cool-workflow 0.1.81 → 0.1.83

package/dist/doctor.js

@@ -0,0 +1,153 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDoctor = runDoctor;
+exports.formatDoctorReport = formatDoctorReport;
+// `cw doctor` — environment diagnostics, in the spirit of `brew doctor`.
+//
+// Homebrew's `doctor` turned "something is subtly wrong with your setup" into a
+// proactive, named list of problems each paired with a concrete fix. We borrow
+// that idea: instead of letting a missing agent / old Node / unwritable state
+// surface as a confusing mid-run failure, `cw doctor` probes the host up front
+// and prints WHAT is wrong and WHAT TO DO about it.
+//
+// Discipline:
+//  - READ-ONLY. Probes versions, $PATH, and the WRITABILITY of the nearest
+//    existing ancestor dir (via access(2)) — it never creates `.cw/` or $CW_HOME
+//    as a side effect, so running `doctor` changes nothing on disk.
+//  - FAIL CLOSED. Any `fail` check ⇒ `ok:false` ⇒ the CLI exits non-zero. A
+//    `warn` (e.g. no agent yet — demo/preview still work) does not fail.
+//  - TWO RENDERINGS. Human text by default; a stable `--json` payload for scripts.
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_child_process_1 = require("node:child_process");
+const agent_config_1 = require("./agent-config");
+/** Resolve a bare binary name against $PATH (or accept an explicit path). Returns
+ *  the resolved path, or undefined when not found. No spawning. */
+function whichBinary(bin, env) {
+    if (bin.includes("/") || bin.includes("\\")) {
+        try {
+            return node_fs_1.default.statSync(bin).isFile() ? bin : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    const dirs = (env.PATH || "").split(node_path_1.default.delimiter).filter(Boolean);
+    const exts = process.platform === "win32" ? (env.PATHEXT || ".EXE;.CMD;.BAT").split(";") : [""];
+    for (const dir of dirs) {
+        for (const ext of exts) {
+            const candidate = node_path_1.default.join(dir, bin + ext);
+            try {
+                if (node_fs_1.default.statSync(candidate).isFile())
+                    return candidate;
+            }
+            catch { /* keep looking */ }
+        }
+    }
+    return undefined;
+}
+/** True when `target` could be created/written: walk up to the nearest EXISTING
+ *  ancestor and require it to be a writable DIRECTORY. (A file in the path is not
+ *  writable-as-a-dir even though access(2) W_OK on the file itself would pass.)
+ *  Does NOT create anything — a diagnostic must not have side effects. */
+function dirWritable(target) {
+    let dir = node_path_1.default.resolve(target);
+    for (;;) {
+        let stat;
+        try {
+            stat = node_fs_1.default.statSync(dir);
+        }
+        catch {
+            const parent = node_path_1.default.dirname(dir);
+            if (parent === dir)
+                return false;
+            dir = parent;
+            continue;
+        }
+        if (!stat.isDirectory())
+            return false; // an existing file blocks mkdir beneath it
+        try {
+            node_fs_1.default.accessSync(dir, node_fs_1.default.constants.W_OK);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+function runDoctor(args = {}, env = process.env, cwd = process.cwd()) {
+    const checks = [];
+    // 1. Node runtime — the one hard prerequisite (README: v18+).
+    const major = Number((process.version.match(/^v(\d+)/) || [])[1]);
+    checks.push(Number.isFinite(major) && major >= 18
+        ? { name: "node", status: "ok", detail: `Node ${process.version} (>= 18).` }
+        : { name: "node", status: "fail", detail: `Node ${process.version} is below the required v18.`, fix: "Install Node.js 18+ (e.g. `brew install node`, or https://nodejs.org)." });
+    // 2. Agent backend — CW delegates execution; without one, real runs park.
+    const cfg = (0, agent_config_1.resolveAgentConfig)(args, env);
+    if (cfg.source === "none") {
+        checks.push({
+            name: "agent",
+            status: "warn",
+            detail: "No agent backend configured — `demo` and `--preview` work, but a real run reports status: blocked.",
+            fix: 'Pass --agent-command "claude -p", set $CW_AGENT_COMMAND, or use --agent-command builtin:claude.'
+        });
+    }
+    else {
+        const binToken = cfg.command ? String(cfg.command).split(/\s+/)[0] : undefined;
+        checks.push({
+            name: "agent",
+            status: "ok",
+            detail: `Agent configured from ${cfg.source}${binToken ? `: ${binToken}` : cfg.endpoint ? " (HTTP endpoint)" : ""}.`
+        });
+        // 2b. If it is a command agent, is the binary actually on PATH?
+        if (binToken) {
+            const resolved = whichBinary(binToken, env);
+            checks.push(resolved
+                ? { name: "agent-binary", status: "ok", detail: `Agent binary "${binToken}" found at ${resolved}.` }
+                : { name: "agent-binary", status: "warn", detail: `Configured agent binary "${binToken}" is not on $PATH.`, fix: `Install "${binToken}", or correct --agent-command / $CW_AGENT_COMMAND.` });
+        }
+    }
+    // 3. git — only needed for commit provenance (git HEAD); a warn, not a hard fail.
+    const git = (0, node_child_process_1.spawnSync)("git", ["--version"], { encoding: "utf8", timeout: 5000 });
+    checks.push(!git.error && git.status === 0
+        ? { name: "git", status: "ok", detail: (String(git.stdout || "git").trim()) + "." }
+        : { name: "git", status: "warn", detail: "git is not available — commit provenance (git HEAD) is recorded as absent.", fix: "Install git (e.g. `brew install git`) if you want commit provenance." });
+    // 4. Home registry — the cross-repo run index lives here; must be writable.
+    const home = env.CW_HOME && String(env.CW_HOME).trim()
+        ? node_path_1.default.resolve(String(env.CW_HOME))
+        : node_path_1.default.join(node_os_1.default.homedir(), ".local", "state", "cool-workflow");
+    checks.push(dirWritable(home)
+        ? { name: "home-registry", status: "ok", detail: `Home registry location is writable (${home}).` }
+        : { name: "home-registry", status: "fail", detail: `Home registry location is not writable: ${home}`, fix: "Set $CW_HOME to a writable directory, or fix the permissions." });
+    // 5. Working-dir state — per-repo runs land under <cwd>/.cw.
+    const cwState = node_path_1.default.join(node_path_1.default.resolve(cwd), ".cw");
+    checks.push(dirWritable(cwState)
+        ? { name: "repo-state", status: "ok", detail: `Run state location is writable (${cwState}).` }
+        : { name: "repo-state", status: "warn", detail: `Cannot write run state under ${cwState}.`, fix: "Run from a writable working directory, or pass --cwd PATH." });
+    const fails = checks.filter((c) => c.status === "fail").length;
+    const warns = checks.filter((c) => c.status === "warn").length;
+    const ok = fails === 0;
+    const summary = ok
+        ? warns === 0
+            ? "ready — all checks passed"
+            : `ready, with ${warns} warning${warns === 1 ? "" : "s"}`
+        : `${fails} blocking problem${fails === 1 ? "" : "s"} found`;
+    return { schemaVersion: 1, ok, checks, summary };
+}
+/** Human rendering (TTY/default). `--json` callers use the report object directly. */
+function formatDoctorReport(report) {
+    const glyph = { ok: "✓", warn: "!", fail: "✗" };
+    const lines = ["cw doctor"];
+    for (const check of report.checks) {
+        lines.push(`  ${glyph[check.status]} ${check.name}: ${check.detail}`);
+        if (check.fix && check.status !== "ok")
+            lines.push(`      fix: ${check.fix}`);
+    }
+    lines.push("");
+    lines.push(`${report.ok ? "✓" : "✗"} ${report.summary}`);
+    return lines.join("\n");
+}

package/dist/evidence-reasoning.js

@@ -19,6 +19,7 @@ const state_1 = require("./state");
 const multi_agent_operator_ux_1 = require("./multi-agent-operator-ux");
 const trust_audit_1 = require("./trust-audit");
 const multi_agent_trust_1 = require("./multi-agent-trust");
+const validation_1 = require("./validation");
 // ---------------------------------------------------------------------------
 // Evidence Adoption Reasoning Chain (v0.1.26)
 //
@@ -616,7 +617,9 @@ function readAllScores(run) {
             continue;
         for (const file of node_fs_1.default.readdirSync(dir).filter((entry) => entry.endsWith(".json")).sort()) {
             try {
-                const score = JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(dir, file), "utf8"));
+                const score = (0, validation_1.tryValidateCandidateScore)(JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(dir, file), "utf8")));
+                if (!score)
+                    continue; // Malformed/forged score shape: skip; the score gate fails closed.
                 scores.set(score.id, score);
             }
             catch {

package/dist/execution-backend/agent.js

@@ -255,53 +255,16 @@ function prepareAgentSpawn(request) {
         timeoutMs: resolved.timeoutMs || 600000
     };
 }
-// Reads jobs JSON on stdin, spawns ALL concurrently (shell:false, inherited env —
-// the agent's own credentials resolve; CW never reads them), per-job SIGTERM at
-// timeoutMs + SIGKILL at +5s, caps each captured stdout at 32MB, and prints the
-// outcome array when every job has settled. stderr is drained (a full pipe must
-// never wedge a child). A kill yields exitCode null — the no-exit-code refusal.
-const BATCH_DELEGATE_CHILD = `
-const { spawn } = require("node:child_process");
-let raw = "";
-process.stdin.setEncoding("utf8");
-process.stdin.on("data", (d) => (raw += d));
-process.stdin.on("end", () => {
-  const jobs = JSON.parse(raw);
-  if (!jobs.length) { process.stdout.write("[]"); return; }
-  const out = new Array(jobs.length);
-  let pending = jobs.length;
-  const CAP = 32 * 1024 * 1024;
-  jobs.forEach((job, i) => {
-    let stdout = "";
-    let settled = false;
-    const settle = (o) => {
-      if (settled) return;
-      settled = true;
-      out[i] = o;
-      if (--pending === 0) process.stdout.write(JSON.stringify(out));
-    };
-    let child;
-    try {
-      child = spawn(job.binary, job.args, { cwd: job.cwd, env: process.env, shell: false });
-    } catch (error) {
-      settle({ spawnError: String((error && error.message) || error), exitCode: null, stdout: "" });
-      return;
-    }
-    const term = setTimeout(() => { try { child.kill("SIGTERM"); } catch {} }, job.timeoutMs);
-    const kill = setTimeout(() => { try { child.kill("SIGKILL"); } catch {} }, job.timeoutMs + 5000);
-    child.stdout.on("data", (d) => { if (stdout.length < CAP) stdout += d; });
-    child.stderr.on("data", () => {});
-    child.on("error", (error) => {
-      clearTimeout(term); clearTimeout(kill);
-      settle({ spawnError: String((error && error.message) || error), exitCode: null, stdout });
-    });
-    child.on("close", (code) => {
-      clearTimeout(term); clearTimeout(kill);
-      settle({ exitCode: typeof code === "number" ? code : null, stdout });
-    });
-  });
-});
-`;
+// The batch delegate child is a real, packaged Node script (not an embedded
+// `node -e` string — F11). It reads jobs JSON on stdin, spawns ALL concurrently
+// (shell:false, inherited env — the agent's own credentials resolve; CW never
+// reads them), per-job SIGTERM at timeoutMs + SIGKILL at +5s, caps each captured
+// stdout at 32MB, and prints the outcome array when every job has settled. stderr
+// is drained (a full pipe must never wedge a child). A kill yields exitCode null —
+// the no-exit-code refusal. We spawn it BY PATH (shell:false); the path is
+// resolved from this compiled module (dist/execution-backend/agent.js) up to the
+// package's `scripts/children/` dir, which package.json ships in "files".
+const BATCH_DELEGATE_CHILD_SCRIPT = node_path_1.default.resolve(__dirname, "..", "..", "scripts", "children", "batch-delegate-child.js");
 /** Run a batch of agent spawns concurrently; outcomes index-align with jobs. The
  *  parent backstop timeout (max job timeout + 30s) means even a wedged delegate
  *  child cannot deadlock the drive: on any batch-level failure EVERY job settles
@@ -310,7 +273,7 @@ function runAgentBatchOutcomes(jobs) {
     if (!jobs.length)
         return [];
     const maxTimeout = Math.max(...jobs.map((job) => job.timeoutMs));
-    const child = (0, node_child_process_1.spawnSync)(process.execPath, ["-e", BATCH_DELEGATE_CHILD], {
+    const child = (0, node_child_process_1.spawnSync)(process.execPath, [BATCH_DELEGATE_CHILD_SCRIPT], {
         input: JSON.stringify(jobs),
         encoding: "utf8",
         maxBuffer: 33 * 1024 * 1024 * jobs.length,

package/dist/execution-backend.js

@@ -47,6 +47,7 @@ exports.backendProbePayload = backendProbePayload;
 exports.buildChildEnv = buildChildEnv;
 exports.clearProbeCache = clearProbeCache;
 const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
 const node_child_process_1 = require("node:child_process");
 // Pure leaf helpers — carved into ./execution-backend/util.ts (god-module carve).
 // `sha256` is re-exported below to keep the public surface byte-identical.
@@ -578,35 +579,14 @@ function runContainer(descriptor, policy, request, label, handle, attestation) {
     }
     return delegatedEnvelope(descriptor, label, handle, attestation, command, args, exitCode, String(result.stdout || ""));
 }
-// A self-contained Node child that performs the remote/CI delegation: it reads a
-// JSON job on stdin, POSTs it to the endpoint, optionally polls a returned jobId,
-// and prints `{ exitCode, stdout }` (or `{ error }`) on stdout. Node-only (global
-// fetch, node >=18), so the driver stays portable and synchronous from CW's view.
-const HTTP_DELEGATE_CHILD = `
-(async () => {
-  const read = () => new Promise((res) => { let b = ""; process.stdin.on("data", (c) => (b += c)); process.stdin.on("end", () => res(b)); });
-  try {
-    const job = JSON.parse((await read()) || "{}");
-    const endpoint = process.env.CW_DELEGATE_ENDPOINT;
-    if (!endpoint) throw new Error("no endpoint");
-    const post = await fetch(endpoint, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(job) });
-    if (!post.ok) throw new Error("runner responded " + post.status);
-    let data = await post.json();
-    // Poll a returned jobId until the runner reports done.
-    let guard = 0;
-    while (data && data.jobId && data.done !== true && guard++ < 600) {
-      await new Promise((r) => setTimeout(r, 1000));
-      const poll = await fetch(endpoint + (endpoint.includes("?") ? "&" : "?") + "jobId=" + encodeURIComponent(data.jobId));
-      if (!poll.ok) throw new Error("poll responded " + poll.status);
-      data = await poll.json();
-    }
-    if (typeof data.exitCode !== "number") throw new Error("runner did not report an exitCode");
-    process.stdout.write(JSON.stringify({ exitCode: data.exitCode, stdout: String(data.stdout || "") }));
-  } catch (e) {
-    process.stdout.write(JSON.stringify({ error: e && e.message ? e.message : String(e) }));
-  }
-})();
-`;
+// The remote/CI delegation child is a real, packaged Node script (not an embedded
+// `node -e` string — F11): it reads a JSON job on stdin, POSTs it to the endpoint,
+// optionally polls a returned jobId, and prints `{ exitCode, stdout }` (or
+// `{ error }`) on stdout. Node-only (global fetch, node >=18), so the driver stays
+// portable and synchronous from CW's view. We spawn it BY PATH (shell:false). The
+// path is resolved from this compiled module (dist/execution-backend.js) up to the
+// package's `scripts/children/` dir, which package.json ships in "files".
+const HTTP_DELEGATE_CHILD_SCRIPT = node_path_1.default.resolve(__dirname, "..", "scripts", "children", "http-delegate-child.js");
 /** remote / ci — real HTTP delegation. POSTs the job to the configured endpoint
  *  (and polls a returned jobId) via a Node child, then records the runner's exit +
  *  stdout digest as canonical evidence. Fails closed when the endpoint is missing,
@@ -628,7 +608,7 @@ function runHttpDelegation(descriptor, policy, request, label, handle, attestati
         sandboxProfileId: policy.id,
         jobId: handle.jobId
     });
-    const child = (0, node_child_process_1.spawnSync)(process.execPath, ["-e", HTTP_DELEGATE_CHILD], {
+    const child = (0, node_child_process_1.spawnSync)(process.execPath, [HTTP_DELEGATE_CHILD_SCRIPT], {
         input: job,
         env: { ...process.env, CW_DELEGATE_ENDPOINT: endpoint },
         encoding: "utf8",
@@ -752,7 +732,7 @@ function runAgentEndpoint(descriptor, policy, request, label, resolved, attestat
         resultPath: manifest?.resultPath,
         sandboxProfileId: policy.id
     });
-    const child = (0, node_child_process_1.spawnSync)(process.execPath, ["-e", HTTP_DELEGATE_CHILD], {
+    const child = (0, node_child_process_1.spawnSync)(process.execPath, [HTTP_DELEGATE_CHILD_SCRIPT], {
         input: job,
         env: { ...process.env, CW_DELEGATE_ENDPOINT: endpoint },
         encoding: "utf8",

package/dist/gates.js

@@ -0,0 +1,48 @@
+"use strict";
+// Shared, drift-proof gate primitives (F4). These two helpers were previously
+// duplicated "in sync by comment" in commit.ts and candidate-scoring.ts — the
+// no-false-green gate and the sandbox-profile lookup. A by-comment sync is a
+// structural drift hazard: nothing prevents one copy from changing without the
+// other, and the two gates MUST agree (selection + commit must reach the same
+// empty-capture verdict). Extracting ONE implementation each, imported by both
+// call sites, makes that drift impossible.
+//
+// Pure functions over PERSISTED state only — no clock, no randomness, no fs —
+// so both selection and commit replays reach the same gate decision. Keep them
+// fail-closed: when in doubt the caller must BLOCK, never silently pass.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emptyCaptureWarning = emptyCaptureWarning;
+exports.sandboxProfileForCandidate = sandboxProfileForCandidate;
+/** The HARD no-false-green gate (DIRECTION.md "ambiguity is a visible state").
+ *  A verifier node is built FROM a result node; when that result captured no
+ *  structured signal at all the result node carries a `metadata.captureWarning`
+ *  marker (set in worker-isolation / lifecycle ingest via isEmptyCapture). The
+ *  worker output is still ACCEPTED (a recorded warning, never a silent pass), but
+ *  a verifier-GATED commit — and candidate SELECTION — must NOT be able to
+ *  present that zero-evidence result as clean/green. We detect it here, reading
+ *  ONLY persisted state (the source result node's metadata) — purely functional,
+ *  no clock/ordering — so snapshot replay reaches the same gate decision.
+ *  Returns the marker string, or undefined.
+ *
+ *  Resolution trail: verifier node -> its input/parent result node. We look at
+ *  `inputs.inputNodeId` (set by runPipelineStage) first, then fall back to the
+ *  first parent, so it works regardless of which ingest path produced the node. */
+function emptyCaptureWarning(run, verifierNode) {
+    const resultNodeId = (typeof verifierNode.inputs?.inputNodeId === "string" ? verifierNode.inputs.inputNodeId : undefined) ||
+        verifierNode.parents[0];
+    const resultNode = resultNodeId ? (run.nodes || []).find((node) => node.id === resultNodeId) : undefined;
+    const warning = resultNode?.metadata?.captureWarning;
+    return typeof warning === "string" && warning ? warning : undefined;
+}
+/** Resolve the sandbox profile that backed a candidate's acceptance: the
+ *  worker's profile if the candidate has a worker, else the originating task's.
+ *  Read by both the commit gate's acceptance rationale and selection. Accepts an
+ *  optional candidate so the commit-side caller (which may not have resolved a
+ *  candidate) can share the same lookup. Pure over persisted run state. */
+function sandboxProfileForCandidate(run, candidate) {
+    const worker = candidate?.workerId ? (run.workers || []).find((entry) => entry.id === candidate.workerId) : undefined;
+    if (worker?.sandboxProfileId)
+        return worker.sandboxProfileId;
+    const task = candidate?.taskId ? (run.tasks || []).find((entry) => entry.id === candidate.taskId) : undefined;
+    return task?.sandboxProfileId;
+}

package/dist/mcp-server.js

@@ -17,6 +17,11 @@ const runner = new orchestrator_1.CoolWorkflowRunner({
 });
 process.stdin.setEncoding("utf8");
 let buffer = "";
+// A single line-delimited JSON-RPC request is bounded; an un-terminated stream
+// (a peer that never sends a newline, or a slow byte dribble) must not grow the
+// long-lived server's buffer without limit until it OOMs. Cap the unconsumed
+// buffer and fail closed on a frame that exceeds it.
+const MAX_LINE_BYTES = 16 * 1024 * 1024;
 process.stdin.on("data", (chunk) => {
     buffer += chunk;
     let newlineIndex;
@@ -26,6 +31,12 @@ process.stdin.on("data", (chunk) => {
         if (line)
             handleLine(line);
     }
+    if (buffer.length > MAX_LINE_BYTES) {
+        // No newline in an over-cap buffer ⇒ a malformed or hostile frame. Reject it
+        // and drop the partial bytes rather than accumulate toward OOM.
+        buffer = "";
+        sendError(null, -32700, `Parse error: request line exceeds ${MAX_LINE_BYTES} bytes`);
+    }
 });
 function handleLine(line) {
     let message;

package/dist/multi-agent/helpers.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MULTI_AGENT_SCHEMA_VERSION = void 0;
+exports.createId = exports.MULTI_AGENT_SCHEMA_VERSION = void 0;
 exports.indexRow = indexRow;
 exports.assertNoRecordPathCollisions = assertNoRecordPathCollisions;
 exports.pluralKind = pluralKind;
@@ -9,7 +9,6 @@ exports.assertLifecycleTransition = assertLifecycleTransition;
 exports.lifecycleEvent = lifecycleEvent;
 exports.isMembershipReported = isMembershipReported;
 exports.touch = touch;
-exports.createId = createId;
 exports.compact = compact;
 exports.unique = unique;
 exports.countBy = countBy;
@@ -106,14 +105,11 @@ function touch(record) {
     record.updatedAt = new Date().toISOString();
     return record;
 }
-// Deterministic record id (FreeBSD-audit L12/L13): the record's POSITION in its
-// per-run collection, threaded from the call site. No wall-clock stamp, no PRNG
-// suffix — re-running the same multi-agent topology mints byte-identical ids, so
-// snapshot/replay digests match. Each call site already asserts the minted id is
-// unique within its collection, and these collections only ever append.
-function createId(prefix, seq) {
-    return `${prefix}-${String(seq).padStart(4, "0")}`;
-}
+// Deterministic record id — single source of truth in ./ids. Re-exported here so
+// multi-agent.ts importers stay byte-unchanged (F10 dedup: the coordinator layer
+// shares the exact same helper).
+var ids_1 = require("./ids");
+Object.defineProperty(exports, "createId", { enumerable: true, get: function () { return ids_1.createId; } });
 function compact(value) {
     if (!value)
         return undefined;

package/dist/multi-agent/ids.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createId = createId;
+// Single source of truth for the deterministic record id scheme shared by the
+// multi-agent kernel (multi-agent/helpers.ts) and the coordinator/blackboard
+// layer (coordinator/util.ts). Both previously copy-pasted byte-identical
+// zero-padded-seq logic; this dedup (F10) collapses them onto one helper.
+//
+// Deterministic record id (FreeBSD-audit L12/L13): the record's POSITION in its
+// per-run collection, threaded from the call site. No wall-clock stamp, no PRNG
+// suffix — re-running the same multi-agent topology / coordination mints
+// byte-identical ids, so snapshot/replay digests match. Each call site already
+// asserts the minted id is unique within its collection, and these collections
+// only ever append.
+//
+// REPLAY DETERMINISM: pure function of its arguments — no Date, no random.
+// The output MUST stay byte-identical: `${prefix}-${4-digit-zero-padded-seq}`.
+function createId(prefix, seq) {
+    return `${prefix}-${String(seq).padStart(4, "0")}`;
+}

package/dist/multi-agent-eval.js

@@ -124,6 +124,14 @@ function replayMultiAgentSnapshot(target, options = {}) {
     const replayDir = node_path_1.default.join(suiteDir, "replay");
     const replayRunPath = node_path_1.default.join(suiteDir, "replay-run.json");
     node_fs_1.default.mkdirSync(replayDir, { recursive: true });
+    // RE-DERIVE the projection from the raw captured state instead of copying
+    // snapshot.normalized. Copying the baseline would make compareMultiAgentReplay
+    // diff the baseline against a byte-copy of itself, so a projection-determinism
+    // regression in normalizeRun could never be caught (the determinism moat would
+    // be false-green). We reconstruct the run from the captured raw state and run
+    // the SAME normalizeRun pipeline used at capture time, producing an INDEPENDENT
+    // re-projection the comparison can pit against the baseline.
+    const replayed = rederiveNormalizedFromSnapshot(snapshot);
     const replay = {
         schemaVersion: 1,
         kind: "multi-agent-replay-run",
@@ -139,7 +147,7 @@ function replayMultiAgentSnapshot(target, options = {}) {
             replayRunPath,
             snapshotPath: snapshot.paths.snapshotPath
         },
-        replay: snapshot.normalized,
+        replay: replayed,
         errors: []
     };
     (0, state_1.writeJson)(replayRunPath, replay);
@@ -398,6 +406,24 @@ function loadScoreForTarget(target, scorePath) {
     }
     return scoreMultiAgentReplay(target);
 }
+// Re-derive snapshot.normalized INDEPENDENTLY at replay time. The raw captured
+// state is the baseline run state file (snapshot.paths.baselineStatePath) — the
+// same WorkflowRun captureRun/normalizeRun projected at capture time. We re-load
+// it and re-run the IDENTICAL normalizeRun pipeline, so the result is a genuine
+// re-projection rather than a copy of the baseline. Fail-closed: if the raw
+// state cannot be reconstructed we throw (never silently fall back to the
+// baseline copy — that is exactly the false-green this guards against).
+function rederiveNormalizedFromSnapshot(snapshot) {
+    const statePath = snapshot.paths.baselineStatePath;
+    if (!statePath || !node_fs_1.default.existsSync(statePath)) {
+        throw new Error(`Cannot re-derive replay projection: baseline run state missing at ${statePath || "<unset>"}; re-snapshot from a live run before replaying.`);
+    }
+    const result = (0, state_1.loadRunStateFile)(statePath, { dryRun: true });
+    if (result.report.status === "unsupported") {
+        throw new Error(`Cannot re-derive replay projection: baseline run state at ${statePath} is unsupported: ${result.report.errors.join("; ")}`);
+    }
+    return normalizeRun(result.run);
+}
 function captureRun(run) {
     return {
         topology: run.topologies || { schemaVersion: 1, runs: [] },

package/dist/multi-agent-host.js

@@ -384,22 +384,54 @@ function hostSelect(run, options = {}) {
     }
     return envelope(run, "select", { performed: "selected-candidate", data: selection });
 }
+function memoize(compute) {
+    let cached;
+    return (run) => (cached ??= { value: compute(run) }).value;
+}
+function createHostSummaryCache(run) {
+    const topologies = memoize(topology_1.summarizeTopologies);
+    const multiAgent = memoize(multi_agent_1.summarizeMultiAgent);
+    const blackboard = memoize(coordinator_1.summarizeBlackboard);
+    const workers = memoize(operator_ux_1.summarizeOperatorWorkers);
+    const candidates = memoize(operator_ux_1.summarizeOperatorCandidates);
+    const feedback = memoize(operator_ux_1.summarizeOperatorFeedback);
+    const commits = memoize(operator_ux_1.summarizeOperatorCommits);
+    const trust = memoize(trust_audit_1.summarizeTrustAudit);
+    const operator = memoize(operator_ux_1.summarizeOperatorRun);
+    const multiAgentOperator = memoize(multi_agent_operator_ux_1.summarizeMultiAgentOperator);
+    const active = memoize(activeTopologies);
+    return {
+        run,
+        topologies: () => topologies(run),
+        multiAgent: () => multiAgent(run),
+        blackboard: () => blackboard(run),
+        workers: () => workers(run),
+        candidates: () => candidates(run),
+        feedback: () => feedback(run),
+        commits: () => commits(run),
+        trust: () => trust(run),
+        operator: () => operator(run),
+        multiAgentOperator: () => multiAgentOperator(run),
+        active: () => active(run)
+    };
+}
 function envelope(run, command, options = {}) {
-    const topologies = (0, topology_1.summarizeTopologies)(run);
-    const multiAgent = (0, multi_agent_1.summarizeMultiAgent)(run);
-    const blackboard = (0, coordinator_1.summarizeBlackboard)(run);
-    const workers = (0, operator_ux_1.summarizeOperatorWorkers)(run);
-    const candidates = (0, operator_ux_1.summarizeOperatorCandidates)(run);
-    const feedback = (0, operator_ux_1.summarizeOperatorFeedback)(run);
-    const commits = (0, operator_ux_1.summarizeOperatorCommits)(run);
-    const trust = (0, trust_audit_1.summarizeTrustAudit)(run);
-    const operator = (0, operator_ux_1.summarizeOperatorRun)(run);
-    const multiAgentOperator = (0, multi_agent_operator_ux_1.summarizeMultiAgentOperator)(run);
-    const active = activeTopologies(run);
+    const cache = createHostSummaryCache(run);
+    const topologies = cache.topologies();
+    const multiAgent = cache.multiAgent();
+    const blackboard = cache.blackboard();
+    const workers = cache.workers();
+    const candidates = cache.candidates();
+    const feedback = cache.feedback();
+    const commits = cache.commits();
+    const trust = cache.trust();
+    const operator = cache.operator();
+    const multiAgentOperator = cache.multiAgentOperator();
+    const active = cache.active();
     const blockedReasons = unique([...operator.blockedReasons, ...(options.extraBlockedReasons || [])]);
-    const state = blockedReasons.length ? "blocked" : classifyHostState(run);
+    const state = blockedReasons.length ? "blocked" : classifyHostState(run, cache);
     const ids = activeIds(run, active);
-    const nextActions = hostNextActions(run, state, active, options.requiredHostAction);
+    const nextActions = hostNextActions(run, state, active, options.requiredHostAction, cache);
     return {
         schemaVersion: 1,
         surface: "multi-agent-host",
@@ -427,12 +459,12 @@ function envelope(run, command, options = {}) {
         data: options.data
     };
 }
-function classifyHostState(run) {
-    const active = activeTopologies(run);
-    const feedback = (0, operator_ux_1.summarizeOperatorFeedback)(run);
-    const workers = (0, operator_ux_1.summarizeOperatorWorkers)(run);
-    const candidates = (0, operator_ux_1.summarizeOperatorCandidates)(run);
-    const commits = (0, operator_ux_1.summarizeOperatorCommits)(run);
+function classifyHostState(run, cache = createHostSummaryCache(run)) {
+    const active = cache.active();
+    const feedback = cache.feedback();
+    const workers = cache.workers();
+    const candidates = cache.candidates();
+    const commits = cache.commits();
     if (!active.length && !(run.multiAgent?.runs || []).length)
         return "needs-run";
     if (feedback.open.some((entry) => !entry.retryable))
@@ -475,7 +507,7 @@ function activeIds(run, active) {
         auditEventIds: unique(active.flatMap((entry) => entry.links.auditEventIds))
     };
 }
-function hostNextActions(run, state, active, requiredHostAction) {
+function hostNextActions(run, state, active, requiredHostAction, cache = createHostSummaryCache(run)) {
     if (requiredHostAction)
         return [{ command: "host-action", reason: requiredHostAction, priority: "high" }];
     const runId = run.id;
@@ -493,7 +525,7 @@ function hostNextActions(run, state, active, requiredHostAction) {
         case "ready-for-selection":
             return [{ command: `node scripts/cw.js multi-agent select ${runId} --candidate <candidate-id> --reason "<rationale>"`, reason: "Select a scored candidate after verifier gates pass.", priority: "high" }];
         case "ready-for-commit": {
-            const ready = (0, operator_ux_1.summarizeOperatorCandidates)(run).readyForCommit[0];
+            const ready = cache.candidates().readyForCommit[0];
             return [{ command: `node scripts/cw.js commit ${runId} --selection ${ready.selectionId} --reason "<verified rationale>"`, reason: "Create a verifier-gated CW state commit.", priority: "high" }];
         }
         case "complete":

package/dist/multi-agent-operator-ux.js

@@ -15,6 +15,7 @@ const coordinator_1 = require("./coordinator");
 const multi_agent_1 = require("./multi-agent");
 const topology_1 = require("./topology");
 const trust_audit_1 = require("./trust-audit");
+const validation_1 = require("./validation");
 function summarizeMultiAgentOperator(run) {
     const topologies = (0, topology_1.summarizeTopologies)(run);
     const multiAgent = (0, multi_agent_1.summarizeMultiAgent)(run);
@@ -447,7 +448,7 @@ function readScores(run, candidateId) {
         .readdirSync(dir)
         .filter((file) => file.endsWith(".json"))
         .sort()
-        .map((file) => JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(dir, file), "utf8")));
+        .map((file) => (0, validation_1.validateCandidateScore)(JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(dir, file), "utf8"))));
 }
 function scorePath(run, candidateId, scoreId) {
     const file = node_path_1.default.join(run.paths.candidatesDir || node_path_1.default.join(run.paths.runDir, "candidates"), safeFileName(candidateId), "scores", `${safeFileName(scoreId)}.json`);