harnery 0.12.2 → 0.14.0

package/dist/core/workflow/engine.js

@@ -30,8 +30,10 @@ import { isAbsolute, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { snapshotRepo } from "../context/index.js";
 import { evaluatePolicy, normalizePolicy, PolicyDeniedError, policyDigest, summarizePolicyRequest, } from "../policy/index.js";
+import { assertWorkflowRunId, createWorkflowApproval } from "./approvals.js";
 import { probeBilling } from "./billing.js";
 import { buildWorkflowProof, createEvidenceRecord, digestResult, normalizeWorkflowMeta, writeWorkflowProof, } from "./proof.js";
+import { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
 import { WORKFLOW_PROOF_SCHEMA_VERSION } from "./types.js";
 import { parseStageOutput, validateAgainstSchema } from "./validate.js";
 const DEFAULT_MAX_AGENTS = 50;
@@ -51,8 +53,61 @@ export class WorkflowRunError extends Error {
         this.proofPath = proofPath;
     }
 }
+export class WorkflowParkedError extends Error {
+    runId;
+    approvalId;
+    journalPath;
+    constructor(message, runId, approvalId, journalPath) {
+        super(message);
+        this.name = "WorkflowParkedError";
+        this.runId = runId;
+        this.approvalId = approvalId;
+        this.journalPath = journalPath;
+    }
+}
 export async function runWorkflow(scriptPath, opts) {
+    if (opts.runId && opts.resumeRunId) {
+        throw new Error("runId and resumeRunId are mutually exclusive");
+    }
+    if (opts.runId)
+        assertWorkflowRunId(opts.runId);
+    if (opts.workItemId && !/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(opts.workItemId)) {
+        throw new Error(`invalid work item id ${JSON.stringify(opts.workItemId)}`);
+    }
+    if (opts.resumeRunId && opts.resumeFrom) {
+        throw new Error("resumeRunId and resumeFrom are mutually exclusive");
+    }
+    const resumeState = opts.resumeRunId
+        ? assertWorkflowRunResumable(opts.coordRoot, opts.resumeRunId)
+        : undefined;
+    if (resumeState !== undefined &&
+        opts.workItemId !== undefined &&
+        resumeState.manifest.work_item_id !== opts.workItemId) {
+        throw new Error(`workflow run ${opts.resumeRunId} belongs to a different work item`);
+    }
     const absScript = isAbsolute(scriptPath) ? scriptPath : resolve(process.cwd(), scriptPath);
+    if (resumeState) {
+        if (resolve(resumeState.manifest.script.path) !== resolve(absScript)) {
+            throw new Error(`workflow run ${opts.resumeRunId} belongs to a different script`);
+        }
+        assertWorkflowScriptUnchanged(resumeState.manifest);
+    }
+    const releaseResumeLease = opts.resumeRunId
+        ? acquireWorkflowResumeLease(opts.coordRoot, opts.resumeRunId)
+        : undefined;
+    try {
+        if (resumeState) {
+            // Recheck under the exclusive lease. Another process may have completed
+            // the run between the optimistic read and lease acquisition.
+            assertWorkflowRunResumable(opts.coordRoot, resumeState.manifest.run_id);
+        }
+        return await executeWorkflow(scriptPath, absScript, opts, resumeState);
+    }
+    finally {
+        releaseResumeLease?.();
+    }
+}
+async function executeWorkflow(scriptPath, absScript, opts, resumeState) {
     const mod = (await import(__rewriteRelativeImportExtension(pathToFileURL(absScript).href)));
     if (typeof mod.default !== "function") {
         throw new Error(`${scriptPath}: workflow script must \`export default async (ctx) => …\``);
@@ -60,20 +115,58 @@ export async function runWorkflow(scriptPath, opts) {
     const fallbackName = scriptPath.replace(/^.*\//, "").replace(/\.[cm]?js$/, "");
     const meta = normalizeWorkflowMeta(mod.meta, fallbackName);
     const name = meta.name;
-    const runId = `wf-${new Date().toISOString().replace(/[:.]/g, "-")}-${randomBytes(3).toString("hex")}`;
+    const runId = opts.resumeRunId ??
+        opts.runId ??
+        `wf-${new Date().toISOString().replace(/[:.]/g, "-")}-${randomBytes(3).toString("hex")}`;
     const runDir = join(opts.coordRoot, ".harnery", "workflows", runId);
     mkdirSync(runDir, { recursive: true });
     const journalPath = join(runDir, "journal.jsonl");
     const proofPath = join(runDir, "proof.json");
-    const maxAgents = opts.maxAgents ?? DEFAULT_MAX_AGENTS;
-    const concurrency = opts.concurrency ?? DEFAULT_CONCURRENCY;
-    const cwd = opts.cwd ?? opts.coordRoot;
+    const frozen = resumeState?.manifest.execution;
+    const maxAgents = frozen?.max_agents ?? opts.maxAgents ?? DEFAULT_MAX_AGENTS;
+    const concurrency = frozen?.concurrency ?? opts.concurrency ?? DEFAULT_CONCURRENCY;
+    assertPositiveWorkflowBound(maxAgents, "maxAgents");
+    assertPositiveWorkflowBound(concurrency, "concurrency");
+    const cwd = frozen?.cwd ?? opts.cwd ?? opts.coordRoot;
     const log = opts.onLog ?? ((line) => process.stderr.write(`${line}\n`));
-    const defaultHarness = opts.defaultHarness ?? "claude-code";
-    const isolation = opts.isolation ?? "shared";
-    const networkAccess = opts.networkAccess ?? "unknown";
-    const policy = opts.policy ? normalizePolicy(opts.policy, { baseDir: cwd }) : undefined;
-    const repoBefore = snapshotRepo(cwd);
+    const defaultHarness = frozen?.default_harness ?? opts.defaultHarness ?? "claude-code";
+    const isolation = frozen?.isolation ?? opts.isolation ?? "shared";
+    const networkAccess = frozen?.network_access ?? opts.networkAccess ?? "unknown";
+    const policy = frozen?.policy ?? (opts.policy ? normalizePolicy(opts.policy, { baseDir: cwd }) : undefined);
+    const approvalMode = frozen?.approval_mode ?? opts.approvalMode ?? "deny";
+    const approvalAddressee = frozen?.approval_addressee ?? opts.approvalAddressee ?? "operator";
+    const subscriptionOnly = frozen?.subscription_only ?? Boolean(opts.subscriptionOnly);
+    const allowApiBilling = frozen?.allow_api_billing ?? Boolean(opts.allowApiBilling);
+    const repoBefore = resumeState?.manifest.repository_before ?? snapshotRepo(cwd);
+    const startedAt = resumeState?.manifest.started_at ?? new Date().toISOString();
+    const t0 = resumeState ? Date.parse(startedAt) : Date.now();
+    if (!resumeState) {
+        writeWorkflowRunManifest({
+            coordRoot: opts.coordRoot,
+            manifest: {
+                schema_version: 1,
+                run_id: runId,
+                work_item_id: opts.workItemId,
+                name,
+                started_at: startedAt,
+                script: { path: absScript, sha256: workflowScriptDigest(absScript) },
+                repository_before: repoBefore,
+                execution: {
+                    cwd,
+                    default_harness: defaultHarness,
+                    max_agents: maxAgents,
+                    concurrency,
+                    subscription_only: subscriptionOnly,
+                    allow_api_billing: allowApiBilling,
+                    approval_mode: approvalMode,
+                    approval_addressee: approvalAddressee,
+                    isolation,
+                    network_access: networkAccess,
+                    policy: policy ? policy : undefined,
+                },
+            },
+        });
+    }
     // Per-child fixed context overhead: children spawn in `cwd` and load its
     // repo-instructions file into their system prompt, cache-writing it once
     // per child. A fan-out multiplies this, so surface it BEFORE the burn.
@@ -83,12 +176,14 @@ export async function runWorkflow(scriptPath, opts) {
             `instructions from ${cwd}; a fan-out multiplies this per agent`);
     }
     // Resume: journaled results of a prior run, keyed by agent-call identity.
-    const resumeCache = opts.resumeFrom
-        ? loadResumeCache(opts.coordRoot, opts.resumeFrom)
+    const resumeSource = opts.resumeRunId ?? opts.resumeFrom;
+    const resumeCache = resumeSource
+        ? loadResumeCache(opts.coordRoot, resumeSource)
         : new Map();
-    let agentsSpawned = 0;
+    const history = opts.resumeRunId ? loadRunHistory(journalPath) : undefined;
+    let agentsSpawned = history?.agentsSpawned ?? 0;
     let agentsCached = 0;
-    let costUsd = 0;
+    let costUsd = history?.costUsd ?? 0;
     let reservedCostUsd = 0;
     let currentStage = "";
     let agentSeq = 0;
@@ -97,7 +192,7 @@ export async function runWorkflow(scriptPath, opts) {
     const billingProbed = new Map();
     const agentProofs = new Map();
     const evidenceRecords = [];
-    const policyDecisions = [];
+    const policyDecisions = new Map(history?.policyDecisions.map((decision) => [decision.id, decision]));
     const acceptanceIds = new Set(meta.acceptance.map((criterion) => criterion.id));
     const journal = (event, data) => {
         const line = JSON.stringify({
@@ -149,7 +244,7 @@ export async function runWorkflow(scriptPath, opts) {
         if (!policy) {
             throw new Error("external mutation authorization requires a host policy");
         }
-        if (policyDecisions.length >= MAX_POLICY_DECISIONS) {
+        if (policyDecisions.size >= MAX_POLICY_DECISIONS && !policyDecisions.has(`p${policySeq + 1}`)) {
             throw new Error(`workflow policy decision cap reached (${MAX_POLICY_DECISIONS}); split the workflow or reduce protected actions`);
         }
         const request = summarizePolicyRequest(rawRequest);
@@ -169,10 +264,8 @@ export async function runWorkflow(scriptPath, opts) {
         let reason = evaluation.reason;
         if (evaluation.verdict === "ask") {
             resolvedBy = "fail_closed";
-            if (!opts.resolvePolicyAsk) {
-                reason = `${evaluation.reason}; no host approval resolver is configured`;
-            }
-            else {
+            let immediateResolution = false;
+            if (opts.resolvePolicyAsk) {
                 try {
                     const resolution = await withTimeout(Promise.resolve(opts.resolvePolicyAsk(request, evaluation)), opts.policyAskTimeoutMs ?? DEFAULT_POLICY_ASK_TIMEOUT_MS);
                     if (!resolution || (resolution.verdict !== "allow" && resolution.verdict !== "deny")) {
@@ -182,12 +275,54 @@ export async function runWorkflow(scriptPath, opts) {
                         verdict = resolution.verdict;
                         resolvedBy = "host";
                         reason = boundedPolicyReason(resolution.reason ?? evaluation.reason);
+                        immediateResolution = true;
                     }
                 }
                 catch (error) {
                     reason = `${evaluation.reason}; approval failed closed: ${error.message}`;
                 }
             }
+            else {
+                reason = `${evaluation.reason}; no host approval resolver is configured`;
+            }
+            if (!immediateResolution && approvalMode === "park") {
+                const stored = createWorkflowApproval({
+                    coordRoot: opts.coordRoot,
+                    runId,
+                    decisionId: id,
+                    addressedTo: approvalAddressee,
+                    policy: { name: policy.name, sha256: policyDigest(policy) },
+                    request,
+                    evaluation,
+                });
+                if (stored.approval.status === "pending") {
+                    if (stored.created) {
+                        journal("approval.requested", {
+                            approval_id: stored.approval.request.id,
+                            decision_id: id,
+                            addressed_to: stored.approval.request.addressed_to,
+                            request_sha256: stored.approval.request.request_sha256,
+                        });
+                    }
+                    journal("run.parked", {
+                        approval_id: stored.approval.request.id,
+                        decision_id: id,
+                        phase: request.phase,
+                        action: request.action,
+                    });
+                    throw new WorkflowParkedError(`workflow parked for approval ${stored.approval.request.id}: ${evaluation.reason}`, runId, stored.approval.request.id, journalPath);
+                }
+                verdict = stored.approval.decision.verdict;
+                resolvedBy = "approval";
+                reason = boundedPolicyReason(stored.approval.decision.reason ?? evaluation.reason);
+                journal("approval.consumed", {
+                    approval_id: stored.approval.request.id,
+                    decision_id: id,
+                    verdict,
+                    actor: stored.approval.decision.actor,
+                    decided_at: stored.approval.decision.decided_at,
+                });
+            }
         }
         const decision = {
             id,
@@ -201,7 +336,7 @@ export async function runWorkflow(scriptPath, opts) {
             rule_codes: evaluation.rules.map((rule) => rule.code),
             request,
         };
-        policyDecisions.push(decision);
+        policyDecisions.set(decision.id, decision);
         journal("policy.resolve", { ...decision });
         if (decision.verdict === "deny") {
             throw new PolicyDeniedError(`policy ${JSON.stringify(policy.name)} denied ${request.phase} ${JSON.stringify(request.action)}: ${decision.reason}`, decision.id);
@@ -236,6 +371,11 @@ export async function runWorkflow(scriptPath, opts) {
         const key = agentCallKey(currentStage, harness, agentOpts, prompt);
         const cached = resumeCache.get(key);
         if (cached) {
+            // Exact-run replay skips dispatch authorization because no dispatch
+            // occurs, but it must still reserve the original policy slot so a later
+            // durable ASK resolves against the same pN identity.
+            if (policy && opts.resumeRunId)
+                policySeq++;
             agentsCached++;
             agentProof.status = "cached";
             agentProof.result = digestResult(cached.value, cached.kind);
@@ -247,7 +387,7 @@ export async function runWorkflow(scriptPath, opts) {
                 model: agentOpts.model ?? null,
                 kind: cached.kind,
             });
-            log(`[${name}] ${currentStage || "(no stage)"} → ${id} ${label} (cached from ${opts.resumeFrom})`);
+            log(`[${name}] ${currentStage || "(no stage)"} → ${id} ${label} (cached from ${resumeSource})`);
             return cached.value;
         }
         if (policy) {
@@ -327,19 +467,19 @@ export async function runWorkflow(scriptPath, opts) {
                 billingProbed.set(harness, probe);
                 journal("billing.probe", {
                     harness,
-                    mode: opts.subscriptionOnly ? "subscription" : probe.mode,
+                    mode: subscriptionOnly ? "subscription" : probe.mode,
                     api_key_source: probe.apiKeySource,
                     login: probe.login,
-                    subscription_only: Boolean(opts.subscriptionOnly),
+                    subscription_only: subscriptionOnly,
                 });
-                if (opts.subscriptionOnly) {
+                if (subscriptionOnly) {
                     if (probe.login === "absent") {
                         throw new Error(`subscription-only: no stored login detected for ${harness}; ` +
                             `log the harness CLI in (or drop --subscription-only for a key-only host)`);
                     }
                     log(`[billing] ${harness}: subscription-only (API-key vars scrubbed from child env)`);
                 }
-                else if (probe.mode === "api-key-override" && !opts.allowApiBilling) {
+                else if (probe.mode === "api-key-override" && !allowApiBilling) {
                     throw new Error(`${probe.apiKeySource} is set AND a stored ${harness} login exists — the key silently ` +
                         `overrides your subscription auth, so children would bill per-token API rates. ` +
                         `Either unset ${probe.apiKeySource}, run with --subscription-only to scrub it from ` +
@@ -392,7 +532,7 @@ export async function runWorkflow(scriptPath, opts) {
                     maxTurns: agentOpts.maxTurns ?? DEFAULT_MAX_TURNS,
                     cwd,
                     runId,
-                    subscriptionOnly: opts.subscriptionOnly,
+                    subscriptionOnly,
                 });
                 agentProof.attempts = attempt;
                 agentProof.duration_ms += last.durationMs;
@@ -413,6 +553,7 @@ export async function runWorkflow(scriptPath, opts) {
                         key,
                         attempts: attempt,
                         cost_usd: last.costUsd,
+                        total_cost_usd: agentCostUsd,
                         duration_ms: last.durationMs,
                         session_id: last.sessionId,
                         result_kind: "text",
@@ -435,6 +576,7 @@ export async function runWorkflow(scriptPath, opts) {
                         key,
                         attempts: attempt,
                         cost_usd: last.costUsd,
+                        total_cost_usd: agentCostUsd,
                         duration_ms: last.durationMs,
                         session_id: last.sessionId,
                         result_kind: "json",
@@ -511,20 +653,28 @@ export async function runWorkflow(scriptPath, opts) {
         });
     };
     const ctx = { agent, parallel, stage, log, evidence, authorize };
-    const t0 = Date.now();
-    const startedAt = new Date(t0).toISOString();
-    journal("run.start", {
-        name,
-        script: absScript,
-        objective: meta.objective ?? null,
-        acceptance: meta.acceptance,
-        max_agents: maxAgents,
-        concurrency,
-        policy: policy ? { name: policy.name, sha256: policyDigest(policy) } : null,
-        isolation,
-        network_access: networkAccess,
-    });
     try {
+        if (resumeState) {
+            journal("run.resume", {
+                approval_id: resumeState.approvalId,
+                script: absScript,
+                resumed_at: new Date().toISOString(),
+            });
+        }
+        else {
+            journal("run.start", {
+                name,
+                work_item_id: opts.workItemId ?? null,
+                script: absScript,
+                objective: meta.objective ?? null,
+                acceptance: meta.acceptance,
+                max_agents: maxAgents,
+                concurrency,
+                policy: policy ? { name: policy.name, sha256: policyDigest(policy) } : null,
+                isolation,
+                network_access: networkAccess,
+            });
+        }
         const result = await mod.default(ctx);
         const endedAt = new Date().toISOString();
         const durationMs = Date.now() - t0;
@@ -539,6 +689,7 @@ export async function runWorkflow(scriptPath, opts) {
         try {
             proof = buildWorkflowProof({
                 runId,
+                workItemId: opts.workItemId ?? resumeState?.manifest.work_item_id,
                 meta,
                 status: "succeeded",
                 startedAt,
@@ -551,7 +702,12 @@ export async function runWorkflow(scriptPath, opts) {
                 evidence: evidenceRecords,
                 harnessEvidence: opts.harnessEvidence,
                 policy: policy
-                    ? { config: policy, decisions: policyDecisions, isolation, networkAccess }
+                    ? {
+                        config: policy,
+                        decisions: Array.from(policyDecisions.values()),
+                        isolation,
+                        networkAccess,
+                    }
                     : undefined,
                 result,
             });
@@ -562,6 +718,7 @@ export async function runWorkflow(scriptPath, opts) {
         }
         const report = {
             runId,
+            workItemId: opts.workItemId ?? resumeState?.manifest.work_item_id,
             name,
             result,
             agentsSpawned,
@@ -574,14 +731,14 @@ export async function runWorkflow(scriptPath, opts) {
             contextTokensPerChildEstimate,
             billing: Array.from(billingProbed.values()).map((p) => ({
                 harness: p.harness,
-                mode: opts.subscriptionOnly ? "subscription" : p.mode,
+                mode: subscriptionOnly ? "subscription" : p.mode,
             })),
             policy: proof.policy?.summary,
         };
         return report;
     }
     catch (err) {
-        if (err instanceof WorkflowRunError)
+        if (err instanceof WorkflowParkedError || err instanceof WorkflowRunError)
             throw err;
         const endedAt = new Date().toISOString();
         const durationMs = Date.now() - t0;
@@ -596,6 +753,7 @@ export async function runWorkflow(scriptPath, opts) {
         try {
             const proof = buildWorkflowProof({
                 runId,
+                workItemId: opts.workItemId ?? resumeState?.manifest.work_item_id,
                 meta,
                 status: "failed",
                 startedAt,
@@ -608,7 +766,12 @@ export async function runWorkflow(scriptPath, opts) {
                 evidence: evidenceRecords,
                 harnessEvidence: opts.harnessEvidence,
                 policy: policy
-                    ? { config: policy, decisions: policyDecisions, isolation, networkAccess }
+                    ? {
+                        config: policy,
+                        decisions: Array.from(policyDecisions.values()),
+                        isolation,
+                        networkAccess,
+                    }
                     : undefined,
                 error: err.message,
             });
@@ -676,6 +839,38 @@ function loadResumeCache(coordRoot, resumeFrom) {
     }
     return cache;
 }
+function loadRunHistory(path) {
+    const agentIds = new Set();
+    const agentCosts = new Map();
+    const decisions = new Map();
+    for (const line of readFileSync(path, "utf8").split("\n")) {
+        if (!line.trim())
+            continue;
+        const event = JSON.parse(line);
+        if (event.event === "agent.start" && typeof event.id === "string") {
+            agentIds.add(event.id);
+        }
+        if (event.event === "agent.end" && typeof event.id === "string") {
+            const cost = event.total_cost_usd ?? event.cost_usd;
+            if (typeof cost === "number" && Number.isFinite(cost) && cost >= 0) {
+                agentCosts.set(event.id, cost);
+            }
+        }
+        if (event.event === "policy.resolve" &&
+            typeof event.id === "string" &&
+            (event.verdict === "allow" || event.verdict === "deny") &&
+            typeof event.resolved_by === "string" &&
+            event.request &&
+            typeof event.request === "object") {
+            decisions.set(event.id, event);
+        }
+    }
+    return {
+        agentsSpawned: agentIds.size,
+        costUsd: round4(Array.from(agentCosts.values()).reduce((sum, value) => sum + value, 0)),
+        policyDecisions: Array.from(decisions.values()),
+    };
+}
 function round4(n) {
     return Math.round(n * 10_000) / 10_000;
 }
@@ -684,6 +879,11 @@ function assertAgentCapacity(agentsSpawned, maxAgents) {
         throw new Error(`workflow agent cap reached (${maxAgents}); raise --max-agents deliberately if the fan-out is intended`);
     }
 }
+function assertPositiveWorkflowBound(value, field) {
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new Error(`${field} must be a positive safe integer`);
+    }
+}
 function boundedPolicyReason(value) {
     const normalized = Array.from(value, (character) => {
         const code = character.charCodeAt(0);

package/dist/core/workflow/index.d.ts

@@ -1,5 +1,9 @@
-export { runWorkflow, WorkflowRunError } from "./engine.js";
+export type { CreateWorkflowApprovalInput, ResolveWorkflowApprovalInput, WorkflowApproval, WorkflowApprovalDecision, WorkflowApprovalRequest, WorkflowApprovalStatus, } from "./approvals.js";
+export { assertWorkflowRunId, createWorkflowApproval, listWorkflowApprovals, readWorkflowApproval, renderWorkflowApproval, resolveWorkflowApproval, WORKFLOW_APPROVAL_SCHEMA_VERSION, workflowApprovalId, } from "./approvals.js";
+export { runWorkflow, WorkflowParkedError, WorkflowRunError } from "./engine.js";
 export { buildWorkflowProof, createEvidenceRecord, digestResult, normalizeWorkflowMeta, readWorkflowProof, renderWorkflowProof, rollupAcceptance, writeWorkflowProof, } from "./proof.js";
-export type { AcceptanceCriterion, AcceptanceResult, AcceptanceStatus, AcceptanceSummary, AgentOpts, EngineOpts, EvidenceKind, EvidenceSource, EvidenceStatus, HarnessEvidenceCapability, HarnessEvidenceCoverage, HarnessName, ResultDigest, RunReport, Spawner, SpawnRequest, SpawnResult, StageSchema, WorkflowAgentProof, WorkflowContext, WorkflowEvidenceInput, WorkflowEvidenceRecord, WorkflowMeta, WorkflowModule, WorkflowPolicyProof, WorkflowProof, WorkflowProofUnknown, WorkflowRepoEvidence, WorkflowRepoSnapshot, WorkflowRunStatus, } from "./types.js";
+export type { WorkflowRunManifest } from "./run-state.js";
+export { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, readWorkflowRunManifest, WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION, workflowRunManifestPath, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
+export type { AcceptanceCriterion, AcceptanceResult, AcceptanceStatus, AcceptanceSummary, AgentOpts, EngineOpts, EvidenceKind, EvidenceSource, EvidenceStatus, HarnessEvidenceCapability, HarnessEvidenceCoverage, HarnessName, ResultDigest, RunReport, Spawner, SpawnRequest, SpawnResult, StageSchema, WorkflowAgentProof, WorkflowApprovalMode, WorkflowContext, WorkflowEvidenceInput, WorkflowEvidenceRecord, WorkflowMeta, WorkflowModule, WorkflowPolicyProof, WorkflowProof, WorkflowProofUnknown, WorkflowRepoEvidence, WorkflowRepoSnapshot, WorkflowRunStatus, } from "./types.js";
 export { WORKFLOW_PROOF_SCHEMA_VERSION } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/core/workflow/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,cAAc,EACd,cAAc,EACd,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,EACX,YAAY,EACZ,SAAS,EACT,OAAO,EACP,YAAY,EACZ,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,2BAA2B,EAC3B,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,gCAAgC,EAChC,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,uBAAuB,EACvB,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,cAAc,EACd,cAAc,EACd,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,EACX,YAAY,EACZ,SAAS,EACT,OAAO,EACP,YAAY,EACZ,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC"}

package/dist/core/workflow/index.js

@@ -1,3 +1,5 @@
-export { runWorkflow, WorkflowRunError } from "./engine.js";
+export { assertWorkflowRunId, createWorkflowApproval, listWorkflowApprovals, readWorkflowApproval, renderWorkflowApproval, resolveWorkflowApproval, WORKFLOW_APPROVAL_SCHEMA_VERSION, workflowApprovalId, } from "./approvals.js";
+export { runWorkflow, WorkflowParkedError, WorkflowRunError } from "./engine.js";
 export { buildWorkflowProof, createEvidenceRecord, digestResult, normalizeWorkflowMeta, readWorkflowProof, renderWorkflowProof, rollupAcceptance, writeWorkflowProof, } from "./proof.js";
+export { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, readWorkflowRunManifest, WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION, workflowRunManifestPath, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
 export { WORKFLOW_PROOF_SCHEMA_VERSION } from "./types.js";

package/dist/core/workflow/proof.d.ts

@@ -9,6 +9,7 @@ export interface NormalizedWorkflowMeta {
 }
 export interface BuildWorkflowProofInput {
     runId: string;
+    workItemId?: string;
     meta: NormalizedWorkflowMeta;
     status: "succeeded" | "failed";
     startedAt: string;

package/dist/core/workflow/proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/proof.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EAEzB,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EAEZ,aAAa,EAId,MAAM,YAAY,CAAC;AAepB,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,sBAAsB,CAAC;IAC7B,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACnC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;QACrC,SAAS,EAAE,eAAe,CAAC;QAC3B,aAAa,EAAE,mBAAmB,CAAC;KACpC,CAAC;IACF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GACnB,sBAAsB,CAqCxB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,sBAAsB,CA6BzB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,QAAQ,EAAE,sBAAsB,EAAE,GACjC;IAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,CAuB9D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,CAQjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,aAAa,CAyChF;AAgCD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAe3E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAkBjF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAoChE"}
+{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/proof.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EAEzB,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EAEZ,aAAa,EAId,MAAM,YAAY,CAAC;AAepB,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,sBAAsB,CAAC;IAC7B,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACnC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;QACrC,SAAS,EAAE,eAAe,CAAC;QAC3B,aAAa,EAAE,mBAAmB,CAAC;KACpC,CAAC;IACF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GACnB,sBAAsB,CAqCxB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,sBAAsB,CA6BzB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,QAAQ,EAAE,sBAAsB,EAAE,GACjC;IAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,CAuB9D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,CAQjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,aAAa,CA0ChF;AAgCD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAe3E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAkBjF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAoChE"}

package/dist/core/workflow/proof.js

@@ -120,6 +120,7 @@ export function buildWorkflowProof(input) {
         schema_version: WORKFLOW_PROOF_SCHEMA_VERSION,
         run: {
             id: input.runId,
+            work_item_id: input.workItemId,
             name: input.meta.name,
             status: input.status,
             started_at: input.startedAt,

package/dist/core/workflow/run-state.d.ts

@@ -0,0 +1,44 @@
+import type { RepoSnapshot } from "../context/index.js";
+import { type NormalizedPolicy, type PolicyIsolation, type PolicyNetworkAccess } from "../policy/index.js";
+export declare const WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION: 1;
+export interface WorkflowRunManifest {
+    schema_version: typeof WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION;
+    run_id: string;
+    work_item_id?: string;
+    name: string;
+    started_at: string;
+    script: {
+        path: string;
+        sha256: string;
+    };
+    repository_before: RepoSnapshot;
+    execution: {
+        cwd: string;
+        default_harness: string;
+        max_agents: number;
+        concurrency: number;
+        subscription_only: boolean;
+        allow_api_billing: boolean;
+        approval_mode: "deny" | "park";
+        approval_addressee: string;
+        isolation: PolicyIsolation;
+        network_access: PolicyNetworkAccess;
+        policy?: NormalizedPolicy;
+    };
+}
+export interface WriteWorkflowRunManifestInput {
+    coordRoot: string;
+    manifest: WorkflowRunManifest;
+}
+export declare function workflowScriptDigest(scriptPath: string): string;
+export declare function writeWorkflowRunManifest(input: WriteWorkflowRunManifestInput): string;
+export declare function readWorkflowRunManifest(coordRoot: string, runId: string): WorkflowRunManifest;
+export declare function assertWorkflowRunResumable(coordRoot: string, runId: string): {
+    manifest: WorkflowRunManifest;
+    approvalId: string;
+};
+export declare function assertWorkflowScriptUnchanged(manifest: WorkflowRunManifest): void;
+export declare function workflowRunManifestPath(coordRoot: string, runId: string): string;
+/** Acquire an exclusive, crash-recoverable lease for one resume segment. */
+export declare function acquireWorkflowResumeLease(coordRoot: string, runId: string): () => void;
+//# sourceMappingURL=run-state.d.ts.map

package/dist/core/workflow/run-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-state.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/run-state.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAEzB,MAAM,oBAAoB,CAAC;AAG5B,eAAO,MAAM,oCAAoC,EAAG,CAAU,CAAC;AAK/D,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,iBAAiB,EAAE,YAAY,CAAC;IAChC,SAAS,EAAE;QACT,GAAG,EAAE,MAAM,CAAC;QACZ,eAAe,EAAE,MAAM,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;QAC/B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,SAAS,EAAE,eAAe,CAAC;QAC3B,cAAc,EAAE,mBAAmB,CAAC;QACpC,MAAM,CAAC,EAAE,gBAAgB,CAAC;KAC3B,CAAC;CACH;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,6BAA6B,GAAG,MAAM,CAmBrF;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAgC7F;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CA4BvD;AAED,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CASjF;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGhF;AAED,4EAA4E;AAC5E,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,IAAI,CA0CvF"}