harnery 0.44.0 → 0.45.1

package/dist/core/workflow/engine.js

@@ -37,8 +37,7 @@ import { freezeWorkflowAttemptContext } from "./attempt-context.js";
 import { probeBilling } from "./billing.js";
 import { stableDigest } from "./durable-record.js";
 import { evidencePreflightError } from "./evidence-preflight.js";
-import { canRetryFailedSpawn, observeSpawnFailure, resolveFailureEvidence, } from "./failure-evidence.js";
-import { endWorkflowChildSessionV3, recordWorkflowChildTerminalFailureV3, startWorkflowChildSessionV3, } from "./live-session-v3.js";
+import { endWorkflowChildSessionV3, startWorkflowChildSessionV3 } from "./live-session-v3.js";
 import { buildWorkflowProof, createEvidenceRecord, digestResult, normalizeWorkflowMeta, writeWorkflowProof, } from "./proof.js";
 import { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
 import { assertProjectionWithinWorkspace, resolveGitGrantRoots } from "./sandbox-projection.js";
@@ -865,40 +864,23 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
             },
         });
         agentProof.access = access;
-        let childGenerationId;
         let recordAgentEnd;
         const finalizeChild = () => {
             try {
-                if (childGenerationId)
-                    endWorkflowChildSessionV3({
-                        coordRoot: opts.coordRoot,
-                        instanceId: childInstanceId(runId, id),
-                        runId,
-                        agentId: id,
-                        adapter,
-                        cleanExit: agentProof.status === "succeeded",
-                        expectedGenerationId: childGenerationId,
-                    });
-                // Result publication is the resume-cache boundary, after canonical custody.
+                // Record the canonical terminal first. agent.end is the resume-cache
+                // boundary, so a child whose end was not recorded never reports success.
+                endWorkflowChildSessionV3({
+                    coordRoot: opts.coordRoot,
+                    instanceId: childInstanceId(runId, id),
+                    runId,
+                    agentId: id,
+                    adapter,
+                    cleanExit: agentProof.status === "succeeded",
+                });
                 recordAgentEnd?.();
             }
             catch (error) {
-                let reason = `V3 terminal recording failed: ${error.message}`;
-                try {
-                    if (childGenerationId)
-                        recordWorkflowChildTerminalFailureV3({
-                            coordRoot: opts.coordRoot,
-                            instanceId: childInstanceId(runId, id),
-                            runId,
-                            agentId: id,
-                            adapter,
-                            expectedGenerationId: childGenerationId,
-                            reason,
-                        });
-                }
-                catch (visibilityError) {
-                    reason += `; blocked lifecycle recording failed: ${visibilityError.message}`;
-                }
+                const reason = `V3 terminal recording failed: ${error.message}`;
                 const failure = new Error(agentProof.error ? `${agentProof.error}; ${reason}` : reason, {
                     cause: error,
                 });
@@ -930,7 +912,7 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
             // Headless children do not reliably fire adapter hooks. The engine owns
             // their canonical V3 start so every dispatched child has an auditable
             // generation before it begins work.
-            const child = startWorkflowChildSessionV3({
+            startWorkflowChildSessionV3({
                 coordRoot: opts.coordRoot,
                 instanceId: childInstanceId(runId, id),
                 runId,
@@ -939,13 +921,9 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 label,
                 model: agentOpts.model,
             });
-            if (!child.v3_generation_id)
-                throw new Error("workflow_child_v3_generation_missing");
-            childGenerationId = child.v3_generation_id;
             let attemptPrompt = dispatchPrompt;
             let last = null;
             let agentCostUsd = 0;
-            let informativeAttempt;
             for (let attempt = 1; attempt <= maxAttempts; attempt++) {
                 last = await spawner({
                     prompt: attemptPrompt,
@@ -967,29 +945,15 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 agentCostUsd += last.costUsd ?? 0;
                 costUsd += last.costUsd ?? 0;
                 if (!last.ok) {
-                    const observed = last.failureEvidence === undefined
-                        ? observeSpawnFailure({}, last.text, "final_message")
-                        : resolveFailureEvidence(last.failureEvidence);
-                    agentProof.failure_evidence = informativeAttempt
-                        ? {
-                            ...observed,
-                            effect: { state: "unknown" },
-                            partial_output: informativeAttempt.partial_output,
-                        }
-                        : observed;
-                    transcript("agent.attempt_failed", {
-                        id,
-                        attempt,
-                        error: last.error,
-                        failure_evidence: observed,
-                        result_digest: digestResult(last.text, "text"),
-                        text: last.text,
-                    });
-                    if (!canRetryFailedSpawn({ ...last, failureEvidence: agentProof.failure_evidence }))
+                    transcript("agent.attempt_failed", { id, attempt, error: last.error });
+                    // ADR 0046: an environment failure (the binary was absent) cannot be
+                    // helped by retrying an unchanged environment, so stop the in-agent
+                    // retry too — not just the outer attempt/replan budget. An upstream
+                    // refusal keeps retrying here: the vendor may recover mid-loop.
+                    if (last.class === "environment")
                         break;
-                    continue;
+                    continue; // spawn-level failure: retry with the original prompt
                 }
-                informativeAttempt = observeSpawnFailure({}, last.text, "final_message");
                 if (!agentOpts.schema) {
                     agentProof.status = "succeeded";
                     agentProof.cost_usd =
@@ -1030,14 +994,7 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                     }, "json", parsed.value);
                     return parsed.value;
                 }
-                agentProof.failure_evidence = informativeAttempt;
-                transcript("agent.schema_retry", {
-                    id,
-                    attempt,
-                    problems,
-                    rejected_text: last.text,
-                    result_digest: digestResult(last.text, "text"),
-                });
+                transcript("agent.schema_retry", { id, attempt, problems });
                 // Keep the original cache identity while making the actual output
                 // contract explicit. A full bounded copy of the rejected value lets the
                 // child repair omissions instead of reconstructing an unseen object.
@@ -1076,7 +1033,6 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 finalizeChild();
             }
             finally {
-                // A slot is disposable; unresolved custody remains visible and failed.
                 release();
             }
         }

package/dist/core/workflow/index.d.ts

@@ -4,8 +4,10 @@ export { assertWorkflowRunId, createWorkflowApproval, listWorkflowApprovals, rea
 export { freezeWorkflowAttemptContext, isCanonicalWorkflowAttemptContext, normalizeWorkflowAttemptContext, } from "./attempt-context.js";
 export { runWorkflow, WorkflowParkedError, WorkflowRunError } from "./engine.js";
 export { buildWorkflowProof, createEvidenceRecord, deriveRunFailureClass, digestResult, normalizeWorkflowMeta, readWorkflowProof, renderWorkflowProof, rollupAcceptance, writeWorkflowProof, } from "./proof.js";
-export type { WorkflowRunManifest } from "./run-state.js";
-export { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, readWorkflowRunManifest, WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION, workflowRunManifestPath, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
+export type { WorkflowRecoveryAuthorization, WorkflowRecoveryIntent, WorkflowRecoveryRecord, } from "./recovery-audit.js";
+export { beginWorkflowRecovery, readWorkflowRecoveryLedger } from "./recovery-audit.js";
+export type { WorkflowResumeRecoveryOptions, WorkflowResumeRecoveryResult, WorkflowRunManifest, } from "./run-state.js";
+export { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, readWorkflowRunManifest, recoverWorkflowResumeLease, WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION, workflowRunManifestPath, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
 export { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
 export type { AcceptanceCriterion, AcceptanceResult, AcceptanceStatus, AcceptanceSummary, AdapterEvidenceCapability, AdapterEvidenceCoverage, AdapterName, AgentOpts, EngineOpts, EvidenceKind, EvidenceSource, EvidenceStatus, ResultDigest, RunReport, Spawner, SpawnFailureClass, SpawnRequest, SpawnResult, StageSchema, WorkflowAgentProof, WorkflowApprovalMode, WorkflowAttemptContext, WorkflowAttemptFailureCause, WorkflowAttemptPriorContext, WorkflowAttemptUnresolvedCriterion, WorkflowContext, WorkflowDiagnosticAdmissionConfig, WorkflowDiagnosticAdmissionObservation, WorkflowDiagnosticAdmissionProof, WorkflowEvidenceInput, WorkflowEvidenceRecord, WorkflowMeta, WorkflowModule, WorkflowPolicyProof, WorkflowProof, WorkflowProofUnknown, WorkflowRepoEvidence, WorkflowRepoSnapshot, WorkflowRunStatus, WorkflowSpecialistProfile, WorkflowWorkContext, } from "./types.js";
 export { WORKFLOW_ATTEMPT_CONTEXT_SCHEMA_VERSION, WORKFLOW_DIAGNOSTIC_ADMISSION_SCHEMA_VERSION, WORKFLOW_PROOF_SCHEMA_VERSION, WORKFLOW_WORK_CONTEXT_SCHEMA_VERSION, } from "./types.js";

package/dist/core/workflow/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4CAA4C,EAC5C,KAAK,uCAAuC,EAC5C,kCAAkC,EAClC,KAAK,kCAAkC,GACxC,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,2BAA2B,EAC3B,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,gCAAgC,EAChC,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,uBAAuB,EACvB,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,EACX,SAAS,EACT,UAAU,EACV,YAAY,EACZ,cAAc,EACd,cAAc,EACd,YAAY,EACZ,SAAS,EACT,OAAO,EACP,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,kCAAkC,EAClC,eAAe,EACf,iCAAiC,EACjC,sCAAsC,EACtC,gCAAgC,EAChC,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uCAAuC,EACvC,4CAA4C,EAC5C,6BAA6B,EAC7B,oCAAoC,GACrC,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,kCAAkC,EAClC,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC7B,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,EAChB,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uCAAuC,EACvC,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,EAClB,4BAA4B,EAC5B,iCAAiC,EACjC,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,gBAAgB,EAChB,kCAAkC,EAClC,eAAe,EACf,gBAAgB,EAChB,8BAA8B,EAC9B,wBAAwB,EACxB,6BAA6B,EAC7B,wBAAwB,EACxB,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4CAA4C,EAC5C,KAAK,uCAAuC,EAC5C,kCAAkC,EAClC,KAAK,kCAAkC,GACxC,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,2BAA2B,EAC3B,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,gCAAgC,EAChC,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,6BAA6B,EAC7B,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACxF,YAAY,EACV,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,uBAAuB,EACvB,0BAA0B,EAC1B,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,EACX,SAAS,EACT,UAAU,EACV,YAAY,EACZ,cAAc,EACd,cAAc,EACd,YAAY,EACZ,SAAS,EACT,OAAO,EACP,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,kCAAkC,EAClC,eAAe,EACf,iCAAiC,EACjC,sCAAsC,EACtC,gCAAgC,EAChC,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uCAAuC,EACvC,4CAA4C,EAC5C,6BAA6B,EAC7B,oCAAoC,GACrC,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,kCAAkC,EAClC,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC7B,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,EAChB,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uCAAuC,EACvC,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,EAClB,4BAA4B,EAC5B,iCAAiC,EACjC,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,gBAAgB,EAChB,kCAAkC,EAClC,eAAe,EACf,gBAAgB,EAChB,8BAA8B,EAC9B,wBAAwB,EACxB,6BAA6B,EAC7B,wBAAwB,EACxB,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,uBAAuB,CAAC"}

package/dist/core/workflow/index.js

@@ -3,7 +3,8 @@ export { assertWorkflowRunId, createWorkflowApproval, listWorkflowApprovals, rea
 export { freezeWorkflowAttemptContext, isCanonicalWorkflowAttemptContext, normalizeWorkflowAttemptContext, } from "./attempt-context.js";
 export { runWorkflow, WorkflowParkedError, WorkflowRunError } from "./engine.js";
 export { buildWorkflowProof, createEvidenceRecord, deriveRunFailureClass, digestResult, normalizeWorkflowMeta, readWorkflowProof, renderWorkflowProof, rollupAcceptance, writeWorkflowProof, } from "./proof.js";
-export { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, readWorkflowRunManifest, WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION, workflowRunManifestPath, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
+export { beginWorkflowRecovery, readWorkflowRecoveryLedger } from "./recovery-audit.js";
+export { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, readWorkflowRunManifest, recoverWorkflowResumeLease, WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION, workflowRunManifestPath, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
 export { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
 export { WORKFLOW_ATTEMPT_CONTEXT_SCHEMA_VERSION, WORKFLOW_DIAGNOSTIC_ADMISSION_SCHEMA_VERSION, WORKFLOW_PROOF_SCHEMA_VERSION, WORKFLOW_WORK_CONTEXT_SCHEMA_VERSION, } from "./types.js";
 export { applyIntegration, assertWorkspaceLifecycleTransition, cancelWorkspace, cleanupWorkspace, createLocalGitWorktreeProvider, deriveWorkspaceLifecycle, IntegrationPrepareParkedError, inspectWorkflowWorkspace, isWorkspaceLifecycleState, listWorkflowWorkspaceInspections, prepareIntegration, probeLocalGitWorktreeProvider, readWorkflowWorkspaceStatus, renderWorkflowWorkspaceStatus, validateProviderEventChain, WORKSPACE_BINDING_SCHEMA_VERSION, WORKSPACE_RECEIPT_SCHEMA_VERSION, } from "./workspaces/index.js";

package/dist/core/workflow/live-session-v3.d.ts

@@ -14,12 +14,6 @@ export declare function startWorkflowChildSessionV3(input: WorkflowChildSessionV
 /** Record the authoritative terminal before removing the disposable coordination cache. */
 export declare function endWorkflowChildSessionV3(input: WorkflowChildSessionV3Input & {
     cleanExit: boolean;
-    expectedGenerationId: string;
-}): void;
-/** Persist unresolved terminal custody only for the generation this dispatch owns. */
-export declare function recordWorkflowChildTerminalFailureV3(input: WorkflowChildSessionV3Input & {
-    expectedGenerationId: string;
-    reason: string;
 }): void;
 export { stableScopeId } from "./scope-id.js";
 //# sourceMappingURL=live-session-v3.d.ts.map

package/dist/core/workflow/live-session-v3.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live-session-v3.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/live-session-v3.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,KAAK,SAAS,EAGf,MAAM,qCAAqC,CAAC;AAoB7C,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8FAA8F;AAC9F,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,2BAA2B,GAAG,SAAS,CAqDzF;AAED,2FAA2F;AAC3F,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,2BAA2B,GAAG;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,GACxF,IAAI,CAIN;AA0CD,sFAAsF;AACtF,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,2BAA2B,GAAG;IAAE,oBAAoB,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpF,IAAI,CAcN;AA8FD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"live-session-v3.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/live-session-v3.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,SAAS,EAEf,MAAM,qCAAqC,CAAC;AAY7C,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8FAA8F;AAC9F,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,2BAA2B,GAAG,SAAS,CAiDzF;AAED,2FAA2F;AAC3F,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,2BAA2B,GAAG;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE,GAC1D,IAAI,CAmBN;AAgBD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}

package/dist/core/workflow/live-session-v3.js

@@ -1,21 +1,13 @@
-import { randomUUID } from "node:crypto";
-import { existsSync, linkSync, readdirSync, readFileSync, renameSync, unlinkSync } from "node:fs";
-import { basename, dirname } from "node:path";
 import { adapterFromPlatform } from "../adapter.js";
-import { recordLiveLifecycleChangeV3, recordLiveTaskChangeV3, } from "../agents/live-authority-v3.js";
+import { recordLiveTaskChangeV3 } from "../agents/live-authority-v3.js";
 import { endSessionExplicitV3 } from "../agents/session-finalizer-v3.js";
-import { heartbeatPath } from "../agents/state/heartbeat-reader.js";
-import { readHeartbeat, setIdentityCache, } from "../agents/state/heartbeat-writer.js";
+import { clearCoordinationCache, setIdentityCache, } from "../agents/state/heartbeat-writer.js";
 import { readLiveCoordinationRow } from "../agents/state/live-coordination-view.js";
 import { ensureLiveCoordinationHeartbeat } from "../agents/state/live-coordination-writer.js";
 import { assignName } from "../agents/state/names.js";
 import { coordFreshnessSeconds } from "../config.js";
 import { ensureEventLedgerV3 } from "../events/v3/bootstrap.js";
-import { readCoordinationViewV3, requireAuthoritySafeCoordinationViewV3, } from "../events/v3/coordination-view.js";
-import { withGenerationCustodyV3 } from "../events/v3/generation-custody.js";
-import { liveInstanceIdV3, recordLiveHookSignalV3, resolveLiveEventLedgerRouteV3, } from "../events/v3/live-routing.js";
-import { readHookProducerStateV3 } from "../events/v3/producers/recorder.js";
-import { fsyncParentDirectory } from "./durable-record.js";
+import { recordLiveHookSignalV3, resolveLiveEventLedgerRouteV3, } from "../events/v3/live-routing.js";
 import { stableScopeId } from "./scope-id.js";
 /** Start a headless workflow child through the same canonical V3 producer as native hooks. */
 export function startWorkflowChildSessionV3(input) {
@@ -62,38 +54,13 @@ export function startWorkflowChildSessionV3(input) {
     const projected = readLiveCoordinationRow(input.coordRoot, input.instanceId);
     if (!projected)
         throw new Error("workflow_child_v3_projection_missing");
-    const own = readHookProducerStateV3(input.coordRoot, adapter, sessionId);
-    if (!own || own.terminal || own.generation_id !== projected.v3_generation_id) {
-        throw new Error("workflow_child_v3_start_generation_changed");
-    }
     return projected;
 }
 /** Record the authoritative terminal before removing the disposable coordination cache. */
 export function endWorkflowChildSessionV3(input) {
-    withGenerationCustodyV3(input.coordRoot, [liveInstanceIdV3(input.instanceId)], () => endExpectedChild(input));
-}
-function endExpectedChild(input) {
     requireV3Route(input.coordRoot);
-    const view = requireAuthoritySafeCoordinationViewV3(readCoordinationViewV3(input.coordRoot));
-    const instanceId = liveInstanceIdV3(input.instanceId);
-    const current = view.instances[instanceId];
-    const terminal = view.terminal_generations[input.expectedGenerationId];
-    if (terminal?.instance_id === instanceId)
-        recoverHeldCaches(input);
-    if (current && current.generation_id !== input.expectedGenerationId) {
-        throw new Error("workflow_child_v3_generation_changed");
-    }
-    if (!current) {
-        if (!terminal || terminal.instance_id !== instanceId)
-            throw new Error("workflow_child_v3_generation_missing");
-        if (terminal.terminal?.outcome !== (input.cleanExit ? "succeeded" : "failed")) {
-            throw new Error("workflow_child_v3_terminal_outcome_changed");
-        }
-        clearExpectedCache(input);
-        return;
-    }
     const row = readLiveCoordinationRow(input.coordRoot, input.instanceId);
-    if (!row?.v3_instance_id || row.v3_generation_id !== input.expectedGenerationId) {
+    if (!row?.v3_instance_id || !row.v3_generation_id) {
         throw new Error("workflow_child_v3_generation_missing");
     }
     const result = endSessionExplicitV3({
@@ -106,95 +73,7 @@ function endExpectedChild(input) {
     if (result.state !== "recorded" && result.state !== "already_ended") {
         throw new Error(`workflow_child_v3_end_failed:${result.state}${"reason" in result ? `:${result.reason}` : ""}`);
     }
-    clearExpectedCache(input);
-}
-/** Persist unresolved terminal custody only for the generation this dispatch owns. */
-export function recordWorkflowChildTerminalFailureV3(input) {
-    withGenerationCustodyV3(input.coordRoot, [liveInstanceIdV3(input.instanceId)], () => {
-        const row = readLiveCoordinationRow(input.coordRoot, input.instanceId);
-        if (!row || row.v3_generation_id !== input.expectedGenerationId)
-            return;
-        recordLiveLifecycleChangeV3({
-            coordRoot: input.coordRoot,
-            owner: input.instanceId,
-            nativeSessionId: input.sessionId ?? input.instanceId,
-            adapter: workflowAdapter(input.adapter),
-            expectedGenerationId: input.expectedGenerationId,
-            state: "blocked",
-            reason: input.reason,
-        });
-    });
-}
-function heldPrefix(input) {
-    if (!/^gen_[a-zA-Z0-9._-]{1,128}$/.test(input.expectedGenerationId))
-        throw new Error("workflow_child_v3_generation_invalid");
-    return `${basename(heartbeatPath(input.coordRoot, input.instanceId))}.terminal-${input.expectedGenerationId}-`;
-}
-function recoverHeldCaches(input) {
-    const path = heartbeatPath(input.coordRoot, input.instanceId);
-    if (!existsSync(dirname(path)))
-        return;
-    const prefix = heldPrefix(input);
-    for (const name of readdirSync(dirname(path)).filter((value) => value.startsWith(prefix))) {
-        finishHeldCache(`${dirname(path)}/${name}`, path, input.expectedGenerationId);
-    }
-}
-function clearExpectedCache(input) {
-    recoverHeldCaches(input);
-    if (readHeartbeat(input.coordRoot, input.instanceId)?.v3_generation_id !==
-        input.expectedGenerationId)
-        return;
-    const path = heartbeatPath(input.coordRoot, input.instanceId);
-    const held = `${dirname(path)}/${heldPrefix(input)}${randomUUID()}`;
-    try {
-        // A unique held name pins the actual bytes atomically. Checking before
-        // unlink alone could consume a replacement published at this boundary.
-        renameSync(path, held);
-        fsyncParentDirectory(path);
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return;
-        throw error;
-    }
-    finishHeldCache(held, path, input.expectedGenerationId);
-}
-function finishHeldCache(held, path, expectedGenerationId) {
-    let removed = false;
-    let cleanupFailed = false;
-    let cleanupError;
-    try {
-        const cache = JSON.parse(readFileSync(held, "utf8"));
-        if (cache.v3_generation_id === expectedGenerationId) {
-            unlinkSync(held);
-            fsyncParentDirectory(held);
-            removed = true;
-        }
-    }
-    catch (error) {
-        cleanupFailed = true;
-        cleanupError = error;
-    }
-    if (!removed) {
-        try {
-            // Never overwrite a later publication. Keep the held evidence when
-            // another cache already owns the live name.
-            linkSync(held, path);
-            fsyncParentDirectory(path);
-            unlinkSync(held);
-            fsyncParentDirectory(held);
-        }
-        catch (error) {
-            if (error.code !== "EEXIST") {
-                if (cleanupFailed) {
-                    throw new AggregateError([cleanupError, error], `workflow_child_v3_cache_cleanup_and_restore_failed: ${String(cleanupError)}; restoration: ${String(error)}`);
-                }
-                throw error;
-            }
-        }
-    }
-    if (cleanupFailed)
-        throw cleanupError;
+    clearCoordinationCache(input.coordRoot, input.instanceId);
 }
 function requireV3Route(coordRoot) {
     let route = resolveLiveEventLedgerRouteV3(coordRoot);

package/dist/core/workflow/proof.d.ts

@@ -72,12 +72,12 @@ export declare function digestResult(value: unknown, kind?: "text" | "json"): Re
  *    attempt was informative about the work — charge it. This also keeps a
  *    resumed run whose earlier segment did real work from being written off by
  *    a later environment failure.
- * 3. Every participant must have failed with positive no-effect evidence,
- *    observed absent output and no refusal. A class alone is insufficient.
- *    Among those eligible failures, environment is the hard stop.
+ * 3. Otherwise, among the failed agents, environment wins over upstream: a
+ *    missing binary means nothing ran at all, and it is the operator-chosen
+ *    hard stop.
  * 4. Anything else is undefined ⇒ a charged work failure, exactly as today.
  */
-export declare function deriveRunFailureClass(status: "succeeded" | "failed", agents: readonly Pick<WorkflowAgentProof, "status" | "class" | "failure_evidence">[]): SpawnFailureClass | undefined;
+export declare function deriveRunFailureClass(status: "succeeded" | "failed", agents: readonly Pick<WorkflowAgentProof, "status" | "class">[]): SpawnFailureClass | undefined;
 export declare function buildWorkflowProof(input: BuildWorkflowProofInput): WorkflowProof;
 export declare function writeWorkflowProof(path: string, proof: WorkflowProof): void;
 export declare function readWorkflowProof(coordRoot: string, runId: string): WorkflowProof;

package/dist/core/workflow/proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/proof.ts"],"names":[],"mappings":"AAGA,OAAO,EAA0B,KAAK,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEtF,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAM5B,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EAEzB,YAAY,EAEZ,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,gCAAgC,EAChC,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EAEZ,aAAa,EAIb,iCAAiC,EACjC,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAOpB,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EAChB,uCAAuC,EAExC,MAAM,uBAAuB,CAAC;AAoB/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC5C,cAAc,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAClD,IAAI,EAAE,sBAAsB,CAAC;IAC7B,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,mBAAmB,CAAC,EAAE,gCAAgC,CAAC;IACvD,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC,CAAC;IAClF,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,iCAAiC,CAAC;IACtD;+DAC2D;IAC3D,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,0BAA0B,GAAG,SAAS,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACnC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;QACrC,SAAS,EAAE,eAAe,CAAC;QAC3B,aAAa,EAAE,mBAAmB,CAAC;KACpC,CAAC;IACF;mFAC+E;IAC/E,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,iBAAiB,CAAC,EAAE,uCAAuC,CAAC;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GACnB,sBAAsB,CAqCxB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,sBAAsB,CA8BzB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,QAAQ,EAAE,sBAAsB,EAAE,GACjC;IAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,CAuB9D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,CAQjF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,WAAW,GAAG,QAAQ,EAC9B,MAAM,EAAE,SAAS,IAAI,CAAC,kBAAkB,EAAE,QAAQ,GAAG,OAAO,GAAG,kBAAkB,CAAC,EAAE,GACnF,iBAAiB,GAAG,SAAS,CAiB/B;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,aAAa,CA8DhF;AAgCD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAO3E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CA4EjF;AA+DD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CA+DhE"}
+{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/proof.ts"],"names":[],"mappings":"AAGA,OAAO,EAA0B,KAAK,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEtF,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EAEzB,YAAY,EAEZ,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,gCAAgC,EAChC,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EAEZ,aAAa,EAIb,iCAAiC,EACjC,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAOpB,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EAChB,uCAAuC,EAExC,MAAM,uBAAuB,CAAC;AAoB/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC5C,cAAc,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAClD,IAAI,EAAE,sBAAsB,CAAC;IAC7B,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,mBAAmB,CAAC,EAAE,gCAAgC,CAAC;IACvD,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC,CAAC;IAClF,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,iCAAiC,CAAC;IACtD;+DAC2D;IAC3D,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,0BAA0B,GAAG,SAAS,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACnC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;QACrC,SAAS,EAAE,eAAe,CAAC;QAC3B,aAAa,EAAE,mBAAmB,CAAC;KACpC,CAAC;IACF;mFAC+E;IAC/E,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,iBAAiB,CAAC,EAAE,uCAAuC,CAAC;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GACnB,sBAAsB,CAqCxB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,sBAAsB,CA8BzB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,QAAQ,EAAE,sBAAsB,EAAE,GACjC;IAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,CAuB9D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,CAQjF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,WAAW,GAAG,QAAQ,EAC9B,MAAM,EAAE,SAAS,IAAI,CAAC,kBAAkB,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,GAC9D,iBAAiB,GAAG,SAAS,CAS/B;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,aAAa,CA8DhF;AAgCD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAO3E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAqEjF;AA+DD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CA+DhE"}

package/dist/core/workflow/proof.js

@@ -6,7 +6,6 @@ import { DIAGNOSTIC_ADVICE_SCHEMA_VERSION } from "../diagnostics/contract.js";
 import { policyDigest } from "../policy/index.js";
 import { isCanonicalWorkflowAttemptContext } from "./attempt-context.js";
 import { stableDigest, writeImmutableJson } from "./durable-record.js";
-import { failureEvidenceAllowsUncharged, isSpawnFailureEvidence } from "./failure-evidence.js";
 import { readWorkflowRunManifest } from "./run-state.js";
 import { EVIDENCE_KINDS, WORKFLOW_DIAGNOSTIC_ADMISSION_SCHEMA_VERSION, WORKFLOW_PROOF_SCHEMA_VERSION, } from "./types.js";
 import { isCanonicalWorkflowWorkContext } from "./work-context.js";
@@ -127,18 +126,15 @@ export function digestResult(value, kind) {
  *    attempt was informative about the work — charge it. This also keeps a
  *    resumed run whose earlier segment did real work from being written off by
  *    a later environment failure.
- * 3. Every participant must have failed with positive no-effect evidence,
- *    observed absent output and no refusal. A class alone is insufficient.
- *    Among those eligible failures, environment is the hard stop.
+ * 3. Otherwise, among the failed agents, environment wins over upstream: a
+ *    missing binary means nothing ran at all, and it is the operator-chosen
+ *    hard stop.
  * 4. Anything else is undefined ⇒ a charged work failure, exactly as today.
  */
 export function deriveRunFailureClass(status, agents) {
     if (status !== "failed")
         return undefined;
-    if (agents.length === 0 ||
-        agents.some((agent) => agent.status !== "failed" ||
-            (agent.class !== "environment" && agent.class !== "upstream") ||
-            !failureEvidenceAllowsUncharged(agent.failure_evidence))) {
+    if (agents.some((agent) => agent.status === "succeeded" || agent.status === "cached")) {
         return undefined;
     }
     const failed = agents.filter((agent) => agent.status === "failed");
@@ -267,10 +263,6 @@ export function readWorkflowProof(coordRoot, runId) {
             proof.run.class !== "environment" &&
             proof.run.class !== "upstream" &&
             proof.run.class !== "decision") ||
-        !Array.isArray(proof.agents) ||
-        proof.agents.some((agent) => !agent ||
-            typeof agent !== "object" ||
-            (agent.failure_evidence !== undefined && !isSpawnFailureEvidence(agent.failure_evidence))) ||
         (proof.run.work_context !== undefined &&
             (!proof.run.work_item_id ||
                 proof.run.work_context.id !== proof.run.work_item_id ||

package/dist/core/workflow/recovery-audit.d.ts

@@ -0,0 +1,30 @@
+export interface WorkflowRecoveryAuthorization {
+    actor: string;
+    reason: string;
+}
+export interface WorkflowRecoveryIntent extends WorkflowRecoveryAuthorization {
+    schema_version: 1;
+    operation_id: string;
+    run_id: string;
+    action: "reclaim_unknown_liveness" | "unlock_resume";
+    target_sha256: string;
+    target: Record<string, unknown>;
+    recorded_at: string;
+    pid: number;
+    host: string;
+    outcome: "unknown";
+}
+export interface WorkflowRecoveryRecord {
+    intent: WorkflowRecoveryIntent;
+    outcome: "unknown" | "completed";
+}
+export declare function validateWorkflowRecoveryAuthorization(authorization: WorkflowRecoveryAuthorization): void;
+/** Canonical recovery ledger: immutable intent is durable before effects.
+ * Completion cites that exact intent; absence always means unknown. */
+export declare function beginWorkflowRecovery(coordRoot: string, input: Omit<WorkflowRecoveryIntent, "schema_version" | "operation_id" | "recorded_at" | "pid" | "host" | "outcome">): {
+    intent: WorkflowRecoveryIntent;
+    assertCurrent(): void;
+    complete(): void;
+};
+export declare function readWorkflowRecoveryLedger(coordRoot: string, runId: string): WorkflowRecoveryRecord[];
+//# sourceMappingURL=recovery-audit.d.ts.map

package/dist/core/workflow/recovery-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-audit.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/recovery-audit.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAuB,SAAQ,6BAA6B;IAC3E,cAAc,EAAE,CAAC,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,0BAA0B,GAAG,eAAe,CAAC;IACrD,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,SAAS,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,OAAO,EAAE,SAAS,GAAG,WAAW,CAAC;CAClC;AAED,wBAAgB,qCAAqC,CACnD,aAAa,EAAE,6BAA6B,GAC3C,IAAI,CAmBN;AAED;uEACuE;AACvE,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,IAAI,CACT,sBAAsB,EACtB,gBAAgB,GAAG,cAAc,GAAG,aAAa,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAC/E,GACA;IAAE,MAAM,EAAE,sBAAsB,CAAC;IAAC,aAAa,IAAI,IAAI,CAAC;IAAC,QAAQ,IAAI,IAAI,CAAA;CAAE,CAmD7E;AAkBD,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,sBAAsB,EAAE,CAyC1B"}

package/dist/core/workflow/recovery-audit.js

@@ -0,0 +1,116 @@
+import { randomUUID } from "node:crypto";
+import { existsSync, lstatSync, mkdirSync, readdirSync } from "node:fs";
+import { hostname } from "node:os";
+import { dirname, join } from "node:path";
+import { stateDirMode } from "../storage/modes.js";
+import { assertWorkflowRunId } from "./approvals.js";
+import { fsyncParentDirectory, readJsonRecord, stableDigest, writeImmutableJson, } from "./durable-record.js";
+export function validateWorkflowRecoveryAuthorization(authorization) {
+    for (const [field, limit] of [
+        ["actor", 200],
+        ["reason", 2_000],
+    ]) {
+        const value = authorization[field];
+        if (typeof value !== "string" ||
+            !value.trim() ||
+            value.length > limit ||
+            Array.from(value).some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) {
+            throw new Error(`workflow recovery requires a nonempty ${field} of at most ${limit} characters without control characters`);
+        }
+    }
+}
+/** Canonical recovery ledger: immutable intent is durable before effects.
+ * Completion cites that exact intent; absence always means unknown. */
+export function beginWorkflowRecovery(coordRoot, input) {
+    assertWorkflowRunId(input.run_id);
+    validateWorkflowRecoveryAuthorization(input);
+    if (!/^[a-f0-9]{64}$/.test(input.target_sha256))
+        throw new Error("workflow recovery requires an exact preview digest");
+    const intent = {
+        ...input,
+        schema_version: 1,
+        operation_id: `recovery-${randomUUID()}`,
+        recorded_at: new Date().toISOString(),
+        pid: process.pid,
+        host: hostname(),
+        outcome: "unknown",
+    };
+    const directory = join(coordRoot, ".harnery", "workflows", input.run_id, "recovery", intent.operation_id);
+    // Sync each newly published directory name too. Syncing only the intent's
+    // immediate parent cannot make a newly created ancestor durable.
+    const runDirectory = join(coordRoot, ".harnery", "workflows", input.run_id);
+    ensureDurableDirectory(runDirectory);
+    const ledgerDirectory = join(runDirectory, "recovery");
+    ensureDurableDirectory(ledgerDirectory);
+    fsyncParentDirectory(ledgerDirectory);
+    mkdirSync(directory, { mode: stateDirMode() });
+    fsyncParentDirectory(directory);
+    const intentPath = join(directory, "intent.json");
+    writeImmutableJson(intentPath, intent);
+    const assertCurrent = () => {
+        if (stableDigest(readJsonRecord(intentPath, "recovery intent")) !== stableDigest(intent))
+            throw new Error("workflow recovery audit authority changed");
+    };
+    return {
+        intent,
+        assertCurrent,
+        complete: () => {
+            assertCurrent();
+            writeImmutableJson(join(directory, "completion.json"), {
+                schema_version: 1,
+                operation_id: intent.operation_id,
+                intent_sha256: stableDigest(intent),
+                outcome: "completed",
+                recorded_at: new Date().toISOString(),
+            });
+        },
+    };
+}
+function ensureDurableDirectory(path) {
+    if (existsSync(path)) {
+        if (!lstatSync(path).isDirectory())
+            throw new Error("workflow recovery ledger is not a directory");
+        return;
+    }
+    ensureDurableDirectory(dirname(path));
+    try {
+        mkdirSync(path, { mode: stateDirMode() });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST" || !lstatSync(path).isDirectory())
+            throw error;
+    }
+    fsyncParentDirectory(path);
+}
+export function readWorkflowRecoveryLedger(coordRoot, runId) {
+    assertWorkflowRunId(runId);
+    const directory = join(coordRoot, ".harnery", "workflows", runId, "recovery");
+    if (!existsSync(directory))
+        return [];
+    return readdirSync(directory)
+        .sort()
+        .map((entry) => {
+        if (!/^recovery-[a-f0-9-]{36}$/.test(entry))
+            throw new Error("invalid workflow recovery ledger entry");
+        const intent = readJsonRecord(join(directory, entry, "intent.json"), "recovery intent");
+        if (intent.schema_version !== 1 ||
+            intent.operation_id !== entry ||
+            intent.run_id !== runId ||
+            intent.outcome !== "unknown" ||
+            !["reclaim_unknown_liveness", "unlock_resume"].includes(intent.action) ||
+            !/^[a-f0-9]{64}$/.test(intent.target_sha256)) {
+            throw new Error("invalid workflow recovery intent authority");
+        }
+        validateWorkflowRecoveryAuthorization(intent);
+        const completionPath = join(directory, entry, "completion.json");
+        if (!existsSync(completionPath))
+            return { intent, outcome: "unknown" };
+        const completion = readJsonRecord(completionPath, "recovery completion");
+        if (completion.schema_version !== 1 ||
+            completion.operation_id !== entry ||
+            completion.intent_sha256 !== stableDigest(intent) ||
+            completion.outcome !== "completed")
+            throw new Error("invalid workflow recovery completion authority");
+        return { intent, outcome: "completed" };
+    });
+}

package/dist/core/workflow/run-state.d.ts

@@ -1,5 +1,6 @@
 import type { RepoSnapshot } from "../context/index.js";
 import { type NormalizedPolicy, type PolicyIsolation, type PolicyNetworkAccess } from "../policy/index.js";
+import { type WorkflowRecoveryAuthorization } from "./recovery-audit.js";
 import type { WorkflowAttemptContext, WorkflowDiagnosticAdmissionConfig, WorkflowSpecialistProfile, WorkflowWorkContext } from "./types.js";
 import type { WorkspaceBinding, WorkspaceCompatibilityExecutionEvidence } from "./workspaces/index.js";
 export declare const WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION: 2;
@@ -48,7 +49,23 @@ export declare function assertWorkflowRunResumable(coordRoot: string, runId: str
 export declare function assertWorkflowScriptUnchanged(manifest: WorkflowRunManifest): void;
 export declare function workflowRunManifestPath(coordRoot: string, runId: string): string;
 /** Acquire an exclusive lease shared by resume and reclaim. Existing locks
- * always refuse: a stale observation cannot authorize unlinking a new owner.
- * Crash recovery requires an audited ownership check outside this operation. */
+ * always refuse; explicit audited recovery is a separate operation. */
 export declare function acquireWorkflowResumeLease(coordRoot: string, runId: string): () => void;
+export interface WorkflowResumeRecoveryOptions extends Partial<WorkflowRecoveryAuthorization> {
+    yes?: boolean;
+    lockSha256?: string;
+}
+export interface WorkflowResumeRecoveryResult {
+    action: "preview" | "unlocked";
+    run_id: string;
+    lock_sha256: string | null;
+    owner_state: "dead" | "live" | "unknown" | "absent";
+    owner: {
+        pid: number;
+        host: string;
+        created_at: string;
+    } | null;
+    recovery_id?: string;
+}
+export declare function recoverWorkflowResumeLease(coordRoot: string, runId: string, options: WorkflowResumeRecoveryOptions): WorkflowResumeRecoveryResult;
 //# sourceMappingURL=run-state.d.ts.map