harnery 0.43.0 → 0.44.0

package/dist/core/workflow/proof.js

@@ -1,10 +1,12 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, statSync } from "node:fs";
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
+import { observationsComparable } from "../context/observation.js";
 import { DIAGNOSTIC_ADVICE_SCHEMA_VERSION } from "../diagnostics/contract.js";
 import { policyDigest } from "../policy/index.js";
 import { isCanonicalWorkflowAttemptContext } from "./attempt-context.js";
 import { stableDigest, writeImmutableJson } from "./durable-record.js";
+import { failureEvidenceAllowsUncharged, isSpawnFailureEvidence } from "./failure-evidence.js";
 import { readWorkflowRunManifest } from "./run-state.js";
 import { EVIDENCE_KINDS, WORKFLOW_DIAGNOSTIC_ADMISSION_SCHEMA_VERSION, WORKFLOW_PROOF_SCHEMA_VERSION, } from "./types.js";
 import { isCanonicalWorkflowWorkContext } from "./work-context.js";
@@ -125,15 +127,18 @@ export function digestResult(value, kind) {
  *    attempt was informative about the work — charge it. This also keeps a
  *    resumed run whose earlier segment did real work from being written off by
  *    a later environment failure.
- * 3. Otherwise, among the failed agents, environment wins over upstream: a
- *    missing binary means nothing ran at all, and it is the operator-chosen
- *    hard stop.
+ * 3. Every participant must have failed with positive no-effect evidence,
+ *    observed absent output and no refusal. A class alone is insufficient.
+ *    Among those eligible failures, environment is the hard stop.
  * 4. Anything else is undefined ⇒ a charged work failure, exactly as today.
  */
 export function deriveRunFailureClass(status, agents) {
     if (status !== "failed")
         return undefined;
-    if (agents.some((agent) => agent.status === "succeeded" || agent.status === "cached")) {
+    if (agents.length === 0 ||
+        agents.some((agent) => agent.status !== "failed" ||
+            (agent.class !== "environment" && agent.class !== "upstream") ||
+            !failureEvidenceAllowsUncharged(agent.failure_evidence))) {
         return undefined;
     }
     const failed = agents.filter((agent) => agent.status === "failed");
@@ -262,6 +267,10 @@ export function readWorkflowProof(coordRoot, runId) {
             proof.run.class !== "environment" &&
             proof.run.class !== "upstream" &&
             proof.run.class !== "decision") ||
+        !Array.isArray(proof.agents) ||
+        proof.agents.some((agent) => !agent ||
+            typeof agent !== "object" ||
+            (agent.failure_evidence !== undefined && !isSpawnFailureEvidence(agent.failure_evidence))) ||
         (proof.run.work_context !== undefined &&
             (!proof.run.work_item_id ||
                 proof.run.work_context.id !== proof.run.work_item_id ||
@@ -275,6 +284,20 @@ export function readWorkflowProof(coordRoot, runId) {
             !isWorkspaceExecutionEvidence(proof.execution, runId, proof.run.status))) {
         throw new Error(`workflow proof at ${path} has an unsupported or mismatched schema`);
     }
+    if (repoComparisonProblem(proof.repository.before, proof.repository.after) !== undefined ||
+        proof.repository.before.dirty_paths_truncated ||
+        proof.repository.after.dirty_paths_truncated ||
+        !proof.repository.before.branch?.trim() ||
+        !proof.repository.after.branch?.trim() ||
+        !proof.repository.before.head?.trim() ||
+        !proof.repository.after.head?.trim()) {
+        proof.repository = buildRepoEvidence(proof.repository.before, proof.repository.after);
+        proof.unknowns = proof.unknowns.filter((item) => item.code !== "repository_drift_incomplete");
+        proof.unknowns.push({
+            code: "repository_drift_incomplete",
+            message: proof.repository.drift.note,
+        });
+    }
     const manifestPath = join(coordRoot, ".harnery", "workflows", runId, "run.json");
     if (proof.execution === undefined && !existsSync(manifestPath))
         return proof;
@@ -369,11 +392,27 @@ export function renderWorkflowProof(proof) {
                 `${observation.advice.assessment.recommended_action}; action none`
             : "admission: shadow not needed; no real child dispatch");
     }
-    const repo = proof.repository;
+    const comparable = repoComparisonProblem(proof.repository.before, proof.repository.after) === undefined;
+    const repo = comparable &&
+        !proof.repository.before.dirty_paths_truncated &&
+        !proof.repository.after.dirty_paths_truncated &&
+        proof.repository.before.branch?.trim() &&
+        proof.repository.after.branch?.trim() &&
+        proof.repository.before.head?.trim() &&
+        proof.repository.after.head?.trim()
+        ? proof.repository
+        : buildRepoEvidence(proof.repository.before, proof.repository.after);
     const drift = repo.drift;
-    lines.push(`repository: branch ${repo.before.branch ?? "unknown"} -> ${repo.after.branch ?? "unknown"}; ` +
-        `HEAD ${short(repo.before.head)} -> ${short(repo.after.head)}; ` +
-        `${drift.dirty_paths_added.length} dirty added, ${drift.dirty_paths_cleared.length} cleared`);
+    if (!comparable) {
+        lines.push(`repository: drift unknown. ${drift.note}`);
+    }
+    else {
+        const paths = drift.dirty_paths_added === null || drift.dirty_paths_cleared === null
+            ? "dirty-path drift unknown"
+            : `${drift.dirty_paths_added.length} dirty added, ${drift.dirty_paths_cleared.length} cleared`;
+        lines.push(`repository: branch ${repo.before.branch ?? "unknown"} -> ${repo.after.branch ?? "unknown"}; ` +
+            `HEAD ${short(repo.before.head)} -> ${short(repo.after.head)}; ${paths}`);
+    }
     if (proof.unknowns.length > 0) {
         lines.push(`unknowns: ${proof.unknowns.length}`);
         for (const unknown of proof.unknowns)
@@ -385,37 +424,93 @@ export function renderWorkflowProof(proof) {
 function buildRepoEvidence(beforeRaw, afterRaw) {
     const before = normalizeRepoSnapshot(beforeRaw);
     const after = normalizeRepoSnapshot(afterRaw);
+    const problem = repoComparisonProblem(before, after);
+    if (problem !== undefined) {
+        return {
+            source: "engine",
+            before,
+            after,
+            drift: {
+                branch_changed: null,
+                head_changed: null,
+                dirty_paths_added: null,
+                dirty_paths_cleared: null,
+                dirty_paths_retained: null,
+                incomplete: true,
+                note: `Repository drift could not be verified: ${problem}. Re-check before editing.`,
+            },
+        };
+    }
+    const pathsComparable = !before.dirty_paths_truncated && !after.dirty_paths_truncated;
+    const branchKnown = Boolean(before.branch && after.branch);
+    const headKnown = Boolean(before.head && after.head);
     const beforeDirty = new Set(before.dirty_paths);
     const afterDirty = new Set(after.dirty_paths);
     const retained = after.dirty_paths.filter((path) => beforeDirty.has(path));
-    const incomplete = Boolean(before.dirty_paths_truncated || after.dirty_paths_truncated || retained.length > 0);
+    const notes = [
+        ...(!pathsComparable
+            ? ["Dirty-path drift is unknown because a snapshot list was truncated."]
+            : []),
+        ...(!branchKnown ? ["Branch drift is unknown because a snapshot has no branch."] : []),
+        ...(!headKnown ? ["HEAD drift is unknown because a snapshot has no HEAD."] : []),
+        ...(pathsComparable && retained.length > 0
+            ? ["Snapshots cannot prove whether retained dirty paths changed during the run."]
+            : []),
+    ];
+    const incomplete = notes.length > 0;
     return {
         source: "engine",
         before,
         after,
         drift: {
-            branch_changed: before.branch !== after.branch,
-            head_changed: before.head !== after.head,
-            dirty_paths_added: after.dirty_paths.filter((path) => !beforeDirty.has(path)),
-            dirty_paths_cleared: before.dirty_paths.filter((path) => !afterDirty.has(path)),
-            dirty_paths_retained: retained,
+            branch_changed: branchKnown ? before.branch !== after.branch : null,
+            head_changed: headKnown ? before.head !== after.head : null,
+            dirty_paths_added: pathsComparable
+                ? after.dirty_paths.filter((path) => !beforeDirty.has(path))
+                : null,
+            dirty_paths_cleared: pathsComparable
+                ? before.dirty_paths.filter((path) => !afterDirty.has(path))
+                : null,
+            dirty_paths_retained: pathsComparable ? retained : null,
             incomplete,
-            note: incomplete
-                ? "Snapshots cannot prove whether retained dirty paths changed during the run, and truncated lists may omit paths."
-                : undefined,
+            note: incomplete ? notes.join(" ") : undefined,
         },
     };
 }
 function normalizeRepoSnapshot(snapshot) {
     return {
         cwd: snapshot.cwd,
+        observation: snapshot.observation ?? "unavailable",
+        observation_detail: snapshot.observation
+            ? clippedOptional(snapshot.observation_detail, 500)
+            : "No repository observation was recorded.",
         root: snapshot.root,
-        branch: snapshot.branch,
-        head: snapshot.head,
+        branch: snapshot.branch?.trim() || undefined,
+        head: snapshot.head?.trim() || undefined,
         dirty_paths: snapshot.dirty_paths,
         dirty_paths_truncated: snapshot.dirty_paths_truncated,
     };
 }
+function snapshotFailure(label, snapshot) {
+    return `${label} snapshot is ${snapshot.observation}${snapshot.observation_detail ? ` (${snapshot.observation_detail})` : ""}`;
+}
+function repoComparisonProblem(before, after) {
+    if (!observationsComparable(before, after)) {
+        return [
+            ...(before.observation !== "ok" ? [snapshotFailure("before", before)] : []),
+            ...(after.observation !== "ok" ? [snapshotFailure("after", after)] : []),
+        ].join("; ");
+    }
+    const unknownRoots = [
+        ...(!before.root || !isAbsolute(before.root) ? ["before"] : []),
+        ...(!after.root || !isAbsolute(after.root) ? ["after"] : []),
+    ];
+    if (unknownRoots.length > 0)
+        return `${unknownRoots.join(" and ")} snapshot repository root is unknown`;
+    if (before.root !== after.root)
+        return "snapshots name different repository roots";
+    return undefined;
+}
 function buildAdapterCoverage(agents, claims, attestations) {
     return [...new Set(agents.map((agent) => agent.adapter))].map((adapter) => {
         const adapterAgents = agents.filter((agent) => agent.adapter === adapter);

package/dist/core/workflow/run-state.d.ts

@@ -47,6 +47,8 @@ export declare function assertWorkflowRunResumable(coordRoot: string, runId: str
 };
 export declare function assertWorkflowScriptUnchanged(manifest: WorkflowRunManifest): void;
 export declare function workflowRunManifestPath(coordRoot: string, runId: string): string;
-/** Acquire an exclusive, crash-recoverable lease for one resume segment. */
+/** Acquire an exclusive lease shared by resume and reclaim. Existing locks
+ * always refuse: a stale observation cannot authorize unlinking a new owner.
+ * Crash recovery requires an audited ownership check outside this operation. */
 export declare function acquireWorkflowResumeLease(coordRoot: string, runId: string): () => void;
 //# sourceMappingURL=run-state.d.ts.map

package/dist/core/workflow/run-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-state.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/run-state.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAEzB,MAAM,oBAAoB,CAAC;AAM5B,OAAO,KAAK,EACV,sBAAsB,EACtB,iCAAiC,EACjC,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,EAEV,gBAAgB,EAChB,uCAAuC,EACxC,MAAM,uBAAuB,CAAC;AAO/B,eAAO,MAAM,oCAAoC,EAAG,CAAU,CAAC;AAK/D,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,iBAAiB,EAAE,YAAY,CAAC;IAChC,SAAS,EAAE;QACT,GAAG,EAAE,MAAM,CAAC;QACZ,eAAe,EAAE,MAAM,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,oBAAoB,CAAC,EAAE,iCAAiC,CAAC;QACzD,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;QAC/B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,SAAS,EAAE,eAAe,CAAC;QAC3B,cAAc,EAAE,mBAAmB,CAAC;QACpC,MAAM,CAAC,EAAE,gBAAgB,CAAC;QAC1B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;QACxD,iBAAiB,CAAC,EAAE,gBAAgB,CAAC;QACrC,kBAAkB,CAAC,EAAE,uCAAuC,CAAC;KAC9D,CAAC;CACH;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,6BAA6B,GAAG,MAAM,CAgBrF;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAyC7F;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CA4BvD;AAED,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CASjF;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGhF;AAED,4EAA4E;AAC5E,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,IAAI,CA0CvF"}
+{"version":3,"file":"run-state.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/run-state.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAEzB,MAAM,oBAAoB,CAAC;AAM5B,OAAO,KAAK,EACV,sBAAsB,EACtB,iCAAiC,EACjC,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,EAEV,gBAAgB,EAChB,uCAAuC,EACxC,MAAM,uBAAuB,CAAC;AAO/B,eAAO,MAAM,oCAAoC,EAAG,CAAU,CAAC;AAI/D,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,iBAAiB,EAAE,YAAY,CAAC;IAChC,SAAS,EAAE;QACT,GAAG,EAAE,MAAM,CAAC;QACZ,eAAe,EAAE,MAAM,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,oBAAoB,CAAC,EAAE,iCAAiC,CAAC;QACzD,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;QAC/B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,SAAS,EAAE,eAAe,CAAC;QAC3B,cAAc,EAAE,mBAAmB,CAAC;QACpC,MAAM,CAAC,EAAE,gBAAgB,CAAC;QAC1B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;QACxD,iBAAiB,CAAC,EAAE,gBAAgB,CAAC;QACrC,kBAAkB,CAAC,EAAE,uCAAuC,CAAC;KAC9D,CAAC;CACH;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,6BAA6B,GAAG,MAAM,CAgBrF;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAgD7F;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CA4BvD;AAED,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CASjF;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGhF;AAED;;gFAEgF;AAChF,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,IAAI,CA2CvF"}

package/dist/core/workflow/run-state.js

@@ -1,4 +1,4 @@
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { hostname } from "node:os";
 import { dirname, isAbsolute, join, resolve } from "node:path";
@@ -13,7 +13,6 @@ import { isCanonicalWorkflowWorkContext } from "./work-context.js";
 import { assertWorkspaceManifestAuthority, isWorkspaceBinding, isWorkspaceCompatibilityExecutionEvidence, } from "./workspaces/validate.js";
 export const WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION = 2;
 const MANIFEST_LIMIT_BYTES = 256 * 1024;
-const FOREIGN_LEASE_STALE_MS = 24 * 60 * 60 * 1_000;
 export function workflowScriptDigest(scriptPath) {
     return createHash("sha256").update(readFileSync(scriptPath)).digest("hex");
 }
@@ -70,6 +69,13 @@ export function readWorkflowRunManifest(coordRoot, runId) {
         !validExecution(manifest.execution)) {
         throw new Error(`workflow run manifest at ${path} has an unsupported or mismatched schema`);
     }
+    if (manifest.repository_before.observation === undefined) {
+        manifest.repository_before = {
+            ...manifest.repository_before,
+            observation: "unavailable",
+            observation_detail: "No repository observation was recorded.",
+        };
+    }
     assertWorkspaceManifestAuthority(manifest, readManifestWorkspaceRequest(coordRoot, runId));
     return manifest;
 }
@@ -121,17 +127,25 @@ export function workflowRunManifestPath(coordRoot, runId) {
     assertWorkflowRunId(runId);
     return join(coordRoot, ".harnery", "workflows", runId, "run.json");
 }
-/** Acquire an exclusive, crash-recoverable lease for one resume segment. */
+/** Acquire an exclusive lease shared by resume and reclaim. Existing locks
+ * always refuse: a stale observation cannot authorize unlinking a new owner.
+ * Crash recovery requires an audited ownership check outside this operation. */
 export function acquireWorkflowResumeLease(coordRoot, runId) {
     assertWorkflowRunId(runId);
     const path = join(coordRoot, ".harnery", "workflows", runId, "resume.lock");
-    const owner = { pid: process.pid, host: hostname(), created_at: new Date().toISOString() };
+    const owner = {
+        owner_id: randomUUID(),
+        pid: process.pid,
+        host: hostname(),
+        created_at: new Date().toISOString(),
+    };
+    const ownerBytes = `${JSON.stringify(owner)}\n`;
     mkdirSync(dirname(path), { recursive: true });
     const acquire = () => {
         try {
             const fd = openSync(path, "wx", stateFileMode());
             try {
-                writeFileSync(fd, `${JSON.stringify(owner)}\n`, "utf8");
+                writeFileSync(fd, ownerBytes, "utf8");
             }
             finally {
                 closeSync(fd);
@@ -147,21 +161,18 @@ export function acquireWorkflowResumeLease(coordRoot, runId) {
     };
     if (!acquire()) {
         const existing = readResumeLease(path);
-        if (existing && resumeLeaseIsLive(existing)) {
-            throw new Error(`workflow run ${runId} is already being resumed by pid ${existing.pid} on ${existing.host}`);
-        }
-        unlinkSync(path);
-        if (!acquire())
-            throw new Error(`workflow run ${runId} resume lease raced with another process`);
+        const holder = existing
+            ? ` by pid ${existing.pid} on ${existing.host}; its liveness has not been verified`
+            : "; its owner could not be verified";
+        throw new Error(`workflow run ${runId} resume lease is already held${holder}`);
     }
     return () => {
         try {
-            const existing = readResumeLease(path);
-            if (existing?.pid === owner.pid && existing.host === owner.host)
+            if (readFileSync(path, "utf8") === ownerBytes)
                 unlinkSync(path);
         }
         catch {
-            // Best effort. A stale lease is recoverable on the next resume attempt.
+            // Leave an unreadable or replaced lock untouched.
         }
     };
 }
@@ -180,19 +191,6 @@ function readResumeLease(path) {
         return null;
     }
 }
-function resumeLeaseIsLive(lease) {
-    if (lease.host !== hostname()) {
-        const age = Date.now() - Date.parse(lease.created_at);
-        return Number.isFinite(age) && age < FOREIGN_LEASE_STALE_MS;
-    }
-    try {
-        process.kill(lease.pid, 0);
-        return true;
-    }
-    catch (error) {
-        return error.code === "EPERM";
-    }
-}
 function validExecution(value) {
     if (!value || typeof value !== "object")
         return false;
@@ -259,6 +257,12 @@ function validFrozenPolicy(policy, cwd) {
 function validRepoSnapshot(value) {
     return (Boolean(value) &&
         typeof value === "object" &&
+        (value.observation === undefined ||
+            value.observation === "ok" ||
+            value.observation === "partial" ||
+            value.observation === "unavailable") &&
+        (value.observation_detail === undefined ||
+            (typeof value.observation_detail === "string" && value.observation_detail.length <= 500)) &&
         isAbsolute(value.cwd) &&
         (value.root === undefined || isAbsolute(value.root)) &&
         (value.branch === undefined || typeof value.branch === "string") &&

package/dist/core/workflow/spawn-claude.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-claude.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-claude.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAKhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAYrE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CA0B1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CA2ExE;AAED,eAAO,MAAM,iBAAiB,EAAE,OAiB/B,CAAC"}
+{"version":3,"file":"spawn-claude.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-claude.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAMhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAYrE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CA0B1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAexE;AA+ED,eAAO,MAAM,iBAAiB,EAAE,OAiB/B,CAAC"}

package/dist/core/workflow/spawn-claude.js

@@ -21,6 +21,7 @@ import { exec } from "../../lib/exec.js";
 import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profiles.js";
 import { notFoundError } from "./adapters.js";
 import { buildChildEnv } from "./child-env.js";
+import { observeSpawnFailure } from "./failure-evidence.js";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.js";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
 export function buildClaudeInvocation(req) {
@@ -50,6 +51,24 @@ export function buildClaudeInvocation(req) {
     return { argv };
 }
 export function normalizeClaudeResult(raw) {
+    const result = normalizeClaudeTransportResult(raw);
+    if (result.ok)
+        return result;
+    let text = raw.stdout.trim();
+    let source = "stdout";
+    try {
+        const envelope = JSON.parse(raw.stdout);
+        if (typeof envelope.result === "string" && envelope.result.length > 0) {
+            text = envelope.result;
+            source = "vendor_envelope";
+        }
+    }
+    catch {
+        // Retain unstructured output without treating it as native authority.
+    }
+    return { ...result, text, failureEvidence: observeSpawnFailure(raw, text, source) };
+}
+function normalizeClaudeTransportResult(raw) {
     if (raw.timedOut) {
         return {
             ok: false,

package/dist/core/workflow/spawn-codex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-codex.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAQH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAKhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAErE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,iBAAiB,CA6C9F;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAwCvE;AAED,eAAO,MAAM,YAAY,EAAE,OA8B1B,CAAC"}
+{"version":3,"file":"spawn-codex.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAQH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAMhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAErE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,iBAAiB,CA6C9F;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAUvE;AA4CD,eAAO,MAAM,YAAY,EAAE,OA8B1B,CAAC"}

package/dist/core/workflow/spawn-codex.js

@@ -24,6 +24,7 @@ import { exec } from "../../lib/exec.js";
 import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profiles.js";
 import { notFoundError } from "./adapters.js";
 import { buildChildEnv } from "./child-env.js";
+import { observeSpawnFailure } from "./failure-evidence.js";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.js";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
 export function buildCodexInvocation(req, resultFile) {
@@ -71,6 +72,18 @@ export function buildCodexInvocation(req, resultFile) {
     return { argv, resultFile };
 }
 export function normalizeCodexResult(raw) {
+    const result = normalizeCodexTransportResult(raw);
+    if (result.ok)
+        return result;
+    const finalText = raw.resultFileText?.trim();
+    const text = finalText || raw.stdout.trim();
+    return {
+        ...result,
+        text,
+        failureEvidence: observeSpawnFailure(raw, text, finalText ? "final_message" : "stdout"),
+    };
+}
+function normalizeCodexTransportResult(raw) {
     if (raw.timedOut) {
         return {
             ok: false,

package/dist/core/workflow/spawn-cursor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-cursor.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAKhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASrE,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAWA;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAsB1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAqDxE;AAED,eAAO,MAAM,aAAa,EAAE,OAkB3B,CAAC"}
+{"version":3,"file":"spawn-cursor.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAMhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASrE,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAWA;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAsB1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAexE;AAyDD,eAAO,MAAM,aAAa,EAAE,OAkB3B,CAAC"}

package/dist/core/workflow/spawn-cursor.js

@@ -22,6 +22,7 @@ import { exec } from "../../lib/exec.js";
 import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profiles.js";
 import { notFoundError } from "./adapters.js";
 import { buildChildEnv } from "./child-env.js";
+import { observeSpawnFailure } from "./failure-evidence.js";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.js";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
 /** Exported for unit tests (no live binary to test against). */
@@ -60,6 +61,24 @@ export function buildCursorInvocation(req) {
     return { argv };
 }
 export function normalizeCursorResult(raw) {
+    const result = normalizeCursorTransportResult(raw);
+    if (result.ok)
+        return result;
+    let text = raw.stdout;
+    let source = "stdout";
+    try {
+        const envelope = JSON.parse(raw.stdout);
+        if (typeof envelope.result === "string" && envelope.result.length > 0) {
+            text = envelope.result;
+            source = "vendor_envelope";
+        }
+    }
+    catch {
+        // Raw output remains evidence, not an inferred refusal or effect result.
+    }
+    return { ...result, text, failureEvidence: observeSpawnFailure(raw, text, source) };
+}
+function normalizeCursorTransportResult(raw) {
     if (raw.timedOut) {
         return {
             ok: false,

package/dist/core/workflow/spawn-opencode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-opencode.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-opencode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAKhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAQrE;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAoBA;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAoB5E;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CA2C1E;AAED,eAAO,MAAM,eAAe,EAAE,OAkB7B,CAAC"}
+{"version":3,"file":"spawn-opencode.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-opencode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAMhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAQrE;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAoBA;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAoB5E;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAW1E;AA+CD,eAAO,MAAM,eAAe,EAAE,OAkB7B,CAAC"}

package/dist/core/workflow/spawn-opencode.js

@@ -20,6 +20,7 @@ import { exec } from "../../lib/exec.js";
 import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profiles.js";
 import { notFoundError } from "./adapters.js";
 import { buildChildEnv } from "./child-env.js";
+import { observeSpawnFailure } from "./failure-evidence.js";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.js";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
 /**
@@ -72,6 +73,19 @@ export function buildOpenCodeInvocation(req) {
     return { argv };
 }
 export function normalizeOpenCodeResult(raw) {
+    const result = normalizeOpenCodeTransportResult(raw);
+    if (result.ok)
+        return result;
+    const parsed = parseOpenCodeStream(raw.stdout);
+    const text = parsed.text || raw.stdout.trim();
+    return {
+        ...result,
+        text,
+        sessionId: parsed.sessionId,
+        failureEvidence: observeSpawnFailure(raw, text, parsed.text ? "vendor_envelope" : "stdout"),
+    };
+}
+function normalizeOpenCodeTransportResult(raw) {
     if (raw.timedOut) {
         return {
             ok: false,

package/dist/core/workflow/types.d.ts

@@ -103,17 +103,21 @@ export interface WorkflowAgentProof {
     session_id?: string;
     result?: ResultDigest;
     error?: string;
-    /** Set on a failed agent whose spawn was classified uninformative about the
-     * work (ADR 0046): environment (binary absent) or upstream (vendor refused).
-     * Absent ⇒ a work failure. Recorded even when a script's parallel() swallows
-     * the rejection, so the run-level class can still be derived from proof. */
+    /** Failed-spawn transport class. It is retained even when a script swallows
+     * the rejection; charging additionally requires validated failure evidence. */
     class?: SpawnFailureClass;
+    /** Failure observations carried from the adapter. Missing observations are
+     * unknown and cannot authorize an uncharged attempt. */
+    failure_evidence?: SpawnFailureEvidence;
     /** Which vendor sandbox mode this agent launched with and why (ADR 0192).
      * Absent on a cached agent, which launched nothing. */
     access?: WorkerAccessDecision;
 }
 export interface WorkflowRepoSnapshot {
     cwd: string;
+    observation: "ok" | "unavailable" | "partial";
+    /** Bounded explanation of an unavailable or incomplete observation. */
+    observation_detail?: string;
     root?: string;
     branch?: string;
     head?: string;
@@ -125,12 +129,13 @@ export interface WorkflowRepoEvidence {
     before: WorkflowRepoSnapshot;
     after: WorkflowRepoSnapshot;
     drift: {
-        branch_changed: boolean;
-        head_changed: boolean;
-        dirty_paths_added: string[];
-        dirty_paths_cleared: string[];
-        dirty_paths_retained: string[];
-        /** True when snapshots cannot prove whether every retained dirty path changed. */
+        /** Null means the snapshots do not establish this comparison. */
+        branch_changed: boolean | null;
+        head_changed: boolean | null;
+        dirty_paths_added: string[] | null;
+        dirty_paths_cleared: string[] | null;
+        dirty_paths_retained: string[] | null;
+        /** True when an observation, comparison, or retained-path change is unknown. */
         incomplete: boolean;
         note?: string;
     };
@@ -305,15 +310,16 @@ export interface WorkflowSpecialistProfile {
     maxTurns?: number;
 }
 /**
- * Why a failed run was uninformative about the work (ADR 0046). Absent means
- * the attempt produced information about the work (or succeeded), which is the
- * default and is charged against the attempt budget exactly as before.
+ * The positively identified transport cause of a failed spawn (ADR 0046).
+ * This class alone proves neither absence of effects nor retry eligibility.
  *
  * - `environment`: the run never started — a precondition was missing (the
- *   vendor binary was absent). Uncharged AND not retried: retrying an unchanged
+ *   vendor binary was absent). With positive no-effect/output evidence it is
+ *   uncharged and not retried: retrying an unchanged
  *   environment cannot help, so the work item stops and names the precondition.
  * - `upstream`: the vendor was reached and refused (5xx, 429, circuit open).
- *   Uncharged, but retry stays available (bounded by max_uncharged_attempts).
+ *   Retry/free-attempt eligibility also requires positive no-effect evidence,
+ *   observed absent output, and no refusal. Unsupported evidence stays unknown.
  */
 export type SpawnFailureClass = "environment" | "upstream";
 /**
@@ -333,6 +339,43 @@ export type SpawnFailureClass = "environment" | "upstream";
  * waiting for is a person who was never told.
  */
 export type RunFailureClass = SpawnFailureClass | "decision";
+/** Positive claims name the observation that supports them. A transport error
+ * or an empty reply is never evidence that no effects occurred. */
+export type SpawnEffectEvidence = {
+    state: "unknown";
+} | {
+    state: "none";
+    source: "spawn_errno";
+    reference: "ENOENT";
+} | {
+    state: "none" | "observed";
+    source: "adapter_evidence";
+    reference: string;
+};
+export type SpawnRefusalEvidence = {
+    state: "unknown";
+} | {
+    state: "refused";
+    source: "vendor_envelope";
+    reference: string;
+};
+export type SpawnOutputSource = "final_message" | "vendor_envelope" | "stdout";
+export type SpawnPartialOutputEvidence = {
+    state: "unknown";
+} | {
+    state: "absent";
+    source: SpawnOutputSource;
+} | {
+    state: "present";
+    source: SpawnOutputSource;
+    bytes: number;
+    sha256: string;
+};
+export interface SpawnFailureEvidence {
+    effect: SpawnEffectEvidence;
+    refusal: SpawnRefusalEvidence;
+    partial_output: SpawnPartialOutputEvidence;
+}
 /** What a spawn adapter returns for one subagent run. */
 export interface SpawnResult {
     ok: boolean;
@@ -344,9 +387,13 @@ export interface SpawnResult {
     durationMs: number;
     /** Populated when ok=false. */
     error?: string;
-    /** Set when ok=false and the failure was positively identified as
-     * uninformative about the work. Absent ⇒ a work failure (charged). */
+    /** Transport classification when ok=false; never sufficient by itself to
+     * grant free work or automatic redispatch. */
     class?: SpawnFailureClass;
+    /** Transport classification alone grants neither a retry nor free work.
+     * Absent evidence is explicitly unknown. Positive adapter_evidence claims
+     * require a documented producer observation, never an HTTP/text heuristic. */
+    failureEvidence?: SpawnFailureEvidence;
 }
 export interface SpawnRequest {
     prompt: string;