clinkx 1.1.0 → 1.1.2

package/clinkx-workflows/dist/verified-repair/runtime.js

@@ -0,0 +1,186 @@
+import { SchemaValidationError, OutputSizeError } from "../artifacts.js";
+import { relative } from "node:path";
+import { readContainedRelativeFile } from "../contained-file.js";
+import { FixProposalSchema, InvestigationSchema, MAX_REPAIR_PACKET_BYTES, MAX_REPAIR_PROPOSAL_BYTES, RepairPacketSchema, RepairRecordSchema, RepairReviewSchema, REPAIR_REFS, assertRepairBounded, } from "./contract.js";
+import { bytesDigest } from "../architecture-comparison/contract.js";
+import { publishRepairRecord } from "./result.js";
+import { hasCredentialTokenShape } from "../dashboard/session-log-redaction.js";
+import { WorkflowCancellationError } from "../errors.js";
+const PROVIDER_PHASES = {
+    [REPAIR_REFS.investigate]: { phase: "investigate", packet: "capture" },
+    [REPAIR_REFS.repair]: { phase: "repair", packet: "reproduce" },
+    [REPAIR_REFS.review]: { phase: "review", packet: "fixed" },
+};
+/** Fixed phase policy; the existing engine remains the only dispatcher. */
+export class VerifiedRepairRuntime {
+    host;
+    runId;
+    runDir;
+    packet;
+    providerPackets = new Map();
+    retained = new Map();
+    finalization;
+    invalidArtifact;
+    constructor(host, runId, runDir) {
+        this.host = host;
+        this.runId = runId;
+        this.runDir = runDir;
+    }
+    async prepareProvider(reference, signal) {
+        if (this.invalidArtifact !== undefined)
+            throw new Error(`invalid repair provider artifact: ${this.invalidArtifact.phase}`);
+        const binding = PROVIDER_PHASES[reference];
+        if (binding === undefined)
+            throw new Error("unexpected repair provider call");
+        if (this.packet?.phase !== binding.packet)
+            throw new Error(`repair prerequisite unavailable for ${binding.phase}`);
+        await this.verifyRetained();
+        await this.host.assertProviderPhase(binding.phase, signal);
+        assertRepairBounded(this.packet, MAX_REPAIR_PACKET_BYTES);
+        this.providerPackets.set(reference, JSON.stringify(this.packet));
+    }
+    providerPacket(reference) {
+        const packet = this.providerPackets.get(reference);
+        if (packet === undefined)
+            throw new Error("repair provider packet was not prepared");
+        return packet;
+    }
+    async beforeDispatch(reference, input, signal) {
+        const binding = PROVIDER_PHASES[reference];
+        if (binding === undefined || input["continuation_id"] !== undefined ||
+            typeof input["prompt"] !== "string" || !input["prompt"].endsWith(`\n\nFROZEN REPAIR PACKET\n${this.providerPacket(reference)}`)) {
+            throw new Error("repair dispatch is not the fresh frozen packet");
+        }
+        await this.verifyRetained();
+        await this.host.assertProviderPhase(binding.phase, signal);
+    }
+    validateOutput(reference, value) {
+        const schema = reference === REPAIR_REFS.investigate ? InvestigationSchema
+            : reference === REPAIR_REFS.repair ? FixProposalSchema
+                : reference === REPAIR_REFS.review ? RepairReviewSchema
+                    : reference === REPAIR_REFS.record ? RepairRecordSchema : RepairPacketSchema;
+        const parsed = schema.parse(value);
+        assertRepairBounded(parsed, MAX_REPAIR_PROPOSAL_BYTES);
+        if (hasCredentialTokenShape(JSON.stringify(parsed)))
+            throw new Error("repair artifact contains credential-like material; publication is rejected");
+        this.host.validateProviderOutput?.(parsed);
+        if (this.packet !== undefined && parsed.frozen_digest !== this.packet.frozen_digest)
+            throw new Error("repair artifact frozen identity mismatch");
+    }
+    noteInvalidArtifact(reference, error) {
+        if (!(reference in PROVIDER_PHASES))
+            return;
+        // JSON parser errors can include excerpts of untrusted provider text.
+        // Preserve the phase and failure class without copying those excerpts.
+        const message = error instanceof SchemaValidationError ? "provider artifact failed strict JSON/schema validation"
+            : error instanceof OutputSizeError ? "provider artifact exceeded repair byte limits"
+                : "provider artifact identity or semantic contract is invalid";
+        this.invalidArtifact ??= { kind: "invalid_artifact", phase: reference, message };
+    }
+    recordWritten(artifact) {
+        this.retained.set(artifact.reference, {
+            path: relative(this.runDir, artifact.filePath),
+            sha256: bytesDigest(`${JSON.stringify(artifact.parsed, null, 2)}\n`),
+        });
+    }
+    async reduce(operation, artifacts, signal) {
+        if (operation !== "record" && this.invalidArtifact !== undefined)
+            throw new Error(`invalid repair provider artifact: ${this.invalidArtifact.phase}`);
+        await this.verifyRetained();
+        const proposal = (reference) => {
+            const artifact = artifacts.find((entry) => entry.reference === reference);
+            if (artifact === undefined || !this.retained.has(reference))
+                throw new Error(`repair prerequisite unavailable: ${reference}`);
+            this.validateOutput(reference, artifact.parsed);
+            return artifact.parsed;
+        };
+        if (operation === "record") {
+            // The run owner publishes again after cleanup with actual terminal state.
+            // A final reducer is never the interruption publication boundary.
+            return JSON.stringify(RepairRecordSchema.parse(await this.host.record("completed")));
+        }
+        const packet = operation === "capture" ? await this.host.capture(signal)
+            : operation === "reproduce" ? await this.host.reproduce(proposal(REPAIR_REFS.investigate), signal)
+                : operation === "fixed" ? await this.host.fixed(proposal(REPAIR_REFS.repair), signal)
+                    : await this.host.independently(proposal(REPAIR_REFS.review), signal);
+        const parsed = RepairPacketSchema.parse(packet);
+        if (parsed.phase !== operation || (this.packet !== undefined && parsed.frozen_digest !== this.packet.frozen_digest))
+            throw new Error("repair host packet phase or frozen identity mismatch");
+        assertRepairBounded(parsed, MAX_REPAIR_PACKET_BYTES);
+        this.packet = parsed;
+        return JSON.stringify(this.packet);
+    }
+    /** Await all owned cleanup before publication, even with an aborted run signal. */
+    finalize(status, reason, signal) {
+        this.finalization ??= this.finalizeOnce(status, reason, signal);
+        return this.finalization;
+    }
+    async cleanupUnadmitted(reason) {
+        try {
+            await this.host.abort(reason);
+        }
+        finally {
+            await this.host.cleanup();
+        }
+    }
+    async finalizeOnce(status, reason, signal) {
+        const requestedCompletion = status === "completed";
+        const finalizationErrors = [];
+        const abort = async (error) => {
+            try {
+                await this.host.abort(error);
+            }
+            catch (abortError) {
+                finalizationErrors.push(abortError);
+            }
+        };
+        if (this.invalidArtifact !== undefined)
+            await abort(this.invalidArtifact);
+        if (status !== "completed")
+            await abort(reason ?? status);
+        try {
+            await this.host.cleanup();
+        }
+        catch (error) {
+            finalizationErrors.push(error);
+            status = status === "completed" ? "failed" : status;
+            await abort(error);
+        }
+        if (status === "completed" && finalizationErrors.length > 0)
+            status = "failed";
+        if (requestedCompletion && signal?.aborted) {
+            status = "cancelled";
+            await abort(signal.reason ?? "cancelled during finalization");
+        }
+        let record = RepairRecordSchema.parse(await this.host.record(status));
+        if (record.run_id !== this.runId || record.execution_status !== status)
+            throw new Error("repair terminal record identity mismatch");
+        await publishRepairRecord(this.runDir, record);
+        // Cancellation can arrive while the host projection or atomic publication
+        // awaits I/O. Reproject partial facts before the owner commits terminal state.
+        if (requestedCompletion && signal?.aborted && status !== "cancelled") {
+            await abort(signal.reason ?? "cancelled during publication");
+            status = "cancelled";
+            record = RepairRecordSchema.parse(await this.host.record(status));
+            if (record.run_id !== this.runId || record.execution_status !== status)
+                throw new Error("repair terminal record identity mismatch");
+            await publishRepairRecord(this.runDir, record);
+        }
+        if (requestedCompletion && status === "cancelled")
+            throw new WorkflowCancellationError();
+        if (finalizationErrors.length > 0)
+            throw new AggregateError(finalizationErrors, "repair finalization failed after retaining terminal facts");
+        return JSON.stringify(record);
+    }
+    async verifyRetained() {
+        for (const [reference, fact] of this.retained) {
+            const read = await readContainedRelativeFile(this.runDir, fact.path, {
+                wantContent: true, requireRegular: true, requireExactRequestedPath: true,
+                maxBytes: MAX_REPAIR_PROPOSAL_BYTES,
+            });
+            if (bytesDigest(read.content) !== fact.sha256)
+                throw new Error(`retained repair artifact changed: ${reference}`);
+        }
+    }
+}
+//# sourceMappingURL=runtime.js.map

package/clinkx-workflows/dist/verified-repair/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/verified-repair/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAuB,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,EACL,iBAAiB,EAAE,mBAAmB,EAAE,uBAAuB,EAC/D,yBAAyB,EAAE,kBAAkB,EAAE,kBAAkB,EACjE,kBAAkB,EAAE,WAAW,EAAE,mBAAmB,GAErD,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAGzD,MAAM,eAAe,GAAG;IACtB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE;IACtE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE;IAC9D,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;CAClD,CAAC;AAEX,2EAA2E;AAC3E,MAAM,OAAO,qBAAqB;IAQb;IACA;IACA;IATX,MAAM,CAA2B;IACxB,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,QAAQ,GAAG,IAAI,GAAG,EAA4C,CAAC;IACxE,YAAY,CAA8B;IAC1C,eAAe,CAA2E;IAElG,YACmB,IAA4B,EAC5B,KAAa,EACb,MAAc;QAFd,SAAI,GAAJ,IAAI,CAAwB;QAC5B,UAAK,GAAL,KAAK,CAAQ;QACb,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,MAAmB;QAC1D,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3H,MAAM,OAAO,GAAG,eAAe,CAAC,SAAyC,CAAC,CAAC;QAC3E,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC9E,IAAI,IAAI,CAAC,MAAM,EAAE,KAAK,KAAK,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACnH,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;QAC1D,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,cAAc,CAAC,SAAiB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACrF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAiB,EAAE,KAAwC,EAAE,MAAmB;QACnG,MAAM,OAAO,GAAG,eAAe,CAAC,SAAyC,CAAC,CAAC;QAC3E,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,iBAAiB,CAAC,KAAK,SAAS;YACjE,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,6BAA6B,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YAClI,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED,cAAc,CAAC,SAAiB,EAAE,KAAc;QAC9C,MAAM,MAAM,GAAG,SAAS,KAAK,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,mBAAmB;YACxE,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB;gBACtD,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB;oBACvD,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;QACvD,IAAI,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QACnJ,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,CAAC,MAAM,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACnJ,CAAC;IAED,mBAAmB,CAAC,SAAiB,EAAE,KAAc;QACnD,IAAI,CAAC,CAAC,SAAS,IAAI,eAAe,CAAC;YAAE,OAAO;QAC5C,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,OAAO,GAAG,KAAK,YAAY,qBAAqB,CAAC,CAAC,CAAC,wDAAwD;YAC/G,CAAC,CAAC,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,+CAA+C;gBACpF,CAAC,CAAC,4DAA4D,CAAC;QACjE,IAAI,CAAC,eAAe,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACnF,CAAC;IAED,aAAa,CAAC,QAAwB;QACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE;YACpC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC;YAC9C,MAAM,EAAE,WAAW,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;SACrE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAA0B,EAAE,SAAoC,EAAE,MAAoB;QACjG,IAAI,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;QACrJ,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,CAAC,SAAiB,EAAW,EAAE;YAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;YAC1E,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,EAAE,CAAC,CAAC;YAC9H,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChD,OAAO,QAAQ,CAAC,MAAM,CAAC;QACzB,CAAC,CAAC;QACF,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,0EAA0E;YAC1E,kEAAkE;YAClE,OAAO,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACtE,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;gBAClG,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;oBACrF,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC7L,mBAAmB,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,mFAAmF;IACnF,QAAQ,CAAC,MAA6B,EAAE,MAAgB,EAAE,MAAoB;QAC5E,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAe;QACrC,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;gBAC9B,CAAC;YAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAAC,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,MAA6B,EAAE,MAAgB,EAAE,MAAoB;QAC9F,MAAM,mBAAmB,GAAG,MAAM,KAAK,WAAW,CAAC;QACnD,MAAM,kBAAkB,GAAc,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,KAAK,EAAE,KAAc,EAAiB,EAAE;YACpD,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YACrC,OAAO,UAAU,EAAE,CAAC;gBAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAAC,CAAC;QAC7D,CAAC,CAAC;QACF,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS;YAAE,MAAM,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1E,IAAI,MAAM,KAAK,WAAW;YAAE,MAAM,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAAC,CAAC;QAClC,OAAO,KAAK,EAAE,CAAC;YACb,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,MAAM,GAAG,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;YACpD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,MAAM,KAAK,WAAW,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,GAAG,QAAQ,CAAC;QAC/E,IAAI,mBAAmB,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YAC3C,MAAM,GAAG,WAAW,CAAC;YACrB,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,+BAA+B,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,gBAAgB,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACpI,MAAM,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/C,0EAA0E;QAC1E,+EAA+E;QAC/E,IAAI,mBAAmB,IAAI,MAAM,EAAE,OAAO,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YACrE,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,8BAA8B,CAAC,CAAC;YAC7D,MAAM,GAAG,WAAW,CAAC;YACrB,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,gBAAgB,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACpI,MAAM,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,mBAAmB,IAAI,MAAM,KAAK,WAAW;YAAE,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACzF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,kBAAkB,EAAE,2DAA2D,CAAC,CAAC;QAC7I,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,KAAK,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE;gBACnE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI;gBACxE,QAAQ,EAAE,yBAAyB;aACpC,CAAC,CAAC;YACH,IAAI,WAAW,CAAC,IAAI,CAAC,OAAQ,CAAC,KAAK,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,SAAS,EAAE,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;CACF"}

package/clinkx-workflows/dist/workflow-tools.d.ts

@@ -26,7 +26,10 @@ import type { Variable } from "./schema.js";
 import { type WorkflowContextRequestedMode, type WorkflowContextPolicy } from "./context-mode-resolver.js";
 import { type AvailableCliCapability, type ResolvedRoster } from "./roster-contract.js";
 import type { RosterLoader } from "./rosters.js";
+import type { VerifiedRepairHost } from "./verified-repair/host.js";
 export interface WorkflowToolsOptions {
+    /** Root-owned contract capture, scoped edits, and native verification. */
+    readonly verifiedRepairHost?: VerifiedRepairHost | undefined;
     /**
      * Factory that creates a ClinkBackend for a given run.
      * For standalone server: `(runId) => new ClinkSession({ runId })`

package/clinkx-workflows/dist/workflow-tools.js

@@ -25,7 +25,7 @@ import { readRunStateForStatus, reapRunCancelled, WorkflowStateStore } from "./s
 import { isTerminalContextBuilderLifecycleStatus, parseContextBuilderLifecycleStateV1, } from "./context-builder-lifecycle-contract.js";
 import { validateRunId } from "./run-id.js";
 import { validateDynamicPaths } from "./path-validation.js";
-import { getMaxPromptBytes, getRunStateDir, getTemplatesPath, getWorkflowsContextDefault, getWorkflowsContextDefaultCurator, getWorkflowsMaxConcurrentAsync, resolveWorkspaceRoot, } from "./config.js";
+import { getMaxPromptBytes, getRunStateDir, getRunsDir, getTemplatesPath, getWorkflowsContextDefault, getWorkflowsContextDefaultCurator, getWorkflowsMaxConcurrentAsync, resolveWorkspaceRoot, } from "./config.js";
 import { WorkflowCancellationError, WorkflowValidationError, } from "./errors.js";
 import { shutdownCoordinator } from "./shutdown.js";
 import { logger } from "./logger.js";
@@ -54,6 +54,14 @@ import { validatePlanReviewCallBindings, validatePlanReviewPreparedInputPolicy,
 import { ContainedFilePolicyError, readContainedRelativeFile, } from "./contained-file.js";
 import { createDashboardRunReader } from "./dashboard/read-model.js";
 import { ROSTER_NAME_PATTERN, ResolvedRosterSchema, } from "./roster-contract.js";
+import { materializeArchitectureRoutes } from "./architecture-comparison/admission.js";
+import { ARCHITECTURE_WORKFLOW } from "./architecture-comparison/contract.js";
+import { inspectArchitectureComparisonRecord } from "./architecture-comparison/runtime.js";
+import { VERIFIED_REPAIR_WORKFLOW, MAX_REPAIR_RECORD_BYTES, RepairRecordSchema, assertRepairBounded } from "./verified-repair/contract.js";
+import { materializeVerifiedRepairRoutes, repairRoutesFromVariables } from "./verified-repair/admission.js";
+import { VerifiedRepairRuntime } from "./verified-repair/runtime.js";
+import { inspectVerifiedRepairRecord } from "./verified-repair/result.js";
+import { readWorkflowVerification } from "./workflow-verification.js";
 async function inspectLegacyWorkflowSessionLogGeneration(runDir, runId) {
     try {
         const result = await createDashboardRunReader().inspectGeneration?.(dirname(runDir), runId);
@@ -1339,7 +1347,7 @@ async function executeRunWorkflow(server, options, args, signal, progressToken)
         throw new McpError(ErrorCode.InvalidParams, `Invalid run_id "${runId}". Must match [A-Za-z0-9_-]{1,64}.`);
     }
     const validatorRegistry = createValidatorRegistry();
-    const loaded = loadWorkflow(workflow, {
+    let loaded = loadWorkflow(workflow, {
         templatesRoot: options.templatesRoot ?? getTemplatesPath(),
         workflowsPath: options.workflowsPath,
         validatorRegistry,
@@ -1400,20 +1408,30 @@ async function executeRunWorkflow(server, options, args, signal, progressToken)
             throw new McpError(ErrorCode.InvalidParams, `chairman_effort parameter is not supported for workflow "${workflow}"`);
         }
         resolvedVariables = validateVariables(suppliedVariables, loaded.definition.variables);
+        try {
+            loaded = { ...loaded, normalized: materializeArchitectureRoutes(loaded.normalized, resolvedVariables, options.planReviewAvailableCliNames ?? options.availableCliNames, options.validateInvocationOverrides) };
+            loaded = { ...loaded, normalized: materializeVerifiedRepairRoutes(loaded.normalized, resolvedVariables, options.planReviewAvailableCliNames ?? options.availableCliNames, options.validateInvocationOverrides) };
+            if (workflow === VERIFIED_REPAIR_WORKFLOW && options.verifiedRepairHost === undefined) {
+                throw new Error("verified-repair requires the root host capability");
+            }
+        }
+        catch (error) {
+            throw new McpError(ErrorCode.InvalidParams, error instanceof Error ? error.message : String(error));
+        }
         // When the runner is absent (preflight disabled / hard kill), the boundary
         // validator is inert. Skip it WITHOUT evaluating the context-default env
         // parsers — getWorkflowsContextDefaultCurator() throws on empty env, and a
         // runner-less run_workflow must never trip context env parsing.
         let contextPolicy;
-        if (options.contextBuilderRunner != null) {
+        if (workflow !== VERIFIED_REPAIR_WORKFLOW && options.contextBuilderRunner != null) {
             contextPolicy = validateContextBuilderAnchorSufficiency(resolvedVariables, options.contextBuilderRunner, options.contextDefault ?? getWorkflowsContextDefault(), options.defaultCurator ?? getWorkflowsContextDefaultCurator());
         }
         validateContextSeedSourceAtAdmission(resolvedVariables, contextPolicy);
         // Pre-mutex, pre-state, pre-preflight: an out-of-roots caller path costs
         // zero delegate round-trips and leaves no run directory behind.
         assertCallerDynamicPathsAllowed(loaded.normalized, resolvedVariables, workflow, runId);
-        initialContextPolicy = contextPolicy ?? resolveWorkflowContextMode(undefined, options.contextDefault ?? "off", false, undefined, options.defaultCurator);
-        if (options.contextBuilderRunner != null) {
+        initialContextPolicy = contextPolicy ?? resolveWorkflowContextMode(undefined, workflow === VERIFIED_REPAIR_WORKFLOW ? "off" : options.contextDefault ?? "off", false, undefined, options.defaultCurator);
+        if (workflow !== VERIFIED_REPAIR_WORKFLOW && options.contextBuilderRunner != null) {
             try {
                 options.contextBuilderRunner.assertTaskSecretsAllowed(resolvedVariables);
             }
@@ -1475,6 +1493,32 @@ async function executeRunWorkflow(server, options, args, signal, progressToken)
     }
     const isAsync = args["async"] === true;
     const ownership = acquireWorkflowRun(runId, options, isAsync ? undefined : signal);
+    let verifiedRepair;
+    if (workflow === VERIFIED_REPAIR_WORKFLOW) {
+        try {
+            ownership.throwIfCancelled();
+            const runDir = getRunStateDir(runId);
+            if (existsSync(runDir))
+                throw new McpError(ErrorCode.InvalidParams, `run_id ${runId} already has persisted state at ${runDir}`);
+            const prepared = await options.verifiedRepairHost.prepare({
+                runId, runDir, contractPath: resolvedVariables["repair_contract_path"],
+                routes: repairRoutesFromVariables(resolvedVariables), signal: ownership.signal,
+            });
+            verifiedRepair = new VerifiedRepairRuntime(prepared, runId, runDir);
+            ownership.throwIfCancelled();
+        }
+        catch (error) {
+            try {
+                await verifiedRepair?.cleanupUnadmitted(error);
+            }
+            finally {
+                await ownership.finish(undefined);
+            }
+            if (ownership.signal.aborted)
+                throw new WorkflowCancellationError();
+            throw new McpError(ErrorCode.InvalidParams, error instanceof Error ? error.message : String(error));
+        }
+    }
     if (isAsync) {
         // Everything between acquireMutex and the detached spawn must release the
         // mutex on ANY throw, or the run slot leaks permanently (bricks the server
@@ -1562,14 +1606,24 @@ async function executeRunWorkflow(server, options, args, signal, progressToken)
                 throw err;
             }
             finally {
-                await ownership.finish(store);
+                try {
+                    if (verifiedRepair !== undefined) {
+                        if (store === undefined)
+                            await verifiedRepair.cleanupUnadmitted(err);
+                        else
+                            await verifiedRepair.finalize(ownership.signal.aborted ? "cancelled" : "failed", err);
+                    }
+                }
+                finally {
+                    await ownership.finish(store);
+                }
             }
         }
         if (store === undefined || effectiveDefinition === undefined) {
             await ownership.finish(store);
             throw new McpError(ErrorCode.InternalError, `Failed to initialize async run ${runId}`);
         }
-        void runWorkflowDetached(server, options, workflow, runId, resolvedVariables, debug, receipt, validatorRegistry, loaded, parsedMembers, parsedChairman, parsedChairmanModel, parsedChairmanEffort, true, ownership, undefined, store, effectiveDefinition, undefined, initializedPlanReview, initialContextPolicy, admittedRosterName).catch((err) => {
+        void runWorkflowDetached(server, options, workflow, runId, resolvedVariables, debug, receipt, validatorRegistry, loaded, parsedMembers, parsedChairman, parsedChairmanModel, parsedChairmanEffort, true, ownership, undefined, store, effectiveDefinition, undefined, initializedPlanReview, initialContextPolicy, admittedRosterName, verifiedRepair).catch((err) => {
             if (err instanceof WorkflowCancellationError) {
                 logger.info({ runId }, "workflow run cancelled");
                 return;
@@ -1597,7 +1651,7 @@ async function executeRunWorkflow(server, options, args, signal, progressToken)
                 }],
         };
     }
-    return await runWorkflowDetached(server, options, workflow, runId, resolvedVariables, debug, receipt, validatorRegistry, loaded, parsedMembers, parsedChairman, parsedChairmanModel, parsedChairmanEffort, false, ownership, progressToken, undefined, undefined, planReviewPlan, undefined, initialContextPolicy, admittedRosterName);
+    return await runWorkflowDetached(server, options, workflow, runId, resolvedVariables, debug, receipt, validatorRegistry, loaded, parsedMembers, parsedChairman, parsedChairmanModel, parsedChairmanEffort, false, ownership, progressToken, undefined, undefined, planReviewPlan, undefined, initialContextPolicy, admittedRosterName, verifiedRepair);
 }
 async function preparePlanReviewSnapshot(plan) {
     try {
@@ -1789,7 +1843,7 @@ preparedSnapshot) {
         ? expandCouncilComposition(definition, parsedMembers, workflow, parsedChairman, parsedChairmanModel, parsedChairmanEffort)
         : definition;
 }
-async function runWorkflowDetached(server, options, workflow, runId, resolvedVariables, debug, receipt, validatorRegistry, loaded, parsedMembers, parsedChairman, parsedChairmanModel, parsedChairmanEffort, isAsync, ownership, progressToken, preCreatedStore, preExpandedDefinition, planReviewPlan, preInitializedPlanReview, initialContextPolicy, rosterName) {
+async function runWorkflowDetached(server, options, workflow, runId, resolvedVariables, debug, receipt, validatorRegistry, loaded, parsedMembers, parsedChairman, parsedChairmanModel, parsedChairmanEffort, isAsync, ownership, progressToken, preCreatedStore, preExpandedDefinition, planReviewPlan, preInitializedPlanReview, initialContextPolicy, rosterName, verifiedRepair) {
     let store = preCreatedStore ?? null;
     let backend = null;
     let reporter;
@@ -1849,6 +1903,24 @@ async function runWorkflowDetached(server, options, workflow, runId, resolvedVar
         const rpt = reporter; // local const for closure narrowing
         const hooks = {
             ...storeRef.hooks,
+            ...(verifiedRepair === undefined ? {} : {
+                onRunStateChange: async (event) => {
+                    if (event.state === "succeeded" || event.state === "failed" || event.state === "cancelled") {
+                        try {
+                            await backend?.terminate();
+                            await verifiedRepair.finalize(event.state === "succeeded" ? "completed" : event.state, event.error, signal);
+                            if (event.state === "succeeded")
+                                ownership.throwIfCancelled();
+                        }
+                        catch (error) {
+                            if (event.state === "succeeded")
+                                throw error;
+                            logger.error({ err: error, runId }, "repair terminal publication failed; preserving original execution failure");
+                        }
+                    }
+                    await storeRef.hooks.onRunStateChange?.(event);
+                },
+            }),
             ...(rpt != null
                 ? {
                     onProgress: async (event) => {
@@ -1872,11 +1944,12 @@ async function runWorkflowDetached(server, options, workflow, runId, resolvedVar
             runDir: storeRef.runDir,
             signal,
             hooks,
-            contextBuilderRunner: options.contextBuilderRunner,
+            contextBuilderRunner: verifiedRepair === undefined ? options.contextBuilderRunner : undefined,
             contextDefault: options.contextDefault,
             defaultCurator: options.defaultCurator,
             commitPreflightContext: storeRef.commitPreflightContext?.bind(storeRef),
             initialContextPolicy,
+            verifiedRepair,
             ...(options.deriveInvocationAudit === undefined
                 ? {}
                 : { deriveInvocationAudit: options.deriveInvocationAudit }),
@@ -1893,6 +1966,7 @@ async function runWorkflowDetached(server, options, workflow, runId, resolvedVar
                 : {}),
         });
         const result = await engine.execute();
+        const terminalRepair = await verifiedRepair?.finalize("completed", undefined, signal);
         // Build summary (fail-open)
         let summary;
         if (receipt) {
@@ -1905,7 +1979,7 @@ async function runWorkflowDetached(server, options, workflow, runId, resolvedVar
             }
         }
         const content = finalizeWorkflowPresentation({
-            outputText: result.outputText,
+            outputText: terminalRepair ?? result.outputText,
             receipt,
             debug,
             summary,
@@ -1916,6 +1990,18 @@ async function runWorkflowDetached(server, options, workflow, runId, resolvedVar
         return { content };
     }
     catch (error) {
+        if (verifiedRepair !== undefined) {
+            try {
+                await backend?.terminate();
+                if (store === null)
+                    await verifiedRepair.cleanupUnadmitted(error);
+                else
+                    await verifiedRepair.finalize(signal.aborted || error instanceof WorkflowCancellationError ? "cancelled" : "failed", error);
+            }
+            catch (publicationError) {
+                logger.error({ err: publicationError, runId }, "repair error publication failed; preserving original execution failure");
+            }
+        }
         if (signal.aborted || error instanceof WorkflowCancellationError) {
             await markWorkflowCancelled(store);
             throw new WorkflowCancellationError();
@@ -1992,6 +2078,9 @@ async function executeResumeWorkflow(server, options, args, signal, progressToke
         persistedBeforeMutex = null;
     }
     const persistedState = persistedBeforeMutex?.state;
+    if (persistedState?.workflowName === VERIFIED_REPAIR_WORKFLOW) {
+        throw new McpError(ErrorCode.InvalidParams, "verified-repair mutation cannot be resumed; inspect the retained result and submit a fresh explicit contract");
+    }
     if (persistedState != null &&
         isPlanReviewRunState(persistedState) &&
         (persistedState.status === "failed" ||
@@ -2022,6 +2111,9 @@ async function executeResumeWorkflow(server, options, args, signal, progressToke
             debugKeepArtifacts: debug,
         };
         store = await WorkflowStateStore.resume(resumeOptions);
+        if (store.runState.workflowName === VERIFIED_REPAIR_WORKFLOW) {
+            throw new McpError(ErrorCode.InvalidParams, "verified-repair mutation cannot be resumed; inspect the retained result and submit a fresh explicit contract");
+        }
         // Open this attempt before classifying an abort during reconstruction;
         // otherwise a prior terminal record would suppress markCancelled.
         await store.beginResumeAttempt();
@@ -2336,7 +2428,7 @@ function parseLifecycleForStatus(value) {
         return undefined;
     }
 }
-async function executeWorkflowRunStatus(_options, args) {
+async function executeWorkflowRunStatus(options, args) {
     const runId = args["run_id"];
     const includeResult = args["include_result"] === true;
     if (typeof runId !== "string" || runId === "") {
@@ -2396,6 +2488,7 @@ async function executeWorkflowRunStatus(_options, args) {
     };
     // artifacts_dir is cheap (pure join, no I/O) and present for every found run.
     projection["artifacts_dir"] = join(runDir, "artifacts");
+    projection["verification"] = await readWorkflowVerification(getRunsDir(), runId);
     // Read-only context-selection observability from already-persisted state.
     // No file I/O — only projects state.workflow_context.context_builder and
     // the state.context_builder_lifecycle snapshot.
@@ -2578,6 +2671,47 @@ async function executeWorkflowRunStatus(_options, args) {
             }
         }
     }
+    if (state.workflowName === ARCHITECTURE_WORKFLOW) {
+        const comparison = await inspectArchitectureComparisonRecord(runDir, runId, includeResult);
+        const { result, ...status } = comparison;
+        projection["comparison"] = status;
+        projection["result_available"] = status["status"] === "complete" || status["status"] === "incomplete";
+        if (result !== undefined)
+            projection["result"] = result;
+        else
+            delete projection["result"];
+    }
+    if (state.workflowName === VERIFIED_REPAIR_WORKFLOW) {
+        let inspected = await inspectVerifiedRepairRecord(runDir, runId, includeResult);
+        if (inspected.availability === "unrecorded" && lock === "stale_or_absent" && !activeRuns.has(runId)) {
+            try {
+                const value = await options.verifiedRepairHost?.readInterruptedRun?.({ runId, runDir });
+                if (value === undefined)
+                    throw new Error("interrupted capture unavailable");
+                const record = RepairRecordSchema.parse(value);
+                if (record.run_id !== runId || record.execution_status !== "interrupted")
+                    throw new Error("interrupted repair record identity mismatch");
+                assertRepairBounded(record, MAX_REPAIR_RECORD_BYTES);
+                const serialized = JSON.stringify(record);
+                inspected = { availability: "available", result_available: true,
+                    result_bytes: Buffer.byteLength(serialized), owner_acceptance: "not_recorded",
+                    execution_status: "interrupted", repair_status: record.repair_status,
+                    ...(includeResult ? { result: serialized, record } : {}) };
+            }
+            catch {
+                inspected = { availability: "unavailable", result_available: false, result_bytes: 0,
+                    owner_acceptance: "not_recorded", reason: "interrupted_capture_unavailable" };
+            }
+        }
+        const { result, record: _record, result_available, result_bytes, ...repair } = inspected;
+        projection["repair"] = { ...repair, scope: repair.execution_status === "interrupted" ? "inspected_at" : "recorded_at" };
+        projection["result_available"] = result_available;
+        projection["result_bytes"] = result_bytes;
+        if (result !== undefined)
+            projection["result"] = result;
+        else
+            delete projection["result"];
+    }
     return {
         content: [{ type: "text", text: JSON.stringify(projection) }],
     };
@@ -2680,7 +2814,7 @@ function executeListWorkflows(options) {
             supports_members: runtimeMembers,
             supports_chairman: runtimeMembers,
             supports_context_preflight: contextStrategy.supports_context_preflight,
-            effective_context_default: effectiveContextDefault,
+            effective_context_default: name === VERIFIED_REPAIR_WORKFLOW ? "disabled" : effectiveContextDefault,
             fails_on_empty_selection: contextStrategy.fails_on_empty_selection,
             context_anchor_variables: contextStrategy.context_anchor_variables,
             context_override_variables: contextStrategy.context_override_variables,
@@ -3131,7 +3265,7 @@ export function getWorkflowToolDefinitions(workflowsPath, availableCliNames) {
         },
         {
             name: "workflow_run_status",
-            description: "Read-only status/progress of a workflow run. The full result is included only with include_result:true. Generic workflows preserve succeeded-final-call behavior; plan-review-receipts reports marker-driven availability and bytes independently of terminal status, with body-blind default polling. Every found run also carries a top-level `health` block {classification: \"ok\"|\"degraded\", reasons: string[]} computed read-time from persisted data — a run can be status:\"succeeded\" yet degraded when on_failure:continue swallowed failed calls or context preflight was partial/degraded (reasons: failed_calls_in_succeeded_run, context_partial, context_lifecycle_failed, coverage_degraded, delegate_fallback_used, context_external_gaps — the finalizer reported evidence gaps outside the delegate packet under external_gap_policy:\"degrade\", so conclusions depending on them are conditional). When a context-builder lifecycle snapshot is persisted, the `context` block additionally includes `lifecycle_status` and `coverage` {policy, status, required, selected, missing}. A parsed snapshot also projects `context.delegate.finalizer` {effective_enabled, execution_status, score?}; `score` is present only for a succeeded finalizer that recorded one, and the finalizer key is omitted when the lifecycle is missing, unparseable, or those fields are absent. While context preflight is still running (non-terminal lifecycle, no committed context yet) the `context` block is absent and a top-level `context_progress` {phase, status, updated_at, counts} reports scan progress instead. Found council runs also include a top-level `resolved_roster` of requested seat and delegate values (no provenance) when the run persisted one; older runs omit the key.",
+            description: "Read-only status/progress of a workflow run. The full result is included only with include_result:true. Generic workflows preserve succeeded-final-call behavior; plan-review-receipts reports marker-driven availability and bytes independently of terminal status, with body-blind default polling. Every found run also carries a top-level `health` block {classification: \"ok\"|\"degraded\", reasons: string[]} computed read-time from persisted data — a run can be status:\"succeeded\" yet degraded when on_failure:continue swallowed failed calls or context preflight was partial/degraded (reasons: failed_calls_in_succeeded_run, context_partial, context_lifecycle_failed, coverage_degraded, delegate_fallback_used, context_external_gaps — the finalizer reported evidence gaps outside the delegate packet under external_gap_policy:\"degrade\", so conclusions depending on them are conditional). When a context-builder lifecycle snapshot is persisted, the `context` block additionally includes `lifecycle_status` and `coverage` {policy, status, required, selected, missing}. A parsed snapshot also projects `context.delegate.finalizer` {effective_enabled, execution_status, score?}; `score` is present only for a succeeded finalizer that recorded one, and the finalizer key is omitted when the lifecycle is missing, unparseable, or those fields are absent. While context preflight is still running (non-terminal lifecycle, no committed context yet) the `context` block is absent and a top-level `context_progress` {phase, status, updated_at, counts} reports scan progress instead. Found council runs also include a top-level `resolved_roster` of requested seat and delegate values (no provenance) when the run persisted one; older runs omit the key. Architecture comparisons additionally project comparison completeness and retained record availability independently of run execution status. Every found run has a separately versioned verification projection of historical inspected-at evidence; it establishes neither current source/runtime applicability nor owner acceptance.",
             inputSchema: WORKFLOW_RUN_STATUS_SCHEMA,
             annotations: { readOnlyHint: true },
         },