harnery 0.22.1 → 0.23.0

package/dist/core/workflow/engine.js

@@ -33,12 +33,16 @@ import { evaluatePolicy, normalizePolicy, PolicyDeniedError, policyDigest, summa
 import { assertWorkflowRunId, createWorkflowApproval } from "./approvals.js";
 import { freezeWorkflowAttemptContext } from "./attempt-context.js";
 import { probeBilling } from "./billing.js";
+import { stableDigest } from "./durable-record.js";
 import { buildWorkflowProof, createEvidenceRecord, digestResult, normalizeWorkflowMeta, writeWorkflowProof, } from "./proof.js";
 import { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
 import { normalizeWorkflowSpecialists, resolveSpecialistAssignment } from "./specialists.js";
 import { WORKFLOW_PROOF_SCHEMA_VERSION } from "./types.js";
 import { parseStageOutput, validateAgainstSchema } from "./validate.js";
 import { freezeWorkflowWorkContext } from "./work-context.js";
+import { attestTerminal, attestWorkspaceFailure, resolveWorkspaceBinding, } from "./workspaces/execution.js";
+import { appendWorkflowJournalEvent } from "./workspaces/state.js";
+import { isWorkspaceAttestation } from "./workspaces/validate.js";
 const DEFAULT_MAX_AGENTS = 50;
 const DEFAULT_CONCURRENCY = 4;
 const DEFAULT_MAX_ATTEMPTS = 2;
@@ -136,13 +140,19 @@ export async function runWorkflow(scriptPath, opts) {
     }
 }
 async function executeWorkflow(scriptPath, absScript, opts, resumeState, workContext, attemptContext) {
-    const mod = (await import(__rewriteRelativeImportExtension(pathToFileURL(absScript).href)));
-    if (typeof mod.default !== "function") {
-        throw new Error(`${scriptPath}: workflow script must \`export default async (ctx) => …\``);
+    const frozen = resumeState?.manifest.execution;
+    const isolation = frozen?.isolation ?? opts.isolation ?? "shared";
+    let sharedWorkflow;
+    let sharedMeta;
+    if (isolation === "shared") {
+        const mod = (await import(__rewriteRelativeImportExtension(pathToFileURL(absScript).href)));
+        if (typeof mod.default !== "function") {
+            throw new Error(`${scriptPath}: workflow script must \`export default async (ctx) => …\``);
+        }
+        const fallbackName = scriptPath.replace(/^.*\//, "").replace(/\.[cm]?js$/, "");
+        sharedWorkflow = mod.default;
+        sharedMeta = normalizeWorkflowMeta(mod.meta, fallbackName);
     }
-    const fallbackName = scriptPath.replace(/^.*\//, "").replace(/\.[cm]?js$/, "");
-    const meta = normalizeWorkflowMeta(mod.meta, fallbackName);
-    const name = meta.name;
     const runId = opts.resumeRunId ??
         opts.runId ??
         `wf-${new Date().toISOString().replace(/[:.]/g, "-")}-${randomBytes(3).toString("hex")}`;
@@ -150,7 +160,6 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
     mkdirSync(runDir, { recursive: true });
     const journalPath = join(runDir, "journal.jsonl");
     const proofPath = join(runDir, "proof.json");
-    const frozen = resumeState?.manifest.execution;
     const maxAgents = frozen?.max_agents ?? opts.maxAgents ?? DEFAULT_MAX_AGENTS;
     const concurrency = frozen?.concurrency ?? opts.concurrency ?? DEFAULT_CONCURRENCY;
     assertPositiveWorkflowBound(maxAgents, "maxAgents");
@@ -159,16 +168,105 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
     const log = opts.onLog ?? ((line) => process.stderr.write(`${line}\n`));
     const defaultHarness = frozen?.default_harness ?? opts.defaultHarness ?? "claude-code";
     const specialists = frozen?.specialists ?? (resumeState ? {} : normalizeWorkflowSpecialists(opts.specialists));
-    const isolation = frozen?.isolation ?? opts.isolation ?? "shared";
     const networkAccess = frozen?.network_access ?? opts.networkAccess ?? "unknown";
     const policy = frozen?.policy ?? (opts.policy ? normalizePolicy(opts.policy, { baseDir: cwd }) : undefined);
     const approvalMode = frozen?.approval_mode ?? opts.approvalMode ?? "deny";
     const approvalAddressee = frozen?.approval_addressee ?? opts.approvalAddressee ?? "operator";
     const subscriptionOnly = frozen?.subscription_only ?? Boolean(opts.subscriptionOnly);
     const allowApiBilling = frozen?.allow_api_billing ?? Boolean(opts.allowApiBilling);
-    const repoBefore = resumeState?.manifest.repository_before ?? snapshotRepo(cwd);
     const startedAt = resumeState?.manifest.started_at ?? new Date().toISOString();
     const t0 = resumeState ? Date.parse(startedAt) : Date.now();
+    const scriptSha256 = resumeState?.manifest.script.sha256 ?? workflowScriptDigest(absScript);
+    const fallbackName = scriptPath.replace(/^.*\//, "").replace(/\.[cm]?js$/, "");
+    const fallbackMeta = normalizeWorkflowMeta(undefined, fallbackName);
+    const workspaceProvider = isolation === "shared" ? undefined : opts.workspace?.provider;
+    let workspaceBinding;
+    let workspaceFallback = resumeState?.manifest.execution.workspace_fallback;
+    try {
+        workspaceBinding = await resolveWorkspaceBinding({
+            opts,
+            resumeState,
+            runId,
+            cwd,
+            isolation,
+            absScript,
+            scriptSha256,
+            provider: workspaceProvider,
+            workContext,
+            attemptContext,
+            policy,
+            onUnsupportedFallback: (evidence) => {
+                workspaceFallback = evidence;
+            },
+        });
+    }
+    catch (error) {
+        const frozenBinding = resumeState?.manifest.execution.workspace_binding;
+        if (!resumeState || !frozenBinding)
+            throw error;
+        const failure = error instanceof Error ? error : new Error(String(error));
+        const endedAt = new Date().toISOString();
+        const durationMs = Date.now() - t0;
+        const failedAttestation = await attestWorkspaceFailure(workspaceProvider, frozenBinding, error);
+        appendWorkflowJournalEvent(opts.coordRoot, runId, "run.resume", {
+            approval_id: resumeState.approvalId,
+            script: absScript,
+            resumed_at: new Date().toISOString(),
+        });
+        appendWorkflowJournalEvent(opts.coordRoot, runId, "workspace.reattach.failed", {
+            binding_id: frozenBinding.binding_id,
+            provider_id: frozenBinding.provider.id,
+            status: failedAttestation.status,
+            reason: failure.message,
+            attestation_sha256: stableDigest(failedAttestation),
+        });
+        appendWorkflowJournalEvent(opts.coordRoot, runId, "run.end", {
+            ok: false,
+            error: failure.message,
+            agents: 0,
+            cached: 0,
+            cost_usd: 0,
+            duration_ms: durationMs,
+        });
+        try {
+            const proof = buildWorkflowProof({
+                runId,
+                workItemId: opts.workItemId ?? resumeState.manifest.work_item_id,
+                workContext,
+                attemptContext,
+                meta: fallbackMeta,
+                status: "failed",
+                startedAt,
+                endedAt,
+                durationMs,
+                journalPath,
+                before: resumeState.manifest.repository_before,
+                after: resumeState.manifest.repository_before,
+                agents: [],
+                evidence: [],
+                harnessEvidence: opts.harnessEvidence,
+                policy: policy
+                    ? {
+                        config: policy,
+                        decisions: [],
+                        isolation,
+                        networkAccess,
+                    }
+                    : undefined,
+                workspaceBinding: frozenBinding,
+                workspaceAttestation: failedAttestation,
+                error: failure.message,
+            });
+            writeWorkflowProof(proofPath, proof);
+        }
+        catch (proofError) {
+            throw new WorkflowRunError(`${failure.message}; recovery proof packet write also failed: ${proofError.message}`, runId, proofPath, failure);
+        }
+        throw new WorkflowRunError(failure.message, runId, proofPath, failure);
+    }
+    const effectiveIsolation = workspaceFallback?.effective_isolation ?? isolation;
+    const executionCwd = workspaceBinding?.active_root ?? cwd;
+    const executionRepoBefore = resumeState?.manifest.repository_before ?? snapshotRepo(executionCwd);
     if (!resumeState) {
         writeWorkflowRunManifest({
             coordRoot: opts.coordRoot,
@@ -178,12 +276,12 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 work_item_id: opts.workItemId,
                 work_context: workContext,
                 attempt_context: attemptContext,
-                name,
+                name: sharedMeta?.name ?? fallbackMeta.name,
                 started_at: startedAt,
-                script: { path: absScript, sha256: workflowScriptDigest(absScript) },
-                repository_before: repoBefore,
+                script: { path: absScript, sha256: scriptSha256 },
+                repository_before: executionRepoBefore,
                 execution: {
-                    cwd,
+                    cwd: executionCwd,
                     default_harness: defaultHarness,
                     max_agents: maxAgents,
                     concurrency,
@@ -195,17 +293,70 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                     network_access: networkAccess,
                     policy: policy ? policy : undefined,
                     specialists,
+                    workspace_binding: workspaceBinding,
+                    workspace_fallback: workspaceFallback,
                 },
             },
         });
     }
+    let workflow = sharedWorkflow;
+    let meta = sharedMeta ?? fallbackMeta;
+    let initializationError;
+    let initializationAttestation;
+    if (isolation !== "shared") {
+        try {
+            const mod = (await import(__rewriteRelativeImportExtension(pathToFileURL(absScript).href)));
+            if (typeof mod.default !== "function") {
+                throw new Error(`${scriptPath}: workflow script must \`export default async (ctx) => …\``);
+            }
+            workflow = mod.default;
+            meta = normalizeWorkflowMeta(mod.meta, fallbackName);
+        }
+        catch (error) {
+            initializationError = error instanceof Error ? error : new Error(String(error));
+        }
+    }
+    if (workspaceBinding && workspaceProvider) {
+        try {
+            const postImport = await workspaceProvider.reattach(workspaceBinding);
+            if (!isWorkspaceAttestation(postImport, workspaceBinding) || postImport.status !== "ok") {
+                initializationAttestation = isWorkspaceAttestation(postImport, workspaceBinding)
+                    ? postImport
+                    : undefined;
+                throw new Error("workspace authority changed during workflow module initialization");
+            }
+            appendWorkflowJournalEvent(opts.coordRoot, runId, "workspace.reattach.module_initialized", {
+                binding_id: workspaceBinding.binding_id,
+                provider_id: workspaceBinding.provider.id,
+                attestation_sha256: stableDigest(postImport),
+            });
+        }
+        catch (error) {
+            const reattachmentError = error instanceof Error ? error : new Error(String(error));
+            initializationAttestation ??= await attestWorkspaceFailure(workspaceProvider, workspaceBinding, error);
+            initializationError = initializationError
+                ? new Error(`${initializationError.message}; ${reattachmentError.message}`, {
+                    cause: reattachmentError,
+                })
+                : reattachmentError;
+            appendWorkflowJournalEvent(opts.coordRoot, runId, "workspace.reattach.module_initialization_failed", {
+                binding_id: workspaceBinding.binding_id,
+                provider_id: workspaceBinding.provider.id,
+                status: initializationAttestation.status,
+                reason: reattachmentError.message,
+                attestation_sha256: stableDigest(initializationAttestation),
+            });
+        }
+    }
+    const name = meta.name;
+    let observedWorkspaceAttestation = initializationAttestation;
     // Per-child fixed context overhead: children spawn in `cwd` and load its
     // repo-instructions file into their system prompt, cache-writing it once
     // per child. A fan-out multiplies this, so surface it BEFORE the burn.
-    const contextTokensPerChildEstimate = estimateInstructionTokens(cwd);
+    const contextTokensPerChildEstimate = estimateInstructionTokens(executionCwd);
     if (contextTokensPerChildEstimate > 0) {
         log(`[context] each child cache-writes ~${Math.round(contextTokensPerChildEstimate / 1000)}K tokens of repo ` +
-            `instructions from ${cwd}; a fan-out multiplies this per agent`);
+            `instructions from ${executionCwd}; a fan-out multiplies this per agent`);
     }
     // Resume: journaled results of a prior run, keyed by agent-call identity.
     const resumeSource = opts.resumeRunId ?? opts.resumeFrom;
@@ -434,7 +585,7 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
             const estimateRequest = summarizePolicyRequest({
                 phase: "dispatch",
                 action: "spawn agent",
-                path: cwd,
+                path: executionCwd,
                 harness,
                 model: agentOpts.model,
                 effort: agentOpts.effort,
@@ -442,7 +593,7 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 max_turns: agentOpts.maxTurns ?? DEFAULT_MAX_TURNS,
                 timeout_ms: agentOpts.timeoutMs ?? DEFAULT_TIMEOUT_MS,
                 prompt_bytes: Buffer.byteLength(dispatchPrompt),
-                isolation,
+                isolation: effectiveIsolation,
                 network_access: networkAccess,
                 current_cost_usd: round4(costUsd + reservedCostUsd),
                 projected_cost_usd: null,
@@ -571,7 +722,7 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                     effort: agentOpts.effort,
                     timeoutMs: agentOpts.timeoutMs ?? DEFAULT_TIMEOUT_MS,
                     maxTurns: agentOpts.maxTurns ?? DEFAULT_MAX_TURNS,
-                    cwd,
+                    cwd: executionCwd,
                     runId,
                     subscriptionOnly,
                 });
@@ -689,8 +840,8 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
         return authorizePolicyRequest({
             phase: "external_mutation",
             action: input.action,
-            path: input.path ? resolve(cwd, input.path) : undefined,
-            isolation,
+            path: input.path ? resolve(executionCwd, input.path) : undefined,
+            isolation: effectiveIsolation,
             network_access: network,
             service: input.service,
             target: input.target,
@@ -728,13 +879,27 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 concurrency,
                 specialists: Object.keys(specialists),
                 policy: policy ? { name: policy.name, sha256: policyDigest(policy) } : null,
-                isolation,
+                isolation: effectiveIsolation,
                 network_access: networkAccess,
+                workspace_binding: workspaceBinding
+                    ? { binding_id: workspaceBinding.binding_id, provider_id: workspaceBinding.provider.id }
+                    : null,
             });
         }
-        const result = await mod.default(ctx);
+        if (initializationError)
+            throw initializationError;
+        if (!workflow)
+            throw new Error("workflow module initialization did not produce an executable");
+        const result = await workflow(ctx);
         const endedAt = new Date().toISOString();
         const durationMs = Date.now() - t0;
+        const workspaceAttestation = workspaceBinding
+            ? await attestTerminal(workspaceProvider, workspaceBinding)
+            : undefined;
+        observedWorkspaceAttestation = workspaceAttestation;
+        if (workspaceAttestation && workspaceAttestation.status !== "ok") {
+            throw new Error(`terminal workspace attestation ${workspaceAttestation.status}: ${workspaceAttestation.provider_drift.join("; ") || "provider could not prove the workspace"}`);
+        }
         journal("run.end", {
             ok: true,
             agents: agentsSpawned,
@@ -755,8 +920,8 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 endedAt,
                 durationMs,
                 journalPath,
-                before: repoBefore,
-                after: snapshotRepo(cwd),
+                before: executionRepoBefore,
+                after: snapshotRepo(executionCwd),
                 agents: Array.from(agentProofs.values()),
                 evidence: evidenceRecords,
                 harnessEvidence: opts.harnessEvidence,
@@ -764,10 +929,13 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                     ? {
                         config: policy,
                         decisions: Array.from(policyDecisions.values()),
-                        isolation,
+                        isolation: effectiveIsolation,
                         networkAccess,
                     }
                     : undefined,
+                workspaceBinding,
+                workspaceAttestation,
+                workspaceFallback,
                 result,
             });
             writeWorkflowProof(proofPath, proof);
@@ -793,11 +961,15 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 mode: subscriptionOnly ? "subscription" : p.mode,
             })),
             policy: proof.policy?.summary,
+            workspaceBinding,
         };
         return report;
     }
     catch (err) {
-        if (err instanceof WorkflowParkedError || err instanceof WorkflowRunError)
+        if (err instanceof WorkflowParkedError) {
+            throw err;
+        }
+        if (err instanceof WorkflowRunError)
             throw err;
         const endedAt = new Date().toISOString();
         const durationMs = Date.now() - t0;
@@ -810,6 +982,10 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
             duration_ms: durationMs,
         });
         try {
+            const workspaceAttestation = workspaceBinding
+                ? (observedWorkspaceAttestation ??
+                    (await attestTerminal(workspaceProvider, workspaceBinding)))
+                : undefined;
             const proof = buildWorkflowProof({
                 runId,
                 workItemId: opts.workItemId ?? resumeState?.manifest.work_item_id,
@@ -821,8 +997,8 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 endedAt,
                 durationMs,
                 journalPath,
-                before: repoBefore,
-                after: snapshotRepo(cwd),
+                before: executionRepoBefore,
+                after: snapshotRepo(executionCwd),
                 agents: Array.from(agentProofs.values()),
                 evidence: evidenceRecords,
                 harnessEvidence: opts.harnessEvidence,
@@ -830,10 +1006,13 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                     ? {
                         config: policy,
                         decisions: Array.from(policyDecisions.values()),
-                        isolation,
+                        isolation: effectiveIsolation,
                         networkAccess,
                     }
                     : undefined,
+                workspaceBinding,
+                workspaceAttestation,
+                workspaceFallback,
                 error: err.message,
             });
             writeWorkflowProof(proofPath, proof);

package/dist/core/workflow/index.d.ts

@@ -7,4 +7,6 @@ export type { WorkflowRunManifest } from "./run-state.js";
 export { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, readWorkflowRunManifest, WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION, workflowRunManifestPath, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
 export type { AcceptanceCriterion, AcceptanceResult, AcceptanceStatus, AcceptanceSummary, AgentOpts, EngineOpts, EvidenceKind, EvidenceSource, EvidenceStatus, HarnessEvidenceCapability, HarnessEvidenceCoverage, HarnessName, ResultDigest, RunReport, Spawner, SpawnRequest, SpawnResult, StageSchema, WorkflowAgentProof, WorkflowApprovalMode, WorkflowAttemptContext, WorkflowAttemptFailureCause, WorkflowAttemptPriorContext, WorkflowAttemptUnresolvedCriterion, WorkflowContext, WorkflowEvidenceInput, WorkflowEvidenceRecord, WorkflowMeta, WorkflowModule, WorkflowPolicyProof, WorkflowProof, WorkflowProofUnknown, WorkflowRepoEvidence, WorkflowRepoSnapshot, WorkflowRunStatus, WorkflowSpecialistProfile, WorkflowWorkContext, } from "./types.js";
 export { WORKFLOW_ATTEMPT_CONTEXT_SCHEMA_VERSION, WORKFLOW_PROOF_SCHEMA_VERSION, WORKFLOW_WORK_CONTEXT_SCHEMA_VERSION, } from "./types.js";
+export type { ApplyIntegrationInput, AuthorizedIntegrationPlan, AuthorizedProviderIntegrationInput, CancelWorkspaceInput, CleanupWorkspaceInput, FilesystemIdentity, IntegrationApplyAttempt, IntegrationApplyReceipt, IntegrationAuthorization, IntegrationPlan, IntegrationReviewRecord, IntegrationTarget, LocalGitWorktreeProviderOptions, PrepareIntegrationInput, ProviderIntegrationInput, ProviderIntegrationPreview, ProviderIntegrationResult, ProviderUnknown, ProviderUnsupportedReason, RepositoryBinding, ValidatedFilesystemPath, WorkflowWorkspaceInspection, WorkflowWorkspaceSelection, WorkflowWorkspaceStatus, WorkflowWorkspaceVerification, WorkspaceAllocationRequest, WorkspaceAttestation, WorkspaceBinding, WorkspaceBoundExecutionEvidence, WorkspaceCancellationReceipt, WorkspaceCancellationResult, WorkspaceCleanupAttempt, WorkspaceCleanupIntent, WorkspaceCleanupMode, WorkspaceCleanupReceipt, WorkspaceCleanupResult, WorkspaceCompatibilityExecutionEvidence, WorkspaceExecutionEvidence, WorkspaceIntegrationState, WorkspaceIsolation, WorkspaceLifecycleProjection, WorkspaceLifecycleProjectionInput, WorkspaceLifecycleState, WorkspaceObservation, WorkspaceOwner, WorkspaceProbeInput, WorkspaceProbeResult, WorkspaceProofOutcome, WorkspaceProvider, WorkspaceProviderCapabilities, WorkspaceProviderRef, WorkspaceResourceState, WorkspaceUnsupportedExecutionEvidence, } from "./workspaces/index.js";
+export { applyIntegration, assertWorkspaceLifecycleTransition, cancelWorkspace, cleanupWorkspace, createLocalGitWorktreeProvider, deriveWorkspaceLifecycle, inspectWorkflowWorkspace, isWorkspaceLifecycleState, listWorkflowWorkspaceInspections, prepareIntegration, probeLocalGitWorktreeProvider, readWorkflowWorkspaceStatus, renderWorkflowWorkspaceStatus, validateProviderEventChain, WORKSPACE_BINDING_SCHEMA_VERSION, WORKSPACE_RECEIPT_SCHEMA_VERSION, } from "./workspaces/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/core/workflow/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,2BAA2B,EAC3B,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,gCAAgC,EAChC,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,uBAAuB,EACvB,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,cAAc,EACd,cAAc,EACd,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,EACX,YAAY,EACZ,SAAS,EACT,OAAO,EACP,YAAY,EACZ,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,kCAAkC,EAClC,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uCAAuC,EACvC,6BAA6B,EAC7B,oCAAoC,GACrC,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,2BAA2B,EAC3B,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,gCAAgC,EAChC,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,uBAAuB,EACvB,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,cAAc,EACd,cAAc,EACd,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,EACX,YAAY,EACZ,SAAS,EACT,OAAO,EACP,YAAY,EACZ,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,kCAAkC,EAClC,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uCAAuC,EACvC,6BAA6B,EAC7B,oCAAoC,GACrC,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,kCAAkC,EAClC,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC7B,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,EAChB,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uCAAuC,EACvC,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,EAClB,4BAA4B,EAC5B,iCAAiC,EACjC,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,qCAAqC,GACtC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,gBAAgB,EAChB,kCAAkC,EAClC,eAAe,EACf,gBAAgB,EAChB,8BAA8B,EAC9B,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,uBAAuB,CAAC"}

package/dist/core/workflow/index.js

@@ -4,3 +4,4 @@ export { runWorkflow, WorkflowParkedError, WorkflowRunError } from "./engine.js"
 export { buildWorkflowProof, createEvidenceRecord, digestResult, normalizeWorkflowMeta, readWorkflowProof, renderWorkflowProof, rollupAcceptance, writeWorkflowProof, } from "./proof.js";
 export { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, readWorkflowRunManifest, WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION, workflowRunManifestPath, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
 export { WORKFLOW_ATTEMPT_CONTEXT_SCHEMA_VERSION, WORKFLOW_PROOF_SCHEMA_VERSION, WORKFLOW_WORK_CONTEXT_SCHEMA_VERSION, } from "./types.js";
+export { applyIntegration, assertWorkspaceLifecycleTransition, cancelWorkspace, cleanupWorkspace, createLocalGitWorktreeProvider, deriveWorkspaceLifecycle, inspectWorkflowWorkspace, isWorkspaceLifecycleState, listWorkflowWorkspaceInspections, prepareIntegration, probeLocalGitWorktreeProvider, readWorkflowWorkspaceStatus, renderWorkflowWorkspaceStatus, validateProviderEventChain, WORKSPACE_BINDING_SCHEMA_VERSION, WORKSPACE_RECEIPT_SCHEMA_VERSION, } from "./workspaces/index.js";

package/dist/core/workflow/proof.d.ts

@@ -1,6 +1,7 @@
 import type { RepoSnapshot } from "../context/index.js";
 import type { NormalizedPolicy, PolicyDecision, PolicyIsolation, PolicyNetworkAccess } from "../policy/index.js";
 import type { AcceptanceCriterion, AcceptanceResult, AcceptanceSummary, HarnessEvidenceCapability, ResultDigest, WorkflowAgentProof, WorkflowAttemptContext, WorkflowEvidenceInput, WorkflowEvidenceRecord, WorkflowMeta, WorkflowProof, WorkflowWorkContext } from "./types.js";
+import type { WorkspaceAttestation, WorkspaceBinding, WorkspaceUnsupportedExecutionEvidence } from "./workspaces/index.js";
 export interface NormalizedWorkflowMeta {
     name: string;
     description?: string;
@@ -29,6 +30,9 @@ export interface BuildWorkflowProofInput {
         isolation: PolicyIsolation;
         networkAccess: PolicyNetworkAccess;
     };
+    workspaceBinding?: WorkspaceBinding;
+    workspaceAttestation?: WorkspaceAttestation;
+    workspaceFallback?: WorkspaceUnsupportedExecutionEvidence;
     result?: unknown;
     error?: string;
 }

package/dist/core/workflow/proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/proof.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EAEzB,YAAY,EACZ,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EAEZ,aAAa,EAIb,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAgBpB,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC5C,cAAc,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAClD,IAAI,EAAE,sBAAsB,CAAC;IAC7B,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACnC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;QACrC,SAAS,EAAE,eAAe,CAAC;QAC3B,aAAa,EAAE,mBAAmB,CAAC;KACpC,CAAC;IACF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GACnB,sBAAsB,CAqCxB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,sBAAsB,CA6BzB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,QAAQ,EAAE,sBAAsB,EAAE,GACjC;IAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,CAuB9D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,CAQjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,aAAa,CA6ChF;AAgCD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAe3E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CA6BjF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAoChE"}
+{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/proof.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EAEzB,YAAY,EACZ,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EAEZ,aAAa,EAIb,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EAEhB,qCAAqC,EACtC,MAAM,uBAAuB,CAAC;AAoB/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC5C,cAAc,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAClD,IAAI,EAAE,sBAAsB,CAAC;IAC7B,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACnC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;QACrC,SAAS,EAAE,eAAe,CAAC;QAC3B,aAAa,EAAE,mBAAmB,CAAC;KACpC,CAAC;IACF,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,iBAAiB,CAAC,EAAE,qCAAqC,CAAC;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GACnB,sBAAsB,CAqCxB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,sBAAsB,CA6BzB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,QAAQ,EAAE,sBAAsB,EAAE,GACjC;IAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,CAuB9D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,CAQjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,aAAa,CAiDhF;AAgCD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAO3E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAgDjF;AA2BD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAoChE"}

package/dist/core/workflow/proof.js

@@ -1,10 +1,13 @@
-import { createHash, randomUUID } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
-import { dirname, join } from "node:path";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
 import { policyDigest } from "../policy/index.js";
 import { isCanonicalWorkflowAttemptContext } from "./attempt-context.js";
+import { stableDigest, writeImmutableJson } from "./durable-record.js";
+import { readWorkflowRunManifest } from "./run-state.js";
 import { WORKFLOW_PROOF_SCHEMA_VERSION } from "./types.js";
 import { isCanonicalWorkflowWorkContext } from "./work-context.js";
+import { isWorkspaceBoundExecutionEvidence, isWorkspaceExecutionEvidence, isWorkspaceUnsupportedExecutionEvidence, workspaceProofLifecycle, } from "./workspaces/validate.js";
 const MAX_ACCEPTANCE_CRITERIA = 50;
 const MAX_EVIDENCE_RECORDS = 200;
 const MAX_PACKET_BYTES = 512 * 1024;
@@ -139,6 +142,9 @@ export function buildWorkflowProof(input) {
         agents,
         evidence: input.evidence,
         policy: input.policy ? buildPolicyProof(input.policy) : undefined,
+        execution: input.workspaceBinding && input.workspaceAttestation
+            ? buildExecutionEvidence(input.status, input.workspaceBinding, input.workspaceAttestation)
+            : input.workspaceFallback,
         repository,
         harnesses,
         unknowns,
@@ -184,17 +190,7 @@ export function writeWorkflowProof(path, proof) {
     if (bytes > MAX_PACKET_BYTES) {
         throw new Error(`workflow proof is ${bytes} bytes; limit is ${MAX_PACKET_BYTES}`);
     }
-    mkdirSync(dirname(path), { recursive: true });
-    const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
-    try {
-        writeFileSync(temporary, body, { encoding: "utf8", flag: "wx", mode: 0o600 });
-        renameSync(temporary, path);
-        chmodSync(path, 0o600);
-    }
-    finally {
-        if (existsSync(temporary))
-            unlinkSync(temporary);
-    }
+    writeImmutableJson(path, proof);
 }
 export function readWorkflowProof(coordRoot, runId) {
     if (!RUN_ID.test(runId))
@@ -222,11 +218,50 @@ export function readWorkflowProof(coordRoot, runId) {
         (proof.run.attempt_context !== undefined &&
             (!proof.run.work_item_id ||
                 !proof.run.work_context ||
-                !isCanonicalWorkflowAttemptContext(proof.run.attempt_context)))) {
+                !isCanonicalWorkflowAttemptContext(proof.run.attempt_context))) ||
+        (proof.execution !== undefined &&
+            !isWorkspaceExecutionEvidence(proof.execution, runId, proof.run.status))) {
         throw new Error(`workflow proof at ${path} has an unsupported or mismatched schema`);
     }
+    const manifestPath = join(coordRoot, ".harnery", "workflows", runId, "run.json");
+    if (proof.execution === undefined && !existsSync(manifestPath))
+        return proof;
+    const manifest = readWorkflowRunManifest(coordRoot, runId);
+    const manifestBinding = manifest.execution.workspace_binding;
+    const manifestFallback = manifest.execution.workspace_fallback;
+    const proofExecution = proof.execution;
+    const executionMatches = manifestBinding !== undefined
+        ? isWorkspaceBoundExecutionEvidence(proofExecution, runId) &&
+            stableDigest(proofExecution.binding) === stableDigest(manifestBinding)
+        : manifestFallback !== undefined
+            ? isWorkspaceUnsupportedExecutionEvidence(proofExecution, runId) &&
+                stableDigest(proofExecution) === stableDigest(manifestFallback)
+            : proofExecution === undefined;
+    if (!executionMatches) {
+        throw new Error(`workflow proof at ${path} does not match the frozen execution manifest`);
+    }
     return proof;
 }
+function buildExecutionEvidence(workflowStatus, binding, terminalAttestation) {
+    return {
+        schema_version: 1,
+        binding,
+        terminal_attestation: terminalAttestation,
+        terminal_lifecycle_state: workspaceProofLifecycle(workflowStatus, terminalAttestation),
+        drift: [...terminalAttestation.provider_drift],
+        unsupported: [...terminalAttestation.unsupported],
+        unknowns: [...terminalAttestation.unknowns],
+        receipts: {
+            request: "workspace-request.json",
+            cancellation_outcome: "cancellation/outcome.json",
+            integration_plan: "integration/plan.json",
+            integration_authorization: "integration/authorization.json",
+            integration_apply: "integration/receipt.json",
+            cleanup_intent: "cleanup/intent.json",
+            cleanup_receipt: "cleanup/receipt.json",
+        },
+    };
+}
 export function renderWorkflowProof(proof) {
     const lines = [
         `run ${proof.run.id} (${proof.run.name}): ${proof.run.status}`,

package/dist/core/workflow/run-state.d.ts

@@ -1,6 +1,7 @@
 import type { RepoSnapshot } from "../context/index.js";
 import { type NormalizedPolicy, type PolicyIsolation, type PolicyNetworkAccess } from "../policy/index.js";
 import type { WorkflowAttemptContext, WorkflowSpecialistProfile, WorkflowWorkContext } from "./types.js";
+import type { WorkspaceBinding, WorkspaceUnsupportedExecutionEvidence } from "./workspaces/index.js";
 export declare const WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION: 1;
 export interface WorkflowRunManifest {
     schema_version: typeof WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION;
@@ -28,6 +29,8 @@ export interface WorkflowRunManifest {
         network_access: PolicyNetworkAccess;
         policy?: NormalizedPolicy;
         specialists?: Record<string, WorkflowSpecialistProfile>;
+        workspace_binding?: WorkspaceBinding;
+        workspace_fallback?: WorkspaceUnsupportedExecutionEvidence;
     };
 }
 export interface WriteWorkflowRunManifestInput {

package/dist/core/workflow/run-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-state.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/run-state.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAEzB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,KAAK,EACV,sBAAsB,EACtB,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAGpB,eAAO,MAAM,oCAAoC,EAAG,CAAU,CAAC;AAK/D,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,iBAAiB,EAAE,YAAY,CAAC;IAChC,SAAS,EAAE;QACT,GAAG,EAAE,MAAM,CAAC;QACZ,eAAe,EAAE,MAAM,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;QAC/B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,SAAS,EAAE,eAAe,CAAC;QAC3B,cAAc,EAAE,mBAAmB,CAAC;QACpC,MAAM,CAAC,EAAE,gBAAgB,CAAC;QAC1B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;KACzD,CAAC;CACH;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,6BAA6B,GAAG,MAAM,CAmBrF;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAwC7F;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CA4BvD;AAED,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CASjF;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGhF;AAED,4EAA4E;AAC5E,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,IAAI,CA0CvF"}
+{"version":3,"file":"run-state.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/run-state.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAEzB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EACV,sBAAsB,EACtB,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAEV,gBAAgB,EAChB,qCAAqC,EACtC,MAAM,uBAAuB,CAAC;AAO/B,eAAO,MAAM,oCAAoC,EAAG,CAAU,CAAC;AAK/D,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,iBAAiB,EAAE,YAAY,CAAC;IAChC,SAAS,EAAE;QACT,GAAG,EAAE,MAAM,CAAC;QACZ,eAAe,EAAE,MAAM,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;QAC/B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,SAAS,EAAE,eAAe,CAAC;QAC3B,cAAc,EAAE,mBAAmB,CAAC;QACpC,MAAM,CAAC,EAAE,gBAAgB,CAAC;QAC1B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;QACxD,iBAAiB,CAAC,EAAE,gBAAgB,CAAC;QACrC,kBAAkB,CAAC,EAAE,qCAAqC,CAAC;KAC5D,CAAC;CACH;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,6BAA6B,GAAG,MAAM,CAgBrF;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAyC7F;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CA4BvD;AAED,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CASjF;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGhF;AAED,4EAA4E;AAC5E,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,IAAI,CA0CvF"}