harnery 0.22.1 → 0.24.0

package/README.md

@@ -22,6 +22,7 @@
 - **Multi-agent coordination:** per-agent heartbeats in `.harnery/active/`, claim-time and commit-time guards, the canonical event stream, councils, a decision docket, per-agent scratchpads, and harness adapters for Claude Code / Cursor / Codex.
 - **Cross-machine presence:** sessions on every machine that shares a repo see each other, labeled by machine. Zero-config over the repo's own git remote (presence refs), with an optional live-socket upgrade via an end-to-end-encrypted relay — the public `relay.harnery.com`, or self-host with `harn relay serve` / the bundled Cloudflare Worker (`relay/worker/`). The relay sees only ciphertext in opaquely-named rooms.
 - **Coordination-aware workflows:** `harn workflow run <script>` executes bounded, schema-gated multi-subagent workflow scripts — plain JS stages fanning out to headless harness-CLI subagents that are born coordination-registered (heartbeats, events, claim guards), with deterministic code deciding the routing between stages. An optional host-owned policy gates dispatch and declared external mutations with `ALLOW`, `ASK`, and `DENY`; CLI `ASK` requests park durably for an explicit approve/deny and same-run resume, while library callers remain fail-closed by default.
+- **Optional isolated workspaces:** add `--isolation worktree --workspace-root <dir>` to run a workflow in a host-owned local Git worktree. Harnery freezes the allocation and provider identity, verifies the workspace before execution and resume, requires review and policy authority before fast-forward integration, and keeps cleanup conservative. Inspect with `harn workflow workspace`, then use the separate `workflow integration prepare`, `integration apply`, and `cleanup` phases; shared execution remains the default.
 - **Durable work above attempts:** `harn work` preserves an objective across bounded workflow attempts, dependencies, approval parks, failures, and review. Reusable workflow code receives the exact work ID, title, objective, acceptance criteria, and attempt identity as frozen typed context. A retry also receives the prior run's bounded error and unresolved proof criteria, while retry authority and attempt ceilings remain unchanged. The manifest, proof, and append-only ledger bind the same context, and the one-shot reconciler reports the next explicit action without silently spawning, retrying, or accepting work.
 - **Bounded goal supervision:** `harn supervisor` freezes a mission or existing root graph, specialist team, and safety limits, then runs scheduling cycles until reviewed mission success, human attention, no progress, or budget exhaustion. Its optional planner can create the first milestone, reassess accepted milestone proof, or recover a terminal graph using only a frozen workflow-template catalog. Plans can require independent bounded specialist review before ordinary approval or auto-apply authority, old generations remain immutable evidence, and all attempts still consume the goal budget. Use explicit foreground ticks or enroll goals in the optional heartbeat-backed background service.
 - **Standalone web UI:** `harn web up` boots a local Next.js dashboard for the coord layer, councils, per-project state, and a local coding-agent status view (Claude Code / Codex / Cursor usage, backed by `harn devtools`). Ships with the git clone, not the npm package (see [Install](#install)).

package/dist/commands/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAgDnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA2XjF"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAiEnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAqqBjF"}

package/dist/commands/workflow.js

@@ -1,4 +1,6 @@
-import { workflowSubscriptionOnly } from "../core/config.js";
+import { existsSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { resolveBinName, workflowSubscriptionOnly } from "../core/config.js";
 import { createBuiltinHarnessRegistry } from "../core/harnesses/index.js";
 import { findCoordRoot } from "../core/hooks/resolve/coord-root.js";
 import { loadPolicyFile } from "../core/policy/index.js";
@@ -24,6 +26,7 @@ export function registerWorkflowCommand(program, emit) {
         "without this the engine refuses that silent-override state")
         .option("--policy <file>", "Host policy JSON/JSONC applied before dispatch and external mutation")
         .option("--isolation <mode>", "Host-created execution boundary: shared | worktree | sandbox | remote (default shared)")
+        .option("--workspace-root <dir>", "Explicit writable parent for the built-in local Git worktree provider (requires --isolation worktree)")
         .option("--approval-to <address>", "Address durable ASK requests (default: operator)")
         .option("--json", "Emit the full RunReport as JSON")
         .action(async (script, opts) => {
@@ -50,6 +53,13 @@ export function registerWorkflowCommand(program, emit) {
             });
             process.exit(1);
         }
+        if (opts.workspaceRoot && opts.isolation !== "worktree") {
+            emit.error({
+                code: "bad_workspace_root",
+                message: "--workspace-root requires --isolation worktree",
+            });
+            process.exit(1);
+        }
         // Flag beats config; the two flags contradict each other by design.
         const subscriptionOnly = opts.subscriptionOnly || workflowSubscriptionOnly(coordRoot);
         if (subscriptionOnly && opts.allowApiBilling) {
@@ -61,7 +71,13 @@ export function registerWorkflowCommand(program, emit) {
             process.exit(1);
         }
         try {
-            const { runWorkflow } = await import("../core/workflow/engine.js");
+            const { createLocalGitWorktreeProvider, runWorkflow } = await import("../core/workflow/index.js");
+            const workspace = opts.workspaceRoot
+                ? {
+                    provider: createLocalGitWorktreeProvider({ coordRoot }),
+                    writableRoots: [resolve(opts.workspaceRoot)],
+                }
+                : undefined;
             const report = await runWorkflow(script, {
                 coordRoot,
                 spawners: registry.spawners(),
@@ -82,6 +98,7 @@ export function registerWorkflowCommand(program, emit) {
                 approvalMode: "park",
                 approvalAddressee: opts.approvalTo,
                 isolation: opts.isolation,
+                workspace,
                 // CLI harness subprocesses inherit the host network. A policy that
                 // forbids network must therefore deny dispatch unless a future host
                 // adapter creates and declares a network-disabled boundary.
@@ -118,7 +135,7 @@ export function registerWorkflowCommand(program, emit) {
                 else {
                     emit.text(`run ${err.runId} parked\napproval: ${err.approvalId}\n` +
                         `journal: ${err.journalPath}\n` +
-                        `resume after resolution: harn workflow resume ${err.runId}\n`);
+                        `resume after resolution: ${resolveBinName()} workflow resume ${err.runId}\n`);
                 }
                 return;
             }
@@ -146,12 +163,22 @@ export function registerWorkflowCommand(program, emit) {
             process.exit(1);
         }
         try {
-            const { assertWorkflowRunResumable, runWorkflow } = await import("../core/workflow/index.js");
+            const { assertWorkflowRunResumable, createLocalGitWorktreeProvider, runWorkflow } = await import("../core/workflow/index.js");
             const { manifest } = assertWorkflowRunResumable(coordRoot, runId);
+            const binding = manifest.execution.workspace_binding;
+            if (binding && binding.provider.id !== "local-git-worktree") {
+                throw new Error(`workflow run ${runId} requires unavailable workspace provider ${binding.provider.id}`);
+            }
             const report = await runWorkflow(manifest.script.path, {
                 coordRoot,
                 spawners: registry.spawners(),
                 resumeRunId: runId,
+                workspace: binding
+                    ? {
+                        provider: createLocalGitWorktreeProvider({ coordRoot }),
+                        writableRoots: [binding.writable_root.configured],
+                    }
+                    : undefined,
                 harnessEvidence: Object.fromEntries(registry
                     .list()
                     .map((adapter) => [
@@ -199,6 +226,249 @@ export function registerWorkflowCommand(program, emit) {
             process.exit(1);
         }
     });
+    workflow
+        .command("workspace <run-id>")
+        .description("Show validated allocation, verification, integration, and cleanup state.")
+        .option("--json", "Emit the validated workspace status as JSON")
+        .action(async (runId, opts) => {
+        const coordRoot = findCoordRoot();
+        if (!coordRoot) {
+            emit.error({
+                code: "no_coord_root",
+                message: "no .harnery/ coordination root found; run `init` first",
+            });
+            process.exit(1);
+        }
+        const { inspectWorkflowWorkspace, renderWorkflowWorkspaceStatus } = await import("../core/workflow/index.js");
+        const inspection = inspectWorkflowWorkspace(coordRoot, runId);
+        if (!inspection.ok) {
+            emit.error({ code: "workflow_workspace_invalid", message: inspection.error });
+            process.exit(1);
+        }
+        if (opts.json) {
+            emit.config({ format: "json" });
+            emit.data(inspection.value);
+            return;
+        }
+        emit.text(renderWorkflowWorkspaceStatus(inspection.value));
+    });
+    workflow
+        .command("workspaces")
+        .description("List validated isolated and shared-compatibility workspace decisions.")
+        .option("--json", "Emit workspace inspections as JSON")
+        .action(async (opts) => {
+        const coordRoot = findCoordRoot();
+        if (!coordRoot) {
+            emit.error({
+                code: "no_coord_root",
+                message: "no .harnery/ coordination root found; run `init` first",
+            });
+            process.exit(1);
+        }
+        const { listWorkflowWorkspaceInspections } = await import("../core/workflow/index.js");
+        const inspections = listWorkflowWorkspaceInspections(coordRoot).filter((inspection) => !inspection.ok || inspection.value.selection !== "shared");
+        if (opts.json) {
+            emit.config({ format: "json" });
+            emit.data(inspections);
+            return;
+        }
+        if (inspections.length === 0) {
+            emit.text("no isolated or shared-compatibility workspace runs\n");
+            return;
+        }
+        emit.text(`${inspections
+            .map((inspection) => inspection.ok
+            ? [
+                inspection.value.run_id,
+                inspection.value.selection,
+                inspection.value.lifecycle.state,
+                `verify=${inspection.value.verification.status}`,
+                `integration=${inspection.value.integration.state}`,
+                `cleanup=${inspection.value.cleanup.state}`,
+            ].join("\t")
+            : `${inspection.run_id}\tinvalid\t${inspection.error}`)
+            .join("\n")}\n`);
+    });
+    const integration = workflow
+        .command("integration")
+        .description("Prepare and apply proof-gated isolated-workspace integration.");
+    integration
+        .command("prepare <run-id>")
+        .description("Preview integration and write exact review and policy authority.")
+        .option("--policy <file>", "Current host policy JSON/JSONC for the Git mutation")
+        .option("--reviewer <name>", "Explicit reviewer for a standalone workflow")
+        .option("--reason <text>", "Reason recorded with the standalone review")
+        .option("--target-root <dir>", "Explicit target checkout (default: frozen source checkout)")
+        .option("--accept-unknown <code>", "Accept one verification unknown by code (repeatable)", collectOption, [])
+        .option("--approval-to <address>", "Address a durable policy ASK request")
+        .option("--json", "Emit the durable integration plan as JSON")
+        .action(async (runId, opts) => {
+        const coordRoot = findCoordRoot();
+        if (!coordRoot) {
+            emit.error({
+                code: "no_coord_root",
+                message: "no .harnery/ coordination root found; run `init` first",
+            });
+            process.exit(1);
+        }
+        if (!opts.policy) {
+            emit.error({
+                code: "integration_policy_required",
+                message: "integration prepare requires --policy <file>",
+            });
+            process.exit(1);
+        }
+        if (opts.reason && !opts.reviewer) {
+            emit.error({
+                code: "integration_reviewer_required",
+                message: "--reason requires --reviewer <name>",
+            });
+            process.exit(1);
+        }
+        try {
+            const provider = await builtInProviderForRun(coordRoot, runId);
+            const { IntegrationPrepareParkedError, prepareIntegration } = await import("../core/workflow/index.js");
+            try {
+                const plan = await prepareIntegration({
+                    coordRoot,
+                    runId,
+                    provider,
+                    policy: loadPolicyFile(opts.policy),
+                    targetRoot: opts.targetRoot,
+                    review: opts.reviewer ? { actor: opts.reviewer, reason: opts.reason } : undefined,
+                    acceptedUnknowns: opts.acceptUnknown,
+                    approvalAddressee: opts.approvalTo,
+                });
+                if (opts.json) {
+                    emit.config({ format: "json" });
+                    emit.data(plan);
+                    return;
+                }
+                emit.text(`integration plan ${plan.plan_id} authorized\n` +
+                    `source: ${plan.provider_preview.source_commit}\n` +
+                    `target: ${plan.provider_preview.target_ref} at ${plan.provider_preview.target_commit}\n` +
+                    `changes: ${plan.provider_preview.changed_paths.length}\n` +
+                    `apply: ${resolveBinName()} workflow integration apply ${runId} --yes\n`);
+            }
+            catch (error) {
+                if (error instanceof IntegrationPrepareParkedError) {
+                    if (opts.json) {
+                        emit.config({ format: "json" });
+                        emit.data({
+                            status: "parked",
+                            runId: error.runId,
+                            planId: error.planId,
+                            approvalId: error.approvalId,
+                        });
+                    }
+                    else {
+                        emit.text(`integration preparation parked\n` +
+                            `run: ${error.runId}\n` +
+                            `plan: ${error.planId}\n` +
+                            `approval: ${error.approvalId}\n` +
+                            `approve: ${resolveBinName()} workflow approvals approve ${error.approvalId}\n`);
+                    }
+                    return;
+                }
+                throw error;
+            }
+        }
+        catch (error) {
+            emit.error({
+                code: "workflow_integration_prepare_failed",
+                message: error instanceof Error ? error.message : String(error),
+            });
+            process.exit(1);
+        }
+    });
+    integration
+        .command("apply <run-id>")
+        .description("Apply an authorized durable integration plan.")
+        .option("--yes", "Confirm the target-branch mutation")
+        .option("--json", "Emit the durable integration receipt as JSON")
+        .action(async (runId, opts) => {
+        const coordRoot = findCoordRoot();
+        if (!coordRoot) {
+            emit.error({
+                code: "no_coord_root",
+                message: "no .harnery/ coordination root found; run `init` first",
+            });
+            process.exit(1);
+        }
+        if (!opts.yes) {
+            emit.error({
+                code: "integration_confirmation_required",
+                message: "integration apply changes the target branch; pass --yes to confirm",
+            });
+            process.exit(1);
+        }
+        try {
+            const provider = await builtInProviderForRun(coordRoot, runId);
+            const { applyIntegration } = await import("../core/workflow/index.js");
+            const receipt = await applyIntegration({ coordRoot, runId, provider });
+            if (opts.json) {
+                emit.config({ format: "json" });
+                emit.data(receipt);
+                return;
+            }
+            emit.text(`integration ${receipt.status}: ${receipt.target_ref} at ${receipt.target_commit}\n` +
+                `receipt: ${receipt.receipt_id}\n` +
+                `cleanup: ${resolveBinName()} workflow cleanup ${runId} --yes\n`);
+        }
+        catch (error) {
+            emit.error({
+                code: "workflow_integration_apply_failed",
+                message: error instanceof Error ? error.message : String(error),
+            });
+            process.exit(1);
+        }
+    });
+    workflow
+        .command("cleanup <run-id>")
+        .description("Conservatively release a provider-owned isolated workspace.")
+        .option("--yes", "Confirm the worktree and provider-branch removal attempt")
+        .option("--json", "Emit the cleanup attempt or receipt as JSON")
+        .action(async (runId, opts) => {
+        const coordRoot = findCoordRoot();
+        if (!coordRoot) {
+            emit.error({
+                code: "no_coord_root",
+                message: "no .harnery/ coordination root found; run `init` first",
+            });
+            process.exit(1);
+        }
+        if (!opts.yes) {
+            emit.error({
+                code: "cleanup_confirmation_required",
+                message: "workspace cleanup may remove a worktree and branch; pass --yes to confirm",
+            });
+            process.exit(1);
+        }
+        try {
+            const provider = await builtInProviderForRun(coordRoot, runId);
+            const { cleanupWorkspace } = await import("../core/workflow/index.js");
+            const result = await cleanupWorkspace({ coordRoot, runId, provider });
+            if (opts.json) {
+                emit.config({ format: "json" });
+                emit.data(result);
+                return;
+            }
+            const receipt = "receipt_id" in result && typeof result.receipt_id === "string"
+                ? `\nreceipt: ${result.receipt_id}`
+                : "";
+            const reason = "reason" in result && typeof result.reason === "string"
+                ? `\nreason: ${result.reason}`
+                : "";
+            emit.text(`workspace cleanup ${result.status}: ${result.binding_id}${receipt}${reason}\n`);
+        }
+        catch (error) {
+            emit.error({
+                code: "workflow_cleanup_failed",
+                message: error instanceof Error ? error.message : String(error),
+            });
+            process.exit(1);
+        }
+    });
     const approvals = workflow
         .command("approvals")
         .description("Inspect and resolve durable workflow policy approvals.");
@@ -290,7 +560,7 @@ export function registerWorkflowCommand(program, emit) {
                 else {
                     emit.text(`${renderWorkflowApproval(resolved.approval)}` +
                         `${resolved.applied ? "decision recorded" : "decision already recorded"}\n` +
-                        `resume: harn workflow resume ${resolved.approval.request.run_id}\n`);
+                        approvalNextActionHint(coordRoot, resolved.approval));
                 }
             }
             catch (err) {
@@ -333,3 +603,30 @@ export function registerWorkflowCommand(program, emit) {
         }
     });
 }
+async function builtInProviderForRun(coordRoot, runId) {
+    const { createLocalGitWorktreeProvider, readWorkflowRunManifest } = await import("../core/workflow/index.js");
+    const manifest = readWorkflowRunManifest(coordRoot, runId);
+    const binding = manifest.execution.workspace_binding;
+    if (!binding) {
+        throw new Error(`workflow run ${runId} has no isolated workspace binding`);
+    }
+    if (binding.provider.id !== "local-git-worktree") {
+        throw new Error(`workflow run ${runId} requires unavailable workspace provider ${binding.provider.id}`);
+    }
+    return createLocalGitWorktreeProvider({ coordRoot });
+}
+function collectOption(value, previous) {
+    return [...previous, value];
+}
+/** Next operator command after resolving an approval. Mid-run parks resume the
+ * workflow; integration prepare parks after the run is already terminal, so
+ * the durable plan is authorized by re-running prepare (resume would fail). */
+function approvalNextActionHint(coordRoot, approval) {
+    const bin = resolveBinName();
+    const runId = approval.request.run_id;
+    const integrationPlanPath = join(coordRoot, ".harnery", "workflows", runId, "integration", "plan.json");
+    if (existsSync(integrationPlanPath)) {
+        return `prepare: ${bin} workflow integration prepare ${runId}\n`;
+    }
+    return `resume: ${bin} workflow resume ${runId}\n`;
+}

package/dist/core/work/state.d.ts

@@ -33,6 +33,10 @@ export interface WorkEvent {
     run_id?: string;
     attempt?: number;
     trigger?: WorkAttemptTrigger;
+    workspace_binding_id?: string;
+    proof_sha256?: string;
+    terminal_attestation_sha256?: string;
+    accepted_unknowns?: string[];
     state?: WorkState;
     next_action?: WorkNextAction;
 }
@@ -85,6 +89,7 @@ export declare function reconcileAllWorkItems(coordRoot: string, actor?: string)
 export declare function acceptWorkItem(coordRoot: string, workId: string, input?: {
     actor?: string;
     reason?: string;
+    acceptedUnknowns?: readonly string[];
 }): WorkRecord;
 export declare function cancelWorkItem(coordRoot: string, workId: string, input?: {
     actor?: string;
@@ -107,6 +112,8 @@ export declare function readWorkItemIgnoringLease(coordRoot: string, workId: str
 export declare function assertWorkflowUnchanged(intent: WorkIntent): void;
 /** @internal Runner seam; not a separate persistence contract. */
 export declare function acquireWorkLease(coordRoot: string, workId: string): () => void;
+/** @internal Work journal mutation seam. */
+export declare function acquireWorkEventLease(coordRoot: string, workId: string): () => void;
 /** @internal Runner seam; not a separate persistence contract. */
 export declare function boundedActor(value?: string, fallback?: string): string;
 //# sourceMappingURL=state.d.ts.map

package/dist/core/work/state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../src/core/work/state.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,0BAA0B,EAAG,CAAU,CAAC;AACrD,eAAO,MAAM,yBAAyB,EAAG,CAAU,CAAC;AAkBpD,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,OAAO,GACP,SAAS,GACT,mBAAmB,GACnB,WAAW,GACX,SAAS,GACT,WAAW,GACX,WAAW,CAAC;AAEhB,MAAM,MAAM,cAAc,GACtB,uBAAuB,GACvB,KAAK,GACL,cAAc,GACd,kBAAkB,GAClB,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,MAAM,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAAC;AAErD,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,OAAO,0BAA0B,CAAC;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,iBAAiB,GACjB,iBAAiB,GACjB,iBAAiB,GACjB,eAAe,GACf,gBAAgB,GAChB,eAAe,CAAC;AAEpB,MAAM,WAAW,SAAS;IACxB,cAAc,EAAE,OAAO,yBAAyB,CAAC;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,aAAa,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,WAAW,CAAC,EAAE,cAAc,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,cAAc,CAAC;IAC5B,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,UAAU,CA0DrE;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAI1E;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,EAAE,CAS7D;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAmC/F;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,CAIrF;AAED,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9C,UAAU,CAEZ;AAED,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9C,UAAU,CAQZ;AAED,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9C,UAAU,CAQZ;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAEjD;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAqPD,kEAAkE;AAClE,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,MAAM,GACZ,IAAI,CAgBN;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,GAAG,KAAK,GAAG,IAAI,CAAC,GAClE,SAAS,CAgCX;AAkCD,kEAAkE;AAClE,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAIvF;AA4HD,kEAAkE;AAClE,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAMhE;AAkBD,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,CA0C9E;AAiGD,kEAAkE;AAClE,wBAAgB,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,SAAa,GAAG,MAAM,CAE1E"}
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../src/core/work/state.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,0BAA0B,EAAG,CAAU,CAAC;AACrD,eAAO,MAAM,yBAAyB,EAAG,CAAU,CAAC;AAkBpD,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,OAAO,GACP,SAAS,GACT,mBAAmB,GACnB,WAAW,GACX,SAAS,GACT,WAAW,GACX,WAAW,CAAC;AAEhB,MAAM,MAAM,cAAc,GACtB,uBAAuB,GACvB,KAAK,GACL,cAAc,GACd,kBAAkB,GAClB,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,MAAM,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAAC;AAErD,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,OAAO,0BAA0B,CAAC;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,iBAAiB,GACjB,iBAAiB,GACjB,iBAAiB,GACjB,eAAe,GACf,gBAAgB,GAChB,eAAe,CAAC;AAEpB,MAAM,WAAW,SAAS;IACxB,cAAc,EAAE,OAAO,yBAAyB,CAAC;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,aAAa,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,WAAW,CAAC,EAAE,cAAc,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,cAAc,CAAC;IAC5B,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,UAAU,CA0DrE;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAI1E;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,EAAE,CAS7D;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAmC/F;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,CAIrF;AAED,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GACpF,UAAU,CAEZ;AAED,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9C,UAAU,CAQZ;AAED,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9C,UAAU,CAQZ;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAEjD;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAsSD,kEAAkE;AAClE,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,MAAM,GACZ,IAAI,CA4BN;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,GAAG,KAAK,GAAG,IAAI,CAAC,GAClE,SAAS,CAOX;AAwED,kEAAkE;AAClE,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAIvF;AAoJD,kEAAkE;AAClE,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAMhE;AAkBD,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,CAE9E;AAED,4CAA4C;AAC5C,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,CAOnF;AAuJD,kEAAkE;AAClE,wBAAgB,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,SAAa,GAAG,MAAM,CAE1E"}

package/dist/core/work/state.js

@@ -1,10 +1,12 @@
-import { randomBytes, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { appendFileSync, chmodSync, closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { hostname } from "node:os";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { readWorkflowApproval } from "../workflow/approvals.js";
+import { stableDigest } from "../workflow/durable-record.js";
 import { readWorkflowProof } from "../workflow/proof.js";
 import { readWorkflowRunManifest, workflowScriptDigest } from "../workflow/run-state.js";
+import { isWorkspaceBoundExecutionEvidence } from "../workflow/workspaces/validate.js";
 export const WORK_INTENT_SCHEMA_VERSION = 1;
 export const WORK_EVENT_SCHEMA_VERSION = 1;
 const WORK_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
@@ -135,7 +137,7 @@ export function acceptWorkItem(coordRoot, workId, input = {}) {
     return appendGovernanceEvent(coordRoot, workId, "work.accepted", ["in_review"], input);
 }
 export function cancelWorkItem(coordRoot, workId, input = {}) {
-    return appendGovernanceEvent(coordRoot, workId, "work.cancelled", ["waiting", "ready", "blocked", "in_review"], input);
+    return appendGovernanceEvent(coordRoot, workId, "work.cancelled", ["waiting", "ready", "running", "awaiting_approval", "blocked", "in_review"], input);
 }
 export function reopenWorkItem(coordRoot, workId, input = {}) {
     return appendGovernanceEvent(coordRoot, workId, "work.reopened", ["blocked", "in_review", "succeeded", "cancelled"], input);
@@ -340,49 +342,107 @@ function workContextForIntent(intent) {
     };
 }
 function appendGovernanceEvent(coordRoot, workId, event, allowed, input) {
-    const release = acquireWorkLease(coordRoot, workId);
+    const releaseWork = event === "work.cancelled" ? undefined : acquireWorkLease(coordRoot, workId);
+    const releaseEvent = acquireWorkEventLease(coordRoot, workId);
     try {
-        const current = readWorkItemIgnoringLease(coordRoot, workId);
+        const current = releaseWork
+            ? readWorkItemIgnoringLease(coordRoot, workId)
+            : readWorkItem(coordRoot, workId);
         if (!allowed.includes(current.projection.state)) {
             throw new Error(`work item ${workId} cannot ${event.replace("work.", "")} from state ${current.projection.state}`);
         }
-        appendWorkEvent(coordRoot, workId, {
+        const acceptance = event === "work.accepted"
+            ? acceptanceAuthority(coordRoot, current, input.acceptedUnknowns ?? [])
+            : undefined;
+        appendWorkEventUnderLease(coordRoot, workId, {
             event,
             actor: boundedActor(input.actor),
             reason: boundedOptional(input.reason, "work reason", MAX_REASON),
+            ...acceptance,
         });
     }
     finally {
-        release();
+        releaseEvent();
+        releaseWork?.();
     }
     return reconcileWorkItem(coordRoot, workId, input.actor);
 }
+function acceptanceAuthority(coordRoot, current, acceptedUnknowns) {
+    const latest = current.projection.attempts.at(-1);
+    if (!latest?.proof_path)
+        throw new Error("work acceptance requires terminal workflow proof");
+    const manifest = readWorkflowRunManifest(coordRoot, latest.run_id);
+    const proof = readWorkflowProof(coordRoot, latest.run_id);
+    if (proof.run.work_item_id !== current.intent.id ||
+        proof.run.attempt_context?.number !== latest.number) {
+        throw new Error("work acceptance proof does not match the durable attempt");
+    }
+    const accepted = [...new Set(acceptedUnknowns)].sort();
+    for (const code of accepted) {
+        boundedString(code, "accepted unknown code", 200);
+    }
+    const execution = proof.execution;
+    return {
+        run_id: latest.run_id,
+        attempt: latest.number,
+        proof_sha256: createHash("sha256").update(readFileSync(latest.proof_path)).digest("hex"),
+        workspace_binding_id: manifest.execution.workspace_binding?.binding_id,
+        terminal_attestation_sha256: isWorkspaceBoundExecutionEvidence(execution)
+            ? stableDigest(execution.terminal_attestation)
+            : undefined,
+        accepted_unknowns: execution ? accepted : undefined,
+    };
+}
 /** @internal Runner seam; not a separate persistence contract. */
 export function appendReconcileIfChanged(coordRoot, record, actor) {
-    const last = [...record.events].reverse().find((event) => event.event === "work.reconciled");
-    if (last?.state === record.projection.state &&
-        last.reason === record.projection.reason &&
-        last.next_action === record.projection.next_action) {
-        return;
+    let release;
+    try {
+        release = acquireWorkEventLease(coordRoot, record.intent.id);
+    }
+    catch (error) {
+        if (workEventLeaseIsLive(coordRoot, record.intent.id))
+            return;
+        throw error;
+    }
+    try {
+        const current = readWorkItemIgnoringLease(coordRoot, record.intent.id);
+        const last = [...current.events].reverse().find((event) => event.event === "work.reconciled");
+        if (last?.state === current.projection.state &&
+            last.reason === current.projection.reason &&
+            last.next_action === current.projection.next_action) {
+            return;
+        }
+        appendWorkEventUnderLease(coordRoot, current.intent.id, {
+            event: "work.reconciled",
+            actor,
+            reason: current.projection.reason,
+            state: current.projection.state,
+            next_action: current.projection.next_action,
+        });
+    }
+    finally {
+        release();
     }
-    appendWorkEvent(coordRoot, record.intent.id, {
-        event: "work.reconciled",
-        actor,
-        reason: record.projection.reason,
-        state: record.projection.state,
-        next_action: record.projection.next_action,
-    });
 }
 /** @internal Runner seam; not a separate persistence contract. */
 export function appendWorkEvent(coordRoot, workId, input) {
+    const release = acquireWorkEventLease(coordRoot, workId);
+    try {
+        return appendWorkEventUnderLease(coordRoot, workId, input);
+    }
+    finally {
+        release();
+    }
+}
+function appendWorkEventUnderLease(coordRoot, workId, input) {
     const events = readWorkEvents(coordRoot, workId);
     if (events.length === 0 && input.event !== "work.created") {
-        appendWorkEvent(coordRoot, workId, {
+        appendWorkEventUnderLease(coordRoot, workId, {
             event: "work.created",
             actor: "recovery",
             reason: "recovered creation receipt from immutable intent",
         });
-        return appendWorkEvent(coordRoot, workId, input);
+        return appendWorkEventUnderLease(coordRoot, workId, input);
     }
     if (events.length >= MAX_EVENTS)
         throw new Error(`work item ${workId} exceeds ${MAX_EVENTS} events`);
@@ -479,7 +539,9 @@ function validateWorkEvent(event, workId, seq) {
     }
     boundedActor(event.actor);
     boundedOptional(event.reason, "work reason", MAX_REASON);
-    if (event.event === "attempt.started" || event.event === "attempt.resumed") {
+    if (event.event === "attempt.started" ||
+        event.event === "attempt.resumed" ||
+        (event.event === "work.accepted" && event.run_id !== undefined)) {
         if (!event.run_id ||
             !RUN_ID.test(event.run_id) ||
             !Number.isSafeInteger(event.attempt) ||
@@ -487,6 +549,22 @@ function validateWorkEvent(event, workId, seq) {
             throw new Error(`work item ${workId} event ${seq} has invalid attempt data`);
         }
     }
+    if (event.event === "work.accepted" && event.run_id !== undefined) {
+        if (event.workspace_binding_id !== undefined) {
+            boundedString(event.workspace_binding_id, "workspace binding id", 200);
+        }
+        if (!/^[a-f0-9]{64}$/.test(event.proof_sha256 ?? "")) {
+            throw new Error(`work item ${workId} event ${seq} has invalid proof digest`);
+        }
+        if (event.workspace_binding_id !== undefined) {
+            if (!/^[a-f0-9]{64}$/.test(event.terminal_attestation_sha256 ?? "") ||
+                !Array.isArray(event.accepted_unknowns) ||
+                event.accepted_unknowns.some((code) => typeof code !== "string" || code.length === 0 || code.length > 200) ||
+                new Set(event.accepted_unknowns).size !== event.accepted_unknowns.length) {
+                throw new Error(`work item ${workId} event ${seq} has invalid execution review evidence`);
+            }
+        }
+    }
     if (event.trigger !== undefined &&
         (event.event !== "attempt.started" ||
             (event.trigger !== "initial" && event.trigger !== "retry"))) {
@@ -573,8 +651,15 @@ function workDir(coordRoot, workId) {
 }
 /** @internal Runner seam; not a separate persistence contract. */
 export function acquireWorkLease(coordRoot, workId) {
+    return acquireWorkFileLease(coordRoot, workId, "lease.json", "is already active");
+}
+/** @internal Work journal mutation seam. */
+export function acquireWorkEventLease(coordRoot, workId) {
+    return acquireWorkFileLease(coordRoot, workId, "events.lease.json", "event journal is already active");
+}
+function acquireWorkFileLease(coordRoot, workId, filename, activeMessage) {
     readWorkIntent(coordRoot, workId);
-    const path = join(workDir(coordRoot, workId), "lease.json");
+    const path = join(workDir(coordRoot, workId), filename);
     const owner = {
         pid: process.pid,
         host: hostname(),
@@ -602,7 +687,7 @@ export function acquireWorkLease(coordRoot, workId) {
     if (!acquire()) {
         const existing = readLease(path);
         if (existing && leaseIsLive(existing)) {
-            throw new Error(`work item ${workId} is already active under pid ${existing.pid} on ${existing.host}`);
+            throw new Error(`work item ${workId} ${activeMessage} under pid ${existing.pid} on ${existing.host}`);
         }
         unlinkSync(path);
         if (!acquire())
@@ -623,6 +708,10 @@ function workLeaseIsLive(coordRoot, workId) {
     const lease = readLease(join(workDir(coordRoot, workId), "lease.json"));
     return lease ? leaseIsLive(lease) : false;
 }
+function workEventLeaseIsLive(coordRoot, workId) {
+    const lease = readLease(join(workDir(coordRoot, workId), "events.lease.json"));
+    return lease ? leaseIsLive(lease) : false;
+}
 function workflowResumeLeaseIsLive(coordRoot, runId) {
     const lease = readLease(join(coordRoot, ".harnery", "workflows", runId, "resume.lock"));
     return lease ? leaseIsLive(lease) : false;