harnery 0.22.1 → 0.24.0

package/dist/core/workflow/child-env.d.ts

@@ -6,13 +6,17 @@
  *    harness CLI under a live session inherits vars that make it exit 1 with
  *    empty output; an empty-string var still reads as set. Scrub all three
  *    families (CLAUDE*, CODEX*, CURSOR*) regardless of which adapter spawns —
- *    a codex child launched from inside a Claude Code session must not
- *    inherit CLAUDE* either.
- * 2. **The scrub targets SESSION vars, not credentials.** CURSOR_API_KEY
+ *    a codex child launched from inside a Claude Code session must not inherit
+ *    CLAUDE* either. Preserve explicit auth/config locators such as CODEX_HOME:
+ *    changing the home silently changes which subscription account the child
+ *    uses.
+ * 2. **The scrub targets SESSION vars, not credentials or auth locators.** CURSOR_API_KEY
  *    matches the CURSOR* prefix but is an auth credential, so it is carved
- *    out and re-added — a key-only cursor host must keep working. (The other
- *    two key vars, ANTHROPIC_API_KEY and OPENAI_API_KEY, don't collide with
- *    the scrub prefixes.)
+ *    out and re-added — a key-only cursor host must keep working. CODEX_HOME
+ *    is likewise preserved because codex reads its ChatGPT subscription login
+ *    from `$CODEX_HOME/auth.json`. (The other two key vars,
+ *    ANTHROPIC_API_KEY and OPENAI_API_KEY, don't collide with the scrub
+ *    prefixes.)
  * 3. **subscriptionOnly deletes every API-key var** (see billing.ts) so the
  *    child can only authenticate via its stored subscription login — the
  *    guarantee behind `workflow run --subscription-only`.

package/dist/core/workflow/child-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"child-env.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,wBAAgB,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,YAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAY7F"}
+{"version":3,"file":"child-env.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAOH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,wBAAgB,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,YAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkB7F"}

package/dist/core/workflow/child-env.js

@@ -6,13 +6,17 @@
  *    harness CLI under a live session inherits vars that make it exit 1 with
  *    empty output; an empty-string var still reads as set. Scrub all three
  *    families (CLAUDE*, CODEX*, CURSOR*) regardless of which adapter spawns —
- *    a codex child launched from inside a Claude Code session must not
- *    inherit CLAUDE* either.
- * 2. **The scrub targets SESSION vars, not credentials.** CURSOR_API_KEY
+ *    a codex child launched from inside a Claude Code session must not inherit
+ *    CLAUDE* either. Preserve explicit auth/config locators such as CODEX_HOME:
+ *    changing the home silently changes which subscription account the child
+ *    uses.
+ * 2. **The scrub targets SESSION vars, not credentials or auth locators.** CURSOR_API_KEY
  *    matches the CURSOR* prefix but is an auth credential, so it is carved
- *    out and re-added — a key-only cursor host must keep working. (The other
- *    two key vars, ANTHROPIC_API_KEY and OPENAI_API_KEY, don't collide with
- *    the scrub prefixes.)
+ *    out and re-added — a key-only cursor host must keep working. CODEX_HOME
+ *    is likewise preserved because codex reads its ChatGPT subscription login
+ *    from `$CODEX_HOME/auth.json`. (The other two key vars,
+ *    ANTHROPIC_API_KEY and OPENAI_API_KEY, don't collide with the scrub
+ *    prefixes.)
  * 3. **subscriptionOnly deletes every API-key var** (see billing.ts) so the
  *    child can only authenticate via its stored subscription login — the
  *    guarantee behind `workflow run --subscription-only`.
@@ -24,6 +28,7 @@
  */
 import { API_KEY_VARS } from "./billing.js";
 const SCRUB_PREFIXES = ["CLAUDE", "CODEX", "CURSOR"];
+const PRESERVED_HARNESS_VARS = new Set(["CODEX_HOME"]);
 export function buildChildEnv(runId, opts = {}) {
     const env = {};
     const keyVars = new Set(Object.values(API_KEY_VARS));
@@ -32,8 +37,11 @@ export function buildChildEnv(runId, opts = {}) {
             continue;
         if (opts.subscriptionOnly && keyVars.has(k))
             continue;
-        if (SCRUB_PREFIXES.some((p) => k.startsWith(p)) && !keyVars.has(k))
+        if (SCRUB_PREFIXES.some((p) => k.startsWith(p)) &&
+            !keyVars.has(k) &&
+            !PRESERVED_HARNESS_VARS.has(k)) {
             continue;
+        }
         env[k] = v;
     }
     env.HARNERY_WORKFLOW_CHILD = "1";

package/dist/core/workflow/durable-record.d.ts

@@ -0,0 +1,7 @@
+export declare function stableDigest(value: unknown): string;
+export declare function canonicalJson(value: unknown): string;
+export declare function fileSha256(path: string): string;
+export declare function writeImmutableJson(path: string, value: unknown): boolean;
+export declare function fsyncParentDirectory(path: string): void;
+export declare function readJsonRecord<T>(path: string, label: string): T;
+//# sourceMappingURL=durable-record.d.ts.map

package/dist/core/workflow/durable-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"durable-record.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/durable-record.ts"],"names":[],"mappings":"AAkBA,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEnD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CA6BxE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAQvD;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC,CAShE"}

package/dist/core/workflow/durable-record.js

@@ -0,0 +1,83 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmodSync, closeSync, existsSync, fsyncSync, linkSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { dirname } from "node:path";
+const JSON_LIMIT = 512 * 1024;
+export function stableDigest(value) {
+    return createHash("sha256").update(canonicalJson(value)).digest("hex");
+}
+export function canonicalJson(value) {
+    return JSON.stringify(canonicalize(value));
+}
+export function fileSha256(path) {
+    return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+export function writeImmutableJson(path, value) {
+    const body = `${JSON.stringify(value, null, 2)}\n`;
+    if (Buffer.byteLength(body) > JSON_LIMIT) {
+        throw new Error(`immutable record exceeds ${JSON_LIMIT} bytes`);
+    }
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
+    let fd;
+    try {
+        fd = openSync(temporary, "wx", 0o600);
+        writeFileSync(fd, body, "utf8");
+        fsyncSync(fd);
+        closeSync(fd);
+        fd = undefined;
+        try {
+            linkSync(temporary, path);
+            chmodSync(path, 0o600);
+            fsyncParentDirectory(path);
+            return true;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            const existing = readFileSync(path, "utf8");
+            if (existing !== body)
+                throw new Error(`immutable record already exists at ${path}`);
+            return false;
+        }
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+        if (existsSync(temporary))
+            unlinkSync(temporary);
+    }
+}
+export function fsyncParentDirectory(path) {
+    const directory = dirname(path);
+    const fd = openSync(directory, "r");
+    try {
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export function readJsonRecord(path, label) {
+    if (!existsSync(path))
+        throw new Error(`${label} does not exist at ${path}`);
+    const size = statSync(path).size;
+    if (size <= 0 || size > JSON_LIMIT)
+        throw new Error(`${label} has invalid size ${size}`);
+    try {
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (error) {
+        throw new Error(`cannot parse ${label} at ${path}: ${error.message}`);
+    }
+}
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value)
+            .filter(([, item]) => item !== undefined)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([key, item]) => [key, canonicalize(item)]));
+    }
+    return value;
+}

package/dist/core/workflow/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAsCH,OAAO,KAAK,EAEV,UAAU,EAEV,SAAS,EAUV,MAAM,YAAY,CAAC;AAapB,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAM/E;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBAEjB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;CAOpF;AAED,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA6E1F"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAuCH,OAAO,KAAK,EAEV,UAAU,EAEV,SAAS,EAUV,MAAM,YAAY,CAAC;AAyBpB,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAM/E;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBAEjB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;CAOpF;AAED,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA6E1F"}

package/dist/core/workflow/engine.js

@@ -33,12 +33,16 @@ import { evaluatePolicy, normalizePolicy, PolicyDeniedError, policyDigest, summa
 import { assertWorkflowRunId, createWorkflowApproval } from "./approvals.js";
 import { freezeWorkflowAttemptContext } from "./attempt-context.js";
 import { probeBilling } from "./billing.js";
+import { stableDigest } from "./durable-record.js";
 import { buildWorkflowProof, createEvidenceRecord, digestResult, normalizeWorkflowMeta, writeWorkflowProof, } from "./proof.js";
 import { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
 import { normalizeWorkflowSpecialists, resolveSpecialistAssignment } from "./specialists.js";
 import { WORKFLOW_PROOF_SCHEMA_VERSION } from "./types.js";
 import { parseStageOutput, validateAgainstSchema } from "./validate.js";
 import { freezeWorkflowWorkContext } from "./work-context.js";
+import { attestTerminal, attestWorkspaceFailure, resolveWorkspaceBinding, } from "./workspaces/execution.js";
+import { appendWorkflowJournalEvent } from "./workspaces/state.js";
+import { isWorkspaceAttestation } from "./workspaces/validate.js";
 const DEFAULT_MAX_AGENTS = 50;
 const DEFAULT_CONCURRENCY = 4;
 const DEFAULT_MAX_ATTEMPTS = 2;
@@ -136,13 +140,19 @@ export async function runWorkflow(scriptPath, opts) {
     }
 }
 async function executeWorkflow(scriptPath, absScript, opts, resumeState, workContext, attemptContext) {
-    const mod = (await import(__rewriteRelativeImportExtension(pathToFileURL(absScript).href)));
-    if (typeof mod.default !== "function") {
-        throw new Error(`${scriptPath}: workflow script must \`export default async (ctx) => …\``);
+    const frozen = resumeState?.manifest.execution;
+    const isolation = frozen?.isolation ?? opts.isolation ?? "shared";
+    let sharedWorkflow;
+    let sharedMeta;
+    if (isolation === "shared") {
+        const mod = (await import(__rewriteRelativeImportExtension(pathToFileURL(absScript).href)));
+        if (typeof mod.default !== "function") {
+            throw new Error(`${scriptPath}: workflow script must \`export default async (ctx) => …\``);
+        }
+        const fallbackName = scriptPath.replace(/^.*\//, "").replace(/\.[cm]?js$/, "");
+        sharedWorkflow = mod.default;
+        sharedMeta = normalizeWorkflowMeta(mod.meta, fallbackName);
     }
-    const fallbackName = scriptPath.replace(/^.*\//, "").replace(/\.[cm]?js$/, "");
-    const meta = normalizeWorkflowMeta(mod.meta, fallbackName);
-    const name = meta.name;
     const runId = opts.resumeRunId ??
         opts.runId ??
         `wf-${new Date().toISOString().replace(/[:.]/g, "-")}-${randomBytes(3).toString("hex")}`;
@@ -150,7 +160,6 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
     mkdirSync(runDir, { recursive: true });
     const journalPath = join(runDir, "journal.jsonl");
     const proofPath = join(runDir, "proof.json");
-    const frozen = resumeState?.manifest.execution;
     const maxAgents = frozen?.max_agents ?? opts.maxAgents ?? DEFAULT_MAX_AGENTS;
     const concurrency = frozen?.concurrency ?? opts.concurrency ?? DEFAULT_CONCURRENCY;
     assertPositiveWorkflowBound(maxAgents, "maxAgents");
@@ -159,16 +168,105 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
     const log = opts.onLog ?? ((line) => process.stderr.write(`${line}\n`));
     const defaultHarness = frozen?.default_harness ?? opts.defaultHarness ?? "claude-code";
     const specialists = frozen?.specialists ?? (resumeState ? {} : normalizeWorkflowSpecialists(opts.specialists));
-    const isolation = frozen?.isolation ?? opts.isolation ?? "shared";
     const networkAccess = frozen?.network_access ?? opts.networkAccess ?? "unknown";
     const policy = frozen?.policy ?? (opts.policy ? normalizePolicy(opts.policy, { baseDir: cwd }) : undefined);
     const approvalMode = frozen?.approval_mode ?? opts.approvalMode ?? "deny";
     const approvalAddressee = frozen?.approval_addressee ?? opts.approvalAddressee ?? "operator";
     const subscriptionOnly = frozen?.subscription_only ?? Boolean(opts.subscriptionOnly);
     const allowApiBilling = frozen?.allow_api_billing ?? Boolean(opts.allowApiBilling);
-    const repoBefore = resumeState?.manifest.repository_before ?? snapshotRepo(cwd);
     const startedAt = resumeState?.manifest.started_at ?? new Date().toISOString();
     const t0 = resumeState ? Date.parse(startedAt) : Date.now();
+    const scriptSha256 = resumeState?.manifest.script.sha256 ?? workflowScriptDigest(absScript);
+    const fallbackName = scriptPath.replace(/^.*\//, "").replace(/\.[cm]?js$/, "");
+    const fallbackMeta = normalizeWorkflowMeta(undefined, fallbackName);
+    const workspaceProvider = isolation === "shared" ? undefined : opts.workspace?.provider;
+    let workspaceBinding;
+    let workspaceFallback = resumeState?.manifest.execution.workspace_fallback;
+    try {
+        workspaceBinding = await resolveWorkspaceBinding({
+            opts,
+            resumeState,
+            runId,
+            cwd,
+            isolation,
+            absScript,
+            scriptSha256,
+            provider: workspaceProvider,
+            workContext,
+            attemptContext,
+            policy,
+            onUnsupportedFallback: (evidence) => {
+                workspaceFallback = evidence;
+            },
+        });
+    }
+    catch (error) {
+        const frozenBinding = resumeState?.manifest.execution.workspace_binding;
+        if (!resumeState || !frozenBinding)
+            throw error;
+        const failure = error instanceof Error ? error : new Error(String(error));
+        const endedAt = new Date().toISOString();
+        const durationMs = Date.now() - t0;
+        const failedAttestation = await attestWorkspaceFailure(workspaceProvider, frozenBinding, error);
+        appendWorkflowJournalEvent(opts.coordRoot, runId, "run.resume", {
+            approval_id: resumeState.approvalId,
+            script: absScript,
+            resumed_at: new Date().toISOString(),
+        });
+        appendWorkflowJournalEvent(opts.coordRoot, runId, "workspace.reattach.failed", {
+            binding_id: frozenBinding.binding_id,
+            provider_id: frozenBinding.provider.id,
+            status: failedAttestation.status,
+            reason: failure.message,
+            attestation_sha256: stableDigest(failedAttestation),
+        });
+        appendWorkflowJournalEvent(opts.coordRoot, runId, "run.end", {
+            ok: false,
+            error: failure.message,
+            agents: 0,
+            cached: 0,
+            cost_usd: 0,
+            duration_ms: durationMs,
+        });
+        try {
+            const proof = buildWorkflowProof({
+                runId,
+                workItemId: opts.workItemId ?? resumeState.manifest.work_item_id,
+                workContext,
+                attemptContext,
+                meta: fallbackMeta,
+                status: "failed",
+                startedAt,
+                endedAt,
+                durationMs,
+                journalPath,
+                before: resumeState.manifest.repository_before,
+                after: resumeState.manifest.repository_before,
+                agents: [],
+                evidence: [],
+                harnessEvidence: opts.harnessEvidence,
+                policy: policy
+                    ? {
+                        config: policy,
+                        decisions: [],
+                        isolation,
+                        networkAccess,
+                    }
+                    : undefined,
+                workspaceBinding: frozenBinding,
+                workspaceAttestation: failedAttestation,
+                error: failure.message,
+            });
+            writeWorkflowProof(proofPath, proof);
+        }
+        catch (proofError) {
+            throw new WorkflowRunError(`${failure.message}; recovery proof packet write also failed: ${proofError.message}`, runId, proofPath, failure);
+        }
+        throw new WorkflowRunError(failure.message, runId, proofPath, failure);
+    }
+    const effectiveIsolation = workspaceFallback?.effective_isolation ?? isolation;
+    const executionCwd = workspaceBinding?.active_root ?? cwd;
+    const executionRepoBefore = resumeState?.manifest.repository_before ?? snapshotRepo(executionCwd);
     if (!resumeState) {
         writeWorkflowRunManifest({
             coordRoot: opts.coordRoot,
@@ -178,12 +276,12 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 work_item_id: opts.workItemId,
                 work_context: workContext,
                 attempt_context: attemptContext,
-                name,
+                name: sharedMeta?.name ?? fallbackMeta.name,
                 started_at: startedAt,
-                script: { path: absScript, sha256: workflowScriptDigest(absScript) },
-                repository_before: repoBefore,
+                script: { path: absScript, sha256: scriptSha256 },
+                repository_before: executionRepoBefore,
                 execution: {
-                    cwd,
+                    cwd: executionCwd,
                     default_harness: defaultHarness,
                     max_agents: maxAgents,
                     concurrency,
@@ -195,17 +293,70 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                     network_access: networkAccess,
                     policy: policy ? policy : undefined,
                     specialists,
+                    workspace_binding: workspaceBinding,
+                    workspace_fallback: workspaceFallback,
                 },
             },
         });
     }
+    let workflow = sharedWorkflow;
+    let meta = sharedMeta ?? fallbackMeta;
+    let initializationError;
+    let initializationAttestation;
+    if (isolation !== "shared") {
+        try {
+            const mod = (await import(__rewriteRelativeImportExtension(pathToFileURL(absScript).href)));
+            if (typeof mod.default !== "function") {
+                throw new Error(`${scriptPath}: workflow script must \`export default async (ctx) => …\``);
+            }
+            workflow = mod.default;
+            meta = normalizeWorkflowMeta(mod.meta, fallbackName);
+        }
+        catch (error) {
+            initializationError = error instanceof Error ? error : new Error(String(error));
+        }
+    }
+    if (workspaceBinding && workspaceProvider) {
+        try {
+            const postImport = await workspaceProvider.reattach(workspaceBinding);
+            if (!isWorkspaceAttestation(postImport, workspaceBinding) || postImport.status !== "ok") {
+                initializationAttestation = isWorkspaceAttestation(postImport, workspaceBinding)
+                    ? postImport
+                    : undefined;
+                throw new Error("workspace authority changed during workflow module initialization");
+            }
+            appendWorkflowJournalEvent(opts.coordRoot, runId, "workspace.reattach.module_initialized", {
+                binding_id: workspaceBinding.binding_id,
+                provider_id: workspaceBinding.provider.id,
+                attestation_sha256: stableDigest(postImport),
+            });
+        }
+        catch (error) {
+            const reattachmentError = error instanceof Error ? error : new Error(String(error));
+            initializationAttestation ??= await attestWorkspaceFailure(workspaceProvider, workspaceBinding, error);
+            initializationError = initializationError
+                ? new Error(`${initializationError.message}; ${reattachmentError.message}`, {
+                    cause: reattachmentError,
+                })
+                : reattachmentError;
+            appendWorkflowJournalEvent(opts.coordRoot, runId, "workspace.reattach.module_initialization_failed", {
+                binding_id: workspaceBinding.binding_id,
+                provider_id: workspaceBinding.provider.id,
+                status: initializationAttestation.status,
+                reason: reattachmentError.message,
+                attestation_sha256: stableDigest(initializationAttestation),
+            });
+        }
+    }
+    const name = meta.name;
+    let observedWorkspaceAttestation = initializationAttestation;
     // Per-child fixed context overhead: children spawn in `cwd` and load its
     // repo-instructions file into their system prompt, cache-writing it once
     // per child. A fan-out multiplies this, so surface it BEFORE the burn.
-    const contextTokensPerChildEstimate = estimateInstructionTokens(cwd);
+    const contextTokensPerChildEstimate = estimateInstructionTokens(executionCwd);
     if (contextTokensPerChildEstimate > 0) {
         log(`[context] each child cache-writes ~${Math.round(contextTokensPerChildEstimate / 1000)}K tokens of repo ` +
-            `instructions from ${cwd}; a fan-out multiplies this per agent`);
+            `instructions from ${executionCwd}; a fan-out multiplies this per agent`);
     }
     // Resume: journaled results of a prior run, keyed by agent-call identity.
     const resumeSource = opts.resumeRunId ?? opts.resumeFrom;
@@ -434,7 +585,7 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
             const estimateRequest = summarizePolicyRequest({
                 phase: "dispatch",
                 action: "spawn agent",
-                path: cwd,
+                path: executionCwd,
                 harness,
                 model: agentOpts.model,
                 effort: agentOpts.effort,
@@ -442,7 +593,7 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 max_turns: agentOpts.maxTurns ?? DEFAULT_MAX_TURNS,
                 timeout_ms: agentOpts.timeoutMs ?? DEFAULT_TIMEOUT_MS,
                 prompt_bytes: Buffer.byteLength(dispatchPrompt),
-                isolation,
+                isolation: effectiveIsolation,
                 network_access: networkAccess,
                 current_cost_usd: round4(costUsd + reservedCostUsd),
                 projected_cost_usd: null,
@@ -571,7 +722,7 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                     effort: agentOpts.effort,
                     timeoutMs: agentOpts.timeoutMs ?? DEFAULT_TIMEOUT_MS,
                     maxTurns: agentOpts.maxTurns ?? DEFAULT_MAX_TURNS,
-                    cwd,
+                    cwd: executionCwd,
                     runId,
                     subscriptionOnly,
                 });
@@ -689,8 +840,8 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
         return authorizePolicyRequest({
             phase: "external_mutation",
             action: input.action,
-            path: input.path ? resolve(cwd, input.path) : undefined,
-            isolation,
+            path: input.path ? resolve(executionCwd, input.path) : undefined,
+            isolation: effectiveIsolation,
             network_access: network,
             service: input.service,
             target: input.target,
@@ -728,13 +879,27 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 concurrency,
                 specialists: Object.keys(specialists),
                 policy: policy ? { name: policy.name, sha256: policyDigest(policy) } : null,
-                isolation,
+                isolation: effectiveIsolation,
                 network_access: networkAccess,
+                workspace_binding: workspaceBinding
+                    ? { binding_id: workspaceBinding.binding_id, provider_id: workspaceBinding.provider.id }
+                    : null,
             });
         }
-        const result = await mod.default(ctx);
+        if (initializationError)
+            throw initializationError;
+        if (!workflow)
+            throw new Error("workflow module initialization did not produce an executable");
+        const result = await workflow(ctx);
         const endedAt = new Date().toISOString();
         const durationMs = Date.now() - t0;
+        const workspaceAttestation = workspaceBinding
+            ? await attestTerminal(workspaceProvider, workspaceBinding)
+            : undefined;
+        observedWorkspaceAttestation = workspaceAttestation;
+        if (workspaceAttestation && workspaceAttestation.status !== "ok") {
+            throw new Error(`terminal workspace attestation ${workspaceAttestation.status}: ${workspaceAttestation.provider_drift.join("; ") || "provider could not prove the workspace"}`);
+        }
         journal("run.end", {
             ok: true,
             agents: agentsSpawned,
@@ -755,8 +920,8 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 endedAt,
                 durationMs,
                 journalPath,
-                before: repoBefore,
-                after: snapshotRepo(cwd),
+                before: executionRepoBefore,
+                after: snapshotRepo(executionCwd),
                 agents: Array.from(agentProofs.values()),
                 evidence: evidenceRecords,
                 harnessEvidence: opts.harnessEvidence,
@@ -764,10 +929,13 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                     ? {
                         config: policy,
                         decisions: Array.from(policyDecisions.values()),
-                        isolation,
+                        isolation: effectiveIsolation,
                         networkAccess,
                     }
                     : undefined,
+                workspaceBinding,
+                workspaceAttestation,
+                workspaceFallback,
                 result,
             });
             writeWorkflowProof(proofPath, proof);
@@ -793,11 +961,15 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 mode: subscriptionOnly ? "subscription" : p.mode,
             })),
             policy: proof.policy?.summary,
+            workspaceBinding,
         };
         return report;
     }
     catch (err) {
-        if (err instanceof WorkflowParkedError || err instanceof WorkflowRunError)
+        if (err instanceof WorkflowParkedError) {
+            throw err;
+        }
+        if (err instanceof WorkflowRunError)
             throw err;
         const endedAt = new Date().toISOString();
         const durationMs = Date.now() - t0;
@@ -810,6 +982,10 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
             duration_ms: durationMs,
         });
         try {
+            const workspaceAttestation = workspaceBinding
+                ? (observedWorkspaceAttestation ??
+                    (await attestTerminal(workspaceProvider, workspaceBinding)))
+                : undefined;
             const proof = buildWorkflowProof({
                 runId,
                 workItemId: opts.workItemId ?? resumeState?.manifest.work_item_id,
@@ -821,8 +997,8 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 endedAt,
                 durationMs,
                 journalPath,
-                before: repoBefore,
-                after: snapshotRepo(cwd),
+                before: executionRepoBefore,
+                after: snapshotRepo(executionCwd),
                 agents: Array.from(agentProofs.values()),
                 evidence: evidenceRecords,
                 harnessEvidence: opts.harnessEvidence,
@@ -830,10 +1006,13 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                     ? {
                         config: policy,
                         decisions: Array.from(policyDecisions.values()),
-                        isolation,
+                        isolation: effectiveIsolation,
                         networkAccess,
                     }
                     : undefined,
+                workspaceBinding,
+                workspaceAttestation,
+                workspaceFallback,
                 error: err.message,
             });
             writeWorkflowProof(proofPath, proof);

package/dist/core/workflow/index.d.ts

@@ -7,4 +7,6 @@ export type { WorkflowRunManifest } from "./run-state.js";
 export { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, readWorkflowRunManifest, WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION, workflowRunManifestPath, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
 export type { AcceptanceCriterion, AcceptanceResult, AcceptanceStatus, AcceptanceSummary, AgentOpts, EngineOpts, EvidenceKind, EvidenceSource, EvidenceStatus, HarnessEvidenceCapability, HarnessEvidenceCoverage, HarnessName, ResultDigest, RunReport, Spawner, SpawnRequest, SpawnResult, StageSchema, WorkflowAgentProof, WorkflowApprovalMode, WorkflowAttemptContext, WorkflowAttemptFailureCause, WorkflowAttemptPriorContext, WorkflowAttemptUnresolvedCriterion, WorkflowContext, WorkflowEvidenceInput, WorkflowEvidenceRecord, WorkflowMeta, WorkflowModule, WorkflowPolicyProof, WorkflowProof, WorkflowProofUnknown, WorkflowRepoEvidence, WorkflowRepoSnapshot, WorkflowRunStatus, WorkflowSpecialistProfile, WorkflowWorkContext, } from "./types.js";
 export { WORKFLOW_ATTEMPT_CONTEXT_SCHEMA_VERSION, WORKFLOW_PROOF_SCHEMA_VERSION, WORKFLOW_WORK_CONTEXT_SCHEMA_VERSION, } from "./types.js";
+export type { ApplyIntegrationInput, AuthorizedIntegrationPlan, AuthorizedProviderIntegrationInput, CancelWorkspaceInput, CleanupWorkspaceInput, FilesystemIdentity, IntegrationApplyAttempt, IntegrationApplyReceipt, IntegrationAuthorization, IntegrationPlan, IntegrationReviewRecord, IntegrationTarget, LocalGitWorktreeProviderOptions, PrepareIntegrationInput, ProviderIntegrationInput, ProviderIntegrationPreview, ProviderIntegrationResult, ProviderUnknown, ProviderUnsupportedReason, RepositoryBinding, ValidatedFilesystemPath, WorkflowWorkspaceInspection, WorkflowWorkspaceSelection, WorkflowWorkspaceStatus, WorkflowWorkspaceVerification, WorkspaceAllocationRequest, WorkspaceAttestation, WorkspaceBinding, WorkspaceBoundExecutionEvidence, WorkspaceCancellationReceipt, WorkspaceCancellationResult, WorkspaceCleanupAttempt, WorkspaceCleanupIntent, WorkspaceCleanupMode, WorkspaceCleanupReceipt, WorkspaceCleanupResult, WorkspaceCompatibilityExecutionEvidence, WorkspaceExecutionEvidence, WorkspaceIntegrationState, WorkspaceIsolation, WorkspaceLifecycleProjection, WorkspaceLifecycleProjectionInput, WorkspaceLifecycleState, WorkspaceObservation, WorkspaceOwner, WorkspaceProbeInput, WorkspaceProbeResult, WorkspaceProofOutcome, WorkspaceProvider, WorkspaceProviderCapabilities, WorkspaceProviderRef, WorkspaceResourceState, WorkspaceUnsupportedExecutionEvidence, } from "./workspaces/index.js";
+export { applyIntegration, assertWorkspaceLifecycleTransition, cancelWorkspace, cleanupWorkspace, createLocalGitWorktreeProvider, deriveWorkspaceLifecycle, IntegrationPrepareParkedError, inspectWorkflowWorkspace, isWorkspaceLifecycleState, listWorkflowWorkspaceInspections, prepareIntegration, probeLocalGitWorktreeProvider, readWorkflowWorkspaceStatus, renderWorkflowWorkspaceStatus, validateProviderEventChain, WORKSPACE_BINDING_SCHEMA_VERSION, WORKSPACE_RECEIPT_SCHEMA_VERSION, } from "./workspaces/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/core/workflow/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,2BAA2B,EAC3B,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,gCAAgC,EAChC,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,uBAAuB,EACvB,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,cAAc,EACd,cAAc,EACd,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,EACX,YAAY,EACZ,SAAS,EACT,OAAO,EACP,YAAY,EACZ,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,kCAAkC,EAClC,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uCAAuC,EACvC,6BAA6B,EAC7B,oCAAoC,GACrC,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,2BAA2B,EAC3B,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,gCAAgC,EAChC,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,uBAAuB,EACvB,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,cAAc,EACd,cAAc,EACd,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,EACX,YAAY,EACZ,SAAS,EACT,OAAO,EACP,YAAY,EACZ,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,kCAAkC,EAClC,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uCAAuC,EACvC,6BAA6B,EAC7B,oCAAoC,GACrC,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,kCAAkC,EAClC,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC7B,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,EAChB,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uCAAuC,EACvC,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,EAClB,4BAA4B,EAC5B,iCAAiC,EACjC,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,qCAAqC,GACtC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,gBAAgB,EAChB,kCAAkC,EAClC,eAAe,EACf,gBAAgB,EAChB,8BAA8B,EAC9B,wBAAwB,EACxB,6BAA6B,EAC7B,wBAAwB,EACxB,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,uBAAuB,CAAC"}

package/dist/core/workflow/index.js

@@ -4,3 +4,4 @@ export { runWorkflow, WorkflowParkedError, WorkflowRunError } from "./engine.js"
 export { buildWorkflowProof, createEvidenceRecord, digestResult, normalizeWorkflowMeta, readWorkflowProof, renderWorkflowProof, rollupAcceptance, writeWorkflowProof, } from "./proof.js";
 export { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, readWorkflowRunManifest, WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION, workflowRunManifestPath, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
 export { WORKFLOW_ATTEMPT_CONTEXT_SCHEMA_VERSION, WORKFLOW_PROOF_SCHEMA_VERSION, WORKFLOW_WORK_CONTEXT_SCHEMA_VERSION, } from "./types.js";
+export { applyIntegration, assertWorkspaceLifecycleTransition, cancelWorkspace, cleanupWorkspace, createLocalGitWorktreeProvider, deriveWorkspaceLifecycle, IntegrationPrepareParkedError, inspectWorkflowWorkspace, isWorkspaceLifecycleState, listWorkflowWorkspaceInspections, prepareIntegration, probeLocalGitWorktreeProvider, readWorkflowWorkspaceStatus, renderWorkflowWorkspaceStatus, validateProviderEventChain, WORKSPACE_BINDING_SCHEMA_VERSION, WORKSPACE_RECEIPT_SCHEMA_VERSION, } from "./workspaces/index.js";

package/dist/core/workflow/proof.d.ts

@@ -1,6 +1,7 @@
 import type { RepoSnapshot } from "../context/index.js";
 import type { NormalizedPolicy, PolicyDecision, PolicyIsolation, PolicyNetworkAccess } from "../policy/index.js";
 import type { AcceptanceCriterion, AcceptanceResult, AcceptanceSummary, HarnessEvidenceCapability, ResultDigest, WorkflowAgentProof, WorkflowAttemptContext, WorkflowEvidenceInput, WorkflowEvidenceRecord, WorkflowMeta, WorkflowProof, WorkflowWorkContext } from "./types.js";
+import type { WorkspaceAttestation, WorkspaceBinding, WorkspaceUnsupportedExecutionEvidence } from "./workspaces/index.js";
 export interface NormalizedWorkflowMeta {
     name: string;
     description?: string;
@@ -29,6 +30,9 @@ export interface BuildWorkflowProofInput {
         isolation: PolicyIsolation;
         networkAccess: PolicyNetworkAccess;
     };
+    workspaceBinding?: WorkspaceBinding;
+    workspaceAttestation?: WorkspaceAttestation;
+    workspaceFallback?: WorkspaceUnsupportedExecutionEvidence;
     result?: unknown;
     error?: string;
 }

package/dist/core/workflow/proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/proof.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EAEzB,YAAY,EACZ,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EAEZ,aAAa,EAIb,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAgBpB,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC5C,cAAc,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAClD,IAAI,EAAE,sBAAsB,CAAC;IAC7B,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACnC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;QACrC,SAAS,EAAE,eAAe,CAAC;QAC3B,aAAa,EAAE,mBAAmB,CAAC;KACpC,CAAC;IACF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GACnB,sBAAsB,CAqCxB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,sBAAsB,CA6BzB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,QAAQ,EAAE,sBAAsB,EAAE,GACjC;IAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,CAuB9D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,CAQjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,aAAa,CA6ChF;AAgCD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAe3E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CA6BjF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAoChE"}
+{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/proof.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EAEzB,YAAY,EACZ,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EAEZ,aAAa,EAIb,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EAEhB,qCAAqC,EACtC,MAAM,uBAAuB,CAAC;AAoB/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC5C,cAAc,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAClD,IAAI,EAAE,sBAAsB,CAAC;IAC7B,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACnC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;QACrC,SAAS,EAAE,eAAe,CAAC;QAC3B,aAAa,EAAE,mBAAmB,CAAC;KACpC,CAAC;IACF,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,iBAAiB,CAAC,EAAE,qCAAqC,CAAC;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GACnB,sBAAsB,CAqCxB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,sBAAsB,CA6BzB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,QAAQ,EAAE,sBAAsB,EAAE,GACjC;IAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,CAuB9D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,CAQjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,aAAa,CAiDhF;AAgCD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAO3E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAgDjF;AA2BD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAoChE"}