cool-workflow 0.1.81 → 0.1.83

package/dist/validation.js

@@ -0,0 +1,328 @@
+"use strict";
+// Fail-closed shape guards for persisted per-record types (F5, integrity boundary).
+//
+// `JSON.parse(...) as T` is a LIE: the cast asserts a shape TypeScript never
+// checked at runtime, so a corrupt/forged/old-schema record flows in as if it
+// were a valid T and is used/upserted unvalidated. These guards re-establish the
+// integrity boundary at the read edge: after parse, the raw value is structurally
+// validated against the type def in src/types/* BEFORE it is trusted.
+//
+// Two callers, two error semantics — both fail closed, neither fabricates:
+//   - validate*()      throw a descriptive Error on mismatch (for readers that
+//                      already let parse errors propagate / require the record).
+//   - tryValidate*()   return null on mismatch (for best-effort readers that
+//                      swallow parse errors and SKIP the record — the downstream
+//                      gate then fails closed on the absence). Never throws.
+//
+// Dependency-light by construction: imports ONLY from ./types. No fs, no clock,
+// no randomness — pure structural checks, safe in replay/core paths.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RecordValidationError = void 0;
+exports.validateWorkerScope = validateWorkerScope;
+exports.tryValidateWorkerScope = tryValidateWorkerScope;
+exports.validateNodeSnapshot = validateNodeSnapshot;
+exports.tryValidateNodeSnapshot = tryValidateNodeSnapshot;
+exports.validateNodeReplayRun = validateNodeReplayRun;
+exports.tryValidateNodeReplayRun = tryValidateNodeReplayRun;
+exports.validateCandidateScore = validateCandidateScore;
+exports.tryValidateCandidateScore = tryValidateCandidateScore;
+exports.validateCandidateRecord = validateCandidateRecord;
+exports.tryValidateCandidateRecord = tryValidateCandidateRecord;
+// ---------------------------------------------------------------------------
+// Primitive predicates — small, total, never throw.
+// ---------------------------------------------------------------------------
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isString(value) {
+    return typeof value === "string";
+}
+function isFiniteNumber(value) {
+    return typeof value === "number" && Number.isFinite(value);
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+function isObjectArray(value) {
+    return Array.isArray(value) && value.every((entry) => isRecord(entry));
+}
+const WORKER_STATUSES = new Set([
+    "allocated",
+    "running",
+    "completed",
+    "failed",
+    "rejected",
+    "verified",
+    "orphaned"
+]);
+const SCORE_VERDICTS = new Set(["pass", "warn", "fail"]);
+const CANDIDATE_STATUSES = new Set([
+    "registered",
+    "scored",
+    "selected",
+    "rejected",
+    "verified",
+    "failed"
+]);
+const CANDIDATE_KINDS = new Set(["worker-output", "result", "artifact", "manual", "release"]);
+const SNAPSHOT_FRESHNESS = new Set(["valid", "stale", "absent"]);
+/** Descriptive integrity error — the message names the type and the field that
+ *  broke, so a corrupt record is diagnosable from logs alone. */
+class RecordValidationError extends Error {
+    code = "record-shape-invalid";
+    typeName;
+    field;
+    constructor(typeName, reason, field) {
+        super(`Invalid persisted ${typeName}: ${reason}`);
+        this.name = "RecordValidationError";
+        this.typeName = typeName;
+        this.field = field;
+    }
+}
+exports.RecordValidationError = RecordValidationError;
+// ---------------------------------------------------------------------------
+// WorkerScope — worker-isolation.ts:309 / :905
+// Required (per src/types/worker.ts WorkerScope): schemaVersion===1, id, runId,
+// taskId, createdAt, updatedAt, status (enum), workerDir, inputPath, resultPath,
+// artifactsDir, logsDir are strings; allowedPaths string[]; feedbackIds string[];
+// errors object[]. Optional fields are not enforced (additive, may be absent).
+// ---------------------------------------------------------------------------
+function workerScopeReason(value) {
+    if (!isRecord(value))
+        return { reason: "not an object" };
+    if (value.schemaVersion !== 1)
+        return { field: "schemaVersion", reason: "must equal 1" };
+    const requiredStrings = [
+        "id",
+        "runId",
+        "taskId",
+        "createdAt",
+        "updatedAt",
+        "workerDir",
+        "inputPath",
+        "resultPath",
+        "artifactsDir",
+        "logsDir"
+    ];
+    for (const field of requiredStrings) {
+        if (!isString(value[field]))
+            return { field: field, reason: "must be a string" };
+    }
+    if (!isString(value.status) || !WORKER_STATUSES.has(value.status)) {
+        return { field: "status", reason: "must be a valid WorkerIsolationStatus" };
+    }
+    if (!isStringArray(value.allowedPaths))
+        return { field: "allowedPaths", reason: "must be a string[]" };
+    if (!isStringArray(value.feedbackIds))
+        return { field: "feedbackIds", reason: "must be a string[]" };
+    if (!isObjectArray(value.errors))
+        return { field: "errors", reason: "must be a StateNodeError[]" };
+    return undefined;
+}
+/** Throw-on-mismatch guard for WorkerScope (callers that require the record). */
+function validateWorkerScope(value) {
+    const problem = workerScopeReason(value);
+    if (problem)
+        throw new RecordValidationError("WorkerScope", problem.reason, problem.field);
+    return value;
+}
+/** Best-effort variant: returns null on mismatch (caller skips the record). */
+function tryValidateWorkerScope(value) {
+    return workerScopeReason(value) ? null : value;
+}
+// ---------------------------------------------------------------------------
+// NodeSnapshotBody — shared by NodeSnapshot.body and NodeReplayRun.body.
+// Required (per src/types/state-node.ts): id, kind, status, loopStage strings;
+// inputs/outputs records; artifacts/evidence/errors object arrays;
+// parents/children string arrays.
+// ---------------------------------------------------------------------------
+function nodeSnapshotBodyReason(value, prefix) {
+    if (!isRecord(value))
+        return { field: prefix, reason: "must be a NodeSnapshotBody object" };
+    const requiredStrings = ["id", "kind", "status", "loopStage"];
+    for (const field of requiredStrings) {
+        if (!isString(value[field]))
+            return { field: `${prefix}.${String(field)}`, reason: "must be a string" };
+    }
+    if (!isRecord(value.inputs))
+        return { field: `${prefix}.inputs`, reason: "must be an object" };
+    if (!isRecord(value.outputs))
+        return { field: `${prefix}.outputs`, reason: "must be an object" };
+    if (!isObjectArray(value.artifacts))
+        return { field: `${prefix}.artifacts`, reason: "must be a StateArtifact[]" };
+    if (!isObjectArray(value.evidence))
+        return { field: `${prefix}.evidence`, reason: "must be a StateEvidence[]" };
+    if (!isObjectArray(value.errors))
+        return { field: `${prefix}.errors`, reason: "must be a StateNodeError[]" };
+    if (!isStringArray(value.parents))
+        return { field: `${prefix}.parents`, reason: "must be a string[]" };
+    if (!isStringArray(value.children))
+        return { field: `${prefix}.children`, reason: "must be a string[]" };
+    return undefined;
+}
+// ---------------------------------------------------------------------------
+// NodeSnapshot — node-snapshot.ts:121
+// Required: schemaVersion===1, snapshotId, runId, nodeId, capturedAt,
+// sourceFingerprint strings; body a valid NodeSnapshotBody.
+// ---------------------------------------------------------------------------
+function nodeSnapshotReason(value) {
+    if (!isRecord(value))
+        return { reason: "not an object" };
+    if (value.schemaVersion !== 1)
+        return { field: "schemaVersion", reason: "must equal 1" };
+    const requiredStrings = ["snapshotId", "runId", "nodeId", "capturedAt", "sourceFingerprint"];
+    for (const field of requiredStrings) {
+        if (!isString(value[field]))
+            return { field: field, reason: "must be a string" };
+    }
+    return nodeSnapshotBodyReason(value.body, "body");
+}
+/** Throw-on-mismatch guard for NodeSnapshot (read edge requires the record). */
+function validateNodeSnapshot(value) {
+    const problem = nodeSnapshotReason(value);
+    if (problem)
+        throw new RecordValidationError("NodeSnapshot", problem.reason, problem.field);
+    return value;
+}
+/** Best-effort variant: returns null on mismatch. */
+function tryValidateNodeSnapshot(value) {
+    return nodeSnapshotReason(value) ? null : value;
+}
+// ---------------------------------------------------------------------------
+// NodeReplayRun — node-snapshot.ts:133
+// Required: schemaVersion===1, replayId, runId, nodeId, snapshotId, replayedAt,
+// outputFingerprint strings; freshness enum; contractValidated boolean; body a
+// valid NodeSnapshotBody.
+// ---------------------------------------------------------------------------
+function nodeReplayRunReason(value) {
+    if (!isRecord(value))
+        return { reason: "not an object" };
+    if (value.schemaVersion !== 1)
+        return { field: "schemaVersion", reason: "must equal 1" };
+    const requiredStrings = [
+        "replayId",
+        "runId",
+        "nodeId",
+        "snapshotId",
+        "replayedAt",
+        "outputFingerprint"
+    ];
+    for (const field of requiredStrings) {
+        if (!isString(value[field]))
+            return { field: field, reason: "must be a string" };
+    }
+    if (!isString(value.freshness) || !SNAPSHOT_FRESHNESS.has(value.freshness)) {
+        return { field: "freshness", reason: "must be a valid NodeSnapshotFreshness" };
+    }
+    if (typeof value.contractValidated !== "boolean") {
+        return { field: "contractValidated", reason: "must be a boolean" };
+    }
+    return nodeSnapshotBodyReason(value.body, "body");
+}
+/** Throw-on-mismatch guard for NodeReplayRun (read edge requires the record). */
+function validateNodeReplayRun(value) {
+    const problem = nodeReplayRunReason(value);
+    if (problem)
+        throw new RecordValidationError("NodeReplayRun", problem.reason, problem.field);
+    return value;
+}
+/** Best-effort variant: returns null on mismatch. */
+function tryValidateNodeReplayRun(value) {
+    return nodeReplayRunReason(value) ? null : value;
+}
+// ---------------------------------------------------------------------------
+// CandidateScore — multi-agent-operator-ux.ts:502 / evidence-reasoning.ts:750
+// Required (per src/types/candidate.ts): schemaVersion===1, id, candidateId,
+// runId, createdAt, scorer strings; criteria record of numbers; total/maxTotal/
+// normalized finite numbers; verdict enum; evidence/artifacts object arrays.
+// ---------------------------------------------------------------------------
+function isNumberRecord(value) {
+    return isRecord(value) && Object.values(value).every((entry) => isFiniteNumber(entry));
+}
+function candidateScoreReason(value) {
+    if (!isRecord(value))
+        return { reason: "not an object" };
+    if (value.schemaVersion !== 1)
+        return { field: "schemaVersion", reason: "must equal 1" };
+    const requiredStrings = ["id", "candidateId", "runId", "createdAt", "scorer"];
+    for (const field of requiredStrings) {
+        if (!isString(value[field]))
+            return { field: field, reason: "must be a string" };
+    }
+    if (!isNumberRecord(value.criteria))
+        return { field: "criteria", reason: "must be a Record<string, number>" };
+    if (!isFiniteNumber(value.total))
+        return { field: "total", reason: "must be a finite number" };
+    if (!isFiniteNumber(value.maxTotal))
+        return { field: "maxTotal", reason: "must be a finite number" };
+    if (!isFiniteNumber(value.normalized))
+        return { field: "normalized", reason: "must be a finite number" };
+    if (!isString(value.verdict) || !SCORE_VERDICTS.has(value.verdict)) {
+        return { field: "verdict", reason: "must be a valid CandidateScoreVerdict" };
+    }
+    if (!isObjectArray(value.evidence))
+        return { field: "evidence", reason: "must be a StateEvidence[]" };
+    if (!isObjectArray(value.artifacts))
+        return { field: "artifacts", reason: "must be a StateArtifact[]" };
+    return undefined;
+}
+/** Throw-on-mismatch guard for CandidateScore (callers that require the record). */
+function validateCandidateScore(value) {
+    const problem = candidateScoreReason(value);
+    if (problem)
+        throw new RecordValidationError("CandidateScore", problem.reason, problem.field);
+    return value;
+}
+/** Best-effort variant: returns null on mismatch (caller skips the record so the
+ *  downstream score gate fails closed on its absence). */
+function tryValidateCandidateScore(value) {
+    return candidateScoreReason(value) ? null : value;
+}
+// ---------------------------------------------------------------------------
+// CandidateRecord — candidate-scoring.ts getCandidate / loadCandidatesFromDisk.
+// Required (per src/types/candidate.ts): schemaVersion===1, id, runId, createdAt,
+// updatedAt strings; kind/status enums; artifacts/evidence object arrays;
+// scores/feedbackIds string arrays. Optional ids (workerId/taskId/…) not enforced.
+// A corrupt/forged candidate record must NOT flow into the run as a trusted T —
+// the gate that backs commit selection reads these fields, so we fail closed at
+// the read edge instead of upserting an unvalidated cast.
+// ---------------------------------------------------------------------------
+function candidateRecordReason(value) {
+    if (!isRecord(value))
+        return { reason: "not an object" };
+    if (value.schemaVersion !== 1)
+        return { field: "schemaVersion", reason: "must equal 1" };
+    const requiredStrings = ["id", "runId", "createdAt", "updatedAt"];
+    for (const field of requiredStrings) {
+        if (!isString(value[field]))
+            return { field: field, reason: "must be a string" };
+    }
+    if (!isString(value.kind) || !CANDIDATE_KINDS.has(value.kind)) {
+        return { field: "kind", reason: "must be a valid CandidateKind" };
+    }
+    if (!isString(value.status) || !CANDIDATE_STATUSES.has(value.status)) {
+        return { field: "status", reason: "must be a valid CandidateStatus" };
+    }
+    if (!isObjectArray(value.artifacts))
+        return { field: "artifacts", reason: "must be a StateArtifact[]" };
+    if (!isObjectArray(value.evidence))
+        return { field: "evidence", reason: "must be a StateEvidence[]" };
+    if (!isStringArray(value.scores))
+        return { field: "scores", reason: "must be a string[]" };
+    if (!isStringArray(value.feedbackIds))
+        return { field: "feedbackIds", reason: "must be a string[]" };
+    return undefined;
+}
+/** Throw-on-mismatch guard for CandidateRecord (callers that require the record
+ *  at the disk read edge — getCandidate / loadCandidatesFromDisk). */
+function validateCandidateRecord(value) {
+    const problem = candidateRecordReason(value);
+    if (problem)
+        throw new RecordValidationError("CandidateRecord", problem.reason, problem.field);
+    return value;
+}
+/** Best-effort variant: returns null on mismatch (caller skips the record so the
+ *  downstream selection gate fails closed on its absence). */
+function tryValidateCandidateRecord(value) {
+    return candidateRecordReason(value) ? null : value;
+}

package/dist/version.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MIN_SUPPORTED_RUN_STATE_SCHEMA_VERSION = exports.LEGACY_RUN_STATE_SCHEMA_VERSION = exports.CURRENT_RUN_STATE_SCHEMA_VERSION = exports.WORKFLOW_APP_SCHEMA_VERSION = exports.CURRENT_COOL_WORKFLOW_VERSION = void 0;
-exports.CURRENT_COOL_WORKFLOW_VERSION = "0.1.81";
+exports.CURRENT_COOL_WORKFLOW_VERSION = "0.1.83";
 exports.WORKFLOW_APP_SCHEMA_VERSION = 1;
 exports.CURRENT_RUN_STATE_SCHEMA_VERSION = 1;
 exports.LEGACY_RUN_STATE_SCHEMA_VERSION = 0;

package/dist/worker-isolation.js

@@ -34,6 +34,7 @@ const telemetry_ledger_1 = require("./telemetry-ledger");
 const coordinator_1 = require("./coordinator");
 const helpers_1 = require("./worker-isolation/helpers");
 const paths_1 = require("./worker-isolation/paths");
+const validation_1 = require("./validation");
 exports.WORKER_ISOLATION_SCHEMA_VERSION = 1;
 function allocateWorkerScope(run, task, options = {}) {
     ensureWorkerState(run);
@@ -269,11 +270,39 @@ function getWorkerScope(run, workerId) {
     const file = node_path_1.default.join(workerRoot(run), (0, state_1.safeFileName)(workerId), paths_1.WORKER_SCOPE_FILE);
     if (!node_fs_1.default.existsSync(file))
         return undefined;
-    const scope = JSON.parse(node_fs_1.default.readFileSync(file, "utf8"));
+    let scope;
+    try {
+        scope = (0, validation_1.validateWorkerScope)(JSON.parse(node_fs_1.default.readFileSync(file, "utf8")));
+    }
+    catch (error) {
+        // A present-but-corrupt scope fails closed with context, not a raw
+        // SyntaxError/validation throw bubbling up from deep in the call stack.
+        throw new Error(`Corrupt worker scope ${file}: ${error instanceof Error ? error.message : String(error)}`);
+    }
     upsertWorkerScope(run, scope);
     return scope;
 }
 function recordWorkerOutput(run, workerId, resultPath, options = {}) {
+    // Accept-path orchestrator. The recorded order + side effects of these ordered
+    // steps are load-bearing (replay determinism + the hash-chained audit/telemetry
+    // ledgers cross-link by parent event ids), so each helper runs exactly where it
+    // did before and mutates the shared `accept` context in place. Do NOT reorder.
+    const accept = validateWorkerResult(run, workerId, resultPath, options);
+    const delegation = attestWorkerDelegation(accept);
+    acceptWorkerResult(accept, delegation);
+    recordWorkerDelegationLedger(accept, delegation);
+    runWorkerVerify(accept);
+    recordWorkerCompletion(accept, delegation);
+    fanOutWorkerOutput(accept);
+    if (options.persist !== false)
+        (0, state_1.saveCheckpoint)(run);
+    return accept.output;
+}
+/** Step 1 — validateResult: resolve scope/task, enforce the sandbox boundary, the
+ *  result-file existence, the envelope contract, and (opt-in) resolvable evidence.
+ *  Fail-closed: any guard records a worker failure and throws BEFORE accept-side
+ *  state mutation. Returns the partially-filled accept context on success. */
+function validateWorkerResult(run, workerId, resultPath, options) {
     const scope = requireWorkerScope(run, workerId);
     const task = requireWorkerTask(run, scope);
     const absoluteResultPath = node_path_1.default.resolve(resultPath);
@@ -316,6 +345,30 @@ function recordWorkerOutput(run, workerId, resultPath, options = {}) {
             throw new Error(error.message);
         }
     }
+    return {
+        run,
+        workerId,
+        options,
+        scope,
+        task,
+        absoluteResultPath,
+        rawResult,
+        parsedResult,
+        destination: "",
+        pathAuditId: "",
+        acceptedAuditId: "",
+        resultNode: undefined,
+        verifierNodeId: "",
+        verifierStatus: "",
+        output: undefined
+    };
+}
+/** Step 2 — attestSandbox/attestDelegation: verify the agent's signed telemetry
+ *  BEFORE recording it, enforce the opt-in require-attested-telemetry gate (still
+ *  fail-closed, pre-mutation), and build the agent-hop provenance. Non-agent hops
+ *  return an empty delegation. */
+function attestWorkerDelegation(accept) {
+    const { run, workerId, options, task, absoluteResultPath, rawResult } = accept;
     // Agent Delegation Drive (v0.1.38): if this worker's result.md was produced by an
     // EXTERNAL agent, record the agent-hop attestation AS PROVENANCE — the agent
     // (kind:process) handle, the agent-REPORTED model (never CW_AGENT_MODEL), the
@@ -355,6 +408,16 @@ function recordWorkerOutput(run, workerId, resultPath, options = {}) {
             ...(telemetry ? { usageAttestation: telemetry.status, usageAttestationReason: telemetry.reason } : {})
         }
         : undefined;
+    return { agentDelegation, telemetry };
+}
+/** Step 3 — recordStateNode/audit: the irreversible accept. Records the allowed
+ *  path decision, copies the result into the run results dir, completes the task,
+ *  builds + appends the result node, emits the accepted audit event, re-normalizes
+ *  node evidence against both audit ids, and surfaces the empty-capture warning.
+ *  Writes destination/pathAuditId/acceptedAuditId/resultNode back into `accept`. */
+function acceptWorkerResult(accept, delegation) {
+    const { run, workerId, scope, task, absoluteResultPath, parsedResult } = accept;
+    const { agentDelegation } = delegation;
     const pathAudit = (0, trust_audit_1.recordSandboxPathDecision)(run, {
         workerId,
         taskId: task.id,
@@ -443,58 +506,75 @@ function recordWorkerOutput(run, workerId, resultPath, options = {}) {
             metadata: { reason: "no findings or evidence captured from result.md", resultPath: destination }
         });
     }
+    accept.destination = destination;
+    accept.pathAuditId = pathAudit.id;
+    accept.acceptedAuditId = acceptedAudit.id;
+    accept.resultNode = resultNode;
+}
+/** Step 4 — recordTelemetryLedger: the agent-hop attestation. Binds the telemetry
+ *  verdict into the append-only hash-chained ledger BEFORE the audit event (so the
+ *  event can cross-link the record hash), then emits the worker.agent-delegation
+ *  audit event. No-op for non-agent hops. */
+function recordWorkerDelegationLedger(accept, delegation) {
+    const { agentDelegation } = delegation;
     // The agent-hop attestation event — hung off worker.output, alongside
     // worker.backend. Recorded in trust-audit/provenance, NEVER in node evidence.
-    if (agentDelegation) {
-        // Track 1 (tamper-evidence): bind this verdict into the append-only,
-        // hash-chained telemetry ledger BEFORE the audit event, so the event can
-        // cross-link the record hash. Editing the recorded verdict/usage later breaks
-        // the chain (verifyTelemetryLedger). Only when a verdict was computed.
-        const ledgerRecord = agentDelegation.usageAttestation
-            ? (0, telemetry_ledger_1.appendTelemetryAttestation)(run, {
-                workerId,
-                taskId: task.id,
-                promptDigest: agentDelegation.promptDigest,
-                reportedUsage: agentDelegation.reportedUsage,
-                usageSignature: agentDelegation.usageSignature,
-                attestation: agentDelegation.usageAttestation,
-                attestationReason: agentDelegation.usageAttestationReason
-            })
-            : undefined;
-        (0, trust_audit_1.recordTrustAuditEvent)(run, {
-            kind: "worker.agent-delegation",
-            decision: "recorded",
-            source: "host-attested",
+    if (!agentDelegation)
+        return;
+    const { run, workerId, scope, task, resultNode, acceptedAuditId } = accept;
+    // Track 1 (tamper-evidence): bind this verdict into the append-only,
+    // hash-chained telemetry ledger BEFORE the audit event, so the event can
+    // cross-link the record hash. Editing the recorded verdict/usage later breaks
+    // the chain (verifyTelemetryLedger). Only when a verdict was computed.
+    const ledgerRecord = agentDelegation.usageAttestation
+        ? (0, telemetry_ledger_1.appendTelemetryAttestation)(run, {
             workerId,
             taskId: task.id,
-            nodeId: resultNode.id,
-            sandboxProfileId: scope.sandboxProfileId,
-            policySnapshot: scope.sandboxPolicy,
-            parentEventIds: [acceptedAudit.id],
-            metadata: {
-                backendId: agentDelegation.backendId,
-                handleKind: agentDelegation.handle.kind,
-                handleRef: agentDelegation.handle.ref,
-                model: agentDelegation.model,
-                promptDigest: agentDelegation.promptDigest,
-                resultDigest: agentDelegation.resultDigest,
-                command: agentDelegation.command,
-                args: agentDelegation.args,
-                exitCode: agentDelegation.exitCode,
-                // Track 1: the telemetry verdict travels with the agent-hop event so the
-                // audit report can surface `unattested` usage loudly. Absent ⇒ no usage.
-                ...(agentDelegation.usageAttestation
-                    ? {
-                        telemetryAttestation: agentDelegation.usageAttestation,
-                        ...(agentDelegation.usageAttestationReason ? { telemetryAttestationReason: agentDelegation.usageAttestationReason } : {}),
-                        ...(agentDelegation.reportedUsage ? { reportedUsage: agentDelegation.reportedUsage } : {}),
-                        // Cross-link to the hash-chained ledger entry (tamper-evidence).
-                        ...(ledgerRecord ? { telemetryRecordId: ledgerRecord.recordId, telemetryRecordHash: ledgerRecord.recordHash, telemetryPrevHash: ledgerRecord.prevHash } : {})
-                    }
-                    : {})
-            }
-        });
-    }
+            promptDigest: agentDelegation.promptDigest,
+            reportedUsage: agentDelegation.reportedUsage,
+            usageSignature: agentDelegation.usageSignature,
+            attestation: agentDelegation.usageAttestation,
+            attestationReason: agentDelegation.usageAttestationReason
+        })
+        : undefined;
+    (0, trust_audit_1.recordTrustAuditEvent)(run, {
+        kind: "worker.agent-delegation",
+        decision: "recorded",
+        source: "host-attested",
+        workerId,
+        taskId: task.id,
+        nodeId: resultNode.id,
+        sandboxProfileId: scope.sandboxProfileId,
+        policySnapshot: scope.sandboxPolicy,
+        parentEventIds: [acceptedAuditId],
+        metadata: {
+            backendId: agentDelegation.backendId,
+            handleKind: agentDelegation.handle.kind,
+            handleRef: agentDelegation.handle.ref,
+            model: agentDelegation.model,
+            promptDigest: agentDelegation.promptDigest,
+            resultDigest: agentDelegation.resultDigest,
+            command: agentDelegation.command,
+            args: agentDelegation.args,
+            exitCode: agentDelegation.exitCode,
+            // Track 1: the telemetry verdict travels with the agent-hop event so the
+            // audit report can surface `unattested` usage loudly. Absent ⇒ no usage.
+            ...(agentDelegation.usageAttestation
+                ? {
+                    telemetryAttestation: agentDelegation.usageAttestation,
+                    ...(agentDelegation.usageAttestationReason ? { telemetryAttestationReason: agentDelegation.usageAttestationReason } : {}),
+                    ...(agentDelegation.reportedUsage ? { reportedUsage: agentDelegation.reportedUsage } : {}),
+                    // Cross-link to the hash-chained ledger entry (tamper-evidence).
+                    ...(ledgerRecord ? { telemetryRecordId: ledgerRecord.recordId, telemetryRecordHash: ledgerRecord.recordHash, telemetryPrevHash: ledgerRecord.prevHash } : {})
+                }
+                : {})
+        }
+    });
+}
+/** Step 5 — runVerify: drive the verify pipeline stage off the accepted result node
+ *  and record the verifier node id on the task + accept context. */
+function runWorkerVerify(accept) {
+    const { run, workerId, scope, task, parsedResult, destination, resultNode } = accept;
     const verifierResult = (0, pipeline_runner_1.createPipelineRunner)({ persist: false }).runPipelineStage(run, "verify", resultNode.id, {
         outputNodeId: `${run.id}:verifier:${task.id}`,
         outputStatus: "verified",
@@ -507,14 +587,24 @@ function recordWorkerOutput(run, workerId, resultPath, options = {}) {
         metadata: { taskId: task.id, workerId, resultNodeId: resultNode.id, sandboxProfileId: scope.sandboxProfileId }
     });
     task.verifierNodeId = verifierResult.outputNodeId;
+    accept.verifierNodeId = verifierResult.outputNodeId;
+    // Carry the verify verdict for the scope-status transition in recordWorkerCompletion.
+    accept.verifierStatus = verifierResult.status;
+}
+/** Step 6 — recordStateNode (worker record): assemble the worker output record +
+ *  host-attested usage record, then persist the worker scope with the verify-derived
+ *  status, output digest/size, and (when present) usage. */
+function recordWorkerCompletion(accept, delegation) {
+    const { run, workerId, scope, task, absoluteResultPath, rawResult, resultNode, verifierNodeId, verifierStatus, pathAuditId, acceptedAuditId } = accept;
+    const { agentDelegation, telemetry } = delegation;
     const output = {
         workerId,
         taskId: task.id,
         resultPath: absoluteResultPath,
         recordedAt: new Date().toISOString(),
         stateNodeId: resultNode.id,
-        verifierNodeId: verifierResult.outputNodeId,
-        auditEventIds: [pathAudit.id, acceptedAudit.id]
+        verifierNodeId,
+        auditEventIds: [pathAuditId, acceptedAuditId]
     };
     // Host-attested usage rides on the worker record. Recorded when the agent
     // REPORTED a model OR token usage — `unreported`/absent stays ABSENT (never
@@ -537,7 +627,7 @@ function recordWorkerOutput(run, workerId, resultPath, options = {}) {
     updateWorkerScope(run, {
         ...scope,
         updatedAt: new Date().toISOString(),
-        status: verifierResult.status === "advanced" ? "verified" : "completed",
+        status: verifierStatus === "advanced" ? "verified" : "completed",
         resultNodeId: resultNode.id,
         output,
         // Output integrity (v0.1.63): SHA256 digest + file size
@@ -545,20 +635,23 @@ function recordWorkerOutput(run, workerId, resultPath, options = {}) {
         outputSizeBytes: Buffer.byteLength(rawResult, "utf8"),
         ...(usageRecord ? { usage: usageRecord } : {})
     });
-    const blackboardLinks = publishWorkerOutputToBlackboard(run, scope, task, parsedResult.summary, destination, absoluteResultPath, resultNode.evidence, acceptedAudit.id);
+    accept.output = output;
+}
+/** Step 7 — fanOut: publish the accepted output to the blackboard and record the
+ *  multi-agent worker output (linking the blackboard message/artifact refs). */
+function fanOutWorkerOutput(accept) {
+    const { run, workerId, scope, task, absoluteResultPath, parsedResult, destination, resultNode, verifierNodeId, acceptedAuditId } = accept;
+    const blackboardLinks = publishWorkerOutputToBlackboard(run, scope, task, parsedResult.summary, destination, absoluteResultPath, resultNode.evidence, acceptedAuditId);
     (0, multi_agent_1.recordMultiAgentWorkerOutput)(run, {
         workerId,
         taskId: task.id,
         resultNodeId: resultNode.id,
-        verifierNodeId: verifierResult.outputNodeId,
+        verifierNodeId,
         evidence: resultNode.evidence,
         artifactPaths: [destination, absoluteResultPath],
         blackboardMessageIds: blackboardLinks.messageIds,
         blackboardArtifactRefIds: blackboardLinks.artifactRefIds
     });
-    if (options.persist !== false)
-        (0, state_1.saveCheckpoint)(run);
-    return output;
 }
 function recordWorkerFailure(run, workerId, error, options = {}) {
     const scope = requireWorkerScope(run, workerId);
@@ -786,7 +879,19 @@ function loadWorkerScopesFromDisk(run) {
         .filter((entry) => entry.isDirectory())
         .map((entry) => node_path_1.default.join(workerRoot(run), entry.name, paths_1.WORKER_SCOPE_FILE))
         .filter((file) => node_fs_1.default.existsSync(file))
-        .map((file) => JSON.parse(node_fs_1.default.readFileSync(file, "utf8")));
+        .map((file) => {
+        // One corrupt/partially-written worker.json must not blank the whole
+        // listing (summarizeWorkers/listWorkerScopes) — skip it with a diagnostic
+        // and surface every worker that IS readable.
+        try {
+            return (0, validation_1.validateWorkerScope)(JSON.parse(node_fs_1.default.readFileSync(file, "utf8")));
+        }
+        catch (error) {
+            process.stderr.write(`cw: skipping unreadable worker scope ${file}: ${error instanceof Error ? error.message : String(error)}\n`);
+            return undefined;
+        }
+    })
+        .filter((scope) => scope !== undefined);
 }
 function requireWorkerScope(run, workerId) {
     const scope = getWorkerScope(run, workerId);