forgeos 0.1.0-alpha.70 → 0.1.0-alpha.71

package/examples/agent-fabric-v2/README.md

@@ -52,3 +52,19 @@ The owner registry is project configuration, not workflow input. `cache: none` i
 default. Only commands declared to depend entirely on their captured workspace inputs
 may opt into `cache: workspace`; the owner must account for external inputs. SDK output
 reuse is disabled until its effective instruction closure can be attested.
+
+## Current workflow runtime and UI example
+
+`ui-audit.workflow.ts` uses the current operatorVersion 2 architecture directly. `run-ui-fixture.ts` is a disposable local integration example: twenty HTML pages, three known defects, command-only agents, item and final checks, capture receipts, compose and gate. Run `node bin/forge-bun.mjs run examples/agent-fabric-v2/run-ui-fixture.ts` from the Forge checkout. It sets the no-LLM fuse and never applies to a user project.
+
+`runUiFixture(count, defects, browserPath?)` also accepts an explicit Chromium/Edge executable for real local headless screenshots; the default uses valid PNG fixtures. Both reviewers are deterministic checks of fixture attributes, not visual AI evaluation. The worker's cooperative process capability must be owner-authorized.
+
+The static lowerer and TS author API share the same example including `as const`, `satisfies`, typed refs and scoped checks. Arbitrary TS execution is unsupported. Legacy file-conversion example remains a separate usage example, not a compatibility interpreter. See docs/agent-fabric-programs.md for all fifty author constructors and fifteen controls.
+
+## Typed reusable subworkflow and visual cases
+
+`item-child.workflow.ts` is a finite typed inspection program. Lower it and register its IR as `inspect-item@v2`; the root `map-child.workflow.ts` calls it with explicit input and a map quota of one. Supply owner schemas `path@v2` (object path:string), `inspection@v2` (object ok:boolean), `any@v2`, policy `local@v2`, acceptance `data@v2`, and executor `inspect@v2` with inputSchema path@v2/output schema inspection@v2. These are templates, not automatically installed executors. Child quotas/cancellation inherit from the root; keep the same policy/acceptance.
+
+`visual-population.json` demonstrates separate desktop/ready and mobile/error cases for one route. Replace the baseline placeholder with the owner-captured digest and enumerate all required scenarios. Matching itemKey alone cannot close a visual case when route, viewport, state or dimensions differ. Image header validation is not proof of visual correctness.
+
+Use program-explain to retrieve the template graph, observed expansions and a Mermaid diagram. Format 3 runs live in program-runs-v3; older checkpoint directories are preserved and not loaded.

package/examples/agent-fabric-v2/item-child.workflow.ts

@@ -0,0 +1,11 @@
+import { defineWorkflow, schemaRef, policyRef, acceptanceRef, executorRef, workflowInput, agent, output } from "forgeos/agent-fabric/workflows";
+
+// Register this IR as inspect-item@v2. Owner schemas/executor remain authoritative.
+const inspect = agent("inspect", {
+  executor: executorRef<{ path: string }, { ok: boolean }>("inspect", "v2"),
+  input: workflowInput<{ path: string }>()
+});
+export default defineWorkflow({
+  id: "inspect-item", version: 2, mode: "data", inputSchema: schemaRef("path", "v2"), outputSchema: schemaRef("inspection", "v2"),
+  policy: policyRef("local", "v2"), acceptance: acceptanceRef("data", "v2"), steps: [inspect], result: output(inspect)
+});

package/examples/agent-fabric-v2/map-child.workflow.ts

@@ -0,0 +1,10 @@
+import { defineWorkflow, schemaRef, policyRef, acceptanceRef, programRef, map, subworkflow, item, field, output } from "forgeos/agent-fabric/workflows";
+
+export default defineWorkflow({
+  id: "inspect-files", version: 2, mode: "data", inputSchema: schemaRef("any", "v2"), outputSchema: schemaRef("any", "v2"),
+  policy: policyRef("local", "v2"), acceptance: acceptanceRef("data", "v2"),
+  steps: [map("files", {
+    items: [{ path: "src/a.ts" }, { path: "src/b.ts" }], key: field(item(), "path"), concurrency: 1, completion: "all-required",
+    body: subworkflow("inspect", { program: programRef<{ path: string }, { ok: boolean }>("inspect-item", "v2"), input: item<{ path: string }>() })
+  })], result: output("files")
+});

package/examples/agent-fabric-v2/migrate.workflow.ts

@@ -1,7 +1,7 @@
 import { defineWorkflow, schemaRef, policyRef, acceptanceRef, populationRef, executorRef, recipeRef, agent, map, field, item, output, population, coverageFor, repair, candidateFromBaseline, compose, acceptedCandidates, outputCandidate, acceptedCandidate, gate, coverageReceipt } from "forgeos/agent-fabric/workflows";
 
 const recipe = {
-  recipe: recipeRef("repair", "v1"),
+  recipe: recipeRef("repair", "v2"),
   implement: executorRef("migrate", "v1"), review: executorRef("review", "v1"),
   checks: ["check@v1"], maxRepairRounds: 3, maxAssessmentAttempts: 6,
   maxInfrastructureAttempts: 2,

package/examples/agent-fabric-v2/run-ui-fixture.ts

@@ -0,0 +1,48 @@
+import { mkdtemp, mkdir, writeFile, readFile, rm } from "node:fs/promises";
+import { spawnSync } from "node:child_process";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { ProgramRunService } from "../../src/forge/agent-fabric/program-service.ts";
+import { programDigest, type ProgramRegistry, type ProgramRunV2 } from "../../src/forge/agent-fabric/program-contract.ts";
+import { lowerWorkflowSource, schemaRef } from "../../src/forge/agent-fabric/program-dsl.ts";
+
+export async function runUiFixture(count = 20, defects = [2, 9, 17], browserPath?: string) {
+  const root = await mkdtemp(join(tmpdir(), "forge-ui-fixture-"));
+  let service: ProgramRunService | undefined;
+  const startedAt = performance.now();
+  try {
+    await mkdir(join(root, "src")); await mkdir(join(root, ".forge"));
+    for (let index = 0; index < count; index++) await writeFile(join(root, "src", `ui-${String(index).padStart(2, "0")}.html`), `<!doctype html><html><title>UI ${index}</title><body data-fixture="${defects.includes(index) ? "bad" : "good"}"><h1>Local fixture ${index}</h1></body></html>`);
+    for (const args of [["init", "--quiet"], ["add", "src"], ["-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid", "commit", "--quiet", "-m", "UI fixture baseline"]]) {
+      const result = spawnSync("git", args, { cwd: root, encoding: "utf8", windowsHide: true }); if (result.status) throw new Error(result.stderr);
+    }
+    const registry: ProgramRegistry = { schemas: { "any@v2": {} }, executors: {}, policies: {}, acceptance: {}, populations: {} };
+    const worker = fileURLToPath(new URL("./ui-fixture-worker.cjs", import.meta.url));
+    for (const id of ["discover", "capture", "implement", "review", "local-check", "global-check"]) registry.executors[`${id}@v2`] = {
+      id, version: "v2", kind: "command", effect: id === "implement" ? "isolated-write" : "read", role: id === "implement" ? "implementer" : id === "review" ? "reviewer" : "investigator",
+      argv: [process.execPath, worker, id, ...(id === "capture" && browserPath ? [browserPath] : [])], timeoutMs: id === "capture" && browserPath ? 120000 : 10000, writeScope: id === "implement" ? ["src"] : [], network: "host", isolation: "cooperative", schema: schemaRef("any", "v2")
+    };
+    registry.policies["local@v2"] = { id: "local", version: "v2", concurrency: 4, maxItems: 100, maxAttempts: 500, maxOperations: 2000, maxDepth: 12, deadlineMs: 240000, maxOutputBytes: 4 * 1024 * 1024, writeScope: ["src"], executors: Object.keys(registry.executors), allowNetwork: true, allowCooperativeCommands: true };
+    registry.acceptance["ui@v2"] = { id: "ui", version: "v2", criteria: ["Known fixture attributes are correct"], requireReview: true, allowNoWork: false, writeScope: ["src"], requiredChecks: [],
+      requiredChecksByScope: { item: ["local-check@v2"], final: ["global-check@v2"] }, assessmentBindings: { page: "item", final: "final" },
+      obligations: [{ id: "layout", scope: "item", criteria: ["known fixture constraint"], requiredEvidence: ["capture"] }, { id: "integration", scope: "final", criteria: ["all pages correct together"] }] };
+    registry.populations["pages@v2"] = { id: "pages", version: "v2", members: [], baselineDigest: "owner-capture", inventoryRoots: ["src"], extensions: [".html"], exclusions: [], allowNoWork: false, evidence: "owner filesystem inventory" };
+    await writeFile(join(root, ".forge/fabric-programs.json"), JSON.stringify(registry));
+    const source = await readFile(new URL("./ui-audit.workflow.ts", import.meta.url), "utf8"), program = lowerWorkflowSource(source);
+    service = await ProgramRunService.open(root);
+    const initial = await service.execute("program-start", { requestId: "ui-fixture", program, input: {} }) as ProgramRunV2;
+    let run: ProgramRunV2;
+    do { await new Promise(resolve => setTimeout(resolve, 20)); run = (await service.store.read(initial.runId))!; } while (run.status === "executing");
+    if (run.status !== "acceptance-ready") throw new Error(`UI fixture failed: ${run.status}: ${run.reason}`);
+    const assessment = Object.values(run.assessments).find(receipt => receipt.phase === "final")!;
+    const implementations = Object.values(run.attempts).filter(attempt => attempt.operationId.endsWith("/implement"));
+    const beforeApply = await readFile(join(root, "src", `ui-${String(defects[0] ?? 0).padStart(2, "0")}.html`), "utf8");
+    const report = { datasetDigest: programDigest({ count, defects }), pages: count, knownDefects: defects.length, implementations: implementations.length, attempts: run.totalAttempts,
+      captures: Object.keys(run.artifactRecords ?? {}).length, finalObligations: assessment.satisfiedObligationIds?.length, finalCaptures: assessment.evidenceRefs?.length,
+      destinationPreserved: beforeApply.includes(`data-fixture="${defects.length ? "bad" : "good"}"`), llmCalls: 0, elapsedMs: Math.round(performance.now() - startedAt), storage: service.store.metrics,
+      captureMode: browserPath ? "local-headless-browser" : "png-fixture", limitations: [browserPath ? "Local browser rendering; no visual model evaluation" : "PNG fixtures; no browser rendering or visual model evaluation", "Cooperative command isolation", "No automatic apply; no Claude benchmark"] };
+    return report;
+  } finally { await service?.close(); await rm(root, { recursive: true, force: true }); }
+}
+if (import.meta.main) { process.env.FORGE_FABRIC_TEST_MODE = "1"; console.log(JSON.stringify(await runUiFixture(), null, 2)); }

package/examples/agent-fabric-v2/ui-audit.workflow.ts

@@ -0,0 +1,28 @@
+import { defineWorkflow, schemaRef, executorRef, policyRef, acceptanceRef, populationRef, recipeRef, agent, map, repair, compose, gate, field, item, output, population, coverageFor, candidateFromBaseline, acceptedCandidates, outputCandidate, acceptedCandidate, coverageReceipt, type WorkflowOptions } from "forgeos/agent-fabric/workflows";
+
+const repairPolicy = {
+  recipe: recipeRef("repair", "v2"), implement: executorRef("implement", "v2"), review: executorRef("review", "v2"), evidence: [executorRef("capture", "v2")],
+  entryMode: "assess-first", maxRepairRounds: 3, maxAssessmentAttempts: 6, maxInfrastructureAttempts: 2,
+  progressPolicy: { unchangedCandidateRounds: 2, repeatedFindingsRounds: 2 }
+} as const;
+const itemRepair = {
+  ...repairPolicy, evidence: [executorRef("capture", "v2")], assessmentScope: "item", checks: ["local-check@v2"], initialCandidate: candidateFromBaseline(item()), writeScope: field(item(), "allowedPaths")
+} satisfies WorkflowOptions["repair"];
+
+export default defineWorkflow({
+  id: "ui-audit", version: 1, operatorVersion: 2, mode: "candidate", inputSchema: schemaRef("any", "v2"), outputSchema: schemaRef("any", "v2"),
+  policy: policyRef("local", "v2"), acceptance: acceptanceRef("ui", "v2"), population: populationRef("pages", "v2"),
+  steps: [
+    agent("discover", { executor: executorRef("discover", "v2"), input: {} }),
+    map("pages", {
+      items: field(output("discover"), "items"), key: field(item(), "id"), coverage: coverageFor(population(), output("discover")), completion: "all-required", concurrency: 4,
+      body: repair("page", itemRepair)
+    }),
+    compose("integrated", { candidates: acceptedCandidates("pages"), onConflict: "needs-resolution" }),
+    repair("final", {
+      ...repairPolicy, evidence: [executorRef("capture", "v2")], assessmentScope: "final", checks: ["global-check@v2"],
+      initialCandidate: outputCandidate("integrated"), writeScope: ["src"]
+    }),
+    gate("ready", { candidate: acceptedCandidate("final"), coverage: coverageReceipt("pages") })
+  ], result: output("ready")
+});

package/examples/agent-fabric-v2/ui-fixture-worker.cjs

@@ -0,0 +1,36 @@
+// Deterministic fixture worker. Does not call an LLM or make network requests.
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { pathToFileURL } = require('node:url');
+const role = process.argv[2];
+const data = JSON.parse(fs.readFileSync(process.env.FORGE_PROGRAM_INPUT_PATH, 'utf8'));
+const context = data.assessmentContext;
+const inventory = () => fs.readdirSync('src').filter(name => name.endsWith('.html')).sort().map(name => ({ id: 'src/' + name, allowedPaths: ['src/' + name] }));
+const items = data.workItem ? [data.workItem] : inventory();
+const invalid = () => items.filter(item => !fs.readFileSync(item.id, 'utf8').includes('data-fixture="good"'));
+let result;
+if (role === 'discover') result = { items: inventory() };
+else if (role === 'implement') {
+  for (const item of invalid()) fs.writeFileSync(item.id, fs.readFileSync(item.id, 'utf8').replace('data-fixture="bad"', 'data-fixture="good"'));
+  result = { summary: 'Repaired known fixture attributes' };
+} else if (role === 'review') {
+  const findings = invalid().map(item => ({ itemKey: item.id, reason: 'Known deterministic fixture defect' }));
+  result = { verdict: findings.length ? 'changes_requested' : 'approved', findings, coveredObligationIds: context.obligationIds };
+} else if (role === 'local-check' || role === 'global-check') result = { passed: invalid().length === 0 };
+else if (role === 'capture') {
+  // A valid PNG fixture proves artifact transport/binding, not browser rendering.
+  const bytes = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+aGfoAAAAASUVORK5CYII=', 'base64');
+  result = { evidenceArtifacts: items.map((item, index) => {
+    const name = 'capture-' + index + '.png', file = path.join(process.env.FORGE_PROGRAM_SCRATCH_DIRECTORY, name);
+    const browser = process.argv[3];
+    if (browser) {
+      const profile = path.join(process.env.FORGE_PROGRAM_SCRATCH_DIRECTORY, 'profile-' + index);
+      const rendered = spawnSync(browser, ['--headless', '--disable-gpu', '--disable-extensions', '--disable-background-networking', '--no-first-run', '--no-default-browser-check', '--hide-scrollbars', '--window-size=800,600', '--user-data-dir=' + profile, '--screenshot=' + file, pathToFileURL(path.resolve(item.id)).href], { windowsHide: true, timeout: 15000, stdio: 'pipe' });
+      if (rendered.error || rendered.status !== 0 || !fs.existsSync(file)) throw new Error('Headless browser capture failed');
+    } else fs.writeFileSync(file, bytes);
+    const image = fs.readFileSync(file), width = image.readUInt32BE(16), height = image.readUInt32BE(20);
+    return { path: name, itemKey: item.id, buildDigest: data.candidateDigest, environmentRef: context.environmentRef, mime: 'image/png', width, height, route: '/' + item.id, viewport: width + 'x' + height, state: browser ? 'local-browser-render' : 'deterministic-fixture' };
+  }) };
+} else throw new Error('Unknown fixture role');
+console.log(JSON.stringify(result));

package/examples/agent-fabric-v2/visual-population.json

@@ -0,0 +1,13 @@
+{
+  "id": "checkout-cases",
+  "version": "v2",
+  "members": ["checkout-desktop-ready", "checkout-mobile-error"],
+  "exclusions": [],
+  "baselineDigest": "OWNER_MUST_SUPPLY_CAPTURED_BASELINE_DIGEST",
+  "evidence": "Owner catalog of required checkout scenarios; extend explicitly for every route, viewport and state",
+  "allowNoWork": false,
+  "visualCases": [
+    { "itemKey": "checkout-desktop-ready", "route": "/checkout", "viewport": "desktop", "state": "ready", "width": 1440, "height": 900 },
+    { "itemKey": "checkout-mobile-error", "route": "/checkout", "viewport": "mobile", "state": "error", "width": 390, "height": 844 }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgeos",
-  "version": "0.1.0-alpha.70",
+  "version": "0.1.0-alpha.71",
   "description": "Agent-native application framework and compiler for building Forge apps without a mandatory dashboard.",
   "type": "module",
   "license": "MIT",
@@ -26,6 +26,8 @@
     "docs/architecture/agent-fabric/WORKFLOW_PROGRAM_V2_PLAN.md",
     "docs/architecture/agent-fabric/WORKFLOW_PROGRAM_V2_ADR.md",
     "docs/architecture/agent-fabric/WORKFLOW_PROGRAM_V2_EVIDENCE.md",
+    "docs/architecture/agent-fabric/WORKFLOW_PROGRAM_V2_CORRECTIONS.md",
+    "docs/architecture/agent-fabric/WORKFLOW_PROGRAM_V2_CORRECTIONS_EVIDENCE.md",
     "examples/go-billing/",
     "examples/agent-fabric-v2/",
     "examples/java-billing/",

package/src/forge/_generated/releaseManifest.json

@@ -1 +1 @@
-{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.70","releaseId":"forgeos@0.1.0-alpha.70+unknown","schemaVersion":"0.1.0"}
+{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.71","releaseId":"forgeos@0.1.0-alpha.71+unknown","schemaVersion":"0.1.0"}

package/src/forge/_generated/releaseManifest.ts

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.70 input=c9c2b146d0cb312a96b8d2ba635c2e26634645a24895b1d003e2f65ae17a3e02 content=0b7cd4e138639e7ccdf2e6723e47f5d231465b6da9b553bb37ba21b68ceb2c5b
+// @forge-generated generator=0.1.0-alpha.71 input=c1757bb141bbcdd4d235a6d1af230b3a767ec7e4354f7fc3afb49fd46e893f06 content=cd16693ecfd3d8410340a10ca8d2fbd0c9a99361acd460af97c00a8c58a5032d
 export const releaseManifest = {
   "defaultProvider": "local",
   "diagnostics": [],
@@ -19,7 +19,7 @@ export const releaseManifest = {
     "custom"
   ],
   "packageName": "forgeos",
-  "packageVersion": "0.1.0-alpha.70",
-  "releaseId": "forgeos@0.1.0-alpha.70+unknown",
+  "packageVersion": "0.1.0-alpha.71",
+  "releaseId": "forgeos@0.1.0-alpha.71+unknown",
   "schemaVersion": "0.1.0"
 } as const;

package/src/forge/agent-fabric/codex-sdk-worker.ts

@@ -165,6 +165,7 @@ async function runCodexWorkerInternal(input: CodexWorkerInput, factory: CodexWor
 }
 
 export async function runCodexWorker(input: CodexWorkerInput, factory?: CodexWorkerFactory): Promise<CodexWorkerOutput> {
+  if (process.env.FORGE_FABRIC_TEST_MODE === "1" && !factory) fail("AF_CODEX_TEST_MODE", "Real LLM calls forbidden; provide a simulated SDK factory");
   try { return await runCodexWorkerInternal(input, factory ?? ((options) => isolatedCodexClient(options, input.cwd, input.signal))); }
   catch (error) {
     if (error instanceof CodexWorkerError) throw error;
@@ -196,6 +197,7 @@ async function runTypedCodexWorkerInternal(input: CodexWorkerInput & { outputSch
   return { threadId, data, ...(observedUsage ? { usage: observedUsage } : {}) };
 }
 export async function runTypedCodexWorker(input: CodexWorkerInput & { outputSchema: unknown; validateOutput: (data: unknown) => void }, factory?: CodexWorkerFactory): Promise<{ threadId: string; data: unknown; usage?: CodexWorkerUsage }> {
+  if (process.env.FORGE_FABRIC_TEST_MODE === "1" && !factory) fail("AF_CODEX_TEST_MODE", "Real LLM calls forbidden; provide a simulated SDK factory");
   try { return await runTypedCodexWorkerInternal(input, factory); }
   catch (error) { if (error instanceof CodexWorkerError) throw error; fail("AF_CODEX_EXECUTION", "Typed SDK or persistence failed; reconcile before retry"); }
 }

package/src/forge/agent-fabric/program-api.ts

@@ -0,0 +1,37 @@
+import type { ProgramExpr, ProgramOperation, ProgramRef, WorkflowProgramV2 } from "./program-contract.ts";
+import type { ProgramBlock } from "./program-structure.ts";
+
+declare const registryKind: unique symbol;
+declare const inputType: unique symbol;
+declare const outputType: unique symbol;
+export type WorkflowExpression<T = unknown> = ProgramExpr & { readonly [outputType]?: T };
+export type WorkflowValue<T> = T | WorkflowExpression<T> | (T extends readonly (infer E)[] ? WorkflowValue<E>[] : T extends object ? { [K in keyof T]: WorkflowValue<T[K]> } : never);
+export type WorkflowResolved<T> = T extends WorkflowExpression<infer V> ? V : T extends readonly unknown[] ? { [K in keyof T]: WorkflowResolved<T[K]> } : T extends object ? { [K in keyof T]: WorkflowResolved<T[K]> } : T;
+export type WorkflowRef<K extends string, Input = unknown, Output = unknown> = ProgramRef & { readonly [registryKind]: K; readonly [inputType]?: Input; readonly [outputType]?: Output };
+export type WorkflowDefinition = Omit<WorkflowProgramV2, "schemaVersion" | "inputSchema" | "outputSchema" | "policy" | "acceptance" | "population"> & {
+  inputSchema: WorkflowRef<"schema">; outputSchema: WorkflowRef<"schema">;
+  policy: WorkflowRef<"policy">; acceptance: WorkflowRef<"acceptance">; population?: WorkflowRef<"population">;
+};
+type Data = unknown;
+export type WorkflowCollection<T> = { items: ({ key: string; outcome: "completed"; value: T } | { key: string; outcome: "failed" | "waiting"; reason?: string })[]; results: T[]; failures: { id: string; reason: string }[]; seal: string; coverage: unknown; status: "completed" | "partial" | "no-work" };
+export type WorkflowBody<T> = WorkflowOperation<keyof WorkflowOptions, T> | (ProgramBlock & { result: WorkflowValue<T> });
+type Body = ProgramOperation | ProgramBlock;
+interface Common { after?: string[]; label?: string }
+interface Activity extends Common { executor: WorkflowRef<"executor">; input?: Data; candidate?: Data; writeScope?: Data }
+export interface WorkflowOptions {
+  value: Common & { value: Data };
+  agent: Activity;
+  command: Activity;
+  map: Common & { items: Data; key: Data; coverage?: Data; completion: "all-required" | "partial" | "quorum"; quorum?: { minAccepted: number }; concurrency?: number; order?: "key" | "input"; body: Body };
+  branch: Common & { condition: boolean | ProgramExpr; then: Body; else: Body };
+  loop: Common & { initialState: Data; maxRounds: number; body: Body; next: Data; until: boolean | ProgramExpr };
+  repair: Common & { recipe: WorkflowRef<"recipe">; implement: WorkflowRef<"executor">; review: WorkflowRef<"executor">; checks: Data; input?: Data; evidence?: WorkflowRef<"executor">[]; assessmentScope?: "item" | "final"; entryMode: "implement-first" | "assess-first"; initialCandidate: Data; writeScope: Data; maxRepairRounds: number; maxAssessmentAttempts: number; maxInfrastructureAttempts: number; progressPolicy: { unchangedCandidateRounds: number; repeatedFindingsRounds: number } };
+  compose: Common & { candidates: Data; onConflict?: "needs-resolution" };
+  gate: Common & { candidate: Data; coverage?: Data; authorization?: Data };
+  subworkflow: Common & { program: WorkflowRef<"program">; input: Data };
+  waitEvent: Common & { type: string; correlation: Data; schema: WorkflowRef<"schema">; subject?: Data; timeoutMs?: number };
+  sequence: Common & ProgramBlock;
+  parallel: Common & ProgramBlock & { onFailure: "collect-all" | "cancel-siblings" };
+}
+export type WorkflowOperation<K extends keyof WorkflowOptions = keyof WorkflowOptions, Output = unknown> = ProgramOperation & { kind: K; readonly [outputType]?: Output };
+export type WorkflowActivityOptions<Input, Output> = Omit<WorkflowOptions["agent"], "executor" | "input"> & { executor: WorkflowRef<"executor", Input, Output>; input?: WorkflowValue<NoInfer<Input>> };

package/src/forge/agent-fabric/program-contract.ts

@@ -1,5 +1,7 @@
 import { createHash } from "node:crypto";
 import { stableStringify } from "./canonical.ts";
+import { programGraph } from "./program-structure.ts";
+import { validateVisualPopulation } from "./program-evidence.ts";
 import { validateProgramTypes } from "./program-types.ts";
 
 export type ProgramValue = null | boolean | number | string | ProgramValue[] | { [key: string]: ProgramValue };
@@ -7,7 +9,8 @@ export interface ProgramRef { id: string; version: string }
 export interface ProgramExpr { $expr: string; args: unknown[] }
 export interface ProgramOperation { kind: string; id: string; options: Record<string, unknown> }
 export interface WorkflowProgramV2 {
-  operatorVersion?: 1;
+  operatorVersion?: 2;
+  mode?: "data" | "candidate";
   schemaVersion: 2; id: string; version: number; inputSchema: ProgramRef; outputSchema: ProgramRef;
   acceptance: ProgramRef; population?: ProgramRef; policy: ProgramRef; steps: ProgramOperation[]; result: unknown;
 }
@@ -15,12 +18,14 @@ export type ProgramSchema = { type?: string | string[]; enum?: ProgramValue[]; c
   properties?: Record<string, ProgramSchema>; required?: string[]; additionalProperties?: boolean;
   items?: ProgramSchema; minItems?: number; maxItems?: number; minLength?: number; maxLength?: number;
   minimum?: number; maximum?: number; anyOf?: ProgramSchema[] };
+export interface ProgramLexicalContext { item?: ProgramSchema; state?: ProgramSchema }
 export interface ProgramExecutor {
   id: string; version: string; kind: "command" | "codex"; effect: "read" | "isolated-write" | "idempotent-effect" | "non-idempotent-effect";
   argv?: string[]; prompt?: string; role?: "implementer" | "reviewer" | "investigator" | "decision";
   model?: string; timeoutMs: number; writeScope: string[]; allowedGeneratedPaths?: string[];
   network: "disabled" | "host"; isolation: "cooperative" | "sandbox"; schema: ProgramRef;
   allowedExitCodes?: number[]; environment?: Record<string, string>;
+  inputSchema?: ProgramRef;
   dependencies?: "none" | "auto";
   cache?: "none" | "workspace";
 }
@@ -34,8 +39,15 @@ export interface ProgramPolicy {
 export interface ProgramAcceptance {
   id: string; version: string; criteria: string[]; writeScope: string[];
   requiredChecks: string[]; requireReview: boolean; allowNoWork: boolean;
+  requiredChecksByScope?: { item: string[]; final: string[] };
+  assessmentBindings?: Record<string, "item" | "final">;
+  obligations?: { id: string; scope: "item" | "final"; criteria: string[]; requiredEvidence?: string[] }[];
+  allowPartial?: boolean;
+  requireHumanApproval?: boolean;
 }
+export interface ProgramVisualCase { itemKey: string; route: string; viewport: string; state: string; width: number; height: number }
 export interface ProgramPopulation {
+  visualCases?: ProgramVisualCase[];
   inventoryRoots?: string[]; extensions?: string[];
   id: string; version: string; members: string[]; exclusions: { id: string; reason: string }[];
   baselineDigest: string; evidence: string; allowNoWork: boolean;
@@ -48,6 +60,8 @@ export interface ProgramRegistry {
 export interface ProgramAssessment {
   receiptId?: string; generation?: number; operationId?: string;
   semanticDigest?: string; inputDigest?: string;
+  phase?: "item" | "final"; obligationIds?: string[]; satisfiedObligationIds?: string[]; unsatisfiedObligationIds?: string[];
+  environmentRef?: string; evidenceRefs?: string[]; contractDigest?: string;
   candidateDigest: string; verdict: "approved" | "changes_requested" | "inconclusive";
   findings: unknown[]; checks: { id: string; passed: boolean }[]; attemptIds: string[];
 }
@@ -63,6 +77,7 @@ export interface ProgramAttempt {
   executorDigest: string; startedAt: string; completedAt?: string;
   outcome: "running" | "completed" | "infrastructure_failed" | "invalid_output" | "uncertain" | "canceled_confirmed";
   outputRef?: string; threadId?: string; reason?: string;
+  reservation?: { scopes: { id: string; limit: number }[]; status: "held" | "released"; ownerEpoch: string };
   usage?: unknown;
 }
 export interface ProgramOperationRecord {
@@ -70,12 +85,12 @@ export interface ProgramOperationRecord {
   retired?: boolean;
   dependencies?: string[];
   id: string; semanticDigest: string; inputDigest: string; generation: number;
-  status: "running" | "completed" | "skipped" | "needs-attention" | "uncertain";
+  status: "declared" | "ready" | "running" | "waiting" | "completed" | "skipped" | "needs-attention" | "uncertain";
   outputRef?: string; attempts: string[]; reason?: string; reusedFromGeneration?: number;
 }
 export interface ProgramSignal {
   id: string; target: string; generation: number; type: string; correlation: string;
-  payloadRef: string; expiresAt?: string; status: "pending" | "consumed" | "pending-after-apply" | "stale";
+  payloadRef: string; authorization?: string; subjectDigest?: string; expiresAt?: string; status: "pending" | "consumed" | "pending-after-apply" | "stale";
 }
 export interface ProgramApplyIntent {
   requestId: string; requestDigest: string;
@@ -88,18 +103,37 @@ export interface ProgramRunV2 {
   program: WorkflowProgramV2; registry: ProgramRegistry; programDigest: string; registryDigest: string;
   inputRef: string; baselineDigest: string; baseRef?: string; createdAt: string; deadlineAt: string;
   version: number; semanticVersion: number; revision: number; planRevision: number;
-  status: "executing" | "paused" | "needs-attention" | "completed" | "acceptance-ready" | "applying" | "applied" | "apply-uncertain" | "canceled";
+  status: "executing" | "waiting" | "paused" | "needs-attention" | "completed" | "acceptance-ready" | "applying" | "applied" | "apply-uncertain" | "canceled";
   operations: Record<string, ProgramOperationRecord>; attempts: Record<string, ProgramAttempt>;
   seals: Record<string, string>; signals: ProgramSignal[]; candidates: Record<string, ProgramCandidate>;
   assessments: Record<string, ProgramAssessment>; coverageReceipts: Record<string, { populationDigest: string; baselineDigest: string; ids: string[]; status: string }>;
   deltas: Record<string, { artifactRef: string; inputCandidateDigest: string; outputCandidateDigest: string; producerAttemptId: string }>;
   waits: Record<string, { generation: number; deadlineAt?: string; signalId?: string; outputRef?: string }>;
-  repairs: Record<string, { semanticDigest: string; inputDigest: string; candidate: ProgramCandidate; rounds: number; assessments: number; infrastructure: number; unchanged: number; repeated: number; priorFindings: string; feedback: unknown; phase: "implement" | "assess" | "assessment-active" | "decide" | "accepted" | "exhausted" | "stalled"; assessment?: ProgramAssessment }>;
+  repairs: Record<string, { semanticDigest: string; inputDigest: string; candidate: ProgramCandidate; rounds: number; assessments: number; infrastructure: number; unchanged: number; repeated: number; priorFindings: string; feedback: unknown; phase: "implement" | "implementation-active" | "assess" | "assessment-active" | "decide" | "accepted" | "exhausted" | "stalled"; assessment?: ProgramAssessment }>;
   collections: Record<string, { seal: string; coverageReceiptId: string | null; generation: number; ids: string[]; acceptedAssessmentIds: string[]; acceptedCandidateIds: string[]; obligationsSatisfied: boolean }>;
   resultRef?: string; gateRef?: string; intent?: ProgramApplyIntent; receiptRef?: string;
   acceptedCandidate?: ProgramCandidate;
+  scopeResults?: Record<string, { outcomes: { id: string; status: string; reason?: string }[]; status: "completed" | "waiting" | "failed"; resultRef?: string }>;
+  artifactRecords?: Record<string, ProgramCaptureReceipt>;
+  queue?: { id: string; generation: number; at: string }[];
   totalAttempts: number; reason?: string;
 }
+export interface ProgramAssessmentContext {
+  visualCases?: ProgramVisualCase[];
+  runId: string; invocationId: string; assessmentId: string; phase: "item" | "final";
+  candidateRef: ProgramCandidate; obligationIds: string[]; itemKey?: string;
+  environmentRef: string; evidenceRefs: string[]; input: unknown;
+}
+export type ProgramCollectionItem = { key: string; outcome: "completed"; value: unknown } | { key: string; outcome: "failed" | "waiting"; reason?: string };
+export interface ProgramCollectionResult {
+  items: ProgramCollectionItem[]; results: unknown[]; failures: { id: string; reason: string }[];
+  seal: string; coverage: unknown; status: "completed" | "partial" | "no-work";
+}
+export interface ProgramCaptureReceipt {
+  receiptId: string; artifactRef: string; candidateDigest: string; environmentRef: string;
+  itemKey: string; buildDigest: string; mime: string; width: number; height: number;
+  route: string; viewport: string; state: string; producerAttemptId: string;
+}
 export class ProgramError extends Error {
   constructor(readonly code: string, message: string) { super(message); this.name = "ProgramError"; }
 }
@@ -158,9 +192,10 @@ export function programPath(path: string): void {
   programAssert(path !== ".git" && !path.startsWith(".git/") && !path.startsWith(".forge/local/"), "Protected path");
 }
 export function programWithin(path: string, scope: string[]): boolean { return scope.some(prefix => path === prefix || path.startsWith(`${prefix}/`)); }
-export function validateWorkflowProgram(program: WorkflowProgramV2, registry: ProgramRegistry, ancestry: Set<string> = new Set()): void {
+export function validateWorkflowProgram(program: WorkflowProgramV2, registry: ProgramRegistry, ancestry: Set<string> = new Set(), lexical: ProgramLexicalContext = {}): void {
   programAssert(program?.schemaVersion === 2 && typeof program.id === "string" && program.id.length > 0 && Number.isSafeInteger(program.version) && program.version > 0, "Program v2 required");
-  programAssert(program.operatorVersion === undefined || program.operatorVersion === 1, "Unsupported operator version");
+  programAssert(program.operatorVersion === undefined || program.operatorVersion === 2, "Unsupported operator version");
+  programAssert(program.mode === undefined || ["data", "candidate"].includes(program.mode), "Invalid workflow mode");
   programValueBytes(program, 4 * 1024 * 1024); programValueBytes(registry, 4 * 1024 * 1024);
   const identity = programDigest(program); programAssert(!ancestry.has(identity), "Recursive subworkflow cycle"); ancestry = new Set([...ancestry, identity]); programAssert(ancestry.size <= 32, "Subworkflow depth exceeded");
   const schemaKeys = new Set(["type", "enum", "const", "properties", "required", "additionalProperties", "items", "minItems", "maxItems", "minLength", "maxLength", "minimum", "maximum", "anyOf"]);
@@ -179,11 +214,9 @@ export function validateWorkflowProgram(program: WorkflowProgramV2, registry: Pr
   programAssert(policy.concurrency <= 32 && policy.maxDepth <= 32 && policy.maxItems <= 10000 && policy.maxAttempts <= 10000 && policy.maxOperations <= 20000 && policy.maxOutputBytes <= 4 * 1024 * 1024, "Physical limits exceeded");
   for (const path of [...policy.writeScope, ...acceptance.writeScope, ...(policy.captureScope ?? [])]) programPath(path);
   programAssert(acceptance.criteria.length > 0 && new Set(acceptance.criteria).size === acceptance.criteria.length, "Acceptance criteria required and unique");
-  if (program.population) { const population = registryEntry(registry.populations, program.population); programAssert(population.members.length <= policy.maxItems && new Set(population.members).size === population.members.length && population.evidence.length > 0, "Population inventory invalid"); }
+  if (program.population) { const population = registryEntry(registry.populations, program.population); programAssert(population.members.length <= policy.maxItems && new Set(population.members).size === population.members.length && population.evidence.length > 0, "Population inventory invalid"); validateVisualPopulation(population); }
   const kinds = new Set(["agent", "command", "map", "branch", "loop", "compose", "gate", "repair", "subworkflow", "waitEvent", "value"]);
-  let count = 0;
   const expressions: Record<string, [number, number]> = { workflowInput: [0, 0], item: [0, 0], loopState: [0, 0], output: [1, 1], field: [2, 2], literal: [1, 1], object: [1, 1], array: [0, 10000], eq: [2, 2], and: [1, 100], or: [1, 100], not: [1, 1], concat: [1, 100], filter: [3, 3], unique: [2, 2], sort: [2, 2], take: [2, 2], length: [1, 1], population: [0, 0], acceptance: [0, 0], acceptedCandidate: [1, 1], acceptedCandidates: [1, 1], outputCandidate: [1, 1], candidateFromBaseline: [0, 1], coverageFor: [2, 2], coverageReceipt: [1, 1], acceptanceWriteScope: [1, 1], approvedChecksFor: [1, 1], acceptanceChecks: [1, 1] };
-  const graph = new Map<string, Set<string>>();
   function inspect(value: unknown, resolve: (id: string) => string | undefined, dependencies: Set<string>, depth = 0): void {
     programAssert(depth <= 32, "Expression nesting exceeded");
     if (!value || typeof value !== "object") return;
@@ -197,33 +230,54 @@ export function validateWorkflowProgram(program: WorkflowProgramV2, registry: Pr
     }
     for (const entry of Object.values(object)) inspect(entry, resolve, dependencies, depth + 1);
   }
-  const options: Record<string, string[]> = { value: ["value"], agent: ["executor", "input", "candidate", "writeScope"], command: ["executor", "input", "candidate", "writeScope"], map: ["items", "key", "coverage", "concurrency", "completion", "quorum", "body"], branch: ["condition", "then", "else"], loop: ["initialState", "maxRounds", "body", "next", "until"], repair: ["recipe", "entryMode", "initialCandidate", "writeScope", "implement", "review", "checks", "maxRepairRounds", "maxAssessmentAttempts", "maxInfrastructureAttempts", "progressPolicy", "onExhausted", "onUncertain", "preserveCandidateHistory"], compose: ["candidates", "onConflict"], gate: ["candidate", "obligations", "coverage"], subworkflow: ["program", "input"], waitEvent: ["schema", "type", "correlation", "timeoutMs", "onTimeout"] };
-  function walk(steps: ProgramOperation[], depth: number, prefix = "", parentResolve?: (id: string) => string | undefined): void {
-    programAssert(Array.isArray(steps) && depth <= policy.maxDepth, "Invalid template depth"); const ids = new Set<string>();
-    const resolve = (id: string): string | undefined => steps.some(step => step.id === id) ? `${prefix}${id}` : parentResolve?.(id);
-    for (const step of steps) {
-      programAssert(step && kinds.has(step.kind) && /^[A-Za-z][A-Za-z0-9_-]{0,79}$/.test(step.id) && !ids.has(step.id) && step.options && typeof step.options === "object", "Invalid/duplicate operation"); ids.add(step.id);
-      programAssert(Object.keys(step.options).every(key => options[step.kind].includes(key)), `Unknown ${step.kind} option`);
-      programAssert(++count <= policy.maxOperations, "Template limit exceeded");
-      const dependencies = new Set<string>(); graph.set(`${prefix}${step.id}`, dependencies);
-      inspect(Object.fromEntries(Object.entries(step.options).filter(([key]) => !["body", "then", "else", "next", "until"].includes(key))), resolve, dependencies);
-      if (step.kind === "map" || step.kind === "loop") { const body = Array.isArray(step.options.body) ? step.options.body as ProgramOperation[] : [step.options.body as ProgramOperation]; const childPrefix = `${prefix}${step.id}/body/`; walk(body, depth + 1, childPrefix, resolve); for (const child of body) dependencies.add(`${childPrefix}${child.id}`); const childResolve = (id: string) => body.some(step => step.id === id) ? `${childPrefix}${id}` : resolve(id); if (step.kind === "loop") { inspect(step.options.next, childResolve, dependencies); inspect(step.options.until, childResolve, dependencies); } }
-      if (step.kind === "map") programAssert(["all-required", "partial", "quorum"].includes(String(step.options.completion)), "Explicit map completion required");
-      if (step.kind === "branch") { walk(step.options.then as ProgramOperation[], depth + 1, `${prefix}${step.id}/then/`, resolve); walk(step.options.else as ProgramOperation[], depth + 1, `${prefix}${step.id}/else/`, resolve); for (const arm of ["then", "else"]) for (const child of step.options[arm] as ProgramOperation[]) dependencies.add(`${prefix}${step.id}/${arm}/${child.id}`); }
-      if (["agent", "command"].includes(step.kind)) registryEntry(registry.executors, step.options.executor as ProgramRef);
-      if (step.kind === "repair") { registryEntry(registry.executors, step.options.implement as ProgramRef); registryEntry(registry.executors, step.options.review as ProgramRef); programAssert(["implement-first", "assess-first"].includes(String(step.options.entryMode)), "Repair entryMode required"); programAssert((step.options.recipe as ProgramRef)?.id === "repair" && (step.options.recipe as ProgramRef)?.version === "v1", "Unsupported repair recipe"); }
-      if (step.kind === "repair") { programAssert(step.options.onExhausted === undefined || step.options.onExhausted === "needs-attention", "Unsupported exhaustion policy"); programAssert(step.options.onUncertain === undefined || step.options.onUncertain === "reconcile", "Unsupported uncertainty policy"); programAssert(step.options.preserveCandidateHistory === undefined || step.options.preserveCandidateHistory === true, "Candidate history is always preserved"); }
-      if (step.kind === "compose") programAssert(step.options.onConflict === undefined || step.options.onConflict === "needs-resolution", "Unsupported composition conflict policy");
-      if (step.kind === "waitEvent") programAssert(step.options.onTimeout === undefined || step.options.onTimeout === "needs-attention", "Unsupported timeout policy");
-      if (step.kind === "waitEvent") registryEntry(registry.schemas, step.options.schema as ProgramRef);
-      if (step.kind === "subworkflow") { const child = registryEntry(registry.programs ?? {}, step.options.program as ProgramRef); programAssert(programDigest(child.policy) === programDigest(program.policy) && programDigest(child.acceptance) === programDigest(program.acceptance), "Child cannot replace inherited policy/acceptance"); validateWorkflowProgram(child, registry, ancestry); }
+  const options: Record<string, string[]> = {
+    value: ["value"], agent: ["executor", "input", "candidate", "writeScope"], command: ["executor", "input", "candidate", "writeScope"],
+    map: ["items", "key", "coverage", "concurrency", "completion", "quorum", "body", "order"],
+    branch: ["condition", "then", "else"], loop: ["initialState", "maxRounds", "body", "next", "until"],
+    repair: ["recipe", "entryMode", "initialCandidate", "writeScope", "implement", "review", "checks", "input", "assessmentScope", "evidence", "maxRepairRounds", "maxAssessmentAttempts", "maxInfrastructureAttempts", "progressPolicy"],
+    compose: ["candidates", "onConflict"], gate: ["candidate", "coverage", "authorization"], subworkflow: ["program", "input"],
+    waitEvent: ["schema", "type", "correlation", "subject", "timeoutMs"], sequence: ["steps", "result"], parallel: ["steps", "result", "onFailure"],
+  };
+  kinds.add("sequence"); kinds.add("parallel");
+  const entries = programGraph(program);
+  programAssert(entries.length <= policy.maxOperations, "Template limit exceeded");
+  for (const entry of entries) {
+    const step = entry.step;
+    programAssert(step && kinds.has(step.kind) && /^[A-Za-z][A-Za-z0-9_-]{0,79}$/.test(step.id) && step.options && typeof step.options === "object", "Invalid operation");
+    programAssert(Object.keys(step.options).every(key => [...options[step.kind], "after", "label"].includes(key)), `Unknown ${step.kind} option`);
+    programAssert(entries.filter(other => other.id === entry.id).length === 1, "Duplicate operation ID");
+    inspect(Object.fromEntries(Object.entries(step.options).filter(([key]) => !["body", "steps", "result", "then", "else", "next", "until"].includes(key))), id => id, new Set());
+    programAssert(entry.id.split("/").length <= policy.maxDepth * 3 + 1, "Template depth exceeded");
+    if (step.kind === "map") {
+      programAssert(["all-required", "partial", "quorum"].includes(String(step.options.completion)), "Explicit map completion required");
+      programAssert(step.options.order === undefined || ["key", "input"].includes(String(step.options.order)), "Invalid map order");
+      if (step.options.completion !== "all-required") programAssert(acceptance.allowPartial, "Partial/quorum requires owner acceptance permission");
+      if (step.options.completion === "quorum") programAssert(step.options.quorum && typeof step.options.quorum === "object" && Number.isSafeInteger((step.options.quorum as { minAccepted: number }).minAccepted) && (step.options.quorum as { minAccepted: number }).minAccepted > 0, "Quorum minAccepted required");
+      else programAssert(step.options.quorum === undefined, "Quorum only applies to quorum completion");
+    }
+    if (["agent", "command"].includes(step.kind)) { const executor = registryEntry(registry.executors, step.options.executor as ProgramRef); if (executor.inputSchema) registryEntry(registry.schemas, executor.inputSchema); }
+    if (step.kind === "repair") {
+      registryEntry(registry.executors, step.options.implement as ProgramRef); registryEntry(registry.executors, step.options.review as ProgramRef);
+      programAssert(["implement-first", "assess-first"].includes(String(step.options.entryMode)), "Repair entryMode required");
+      programAssert((step.options.recipe as ProgramRef)?.id === "repair" && (step.options.recipe as ProgramRef)?.version === "v2", "Unsupported repair recipe");
+      const phase = step.options.assessmentScope as "item" | "final" | undefined;
+      programAssert(phase === undefined || phase === "item" || phase === "final", "Invalid assessment scope");
+      if (acceptance.requiredChecksByScope) {
+        programAssert(phase && acceptance.assessmentBindings?.[step.id] === phase, "Assessment scope must match owner operation binding");
+        if (phase === "item") programAssert(lexical.item || entries.some(ancestor => ancestor.step.kind === "map" && entry.id.startsWith(`${ancestor.id}/body/`)), "Item assessment requires a map context");
+      }
+      const required = phase && acceptance.requiredChecksByScope ? acceptance.requiredChecksByScope[phase] : acceptance.requiredChecks;
+      programAssert(Array.isArray(step.options.checks) && required.every(check => (step.options.checks as unknown[]).includes(check)), "Repair cannot omit required checks");
+      for (const ref of (step.options.evidence ?? []) as ProgramRef[]) programAssert(registryEntry(registry.executors, ref).effect === "read", "Evidence executor must be readonly");
     }
+    if (step.kind === "parallel") programAssert(["collect-all", "cancel-siblings"].includes(String(step.options.onFailure)), "Parallel failure policy required");
+    if (step.kind === "compose") programAssert(step.options.onConflict === undefined || step.options.onConflict === "needs-resolution", "Unsupported conflict policy");
+    if (step.kind === "waitEvent") registryEntry(registry.schemas, step.options.schema as ProgramRef);
+    if (step.kind === "subworkflow") { const child = registryEntry(registry.programs ?? {}, step.options.program as ProgramRef); programAssert(programDigest(child.policy) === programDigest(program.policy) && programDigest(child.acceptance) === programDigest(program.acceptance), "Child cannot replace inherited policy/acceptance"); programAssert(!child.population || program.population && programDigest(child.population) === programDigest(program.population), "Child cannot replace inherited population"); validateWorkflowProgram(child, registry, ancestry, { ...lexical, ...(entries.some(ancestor => ancestor.step.kind === "map" && entry.id.startsWith(`${ancestor.id}/body/`)) ? { item: {} } : {}), ...(entries.some(ancestor => ancestor.step.kind === "loop" && entry.id.startsWith(`${ancestor.id}/body/`)) ? { state: {} } : {}) }); }
   }
-  walk(program.steps, 0); programAssert(Object.hasOwn(program, "result"), "Explicit program result required");
+  programAssert(Object.hasOwn(program, "result"), "Explicit program result required");
   inspect(program.result, id => program.steps.some(step => step.id === id) ? id : undefined, new Set());
-  const visiting = new Set<string>(), visited = new Set<string>();
-  function visit(id: string): void { programAssert(!visiting.has(id), `Dependency cycle ${id}`); if (visited.has(id)) return; visiting.add(id); for (const dependency of graph.get(id) ?? []) visit(dependency); visiting.delete(id); visited.add(id); }
-  for (const id of graph.keys()) visit(id);
-  validateProgramTypes(program, registry);
+  if (acceptance.requiredChecksByScope) programAssert(acceptance.obligations?.length && new Set(acceptance.obligations.map(obligation => obligation.id)).size === acceptance.obligations.length, "Scoped acceptance requires unique owner obligations");
+  validateProgramTypes(program, registry, lexical);
   programDigest(program); programDigest(registry);
 }