harnery 0.43.0 → 0.45.0

package/dist/core/workflow/proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/proof.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EAEzB,YAAY,EAEZ,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,gCAAgC,EAChC,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EAEZ,aAAa,EAIb,iCAAiC,EACjC,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAOpB,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EAChB,uCAAuC,EAExC,MAAM,uBAAuB,CAAC;AAoB/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC5C,cAAc,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAClD,IAAI,EAAE,sBAAsB,CAAC;IAC7B,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,mBAAmB,CAAC,EAAE,gCAAgC,CAAC;IACvD,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC,CAAC;IAClF,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,iCAAiC,CAAC;IACtD;+DAC2D;IAC3D,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,0BAA0B,GAAG,SAAS,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACnC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;QACrC,SAAS,EAAE,eAAe,CAAC;QAC3B,aAAa,EAAE,mBAAmB,CAAC;KACpC,CAAC;IACF;mFAC+E;IAC/E,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,iBAAiB,CAAC,EAAE,uCAAuC,CAAC;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GACnB,sBAAsB,CAqCxB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,sBAAsB,CA8BzB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,QAAQ,EAAE,sBAAsB,EAAE,GACjC;IAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,CAuB9D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,CAQjF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,WAAW,GAAG,QAAQ,EAC9B,MAAM,EAAE,SAAS,IAAI,CAAC,kBAAkB,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,GAC9D,iBAAiB,GAAG,SAAS,CAS/B;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,aAAa,CA8DhF;AAgCD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAO3E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAqDjF;AA+DD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CA6ChE"}
+{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/proof.ts"],"names":[],"mappings":"AAGA,OAAO,EAA0B,KAAK,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEtF,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAM5B,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EAEzB,YAAY,EAEZ,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,gCAAgC,EAChC,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EAEZ,aAAa,EAIb,iCAAiC,EACjC,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAOpB,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EAChB,uCAAuC,EAExC,MAAM,uBAAuB,CAAC;AAoB/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC5C,cAAc,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAClD,IAAI,EAAE,sBAAsB,CAAC;IAC7B,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,mBAAmB,CAAC,EAAE,gCAAgC,CAAC;IACvD,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC,CAAC;IAClF,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,iCAAiC,CAAC;IACtD;+DAC2D;IAC3D,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,0BAA0B,GAAG,SAAS,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACnC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;QACrC,SAAS,EAAE,eAAe,CAAC;QAC3B,aAAa,EAAE,mBAAmB,CAAC;KACpC,CAAC;IACF;mFAC+E;IAC/E,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,iBAAiB,CAAC,EAAE,uCAAuC,CAAC;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GACnB,sBAAsB,CAqCxB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,sBAAsB,CA8BzB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,QAAQ,EAAE,sBAAsB,EAAE,GACjC;IAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,CAuB9D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,CAQjF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,WAAW,GAAG,QAAQ,EAC9B,MAAM,EAAE,SAAS,IAAI,CAAC,kBAAkB,EAAE,QAAQ,GAAG,OAAO,GAAG,kBAAkB,CAAC,EAAE,GACnF,iBAAiB,GAAG,SAAS,CAiB/B;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,aAAa,CA8DhF;AAgCD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAO3E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CA4EjF;AA+DD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CA+DhE"}

package/dist/core/workflow/proof.js

@@ -1,10 +1,12 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, statSync } from "node:fs";
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
+import { observationsComparable } from "../context/observation.js";
 import { DIAGNOSTIC_ADVICE_SCHEMA_VERSION } from "../diagnostics/contract.js";
 import { policyDigest } from "../policy/index.js";
 import { isCanonicalWorkflowAttemptContext } from "./attempt-context.js";
 import { stableDigest, writeImmutableJson } from "./durable-record.js";
+import { failureEvidenceAllowsUncharged, isSpawnFailureEvidence } from "./failure-evidence.js";
 import { readWorkflowRunManifest } from "./run-state.js";
 import { EVIDENCE_KINDS, WORKFLOW_DIAGNOSTIC_ADMISSION_SCHEMA_VERSION, WORKFLOW_PROOF_SCHEMA_VERSION, } from "./types.js";
 import { isCanonicalWorkflowWorkContext } from "./work-context.js";
@@ -125,15 +127,18 @@ export function digestResult(value, kind) {
  *    attempt was informative about the work — charge it. This also keeps a
  *    resumed run whose earlier segment did real work from being written off by
  *    a later environment failure.
- * 3. Otherwise, among the failed agents, environment wins over upstream: a
- *    missing binary means nothing ran at all, and it is the operator-chosen
- *    hard stop.
+ * 3. Every participant must have failed with positive no-effect evidence,
+ *    observed absent output and no refusal. A class alone is insufficient.
+ *    Among those eligible failures, environment is the hard stop.
  * 4. Anything else is undefined ⇒ a charged work failure, exactly as today.
  */
 export function deriveRunFailureClass(status, agents) {
     if (status !== "failed")
         return undefined;
-    if (agents.some((agent) => agent.status === "succeeded" || agent.status === "cached")) {
+    if (agents.length === 0 ||
+        agents.some((agent) => agent.status !== "failed" ||
+            (agent.class !== "environment" && agent.class !== "upstream") ||
+            !failureEvidenceAllowsUncharged(agent.failure_evidence))) {
         return undefined;
     }
     const failed = agents.filter((agent) => agent.status === "failed");
@@ -262,6 +267,10 @@ export function readWorkflowProof(coordRoot, runId) {
             proof.run.class !== "environment" &&
             proof.run.class !== "upstream" &&
             proof.run.class !== "decision") ||
+        !Array.isArray(proof.agents) ||
+        proof.agents.some((agent) => !agent ||
+            typeof agent !== "object" ||
+            (agent.failure_evidence !== undefined && !isSpawnFailureEvidence(agent.failure_evidence))) ||
         (proof.run.work_context !== undefined &&
             (!proof.run.work_item_id ||
                 proof.run.work_context.id !== proof.run.work_item_id ||
@@ -275,6 +284,20 @@ export function readWorkflowProof(coordRoot, runId) {
             !isWorkspaceExecutionEvidence(proof.execution, runId, proof.run.status))) {
         throw new Error(`workflow proof at ${path} has an unsupported or mismatched schema`);
     }
+    if (repoComparisonProblem(proof.repository.before, proof.repository.after) !== undefined ||
+        proof.repository.before.dirty_paths_truncated ||
+        proof.repository.after.dirty_paths_truncated ||
+        !proof.repository.before.branch?.trim() ||
+        !proof.repository.after.branch?.trim() ||
+        !proof.repository.before.head?.trim() ||
+        !proof.repository.after.head?.trim()) {
+        proof.repository = buildRepoEvidence(proof.repository.before, proof.repository.after);
+        proof.unknowns = proof.unknowns.filter((item) => item.code !== "repository_drift_incomplete");
+        proof.unknowns.push({
+            code: "repository_drift_incomplete",
+            message: proof.repository.drift.note,
+        });
+    }
     const manifestPath = join(coordRoot, ".harnery", "workflows", runId, "run.json");
     if (proof.execution === undefined && !existsSync(manifestPath))
         return proof;
@@ -369,11 +392,27 @@ export function renderWorkflowProof(proof) {
                 `${observation.advice.assessment.recommended_action}; action none`
             : "admission: shadow not needed; no real child dispatch");
     }
-    const repo = proof.repository;
+    const comparable = repoComparisonProblem(proof.repository.before, proof.repository.after) === undefined;
+    const repo = comparable &&
+        !proof.repository.before.dirty_paths_truncated &&
+        !proof.repository.after.dirty_paths_truncated &&
+        proof.repository.before.branch?.trim() &&
+        proof.repository.after.branch?.trim() &&
+        proof.repository.before.head?.trim() &&
+        proof.repository.after.head?.trim()
+        ? proof.repository
+        : buildRepoEvidence(proof.repository.before, proof.repository.after);
     const drift = repo.drift;
-    lines.push(`repository: branch ${repo.before.branch ?? "unknown"} -> ${repo.after.branch ?? "unknown"}; ` +
-        `HEAD ${short(repo.before.head)} -> ${short(repo.after.head)}; ` +
-        `${drift.dirty_paths_added.length} dirty added, ${drift.dirty_paths_cleared.length} cleared`);
+    if (!comparable) {
+        lines.push(`repository: drift unknown. ${drift.note}`);
+    }
+    else {
+        const paths = drift.dirty_paths_added === null || drift.dirty_paths_cleared === null
+            ? "dirty-path drift unknown"
+            : `${drift.dirty_paths_added.length} dirty added, ${drift.dirty_paths_cleared.length} cleared`;
+        lines.push(`repository: branch ${repo.before.branch ?? "unknown"} -> ${repo.after.branch ?? "unknown"}; ` +
+            `HEAD ${short(repo.before.head)} -> ${short(repo.after.head)}; ${paths}`);
+    }
     if (proof.unknowns.length > 0) {
         lines.push(`unknowns: ${proof.unknowns.length}`);
         for (const unknown of proof.unknowns)
@@ -385,37 +424,93 @@ export function renderWorkflowProof(proof) {
 function buildRepoEvidence(beforeRaw, afterRaw) {
     const before = normalizeRepoSnapshot(beforeRaw);
     const after = normalizeRepoSnapshot(afterRaw);
+    const problem = repoComparisonProblem(before, after);
+    if (problem !== undefined) {
+        return {
+            source: "engine",
+            before,
+            after,
+            drift: {
+                branch_changed: null,
+                head_changed: null,
+                dirty_paths_added: null,
+                dirty_paths_cleared: null,
+                dirty_paths_retained: null,
+                incomplete: true,
+                note: `Repository drift could not be verified: ${problem}. Re-check before editing.`,
+            },
+        };
+    }
+    const pathsComparable = !before.dirty_paths_truncated && !after.dirty_paths_truncated;
+    const branchKnown = Boolean(before.branch && after.branch);
+    const headKnown = Boolean(before.head && after.head);
     const beforeDirty = new Set(before.dirty_paths);
     const afterDirty = new Set(after.dirty_paths);
     const retained = after.dirty_paths.filter((path) => beforeDirty.has(path));
-    const incomplete = Boolean(before.dirty_paths_truncated || after.dirty_paths_truncated || retained.length > 0);
+    const notes = [
+        ...(!pathsComparable
+            ? ["Dirty-path drift is unknown because a snapshot list was truncated."]
+            : []),
+        ...(!branchKnown ? ["Branch drift is unknown because a snapshot has no branch."] : []),
+        ...(!headKnown ? ["HEAD drift is unknown because a snapshot has no HEAD."] : []),
+        ...(pathsComparable && retained.length > 0
+            ? ["Snapshots cannot prove whether retained dirty paths changed during the run."]
+            : []),
+    ];
+    const incomplete = notes.length > 0;
     return {
         source: "engine",
         before,
         after,
         drift: {
-            branch_changed: before.branch !== after.branch,
-            head_changed: before.head !== after.head,
-            dirty_paths_added: after.dirty_paths.filter((path) => !beforeDirty.has(path)),
-            dirty_paths_cleared: before.dirty_paths.filter((path) => !afterDirty.has(path)),
-            dirty_paths_retained: retained,
+            branch_changed: branchKnown ? before.branch !== after.branch : null,
+            head_changed: headKnown ? before.head !== after.head : null,
+            dirty_paths_added: pathsComparable
+                ? after.dirty_paths.filter((path) => !beforeDirty.has(path))
+                : null,
+            dirty_paths_cleared: pathsComparable
+                ? before.dirty_paths.filter((path) => !afterDirty.has(path))
+                : null,
+            dirty_paths_retained: pathsComparable ? retained : null,
             incomplete,
-            note: incomplete
-                ? "Snapshots cannot prove whether retained dirty paths changed during the run, and truncated lists may omit paths."
-                : undefined,
+            note: incomplete ? notes.join(" ") : undefined,
         },
     };
 }
 function normalizeRepoSnapshot(snapshot) {
     return {
         cwd: snapshot.cwd,
+        observation: snapshot.observation ?? "unavailable",
+        observation_detail: snapshot.observation
+            ? clippedOptional(snapshot.observation_detail, 500)
+            : "No repository observation was recorded.",
         root: snapshot.root,
-        branch: snapshot.branch,
-        head: snapshot.head,
+        branch: snapshot.branch?.trim() || undefined,
+        head: snapshot.head?.trim() || undefined,
         dirty_paths: snapshot.dirty_paths,
         dirty_paths_truncated: snapshot.dirty_paths_truncated,
     };
 }
+function snapshotFailure(label, snapshot) {
+    return `${label} snapshot is ${snapshot.observation}${snapshot.observation_detail ? ` (${snapshot.observation_detail})` : ""}`;
+}
+function repoComparisonProblem(before, after) {
+    if (!observationsComparable(before, after)) {
+        return [
+            ...(before.observation !== "ok" ? [snapshotFailure("before", before)] : []),
+            ...(after.observation !== "ok" ? [snapshotFailure("after", after)] : []),
+        ].join("; ");
+    }
+    const unknownRoots = [
+        ...(!before.root || !isAbsolute(before.root) ? ["before"] : []),
+        ...(!after.root || !isAbsolute(after.root) ? ["after"] : []),
+    ];
+    if (unknownRoots.length > 0)
+        return `${unknownRoots.join(" and ")} snapshot repository root is unknown`;
+    if (before.root !== after.root)
+        return "snapshots name different repository roots";
+    return undefined;
+}
 function buildAdapterCoverage(agents, claims, attestations) {
     return [...new Set(agents.map((agent) => agent.adapter))].map((adapter) => {
         const adapterAgents = agents.filter((agent) => agent.adapter === adapter);

package/dist/core/workflow/recovery-audit.d.ts

@@ -0,0 +1,30 @@
+export interface WorkflowRecoveryAuthorization {
+    actor: string;
+    reason: string;
+}
+export interface WorkflowRecoveryIntent extends WorkflowRecoveryAuthorization {
+    schema_version: 1;
+    operation_id: string;
+    run_id: string;
+    action: "reclaim_unknown_liveness" | "unlock_resume";
+    target_sha256: string;
+    target: Record<string, unknown>;
+    recorded_at: string;
+    pid: number;
+    host: string;
+    outcome: "unknown";
+}
+export interface WorkflowRecoveryRecord {
+    intent: WorkflowRecoveryIntent;
+    outcome: "unknown" | "completed";
+}
+export declare function validateWorkflowRecoveryAuthorization(authorization: WorkflowRecoveryAuthorization): void;
+/** Canonical recovery ledger: immutable intent is durable before effects.
+ * Completion cites that exact intent; absence always means unknown. */
+export declare function beginWorkflowRecovery(coordRoot: string, input: Omit<WorkflowRecoveryIntent, "schema_version" | "operation_id" | "recorded_at" | "pid" | "host" | "outcome">): {
+    intent: WorkflowRecoveryIntent;
+    assertCurrent(): void;
+    complete(): void;
+};
+export declare function readWorkflowRecoveryLedger(coordRoot: string, runId: string): WorkflowRecoveryRecord[];
+//# sourceMappingURL=recovery-audit.d.ts.map

package/dist/core/workflow/recovery-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-audit.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/recovery-audit.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAuB,SAAQ,6BAA6B;IAC3E,cAAc,EAAE,CAAC,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,0BAA0B,GAAG,eAAe,CAAC;IACrD,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,SAAS,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,OAAO,EAAE,SAAS,GAAG,WAAW,CAAC;CAClC;AAED,wBAAgB,qCAAqC,CACnD,aAAa,EAAE,6BAA6B,GAC3C,IAAI,CAmBN;AAED;uEACuE;AACvE,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,IAAI,CACT,sBAAsB,EACtB,gBAAgB,GAAG,cAAc,GAAG,aAAa,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAC/E,GACA;IAAE,MAAM,EAAE,sBAAsB,CAAC;IAAC,aAAa,IAAI,IAAI,CAAC;IAAC,QAAQ,IAAI,IAAI,CAAA;CAAE,CAmD7E;AAkBD,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,sBAAsB,EAAE,CAyC1B"}

package/dist/core/workflow/recovery-audit.js

@@ -0,0 +1,116 @@
+import { randomUUID } from "node:crypto";
+import { existsSync, lstatSync, mkdirSync, readdirSync } from "node:fs";
+import { hostname } from "node:os";
+import { dirname, join } from "node:path";
+import { stateDirMode } from "../storage/modes.js";
+import { assertWorkflowRunId } from "./approvals.js";
+import { fsyncParentDirectory, readJsonRecord, stableDigest, writeImmutableJson, } from "./durable-record.js";
+export function validateWorkflowRecoveryAuthorization(authorization) {
+    for (const [field, limit] of [
+        ["actor", 200],
+        ["reason", 2_000],
+    ]) {
+        const value = authorization[field];
+        if (typeof value !== "string" ||
+            !value.trim() ||
+            value.length > limit ||
+            Array.from(value).some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) {
+            throw new Error(`workflow recovery requires a nonempty ${field} of at most ${limit} characters without control characters`);
+        }
+    }
+}
+/** Canonical recovery ledger: immutable intent is durable before effects.
+ * Completion cites that exact intent; absence always means unknown. */
+export function beginWorkflowRecovery(coordRoot, input) {
+    assertWorkflowRunId(input.run_id);
+    validateWorkflowRecoveryAuthorization(input);
+    if (!/^[a-f0-9]{64}$/.test(input.target_sha256))
+        throw new Error("workflow recovery requires an exact preview digest");
+    const intent = {
+        ...input,
+        schema_version: 1,
+        operation_id: `recovery-${randomUUID()}`,
+        recorded_at: new Date().toISOString(),
+        pid: process.pid,
+        host: hostname(),
+        outcome: "unknown",
+    };
+    const directory = join(coordRoot, ".harnery", "workflows", input.run_id, "recovery", intent.operation_id);
+    // Sync each newly published directory name too. Syncing only the intent's
+    // immediate parent cannot make a newly created ancestor durable.
+    const runDirectory = join(coordRoot, ".harnery", "workflows", input.run_id);
+    ensureDurableDirectory(runDirectory);
+    const ledgerDirectory = join(runDirectory, "recovery");
+    ensureDurableDirectory(ledgerDirectory);
+    fsyncParentDirectory(ledgerDirectory);
+    mkdirSync(directory, { mode: stateDirMode() });
+    fsyncParentDirectory(directory);
+    const intentPath = join(directory, "intent.json");
+    writeImmutableJson(intentPath, intent);
+    const assertCurrent = () => {
+        if (stableDigest(readJsonRecord(intentPath, "recovery intent")) !== stableDigest(intent))
+            throw new Error("workflow recovery audit authority changed");
+    };
+    return {
+        intent,
+        assertCurrent,
+        complete: () => {
+            assertCurrent();
+            writeImmutableJson(join(directory, "completion.json"), {
+                schema_version: 1,
+                operation_id: intent.operation_id,
+                intent_sha256: stableDigest(intent),
+                outcome: "completed",
+                recorded_at: new Date().toISOString(),
+            });
+        },
+    };
+}
+function ensureDurableDirectory(path) {
+    if (existsSync(path)) {
+        if (!lstatSync(path).isDirectory())
+            throw new Error("workflow recovery ledger is not a directory");
+        return;
+    }
+    ensureDurableDirectory(dirname(path));
+    try {
+        mkdirSync(path, { mode: stateDirMode() });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST" || !lstatSync(path).isDirectory())
+            throw error;
+    }
+    fsyncParentDirectory(path);
+}
+export function readWorkflowRecoveryLedger(coordRoot, runId) {
+    assertWorkflowRunId(runId);
+    const directory = join(coordRoot, ".harnery", "workflows", runId, "recovery");
+    if (!existsSync(directory))
+        return [];
+    return readdirSync(directory)
+        .sort()
+        .map((entry) => {
+        if (!/^recovery-[a-f0-9-]{36}$/.test(entry))
+            throw new Error("invalid workflow recovery ledger entry");
+        const intent = readJsonRecord(join(directory, entry, "intent.json"), "recovery intent");
+        if (intent.schema_version !== 1 ||
+            intent.operation_id !== entry ||
+            intent.run_id !== runId ||
+            intent.outcome !== "unknown" ||
+            !["reclaim_unknown_liveness", "unlock_resume"].includes(intent.action) ||
+            !/^[a-f0-9]{64}$/.test(intent.target_sha256)) {
+            throw new Error("invalid workflow recovery intent authority");
+        }
+        validateWorkflowRecoveryAuthorization(intent);
+        const completionPath = join(directory, entry, "completion.json");
+        if (!existsSync(completionPath))
+            return { intent, outcome: "unknown" };
+        const completion = readJsonRecord(completionPath, "recovery completion");
+        if (completion.schema_version !== 1 ||
+            completion.operation_id !== entry ||
+            completion.intent_sha256 !== stableDigest(intent) ||
+            completion.outcome !== "completed")
+            throw new Error("invalid workflow recovery completion authority");
+        return { intent, outcome: "completed" };
+    });
+}

package/dist/core/workflow/run-state.d.ts

@@ -1,5 +1,6 @@
 import type { RepoSnapshot } from "../context/index.js";
 import { type NormalizedPolicy, type PolicyIsolation, type PolicyNetworkAccess } from "../policy/index.js";
+import { type WorkflowRecoveryAuthorization } from "./recovery-audit.js";
 import type { WorkflowAttemptContext, WorkflowDiagnosticAdmissionConfig, WorkflowSpecialistProfile, WorkflowWorkContext } from "./types.js";
 import type { WorkspaceBinding, WorkspaceCompatibilityExecutionEvidence } from "./workspaces/index.js";
 export declare const WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION: 2;
@@ -47,6 +48,24 @@ export declare function assertWorkflowRunResumable(coordRoot: string, runId: str
 };
 export declare function assertWorkflowScriptUnchanged(manifest: WorkflowRunManifest): void;
 export declare function workflowRunManifestPath(coordRoot: string, runId: string): string;
-/** Acquire an exclusive, crash-recoverable lease for one resume segment. */
+/** Acquire an exclusive lease shared by resume and reclaim. Existing locks
+ * always refuse; explicit audited recovery is a separate operation. */
 export declare function acquireWorkflowResumeLease(coordRoot: string, runId: string): () => void;
+export interface WorkflowResumeRecoveryOptions extends Partial<WorkflowRecoveryAuthorization> {
+    yes?: boolean;
+    lockSha256?: string;
+}
+export interface WorkflowResumeRecoveryResult {
+    action: "preview" | "unlocked";
+    run_id: string;
+    lock_sha256: string | null;
+    owner_state: "dead" | "live" | "unknown" | "absent";
+    owner: {
+        pid: number;
+        host: string;
+        created_at: string;
+    } | null;
+    recovery_id?: string;
+}
+export declare function recoverWorkflowResumeLease(coordRoot: string, runId: string, options: WorkflowResumeRecoveryOptions): WorkflowResumeRecoveryResult;
 //# sourceMappingURL=run-state.d.ts.map

package/dist/core/workflow/run-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-state.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/run-state.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAEzB,MAAM,oBAAoB,CAAC;AAM5B,OAAO,KAAK,EACV,sBAAsB,EACtB,iCAAiC,EACjC,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,EAEV,gBAAgB,EAChB,uCAAuC,EACxC,MAAM,uBAAuB,CAAC;AAO/B,eAAO,MAAM,oCAAoC,EAAG,CAAU,CAAC;AAK/D,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,iBAAiB,EAAE,YAAY,CAAC;IAChC,SAAS,EAAE;QACT,GAAG,EAAE,MAAM,CAAC;QACZ,eAAe,EAAE,MAAM,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,oBAAoB,CAAC,EAAE,iCAAiC,CAAC;QACzD,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;QAC/B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,SAAS,EAAE,eAAe,CAAC;QAC3B,cAAc,EAAE,mBAAmB,CAAC;QACpC,MAAM,CAAC,EAAE,gBAAgB,CAAC;QAC1B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;QACxD,iBAAiB,CAAC,EAAE,gBAAgB,CAAC;QACrC,kBAAkB,CAAC,EAAE,uCAAuC,CAAC;KAC9D,CAAC;CACH;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,6BAA6B,GAAG,MAAM,CAgBrF;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAyC7F;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CA4BvD;AAED,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CASjF;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGhF;AAED,4EAA4E;AAC5E,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,IAAI,CA0CvF"}
+{"version":3,"file":"run-state.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/run-state.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAEzB,MAAM,oBAAoB,CAAC;AAU5B,OAAO,EAAyB,KAAK,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAEhG,OAAO,KAAK,EACV,sBAAsB,EACtB,iCAAiC,EACjC,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,EAEV,gBAAgB,EAChB,uCAAuC,EACxC,MAAM,uBAAuB,CAAC;AAQ/B,eAAO,MAAM,oCAAoC,EAAG,CAAU,CAAC;AAI/D,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,iBAAiB,EAAE,YAAY,CAAC;IAChC,SAAS,EAAE;QACT,GAAG,EAAE,MAAM,CAAC;QACZ,eAAe,EAAE,MAAM,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,oBAAoB,CAAC,EAAE,iCAAiC,CAAC;QACzD,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;QAC/B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,SAAS,EAAE,eAAe,CAAC;QAC3B,cAAc,EAAE,mBAAmB,CAAC;QACpC,MAAM,CAAC,EAAE,gBAAgB,CAAC;QAC1B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;QACxD,iBAAiB,CAAC,EAAE,gBAAgB,CAAC;QACrC,kBAAkB,CAAC,EAAE,uCAAuC,CAAC;KAC9D,CAAC;CACH;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,6BAA6B,GAAG,MAAM,CAgBrF;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAgD7F;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CA4BvD;AAED,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CASjF;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGhF;AAED;uEACuE;AACvE,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,IAAI,CA6DvF;AAED,MAAM,WAAW,6BAA8B,SAAQ,OAAO,CAAC,6BAA6B,CAAC;IAC3F,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;IACpD,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,6BAA6B,GACrC,4BAA4B,CAkE9B"}