clinkx 0.3.0 → 1.1.0

package/clinkx-workflows/dist/workflow-tools.js

@@ -5,44 +5,252 @@
  * - Standalone STDIO server (ClinkSession child process backend)
  * - In-process integration (LocalClinkBackend via root ClinkX)
  *
- * The `registerWorkflowTools()` function registers three tools on a Server:
+ * The `registerWorkflowTools()` function registers five tools on a Server:
  * - run_workflow: start a new workflow execution
  * - resume_workflow: resume a failed/cancelled run
  * - list_workflows: list available workflow definitions
+ * - workflow_run_status: read workflow run progress/result
+ * - cancel_workflow: cancel a live or orphaned workflow run
  *
  * The caller provides a `createBackend` factory that determines how clink
  * calls are dispatched — either via child process or in-process.
  */
 import { CallToolRequestSchema, ListToolsRequestSchema, ErrorCode, McpError, } from "@modelcontextprotocol/sdk/types.js";
+import { existsSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { computeRunHealth } from "./run-health.js";
 import { loadWorkflow, listWorkflowCatalog } from "./loader.js";
-import { WorkflowEngine } from "./engine.js";
-import { WorkflowStateStore } from "./state.js";
+import { defaultWorkflowAllowedRoots, WorkflowEngine } from "./engine.js";
+import { readRunStateForStatus, reapRunCancelled, WorkflowStateStore } from "./state.js";
+import { isTerminalContextBuilderLifecycleStatus, parseContextBuilderLifecycleStateV1, } from "./context-builder-lifecycle-contract.js";
 import { validateRunId } from "./run-id.js";
-import { getTemplatesPath } from "./config.js";
-import { WorkflowCancellationError, } from "./errors.js";
+import { validateDynamicPaths } from "./path-validation.js";
+import { getMaxPromptBytes, getRunStateDir, getTemplatesPath, getWorkflowsContextDefault, getWorkflowsContextDefaultCurator, getWorkflowsMaxConcurrentAsync, resolveWorkspaceRoot, } from "./config.js";
+import { WorkflowCancellationError, WorkflowValidationError, } from "./errors.js";
 import { shutdownCoordinator } from "./shutdown.js";
-import { basename } from "node:path";
 import { logger } from "./logger.js";
 import { createValidatorRegistry } from "./validators/index.js";
 import { deriveDecisiveFailure } from "./run-summary-derived.js";
 import { buildRunSummaryOrUndefined, buildFailureRunSummary } from "./run-summary.js";
 import { extractCard } from "./run-summary/cards/index.js";
 import { renderWorkflowReceipt } from "./workflow-receipt.js";
-import { supportsRuntimeMembers, COUNCIL_RUNTIME_MEMBER_WORKFLOWS, expandCouncilComposition } from "./council-expander.js";
+import { supportsRuntimeMembers, COUNCIL_RUNTIME_MEMBER_WORKFLOWS, COUNCIL_STAGE_COUNT, expandCouncilComposition } from "./council-expander.js";
+import { resolveWorkflowContextMode, WorkflowContextModeResolverError, } from "./context-mode-resolver.js";
+import { resolveEffectiveChairmanCall } from "./chairman-knobs.js";
+import { disabledFinalizerOverrideRejection, effectiveFinalizerEnabled, } from "./delegate-finalizer-policy.js";
+import { delegateFinalizerMinScoreExplicit, WorkflowDelegateValidationError, } from "./delegate-validate.js";
+import { contextSearchTermsValidationError, contextSeedSourceValidationError, resolveSeedSource, } from "./seed-terms.js";
+import { LEGACY_PLAN_REVIEW_RECEIPTS_WORKFLOW_NAME, PLAN_REVIEW_RECEIPTS_WORKFLOW, admitCouncilPlanReview, assertPlanReviewPromptBudget, isPlanReviewRunState, } from "./plan-review/admission.js";
+import { PLAN_REVIEW_V1_CLI_NAMES } from "./plan-review/contract.js";
+import { buildCouncilPlanReviewDiscovery } from "./plan-review/discovery.js";
+import { expandCouncilPlanReview } from "./plan-review/expander.js";
+import { buildPlanReviewContextPolicy, findRejectedPlanContextAnchors, } from "./plan-review/context-policy.js";
+import { PLAN_SNAPSHOT_RELPATH, persistCanonicalPlanSnapshot, readCanonicalPlanSnapshot, writeExecutionContractSnapshot, } from "./plan-review/snapshot.js";
+import { deriveSeatMappings, reconstructPlanReviewCallBindings, } from "./plan-review/run-state.js";
+import { restorePlanReviewRun, } from "./plan-review/resume.js";
+import { PlanReviewStageError } from "./plan-review/stage-error.js";
+import { CouncilPlanReviewErrorSchema, createPlanReviewPublicationError, inspectPlanReviewPublication, } from "./plan-review/publication.js";
+import { validatePlanReviewCallBindings, validatePlanReviewPreparedInputPolicy, } from "./plan-review/runtime-policy.js";
+import { ContainedFilePolicyError, readContainedRelativeFile, } from "./contained-file.js";
+import { createDashboardRunReader } from "./dashboard/read-model.js";
+import { ROSTER_NAME_PATTERN, ResolvedRosterSchema, } from "./roster-contract.js";
+async function inspectLegacyWorkflowSessionLogGeneration(runDir, runId) {
+    try {
+        const result = await createDashboardRunReader().inspectGeneration?.(dirname(runDir), runId);
+        if (result?.kind === "present")
+            return result.runGeneration;
+        logger.debug({
+            run_id: runId,
+            reason: result === undefined ? "unsupported" : result.kind,
+        }, "workflow session-log generation unavailable; capture disabled");
+    }
+    catch {
+        logger.debug({ run_id: runId, reason: "inspection_failed" }, "workflow session-log generation unavailable; capture disabled");
+    }
+    return undefined;
+}
+/**
+ * Allowed roots for reading the caller's `plan_file`.
+ *
+ * Deliberately the workspace root ONLY. The state/artifact dirs are
+ * artifact-only roots — they are where runtime-owned output goes, never a
+ * source of reviewable plan text.
+ */
+function planFileAllowedRoots() {
+    return [resolveWorkspaceRoot()];
+}
+function createPreflightOnlyBackend(advertisedCliNames) {
+    return {
+        cliNames: [...(advertisedCliNames ?? [])],
+        roleNames: [],
+        isTerminated: false,
+        hasChildDied: false,
+        connect: async () => { },
+        callTool: async () => {
+            throw new Error("preflight-only backend cannot dispatch provider calls");
+        },
+        terminate: async () => { },
+    };
+}
 // ---------------------------------------------------------------------------
 // Admission control
 // ---------------------------------------------------------------------------
-let activeMutex = null;
-function acquireMutex(runId) {
-    if (activeMutex != null) {
-        throw new McpError(ErrorCode.InvalidRequest, `A workflow is already running (run_id: "${activeMutex.runId}", started: ${activeMutex.startedAt}). ` +
-            `Wait for it to complete or cancel it before starting another. ` +
-            `Only one workflow can run at a time per server instance.`);
+const activeRuns = new Map();
+/**
+ * Number of workflow tool handlers currently executing in the standalone
+ * registration path. This includes non-run tools such as status/list/cancel;
+ * it is kept separate from activeRuns because an admitted run can outlive its
+ * request handler (async mode), while a handler can be busy before admission.
+ */
+let activeWorkflowHandlers = 0;
+let workflowActivityObserver;
+/** Internal standalone-lifecycle seam; not part of the public package API. */
+export function getActiveWorkflowHandlerCount() {
+    return activeWorkflowHandlers;
+}
+/** Internal shared lifecycle seam used by the root server's compiled import. */
+export function getActiveWorkflowRunCount() {
+    return activeRuns.size;
+}
+/**
+ * Install the standalone server's activity sink. The observer is optional and
+ * process-local; library callers leave it unset, so importing this module or
+ * using the in-process registration path has no timer/lifecycle side effects.
+ */
+export function setWorkflowActivityObserver(observer) {
+    workflowActivityObserver = observer;
+}
+function notifyWorkflowActivity() {
+    try {
+        workflowActivityObserver?.();
+    }
+    catch (error) {
+        logger.warn({ err: error instanceof Error ? error.message : String(error) }, "workflow activity observer failed");
+    }
+}
+/**
+ * In-process registry of AbortControllers for live async runs, keyed by run_id.
+ * cancel_workflow aborts the controller to drive the run's own cancellation
+ * unwind. Registered at async admission (foreground) and deleted in the detached
+ * run's finally (a delete on an absent key is a harmless no-op, so the
+ * synchronous run path is unaffected).
+ */
+const cancelRegistry = new Map();
+export function resolveWorkflowAsyncAdmissionCap(options) {
+    const injected = options?.asyncAdmissionCap;
+    if (typeof injected === "number" &&
+        Number.isSafeInteger(injected) &&
+        injected >= 1) {
+        return injected;
+    }
+    return getWorkflowsMaxConcurrentAsync();
+}
+function acquireMutex(runId, options) {
+    if (shutdownCoordinator.isShuttingDown()) {
+        throw new McpError(ErrorCode.InvalidRequest, "workflow server is shutting down");
+    }
+    if (activeRuns.has(runId)) {
+        throw new McpError(ErrorCode.InvalidParams, `run_id ${runId} already running`);
+    }
+    const maxConcurrent = resolveWorkflowAsyncAdmissionCap(options);
+    if (activeRuns.size >= maxConcurrent) {
+        throw new McpError(ErrorCode.InvalidRequest, `max ${maxConcurrent} concurrent workflow(s); retry later`);
+    }
+    activeRuns.set(runId, { startedAt: new Date().toISOString() });
+}
+function releaseMutex(runId) {
+    activeRuns.delete(runId);
+    notifyWorkflowActivity();
+}
+/** Own setup before its first await, and keep that ownership through cleanup. */
+function acquireWorkflowRun(runId, options, requestSignal) {
+    acquireMutex(runId, options);
+    const controller = new AbortController();
+    const signal = requestSignal === undefined
+        ? controller.signal
+        : AbortSignal.any([requestSignal, controller.signal]);
+    let backend;
+    let termination;
+    const terminate = () => {
+        if (backend === undefined || backend.isTerminated)
+            return termination ?? Promise.resolve();
+        termination ??= Promise.resolve().then(() => backend.terminate());
+        return termination;
+    };
+    let complete;
+    const completion = new Promise((resolve) => { complete = resolve; });
+    let handle;
+    try {
+        // The run owns persistence and close; shutdown only interrupts the lazy
+        // backend and waits until the run's own finally releases all resources.
+        handle = shutdownCoordinator.register({ terminate }, controller, async () => { }, completion);
+    }
+    catch (error) {
+        releaseMutex(runId);
+        complete();
+        throw error;
+    }
+    if (requestSignal === undefined)
+        cancelRegistry.set(runId, controller);
+    return {
+        signal,
+        throwIfCancelled: () => {
+            if (signal.aborted)
+                throw new WorkflowCancellationError();
+        },
+        setBackend: (value) => { backend = value; },
+        finish: async (store) => {
+            try {
+                try {
+                    await terminate();
+                }
+                catch (err) {
+                    logger.warn({ err }, "backend.terminate() failed during cleanup");
+                }
+                try {
+                    await store?.close();
+                }
+                catch (err) {
+                    logger.warn({ err }, "store.close() failed during cleanup");
+                }
+            }
+            finally {
+                cancelRegistry.delete(runId);
+                releaseMutex(runId);
+                shutdownCoordinator.unregister(handle);
+                complete();
+            }
+        },
+    };
+}
+async function markWorkflowCancelled(store) {
+    try {
+        await store?.markCancelled();
+    }
+    catch (err) {
+        // Preserve cancellation/no-response even if best-effort persistence fails.
+        logger.warn({ err }, "markCancelled during cancellation handling failed");
     }
-    activeMutex = { runId, startedAt: new Date().toISOString() };
 }
-function releaseMutex() {
-    activeMutex = null;
+// Keep in sync with schema.ts model regex and ModelSchema (delegate-validate.ts).
+const MODEL_OVERRIDE_PATTERN = /^[^\s\u0000-][^\s\u0000]*$/;
+// Keep in sync with schema.ts effort regex and EffortSchema (delegate-validate.ts).
+const EFFORT_OVERRIDE_PATTERN = /^[a-z0-9][a-z0-9_-]*$/;
+function parseInvocationOverride(raw, label, maxLength, pattern) {
+    if (typeof raw !== "string") {
+        throw new McpError(ErrorCode.InvalidParams, `${label} must be a string`);
+    }
+    const value = raw.trim();
+    if (value.length === 0) {
+        throw new McpError(ErrorCode.InvalidParams, `${label} must not be empty`);
+    }
+    if (value.length > maxLength) {
+        throw new McpError(ErrorCode.InvalidParams, `${label} must be at most ${maxLength} characters`);
+    }
+    if (!pattern.test(value)) {
+        throw new McpError(ErrorCode.InvalidParams, `${label} has an invalid format`);
+    }
+    return value;
 }
 export function parseMembersOverride(raw, knownCliNames) {
     if (raw == null)
@@ -63,7 +271,7 @@ export function parseMembersOverride(raw, knownCliNames) {
             throw new McpError(ErrorCode.InvalidParams, `members[${i}] must be a non-null object`);
         }
         const keys = Object.keys(item);
-        const allowedKeys = new Set(["cli_name", "stance"]);
+        const allowedKeys = new Set(["cli_name", "stance", "model", "effort"]);
         for (const key of keys) {
             if (!allowedKeys.has(key)) {
                 throw new McpError(ErrorCode.InvalidParams, `members[${i}] has unexpected key "${key}"`);
@@ -102,6 +310,12 @@ export function parseMembersOverride(raw, knownCliNames) {
         else if (i >= 3) {
             throw new McpError(ErrorCode.InvalidParams, "stance is required for members at index 3 and above");
         }
+        if (obj["model"] !== undefined) {
+            entry.model = parseInvocationOverride(obj["model"], `members[${i}].model`, 128, MODEL_OVERRIDE_PATTERN);
+        }
+        if (obj["effort"] !== undefined) {
+            entry.effort = parseInvocationOverride(obj["effort"], `members[${i}].effort`, 32, EFFORT_OVERRIDE_PATTERN);
+        }
         result.push(entry);
     }
     return result;
@@ -125,6 +339,131 @@ export function parseChairmanOverride(raw, knownCliNames) {
     }
     return trimmed;
 }
+function parseChairmanModelOverride(raw) {
+    if (raw === undefined)
+        return undefined;
+    return parseInvocationOverride(raw, "chairman_model", 128, MODEL_OVERRIDE_PATTERN);
+}
+function parseChairmanEffortOverride(raw) {
+    if (raw === undefined)
+        return undefined;
+    return parseInvocationOverride(raw, "chairman_effort", 32, EFFORT_OVERRIDE_PATTERN);
+}
+function invocationOverrideKnobs(value) {
+    if (value.model === undefined && value.effort === undefined) {
+        return undefined;
+    }
+    return {
+        ...(value.model === undefined ? {} : { model: value.model }),
+        ...(value.effort === undefined ? {} : { effort: value.effort }),
+    };
+}
+function validateInvocationOverridesAtAdmission(workflow, definition, parsedMembers, parsedChairman, parsedChairmanModel, parsedChairmanEffort, initialContextPolicy, resolvedVariables, validate, callerDelegateRaw) {
+    // Structural E5: independent of the optional adapter-capability hook so the
+    // standalone server rejects a disabled-finalizer override too. No-op when
+    // the policy has no enabled delegate (including the no-runner `off` default).
+    const admissionDelegate = initialContextPolicy.effectiveDelegate;
+    if (admissionDelegate?.enabled === true) {
+        const rejection = disabledFinalizerOverrideRejection(admissionDelegate, resolvedVariables, delegateFinalizerMinScoreExplicit(callerDelegateRaw));
+        if (rejection !== undefined) {
+            throw new McpError(ErrorCode.InvalidParams, rejection);
+        }
+    }
+    if (validate == null)
+        return;
+    const councilWorkflow = COUNCIL_RUNTIME_MEMBER_WORKFLOWS.has(workflow);
+    if (councilWorkflow && definition.stages.length !== COUNCIL_STAGE_COUNT) {
+        throw new McpError(ErrorCode.InvalidParams, `Council workflow "${workflow}" expects ${COUNCIL_STAGE_COUNT} stages, found ${definition.stages.length}`);
+    }
+    const staticChairman = councilWorkflow
+        ? definition.stages[3]?.calls[0]
+        : undefined;
+    for (const [stageIndex, stage] of definition.stages.entries()) {
+        for (const call of stage.calls) {
+            if (call === staticChairman) {
+                continue;
+            }
+            if (parsedMembers !== undefined && stageIndex < 2) {
+                continue;
+            }
+            const knobs = invocationOverrideKnobs(call);
+            if (knobs !== undefined) {
+                validate(call.cli_name, knobs);
+            }
+        }
+    }
+    if (parsedMembers !== undefined) {
+        for (const member of parsedMembers) {
+            const knobs = invocationOverrideKnobs(member);
+            if (knobs !== undefined) {
+                validate(member.cli_name, knobs);
+            }
+        }
+    }
+    if (councilWorkflow && staticChairman !== undefined) {
+        const effectiveChairman = resolveEffectiveChairmanCall({
+            staticCall: staticChairman,
+            chairmanCliName: parsedChairman,
+            chairmanModel: parsedChairmanModel,
+            chairmanEffort: parsedChairmanEffort,
+        });
+        const knobs = invocationOverrideKnobs(effectiveChairman);
+        if (knobs !== undefined) {
+            validate(effectiveChairman.cli_name, knobs);
+        }
+    }
+    const delegate = initialContextPolicy.effectiveDelegate;
+    if (delegate?.enabled === true) {
+        const curatorKnobs = invocationOverrideKnobs(delegate.curator);
+        if (curatorKnobs !== undefined) {
+            validate(delegate.curator.cli_name, curatorKnobs);
+        }
+        if (effectiveFinalizerEnabled(delegate, resolvedVariables)) {
+            const finalizerKnobs = invocationOverrideKnobs(delegate.finalizer);
+            if (finalizerKnobs !== undefined) {
+                validate(delegate.finalizer.cli_name, finalizerKnobs);
+            }
+        }
+    }
+}
+/**
+ * Point a generic-council caller at the input shape the workflow actually takes.
+ *
+ * Appended by the boundary decorator wrapping the whole pre-mutex admission
+ * block, so it rides on ANY `InvalidParams` rejection of a generic-shaped
+ * `plan-review-receipts` request — not only the `members`/`chairman` roster
+ * gates. A generic `user_request`-shaped caller can trip several independent
+ * pre-state checks (the roster-override parsers themselves, the two roster
+ * gates, unknown `user_request`/`cb_delegate` variables, context-mode and root
+ * validation, the conditional `cb_task` seed, task-secret validation, and the
+ * missing typed `plan_review`); whichever fires first now names the
+ * destination, instead of the caller re-submitting and being told something
+ * different each round trip.
+ *
+ * The decorator is gated on a RAW-`args` shape predicate, not on parsed
+ * values, specifically because a parser throw means no parsed value exists
+ * yet: `parseMembersOverride` rejects `[]` and unknown `cli_name`s before
+ * `parsedMembers` is ever bound, and that is exactly a case the hint must
+ * cover.
+ *
+ * Deliberately a HINT appended to the existing message, not a reordered check.
+ * Hoisting the `plan_review` requirement above the roster gate would mask
+ * malformed roster overrides behind a missing-contract error, and split the
+ * requirement from its authoritative mirror in `admitCouncilPlanReview`. The
+ * decorator changes no ordering, so that reasoning still holds.
+ */
+function planReviewShapeHint() {
+    return (`. ${PLAN_REVIEW_RECEIPTS_WORKFLOW} takes a typed "plan_review" contract instead:` +
+        ` the roster is plan_review.seats[] and the chairman is plan_review.chairman_seat` +
+        ` (a seat_id, not an adapter name). It declares neither a "user_request" nor a` +
+        ` "cb_delegate" variable, and its "cb_task" seed is conditionally required:` +
+        ` trimmed-nonblank whenever context preflight is available (the default` +
+        ` deployment), and genuinely optional only on a server where preflight is` +
+        ` unavailable. It is driven by the plan-review-loop skill, not a generic` +
+        ` council template. For a generic members/chairman/user_request plan review` +
+        ` without the typed contract, use the "council-plan-review" workflow; the` +
+        ` typed plan_review contract belongs only to "plan-review-receipts".`);
+}
 // ---------------------------------------------------------------------------
 // Variable validation (6-6)
 // ---------------------------------------------------------------------------
@@ -136,7 +475,8 @@ function formatExpectedVariables(schema) {
     }
     return parts.length > 0 ? `Expected variables: ${parts.join(", ")}` : "";
 }
-function validateVariables(supplied, schema) {
+/** @internal Shared with the compiled producer-fixture admission check. */
+export function validateVariables(supplied, schema) {
     const resolved = {};
     const errors = [];
     for (const [name, def] of Object.entries(schema)) {
@@ -174,6 +514,153 @@ function validateVariables(supplied, schema) {
     }
     return resolved;
 }
+/**
+ * Reject caller-supplied dynamic path variables that fall outside the workflow
+ * engine's allowed roots, at ADMISSION — before the concurrency mutex, before
+ * any run state exists, and before context preflight spends a delegate
+ * round-trip. The engine already rejects these paths, but only at
+ * `validateInputPathsExist()`, which runs AFTER preflight: by then the caller
+ * has paid for a curator/finalizer subprocess and is left with a `failed` run
+ * directory to inspect and prune.
+ *
+ * This is a pre-check, NOT a replacement. The engine's post-preflight check
+ * must stay: it is the only thing that covers preflight-produced bundle copies
+ * appended to `context_bundle_files`, which do not exist yet at admission.
+ *
+ * Three deliberate narrowings, each of which exists to avoid rejecting a run
+ * that succeeds today:
+ *
+ * (i)   Only variable names the DEFINITION actually wires through
+ *       `absolute_file_paths_from` / `images_from` are validated. A caller may
+ *       legitimately pass any other declared variable that happens to hold
+ *       path-like strings; the engine never resolves those as paths, so
+ *       validating them here would reject working runs.
+ * (ii)  `plan-review-receipts` is skipped entirely.
+ *       `enforcePlanReviewContextExclusions` strips force-excluded plan paths
+ *       BEFORE the engine's check, so a path destined for stripping is never
+ *       validated today and must not start being rejected at admission.
+ * (iii) The resume path does not call this. Resume prefers persisted inputs and
+ *       skips completed calls, so re-validating current variables could reject a
+ *       resume whose original admission passed.
+ *
+ * Non-array values and non-string entries are deliberately NOT rejected here —
+ * they are left to the engine so its existing error text is unchanged.
+ */
+function assertCallerDynamicPathsAllowed(normalized, variables, workflowName, runId) {
+    // Caveat (ii).
+    if (workflowName === PLAN_REVIEW_RECEIPTS_WORKFLOW) {
+        return;
+    }
+    // Caveat (i): the set of variable names this definition wires as paths.
+    const wiredNames = new Set();
+    const collectWiredNames = (declared) => {
+        if (typeof declared === "string") {
+            wiredNames.add(declared);
+            return;
+        }
+        if (declared === undefined) {
+            return;
+        }
+        for (const name of declared) {
+            wiredNames.add(name);
+        }
+    };
+    for (const stage of normalized.stages) {
+        for (const call of stage.calls) {
+            collectWiredNames(call.absolute_file_paths_from);
+            collectWiredNames(call.images_from);
+        }
+    }
+    if (wiredNames.size === 0) {
+        return;
+    }
+    // The engine derives its own roots and never consults CLINKX_ALLOWED_ROOTS;
+    // mirror that exact set so admission cannot be stricter or looser than
+    // dispatch.
+    const allowedRoots = defaultWorkflowAllowedRoots(getRunStateDir(runId));
+    const workspaceRoot = resolveWorkspaceRoot();
+    for (const name of wiredNames) {
+        const rawValue = variables[name];
+        if (!Array.isArray(rawValue)) {
+            continue;
+        }
+        // Mirrors resolveDynamicPathVariable (engine.ts) exactly.
+        const values = rawValue
+            .filter((entry) => typeof entry === "string")
+            .map((entry) => (isAbsolute(entry) ? entry : resolve(workspaceRoot, entry)));
+        if (values.length === 0) {
+            continue;
+        }
+        try {
+            validateDynamicPaths(values, allowedRoots, `${workflowName}.${name}`);
+        }
+        catch (err) {
+            if (err instanceof WorkflowValidationError) {
+                throw new McpError(ErrorCode.InvalidParams, err.message);
+            }
+            throw err;
+        }
+    }
+}
+function validateContextBuilderAnchorSufficiency(variables, runner, contextDefault, defaultCurator) {
+    if (runner == null) {
+        return undefined;
+    }
+    let policy;
+    try {
+        // Throws on an invalid cb_context_mode / cb_delegate combination (surfaced
+        // below as -32602). The resolved policy is also returned for admission-time
+        // checks that must stay inert under soft off.
+        policy = resolveWorkflowContextMode(variables["cb_context_mode"], contextDefault, true, variables["cb_delegate"], defaultCurator);
+    }
+    catch (error) {
+        if (error instanceof WorkflowContextModeResolverError ||
+            error instanceof WorkflowDelegateValidationError) {
+            throw new McpError(ErrorCode.InvalidParams, error.message);
+        }
+        throw error;
+    }
+    const cbRoots = readStringArrayForAnchorCheck(variables["cb_roots"]);
+    // Eager allowlist validation: explicit cb_roots are validated whenever
+    // provided, including soft off. Out-of-allowlist roots are rejected at the
+    // boundary as -32602. The disabled hard kill never reaches this validator.
+    if (cbRoots.length > 0) {
+        try {
+            runner.assertRootsAllowed(cbRoots);
+        }
+        catch (err) {
+            throw new McpError(ErrorCode.InvalidParams, err instanceof Error ? err.message : String(err));
+        }
+    }
+    // policy.preflightDisabled is unreachable here: this validator early-returns
+    // when runner == null and always resolves with preflightEnabled:true, so the
+    // resolver never returns a disabled policy on this path.
+    return policy;
+}
+function validateContextSeedSourceAtAdmission(variables, policy) {
+    if (policy == null) {
+        return;
+    }
+    const cbTask = typeof variables["cb_task"] === "string"
+        ? variables["cb_task"]
+        : undefined;
+    const userRequest = typeof variables["user_request"] === "string"
+        ? variables["user_request"]
+        : undefined;
+    const seedSource = resolveSeedSource(cbTask, userRequest);
+    const seedSourceError = contextSeedSourceValidationError(seedSource);
+    if (seedSourceError != null) {
+        throw new McpError(ErrorCode.InvalidParams, seedSourceError);
+    }
+    const searchTerms = readStringArrayForAnchorCheck(variables["cb_search_terms"]);
+    const searchTermsError = contextSearchTermsValidationError(searchTerms);
+    if (searchTermsError != null) {
+        throw new McpError(ErrorCode.InvalidParams, searchTermsError);
+    }
+}
+function readStringArrayForAnchorCheck(value) {
+    return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : [];
+}
 function validateVariableType(name, value, expectedType) {
     switch (expectedType) {
         case "string":
@@ -597,6 +1084,52 @@ function finalizeWorkflowPresentation(options) {
     }
     return content;
 }
+/**
+ * Wire projection of the warn-only duplicate-replay signal recorded at
+ * `WorkflowStateStore.create()` (failure investigation F6). Additive and
+ * advisory: identical snapshot hashes do NOT imply an identical outcome —
+ * workspace content is not covered by the hashes and providers are
+ * nondeterministic — so this field never gates admission or execution.
+ * Defensive optional access: partial store mocks may omit the property.
+ */
+function buildDuplicateOfFailedRunField(store) {
+    const signal = store?.duplicateOfFailedRun;
+    if (signal === undefined || signal === null)
+        return undefined;
+    return {
+        run_id: signal.runId,
+        ...(signal.completedAt !== undefined ? { completed_at: signal.completedAt } : {}),
+    };
+}
+/**
+ * Appends the duplicate-replay signal as a trailing additive content block on
+ * sync run_workflow results (success and error). No block is added when no
+ * signal was detected, so existing content ordering is untouched.
+ */
+function appendDuplicateReplayBlock(content, store) {
+    const duplicateOfFailedRun = buildDuplicateOfFailedRunField(store);
+    if (duplicateOfFailedRun === undefined)
+        return;
+    content.push({
+        type: "text",
+        text: JSON.stringify({ duplicate_of_failed_run: duplicateOfFailedRun }),
+    });
+}
+/**
+ * Trailing additive content block for the admission-time requested-value
+ * roster. Omitted when the run did not persist one (non-council, plan-review,
+ * or pre-roster state). Defensive optional access: partial store mocks may
+ * omit runState.
+ */
+function appendResolvedRosterBlock(content, store) {
+    const resolvedRoster = store?.runState?.resolvedRoster;
+    if (resolvedRoster === undefined)
+        return;
+    content.push({
+        type: "text",
+        text: JSON.stringify({ resolved_roster: resolvedRoster }),
+    });
+}
 // ---------------------------------------------------------------------------
 // Actionable error formatting (5-6)
 // ---------------------------------------------------------------------------
@@ -655,15 +1188,77 @@ function formatWorkflowError(runId, error, store, workflowSource) {
     let nextAction = "";
     if (store != null) {
         const isResumable = state?.resumable === true;
-        nextAction = isResumable
-            ? `Use resume_workflow with run_id "${runId}" to retry from the last checkpoint.`
-            : `Start a new run with run_workflow (this run is not resumable — set CLINKX_WORKFLOWS_CHILD_CONFIG_PATH for resumable runs).`;
+        const isTerminalPlanReview = state != null &&
+            isPlanReviewRunState(state) &&
+            (state.status === "failed" ||
+                state.status === "cancelled" ||
+                state.status === "succeeded");
+        nextAction = isTerminalPlanReview
+            ? `Start a new run with run_workflow and a new run_id; terminal plan-review-receipts runs are immutable.`
+            : isResumable
+                ? `Use resume_workflow with run_id "${runId}" to retry from the last checkpoint.`
+                : `Start a new run with run_workflow (this run is not resumable — set CLINKX_WORKFLOWS_CHILD_CONFIG_PATH for resumable runs).`;
     }
     return (`Workflow failed [run_id: ${runId}]${sourceLabel}${location}` +
         (retryCount > 0 ? ` (after ${String(retryCount)} retries)` : "") +
         `: ${message}${metaBlock}` +
         (nextAction !== "" ? `\n\n${nextAction}` : ""));
 }
+function toCouncilPlanReviewError(runId, error) {
+    if (!(error instanceof PlanReviewStageError)) {
+        return undefined;
+    }
+    return CouncilPlanReviewErrorSchema.parse({
+        schema_version: "council-plan-review-error-v1",
+        run_id: runId,
+        execution_status: "failed",
+        stage: error.stage,
+        error: {
+            reason: error.reason,
+            detail: error.message.slice(0, 2_048),
+        },
+    });
+}
+/**
+ * Read a well-formed `failureClass` the error already carries. Structural on
+ * purpose: errors crossing the engine boundary cannot be narrowed by
+ * `instanceof` here, and this must never GUESS a class — an error without one
+ * yields undefined, which `markFailed` treats as "leave the existing class
+ * alone".
+ */
+function carriedFailureClass(error) {
+    if (error == null || typeof error !== "object") {
+        return undefined;
+    }
+    const value = error.failureClass;
+    return value === "transient" || value === "permanent" ? value : undefined;
+}
+async function markWorkflowFailed(store, runId, error) {
+    const message = error instanceof Error ? error.message : String(error);
+    // Forward a class the error already carries. Load-bearing on the RESUME path:
+    // `beginResumeAttempt` clears `failureClass`, and the resume preflight engine
+    // never runs `execute()`, so its catch never stamps one — without this a
+    // bounded-preflight timeout persists `failed` with no class at all, while the
+    // identical first-run failure keeps `transient`. Safe for the other call
+    // sites: `markFailed` assigns only when defined, so an error carrying no
+    // class still cannot clobber a class the engine already emitted.
+    const planReviewError = toCouncilPlanReviewError(runId, error);
+    if (planReviewError !== undefined) {
+        // Plan-review terminal intent is first-wins. Forwarding a class here would
+        // flip `replaceFailureClass` and overwrite a recorded intent, so this call
+        // stays exactly as it was.
+        await store.markFailed(message, undefined, planReviewError);
+        return;
+    }
+    const failureClass = carriedFailureClass(error);
+    if (failureClass === undefined) {
+        // Nothing to add: keep the original single-argument call so callers that
+        // rely on `markFailed`'s existing behavior are byte-identical.
+        await store.markFailed(message);
+        return;
+    }
+    await store.markFailed(message, failureClass);
+}
 function getCallEntryByLocation(stages, location) {
     const dotIndex = location.indexOf(".");
     if (dotIndex === -1) {
@@ -675,6 +1270,54 @@ function getCallEntryByLocation(stages, location) {
     return stage?.calls.find((call) => call.callId === callId);
 }
 // ---------------------------------------------------------------------------
+// Roster preset admission (pre-mutex, pre-state)
+// ---------------------------------------------------------------------------
+function applyRosterPresetAtAdmission(workflow, args, variables, rosterLoader) {
+    const raw = args["roster"];
+    if (typeof raw !== "string") {
+        throw new McpError(ErrorCode.InvalidParams, "roster must be a string");
+    }
+    if (!COUNCIL_RUNTIME_MEMBER_WORKFLOWS.has(workflow)) {
+        throw new McpError(ErrorCode.InvalidParams, `roster parameter is not supported for workflow "${workflow}"`);
+    }
+    const conflicts = [];
+    if (args["members"] != null)
+        conflicts.push("members");
+    if (args["chairman"] != null)
+        conflicts.push("chairman");
+    if (args["chairman_model"] != null)
+        conflicts.push("chairman_model");
+    if (args["chairman_effort"] != null)
+        conflicts.push("chairman_effort");
+    const cbDelegate = variables?.["cb_delegate"];
+    if (typeof cbDelegate === "string" && cbDelegate !== "") {
+        conflicts.push("cb_delegate");
+    }
+    if (conflicts.length > 0) {
+        throw new McpError(ErrorCode.InvalidParams, `roster is exclusive and cannot be combined with ${conflicts.join(", ")}`);
+    }
+    if (rosterLoader == null) {
+        throw new McpError(ErrorCode.InvalidParams, "rosters are not available on this server");
+    }
+    const preset = rosterLoader.load(raw);
+    if (preset === undefined) {
+        const available = rosterLoader.list().map((entry) => entry.name).join(", ");
+        throw new McpError(ErrorCode.InvalidParams, `roster "${raw}" is not a known roster. Available: ${available}`);
+    }
+    const chairman = preset.chairman;
+    const nextVariables = preset.delegate !== undefined
+        ? { ...(variables ?? {}), cb_delegate: JSON.stringify(preset.delegate) }
+        : variables;
+    return {
+        rosterName: raw,
+        membersRaw: preset.members,
+        chairmanRaw: chairman?.cli_name,
+        chairmanModelRaw: chairman?.model,
+        chairmanEffortRaw: chairman?.effort,
+        variables: nextVariables,
+    };
+}
+// ---------------------------------------------------------------------------
 // Tool execution helpers
 // ---------------------------------------------------------------------------
 async function executeRunWorkflow(server, options, args, signal, progressToken) {
@@ -704,108 +1347,589 @@ async function executeRunWorkflow(server, options, args, signal, progressToken)
     const knownCliNames = options.availableCliNames != null
         ? new Set(options.availableCliNames)
         : undefined;
-    const parsedMembers = parseMembersOverride(args["members"], knownCliNames);
-    const parsedChairman = parseChairmanOverride(args["chairman"], knownCliNames);
-    if (parsedMembers != null && !COUNCIL_RUNTIME_MEMBER_WORKFLOWS.has(workflow)) {
-        throw new McpError(ErrorCode.InvalidParams, `members parameter is not supported for workflow "${workflow}"`);
-    }
-    if (parsedChairman != null && !COUNCIL_RUNTIME_MEMBER_WORKFLOWS.has(workflow)) {
-        throw new McpError(ErrorCode.InvalidParams, `chairman parameter is not supported for workflow "${workflow}"`);
-    }
-    const resolvedVariables = validateVariables(variables, loaded.definition.variables);
-    acquireMutex(runId);
-    let store = null;
-    let backend = null;
-    let reporter;
+    // Read RAW `args`, not parsed values: `parseMembersOverride` throws on `[]`
+    // and on an unknown `cli_name`, so in exactly the cases the hint exists to
+    // cover, `parsedMembers` is never bound.
+    const genericShaped = workflow === PLAN_REVIEW_RECEIPTS_WORKFLOW &&
+        (args["plan_review"] == null ||
+            args["members"] != null ||
+            args["chairman"] != null ||
+            args["chairman_model"] != null ||
+            args["chairman_effort"] != null ||
+            args["roster"] != null);
+    // Declarations hoisted out of the decorator's try so the bindings stay in
+    // scope for the post-admission code below; the assignments and their order
+    // are unchanged.
+    let parsedMembers;
+    let parsedChairman;
+    let parsedChairmanModel;
+    let parsedChairmanEffort;
+    let resolvedVariables;
+    let initialContextPolicy;
+    let planReviewAdmission;
+    let admittedRosterName;
     try {
-        const effectiveDefinition = (parsedMembers != null || parsedChairman != null)
-            ? expandCouncilComposition(loaded.normalized, parsedMembers ?? undefined, workflow, parsedChairman)
-            : loaded.normalized;
-        // Create state store (resumable if child config path is set)
-        store = await WorkflowStateStore.create({
-            runId,
-            definition: effectiveDefinition,
-            variables: resolvedVariables,
-            debugKeepArtifacts: debug,
-        });
-        // Create backend via factory
-        backend = options.createBackend(runId);
-        await backend.connect();
-        // Wire up shutdown coordinator
-        const controller = new AbortController();
-        if (signal.aborted) {
-            controller.abort(new WorkflowCancellationError());
+        let membersRaw = args["members"];
+        let chairmanRaw = args["chairman"];
+        let chairmanModelRaw = args["chairman_model"];
+        let chairmanEffortRaw = args["chairman_effort"];
+        let suppliedVariables = variables;
+        if (args["roster"] !== undefined) {
+            const applied = applyRosterPresetAtAdmission(workflow, args, variables, options.rosterLoader);
+            admittedRosterName = applied.rosterName;
+            membersRaw = applied.membersRaw;
+            chairmanRaw = applied.chairmanRaw;
+            chairmanModelRaw = applied.chairmanModelRaw;
+            chairmanEffortRaw = applied.chairmanEffortRaw;
+            suppliedVariables = applied.variables;
+        }
+        parsedMembers = parseMembersOverride(membersRaw, knownCliNames);
+        parsedChairman = parseChairmanOverride(chairmanRaw, knownCliNames);
+        parsedChairmanModel = parseChairmanModelOverride(chairmanModelRaw);
+        parsedChairmanEffort = parseChairmanEffortOverride(chairmanEffortRaw);
+        if (parsedMembers != null && !COUNCIL_RUNTIME_MEMBER_WORKFLOWS.has(workflow)) {
+            throw new McpError(ErrorCode.InvalidParams, `members parameter is not supported for workflow "${workflow}"`);
+        }
+        if (parsedChairman != null && !COUNCIL_RUNTIME_MEMBER_WORKFLOWS.has(workflow)) {
+            throw new McpError(ErrorCode.InvalidParams, `chairman parameter is not supported for workflow "${workflow}"`);
         }
-        else {
-            signal.addEventListener("abort", () => {
-                controller.abort(new WorkflowCancellationError());
-            }, { once: true });
+        if (parsedChairmanModel != null && !COUNCIL_RUNTIME_MEMBER_WORKFLOWS.has(workflow)) {
+            throw new McpError(ErrorCode.InvalidParams, `chairman_model parameter is not supported for workflow "${workflow}"`);
         }
-        shutdownCoordinator.register(backend, controller, async () => {
-            if (store != null) {
-                await store.markCancelled();
+        if (parsedChairmanEffort != null && !COUNCIL_RUNTIME_MEMBER_WORKFLOWS.has(workflow)) {
+            throw new McpError(ErrorCode.InvalidParams, `chairman_effort parameter is not supported for workflow "${workflow}"`);
+        }
+        resolvedVariables = validateVariables(suppliedVariables, loaded.definition.variables);
+        // When the runner is absent (preflight disabled / hard kill), the boundary
+        // validator is inert. Skip it WITHOUT evaluating the context-default env
+        // parsers — getWorkflowsContextDefaultCurator() throws on empty env, and a
+        // runner-less run_workflow must never trip context env parsing.
+        let contextPolicy;
+        if (options.contextBuilderRunner != null) {
+            contextPolicy = validateContextBuilderAnchorSufficiency(resolvedVariables, options.contextBuilderRunner, options.contextDefault ?? getWorkflowsContextDefault(), options.defaultCurator ?? getWorkflowsContextDefaultCurator());
+        }
+        validateContextSeedSourceAtAdmission(resolvedVariables, contextPolicy);
+        // Pre-mutex, pre-state, pre-preflight: an out-of-roots caller path costs
+        // zero delegate round-trips and leaves no run directory behind.
+        assertCallerDynamicPathsAllowed(loaded.normalized, resolvedVariables, workflow, runId);
+        initialContextPolicy = contextPolicy ?? resolveWorkflowContextMode(undefined, options.contextDefault ?? "off", false, undefined, options.defaultCurator);
+        if (options.contextBuilderRunner != null) {
+            try {
+                options.contextBuilderRunner.assertTaskSecretsAllowed(resolvedVariables);
             }
-        });
-        // Build engine hooks — capture store in a const for closure narrowing
-        const storeRef = store;
-        reporter = progressToken != null
-            ? new WorkflowProgressReporter(server, progressToken, runId, effectiveDefinition)
-            : undefined;
-        const rpt = reporter; // local const for closure narrowing
-        const hooks = {
-            ...storeRef.hooks,
-            ...(rpt != null
-                ? {
-                    onProgress: async (event) => {
-                        await storeRef.hooks.onProgress?.(event);
-                        await rpt.onProgress(event);
-                    },
-                    onRetryScheduled: async (event) => {
-                        await storeRef.hooks.onRetryScheduled?.(event);
-                        await rpt.onRetryScheduled(event);
-                    },
+            catch (err) {
+                if (err instanceof McpError) {
+                    throw err;
                 }
-                : {}),
-        };
-        const engine = new WorkflowEngine({
-            definition: effectiveDefinition,
-            session: backend,
+                throw new McpError(ErrorCode.InvalidParams, err instanceof Error ? err.message : String(err));
+            }
+        }
+        const planReviewCliNames = options.planReviewAvailableCliNames ?? options.availableCliNames;
+        planReviewAdmission = admitCouncilPlanReview({
+            workflow,
+            planReview: args["plan_review"],
             variables: resolvedVariables,
-            validatorRegistry,
-            runId,
-            runDir: storeRef.runDir,
-            signal: controller.signal,
-            hooks,
+            ...(planReviewCliNames !== undefined
+                ? { availableCliNames: planReviewCliNames }
+                : {}),
         });
-        const result = await engine.execute();
-        shutdownCoordinator.unregister();
-        // Build summary (fail-open)
-        let summary;
-        if (receipt) {
+    }
+    catch (err) {
+        // Append the hint by MUTATING the caught error and rethrowing that same
+        // instance. Do NOT re-wrap it in `new McpError(err.code, err.message + …)`:
+        // the SDK constructor prefixes its argument with `MCP error <code>: `, so
+        // `err.message` already carries that prefix and re-constructing emits it
+        // twice on the wire (`MCP error -32602: MCP error -32602: …`). Mutating in
+        // place also preserves `code`, `data`, and the original stack.
+        if (genericShaped && err instanceof McpError && err.code === ErrorCode.InvalidParams) {
+            err.message = `${err.message}${planReviewShapeHint()}`;
+        }
+        throw err;
+    }
+    validateInvocationOverridesAtAdmission(workflow, loaded.normalized, parsedMembers, parsedChairman, parsedChairmanModel, parsedChairmanEffort, initialContextPolicy, resolvedVariables, options.validateInvocationOverrides, 
+    // Caller-supplied cb_delegate only, never the roster-materialized one: a
+    // roster preset is Zod-parsed at load, which defaults min_score and erases
+    // whether the preset file actually requested it.
+    admittedRosterName === undefined ? variables?.["cb_delegate"] : undefined);
+    // A-7: reject caller context anchors that resolve to the bound plan or any
+    // plan-workspace PLAN.md. Pre-mutex, so a rejected request creates no state:
+    // the caller must not be able to hand actors a MUTABLE plan alongside the
+    // immutable snapshot.
+    let planReviewPlan;
+    if (planReviewAdmission !== undefined) {
+        const contextPolicy = buildPlanReviewContextPolicy(planReviewAdmission.input.plan_file);
+        const rejected = findRejectedPlanContextAnchors(contextPolicy, resolvedVariables, resolveWorkspaceRoot());
+        if (rejected.length > 0) {
+            throw new McpError(ErrorCode.InvalidParams, `plan-review-receipts forbids plan context anchors; reviewers receive only the immutable snapshot. Offending entries: ${rejected
+                .map((entry) => `${entry.variable}: ${entry.path}`)
+                .join(", ")}`);
+        }
+        planReviewPlan = {
+            admission: planReviewAdmission,
+            contextPolicy,
+            // Deterministic, runtime-owned: the definition must name the snapshot
+            // before `create()` makes the run dir, so the path is derived rather than
+            // discovered. A post-create guard asserts the store agrees.
+            snapshotAbsolutePath: join(getRunStateDir(runId), PLAN_SNAPSHOT_RELPATH),
+        };
+    }
+    const isAsync = args["async"] === true;
+    const ownership = acquireWorkflowRun(runId, options, isAsync ? undefined : signal);
+    if (isAsync) {
+        // Everything between acquireMutex and the detached spawn must release the
+        // mutex on ANY throw, or the run slot leaks permanently (bricks the server
+        // at the default cap of 1).
+        let store;
+        let effectiveDefinition;
+        let initializedPlanReview;
+        let preparedSnapshot;
+        try {
+            ownership.throwIfCancelled();
+            const runDir = getRunStateDir(runId);
+            if (existsSync(runDir)) {
+                throw new McpError(ErrorCode.InvalidParams, `run_id ${runId} already has persisted state at ${runDir}`);
+            }
+            // Read + digest-verify the plan BEFORE composing: the expander inlines
+            // the snapshot text, so it must exist by expansion time (D9).
+            preparedSnapshot = planReviewPlan === undefined
+                ? undefined
+                : await preparePlanReviewSnapshot(planReviewPlan);
+            ownership.throwIfCancelled();
+            // Expand composition ONCE in the foreground; the detached run reuses it.
+            effectiveDefinition = expandRunWorkflowDefinition(loaded.normalized, workflow, parsedMembers, parsedChairman, parsedChairmanModel, parsedChairmanEffort, planReviewPlan, preparedSnapshot);
+            const resolvedRoster = resolvedRosterForAdmission(workflow, effectiveDefinition, parsedMembers, parsedChairman, parsedChairmanModel, parsedChairmanEffort, initialContextPolicy, resolvedVariables, admittedRosterName);
+            // Create the durable, pollable state record in the FOREGROUND so a failure
+            // here surfaces synchronously (a real error, never a false "running").
             try {
-                const cardExtractor = createCardExtractor(effectiveDefinition);
-                summary = buildRunSummaryOrUndefined(result, store, cardExtractor);
+                store = await WorkflowStateStore.create({
+                    runId,
+                    definition: effectiveDefinition,
+                    variables: resolvedVariables,
+                    debugKeepArtifacts: debug,
+                    async: true,
+                    initialContextPolicy,
+                    ...(resolvedRoster !== undefined ? { resolvedRoster } : {}),
+                    ...(admittedRosterName !== undefined ? { rosterName: admittedRosterName } : {}),
+                });
             }
             catch (err) {
-                logger.warn({ err }, "run summary construction failed, omitting receipt");
+                throw new McpError(ErrorCode.InternalError, `Failed to initialize async run ${runId}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            ownership.throwIfCancelled();
+            // A-10: the async acknowledgement is a durability boundary. A caller
+            // cannot observe `running` until every plan-review snapshot and the
+            // strict typed state subtree have committed successfully.
+            if (planReviewPlan !== undefined) {
+                initializedPlanReview = await initializePlanReviewRunState(store, planReviewPlan, effectiveDefinition, preparedSnapshot);
             }
+            ownership.throwIfCancelled();
         }
-        const content = finalizeWorkflowPresentation({
-            outputText: result.outputText,
-            receipt,
-            debug,
+        catch (err) {
+            try {
+                if (ownership.signal.aborted || err instanceof WorkflowCancellationError) {
+                    await markWorkflowCancelled(store);
+                    throw new WorkflowCancellationError();
+                }
+                if (store !== undefined && planReviewPlan !== undefined) {
+                    try {
+                        await markWorkflowFailed(store, runId, err);
+                    }
+                    catch (markFailedError) {
+                        logger.warn({ err: markFailedError }, "markFailed during async initialization error handling failed");
+                    }
+                    const errorText = formatWorkflowError(runId, err, store, {
+                        source: loaded.source,
+                        sourcePath: loaded.sourcePath,
+                    });
+                    let failureSummary;
+                    if (receipt) {
+                        try {
+                            failureSummary = buildFailureRunSummary(store);
+                        }
+                        catch (summaryError) {
+                            logger.warn({ err: summaryError }, "failure summary construction failed, omitting receipt");
+                        }
+                    }
+                    const content = finalizeWorkflowPresentation({
+                        outputText: errorText,
+                        receipt,
+                        debug,
+                        summary: failureSummary,
+                        debugBlock: debug ? buildErrorDebugBlock(runId, store) : undefined,
+                    });
+                    return { content, isError: true };
+                }
+                throw err;
+            }
+            finally {
+                await ownership.finish(store);
+            }
+        }
+        if (store === undefined || effectiveDefinition === undefined) {
+            await ownership.finish(store);
+            throw new McpError(ErrorCode.InternalError, `Failed to initialize async run ${runId}`);
+        }
+        void runWorkflowDetached(server, options, workflow, runId, resolvedVariables, debug, receipt, validatorRegistry, loaded, parsedMembers, parsedChairman, parsedChairmanModel, parsedChairmanEffort, true, ownership, undefined, store, effectiveDefinition, undefined, initializedPlanReview, initialContextPolicy, admittedRosterName).catch((err) => {
+            if (err instanceof WorkflowCancellationError) {
+                logger.info({ runId }, "workflow run cancelled");
+                return;
+            }
+            logger.error({ err, runId }, "detached async run failed");
+        });
+        // Additive-only ack shape: base {run_id, status:"running"} is unchanged;
+        // the duplicate-replay field appears only when detected (warn-only, F6).
+        // resolved_roster is the admission-time requested-value projection (E2).
+        const duplicateOfFailedRun = buildDuplicateOfFailedRunField(store);
+        const resolvedRoster = store.runState.resolvedRoster;
+        return {
+            content: [{
+                    type: "text",
+                    text: JSON.stringify({
+                        run_id: runId,
+                        status: "running",
+                        ...(duplicateOfFailedRun !== undefined
+                            ? { duplicate_of_failed_run: duplicateOfFailedRun }
+                            : {}),
+                        ...(resolvedRoster !== undefined
+                            ? { resolved_roster: resolvedRoster }
+                            : {}),
+                    }),
+                }],
+        };
+    }
+    return await runWorkflowDetached(server, options, workflow, runId, resolvedVariables, debug, receipt, validatorRegistry, loaded, parsedMembers, parsedChairman, parsedChairmanModel, parsedChairmanEffort, false, ownership, progressToken, undefined, undefined, planReviewPlan, undefined, initialContextPolicy, admittedRosterName);
+}
+async function preparePlanReviewSnapshot(plan) {
+    try {
+        const canonical = await readCanonicalPlanSnapshot({
+            planFile: plan.admission.input.plan_file,
+            allowedRoots: planFileAllowedRoots(),
+            claimedDigest: plan.admission.input.digest,
+        });
+        // Fail fast on a roster that cannot fit its own prompts. This is caller
+        // sizing, not a TOCTOU: it is deterministic and pre-state.
+        //
+        // It raises `McpError(-32602)`, which the re-throw below deliberately lets
+        // escape rather than carrying as `{ok:false}` — but the CODE only reaches
+        // the caller on the ASYNC path. `executeWorkflowRun` wraps the sync path in
+        // its generic failure handler, so the same error surfaces there as an
+        // `isError` TEXT result carrying the message but NOT the code. Do not
+        // describe this as "-32602" unqualified; the invariant that holds on BOTH
+        // paths is: no run directory, no persisted state, no provider work.
+        assertPlanReviewPromptBudget({
+            seatCount: plan.admission.execution_contract.seats.length,
+            snapshotBytes: canonical.canonicalBytes.byteLength,
+            maxPromptBytes: getMaxPromptBytes(),
+        });
+        return { ok: true, canonical };
+    }
+    catch (err) {
+        if (err instanceof McpError)
+            throw err;
+        return { ok: false, error: err };
+    }
+}
+/**
+ * A-5/A-6: materialize the immutable snapshot + persisted execution contract
+ * into runtime-owned storage and commit the typed plan-review subtree, all
+ * BEFORE any seat is dispatched.
+ *
+ * A failure here is a post-state PRE-SEAT failure: the run is marked `failed`
+ * with the offending `stage`, and no result sidecar is ever attempted.
+ */
+async function initializePlanReviewRunState(store, plan, definition, prepared) {
+    // Raise a carried read/verify failure now that state exists, so a swapped or
+    // unreadable plan is a `failed` run rather than a pre-state rejection.
+    if (!prepared.ok)
+        throw prepared.error;
+    const contract = plan.admission.execution_contract;
+    const snapshot = await persistCanonicalPlanSnapshot(store.runDir, prepared.canonical);
+    if (snapshot.absolutePath !== plan.snapshotAbsolutePath) {
+        throw new PlanReviewStageError("snapshot", `Snapshot path ${snapshot.absolutePath} does not match the runtime-owned path derived for this run (${plan.snapshotAbsolutePath})`);
+    }
+    const persistedContract = await writeExecutionContractSnapshot(store.runDir, contract);
+    const state = {
+        schema_version: "council-plan-review-state-v1",
+        execution_contract_path: persistedContract.relPath,
+        execution_contract_sha256: persistedContract.sha256,
+        execution_contract_digest: plan.admission.execution_contract_digest,
+        snapshot_path: snapshot.relPath,
+        snapshot_sha256: snapshot.sha256,
+        plan_digest: snapshot.planDigest,
+        seat_mappings: deriveSeatMappings(contract),
+        call_bindings: reconstructPlanReviewCallBindings(contract, resolvePlanReviewChairmanCallId(definition)),
+        context_policy: plan.contextPolicy,
+    };
+    validatePlanReviewCallBindings(definition, state.call_bindings);
+    await store.commitPlanReviewState(state);
+    return state;
+}
+/** The chairman stage's call id, read from the normalized definition. */
+function resolvePlanReviewChairmanCallId(definition) {
+    const stage = definition.stages.find((entry) => entry.id === "chairman");
+    const callId = stage?.calls[0]?.id;
+    if (callId === undefined) {
+        throw new PlanReviewStageError("execution_contract", "Plan-review definition has no chairman call");
+    }
+    return callId;
+}
+function projectResolvedRosterSeat(call, index, stancePresent) {
+    return {
+        index,
+        cli_name: call.cli_name,
+        ...(call.model !== undefined ? { model: call.model } : {}),
+        ...(call.effort !== undefined ? { effort: call.effort } : {}),
+        stance_present: stancePresent,
+    };
+}
+function projectResolvedRosterDelegate(policy, resolvedVariables) {
+    const delegate = policy.effectiveDelegate;
+    if (delegate?.enabled !== true) {
+        return { enabled: false };
+    }
+    const finalizerEnabled = effectiveFinalizerEnabled(delegate, resolvedVariables);
+    return {
+        enabled: true,
+        curator: {
+            cli_name: delegate.curator.cli_name,
+            role: delegate.curator.role,
+            ...(delegate.curator.model !== undefined ? { model: delegate.curator.model } : {}),
+            ...(delegate.curator.effort !== undefined ? { effort: delegate.curator.effort } : {}),
+        },
+        finalizer: {
+            cli_name: delegate.finalizer.cli_name,
+            role: delegate.finalizer.role,
+            ...(delegate.finalizer.model !== undefined ? { model: delegate.finalizer.model } : {}),
+            ...(delegate.finalizer.effort !== undefined ? { effort: delegate.finalizer.effort } : {}),
+            effective_enabled: finalizerEnabled,
+        },
+    };
+}
+/**
+ * Requested-value roster projection for council workflows. Call AFTER
+ * `expandCouncilComposition` / `expandRunWorkflowDefinition`, AFTER
+ * `resolveEffectiveChairmanCall` values are on the definition (or passed as
+ * parsed chairman knobs), and AFTER `effectiveFinalizerEnabled` can be
+ * evaluated from `initialContextPolicy` — and BEFORE `WorkflowStateStore.create()`.
+ * `plan-review-receipts` and any non-council workflow return undefined.
+ */
+export function buildResolvedRoster(input) {
+    if (!supportsRuntimeMembers(input.workflow)) {
+        return undefined;
+    }
+    const stages = input.definition.stages;
+    if (stages.length !== COUNCIL_STAGE_COUNT) {
+        return undefined;
+    }
+    const memberCalls = stages[0]?.calls;
+    const reviewerCalls = stages[1]?.calls;
+    const chairmanCall = stages[3]?.calls[0];
+    if (memberCalls === undefined || reviewerCalls === undefined || chairmanCall === undefined) {
+        return undefined;
+    }
+    const members = memberCalls.map((call, index) => projectResolvedRosterSeat(call, index, input.parsedMembers?.[index]?.stance !== undefined));
+    const reviewers = reviewerCalls.map((call, index) => projectResolvedRosterSeat(call, index, false));
+    const effectiveChairman = resolveEffectiveChairmanCall({
+        staticCall: chairmanCall,
+        chairmanCliName: input.parsedChairman,
+        chairmanModel: input.parsedChairmanModel,
+        chairmanEffort: input.parsedChairmanEffort,
+    });
+    const delegate = projectResolvedRosterDelegate(input.initialContextPolicy, input.resolvedVariables);
+    const preflightCalls = delegate.enabled === true
+        ? 1 + (delegate.finalizer.effective_enabled ? 1 : 0)
+        : 0;
+    return ResolvedRosterSchema.parse({
+        ...(input.rosterName !== undefined ? { roster: input.rosterName } : {}),
+        members,
+        reviewers,
+        chairman: {
+            cli_name: effectiveChairman.cli_name,
+            ...(effectiveChairman.model !== undefined ? { model: effectiveChairman.model } : {}),
+            ...(effectiveChairman.effort !== undefined ? { effort: effectiveChairman.effort } : {}),
+        },
+        delegate,
+        provider_spawns: members.length + reviewers.length + 1,
+        preflight_calls: preflightCalls,
+    });
+}
+function resolvedRosterForAdmission(workflow, definition, parsedMembers, parsedChairman, parsedChairmanModel, parsedChairmanEffort, initialContextPolicy, resolvedVariables, rosterName) {
+    return buildResolvedRoster({
+        workflow,
+        definition,
+        ...(parsedMembers !== undefined ? { parsedMembers } : {}),
+        ...(parsedChairman !== undefined ? { parsedChairman } : {}),
+        ...(parsedChairmanModel !== undefined ? { parsedChairmanModel } : {}),
+        ...(parsedChairmanEffort !== undefined ? { parsedChairmanEffort } : {}),
+        initialContextPolicy,
+        resolvedVariables,
+        ...(rosterName !== undefined ? { rosterName } : {}),
+    });
+}
+function expandRunWorkflowDefinition(definition, workflow, parsedMembers, parsedChairman, parsedChairmanModel, parsedChairmanEffort, planReviewPlan, 
+/**
+ * The already-verified snapshot. This function must NEVER read `plan_file`:
+ * the text it inlines is the digest-verified canonical copy or nothing.
+ */
+preparedSnapshot) {
+    if (planReviewPlan !== undefined) {
+        return expandCouncilPlanReview(definition, planReviewPlan.admission.execution_contract, 
+        // On a carried read failure the run is already doomed; expand without a
+        // snapshot so the store can be created and mark the run `failed`.
+        //
+        // The verified snapshot is passed WHOLE rather than flattened to `.text`:
+        // the expander's guard re-checks the digest-bearing shape, which a bare
+        // string cannot carry. This is the single read — never re-read `plan_file`.
+        preparedSnapshot?.ok === true ? preparedSnapshot.canonical : undefined);
+    }
+    return parsedMembers != null ||
+        parsedChairman != null ||
+        parsedChairmanModel !== undefined ||
+        parsedChairmanEffort !== undefined
+        ? expandCouncilComposition(definition, parsedMembers, workflow, parsedChairman, parsedChairmanModel, parsedChairmanEffort)
+        : definition;
+}
+async function runWorkflowDetached(server, options, workflow, runId, resolvedVariables, debug, receipt, validatorRegistry, loaded, parsedMembers, parsedChairman, parsedChairmanModel, parsedChairmanEffort, isAsync, ownership, progressToken, preCreatedStore, preExpandedDefinition, planReviewPlan, preInitializedPlanReview, initialContextPolicy, rosterName) {
+    let store = preCreatedStore ?? null;
+    let backend = null;
+    let reporter;
+    let releaseLifecycleBinding;
+    let initializedPlanReview = preInitializedPlanReview;
+    const signal = ownership.signal;
+    try {
+        ownership.throwIfCancelled();
+        // The async admission path already expanded the composition (and read the
+        // snapshot) in the foreground; reuse both to avoid redundant work and a
+        // second `plan_file` read.
+        const preparedSnapshot = preExpandedDefinition !== undefined ||
+            planReviewPlan === undefined
+            ? undefined
+            : await preparePlanReviewSnapshot(planReviewPlan);
+        ownership.throwIfCancelled();
+        const effectiveDefinition = preExpandedDefinition ??
+            expandRunWorkflowDefinition(loaded.normalized, workflow, parsedMembers, parsedChairman, parsedChairmanModel, parsedChairmanEffort, planReviewPlan, preparedSnapshot);
+        // Create state store (resumable if child config path is set) unless the
+        // async admission path already created it in the foreground.
+        if (store == null) {
+            const resolvedRoster = resolvedRosterForAdmission(workflow, effectiveDefinition, parsedMembers, parsedChairman, parsedChairmanModel, parsedChairmanEffort, initialContextPolicy, resolvedVariables, rosterName);
+            store = await WorkflowStateStore.create({
+                runId,
+                definition: effectiveDefinition,
+                variables: resolvedVariables,
+                debugKeepArtifacts: debug,
+                async: isAsync,
+                initialContextPolicy,
+                ...(resolvedRoster !== undefined ? { resolvedRoster } : {}),
+                ...(rosterName !== undefined ? { rosterName } : {}),
+            });
+        }
+        ownership.throwIfCancelled();
+        releaseLifecycleBinding = options.contextBuilderLifecycleRouter?.bind(runId, store);
+        // A-5/A-6: snapshot + contract + typed subtree land here — after state
+        // exists, before the backend is even created, so a snapshot/digest failure
+        // is a `failed` RunState with zero seats dispatched (never a result
+        // sidecar, never a pre-state -32602).
+        if (planReviewPlan !== undefined && preparedSnapshot !== undefined) {
+            initializedPlanReview = await initializePlanReviewRunState(store, planReviewPlan, effectiveDefinition, preparedSnapshot);
+        }
+        ownership.throwIfCancelled();
+        const sessionLogGeneration = store.sessionLogGeneration ??
+            await inspectLegacyWorkflowSessionLogGeneration(store.runDir, runId);
+        ownership.throwIfCancelled();
+        backend = options.createBackend(runId);
+        ownership.setBackend(backend);
+        ownership.throwIfCancelled();
+        await backend.connect();
+        ownership.throwIfCancelled();
+        // Build engine hooks — capture store in a const for closure narrowing
+        const storeRef = store;
+        reporter = progressToken != null
+            ? new WorkflowProgressReporter(server, progressToken, runId, effectiveDefinition)
+            : undefined;
+        const rpt = reporter; // local const for closure narrowing
+        const hooks = {
+            ...storeRef.hooks,
+            ...(rpt != null
+                ? {
+                    onProgress: async (event) => {
+                        await storeRef.hooks.onProgress?.(event);
+                        await rpt.onProgress(event);
+                    },
+                    onRetryScheduled: async (event) => {
+                        await storeRef.hooks.onRetryScheduled?.(event);
+                        await rpt.onRetryScheduled(event);
+                    },
+                }
+                : {}),
+        };
+        const engine = new WorkflowEngine({
+            definition: effectiveDefinition,
+            session: backend,
+            variables: resolvedVariables,
+            validatorRegistry,
+            runId,
+            sessionLogGeneration,
+            runDir: storeRef.runDir,
+            signal,
+            hooks,
+            contextBuilderRunner: options.contextBuilderRunner,
+            contextDefault: options.contextDefault,
+            defaultCurator: options.defaultCurator,
+            commitPreflightContext: storeRef.commitPreflightContext?.bind(storeRef),
+            initialContextPolicy,
+            ...(options.deriveInvocationAudit === undefined
+                ? {}
+                : { deriveInvocationAudit: options.deriveInvocationAudit }),
+            ...(initializedPlanReview !== undefined
+                ? {
+                    planReviewContextPolicy: initializedPlanReview.context_policy,
+                    planReviewCallBindings: initializedPlanReview.call_bindings,
+                    commitPlanReviewContextProvenance: storeRef.commitPlanReviewContextProvenance?.bind(storeRef),
+                    terminalResultPolicy: {
+                        kind: "plan_review_artifacts",
+                        project: storeRef.projectPlanReviewTerminalResult.bind(storeRef),
+                    },
+                }
+                : {}),
+        });
+        const result = await engine.execute();
+        // Build summary (fail-open)
+        let summary;
+        if (receipt) {
+            try {
+                const cardExtractor = createCardExtractor(effectiveDefinition);
+                summary = buildRunSummaryOrUndefined(result, store, cardExtractor);
+            }
+            catch (err) {
+                logger.warn({ err }, "run summary construction failed, omitting receipt");
+            }
+        }
+        const content = finalizeWorkflowPresentation({
+            outputText: result.outputText,
+            receipt,
+            debug,
             summary,
             debugBlock: debug ? buildDebugBlock(runId, result, store) : undefined,
         });
+        appendDuplicateReplayBlock(content, store);
+        appendResolvedRosterBlock(content, store);
         return { content };
     }
     catch (error) {
-        shutdownCoordinator.unregister();
-        if (error instanceof WorkflowCancellationError) {
-            if (store != null) {
-                await store.markCancelled();
+        if (signal.aborted || error instanceof WorkflowCancellationError) {
+            await markWorkflowCancelled(store);
+            throw new WorkflowCancellationError();
+        }
+        // Persist a terminal "failed" record for post-admission setup failures
+        // (e.g. backend.connect() / engine construction). Idempotent: the engine
+        // already persists "failed" for in-engine failures, so this won't clobber.
+        if (store != null) {
+            try {
+                await markWorkflowFailed(store, runId, error);
+            }
+            catch (err) {
+                logger.warn({ err }, "markFailed during error handling failed");
             }
-            throw error;
         }
         const errorText = formatWorkflowError(runId, error, store, {
             source: loaded.source,
@@ -828,27 +1952,18 @@ async function executeRunWorkflow(server, options, args, signal, progressToken)
             summary: failureSummary,
             debugBlock: debug && store != null ? buildErrorDebugBlock(runId, store) : undefined,
         });
+        appendDuplicateReplayBlock(content, store);
+        appendResolvedRosterBlock(content, store);
         return { content, isError: true };
     }
     finally {
-        reporter?.stop();
-        try {
-            if (backend != null && !backend.isTerminated) {
-                await backend.terminate();
-            }
-        }
-        catch (cleanupErr) {
-            logger.warn({ err: cleanupErr }, "backend.terminate() failed during cleanup");
-        }
         try {
-            if (store != null) {
-                await store.close();
-            }
+            releaseLifecycleBinding?.();
+            reporter?.stop();
         }
-        catch (cleanupErr) {
-            logger.warn({ err: cleanupErr }, "store.close() failed during cleanup");
+        finally {
+            await ownership.finish(store);
         }
-        releaseMutex();
     }
 }
 async function executeResumeWorkflow(server, options, args, signal, progressToken) {
@@ -864,33 +1979,148 @@ async function executeResumeWorkflow(server, options, args, signal, progressToke
     catch {
         throw new McpError(ErrorCode.InvalidParams, `Invalid run_id "${runId}". Must match [A-Za-z0-9_-]{1,64}.`);
     }
-    acquireMutex(runId);
+    // Plan-review terminal state is authoritative even while the detached run's
+    // finally still owns the in-process mutex. Read it before duplicate-run
+    // arbitration so terminal-before-cleanup never leaks as "already running".
+    // Any read/validation error is retried by WorkflowStateStore.resume under the
+    // run lock, preserving the existing error surface for corrupt generic state.
+    let persistedBeforeMutex;
+    try {
+        persistedBeforeMutex = await readRunStateForStatus(runId);
+    }
+    catch {
+        persistedBeforeMutex = null;
+    }
+    const persistedState = persistedBeforeMutex?.state;
+    if (persistedState != null &&
+        isPlanReviewRunState(persistedState) &&
+        (persistedState.status === "failed" ||
+            persistedState.status === "cancelled" ||
+            persistedState.status === "succeeded")) {
+        const error = new Error(`Run ${runId} is terminal (${persistedState.status}) and cannot be resumed; start a new run instead.`);
+        return {
+            content: finalizeWorkflowPresentation({
+                outputText: formatWorkflowError(runId, error, null),
+                receipt,
+                debug,
+                summary: undefined,
+                debugBlock: undefined,
+            }),
+            isError: true,
+        };
+    }
+    const ownership = acquireWorkflowRun(runId, options, signal);
+    const ownedSignal = ownership.signal;
     let store = null;
     let backend = null;
     let reporter;
+    let releaseLifecycleBinding;
     try {
+        ownership.throwIfCancelled();
         const resumeOptions = {
             runId,
             debugKeepArtifacts: debug,
         };
         store = await WorkflowStateStore.resume(resumeOptions);
+        // Open this attempt before classifying an abort during reconstruction;
+        // otherwise a prior terminal record would suppress markCancelled.
+        await store.beginResumeAttempt();
+        ownership.throwIfCancelled();
+        releaseLifecycleBinding = options.contextBuilderLifecycleRouter?.bind(runId, store);
         const validatorRegistry = createValidatorRegistry();
-        // Create backend via factory
-        backend = options.createBackend(runId);
-        await backend.connect();
-        // Wire up shutdown coordinator
-        const controller = new AbortController();
-        if (signal.aborted) {
-            controller.abort(new WorkflowCancellationError());
+        const initialContextPolicy = store.runState.initialContextPolicy ??
+            reconstructLegacyInitialContextPolicy(store.runState, options.defaultCurator);
+        // A-5 resume fidelity: the persisted contract + snapshot are the SOLE
+        // inputs — `plan_file` is never re-read and caller input is never
+        // re-parsed. Decode + hash-verify + RECOMPUTE before the engine exists, so
+        // a corrupt contract fails post-state/pre-seat rather than dispatching
+        // seats under unverified (or absent) per-call bindings.
+        // Typed detection is by PERSISTED plan-review state presence, not the
+        // definition name alone: legacy runs persisted under the pre-rename name
+        // "council-plan-review" (which now names the GENERIC plan-review council)
+        // must keep routing through the typed restore path, while a new generic
+        // council-plan-review run (no plan_review_state) must never enter it. A
+        // tampered generic run that smuggles in a plan_review_state subtree fails
+        // closed downstream: restorePlanReviewRun / validatePlanReviewCallBindings
+        // reject any definition whose stages/calls do not match the contract.
+        const persistedPlanReview = store.runState.plan_review_state;
+        let restoredPlanReview;
+        if (store.definition.name === PLAN_REVIEW_RECEIPTS_WORKFLOW &&
+            persistedPlanReview === undefined) {
+            throw new PlanReviewStageError("execution_contract", "Persisted plan-review-receipts run is missing plan_review_state");
         }
-        else {
-            signal.addEventListener("abort", () => {
-                controller.abort(new WorkflowCancellationError());
-            }, { once: true });
+        if (persistedPlanReview !== undefined &&
+            store.definition.name !== PLAN_REVIEW_RECEIPTS_WORKFLOW &&
+            store.definition.name !== LEGACY_PLAN_REVIEW_RECEIPTS_WORKFLOW_NAME) {
+            throw new PlanReviewStageError("execution_contract", `Persisted workflow "${store.definition.name}" cannot carry plan_review_state`);
         }
-        shutdownCoordinator.register(backend, controller, async () => {
-            await store.markCancelled();
-        });
+        if (persistedPlanReview !== undefined) {
+            restoredPlanReview = await restorePlanReviewRun(store.runDir, persistedPlanReview, resolvePlanReviewChairmanCallId(store.definition));
+            const bindingsByCall = validatePlanReviewCallBindings(store.definition, restoredPlanReview.call_bindings);
+            /**
+             * DELIBERATELY the FIRST of two identical checks; `WorkflowEngine`'s
+             * constructor runs the same one. This is not drift.
+             *
+             * The engine's copy is the load-bearing seam: it is the one no caller can
+             * bypass, and it is what a future construction path would inherit. This
+             * copy buys ORDERING — it rejects tampered state before `createBackend` /
+             * `connect`, so a doomed resume never spawns a provider process. The
+             * function is pure and cheap over a handful of prepared inputs, so paying
+             * twice costs nothing measurable and removing EITHER one loses a real
+             * property. If you are here to delete a redundant call: don't.
+             */
+            validatePlanReviewPreparedInputPolicy(store.resume.preparedInputs ?? new Map(), bindingsByCall, {
+                // From the SAME read that re-verified the snapshot above (D9).
+                snapshotText: restoredPlanReview.snapshot.text,
+                contextPolicy: restoredPlanReview.state.context_policy,
+            });
+        }
+        ownership.throwIfCancelled();
+        const sessionLogGeneration = store.sessionLogGeneration ??
+            await inspectLegacyWorkflowSessionLogGeneration(store.runDir, runId);
+        ownership.throwIfCancelled();
+        if (store.runState.workflow_context === undefined) {
+            const preflightEngine = new WorkflowEngine({
+                definition: store.definition,
+                session: createPreflightOnlyBackend(options.availableCliNames),
+                variables: store.variables,
+                validatorRegistry,
+                runId,
+                runDir: store.runDir,
+                signal: ownedSignal,
+                resume: store.resume,
+                contextBuilderRunner: options.contextBuilderRunner,
+                contextDefault: options.contextDefault,
+                defaultCurator: options.defaultCurator,
+                commitPreflightContext: store.commitPreflightContext.bind(store),
+                requireContextPreflight: true,
+                initialContextPolicy,
+                ...(options.deriveInvocationAudit === undefined
+                    ? {}
+                    : { deriveInvocationAudit: options.deriveInvocationAudit }),
+                ...(restoredPlanReview === undefined
+                    ? {}
+                    : {
+                        planReviewContextPolicy: restoredPlanReview.state.context_policy,
+                        planReviewCallBindings: restoredPlanReview.call_bindings,
+                        planReviewSnapshotText: restoredPlanReview.snapshot.text,
+                        commitPlanReviewContextProvenance: store.commitPlanReviewContextProvenance.bind(store),
+                    }),
+            });
+            // D1: bound the resume-path preflight by the same fresh `timeout_seconds`
+            // budget a resumed run receives. `execute()` is never called on this engine,
+            // so without this the curator/finalizer delegate runs unbounded. The engine is
+            // constructed with `signal: ownedSignal`, which createDeadlineController chains,
+            // so cancellation ownership is unchanged.
+            await preflightEngine.prepareContextPreflightWithDeadline();
+        }
+        // Create backend only after the owned resume preflight has completed.
+        ownership.throwIfCancelled();
+        backend = options.createBackend(runId);
+        ownership.setBackend(backend);
+        ownership.throwIfCancelled();
+        await backend.connect();
+        ownership.throwIfCancelled();
         // Build engine hooks with progress reporter
         reporter = progressToken != null
             ? new WorkflowProgressReporter(server, progressToken, runId, store.definition)
@@ -922,13 +2152,37 @@ async function executeResumeWorkflow(server, options, args, signal, progressToke
             variables: store.variables,
             validatorRegistry,
             runId,
+            sessionLogGeneration,
             runDir: store.runDir,
-            signal: controller.signal,
+            signal: ownedSignal,
             hooks: rpt != null ? hooks : store.hooks,
             resume: store.resume,
+            contextBuilderRunner: options.contextBuilderRunner,
+            contextDefault: options.contextDefault,
+            defaultCurator: options.defaultCurator,
+            commitPreflightContext: store.commitPreflightContext?.bind(store),
+            restoredWorkflowContext: store.runState.workflow_context,
+            requireContextPreflight: false,
+            initialContextPolicy,
+            ...(options.deriveInvocationAudit === undefined
+                ? {}
+                : { deriveInvocationAudit: options.deriveInvocationAudit }),
+            // A-7: replay the SAME enforced exclusion on resume, reconstructed from
+            // persisted state rather than re-derived from caller variables.
+            ...(restoredPlanReview !== undefined
+                ? {
+                    planReviewContextPolicy: restoredPlanReview.state.context_policy,
+                    planReviewCallBindings: restoredPlanReview.call_bindings,
+                    planReviewSnapshotText: restoredPlanReview.snapshot.text,
+                    commitPlanReviewContextProvenance: store.commitPlanReviewContextProvenance?.bind(store),
+                    terminalResultPolicy: {
+                        kind: "plan_review_artifacts",
+                        project: store.projectPlanReviewTerminalResult.bind(store),
+                    },
+                }
+                : {}),
         });
         const result = await engine.execute();
-        shutdownCoordinator.unregister();
         // Build summary (fail-open)
         let summary;
         if (receipt) {
@@ -950,12 +2204,19 @@ async function executeResumeWorkflow(server, options, args, signal, progressToke
         return { content };
     }
     catch (error) {
-        shutdownCoordinator.unregister();
-        if (error instanceof WorkflowCancellationError) {
-            if (store != null) {
-                await store.markCancelled();
+        if (ownedSignal.aborted || error instanceof WorkflowCancellationError) {
+            await markWorkflowCancelled(store);
+            throw new WorkflowCancellationError();
+        }
+        // Persist a terminal "failed" record for post-admission setup failures.
+        // Idempotent: won't clobber an engine-emitted terminal status.
+        if (store != null) {
+            try {
+                await markWorkflowFailed(store, runId, error);
+            }
+            catch (err) {
+                logger.warn({ err }, "markFailed during error handling failed");
             }
-            throw error;
         }
         const errorText = formatWorkflowError(runId, error, store);
         // Build failure summary (fail-open)
@@ -978,45 +2239,468 @@ async function executeResumeWorkflow(server, options, args, signal, progressToke
         return { content, isError: true };
     }
     finally {
-        reporter?.stop();
         try {
-            if (backend != null && !backend.isTerminated) {
-                await backend.terminate();
-            }
+            releaseLifecycleBinding?.();
+            reporter?.stop();
         }
-        catch (cleanupErr) {
-            logger.warn({ err: cleanupErr }, "backend.terminate() failed during cleanup");
+        finally {
+            await ownership.finish(store);
         }
+    }
+}
+// ---------------------------------------------------------------------------
+// Sidecar access (atomic, fd-based, cheap-poll-safe)
+// ---------------------------------------------------------------------------
+/**
+ * Thrown for genuine containment-policy violations (absolute outputPath or an
+ * escape past the run directory). These MUST reject even on a cheap default
+ * poll. Everything else (missing file, fs race, permission) is swallowed on the
+ * cheap path so liveness polling never throws for a recoverable condition.
+ *
+ * Alias of the shared reader's policy error so the existing `instanceof`
+ * cheap-poll discrimination below is unchanged.
+ */
+const SidecarPolicyError = ContainedFilePolicyError;
+/**
+ * Read a run sidecar through the shared containment-safe, no-follow reader.
+ *
+ * The reader is shared (not re-implemented) with the plan-review snapshot and
+ * contract paths: one audited realpath + `O_NOFOLLOW` + single-handle
+ * implementation, so a fix to the TOCTOU handling lands everywhere at once.
+ */
+async function readContainedSidecar(runDir, outputPath, wantContent) {
+    const read = await readContainedRelativeFile(runDir, outputPath, {
+        wantContent,
+        // Preserve this path's established error wording byte-for-byte.
+        containerLabel: "run directory",
+        pathLabel: "outputPath",
+    });
+    return read.content !== undefined
+        ? { size: read.size, content: read.content }
+        : { size: read.size };
+}
+/**
+ * Legacy state-v1 runs did not persist their admission-time default. Rebuild
+ * only caller-explicit choices; otherwise require deterministic preflight so a
+ * changed server default cannot silently introduce or switch a delegate.
+ */
+export function reconstructLegacyInitialContextPolicy(state, defaultCurator) {
+    const persistedMode = state.workflow_context?.context_builder.context_mode;
+    if (persistedMode === "disabled") {
+        return {
+            requestedMode: "off",
+            effectiveMode: "disabled",
+            preflightDisabled: true,
+        };
+    }
+    const legacyVariables = state.variables ?? {};
+    const callerMode = legacyVariables["cb_context_mode"];
+    const normalizedMode = typeof callerMode === "string" ? callerMode.trim() : "";
+    if (normalizedMode === "off" || normalizedMode === "deterministic") {
+        return {
+            requestedMode: normalizedMode,
+            effectiveMode: normalizedMode,
+            preflightDisabled: false,
+        };
+    }
+    if (normalizedMode === "full" && legacyVariables["cb_delegate"] != null) {
         try {
-            if (store != null) {
-                await store.close();
+            return resolveWorkflowContextMode("full", "deterministic", true, legacyVariables["cb_delegate"], defaultCurator);
+        }
+        catch {
+            // Legacy hard-disabled runs may contain a delegate value that was never
+            // validated. Do not turn it into a new resume-time fatal or provider.
+        }
+    }
+    return {
+        requestedMode: normalizedMode === "full" || persistedMode === "full"
+            ? "full"
+            : "deterministic",
+        effectiveMode: "deterministic",
+        preflightDisabled: false,
+    };
+}
+/**
+ * Best-effort read-time parse of the persisted context-builder lifecycle
+ * snapshot. Status projection is observability-only and must never throw for
+ * a malformed or absent snapshot — invalid input yields undefined and the
+ * dependent health/context fields are simply omitted.
+ */
+function parseLifecycleForStatus(value) {
+    if (value == null)
+        return undefined;
+    try {
+        return parseContextBuilderLifecycleStateV1(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function executeWorkflowRunStatus(_options, args) {
+    const runId = args["run_id"];
+    const includeResult = args["include_result"] === true;
+    if (typeof runId !== "string" || runId === "") {
+        throw new McpError(ErrorCode.InvalidParams, 'Missing or invalid "run_id" parameter');
+    }
+    try {
+        validateRunId(runId);
+    }
+    catch {
+        throw new McpError(ErrorCode.InvalidParams, `Invalid run_id "${runId}". Must match [A-Za-z0-9_-]{1,64}.`);
+    }
+    const read = await readRunStateForStatus(runId);
+    if (read == null) {
+        return {
+            content: [{ type: "text", text: JSON.stringify({ status: "not_found", run_id: runId }) }],
+        };
+    }
+    const { state, lock } = read;
+    const status = (state.status === "running" || state.status === "pending") && lock === "stale_or_absent"
+        ? "orphaned"
+        : state.status;
+    const runDir = getRunStateDir(runId);
+    const stages = state.stages.map((stage) => {
+        const completedCalls = stage.calls.filter((call) => call.state === "succeeded").length;
+        const runningCalls = stage.calls.filter((call) => call.state === "running").length;
+        const failedCalls = stage.calls.filter((call) => call.state === "failed").length;
+        return {
+            stage_id: stage.stageId,
+            state: stage.state,
+            total_calls: stage.calls.length,
+            completed_calls: completedCalls,
+            running_calls: runningCalls,
+            failed_calls: failedCalls,
+            calls: stage.calls.map((call) => ({
+                call_id: call.callId,
+                state: call.state,
+                retry_count: call.retryCount,
+                ...(call.startedAt != null ? { started_at: call.startedAt } : {}),
+                ...(call.completedAt != null ? { completed_at: call.completedAt } : {}),
+                ...(call.durationMs != null ? { duration_ms: call.durationMs } : {}),
+                ...(call.errorMessage != null ? { error: call.errorMessage } : {}),
+            })),
+        };
+    });
+    const projection = {
+        run_id: state.runId,
+        status,
+        async: state.async ?? false,
+        workflow: {
+            name: state.workflowName,
+            version: state.workflowVersion,
+        },
+        ...(state.startedAt != null ? { started_at: state.startedAt } : {}),
+        ...(state.completedAt != null ? { completed_at: state.completedAt } : {}),
+        ...(lock === "unknown" ? { lock_ownership: "unknown" } : {}),
+        stages,
+    };
+    // artifacts_dir is cheap (pure join, no I/O) and present for every found run.
+    projection["artifacts_dir"] = join(runDir, "artifacts");
+    // Read-only context-selection observability from already-persisted state.
+    // No file I/O — only projects state.workflow_context.context_builder and
+    // the state.context_builder_lifecycle snapshot.
+    const lifecycle = parseLifecycleForStatus(state.context_builder_lifecycle);
+    const cb = state.workflow_context?.context_builder;
+    if (cb != null) {
+        const context = {
+            ...(cb.context_mode != null ? { context_mode: cb.context_mode } : {}),
+            status: cb.status,
+            files_selected: cb.metrics.files_selected,
+        };
+        if (cb.delegate != null) {
+            context["delegate"] = {
+                status: cb.delegate.status,
+                fallback_used: cb.delegate.fallback_used,
+            };
+        }
+        if (lifecycle != null) {
+            // Additive lifecycle observability. `coverage.missing` is a bounded
+            // integer count in the persisted schema (never a list), so it is
+            // projected as-is with no truncation concern.
+            context["lifecycle_status"] = lifecycle.status;
+            context["coverage"] = {
+                policy: lifecycle.coverage.policy,
+                status: lifecycle.coverage.status,
+                required: lifecycle.coverage.required,
+                selected: lifecycle.coverage.selected,
+                missing: lifecycle.coverage.missing,
+            };
+            const finalizer = lifecycle.finalizer;
+            if (typeof finalizer.effective_enabled === "boolean" &&
+                typeof finalizer.execution_status === "string") {
+                const existingDelegate = context["delegate"] !== undefined &&
+                    typeof context["delegate"] === "object" &&
+                    context["delegate"] !== null
+                    ? context["delegate"]
+                    : {};
+                context["delegate"] = {
+                    ...existingDelegate,
+                    finalizer: {
+                        effective_enabled: finalizer.effective_enabled,
+                        execution_status: finalizer.execution_status,
+                        // The lifecycle contract only admits a score on succeeded
+                        // execution; re-check here so the projection cannot surface one
+                        // for any other outcome.
+                        ...(finalizer.execution_status === "succeeded" &&
+                            typeof finalizer.score === "number" &&
+                            Number.isFinite(finalizer.score)
+                            ? { score: finalizer.score }
+                            : {}),
+                    },
+                };
             }
         }
-        catch (cleanupErr) {
-            logger.warn({ err: cleanupErr }, "store.close() failed during cleanup");
+        projection["context"] = context;
+    }
+    else if (lifecycle != null &&
+        !isTerminalContextBuilderLifecycleStatus(lifecycle.status)) {
+        // Preflight in flight: `context` is reserved for committed-preflight
+        // semantics, so mid-scan progress rides on its own top-level key.
+        projection["context_progress"] = {
+            phase: lifecycle.phase,
+            status: lifecycle.status,
+            updated_at: lifecycle.updated_at,
+            counts: {
+                files_seen: lifecycle.counts.files_seen,
+                files_considered: lifecycle.counts.files_considered,
+                files_selected: lifecycle.counts.files_selected,
+                files_omitted: lifecycle.counts.files_omitted,
+                search_results: lifecycle.counts.search_results,
+                bytes_read: lifecycle.counts.bytes_read,
+                bytes_written: lifecycle.counts.bytes_written,
+            },
+        };
+    }
+    // F7 read-time health projection: top-level run status alone overstates
+    // health when on_failure:continue swallowed seat failures or context
+    // preflight completed partial/degraded. Computed only from already-persisted
+    // data; additive and advisory — never mutates status semantics.
+    projection["health"] = computeRunHealth(state, lifecycle);
+    if (state.resolvedRoster !== undefined) {
+        projection["resolved_roster"] = state.resolvedRoster;
+    }
+    if (isPlanReviewRunState(state)) {
+        const terminalExecutionStatus = state.status === "succeeded" ||
+            state.status === "failed" ||
+            state.status === "cancelled"
+            ? state.status
+            : undefined;
+        const publication = state.plan_review_state?.publication;
+        const inspected = await inspectPlanReviewPublication(runDir, runId, terminalExecutionStatus ??
+            (includeResult && publication?.committed === true ? "failed" : undefined), publication, includeResult);
+        projection["result_available"] = inspected.result_available;
+        projection["result_bytes"] = inspected.result_bytes;
+        if (inspected.result !== undefined) {
+            projection["result"] = inspected.result;
+        }
+        let planReviewError = (includeResult && publication?.committed === true ? inspected.error : undefined) ??
+            state.plan_review_error ??
+            inspected.error;
+        if (planReviewError === undefined &&
+            publication === undefined &&
+            state.plan_review_state === undefined &&
+            (state.status === "succeeded" || state.status === "failed")) {
+            planReviewError = createPlanReviewPublicationError(runId, state.status, "no_artifact", "Historical plan-review run has no publication marker; rerun with a Track-C-capable ClinkX runtime.");
+        }
+        if (planReviewError !== undefined) {
+            projection["plan_review_error"] = planReviewError;
+        }
+        if (state.status === "failed" || state.status === "cancelled") {
+            if (state.error != null) {
+                projection["error"] = state.error;
+            }
+            if (state.failureClass != null) {
+                projection["failure_class"] = state.failureClass;
+            }
         }
-        releaseMutex();
     }
+    else {
+        projection["result_available"] = state.status === "succeeded";
+        if (state.status === "succeeded") {
+            const final = state.stages.at(-1);
+            const call = final?.calls[0];
+            // Cheap size hint without reading contents. Containment (via
+            // readContainedSidecar) runs even on a default poll so an absolute path or
+            // symlink escape is rejected regardless of include_result. Everything else
+            // — a missing final call, a missing/unreadable file, an fs race — omits the
+            // hint rather than throwing, preserving the "a cheap poll never throws for a
+            // recoverable/missing-file condition" invariant that liveness polling needs.
+            if (call?.outputInline != null) {
+                projection["result_bytes"] = Buffer.byteLength(call.outputInline, "utf-8");
+            }
+            else if (!includeResult && call?.outputPath != null) {
+                // Skip this size-only open when include_result is set — the block below
+                // opens the sidecar once for both size and content, so a second open here
+                // would be redundant.
+                try {
+                    const { size } = await readContainedSidecar(runDir, call.outputPath, false);
+                    projection["result_bytes"] = size;
+                }
+                catch (err) {
+                    if (err instanceof SidecarPolicyError) {
+                        // Absolute path / containment escape rejects even on a cheap poll.
+                        throw new Error(`Succeeded run ${runId} ${err.message}`);
+                    }
+                    // Missing file / fs race / permission on a cheap poll: omit the hint.
+                }
+            }
+            if (includeResult) {
+                if (call == null) {
+                    throw new Error(`Succeeded run ${runId} is missing final call state`);
+                }
+                if (call.outputInline != null) {
+                    projection["result"] = call.outputInline;
+                }
+                else if (call.outputPath != null) {
+                    try {
+                        const { size, content } = await readContainedSidecar(runDir, call.outputPath, true);
+                        projection["result_bytes"] = size;
+                        projection["result"] = content;
+                    }
+                    catch (err) {
+                        if (err instanceof SidecarPolicyError) {
+                            throw new Error(`Succeeded run ${runId} ${err.message}`);
+                        }
+                        throw new Error(`Succeeded run ${runId} output file is missing or unreadable`);
+                    }
+                }
+                else {
+                    throw new Error(`Succeeded run ${runId} final call has neither inline nor persisted output`);
+                }
+            }
+        }
+        else if (state.status === "failed" || state.status === "cancelled") {
+            if (state.error != null) {
+                projection["error"] = state.error;
+            }
+            if (state.failureClass != null) {
+                projection["failure_class"] = state.failureClass;
+            }
+        }
+    }
+    return {
+        content: [{ type: "text", text: JSON.stringify(projection) }],
+    };
 }
-function executeListWorkflows(workflowsPath, availableCliNames) {
-    const workflows = listWorkflowCatalog(workflowsPath);
+async function executeCancelWorkflow(_options, args) {
+    const runId = args["run_id"];
+    if (typeof runId !== "string" || runId === "") {
+        throw new McpError(ErrorCode.InvalidParams, 'Missing or invalid "run_id" parameter');
+    }
+    try {
+        validateRunId(runId);
+    }
+    catch {
+        throw new McpError(ErrorCode.InvalidParams, `Invalid run_id "${runId}". Must match [A-Za-z0-9_-]{1,64}.`);
+    }
+    const text = (value) => ({
+        content: [{ type: "text", text: JSON.stringify(value) }],
+    });
+    // 1) Live in-process async run: abort its controller and let the run's own
+    //    unwind drive it to terminal "cancelled". We do NOT touch the mutex here —
+    //    the detached run's finally owns the slot (touching it risks a double-free).
+    const controller = cancelRegistry.get(runId);
+    if (controller != null) {
+        // The engine can have already persisted a terminal status while its
+        // controller is still in the registry (deleted only in the run's finally).
+        // Re-read first so we never claim "cancelling" for an already-done run.
+        const live = await readRunStateForStatus(runId);
+        if (live != null && live.state.status !== "running" && live.state.status !== "pending") {
+            return text({ run_id: runId, status: live.state.status, already_terminal: true });
+        }
+        if (!controller.signal.aborted) {
+            controller.abort(new WorkflowCancellationError());
+        }
+        return text({ run_id: runId, status: "cancelling" });
+    }
+    // 2) Not in our registry — inspect persisted state via the same path as status.
+    const read = await readRunStateForStatus(runId);
+    if (read == null) {
+        return text({ run_id: runId, status: "not_found" });
+    }
+    const { state, lock } = read;
+    if (state.status !== "running" && state.status !== "pending") {
+        return text({ run_id: runId, status: state.status, already_terminal: true });
+    }
+    if (lock === "unknown") {
+        return text({
+            run_id: runId,
+            status: state.status,
+            cancellable: false,
+            lock_ownership: "unknown",
+            error: `Run lock ownership is unknown for run_id "${runId}"; refusing cancellation until the lock record is repaired.`,
+        });
+    }
+    // running|pending and not in our registry. The run.lock is the single source
+    // of truth for ownership: reapRunCancelled acquires it itself (reclaiming a
+    // truly stale/dead lock, refusing a live one), closing the TOCTOU where a
+    // concurrent resume_workflow could grab the lock between read and reap.
+    const outcome = await reapRunCancelled(runId);
+    if (outcome === "cancelled") {
+        return text({ run_id: runId, status: "cancelled", reaped: true });
+    }
+    if (outcome === "locked") {
+        // The run is owned by another live worker (or a blocking run): the lock
+        // could not be acquired. Refuse without mutating — this process cannot
+        // safely kill a worker it does not own.
+        return text({ run_id: runId, status: "running", cancellable: false });
+    }
+    if (outcome === "ownership_unknown") {
+        return text({
+            run_id: runId,
+            status: state.status,
+            cancellable: false,
+            lock_ownership: "unknown",
+            error: `Run lock ownership became unknown for run_id "${runId}"; refusing cancellation until the lock record is repaired.`,
+        });
+    }
+    // "skipped": became terminal between our read and the reap. Re-read and report.
+    const reread = await readRunStateForStatus(runId);
+    const status = reread?.state.status ?? "cancelled";
+    return text({ run_id: runId, status, already_terminal: true });
+}
+function executeListWorkflows(options) {
+    const workflows = listWorkflowCatalog(options.workflowsPath);
+    const preflightEnabled = options.contextBuilderRunner != null;
+    const contextDefault = preflightEnabled
+        ? options.contextDefault ?? getWorkflowsContextDefault()
+        : options.contextDefault ?? "off";
+    const effectiveContextDefault = resolveWorkflowContextMode(undefined, contextDefault, preflightEnabled, undefined, options.defaultCurator).effectiveMode;
     const entries = [];
     for (const [name, entry] of workflows) {
         const def = entry.definition;
+        const contextStrategy = deriveContextStrategy(def);
+        const runtimeMembers = supportsRuntimeMembers(name);
         entries.push({
             name,
             description: def.description,
             version: def.version,
             source: entry.source,
             shadowed_yaml: entry.shadowedYaml,
-            supports_members: supportsRuntimeMembers(name),
-            supports_chairman: supportsRuntimeMembers(name),
-            ...(supportsRuntimeMembers(name) ? {
+            supports_members: runtimeMembers,
+            supports_chairman: runtimeMembers,
+            supports_context_preflight: contextStrategy.supports_context_preflight,
+            effective_context_default: effectiveContextDefault,
+            fails_on_empty_selection: contextStrategy.fails_on_empty_selection,
+            context_anchor_variables: contextStrategy.context_anchor_variables,
+            context_override_variables: contextStrategy.context_override_variables,
+            ...(contextStrategy.default_context_profile !== undefined
+                ? { default_context_profile: contextStrategy.default_context_profile }
+                : {}),
+            context_recipient_stages: contextStrategy.context_recipient_stages,
+            ...(runtimeMembers ? {
                 members_min: 1,
                 members_max: 10,
                 members_stance_required_from_index: 3,
             } : {}),
             ...(entry.path != null ? { path: basename(entry.path) } : {}),
+            ...(name === PLAN_REVIEW_RECEIPTS_WORKFLOW
+                ? {
+                    plan_review: buildCouncilPlanReviewDiscovery(options.planReviewAvailableCliNames ??
+                        options.availableCliNames ??
+                        []),
+                }
+                : {}),
             variables: Object.fromEntries(Object.entries(def.variables).map(([varName, varDef]) => [
                 varName,
                 {
@@ -1029,8 +2713,16 @@ function executeListWorkflows(workflowsPath, availableCliNames) {
         });
     }
     const response = { workflows: entries };
-    if (availableCliNames != null && availableCliNames.length > 0) {
-        response["available_cli_names"] = [...availableCliNames].sort();
+    if (options.availableCliNames != null && options.availableCliNames.length > 0) {
+        response["available_cli_names"] = [...options.availableCliNames].sort();
+    }
+    if (options.adapterCapabilities != null) {
+        const availableClis = [...options.adapterCapabilities()];
+        availableClis.sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+        response["available_clis"] = availableClis;
+    }
+    if (options.rosterLoader != null) {
+        response["available_rosters"] = options.rosterLoader.list();
     }
     return {
         content: [
@@ -1041,10 +2733,137 @@ function executeListWorkflows(workflowsPath, availableCliNames) {
         ],
     };
 }
+function includesVar(from, name) {
+    if (typeof from === "string") {
+        return from === name;
+    }
+    return Array.isArray(from) && from.includes(name);
+}
+// cb_* variables that tune preflight execution rather than source selection —
+// overrides, not anchors. Advertised separately as context_override_variables.
+const CONTEXT_OVERRIDE_VARIABLES = new Set([
+    "cb_allow_secrets",
+    "cb_budget_max_estimated_tokens",
+    "cb_budget_max_files",
+    "cb_budget_max_scan_files",
+    "cb_budget_max_bytes_per_file",
+    "cb_budget_max_total_bytes",
+    "cb_budget_max_search_results",
+    "cb_budget_adapter",
+    "cb_delegate",
+    "cb_context_mode",
+]);
+function deriveContextStrategy(def) {
+    const contextRecipientStages = def.stages
+        .filter((stage) => stage.calls.some((call) => includesVar(call.absolute_file_paths_from, "context_bundle_files")))
+        .map((stage) => stage.id);
+    const cbVariables = Object.keys(def.variables)
+        .filter((name) => name.startsWith("cb_"))
+        .sort();
+    const contextAnchorVariables = cbVariables.filter((name) => !CONTEXT_OVERRIDE_VARIABLES.has(name));
+    const contextOverrideVariables = cbVariables.filter((name) => CONTEXT_OVERRIDE_VARIABLES.has(name));
+    const defaultContextProfile = def.variables["cb_profile"]?.default;
+    const hasSelectionScopeVariable = "cb_focus_paths" in def.variables || "cb_search_terms" in def.variables;
+    return {
+        supports_context_preflight: "context_bundle_files" in def.variables &&
+            contextRecipientStages.length > 0 &&
+            hasSelectionScopeVariable,
+        context_anchor_variables: contextAnchorVariables,
+        context_override_variables: contextOverrideVariables,
+        ...(typeof defaultContextProfile === "string"
+            ? { default_context_profile: defaultContextProfile }
+            : {}),
+        context_recipient_stages: contextRecipientStages,
+        fails_on_empty_selection: def.settings.fail_on_empty_context_selection,
+    };
+}
 // ---------------------------------------------------------------------------
 // Tool input schemas (JSON Schema)
 // ---------------------------------------------------------------------------
 const MAX_INLINE_WORKFLOW_DETAILS = 8;
+const PLAN_REVIEW_INPUT_SCHEMA = {
+    type: "object",
+    description: 'Immutable plan-review contract. Accepted only when workflow is "plan-review-receipts".',
+    properties: {
+        schema_version: { type: "string", const: "council-plan-review-input-v1" },
+        workspace_schema: { type: "string", const: "plan-workspace-v1" },
+        digest_profile: { type: "string", const: "checkpoint-text-v1" },
+        review_id: {
+            type: "string",
+            pattern: "^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$",
+        },
+        repository_id: {
+            type: "string",
+            maxLength: 128,
+            pattern: "^[A-Za-z0-9][A-Za-z0-9._-]*(?:/[A-Za-z0-9][A-Za-z0-9._-]*)*$",
+        },
+        iteration: { type: "integer", minimum: 1 },
+        plan_id: {
+            type: "string",
+            pattern: "^[a-z0-9][a-z0-9-]{0,62}$",
+        },
+        revision: { type: "integer", minimum: 1 },
+        digest: { type: "string", pattern: "^[0-9a-f]{64}$" },
+        expected_execution_contract_digest: {
+            type: "string",
+            pattern: "^[0-9a-f]{64}$",
+        },
+        threshold: { type: "number", minimum: 0, maximum: 10 },
+        designated_editor: { type: "string", minLength: 1 },
+        chairman_seat: {
+            type: "string",
+            pattern: "^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$",
+        },
+        plan_file: {
+            type: "string",
+            minLength: 1,
+            description: "Absolute path to the plan snapshot source",
+        },
+        seats: {
+            type: "array",
+            minItems: 1,
+            maxItems: 10,
+            items: {
+                type: "object",
+                properties: {
+                    seat_id: {
+                        type: "string",
+                        pattern: "^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$",
+                    },
+                    reviewer: { type: "string", minLength: 1 },
+                    cli_name: {
+                        type: "string",
+                        enum: [...PLAN_REVIEW_V1_CLI_NAMES].sort(),
+                    },
+                    stance: {
+                        type: "string",
+                        enum: ["strict", "pragmatic", "adversarial"],
+                    },
+                },
+                required: ["seat_id", "reviewer", "cli_name", "stance"],
+                additionalProperties: false,
+            },
+        },
+    },
+    required: [
+        "schema_version",
+        "workspace_schema",
+        "digest_profile",
+        "review_id",
+        "repository_id",
+        "iteration",
+        "plan_id",
+        "revision",
+        "digest",
+        "expected_execution_contract_digest",
+        "threshold",
+        "designated_editor",
+        "chairman_seat",
+        "plan_file",
+        "seats",
+    ],
+    additionalProperties: false,
+};
 const RUN_WORKFLOW_SCHEMA = {
     type: "object",
     properties: {
@@ -1072,9 +2891,20 @@ const RUN_WORKFLOW_SCHEMA = {
             description: "When true, append a structured receipt summarizing the workflow run as a content block",
             default: false,
         },
+        async: {
+            type: "boolean",
+            default: false,
+            description: "When true, start the run detached and return {run_id, status:'running'} immediately; poll workflow_run_status for progress and result.",
+        },
+        roster: {
+            type: "string",
+            pattern: ROSTER_NAME_PATTERN.source,
+            maxLength: 64,
+            description: "Optional named roster preset; exclusive with members, chairman, chairman_model, chairman_effort, and a non-empty variables.cb_delegate.",
+        },
         members: {
             type: "array",
-            description: "Optional runtime council member composition override. Accepted only for council workflows (council-default, council-answer, council-code-review, council-debug, council-discover). Each entry specifies a CLI adapter and an optional analytical stance. Seats at indices 0-2 may omit stance (inherits default); seats at indices 3-9 MUST provide stance. When provided, both the member stage (stage 0) and reviewer stage (stage 1) are expanded to match the specified count and CLI mapping. Reviewer stances are NOT inherited — reviewers keep their default review lens.",
+            description: "Optional runtime council member composition override. Accepted only for council workflows (council-default, council-answer, council-code-review, council-debug, council-discover, council-plan-review). Each entry specifies a CLI adapter, an optional analytical stance, and optional requested model/effort values whose support is adapter-declared. Seats at indices 0-2 may omit stance (inherits default); seats at indices 3-9 MUST provide stance. When provided, both the member stage (stage 0) and reviewer stage (stage 1) are expanded to match the specified count and CLI mapping. Reviewer stances are NOT inherited — reviewers keep their default review lens.",
             minItems: 1,
             maxItems: 10,
             items: {
@@ -1088,6 +2918,20 @@ const RUN_WORKFLOW_SCHEMA = {
                         type: "string",
                         description: "Analytical stance or perspective for this council seat. Required for seats at indices 3-9. Server enforces a 200-character limit after whitespace normalization (trim + collapse). Must not contain {{ or }}.",
                     },
+                    model: {
+                        type: "string",
+                        minLength: 1,
+                        maxLength: 128,
+                        pattern: MODEL_OVERRIDE_PATTERN.source,
+                        description: "Optional requested model for this seat. Support is declared by the selected adapter; omission preserves its configured default.",
+                    },
+                    effort: {
+                        type: "string",
+                        minLength: 1,
+                        maxLength: 32,
+                        pattern: "^[a-z0-9][a-z0-9_-]*$",
+                        description: "Optional requested reasoning effort for this seat. Support is declared by the selected adapter; omission preserves its configured default.",
+                    },
                 },
                 required: ["cli_name"],
                 additionalProperties: false,
@@ -1097,6 +2941,21 @@ const RUN_WORKFLOW_SCHEMA = {
             type: "string",
             description: "Optional CLI adapter name override for the council chairman seat. Accepted only for council workflows. Only changes the LLM adapter; the chairman's role and prompt template are preserved.",
         },
+        chairman_model: {
+            type: "string",
+            minLength: 1,
+            maxLength: 128,
+            pattern: MODEL_OVERRIDE_PATTERN.source,
+            description: "Optional requested model for the council chairman. Support is declared by the chairman adapter; omission preserves its configured default. May be supplied without chairman.",
+        },
+        chairman_effort: {
+            type: "string",
+            minLength: 1,
+            maxLength: 32,
+            pattern: "^[a-z0-9][a-z0-9_-]*$",
+            description: "Optional requested reasoning effort for the council chairman. Support is declared by the chairman adapter; omission preserves its configured default. May be supplied without chairman.",
+        },
+        plan_review: PLAN_REVIEW_INPUT_SCHEMA,
     },
     required: ["workflow", "run_id"],
     additionalProperties: false,
@@ -1128,8 +2987,35 @@ const LIST_WORKFLOWS_SCHEMA = {
     properties: {},
     additionalProperties: false,
 };
+const WORKFLOW_RUN_STATUS_SCHEMA = {
+    type: "object",
+    properties: {
+        run_id: {
+            type: "string",
+            pattern: "^[A-Za-z0-9_-]{1,64}$",
+        },
+        include_result: {
+            type: "boolean",
+            default: false,
+            description: "When true, include the generic final result for a succeeded run or the committed plan-review envelope regardless of terminal status. Default false keeps polling body-blind.",
+        },
+    },
+    required: ["run_id"],
+    additionalProperties: false,
+};
+const CANCEL_WORKFLOW_SCHEMA = {
+    type: "object",
+    properties: {
+        run_id: {
+            type: "string",
+            pattern: "^[A-Za-z0-9_-]{1,64}$",
+        },
+    },
+    required: ["run_id"],
+    additionalProperties: false,
+};
 /**
- * Return the three workflow tool definitions for tools/list.
+ * Return the workflow tool definitions for tools/list.
  *
  * Dynamically discovers available workflows to include in the
  * run_workflow description. Safe to call repeatedly — no side effects.
@@ -1170,6 +3056,22 @@ export function getWorkflowToolDefinitions(workflowsPath, availableCliNames) {
                 }
             }
         }
+        // plan_review.seats[].cli_name enum (intersection with the v1 provider set)
+        const planReview = props["plan_review"];
+        const planReviewProps = planReview?.["properties"];
+        const planReviewSeats = planReviewProps?.["seats"];
+        const planReviewItems = planReviewSeats?.["items"];
+        const planReviewSeatProps = planReviewItems?.["properties"];
+        const planReviewCliNameSet = new Set(PLAN_REVIEW_V1_CLI_NAMES);
+        const supportedPlanReviewCliNames = sorted.filter((name) => planReviewCliNameSet.has(name));
+        if (planReviewSeatProps?.["cli_name"] != null &&
+            supportedPlanReviewCliNames.length > 0) {
+            planReviewSeatProps["cli_name"] = {
+                ...planReviewSeatProps["cli_name"],
+                enum: supportedPlanReviewCliNames,
+                description: `Configured v1 plan-review adapters: ${supportedPlanReviewCliNames.join(", ")}`,
+            };
+        }
         // chairman enum
         if (props["chairman"] != null) {
             props["chairman"] = {
@@ -1212,7 +3114,7 @@ export function getWorkflowToolDefinitions(workflowsPath, availableCliNames) {
     return [
         {
             name: "run_workflow",
-            description: `Start a new multi-stage workflow execution.${workflowSuffix}\nAccepts optional \`members\` and \`chairman\` parameters for council workflows (council-default, council-answer, council-code-review, council-debug, council-discover) to override member/reviewer composition and chairman CLI adapter at runtime.`,
+            description: `Start a new multi-stage workflow execution.${workflowSuffix}\nAccepts optional \`members\` and \`chairman\` parameters for council workflows (council-default, council-answer, council-code-review, council-debug, council-discover, council-plan-review) to override member/reviewer composition and chairman CLI adapter at runtime. Council runs include a \`resolved_roster\` of requested seat and delegate values (no provenance) on the async ack, a trailing sync content block, and workflow_run_status.`,
             inputSchema: runSchema,
         },
         {
@@ -1227,6 +3129,18 @@ export function getWorkflowToolDefinitions(workflowsPath, availableCliNames) {
             inputSchema: LIST_WORKFLOWS_SCHEMA,
             annotations: { readOnlyHint: true },
         },
+        {
+            name: "workflow_run_status",
+            description: "Read-only status/progress of a workflow run. The full result is included only with include_result:true. Generic workflows preserve succeeded-final-call behavior; plan-review-receipts reports marker-driven availability and bytes independently of terminal status, with body-blind default polling. Every found run also carries a top-level `health` block {classification: \"ok\"|\"degraded\", reasons: string[]} computed read-time from persisted data — a run can be status:\"succeeded\" yet degraded when on_failure:continue swallowed failed calls or context preflight was partial/degraded (reasons: failed_calls_in_succeeded_run, context_partial, context_lifecycle_failed, coverage_degraded, delegate_fallback_used, context_external_gaps — the finalizer reported evidence gaps outside the delegate packet under external_gap_policy:\"degrade\", so conclusions depending on them are conditional). When a context-builder lifecycle snapshot is persisted, the `context` block additionally includes `lifecycle_status` and `coverage` {policy, status, required, selected, missing}. A parsed snapshot also projects `context.delegate.finalizer` {effective_enabled, execution_status, score?}; `score` is present only for a succeeded finalizer that recorded one, and the finalizer key is omitted when the lifecycle is missing, unparseable, or those fields are absent. While context preflight is still running (non-terminal lifecycle, no committed context yet) the `context` block is absent and a top-level `context_progress` {phase, status, updated_at, counts} reports scan progress instead. Found council runs also include a top-level `resolved_roster` of requested seat and delegate values (no provenance) when the run persisted one; older runs omit the key.",
+            inputSchema: WORKFLOW_RUN_STATUS_SCHEMA,
+            annotations: { readOnlyHint: true },
+        },
+        {
+            name: "cancel_workflow",
+            description: "Cancel a workflow run by run_id. Aborts a live in-process async run (returns status:'cancelling'; poll workflow_run_status until it reaches terminal 'cancelled'). Reaps an orphaned/no-live-worker run to terminal 'cancelled' (reaped:true). Refuses a lock-held run owned by another live worker or a blocking run (cancellable:false). Idempotent; not_found and already_terminal are soft results.",
+            inputSchema: CANCEL_WORKFLOW_SCHEMA,
+            annotations: { destructiveHint: true },
+        },
     ];
 }
 /** Names of the workflow tools (for dispatch matching). */
@@ -1234,6 +3148,8 @@ export const WORKFLOW_TOOL_NAMES = new Set([
     "run_workflow",
     "resume_workflow",
     "list_workflows",
+    "workflow_run_status",
+    "cancel_workflow",
 ]);
 /**
  * Dispatch a workflow tool call.
@@ -1248,7 +3164,11 @@ export async function handleWorkflowToolCall(server, options, name, args, signal
         case "resume_workflow":
             return await executeResumeWorkflow(server, options, args, signal, progressToken);
         case "list_workflows":
-            return executeListWorkflows(options.workflowsPath, options.availableCliNames);
+            return executeListWorkflows(options);
+        case "workflow_run_status":
+            return await executeWorkflowRunStatus(options, args);
+        case "cancel_workflow":
+            return await executeCancelWorkflow(options, args);
         default:
             return null;
     }
@@ -1260,7 +3180,8 @@ export async function handleWorkflowToolCall(server, options, name, args, signal
  * Register workflow tools on an MCP Server instance.
  *
  * This is the reusable core extracted from createWorkflowServer().
- * It registers three tools: run_workflow, resume_workflow, list_workflows.
+ * It registers five tools: run_workflow, resume_workflow, list_workflows,
+ * workflow_run_status, cancel_workflow.
  *
  * The `options.createBackend` factory determines how clink calls are
  * dispatched — callers provide either a child-process or in-process backend.
@@ -1272,21 +3193,35 @@ export async function handleWorkflowToolCall(server, options, name, args, signal
 export function registerWorkflowTools(server, options) {
     // tools/list
     server.setRequestHandler(ListToolsRequestSchema, async () => {
-        return { tools: getWorkflowToolDefinitions(options.workflowsPath, options.availableCliNames) };
+        activeWorkflowHandlers += 1;
+        try {
+            return { tools: getWorkflowToolDefinitions(options.workflowsPath, options.availableCliNames) };
+        }
+        finally {
+            activeWorkflowHandlers -= 1;
+            notifyWorkflowActivity();
+        }
     });
     // tools/call
     server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
-        const { name, arguments: args } = request.params;
-        const progressToken = request.params._meta?.progressToken;
-        const result = await handleWorkflowToolCall(server, options, name, args ?? {}, extra.signal, progressToken);
-        if (result != null) {
-            return result;
+        activeWorkflowHandlers += 1;
+        try {
+            const { name, arguments: args } = request.params;
+            const progressToken = request.params._meta?.progressToken;
+            const result = await handleWorkflowToolCall(server, options, name, args ?? {}, extra.signal, progressToken);
+            if (result != null) {
+                return result;
+            }
+            logger.warn({ tool: name }, "unknown tool requested");
+            return {
+                content: [{ type: "text", text: `Unknown tool: ${String(name)}` }],
+                isError: true,
+            };
+        }
+        finally {
+            activeWorkflowHandlers -= 1;
+            notifyWorkflowActivity();
         }
-        logger.warn({ tool: name }, "unknown tool requested");
-        return {
-            content: [{ type: "text", text: `Unknown tool: ${String(name)}` }],
-            isError: true,
-        };
     });
 }
 //# sourceMappingURL=workflow-tools.js.map