cool-workflow 0.1.81 → 0.1.82

package/dist/execution-backend.js

@@ -47,6 +47,7 @@ exports.backendProbePayload = backendProbePayload;
 exports.buildChildEnv = buildChildEnv;
 exports.clearProbeCache = clearProbeCache;
 const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
 const node_child_process_1 = require("node:child_process");
 // Pure leaf helpers — carved into ./execution-backend/util.ts (god-module carve).
 // `sha256` is re-exported below to keep the public surface byte-identical.
@@ -578,35 +579,14 @@ function runContainer(descriptor, policy, request, label, handle, attestation) {
     }
     return delegatedEnvelope(descriptor, label, handle, attestation, command, args, exitCode, String(result.stdout || ""));
 }
-// A self-contained Node child that performs the remote/CI delegation: it reads a
-// JSON job on stdin, POSTs it to the endpoint, optionally polls a returned jobId,
-// and prints `{ exitCode, stdout }` (or `{ error }`) on stdout. Node-only (global
-// fetch, node >=18), so the driver stays portable and synchronous from CW's view.
-const HTTP_DELEGATE_CHILD = `
-(async () => {
-  const read = () => new Promise((res) => { let b = ""; process.stdin.on("data", (c) => (b += c)); process.stdin.on("end", () => res(b)); });
-  try {
-    const job = JSON.parse((await read()) || "{}");
-    const endpoint = process.env.CW_DELEGATE_ENDPOINT;
-    if (!endpoint) throw new Error("no endpoint");
-    const post = await fetch(endpoint, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(job) });
-    if (!post.ok) throw new Error("runner responded " + post.status);
-    let data = await post.json();
-    // Poll a returned jobId until the runner reports done.
-    let guard = 0;
-    while (data && data.jobId && data.done !== true && guard++ < 600) {
-      await new Promise((r) => setTimeout(r, 1000));
-      const poll = await fetch(endpoint + (endpoint.includes("?") ? "&" : "?") + "jobId=" + encodeURIComponent(data.jobId));
-      if (!poll.ok) throw new Error("poll responded " + poll.status);
-      data = await poll.json();
-    }
-    if (typeof data.exitCode !== "number") throw new Error("runner did not report an exitCode");
-    process.stdout.write(JSON.stringify({ exitCode: data.exitCode, stdout: String(data.stdout || "") }));
-  } catch (e) {
-    process.stdout.write(JSON.stringify({ error: e && e.message ? e.message : String(e) }));
-  }
-})();
-`;
+// The remote/CI delegation child is a real, packaged Node script (not an embedded
+// `node -e` string — F11): it reads a JSON job on stdin, POSTs it to the endpoint,
+// optionally polls a returned jobId, and prints `{ exitCode, stdout }` (or
+// `{ error }`) on stdout. Node-only (global fetch, node >=18), so the driver stays
+// portable and synchronous from CW's view. We spawn it BY PATH (shell:false). The
+// path is resolved from this compiled module (dist/execution-backend.js) up to the
+// package's `scripts/children/` dir, which package.json ships in "files".
+const HTTP_DELEGATE_CHILD_SCRIPT = node_path_1.default.resolve(__dirname, "..", "scripts", "children", "http-delegate-child.js");
 /** remote / ci — real HTTP delegation. POSTs the job to the configured endpoint
  *  (and polls a returned jobId) via a Node child, then records the runner's exit +
  *  stdout digest as canonical evidence. Fails closed when the endpoint is missing,
@@ -628,7 +608,7 @@ function runHttpDelegation(descriptor, policy, request, label, handle, attestati
         sandboxProfileId: policy.id,
         jobId: handle.jobId
     });
-    const child = (0, node_child_process_1.spawnSync)(process.execPath, ["-e", HTTP_DELEGATE_CHILD], {
+    const child = (0, node_child_process_1.spawnSync)(process.execPath, [HTTP_DELEGATE_CHILD_SCRIPT], {
         input: job,
         env: { ...process.env, CW_DELEGATE_ENDPOINT: endpoint },
         encoding: "utf8",
@@ -752,7 +732,7 @@ function runAgentEndpoint(descriptor, policy, request, label, resolved, attestat
         resultPath: manifest?.resultPath,
         sandboxProfileId: policy.id
     });
-    const child = (0, node_child_process_1.spawnSync)(process.execPath, ["-e", HTTP_DELEGATE_CHILD], {
+    const child = (0, node_child_process_1.spawnSync)(process.execPath, [HTTP_DELEGATE_CHILD_SCRIPT], {
         input: job,
         env: { ...process.env, CW_DELEGATE_ENDPOINT: endpoint },
         encoding: "utf8",

package/dist/gates.js

@@ -0,0 +1,48 @@
+"use strict";
+// Shared, drift-proof gate primitives (F4). These two helpers were previously
+// duplicated "in sync by comment" in commit.ts and candidate-scoring.ts — the
+// no-false-green gate and the sandbox-profile lookup. A by-comment sync is a
+// structural drift hazard: nothing prevents one copy from changing without the
+// other, and the two gates MUST agree (selection + commit must reach the same
+// empty-capture verdict). Extracting ONE implementation each, imported by both
+// call sites, makes that drift impossible.
+//
+// Pure functions over PERSISTED state only — no clock, no randomness, no fs —
+// so both selection and commit replays reach the same gate decision. Keep them
+// fail-closed: when in doubt the caller must BLOCK, never silently pass.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emptyCaptureWarning = emptyCaptureWarning;
+exports.sandboxProfileForCandidate = sandboxProfileForCandidate;
+/** The HARD no-false-green gate (DIRECTION.md "ambiguity is a visible state").
+ *  A verifier node is built FROM a result node; when that result captured no
+ *  structured signal at all the result node carries a `metadata.captureWarning`
+ *  marker (set in worker-isolation / lifecycle ingest via isEmptyCapture). The
+ *  worker output is still ACCEPTED (a recorded warning, never a silent pass), but
+ *  a verifier-GATED commit — and candidate SELECTION — must NOT be able to
+ *  present that zero-evidence result as clean/green. We detect it here, reading
+ *  ONLY persisted state (the source result node's metadata) — purely functional,
+ *  no clock/ordering — so snapshot replay reaches the same gate decision.
+ *  Returns the marker string, or undefined.
+ *
+ *  Resolution trail: verifier node -> its input/parent result node. We look at
+ *  `inputs.inputNodeId` (set by runPipelineStage) first, then fall back to the
+ *  first parent, so it works regardless of which ingest path produced the node. */
+function emptyCaptureWarning(run, verifierNode) {
+    const resultNodeId = (typeof verifierNode.inputs?.inputNodeId === "string" ? verifierNode.inputs.inputNodeId : undefined) ||
+        verifierNode.parents[0];
+    const resultNode = resultNodeId ? (run.nodes || []).find((node) => node.id === resultNodeId) : undefined;
+    const warning = resultNode?.metadata?.captureWarning;
+    return typeof warning === "string" && warning ? warning : undefined;
+}
+/** Resolve the sandbox profile that backed a candidate's acceptance: the
+ *  worker's profile if the candidate has a worker, else the originating task's.
+ *  Read by both the commit gate's acceptance rationale and selection. Accepts an
+ *  optional candidate so the commit-side caller (which may not have resolved a
+ *  candidate) can share the same lookup. Pure over persisted run state. */
+function sandboxProfileForCandidate(run, candidate) {
+    const worker = candidate?.workerId ? (run.workers || []).find((entry) => entry.id === candidate.workerId) : undefined;
+    if (worker?.sandboxProfileId)
+        return worker.sandboxProfileId;
+    const task = candidate?.taskId ? (run.tasks || []).find((entry) => entry.id === candidate.taskId) : undefined;
+    return task?.sandboxProfileId;
+}

package/dist/multi-agent/helpers.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MULTI_AGENT_SCHEMA_VERSION = void 0;
+exports.createId = exports.MULTI_AGENT_SCHEMA_VERSION = void 0;
 exports.indexRow = indexRow;
 exports.assertNoRecordPathCollisions = assertNoRecordPathCollisions;
 exports.pluralKind = pluralKind;
@@ -9,7 +9,6 @@ exports.assertLifecycleTransition = assertLifecycleTransition;
 exports.lifecycleEvent = lifecycleEvent;
 exports.isMembershipReported = isMembershipReported;
 exports.touch = touch;
-exports.createId = createId;
 exports.compact = compact;
 exports.unique = unique;
 exports.countBy = countBy;
@@ -106,14 +105,11 @@ function touch(record) {
     record.updatedAt = new Date().toISOString();
     return record;
 }
-// Deterministic record id (FreeBSD-audit L12/L13): the record's POSITION in its
-// per-run collection, threaded from the call site. No wall-clock stamp, no PRNG
-// suffix — re-running the same multi-agent topology mints byte-identical ids, so
-// snapshot/replay digests match. Each call site already asserts the minted id is
-// unique within its collection, and these collections only ever append.
-function createId(prefix, seq) {
-    return `${prefix}-${String(seq).padStart(4, "0")}`;
-}
+// Deterministic record id — single source of truth in ./ids. Re-exported here so
+// multi-agent.ts importers stay byte-unchanged (F10 dedup: the coordinator layer
+// shares the exact same helper).
+var ids_1 = require("./ids");
+Object.defineProperty(exports, "createId", { enumerable: true, get: function () { return ids_1.createId; } });
 function compact(value) {
     if (!value)
         return undefined;

package/dist/multi-agent/ids.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createId = createId;
+// Single source of truth for the deterministic record id scheme shared by the
+// multi-agent kernel (multi-agent/helpers.ts) and the coordinator/blackboard
+// layer (coordinator/util.ts). Both previously copy-pasted byte-identical
+// zero-padded-seq logic; this dedup (F10) collapses them onto one helper.
+//
+// Deterministic record id (FreeBSD-audit L12/L13): the record's POSITION in its
+// per-run collection, threaded from the call site. No wall-clock stamp, no PRNG
+// suffix — re-running the same multi-agent topology / coordination mints
+// byte-identical ids, so snapshot/replay digests match. Each call site already
+// asserts the minted id is unique within its collection, and these collections
+// only ever append.
+//
+// REPLAY DETERMINISM: pure function of its arguments — no Date, no random.
+// The output MUST stay byte-identical: `${prefix}-${4-digit-zero-padded-seq}`.
+function createId(prefix, seq) {
+    return `${prefix}-${String(seq).padStart(4, "0")}`;
+}

package/dist/multi-agent-eval.js

@@ -124,6 +124,14 @@ function replayMultiAgentSnapshot(target, options = {}) {
     const replayDir = node_path_1.default.join(suiteDir, "replay");
     const replayRunPath = node_path_1.default.join(suiteDir, "replay-run.json");
     node_fs_1.default.mkdirSync(replayDir, { recursive: true });
+    // RE-DERIVE the projection from the raw captured state instead of copying
+    // snapshot.normalized. Copying the baseline would make compareMultiAgentReplay
+    // diff the baseline against a byte-copy of itself, so a projection-determinism
+    // regression in normalizeRun could never be caught (the determinism moat would
+    // be false-green). We reconstruct the run from the captured raw state and run
+    // the SAME normalizeRun pipeline used at capture time, producing an INDEPENDENT
+    // re-projection the comparison can pit against the baseline.
+    const replayed = rederiveNormalizedFromSnapshot(snapshot);
     const replay = {
         schemaVersion: 1,
         kind: "multi-agent-replay-run",
@@ -139,7 +147,7 @@ function replayMultiAgentSnapshot(target, options = {}) {
             replayRunPath,
             snapshotPath: snapshot.paths.snapshotPath
         },
-        replay: snapshot.normalized,
+        replay: replayed,
         errors: []
     };
     (0, state_1.writeJson)(replayRunPath, replay);
@@ -398,6 +406,24 @@ function loadScoreForTarget(target, scorePath) {
     }
     return scoreMultiAgentReplay(target);
 }
+// Re-derive snapshot.normalized INDEPENDENTLY at replay time. The raw captured
+// state is the baseline run state file (snapshot.paths.baselineStatePath) — the
+// same WorkflowRun captureRun/normalizeRun projected at capture time. We re-load
+// it and re-run the IDENTICAL normalizeRun pipeline, so the result is a genuine
+// re-projection rather than a copy of the baseline. Fail-closed: if the raw
+// state cannot be reconstructed we throw (never silently fall back to the
+// baseline copy — that is exactly the false-green this guards against).
+function rederiveNormalizedFromSnapshot(snapshot) {
+    const statePath = snapshot.paths.baselineStatePath;
+    if (!statePath || !node_fs_1.default.existsSync(statePath)) {
+        throw new Error(`Cannot re-derive replay projection: baseline run state missing at ${statePath || "<unset>"}; re-snapshot from a live run before replaying.`);
+    }
+    const result = (0, state_1.loadRunStateFile)(statePath, { dryRun: true });
+    if (result.report.status === "unsupported") {
+        throw new Error(`Cannot re-derive replay projection: baseline run state at ${statePath} is unsupported: ${result.report.errors.join("; ")}`);
+    }
+    return normalizeRun(result.run);
+}
 function captureRun(run) {
     return {
         topology: run.topologies || { schemaVersion: 1, runs: [] },

package/dist/multi-agent-host.js

@@ -384,22 +384,54 @@ function hostSelect(run, options = {}) {
     }
     return envelope(run, "select", { performed: "selected-candidate", data: selection });
 }
+function memoize(compute) {
+    let cached;
+    return (run) => (cached ??= { value: compute(run) }).value;
+}
+function createHostSummaryCache(run) {
+    const topologies = memoize(topology_1.summarizeTopologies);
+    const multiAgent = memoize(multi_agent_1.summarizeMultiAgent);
+    const blackboard = memoize(coordinator_1.summarizeBlackboard);
+    const workers = memoize(operator_ux_1.summarizeOperatorWorkers);
+    const candidates = memoize(operator_ux_1.summarizeOperatorCandidates);
+    const feedback = memoize(operator_ux_1.summarizeOperatorFeedback);
+    const commits = memoize(operator_ux_1.summarizeOperatorCommits);
+    const trust = memoize(trust_audit_1.summarizeTrustAudit);
+    const operator = memoize(operator_ux_1.summarizeOperatorRun);
+    const multiAgentOperator = memoize(multi_agent_operator_ux_1.summarizeMultiAgentOperator);
+    const active = memoize(activeTopologies);
+    return {
+        run,
+        topologies: () => topologies(run),
+        multiAgent: () => multiAgent(run),
+        blackboard: () => blackboard(run),
+        workers: () => workers(run),
+        candidates: () => candidates(run),
+        feedback: () => feedback(run),
+        commits: () => commits(run),
+        trust: () => trust(run),
+        operator: () => operator(run),
+        multiAgentOperator: () => multiAgentOperator(run),
+        active: () => active(run)
+    };
+}
 function envelope(run, command, options = {}) {
-    const topologies = (0, topology_1.summarizeTopologies)(run);
-    const multiAgent = (0, multi_agent_1.summarizeMultiAgent)(run);
-    const blackboard = (0, coordinator_1.summarizeBlackboard)(run);
-    const workers = (0, operator_ux_1.summarizeOperatorWorkers)(run);
-    const candidates = (0, operator_ux_1.summarizeOperatorCandidates)(run);
-    const feedback = (0, operator_ux_1.summarizeOperatorFeedback)(run);
-    const commits = (0, operator_ux_1.summarizeOperatorCommits)(run);
-    const trust = (0, trust_audit_1.summarizeTrustAudit)(run);
-    const operator = (0, operator_ux_1.summarizeOperatorRun)(run);
-    const multiAgentOperator = (0, multi_agent_operator_ux_1.summarizeMultiAgentOperator)(run);
-    const active = activeTopologies(run);
+    const cache = createHostSummaryCache(run);
+    const topologies = cache.topologies();
+    const multiAgent = cache.multiAgent();
+    const blackboard = cache.blackboard();
+    const workers = cache.workers();
+    const candidates = cache.candidates();
+    const feedback = cache.feedback();
+    const commits = cache.commits();
+    const trust = cache.trust();
+    const operator = cache.operator();
+    const multiAgentOperator = cache.multiAgentOperator();
+    const active = cache.active();
     const blockedReasons = unique([...operator.blockedReasons, ...(options.extraBlockedReasons || [])]);
-    const state = blockedReasons.length ? "blocked" : classifyHostState(run);
+    const state = blockedReasons.length ? "blocked" : classifyHostState(run, cache);
     const ids = activeIds(run, active);
-    const nextActions = hostNextActions(run, state, active, options.requiredHostAction);
+    const nextActions = hostNextActions(run, state, active, options.requiredHostAction, cache);
     return {
         schemaVersion: 1,
         surface: "multi-agent-host",
@@ -427,12 +459,12 @@ function envelope(run, command, options = {}) {
         data: options.data
     };
 }
-function classifyHostState(run) {
-    const active = activeTopologies(run);
-    const feedback = (0, operator_ux_1.summarizeOperatorFeedback)(run);
-    const workers = (0, operator_ux_1.summarizeOperatorWorkers)(run);
-    const candidates = (0, operator_ux_1.summarizeOperatorCandidates)(run);
-    const commits = (0, operator_ux_1.summarizeOperatorCommits)(run);
+function classifyHostState(run, cache = createHostSummaryCache(run)) {
+    const active = cache.active();
+    const feedback = cache.feedback();
+    const workers = cache.workers();
+    const candidates = cache.candidates();
+    const commits = cache.commits();
     if (!active.length && !(run.multiAgent?.runs || []).length)
         return "needs-run";
     if (feedback.open.some((entry) => !entry.retryable))
@@ -475,7 +507,7 @@ function activeIds(run, active) {
         auditEventIds: unique(active.flatMap((entry) => entry.links.auditEventIds))
     };
 }
-function hostNextActions(run, state, active, requiredHostAction) {
+function hostNextActions(run, state, active, requiredHostAction, cache = createHostSummaryCache(run)) {
     if (requiredHostAction)
         return [{ command: "host-action", reason: requiredHostAction, priority: "high" }];
     const runId = run.id;
@@ -493,7 +525,7 @@ function hostNextActions(run, state, active, requiredHostAction) {
         case "ready-for-selection":
             return [{ command: `node scripts/cw.js multi-agent select ${runId} --candidate <candidate-id> --reason "<rationale>"`, reason: "Select a scored candidate after verifier gates pass.", priority: "high" }];
         case "ready-for-commit": {
-            const ready = (0, operator_ux_1.summarizeOperatorCandidates)(run).readyForCommit[0];
+            const ready = cache.candidates().readyForCommit[0];
             return [{ command: `node scripts/cw.js commit ${runId} --selection ${ready.selectionId} --reason "<verified rationale>"`, reason: "Create a verifier-gated CW state commit.", priority: "high" }];
         }
         case "complete":

package/dist/multi-agent-operator-ux.js

@@ -15,6 +15,7 @@ const coordinator_1 = require("./coordinator");
 const multi_agent_1 = require("./multi-agent");
 const topology_1 = require("./topology");
 const trust_audit_1 = require("./trust-audit");
+const validation_1 = require("./validation");
 function summarizeMultiAgentOperator(run) {
     const topologies = (0, topology_1.summarizeTopologies)(run);
     const multiAgent = (0, multi_agent_1.summarizeMultiAgent)(run);
@@ -447,7 +448,7 @@ function readScores(run, candidateId) {
         .readdirSync(dir)
         .filter((file) => file.endsWith(".json"))
         .sort()
-        .map((file) => JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(dir, file), "utf8")));
+        .map((file) => (0, validation_1.validateCandidateScore)(JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(dir, file), "utf8"))));
 }
 function scorePath(run, candidateId, scoreId) {
     const file = node_path_1.default.join(run.paths.candidatesDir || node_path_1.default.join(run.paths.runDir, "candidates"), safeFileName(candidateId), "scores", `${safeFileName(scoreId)}.json`);

package/dist/multi-agent-trust.js

@@ -1,7 +1,4 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.policyForRole = policyForRole;
 exports.policyForGroup = policyForGroup;
@@ -16,7 +13,7 @@ exports.summarizeMultiAgentTrust = summarizeMultiAgentTrust;
 exports.hasAcceptedJudgeRationale = hasAcceptedJudgeRationale;
 exports.sourceForActor = sourceForActor;
 exports.hashText = hashText;
-const node_crypto_1 = __importDefault(require("node:crypto"));
+const execution_backend_1 = require("./execution-backend");
 const trust_audit_1 = require("./trust-audit");
 function policyForRole(role) {
     const topologyRole = String(role.metadata?.topologyRoleId || role.title || "").toLowerCase();
@@ -294,8 +291,11 @@ function sourceForActor(actor) {
         return "runtime-derived";
     return "cw-validated";
 }
+// Delegates to the shared execution-backend sha256 (F10 dedup). Byte-identical:
+// both emit `sha256:<hex>` and Node's Hash.update(string) defaults to utf8, the
+// same encoding the shared helper passes explicitly.
 function hashText(value) {
-    return `sha256:${node_crypto_1.default.createHash("sha256").update(value).digest("hex")}`;
+    return (0, execution_backend_1.sha256)(value);
 }
 function resolvePolicy(run, input) {
     const membership = input.membershipId ? run.multiAgent?.memberships.find((entry) => entry.id === input.membershipId) : undefined;

package/dist/node-projection.js

@@ -0,0 +1,59 @@
+"use strict";
+// Canonical StateNode projection (F9 de-triplication) — the SINGLE source of
+// truth for which StateNode fields make up the derived, fingerprinted body.
+//
+// Previously this 13-field set was hand-copied in three places: node-snapshot.ts's
+// snapshotBody, reclamation.ts's snapshotProjectionDigest, and reclamation.ts's
+// rawNodeBody/nodeBodyDigest (whose comment literally said "Mirror
+// node-snapshot.ts"). Any field added in one place but not the others would drift
+// the projection — and because reclamation hashes are tombstone-chained, a drift
+// would silently break the chain. This module collapses the list to ONE export so
+// the field set can only change in one place.
+//
+// BYTE-IDENTITY [load-bearing]: the projection / digest OUTPUT here is identical to
+// the prior in-line implementations. `normalizeValue` sorts object keys, so the
+// literal field ORDER never affected the bytes — only the field SET ever mattered.
+// `replayStableStringify(value) === JSON.stringify(normalizeValue(value))` and
+// `normalizeValue` is idempotent, so the projected-body digest and the raw-body
+// digest funnel through the same canonical bytes (node-snapshot-diff-replay +
+// reclamation smokes verify this).
+//
+// Pure: no I/O, no wall-clock, no random — safe in core/state/replay logic.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rawNodeProjection = rawNodeProjection;
+exports.projectNodeBody = projectNodeBody;
+exports.nodeProjectionDigestInput = nodeProjectionDigestInput;
+const multi_agent_eval_1 = require("./multi-agent-eval");
+/** The raw (un-normalized) projection input: the canonical field set, copied off
+ *  the StateNode with no scrubbing. `normalizeValue`/`replayStableStringify` apply
+ *  the timestamp/path scrubbing downstream. This is the ONE place the field list
+ *  lives — add or drop a projected field here and every consumer follows. */
+function rawNodeProjection(node) {
+    return {
+        id: node.id,
+        kind: node.kind,
+        status: node.status,
+        loopStage: node.loopStage,
+        inputs: node.inputs,
+        outputs: node.outputs,
+        artifacts: node.artifacts,
+        evidence: node.evidence,
+        errors: node.errors,
+        parents: node.parents,
+        children: node.children,
+        contractId: node.contractId,
+        metadata: node.metadata
+    };
+}
+/** The normalized, derived projected body of one StateNode — timestamps/paths
+ *  stripped via the eval normalizer, so it is byte-stable across captures of the
+ *  same logical state. This is exactly node-snapshot.ts's historical snapshotBody. */
+function projectNodeBody(node) {
+    return (0, multi_agent_eval_1.normalizeValue)(rawNodeProjection(node));
+}
+/** Stable digest input for the projected body: the canonical bytes that the
+ *  snapshot/reconstruction digests bind. `replayStableStringify` re-normalizes, so
+ *  feeding the raw projection or the already-normalized body yields identical bytes. */
+function nodeProjectionDigestInput(node) {
+    return (0, multi_agent_eval_1.replayStableStringify)(rawNodeProjection(node));
+}

package/dist/node-snapshot.js

@@ -37,7 +37,9 @@ const node_path_1 = __importDefault(require("node:path"));
 const pipeline_runner_1 = require("./pipeline-runner");
 const state_1 = require("./state");
 const multi_agent_eval_1 = require("./multi-agent-eval");
+const node_projection_1 = require("./node-projection");
 const state_explosion_1 = require("./state-explosion");
+const validation_1 = require("./validation");
 exports.NODE_SNAPSHOT_SCHEMA_VERSION = 1;
 /** Structured fail-closed error (mirrors the PipelineContractError shape). */
 class NodeSnapshotError extends Error {
@@ -64,23 +66,11 @@ const SNAPSHOT_SECTIONS = [
     "metadata"
 ];
 /** The normalized projection of a node — timestamps/paths stripped by the eval
- *  normalizer, so it is byte-stable across captures of the same logical state. */
+ *  normalizer, so it is byte-stable across captures of the same logical state. The
+ *  canonical field set lives in node-projection.ts (shared with reclamation.ts so
+ *  the projection can never drift across the two). */
 function snapshotBody(node) {
-    return (0, multi_agent_eval_1.normalizeValue)({
-        id: node.id,
-        kind: node.kind,
-        status: node.status,
-        loopStage: node.loopStage,
-        inputs: node.inputs,
-        outputs: node.outputs,
-        artifacts: node.artifacts,
-        evidence: node.evidence,
-        errors: node.errors,
-        parents: node.parents,
-        children: node.children,
-        contractId: node.contractId,
-        metadata: node.metadata
-    });
+    return (0, node_projection_1.projectNodeBody)(node);
 }
 /** RAW fingerprint (NOT normalized): any transition (updatedAt/status) or
  *  artifact/evidence change flips it, which is how drift is detected. */
@@ -113,7 +103,7 @@ function readNodeSnapshot(run, snapshotId) {
         for (const nodeDir of node_fs_1.default.readdirSync(root)) {
             const file = node_path_1.default.join(root, nodeDir, `${snapshotId}.json`);
             if (node_fs_1.default.existsSync(file))
-                return JSON.parse(node_fs_1.default.readFileSync(file, "utf8"));
+                return (0, validation_1.validateNodeSnapshot)(JSON.parse(node_fs_1.default.readFileSync(file, "utf8")));
         }
     }
     throw new NodeSnapshotError("snapshot-not-found", `Node snapshot ${snapshotId} not found in run ${run.id}`, { freshness: "absent" });
@@ -125,7 +115,7 @@ function readNodeReplay(run, replayId) {
         for (const nodeDir of node_fs_1.default.readdirSync(root)) {
             const file = node_path_1.default.join(root, nodeDir, "replays", `${replayId}.json`);
             if (node_fs_1.default.existsSync(file))
-                return JSON.parse(node_fs_1.default.readFileSync(file, "utf8"));
+                return (0, validation_1.validateNodeReplayRun)(JSON.parse(node_fs_1.default.readFileSync(file, "utf8")));
         }
     }
     throw new NodeSnapshotError("replay-not-found", `Node replay ${replayId} not found in run ${run.id}`, { freshness: "absent" });

package/dist/orchestrator/lifecycle-operations.js

@@ -17,6 +17,7 @@ exports.commit = commit;
 // plan() receives an already-resolved workflow app record (the runner still owns
 // app loading, which is instance-stateful). Behavior is identical to the inline
 // implementations; only the location changed.
+const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const state_1 = require("../state");
@@ -456,8 +457,28 @@ function renderPrompt(prompt, inputs) {
     }
     return rendered;
 }
+// Deterministic run id (replay-determinism self-audit): the wall-clock stamp is an
+// edge timestamp (recorded once and stripped on replay), but the former
+// Math.random() suffix made the run id itself non-reproducible — re-deriving the id
+// for the SAME recorded run would never match. The suffix is now a content hash of
+// the run's deterministic identity (workflowId + the recorded stamp), so the id is a
+// pure function of inputs that already live in state. Distinct plan() invocations
+// still get distinct ids because the per-millisecond stamp differs; replaying a
+// recorded run reproduces the byte-identical id. Mirrors the de-clock done for
+// worker ids in src/worker-isolation/paths.ts.
+let runIdSequence = 0;
 function createRunId(workflowId) {
     const stamp = new Date().toISOString().replace(/[-:]/g, "").replace(/\..+/, "Z");
-    const suffix = Math.random().toString(36).slice(2, 8);
+    // The stamp is second-resolution, so several runs of the same workflowId minted
+    // within one second would otherwise hash to the SAME id. process.pid + a monotonic
+    // counter break the tie across BOTH same-process (counter) and concurrent-process
+    // (pid) minting — deterministic-by-environment, not a PRNG, so it keeps the
+    // replay-determinism intent; the id is an edge stamp stripped on replay anyway.
+    runIdSequence += 1;
+    const suffix = node_crypto_1.default
+        .createHash("sha256")
+        .update(`${workflowId}:${stamp}:${process.pid}:${runIdSequence}`)
+        .digest("hex")
+        .slice(0, 6);
     return `${workflowId}-${stamp}-${suffix}`;
 }

package/dist/orchestrator.js

@@ -90,10 +90,24 @@ class CoolWorkflowRunner {
     pluginRoot;
     workflowsDir;
     appsDir;
-    constructor({ pluginRoot }) {
+    // F7: the directory a run is resolved against (replaces the former process.chdir
+    // bracket in capability-core). undefined => fall back to process.cwd(). The runner
+    // reads runs from disk per call (no in-memory run state), so withBaseDir hands back
+    // a cheap scoped clone instead of mutating the global process cwd.
+    baseDir;
+    constructor({ pluginRoot, baseDir }) {
         this.pluginRoot = resolvePluginRoot(pluginRoot);
         this.workflowsDir = node_path_1.default.join(this.pluginRoot, "workflows");
         this.appsDir = node_path_1.default.join(this.pluginRoot, "apps");
+        this.baseDir = baseDir ? node_path_1.default.resolve(baseDir) : undefined;
+    }
+    /** Return a runner that resolves runs against `dir` instead of process.cwd(),
+     *  WITHOUT chdir-ing the process (F7). Same instance when the dir is unchanged. */
+    withBaseDir(dir) {
+        const resolved = dir ? node_path_1.default.resolve(dir) : undefined;
+        if (resolved === this.baseDir)
+            return this;
+        return new CoolWorkflowRunner({ pluginRoot: this.pluginRoot, baseDir: resolved });
     }
     listWorkflows() {
         return this.loadWorkflowApps().map((record) => {
@@ -700,7 +714,7 @@ class CoolWorkflowRunner {
         return feedbackOps.resolveFeedback(this.loadRun(runId), feedbackId, options);
     }
     loadRun(runId) {
-        return (0, state_1.loadRunFromCwd)(runId);
+        return (0, state_1.loadRunFromCwd)(runId, this.baseDir);
     }
     loadWorkflowAppById(appId) {
         const record = this.loadWorkflowApps().find((candidate) => candidate.app.id === appId);

package/dist/reclamation.js

@@ -53,6 +53,7 @@ const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const multi_agent_eval_1 = require("./multi-agent-eval");
+const node_projection_1 = require("./node-projection");
 const node_snapshot_1 = require("./node-snapshot");
 const state_1 = require("./state");
 const trust_audit_1 = require("./trust-audit");
@@ -397,46 +398,17 @@ function buildReferenceGraph(run) {
         add(message.id);
     return refs;
 }
+/** expectDigest of a node's deterministic projection. Re-uses the SHARED
+ *  node-projection field set (node-projection.ts) so reconstruction matches
+ *  node-snapshot.ts's body byte-for-byte — the projection can no longer drift. */
 function snapshotProjectionDigest(node) {
-    // Mirror node-snapshot.ts's deterministic projection so reconstruction matches.
-    const body = (0, multi_agent_eval_1.normalizeValue)({
-        id: node.id,
-        kind: node.kind,
-        status: node.status,
-        loopStage: node.loopStage,
-        inputs: node.inputs,
-        outputs: node.outputs,
-        artifacts: node.artifacts,
-        evidence: node.evidence,
-        errors: node.errors,
-        parents: node.parents,
-        children: node.children,
-        contractId: node.contractId,
-        metadata: node.metadata
-    });
-    return sha256OfString((0, multi_agent_eval_1.replayStableStringify)(body));
+    return sha256OfString((0, node_projection_1.nodeProjectionDigestInput)(node));
 }
 /** Body digest of the RETAINED node (lives in state.json). The reconstruction
- *  verifier re-derives the projection from this retained input. */
+ *  verifier re-derives the projection from this retained input. Same shared field
+ *  set / canonical bytes as snapshotProjectionDigest. */
 function nodeBodyDigest(node) {
-    return sha256OfString((0, multi_agent_eval_1.replayStableStringify)(rawNodeBody(node)));
-}
-function rawNodeBody(node) {
-    return {
-        id: node.id,
-        kind: node.kind,
-        status: node.status,
-        loopStage: node.loopStage,
-        inputs: node.inputs,
-        outputs: node.outputs,
-        artifacts: node.artifacts,
-        evidence: node.evidence,
-        errors: node.errors,
-        parents: node.parents,
-        children: node.children,
-        contractId: node.contractId,
-        metadata: node.metadata
-    };
+    return sha256OfString((0, node_projection_1.nodeProjectionDigestInput)(node));
 }
 /** Build the retention plan: which paths are freeable under `policy`, of what
  *  kind, how many bytes, and the resulting capability downgrade. */