harnery 0.28.0 → 0.30.0

package/dist/core/work/state.js

@@ -25,6 +25,12 @@ const MAX_EVENTS_BYTES = 4 * 1024 * 1024;
 const MAX_EVENT_BYTES = 16 * 1024;
 const MAX_EVENTS = 1_000;
 const FOREIGN_LEASE_STALE_MS = 24 * 60 * 60 * 1_000;
+/** Default ceiling on consecutive uncharged attempts (ADR 0046). Kept low: each
+ * one is a real vendor round-trip, so a handful gives a transient outage room
+ * to recover before the item stops and names the outside service. There is no
+ * backoff between them beyond the cadence of the supervisor and the vendor's own
+ * responses, which is why the bound stays small. */
+const DEFAULT_MAX_UNCHARGED_ATTEMPTS = 3;
 export function createWorkItem(input) {
     const coordRoot = resolve(input.coordRoot);
     const id = input.id ?? newWorkId();
@@ -45,6 +51,12 @@ export function createWorkItem(input) {
     if (!Number.isSafeInteger(maxAttempts) || maxAttempts < 1 || maxAttempts > 100) {
         throw new Error("work maxAttempts must be an integer from 1 to 100");
     }
+    const maxUnchargedAttempts = input.maxUnchargedAttempts ?? DEFAULT_MAX_UNCHARGED_ATTEMPTS;
+    if (!Number.isSafeInteger(maxUnchargedAttempts) ||
+        maxUnchargedAttempts < 1 ||
+        maxUnchargedAttempts > 100) {
+        throw new Error("work maxUnchargedAttempts must be an integer from 1 to 100");
+    }
     const acceptance = (input.acceptance ?? []).map((value, index) => boundedString(value, `work acceptance[${index}]`, MAX_ACCEPTANCE_ITEM));
     if (acceptance.length > MAX_ACCEPTANCE) {
         throw new Error(`work acceptance exceeds ${MAX_ACCEPTANCE} criteria`);
@@ -59,6 +71,7 @@ export function createWorkItem(input) {
         dependencies,
         workflow: { path: workflowPath, sha256: workflowScriptDigest(workflowPath) },
         max_attempts: maxAttempts,
+        max_uncharged_attempts: maxUnchargedAttempts,
         source,
         created_at: new Date().toISOString(),
     };
@@ -178,13 +191,18 @@ function deriveWorkProjection(coordRoot, intent, events, ignoreLease = false) {
     const terminal = latestGovernance?.event === "work.accepted" || latestGovernance?.event === "work.cancelled";
     const attemptEvents = events.filter((event) => event.event === "attempt.started");
     const attempts = attemptEvents.map((event, index) => inspectAttempt(coordRoot, event, intent, attemptEvents[index - 1]?.run_id));
+    // Charged attempts — not the raw count — are what max_attempts budgets
+    // (ADR 0046). An uncharged environment/upstream attempt still increments
+    // attempts_used (ordering + next number) but not the budget.
+    const chargedAttempts = attempts.filter((attempt) => attempt.uncharged === undefined).length;
     const base = {
         id: intent.id,
         title: intent.title,
         unresolved_dependencies: [],
         attempts,
         attempts_used: attempts.length,
-        attempts_remaining: Math.max(0, intent.max_attempts - attempts.length),
+        charged_attempts: chargedAttempts,
+        attempts_remaining: Math.max(0, intent.max_attempts - chargedAttempts),
         latest_run_id: attempts.at(-1)?.run_id,
         approval_id: attempts.at(-1)?.approval_id,
         proof_path: attempts.at(-1)?.proof_path,
@@ -266,7 +284,7 @@ function deriveWorkProjection(coordRoot, intent, events, ignoreLease = false) {
             next_action: "review",
         };
     }
-    const attemptsRemaining = intent.max_attempts - attempts.length;
+    const attemptsRemaining = intent.max_attempts - chargedAttempts;
     if (latest.status === "journal_unreadable") {
         return {
             ...base,
@@ -275,6 +293,49 @@ function deriveWorkProjection(coordRoot, intent, events, ignoreLease = false) {
             next_action: attemptsRemaining > 0 ? "retry" : "none",
         };
     }
+    // Uncharged failures (ADR 0046) are handled before the ordinary work-failure
+    // path: they did not touch the work, so they neither spent the budget nor
+    // signal that retrying the work would help.
+    if (latest.status === "failed" && latest.uncharged === "environment") {
+        // A missing precondition. The operator chose to STOP the item immediately
+        // rather than retry an unchanged environment (ADR 0046); next_action "none"
+        // stops the supervisor. A human who fixes the environment can still force a
+        // retry — the attempt was uncharged, so the budget is intact.
+        return {
+            ...base,
+            state: "blocked",
+            reason: environmentBlockedReason(latest),
+            next_action: "none",
+        };
+    }
+    if (latest.status === "failed" && latest.uncharged === "upstream") {
+        // Count trailing consecutive uncharged attempts in the current window. The
+        // bound is the only brake on an outage that never ends, so at the limit the
+        // item stops and names the outside service — distinct from work-blocked.
+        const maxUncharged = intent.max_uncharged_attempts ?? DEFAULT_MAX_UNCHARGED_ATTEMPTS;
+        let trailingUncharged = 0;
+        for (let index = currentAttempts.length - 1; index >= 0; index--) {
+            if (currentAttempts[index].uncharged === undefined)
+                break;
+            trailingUncharged++;
+        }
+        if (trailingUncharged >= maxUncharged || attemptsRemaining <= 0) {
+            return {
+                ...base,
+                state: "blocked",
+                reason: trailingUncharged >= maxUncharged
+                    ? `blocked waiting on an outside service after ${trailingUncharged} consecutive uncharged attempt(s): ${upstreamReason(latest)}`
+                    : `workflow attempt ${latest.number} was uncharged (${upstreamReason(latest)}) but the work attempt budget is exhausted`,
+                next_action: "none",
+            };
+        }
+        return {
+            ...base,
+            state: "blocked",
+            reason: `workflow attempt ${latest.number} did not touch the work; an outside service refused: ${upstreamReason(latest)}`,
+            next_action: "retry",
+        };
+    }
     return {
         ...base,
         state: "blocked",
@@ -284,6 +345,31 @@ function deriveWorkProjection(coordRoot, intent, events, ignoreLease = false) {
         next_action: attemptsRemaining > 0 ? "retry" : "none",
     };
 }
+/** The failure reason for an uncharged attempt, read from the proof when
+ * present. Bounded so a verbose vendor transcript cannot bloat the projection
+ * reason (which is persisted verbatim into the reconciliation event). */
+function unchargedProofError(attempt) {
+    if (!attempt.proof_path)
+        return undefined;
+    try {
+        const proof = parseObject(readFileSync(attempt.proof_path, "utf8"), "workflow proof");
+        const run = proof.run;
+        const error = run && typeof run === "object" ? run.error : undefined;
+        return typeof error === "string" && error.trim() ? boundedJournalError(error) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function environmentBlockedReason(attempt) {
+    const detail = unchargedProofError(attempt);
+    return detail
+        ? `workflow attempt ${attempt.number} could not start; a required precondition is missing: ${detail}`
+        : `workflow attempt ${attempt.number} could not start; a required precondition is missing`;
+}
+function upstreamReason(attempt) {
+    return unchargedProofError(attempt) ?? "the vendor was reached and refused";
+}
 function inspectAttempt(coordRoot, event, intent, priorRunId) {
     const runId = event.run_id;
     const attempt = {
@@ -334,6 +420,13 @@ function inspectAttempt(coordRoot, event, intent, priorRunId) {
                 proof.acceptance.summary.unknown === 0
                 ? "succeeded"
                 : "failed";
+        // A failed attempt the run classified as uninformative about the work is
+        // uncharged (ADR 0046). Absent class ⇒ charged, as before. Read only for a
+        // failed attempt: a succeeded run never carries a class.
+        if (attempt.status === "failed" &&
+            (proof.run.class === "environment" || proof.run.class === "upstream")) {
+            attempt.uncharged = proof.run.class;
+        }
         return attempt;
     }
     const journalPath = workflowJournalPath(coordRoot, runId);
@@ -596,7 +689,13 @@ function validateWorkIntent(intent, workId) {
         !/^[a-f0-9]{64}$/.test(intent.workflow.sha256) ||
         !Number.isSafeInteger(intent.max_attempts) ||
         intent.max_attempts < 1 ||
-        intent.max_attempts > 100) {
+        intent.max_attempts > 100 ||
+        // Optional for back-compat: absent on pre-ADR-0046 intents. When present it
+        // must be a valid bound.
+        (intent.max_uncharged_attempts !== undefined &&
+            (!Number.isSafeInteger(intent.max_uncharged_attempts) ||
+                intent.max_uncharged_attempts < 1 ||
+                intent.max_uncharged_attempts > 100))) {
         throw new Error(`work intent ${workId} has an unsupported or mismatched schema`);
     }
     boundedString(intent.title, "work title", MAX_TITLE);

package/dist/core/workflow/engine.js

@@ -774,6 +774,12 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 costUsd += last.costUsd ?? 0;
                 if (!last.ok) {
                     journal("agent.attempt_failed", { id, attempt, error: last.error });
+                    // ADR 0046: an environment failure (the binary was absent) cannot be
+                    // helped by retrying an unchanged environment, so stop the in-agent
+                    // retry too — not just the outer attempt/replan budget. An upstream
+                    // refusal keeps retrying here: the vendor may recover mid-loop.
+                    if (last.class === "environment")
+                        break;
                     continue; // spawn-level failure: retry with the original prompt
                 }
                 if (!agentOpts.schema) {
@@ -833,6 +839,13 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 agentCostUsd > 0 || last?.costUsd !== undefined ? agentCostUsd : undefined;
             agentProof.session_id = last?.sessionId;
             agentProof.error = reason;
+            // Carry the spawn class (environment/upstream) onto the proof only when the
+            // final outcome was a spawn failure. A schema failure after a spawn that
+            // reached the model is a work failure — left unclassed (charged). An
+            // earlier attempt that transiently failed and then succeeded returned
+            // above, so this only fires when the agent genuinely failed.
+            if (last && !last.ok && last.class)
+                agentProof.class = last.class;
             journal("agent.failed", { id, error: reason });
             throw new Error(`agent ${proofLabel}: ${reason}`);
         }

package/dist/core/workflow/index.d.ts

@@ -2,10 +2,11 @@ export type { CreateWorkflowApprovalInput, ResolveWorkflowApprovalInput, Workflo
 export { assertWorkflowRunId, createWorkflowApproval, listWorkflowApprovals, readWorkflowApproval, renderWorkflowApproval, resolveWorkflowApproval, WORKFLOW_APPROVAL_SCHEMA_VERSION, workflowApprovalId, } from "./approvals.js";
 export { freezeWorkflowAttemptContext, isCanonicalWorkflowAttemptContext, normalizeWorkflowAttemptContext, } from "./attempt-context.js";
 export { runWorkflow, WorkflowParkedError, WorkflowRunError } from "./engine.js";
-export { buildWorkflowProof, createEvidenceRecord, digestResult, normalizeWorkflowMeta, readWorkflowProof, renderWorkflowProof, rollupAcceptance, writeWorkflowProof, } from "./proof.js";
+export { buildWorkflowProof, createEvidenceRecord, deriveRunFailureClass, digestResult, normalizeWorkflowMeta, readWorkflowProof, renderWorkflowProof, rollupAcceptance, writeWorkflowProof, } from "./proof.js";
 export type { WorkflowRunManifest } from "./run-state.js";
 export { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, readWorkflowRunManifest, WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION, workflowRunManifestPath, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
-export type { AcceptanceCriterion, AcceptanceResult, AcceptanceStatus, AcceptanceSummary, AgentOpts, EngineOpts, EvidenceKind, EvidenceSource, EvidenceStatus, HarnessEvidenceCapability, HarnessEvidenceCoverage, HarnessName, ResultDigest, RunReport, Spawner, SpawnRequest, SpawnResult, StageSchema, WorkflowAgentProof, WorkflowApprovalMode, WorkflowAttemptContext, WorkflowAttemptFailureCause, WorkflowAttemptPriorContext, WorkflowAttemptUnresolvedCriterion, WorkflowContext, WorkflowEvidenceInput, WorkflowEvidenceRecord, WorkflowMeta, WorkflowModule, WorkflowPolicyProof, WorkflowProof, WorkflowProofUnknown, WorkflowRepoEvidence, WorkflowRepoSnapshot, WorkflowRunStatus, WorkflowSpecialistProfile, WorkflowWorkContext, } from "./types.js";
+export { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
+export type { AcceptanceCriterion, AcceptanceResult, AcceptanceStatus, AcceptanceSummary, AgentOpts, EngineOpts, EvidenceKind, EvidenceSource, EvidenceStatus, HarnessEvidenceCapability, HarnessEvidenceCoverage, HarnessName, ResultDigest, RunReport, Spawner, SpawnFailureClass, SpawnRequest, SpawnResult, StageSchema, WorkflowAgentProof, WorkflowApprovalMode, WorkflowAttemptContext, WorkflowAttemptFailureCause, WorkflowAttemptPriorContext, WorkflowAttemptUnresolvedCriterion, WorkflowContext, WorkflowEvidenceInput, WorkflowEvidenceRecord, WorkflowMeta, WorkflowModule, WorkflowPolicyProof, WorkflowProof, WorkflowProofUnknown, WorkflowRepoEvidence, WorkflowRepoSnapshot, WorkflowRunStatus, WorkflowSpecialistProfile, WorkflowWorkContext, } from "./types.js";
 export { WORKFLOW_ATTEMPT_CONTEXT_SCHEMA_VERSION, WORKFLOW_PROOF_SCHEMA_VERSION, WORKFLOW_WORK_CONTEXT_SCHEMA_VERSION, } from "./types.js";
 export type { ApplyIntegrationInput, AuthorizedIntegrationPlan, AuthorizedProviderIntegrationInput, CancelWorkspaceInput, CleanupWorkspaceInput, FilesystemIdentity, IntegrationApplyAttempt, IntegrationApplyReceipt, IntegrationAuthorization, IntegrationPlan, IntegrationReviewRecord, IntegrationTarget, LocalGitWorktreeProviderOptions, PrepareIntegrationInput, ProviderIntegrationInput, ProviderIntegrationPreview, ProviderIntegrationResult, ProviderUnknown, ProviderUnsupportedReason, RepositoryBinding, ValidatedFilesystemPath, WorkflowWorkspaceInspection, WorkflowWorkspaceSelection, WorkflowWorkspaceStatus, WorkflowWorkspaceVerification, WorkspaceAllocationRequest, WorkspaceAttestation, WorkspaceBinding, WorkspaceBoundExecutionEvidence, WorkspaceCancellationReceipt, WorkspaceCancellationResult, WorkspaceCleanupAttempt, WorkspaceCleanupIntent, WorkspaceCleanupMode, WorkspaceCleanupReceipt, WorkspaceCleanupResult, WorkspaceCompatibilityExecutionEvidence, WorkspaceExecutionEvidence, WorkspaceIntegrationState, WorkspaceIsolation, WorkspaceLifecycleProjection, WorkspaceLifecycleProjectionInput, WorkspaceLifecycleState, WorkspaceObservation, WorkspaceOwner, WorkspaceProbeInput, WorkspaceProbeResult, WorkspaceProofOutcome, WorkspaceProvider, WorkspaceProviderCapabilities, WorkspaceProviderRef, WorkspaceResourceState, WorkspaceUnsupportedExecutionEvidence, } from "./workspaces/index.js";
 export { applyIntegration, assertWorkspaceLifecycleTransition, cancelWorkspace, cleanupWorkspace, createLocalGitWorktreeProvider, deriveWorkspaceLifecycle, IntegrationPrepareParkedError, inspectWorkflowWorkspace, isWorkspaceLifecycleState, listWorkflowWorkspaceInspections, prepareIntegration, prepareReclaim, probeLocalGitWorktreeProvider, readWorkflowWorkspaceStatus, renderWorkflowWorkspaceStatus, validateProviderEventChain, WORKSPACE_BINDING_SCHEMA_VERSION, WORKSPACE_RECEIPT_SCHEMA_VERSION, } from "./workspaces/index.js";

package/dist/core/workflow/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,2BAA2B,EAC3B,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,gCAAgC,EAChC,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,uBAAuB,EACvB,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,cAAc,EACd,cAAc,EACd,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,EACX,YAAY,EACZ,SAAS,EACT,OAAO,EACP,YAAY,EACZ,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,kCAAkC,EAClC,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uCAAuC,EACvC,6BAA6B,EAC7B,oCAAoC,GACrC,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,kCAAkC,EAClC,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC7B,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,EAChB,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uCAAuC,EACvC,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,EAClB,4BAA4B,EAC5B,iCAAiC,EACjC,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,qCAAqC,GACtC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,gBAAgB,EAChB,kCAAkC,EAClC,eAAe,EACf,gBAAgB,EAChB,8BAA8B,EAC9B,wBAAwB,EACxB,6BAA6B,EAC7B,wBAAwB,EACxB,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,cAAc,EACd,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,2BAA2B,EAC3B,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,gCAAgC,EAChC,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,uBAAuB,EACvB,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,cAAc,EACd,cAAc,EACd,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,EACX,YAAY,EACZ,SAAS,EACT,OAAO,EACP,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,kCAAkC,EAClC,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uCAAuC,EACvC,6BAA6B,EAC7B,oCAAoC,GACrC,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,kCAAkC,EAClC,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC7B,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,EAChB,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uCAAuC,EACvC,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,EAClB,4BAA4B,EAC5B,iCAAiC,EACjC,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,qCAAqC,GACtC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,gBAAgB,EAChB,kCAAkC,EAClC,eAAe,EACf,gBAAgB,EAChB,8BAA8B,EAC9B,wBAAwB,EACxB,6BAA6B,EAC7B,wBAAwB,EACxB,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,cAAc,EACd,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,uBAAuB,CAAC"}

package/dist/core/workflow/index.js

@@ -1,7 +1,8 @@
 export { assertWorkflowRunId, createWorkflowApproval, listWorkflowApprovals, readWorkflowApproval, renderWorkflowApproval, resolveWorkflowApproval, WORKFLOW_APPROVAL_SCHEMA_VERSION, workflowApprovalId, } from "./approvals.js";
 export { freezeWorkflowAttemptContext, isCanonicalWorkflowAttemptContext, normalizeWorkflowAttemptContext, } from "./attempt-context.js";
 export { runWorkflow, WorkflowParkedError, WorkflowRunError } from "./engine.js";
-export { buildWorkflowProof, createEvidenceRecord, digestResult, normalizeWorkflowMeta, readWorkflowProof, renderWorkflowProof, rollupAcceptance, writeWorkflowProof, } from "./proof.js";
+export { buildWorkflowProof, createEvidenceRecord, deriveRunFailureClass, digestResult, normalizeWorkflowMeta, readWorkflowProof, renderWorkflowProof, rollupAcceptance, writeWorkflowProof, } from "./proof.js";
 export { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, readWorkflowRunManifest, WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION, workflowRunManifestPath, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
+export { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
 export { WORKFLOW_ATTEMPT_CONTEXT_SCHEMA_VERSION, WORKFLOW_PROOF_SCHEMA_VERSION, WORKFLOW_WORK_CONTEXT_SCHEMA_VERSION, } from "./types.js";
 export { applyIntegration, assertWorkspaceLifecycleTransition, cancelWorkspace, cleanupWorkspace, createLocalGitWorktreeProvider, deriveWorkspaceLifecycle, IntegrationPrepareParkedError, inspectWorkflowWorkspace, isWorkspaceLifecycleState, listWorkflowWorkspaceInspections, prepareIntegration, prepareReclaim, probeLocalGitWorktreeProvider, readWorkflowWorkspaceStatus, renderWorkflowWorkspaceStatus, validateProviderEventChain, WORKSPACE_BINDING_SCHEMA_VERSION, WORKSPACE_RECEIPT_SCHEMA_VERSION, } from "./workspaces/index.js";

package/dist/core/workflow/proof.d.ts

@@ -1,6 +1,6 @@
 import type { RepoSnapshot } from "../context/index.js";
 import type { NormalizedPolicy, PolicyDecision, PolicyIsolation, PolicyNetworkAccess } from "../policy/index.js";
-import type { AcceptanceCriterion, AcceptanceResult, AcceptanceSummary, HarnessAttestationCitation, HarnessEvidenceCapability, ResultDigest, WorkflowAgentProof, WorkflowAttemptContext, WorkflowEvidenceInput, WorkflowEvidenceRecord, WorkflowMeta, WorkflowProof, WorkflowSandboxProjectionEvidence, WorkflowWorkContext } from "./types.js";
+import type { AcceptanceCriterion, AcceptanceResult, AcceptanceSummary, HarnessAttestationCitation, HarnessEvidenceCapability, ResultDigest, SpawnFailureClass, WorkflowAgentProof, WorkflowAttemptContext, WorkflowEvidenceInput, WorkflowEvidenceRecord, WorkflowMeta, WorkflowProof, WorkflowSandboxProjectionEvidence, WorkflowWorkContext } from "./types.js";
 import type { WorkspaceAttestation, WorkspaceBinding, WorkspaceUnsupportedExecutionEvidence } from "./workspaces/index.js";
 export interface NormalizedWorkflowMeta {
     name: string;
@@ -54,6 +54,23 @@ export declare function rollupAcceptance(criteria: AcceptanceCriterion[], eviden
     summary: AcceptanceSummary;
 };
 export declare function digestResult(value: unknown, kind?: "text" | "json"): ResultDigest;
+/**
+ * The run-level failure class (ADR 0046), derived from the agents rather than a
+ * single terminal throw so it survives a script's `parallel()` swallowing the
+ * rejection — a swallowed agent's proof is still recorded with its class.
+ *
+ * Rules, in order, all in service of "default to charging":
+ * 1. A succeeded run is never classed (there is nothing uncharged about it).
+ * 2. If ANY agent produced a result (succeeded or replayed from cache) the
+ *    attempt was informative about the work — charge it. This also keeps a
+ *    resumed run whose earlier segment did real work from being written off by
+ *    a later environment failure.
+ * 3. Otherwise, among the failed agents, environment wins over upstream: a
+ *    missing binary means nothing ran at all, and it is the operator-chosen
+ *    hard stop.
+ * 4. Anything else is undefined ⇒ a charged work failure, exactly as today.
+ */
+export declare function deriveRunFailureClass(status: "succeeded" | "failed", agents: readonly Pick<WorkflowAgentProof, "status" | "class">[]): SpawnFailureClass | undefined;
 export declare function buildWorkflowProof(input: BuildWorkflowProofInput): WorkflowProof;
 export declare function writeWorkflowProof(path: string, proof: WorkflowProof): void;
 export declare function readWorkflowProof(coordRoot: string, runId: string): WorkflowProof;

package/dist/core/workflow/proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/proof.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EAEzB,YAAY,EACZ,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EAEZ,aAAa,EAIb,iCAAiC,EACjC,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EAEhB,qCAAqC,EACtC,MAAM,uBAAuB,CAAC;AAoB/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC5C,cAAc,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAClD,IAAI,EAAE,sBAAsB,CAAC;IAC7B,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC,CAAC;IAClF,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,iCAAiC,CAAC;IACtD;+DAC2D;IAC3D,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,0BAA0B,GAAG,SAAS,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACnC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;QACrC,SAAS,EAAE,eAAe,CAAC;QAC3B,aAAa,EAAE,mBAAmB,CAAC;KACpC,CAAC;IACF,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,iBAAiB,CAAC,EAAE,qCAAqC,CAAC;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GACnB,sBAAsB,CAqCxB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,sBAAsB,CA6BzB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,QAAQ,EAAE,sBAAsB,EAAE,GACjC;IAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,CAuB9D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,CAQjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,aAAa,CAkDhF;AAgCD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAO3E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAgDjF;AA2BD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAoChE"}
+{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/proof.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EAEzB,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EAEZ,aAAa,EAIb,iCAAiC,EACjC,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EAEhB,qCAAqC,EACtC,MAAM,uBAAuB,CAAC;AAoB/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC5C,cAAc,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAClD,IAAI,EAAE,sBAAsB,CAAC;IAC7B,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC,CAAC;IAClF,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,iCAAiC,CAAC;IACtD;+DAC2D;IAC3D,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,0BAA0B,GAAG,SAAS,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACnC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;QACrC,SAAS,EAAE,eAAe,CAAC;QAC3B,aAAa,EAAE,mBAAmB,CAAC;KACpC,CAAC;IACF,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,iBAAiB,CAAC,EAAE,qCAAqC,CAAC;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GACnB,sBAAsB,CAqCxB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,sBAAsB,CA6BzB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,QAAQ,EAAE,sBAAsB,EAAE,GACjC;IAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,CAuB9D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,CAQjF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,WAAW,GAAG,QAAQ,EAC9B,MAAM,EAAE,SAAS,IAAI,CAAC,kBAAkB,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,GAC9D,iBAAiB,GAAG,SAAS,CAS/B;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,aAAa,CAoDhF;AAgCD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAO3E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAmDjF;AA2BD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAoChE"}

package/dist/core/workflow/proof.js

@@ -108,6 +108,35 @@ export function digestResult(value, kind) {
         bytes: Buffer.byteLength(serialized),
     };
 }
+/**
+ * The run-level failure class (ADR 0046), derived from the agents rather than a
+ * single terminal throw so it survives a script's `parallel()` swallowing the
+ * rejection — a swallowed agent's proof is still recorded with its class.
+ *
+ * Rules, in order, all in service of "default to charging":
+ * 1. A succeeded run is never classed (there is nothing uncharged about it).
+ * 2. If ANY agent produced a result (succeeded or replayed from cache) the
+ *    attempt was informative about the work — charge it. This also keeps a
+ *    resumed run whose earlier segment did real work from being written off by
+ *    a later environment failure.
+ * 3. Otherwise, among the failed agents, environment wins over upstream: a
+ *    missing binary means nothing ran at all, and it is the operator-chosen
+ *    hard stop.
+ * 4. Anything else is undefined ⇒ a charged work failure, exactly as today.
+ */
+export function deriveRunFailureClass(status, agents) {
+    if (status !== "failed")
+        return undefined;
+    if (agents.some((agent) => agent.status === "succeeded" || agent.status === "cached")) {
+        return undefined;
+    }
+    const failed = agents.filter((agent) => agent.status === "failed");
+    if (failed.some((agent) => agent.class === "environment"))
+        return "environment";
+    if (failed.some((agent) => agent.class === "upstream"))
+        return "upstream";
+    return undefined;
+}
 export function buildWorkflowProof(input) {
     const acceptance = rollupAcceptance(input.meta.acceptance, input.evidence);
     const repository = buildRepoEvidence(input.before, input.after);
@@ -121,6 +150,7 @@ export function buildWorkflowProof(input) {
     }));
     const harnesses = buildHarnessCoverage(agents, input.harnessEvidence, input.harnessAttestations);
     const unknowns = buildUnknowns(agents, harnesses, repository);
+    const runClass = deriveRunFailureClass(input.status, agents);
     const journal = readFileSync(input.journalPath);
     return {
         schema_version: WORKFLOW_PROOF_SCHEMA_VERSION,
@@ -137,6 +167,7 @@ export function buildWorkflowProof(input) {
             objective: input.meta.objective,
             error: clippedOptional(input.error, MAX_SUMMARY_CHARS),
             result: input.result === undefined ? undefined : digestResult(input.result),
+            ...(runClass ? { class: runClass } : {}),
         },
         acceptance,
         agents,
@@ -212,6 +243,9 @@ export function readWorkflowProof(coordRoot, runId) {
     }
     if (proof.schema_version !== WORKFLOW_PROOF_SCHEMA_VERSION ||
         proof.run?.id !== runId ||
+        (proof.run.class !== undefined &&
+            proof.run.class !== "environment" &&
+            proof.run.class !== "upstream") ||
         (proof.run.work_context !== undefined &&
             (!proof.run.work_item_id ||
                 proof.run.work_context.id !== proof.run.work_item_id ||

package/dist/core/workflow/spawn-claude.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-claude.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-claude.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAKjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAYrE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAsB1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAwDxE;AAED,eAAO,MAAM,iBAAiB,EAAE,OAc/B,CAAC"}
+{"version":3,"file":"spawn-claude.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-claude.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAKjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAYrE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAsB1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CA2ExE;AAED,eAAO,MAAM,iBAAiB,EAAE,OAc/B,CAAC"}

package/dist/core/workflow/spawn-claude.js

@@ -22,7 +22,7 @@ import { builtinHarnessProfile, validateHarnessEffort } from "../harnesses/profi
 import { buildChildEnv } from "./child-env.js";
 import { notFoundError } from "./harnesses.js";
 import { resolveSandboxProjection } from "./sandbox-projection.js";
-import { vendorFailureText } from "./spawn-failure.js";
+import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
 export function buildClaudeInvocation(req) {
     validateHarnessEffort("claude-code", req.effort);
     if (req.filesystemPolicy) {
@@ -53,7 +53,20 @@ export function normalizeClaudeResult(raw) {
             error: `claude timed out after ${raw.durationMs}ms and was killed`,
         };
     }
+    // Structural environment signal: the binary was never there (spawned directly,
+    // so a missing binary surfaces as ENOENT). Uncharged and not retried.
+    if (raw.spawnErrno === "ENOENT") {
+        return {
+            ok: false,
+            text: "",
+            durationMs: raw.durationMs,
+            error: notFoundError("claude-code"),
+            class: "environment",
+        };
+    }
     if (raw.exitCode === 127) {
+        // A bare 127 with no errno is a shell/vendor 127, indistinguishable from a
+        // legitimate one — charged as work rather than classed environment.
         return {
             ok: false,
             text: "",
@@ -62,11 +75,13 @@ export function normalizeClaudeResult(raw) {
         };
     }
     if (raw.exitCode !== 0) {
+        const failureText = vendorFailureText(raw);
         return {
             ok: false,
             text: "",
             durationMs: raw.durationMs,
-            error: `claude exited ${raw.exitCode}: ${vendorFailureText(raw)}`,
+            error: `claude exited ${raw.exitCode}: ${failureText}`,
+            ...(isUpstreamFailureText(failureText) ? { class: "upstream" } : {}),
         };
     }
     let envelope;
@@ -82,6 +97,7 @@ export function normalizeClaudeResult(raw) {
         };
     }
     if (envelope.is_error) {
+        const envelopeError = `${envelope.subtype ?? ""} ${(envelope.errors ?? []).join("; ")} ${String(envelope.result ?? "")}`;
         return {
             ok: false,
             text: String(envelope.result ?? ""),
@@ -89,6 +105,7 @@ export function normalizeClaudeResult(raw) {
             costUsd: envelope.total_cost_usd,
             durationMs: raw.durationMs,
             error: `harness error (${envelope.subtype ?? "unknown"}): ${(envelope.errors ?? []).join("; ") || "see envelope"}`,
+            ...(isUpstreamFailureText(envelopeError) ? { class: "upstream" } : {}),
         };
     }
     return {

package/dist/core/workflow/spawn-codex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-codex.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAKjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAErE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,iBAAiB,CA8B9F;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAyBvE;AAED,eAAO,MAAM,YAAY,EAAE,OA2B1B,CAAC"}
+{"version":3,"file":"spawn-codex.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAKjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAErE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,iBAAiB,CA8B9F;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAwCvE;AAED,eAAO,MAAM,YAAY,EAAE,OA2B1B,CAAC"}

package/dist/core/workflow/spawn-codex.js

@@ -23,7 +23,7 @@ import { builtinHarnessProfile, validateHarnessEffort } from "../harnesses/profi
 import { buildChildEnv } from "./child-env.js";
 import { notFoundError } from "./harnesses.js";
 import { resolveSandboxProjection } from "./sandbox-projection.js";
-import { vendorFailureText } from "./spawn-failure.js";
+import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
 export function buildCodexInvocation(req, resultFile) {
     validateHarnessEffort("codex", req.effort);
     if (!resultFile)
@@ -60,15 +60,30 @@ export function normalizeCodexResult(raw) {
             error: `codex timed out after ${raw.durationMs}ms and was killed`,
         };
     }
+    // Structural environment signal: the binary was never there (spawned directly,
+    // so a missing binary surfaces as ENOENT). Uncharged and not retried.
+    if (raw.spawnErrno === "ENOENT") {
+        return {
+            ok: false,
+            text: "",
+            durationMs: raw.durationMs,
+            error: notFoundError("codex"),
+            class: "environment",
+        };
+    }
     if (raw.exitCode === 127) {
+        // A bare 127 with no errno is a shell/vendor 127, indistinguishable from a
+        // legitimate one — charged as work rather than classed environment.
         return { ok: false, text: "", durationMs: raw.durationMs, error: notFoundError("codex") };
     }
     if (raw.exitCode !== 0) {
+        const failureText = vendorFailureText(raw);
         return {
             ok: false,
             text: "",
             durationMs: raw.durationMs,
-            error: `codex exited ${raw.exitCode}: ${vendorFailureText(raw)}`,
+            error: `codex exited ${raw.exitCode}: ${failureText}`,
+            ...(isUpstreamFailureText(failureText) ? { class: "upstream" } : {}),
         };
     }
     return {

package/dist/core/workflow/spawn-cursor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-cursor.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAKjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASrE,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAWA;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAkB1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAqCxE;AAED,eAAO,MAAM,aAAa,EAAE,OAe3B,CAAC"}
+{"version":3,"file":"spawn-cursor.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAKjF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASrE,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAWA;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAkB1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAqDxE;AAED,eAAO,MAAM,aAAa,EAAE,OAe3B,CAAC"}

package/dist/core/workflow/spawn-cursor.js

@@ -23,7 +23,7 @@ import { builtinHarnessProfile, validateHarnessEffort } from "../harnesses/profi
 import { buildChildEnv } from "./child-env.js";
 import { notFoundError } from "./harnesses.js";
 import { resolveSandboxProjection } from "./sandbox-projection.js";
-import { vendorFailureText } from "./spawn-failure.js";
+import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
 /** Exported for unit tests (no live binary to test against). */
 export function parseCursorOutput(stdout) {
     try {
@@ -63,15 +63,30 @@ export function normalizeCursorResult(raw) {
             error: `cursor timed out after ${raw.durationMs}ms and was killed`,
         };
     }
+    // Structural environment signal: the binary was never there (spawned directly,
+    // so a missing binary surfaces as ENOENT). Uncharged and not retried.
+    if (raw.spawnErrno === "ENOENT") {
+        return {
+            ok: false,
+            text: "",
+            durationMs: raw.durationMs,
+            error: notFoundError("cursor"),
+            class: "environment",
+        };
+    }
     if (raw.exitCode === 127) {
+        // A bare 127 with no errno is a shell/vendor 127, indistinguishable from a
+        // legitimate one — charged as work rather than classed environment.
         return { ok: false, text: "", durationMs: raw.durationMs, error: notFoundError("cursor") };
     }
     if (raw.exitCode !== 0) {
+        const failureText = vendorFailureText(raw);
         return {
             ok: false,
             text: "",
             durationMs: raw.durationMs,
-            error: `cursor-agent exited ${raw.exitCode}: ${vendorFailureText(raw)}`,
+            error: `cursor-agent exited ${raw.exitCode}: ${failureText}`,
+            ...(isUpstreamFailureText(failureText) ? { class: "upstream" } : {}),
         };
     }
     const parsed = parseCursorOutput(raw.stdout);
@@ -82,6 +97,7 @@ export function normalizeCursorResult(raw) {
             sessionId: parsed.sessionId,
             durationMs: raw.durationMs,
             error: `cursor-agent reported is_error: ${parsed.text.slice(0, 300)}`,
+            ...(isUpstreamFailureText(parsed.text) ? { class: "upstream" } : {}),
         };
     }
     return {

package/dist/core/workflow/spawn-failure.d.ts

@@ -15,4 +15,18 @@ export declare function vendorFailureText(raw: {
     stdout?: string;
     stderr?: string;
 }, maxChars?: number): string;
+/**
+ * Whether failure text names an UPSTREAM refusal — the vendor was reached and
+ * refused (a 5xx/429 status or circuit-open wording), as opposed to a work
+ * failure (the model ran and produced a wrong or incomplete result).
+ *
+ * There is no structural upstream signal the way ENOENT structurally marks a
+ * missing binary, so this is the one text match in the classifier. It is kept
+ * SHORT and documented on purpose: a per-vendor regex zoo would rot, and a
+ * false positive here wrongly withholds a charge, so both the phrase list and
+ * the numeric match stay tight — the number must sit in HTTP-status context, not
+ * merely fall in the 429/5xx range. Anything it does not match falls through to
+ * a charged work failure.
+ */
+export declare function isUpstreamFailureText(text: string): boolean;
 //# sourceMappingURL=spawn-failure.d.ts.map

package/dist/core/workflow/spawn-failure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-failure.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,mEAAmE;AACnE,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACzC,QAAQ,SAAoB,GAC3B,MAAM,CAQR"}
+{"version":3,"file":"spawn-failure.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,mEAAmE;AACnE,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACzC,QAAQ,SAAoB,GAC3B,MAAM,CAQR;AAyBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D"}

package/dist/core/workflow/spawn-failure.js

@@ -22,3 +22,37 @@ export function vendorFailureText(raw, maxChars = DEFAULT_MAX_CHARS) {
     const combined = parts.join("\n");
     return combined.length > maxChars ? `…${combined.slice(-maxChars)}` : combined;
 }
+// A 429 or 5xx status, but only where it sits in HTTP-status CONTEXT — not any
+// digits that merely happen to fall in that range. A bare-number match treats a
+// line number ("at line 500"), an item count ("got 429 items"), or a duration
+// ("after 502 seconds") as an upstream refusal, which wrongly withholds a charge
+// for a failure that was entirely our code. Three recognized shapes:
+//   1. after an "HTTP" label:  "HTTP 429", "HTTP/1.1 503 Service Unavailable"
+//   2. after a "status" label: "status 500", "status: 429", "status code 502"
+//   3. a bare status line:     "503 Service Unavailable" (code at line start,
+//      then a reason phrase) — the classic "<code> <Reason-Phrase>" shape.
+// The trailing `(?![0-9])` and the label/line-start anchors also keep a status
+// embedded in a longer number ("4295"/"5031") out. All 5xx are server-side; 429
+// is the only 4xx that means "reached and refused, retry later".
+const STATUS = "(?:429|5[0-9]{2})";
+const UPSTREAM_STATUS = new RegExp(`(?:\\bHTTP\\b[/0-9. ]*|\\bstatus(?:\\s*code)?\\b[\\s:=]*)${STATUS}(?![0-9])` +
+    `|(?:^|\\n)\\s*${STATUS}\\s+[A-Za-z]`, "i");
+// Explicit vendor wording for the same conditions when a numeric status is
+// absent. Deliberately short — see isUpstreamFailureText.
+const UPSTREAM_PHRASES = /circuit[ _-]?open|service unavailable|too many requests|rate[ _-]?limit|overloaded|bad gateway|gateway time-?out|internal server error/i;
+/**
+ * Whether failure text names an UPSTREAM refusal — the vendor was reached and
+ * refused (a 5xx/429 status or circuit-open wording), as opposed to a work
+ * failure (the model ran and produced a wrong or incomplete result).
+ *
+ * There is no structural upstream signal the way ENOENT structurally marks a
+ * missing binary, so this is the one text match in the classifier. It is kept
+ * SHORT and documented on purpose: a per-vendor regex zoo would rot, and a
+ * false positive here wrongly withholds a charge, so both the phrase list and
+ * the numeric match stay tight — the number must sit in HTTP-status context, not
+ * merely fall in the 429/5xx range. Anything it does not match falls through to
+ * a charged work failure.
+ */
+export function isUpstreamFailureText(text) {
+    return UPSTREAM_STATUS.test(text) || UPSTREAM_PHRASES.test(text);
+}