recoverable condition.
+ *
+ * Alias of the shared reader's policy error so the existing `instanceof`
+ * cheap-poll discrimination below is unchanged.
+ */
+const SidecarPolicyError = ContainedFilePolicyError;
+/**
+ * Read a run sidecar through the shared containment-safe, no-follow reader.
+ *
+ * The reader is shared (not re-implemented) with the plan-review snapshot and
+ * contract paths: one audited realpath + `O_NOFOLLOW` + single-handle
+ * implementation, so a fix to the TOCTOU handling lands everywhere at once.
+ */
+async function readContainedSidecar(runDir, outputPath, wantContent) {
+    const read = await readContainedRelativeFile(runDir, outputPath, {
+        wantContent,
+        // Preserve this path's established error wording byte-for-byte.
+        containerLabel: "run directory",
+        pathLabel: "outputPath",
+    });
+    return read.content !== undefined
+        ? { size: read.size, content: read.content }
+        : { size: read.size };
+}
+/**
+ * Legacy state-v1 runs did not persist their admission-time default. Rebuild
+ * only caller-explicit choices; otherwise require deterministic preflight so a
+ * changed server default cannot silently introduce or switch a delegate.
+ */
+export function reconstructLegacyInitialContextPolicy(state, defaultCurator) {
+    const persistedMode = state.workflow_context?.context_builder.context_mode;
+    if (persistedMode === "disabled") {
+        return {
+            requestedMode: "off",
+            effectiveMode: "disabled",
+            preflightDisabled: true,
+        };
+    }
+    const legacyVariables = state.variables ?? {};
+    const callerMode = legacyVariables["cb_context_mode"];
+    const normalizedMode = typeof callerMode === "string" ? callerMode.trim() : "";
+    if (normalizedMode === "off" || normalizedMode === "deterministic") {
+        return {
+            requestedMode: normalizedMode,
+            effectiveMode: normalizedMode,
+            preflightDisabled: false,
+        };
+    }
+    if (normalizedMode === "full" && legacyVariables["cb_delegate"] != null) {
+        try {
+            return resolveWorkflowContextMode("full", "deterministic", true, legacyVariables["cb_delegate"], defaultCurator);
+        }
+        catch {
+            // Legacy hard-disabled runs may contain a delegate value that was never
+            // validated. Do not turn it into a new resume-time fatal or provider.
+        }
+    }
+    return {
+        requestedMode: normalizedMode === "full" || persistedMode === "full"
+            ? "full"
+            : "deterministic",
+        effectiveMode: "deterministic",
+        preflightDisabled: false,
+    };
+}
+/**
+ * Best-effort read-time parse of the persisted context-builder lifecycle
+ * snapshot. Status projection is observability-only and must never throw for
+ * a malformed or absent snapshot — invalid input yields undefined and the
+ * dependent health/context fields are simply omitted.
+ */
+function parseLifecycleForStatus(value) {
+    if (value == null)
+        return undefined;
+    try {
+        return parseContextBuilderLifecycleStateV1(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function executeWorkflowRunStatus(_options, args) {
+    const runId = args["run_id"];
+    const includeResult = args["include_result"] === true;
+    if (typeof runId !== "string" || runId === "") {
+        throw new McpError(ErrorCode.InvalidParams, 'Missing or invalid "run_id" parameter');
+    }
+    try {
+        validateRunId(runId);
+    }
+    catch {
+        throw new McpError(ErrorCode.InvalidParams, `Invalid run_id "${runId}". Must match [A-Za-z0-9_-]{1,64}.`);
+    }
+    const read = await readRunStateForStatus(runId);
+    if (read == null) {
+        return {
+            content: [{ type: "text", text: JSON.stringify({ status: "not_found", run_id: runId }) }],
+        };
+    }
+    const { state, lock } = read;
+    const status = (state.status === "running" || state.status === "pending") && lock === "stale_or_absent"
+        ? "orphaned"
+        : state.status;
+    const runDir = getRunStateDir(runId);
+    const stages = state.stages.map((stage) => {
+        const completedCalls = stage.calls.filter((call) => call.state === "succeeded").length;
+        const runningCalls = stage.calls.filter((call) => call.state === "running").length;
+        const failedCalls = stage.calls.filter((call) => call.state === "failed").length;
+        return {
+            stage_id: stage.stageId,
+            state: stage.state,
+            total_calls: stage.calls.length,
+            completed_calls: completedCalls,
+            running_calls: runningCalls,
+            failed_calls: failedCalls,
+            calls: stage.calls.map((call) => ({
+                call_id: call.callId,
+                state: call.state,
+                retry_count: call.retryCount,
+                ...(call.startedAt != null ? { started_at: call.startedAt } : {}),
+                ...(call.completedAt != null ? { completed_at: call.completedAt } : {}),
+                ...(call.durationMs != null ? { duration_ms: call.durationMs } : {}),
+                ...(call.errorMessage != null ? { error: call.errorMessage } : {}),
+            })),
+        };
+    });
+    const projection = {
+        run_id: state.runId,
+        status,
+        async: state.async ?? false,
+        workflow: {
+            name: state.workflowName,
+            version: state.workflowVersion,
+        },
+        ...(state.startedAt != null ? { started_at: state.startedAt } : {}),
+        ...(state.completedAt != null ? { completed_at: state.completedAt } : {}),
+        ...(lock === "unknown" ? { lock_ownership: "unknown" } : {}),
+        stages,
+    };
+    // artifacts_dir is cheap (pure join, no I/O) and present for every found run.
+    projection["artifacts_dir"] = join(runDir, "artifacts");
+    // Read-only context-selection observability from already-persisted state.
+    // No file I/O — only projects state.workflow_context.context_builder and
+    // the state.context_builder_lifecycle snapshot.
+    const lifecycle = parseLifecycleForStatus(state.context_builder_lifecycle);
+    const cb = state.workflow_context?.context_builder;
+    if (cb != null) {
+        const context = {
+            ...(cb.context_mode != null ? { context_mode: cb.context_mode } : {}),
+            status: cb.status,
+            files_selected: cb.metrics.files_selected,
+        };
+        if (cb.delegate != null) {
+            context["delegate"] = {
+                status: cb.delegate.status,
+                fallback_used: cb.delegate.fallback_used,
+            };
+        }
+        if (lifecycle != null) {
+            // Additive lifecycle observability. `coverage.missing` is a bounded
+            // integer count in the persisted schema (never a list), so it is
+            // projected as-is with no truncation concern.
+            context["lifecycle_status"] = lifecycle.status;
+            context["coverage"] = {
+                policy: lifecycle.coverage.policy,
+                status: lifecycle.coverage.status,
+                required: lifecycle.coverage.required,
+                selected: lifecycle.coverage.selected,
+                missing: lifecycle.coverage.missing,
+            };
+        }
+        projection["context"] = context;
+    }
+    // F7 read-time health projection: top-level run status alone overstates
+    // health when on_failure:continue swallowed seat failures or context
+    // preflight completed partial/degraded. Computed only from already-persisted
+    // data; additive and advisory — never mutates status semantics.
+    const healthReasons = [];
+    if (status === "succeeded" && stages.some((stage) => stage.failed_calls > 0)) {
+        healthReasons.push("failed_calls_in_succeeded_run");
+    }
+    if (lifecycle?.status === "partial") {
+        healthReasons.push("context_partial");
+    }
+    if (lifecycle?.status === "failed") {
+        healthReasons.push("context_lifecycle_failed");
+    }
+    if (lifecycle?.coverage.status === "degraded") {
+        healthReasons.push("coverage_degraded");
+    }
+    if (cb?.delegate?.fallback_used === true) {
+        healthReasons.push("delegate_fallback_used");
+    }
+    projection["health"] = {
+        classification: healthReasons.length > 0 ? "degraded" : "ok",
+        reasons: healthReasons,
+    };
+    if (isPlanReviewRunState(state)) {
+        const terminalExecutionStatus = state.status === "succeeded" ||
+            state.status === "failed" ||
+            state.status === "cancelled"
+            ? state.status
+            : undefined;
+        const publication = state.plan_review_state?.publication;
+        const inspected = await inspectPlanReviewPublication(runDir, runId, terminalExecutionStatus ??
+            (includeResult && publication?.committed === true ? "failed" : undefined), publication, includeResult);
+        projection["result_available"] = inspected.result_available;
+        projection["result_bytes"] = inspected.result_bytes;
+        if (inspected.result !== undefined) {
+            projection["result"] = inspected.result;
+        }
+        let planReviewError = (includeResult && publication?.committed === true ? inspected.error : undefined) ??
+            state.plan_review_error ??
+            inspected.error;
+        if (planReviewError === undefined &&
+            publication === undefined &&
+            state.plan_review_state === undefined &&
+            (state.status === "succeeded" || state.status === "failed")) {
+            planReviewError = createPlanReviewPublicationError(runId, state.status, "no_artifact", "Historical plan-review run has no publication marker; rerun with a Track-C-capable ClinkX runtime.");
+        }
+        if (planReviewError !== undefined) {
+            projection["plan_review_error"] = planReviewError;
+        }
+        if (state.status === "failed" || state.status === "cancelled") {
+            if (state.error != null) {
+                projection["error"] = state.error;
+            }
+            if (state.failureClass != null) {
+                projection["failure_class"] = state.failureClass;
+            }
+        }
+    }
+    else {
+        projection["result_available"] = state.status === "succeeded";
+        if (state.status === "succeeded") {
+            const final = state.stages.at(-1);
+            const call = final?.calls[0];
+            // Cheap size hint without reading contents. Containment (via
+            // readContainedSidecar) runs even on a default poll so an absolute path or
+            // symlink escape is rejected regardless of include_result. Everything else
+            // — a missing final call, a missing/unreadable file, an fs race — omits the
+            // hint rather than throwing, preserving the "a cheap poll never throws for a
+            // recoverable/missing-file condition" invariant that liveness polling needs.
+            if (call?.outputInline != null) {
+                projection["result_bytes"] = Buffer.byteLength(call.outputInline, "utf-8");
+            }
+            else if (!includeResult && call?.outputPath != null) {
+                // Skip this size-only open when include_result is set — the block below
+                // opens the sidecar once for both size and content, so a second open here
+                // would be redundant.
+                try {
+                    const { size } = await readContainedSidecar(runDir, call.outputPath, false);
+                    projection["result_bytes"] = size;
+                }
+                catch (err) {
+                    if (err instanceof SidecarPolicyError) {
+                        // Absolute path / containment escape rejects even on a cheap poll.
+                        throw new Error(`Succeeded run ${runId} ${err.message}`);
+                    }
+                    // Missing file / fs race / permission on a cheap poll: omit the hint.
+                }
+            }
+            if (includeResult) {
+                if (call == null) {
+                    throw new Error(`Succeeded run ${runId} is missing final call state`);
+                }
+                if (call.outputInline != null) {
+                    projection["result"] = call.outputInline;
+                }
+                else if (call.outputPath != null) {
+                    try {
+                        const { size, content } = await readContainedSidecar(runDir, call.outputPath, true);
+                        projection["result_bytes"] = size;
+                        projection["result"] = content;
+                    }
+                    catch (err) {
+                        if (err instanceof SidecarPolicyError) {
+                            throw new Error(`Succeeded run ${runId} ${err.message}`);
+                        }
+                        throw new Error(`Succeeded run ${runId} output file is missing or unreadable`);
+                    }
+                }
+                else {
+                    throw new Error(`Succeeded run ${runId} final call has neither inline nor persisted output`);
+                }
+            }
+        }
+        else if (state.status === "failed" || state.status === "cancelled") {
+            if (state.error != null) {
+                projection["error"] = state.error;
+            }
+            if (state.failureClass != null) {
+                projection["failure_class"] = state.failureClass;
+            }
+        }
+    }
+    return {
+        content: [{ type: "text", text: JSON.stringify(projection) }],
+    };
+}
+async function executeCancelWorkflow(_options, args) {
+    const runId = args["run_id"];
+    if (typeof runId !== "string" || runId === "") {
+        throw new McpError(ErrorCode.InvalidParams, 'Missing or invalid "run_id" parameter');
+    }
+    try {
+        validateRunId(runId);
+    }
+    catch {
+        throw new McpError(ErrorCode.InvalidParams, `Invalid run_id "${runId}". Must match [A-Za-z0-9_-]{1,64}.`);
+    }
+    const text = (value) => ({
+        content: [{ type: "text", text: JSON.stringify(value) }],
+    });
+    // 1) Live in-process async run: abort its controller and let the run's own
+    //    unwind drive it to terminal "cancelled". We do NOT touch the mutex here —
+    //    the detached run's finally owns the slot (touching it risks a double-free).
+    const controller = cancelRegistry.get(runId);
+    if (controller != null) {
+        // The engine can have already persisted a terminal status while its
+        // controller is still in the registry (deleted only in the run's finally).
+        // Re-read first so we never claim "cancelling" for an already-done run.
+        const live = await readRunStateForStatus(runId);
+        if (live != null && live.state.status !== "running" && live.state.status !== "pending") {
+            return text({ run_id: runId, status: live.state.status, already_terminal: true });
+        }
+        if (!controller.signal.aborted) {
+            controller.abort(new WorkflowCancellationError());
+        }
+        return text({ run_id: runId, status: "cancelling" });
+    }
+    // 2) Not in our registry — inspect persisted state via the same path as status.
+    const read = await readRunStateForStatus(runId);
+    if (read == null) {
+        return text({ run_id: runId, status: "not_found" });
+    }
+    const { state, lock } = read;
+    if (state.status !== "running" && state.status !== "pending") {
+        return text({ run_id: runId, status: state.status, already_terminal: true });
+    }
+    if (lock === "unknown") {
+        return text({
+            run_id: runId,
+            status: state.status,
+            cancellable: false,
+            lock_ownership: "unknown",
+            error: `Run lock ownership is unknown for run_id "${runId}"; refusing cancellation until the lock record is repaired.`,
+        });
+    }
+    // running|pending and not in our registry. The run.lock is the single source
+    // of truth for ownership: reapRunCancelled acquires it itself (reclaiming a
+    // truly stale/dead lock, refusing a live one), closing the TOCTOU where a
+    // concurrent resume_workflow could grab the lock between read and reap.
+    const outcome = await reapRunCancelled(runId);
+    if (outcome === "cancelled") {
+        return text({ run_id: runId, status: "cancelled", reaped: true });
+    }
+    if (outcome === "locked") {
+        // The run is owned by another live worker (or a blocking run): the lock
+        // could not be acquired. Refuse without mutating — this process cannot
+        // safely kill a worker it does not own.
+        return text({ run_id: runId, status: "running", cancellable: false });
+    }
+    if (outcome === "ownership_unknown") {
+        return text({
+            run_id: runId,
+            status: state.status,
+            cancellable: false,
+            lock_ownership: "unknown",
+            error: `Run lock ownership became unknown for run_id "${runId}"; refusing cancellation until the lock record is repaired.`,
+        });
+    }
+    // "skipped": became terminal between our read and the reap. Re-read and report.
+    const reread = await readRunStateForStatus(runId);
+    const status = reread?.state.status ?? "cancelled";
+    return text({ run_id: runId, status, already_terminal: true });
+}
+function executeListWorkflows(options) {
+    const workflows = listWorkflowCatalog(options.workflowsPath);
+    const preflightEnabled = options.contextBuilderRunner != null;
+    const contextDefault = preflightEnabled
+        ? options.contextDefault ?? getWorkflowsContextDefault()
+        : options.contextDefault ?? "off";
+    const effectiveContextDefault = resolveWorkflowContextMode(undefined, contextDefault, preflightEnabled, undefined, options.defaultCurator).effectiveMode;
     const entries = [];
     for (const [name, entry] of workflows) {
         const def = entry.definition;
+        const contextStrategy = deriveContextStrategy(def);
+        const runtimeMembers = supportsRuntimeMembers(name);
         entries.push({
             name,
             description: def.description,
             version: def.version,
             source: entry.source,
             shadowed_yaml: entry.shadowedYaml,
-            supports_members: supportsRuntimeMembers(name),
-            supports_chairman: supportsRuntimeMembers(name),
-            ...(supportsRuntimeMembers(name) ? {
+            supports_members: runtimeMembers,
+            supports_chairman: runtimeMembers,
+            supports_context_preflight: contextStrategy.supports_context_preflight,
+            effective_context_default: effectiveContextDefault,
+            fails_on_empty_selection: contextStrategy.fails_on_empty_selection,
+            context_anchor_variables: contextStrategy.context_anchor_variables,
+            context_override_variables: contextStrategy.context_override_variables,
+            ...(contextStrategy.default_context_profile !== undefined
+                ? { default_context_profile: contextStrategy.default_context_profile }
+                : {}),
+            context_recipient_stages: contextStrategy.context_recipient_stages,
+            ...(runtimeMembers ? {
                 members_min: 1,
                 members_max: 10,
                 members_stance_required_from_index: 3,
             } : {}),
             ...(entry.path != null ? { path: basename(entry.path) } : {}),
+            ...(name === PLAN_REVIEW_RECEIPTS_WORKFLOW
+                ? {
+                    plan_review: buildCouncilPlanReviewDiscovery(options.planReviewAvailableCliNames ??
+                        options.availableCliNames ??
+                        []),
+                }
+                : {}),
             variables: Object.fromEntries(Object.entries(def.variables).map(([varName, varDef]) => [
                 varName,
                 {
@@ -1029,8 +2177,8 @@ function executeListWorkflows(workflowsPath, availableCliNames) {
         });
     }
     const response = { workflows: entries };
-    if (availableCliNames != null && availableCliNames.length > 0) {
-        response["available_cli_names"] = [...availableCliNames].sort();
+    if (options.availableCliNames != null && options.availableCliNames.length > 0) {
+        response["available_cli_names"] = [...options.availableCliNames].sort();
     }
     return {
         content: [
@@ -1041,10 +2189,137 @@ function executeListWorkflows(workflowsPath, availableCliNames) {
         ],
     };
 }
+function includesVar(from, name) {
+    if (typeof from === "string") {
+        return from === name;
+    }
+    return Array.isArray(from) && from.includes(name);
+}
+// cb_* variables that tune preflight execution rather than source selection —
+// overrides, not anchors. Advertised separately as context_override_variables.
+const CONTEXT_OVERRIDE_VARIABLES = new Set([
+    "cb_allow_secrets",
+    "cb_budget_max_estimated_tokens",
+    "cb_budget_max_files",
+    "cb_budget_max_scan_files",
+    "cb_budget_max_bytes_per_file",
+    "cb_budget_max_total_bytes",
+    "cb_budget_max_search_results",
+    "cb_budget_adapter",
+    "cb_delegate",
+    "cb_context_mode",
+]);
+function deriveContextStrategy(def) {
+    const contextRecipientStages = def.stages
+        .filter((stage) => stage.calls.some((call) => includesVar(call.absolute_file_paths_from, "context_bundle_files")))
+        .map((stage) => stage.id);
+    const cbVariables = Object.keys(def.variables)
+        .filter((name) => name.startsWith("cb_"))
+        .sort();
+    const contextAnchorVariables = cbVariables.filter((name) => !CONTEXT_OVERRIDE_VARIABLES.has(name));
+    const contextOverrideVariables = cbVariables.filter((name) => CONTEXT_OVERRIDE_VARIABLES.has(name));
+    const defaultContextProfile = def.variables["cb_profile"]?.default;
+    const hasSelectionScopeVariable = "cb_focus_paths" in def.variables || "cb_search_terms" in def.variables;
+    return {
+        supports_context_preflight: "context_bundle_files" in def.variables &&
+            contextRecipientStages.length > 0 &&
+            hasSelectionScopeVariable,
+        context_anchor_variables: contextAnchorVariables,
+        context_override_variables: contextOverrideVariables,
+        ...(typeof defaultContextProfile === "string"
+            ? { default_context_profile: defaultContextProfile }
+            : {}),
+        context_recipient_stages: contextRecipientStages,
+        fails_on_empty_selection: def.settings.fail_on_empty_context_selection,
+    };
+}
 // ---------------------------------------------------------------------------
 // Tool input schemas (JSON Schema)
 // ---------------------------------------------------------------------------
 const MAX_INLINE_WORKFLOW_DETAILS = 8;
+const PLAN_REVIEW_INPUT_SCHEMA = {
+    type: "object",
+    description: 'Immutable plan-review contract. Accepted only when workflow is "plan-review-receipts".',
+    properties: {
+        schema_version: { type: "string", const: "council-plan-review-input-v1" },
+        workspace_schema: { type: "string", const: "plan-workspace-v1" },
+        digest_profile: { type: "string", const: "checkpoint-text-v1" },
+        review_id: {
+            type: "string",
+            pattern: "^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$",
+        },
+        repository_id: {
+            type: "string",
+            maxLength: 128,
+            pattern: "^[A-Za-z0-9][A-Za-z0-9._-]*(?:/[A-Za-z0-9][A-Za-z0-9._-]*)*$",
+        },
+        iteration: { type: "integer", minimum: 1 },
+        plan_id: {
+            type: "string",
+            pattern: "^[a-z0-9][a-z0-9-]{0,62}$",
+        },
+        revision: { type: "integer", minimum: 1 },
+        digest: { type: "string", pattern: "^[0-9a-f]{64}$" },
+        expected_execution_contract_digest: {
+            type: "string",
+            pattern: "^[0-9a-f]{64}$",
+        },
+        threshold: { type: "number", minimum: 0, maximum: 10 },
+        designated_editor: { type: "string", minLength: 1 },
+        chairman_seat: {
+            type: "string",
+            pattern: "^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$",
+        },
+        plan_file: {
+            type: "string",
+            minLength: 1,
+            description: "Absolute path to the plan snapshot source",
+        },
+        seats: {
+            type: "array",
+            minItems: 1,
+            maxItems: 10,
+            items: {
+                type: "object",
+                properties: {
+                    seat_id: {
+                        type: "string",
+                        pattern: "^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$",
+                    },
+                    reviewer: { type: "string", minLength: 1 },
+                    cli_name: {
+                        type: "string",
+                        enum: [...PLAN_REVIEW_V1_CLI_NAMES].sort(),
+                    },
+                    stance: {
+                        type: "string",
+                        enum: ["strict", "pragmatic", "adversarial"],
+                    },
+                },
+                required: ["seat_id", "reviewer", "cli_name", "stance"],
+                additionalProperties: false,
+            },
+        },
+    },
+    required: [
+        "schema_version",
+        "workspace_schema",
+        "digest_profile",
+        "review_id",
+        "repository_id",
+        "iteration",
+        "plan_id",
+        "revision",
+        "digest",
+        "expected_execution_contract_digest",
+        "threshold",
+        "designated_editor",
+        "chairman_seat",
+        "plan_file",
+        "seats",
+    ],
+    additionalProperties: false,
+};
 const RUN_WORKFLOW_SCHEMA = {
     type: "object",
     properties: {
@@ -1072,9 +2347,14 @@ const RUN_WORKFLOW_SCHEMA = {
             description: "When true, append a structured receipt summarizing the workflow run as a content block",
             default: false,
         },
+        async: {
+            type: "boolean",
+            default: false,
+            description: "When true, start the run detached and return {run_id, status:'running'} immediately; poll workflow_run_status for progress and result.",
+        },
         members: {
             type: "array",
-            description: "Optional runtime council member composition override. Accepted only for council workflows (council-default, council-answer, council-code-review, council-debug, council-discover). Each entry specifies a CLI adapter and an optional analytical stance. Seats at indices 0-2 may omit stance (inherits default); seats at indices 3-9 MUST provide stance. When provided, both the member stage (stage 0) and reviewer stage (stage 1) are expanded to match the specified count and CLI mapping. Reviewer stances are NOT inherited — reviewers keep their default review lens.",
+            description: "Optional runtime council member composition override. Accepted only for council workflows (council-default, council-answer, council-code-review, council-debug, council-discover, council-plan-review). Each entry specifies a CLI adapter and an optional analytical stance. Seats at indices 0-2 may omit stance (inherits default); seats at indices 3-9 MUST provide stance. When provided, both the member stage (stage 0) and reviewer stage (stage 1) are expanded to match the specified count and CLI mapping. Reviewer stances are NOT inherited — reviewers keep their default review lens.",
             minItems: 1,
             maxItems: 10,
             items: {
@@ -1097,6 +2377,7 @@ const RUN_WORKFLOW_SCHEMA = {
             type: "string",
             description: "Optional CLI adapter name override for the council chairman seat. Accepted only for council workflows. Only changes the LLM adapter; the chairman's role and prompt template are preserved.",
         },
+        plan_review: PLAN_REVIEW_INPUT_SCHEMA,
     },
     required: ["workflow", "run_id"],
     additionalProperties: false,
@@ -1128,8 +2409,35 @@ const LIST_WORKFLOWS_SCHEMA = {
     properties: {},
     additionalProperties: false,
 };
+const WORKFLOW_RUN_STATUS_SCHEMA = {
+    type: "object",
+    properties: {
+        run_id: {
+            type: "string",
+            pattern: "^[A-Za-z0-9_-]{1,64}$",
+        },
+        include_result: {
+            type: "boolean",
+            default: false,
+            description: "When true, include the generic final result for a succeeded run or the committed plan-review envelope regardless of terminal status. Default false keeps polling body-blind.",
+        },
+    },
+    required: ["run_id"],
+    additionalProperties: false,
+};
+const CANCEL_WORKFLOW_SCHEMA = {
+    type: "object",
+    properties: {
+        run_id: {
+            type: "string",
+            pattern: "^[A-Za-z0-9_-]{1,64}$",
+        },
+    },
+    required: ["run_id"],
+    additionalProperties: false,
+};
 /**
- * Return the three workflow tool definitions for tools/list.
+ * Return the workflow tool definitions for tools/list.
  *
  * Dynamically discovers available workflows to include in the
  * run_workflow description. Safe to call repeatedly — no side effects.
@@ -1170,6 +2478,22 @@ export function getWorkflowToolDefinitions(workflowsPath, availableCliNames) {
                 }
             }
         }
+        // plan_review.seats[].cli_name enum (intersection with the v1 provider set)
+        const planReview = props["plan_review"];
+        const planReviewProps = planReview?.["properties"];
+        const planReviewSeats = planReviewProps?.["seats"];
+        const planReviewItems = planReviewSeats?.["items"];
+        const planReviewSeatProps = planReviewItems?.["properties"];
+        const planReviewCliNameSet = new Set(PLAN_REVIEW_V1_CLI_NAMES);
+        const supportedPlanReviewCliNames = sorted.filter((name) => planReviewCliNameSet.has(name));
+        if (planReviewSeatProps?.["cli_name"] != null &&
+            supportedPlanReviewCliNames.length > 0) {
+            planReviewSeatProps["cli_name"] = {
+                ...planReviewSeatProps["cli_name"],
+                enum: supportedPlanReviewCliNames,
+                description: `Configured v1 plan-review adapters: ${supportedPlanReviewCliNames.join(", ")}`,
+            };
+        }
         // chairman enum
         if (props["chairman"] != null) {
             props["chairman"] = {
@@ -1212,7 +2536,7 @@ export function getWorkflowToolDefinitions(workflowsPath, availableCliNames) {
     return [
         {
             name: "run_workflow",
-            description: `Start a new multi-stage workflow execution.${workflowSuffix}\nAccepts optional \`members\` and \`chairman\` parameters for council workflows (council-default, council-answer, council-code-review, council-debug, council-discover) to override member/reviewer composition and chairman CLI adapter at runtime.`,
+            description: `Start a new multi-stage workflow execution.${workflowSuffix}\nAccepts optional \`members\` and \`chairman\` parameters for council workflows (council-default, council-answer, council-code-review, council-debug, council-discover, council-plan-review) to override member/reviewer composition and chairman CLI adapter at runtime.`,
             inputSchema: runSchema,
         },
         {
@@ -1227,6 +2551,18 @@ export function getWorkflowToolDefinitions(workflowsPath, availableCliNames) {
             inputSchema: LIST_WORKFLOWS_SCHEMA,
             annotations: { readOnlyHint: true },
         },
+        {
+            name: "workflow_run_status",
+            description: "Read-only status/progress of a workflow run. The full result is included only with include_result:true. Generic workflows preserve succeeded-final-call behavior; plan-review-receipts reports marker-driven availability and bytes independently of terminal status, with body-blind default polling. Every found run also carries a top-level `health` block {classification: \"ok\"|\"degraded\", reasons: string[]} computed read-time from persisted data — a run can be status:\"succeeded\" yet degraded when on_failure:continue swallowed failed calls or context preflight was partial/degraded (reasons: failed_calls_in_succeeded_run, context_partial, context_lifecycle_failed, coverage_degraded, delegate_fallback_used). When a context-builder lifecycle snapshot is persisted, the `context` block additionally includes `lifecycle_status` and `coverage` {policy, status, required, selected, missing}.",
+            inputSchema: WORKFLOW_RUN_STATUS_SCHEMA,
+            annotations: { readOnlyHint: true },
+        },
+        {
+            name: "cancel_workflow",
+            description: "Cancel a workflow run by run_id. Aborts a live in-process async run (returns status:'cancelling'; poll workflow_run_status until it reaches terminal 'cancelled'). Reaps an orphaned/no-live-worker run to terminal 'cancelled' (reaped:true). Refuses a lock-held run owned by another live worker or a blocking run (cancellable:false). Idempotent; not_found and already_terminal are soft results.",
+            inputSchema: CANCEL_WORKFLOW_SCHEMA,
+            annotations: { destructiveHint: true },
+        },
     ];
 }
 /** Names of the workflow tools (for dispatch matching). */
@@ -1234,6 +2570,8 @@ export const WORKFLOW_TOOL_NAMES = new Set([
     "run_workflow",
     "resume_workflow",
     "list_workflows",
+    "workflow_run_status",
+    "cancel_workflow",
 ]);
 /**
  * Dispatch a workflow tool call.
@@ -1248,7 +2586,11 @@ export async function handleWorkflowToolCall(server, options, name, args, signal
         case "resume_workflow":
             return await executeResumeWorkflow(server, options, args, signal, progressToken);
         case "list_workflows":
-            return executeListWorkflows(options.workflowsPath, options.availableCliNames);
+            return executeListWorkflows(options);
+        case "workflow_run_status":
+            return await executeWorkflowRunStatus(options, args);
+        case "cancel_workflow":
+            return await executeCancelWorkflow(options, args);
         default:
             return null;
     }
@@ -1260,7 +2602,8 @@ export async function handleWorkflowToolCall(server, options, name, args, signal
  * Register workflow tools on an MCP Server instance.
  *
  * This is the reusable core extracted from createWorkflowServer().
- * It registers three tools: run_workflow, resume_workflow, list_workflows.
+ * It registers five tools: run_workflow, resume_workflow, list_workflows,
+ * workflow_run_status, cancel_workflow.
  *
  * The `options.createBackend` factory determines how clink calls are
  * dispatched — callers provide either a child-process or in-process backend.