harnery 0.44.0 → 0.45.1

package/dist/core/workflow/workspaces/local-git.js

@@ -2,6 +2,7 @@ import { randomBytes } from "node:crypto";
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, writeFileSync, } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { stateDirMode, stateFileMode } from "../../storage/modes.js";
+import { beginWorkflowRecovery, validateWorkflowRecoveryAuthorization } from "../recovery-audit.js";
 import { acquireWorkflowResumeLease } from "../run-state.js";
 import { WorkspaceAttestationError } from "./attestation-error.js";
 import { cleanupWorkspace } from "./cleanup.js";
@@ -10,7 +11,7 @@ import { acquireNoClobberLease } from "./leases.js";
 import { claimOverlapsWorkspace, reserveWorkspaceReclaim, } from "./ownership.js";
 import { assertContainedExisting, assertPathIdentity, candidateUnderRoot, containsPath, createContainedDirectories, descriptorBackedPathsSupported, descriptorPath, filesystemIdentity, openContainedDirectory, sameFilesystemIdentity, validateConfiguredRoot, } from "./paths.js";
 import { prepareReclaim, WorkflowReclaimError, } from "./reclaim.js";
-import { readWorkflowLiveness } from "./recovery.js";
+import { hasActiveWorkflowEvidence, readWorkflowLiveness } from "./recovery.js";
 import { appendWorkspaceEvent, fileSha256, readWorkflowSupplement, readWorkspaceBinding, readWorkspaceClaim, readWorkspaceClaims, readWorkspaceEvents, stableDigest, workspaceClaimPath, workspaceLockPath, writeWorkspaceBinding, writeWorkspaceClaim, } from "./state.js";
 import { isWorkspaceAttestation } from "./validate.js";
 const PROVIDER_ID = "local-git-worktree";
@@ -597,6 +598,7 @@ function reclaimPreview(coordRoot, binding, mode) {
         run_id: binding.run_id,
         mode,
         liveness: readWorkflowLiveness(coordRoot, binding.run_id),
+        evidence_sha256: reclaimEvidenceDigest(coordRoot, binding),
         ownership: "unproven",
         dirty_paths: null,
         lease_holder: reclaimLeaseHolders(coordRoot, binding),
@@ -617,13 +619,36 @@ function reclaimPreview(coordRoot, binding, mode) {
     }
     return preview;
 }
-function assertReclaimLiveness(coordRoot, binding) {
+function reclaimEvidenceDigest(coordRoot, binding) {
+    const evidence = (name) => {
+        try {
+            return readFileSync(join(coordRoot, ".harnery", "workflows", binding.run_id, name), "utf8");
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return null;
+            throw error;
+        }
+    };
+    return stableDigest({
+        binding,
+        proof: evidence("proof.json"),
+        transcript: evidence("transcript.jsonl"),
+    });
+}
+function assertReclaimLiveness(coordRoot, binding, recovery) {
     const liveness = readWorkflowLiveness(coordRoot, binding.run_id);
+    if (liveness === "active" || (recovery && hasActiveWorkflowEvidence(coordRoot, binding.run_id))) {
+        throw new WorkflowReclaimError("workflow_reclaim_run_live", `run ${binding.run_id} has active evidence; its workspace was left untouched`);
+    }
+    if (recovery && reclaimEvidenceDigest(coordRoot, binding) !== recovery.evidenceSha256) {
+        throw new WorkflowReclaimError("workflow_reclaim_recovery_mismatch", "workflow reclaim requires the exact current preview evidence digest");
+    }
     if (liveness === "inactive")
         return;
-    throw new WorkflowReclaimError(liveness === "active" ? "workflow_reclaim_run_live" : "workflow_reclaim_liveness_unknown", liveness === "active"
-        ? `run ${binding.run_id} is active; its workspace was left untouched`
-        : `run ${binding.run_id} has missing, corrupt, or ambiguous liveness evidence; its workspace was left untouched`);
+    if (liveness === "unknown" && recovery)
+        return;
+    throw new WorkflowReclaimError("workflow_reclaim_liveness_unknown", `run ${binding.run_id} has missing, corrupt, or ambiguous liveness evidence; its workspace was left untouched`);
 }
 function assertReclaimOwnership(coordRoot, binding) {
     try {
@@ -666,10 +691,10 @@ function assertPeerWorkspaceAuthority(coordRoot, claim) {
         throw new WorkflowReclaimError("workflow_reclaim_ownership_unproven", error.message);
     }
 }
-function reclaimAuthorityGuard(coordRoot, binding, claim, reservation) {
+function reclaimAuthorityGuard(coordRoot, binding, claim, reservation, recovery) {
     try {
         reservation.assertCurrent();
-        assertReclaimLiveness(coordRoot, binding);
+        assertReclaimLiveness(coordRoot, binding, recovery);
         assertReclaimOwnership(coordRoot, binding);
         assertPeerWorkspaceAuthority(coordRoot, claim);
     }
@@ -685,9 +710,11 @@ async function reclaim(coordRoot, provider, binding, options) {
     }
     if (!options.yes)
         return reclaimPreview(coordRoot, binding, options.mode);
+    if (options.unknownLiveness)
+        validateWorkflowRecoveryAuthorization(options.unknownLiveness);
     // Liveness comes before terminal-proof cleanup helpers. A live run may not
     // have a proof yet, and a missing proof must never be discovered after reset.
-    assertReclaimLiveness(coordRoot, binding);
+    assertReclaimLiveness(coordRoot, binding, options.unknownLiveness);
     const claim = assertReclaimOwnership(coordRoot, binding);
     let reservation;
     try {
@@ -697,7 +724,7 @@ async function reclaim(coordRoot, provider, binding, options) {
         throw new WorkflowReclaimError("workflow_reclaim_lease_held", error.message);
     }
     try {
-        reclaimAuthorityGuard(coordRoot, binding, claim, reservation);
+        reclaimAuthorityGuard(coordRoot, binding, claim, reservation, options.unknownLiveness);
         let releaseResume;
         try {
             releaseResume = acquireWorkflowResumeLease(coordRoot, binding.run_id);
@@ -722,9 +749,24 @@ async function reclaim(coordRoot, provider, binding, options) {
                     throw new WorkflowReclaimError("workflow_reclaim_lease_held", error.message);
                 }
                 try {
-                    assertReclaimLiveness(coordRoot, binding);
+                    assertReclaimLiveness(coordRoot, binding, options.unknownLiveness);
                     assertReclaimOwnership(coordRoot, binding);
                     const preview = reclaimPreview(coordRoot, binding, options.mode);
+                    const audit = options.unknownLiveness
+                        ? beginWorkflowRecovery(coordRoot, {
+                            run_id: binding.run_id,
+                            action: "reclaim_unknown_liveness",
+                            actor: options.unknownLiveness.actor,
+                            reason: options.unknownLiveness.reason,
+                            target_sha256: options.unknownLiveness.evidenceSha256,
+                            target: {
+                                binding_id: binding.binding_id,
+                                workspace_root: binding.workspace_root,
+                                mode: options.mode,
+                                liveness: preview.liveness,
+                            },
+                        })
+                        : undefined;
                     let preparation;
                     // Keep ordinary cleanup's terminal-evidence checks, intent and receipts.
                     // Its provider callback uses the leases already held here instead of
@@ -736,11 +778,22 @@ async function reclaim(coordRoot, provider, binding, options) {
                         provider: {
                             ...provider,
                             cleanup: async (candidate, intent) => {
-                                assertReclaimLiveness(coordRoot, candidate);
+                                assertReclaimLiveness(coordRoot, candidate, options.unknownLiveness);
                                 assertReclaimOwnership(coordRoot, candidate);
                                 return cleanupUnderLease(coordRoot, candidate, claim, intent, {
                                     mode: options.mode,
-                                    beforeEffect: () => reclaimAuthorityGuard(coordRoot, candidate, claim, reservation),
+                                    recovery: options.unknownLiveness,
+                                    beforeEffect: () => {
+                                        audit?.assertCurrent();
+                                        reclaimAuthorityGuard(coordRoot, candidate, claim, reservation, options.unknownLiveness);
+                                    },
+                                    beforeRefEffect: () => {
+                                        audit?.assertCurrent();
+                                        reservation.assertCurrent();
+                                        assertReclaimLiveness(coordRoot, candidate, options.unknownLiveness);
+                                        requiredClaim(coordRoot, candidate);
+                                        assertPeerWorkspaceAuthority(coordRoot, claim);
+                                    },
                                     prepared: (value) => {
                                         preparation = value;
                                     },
@@ -754,6 +807,8 @@ async function reclaim(coordRoot, provider, binding, options) {
                         throw new WorkflowReclaimError("workflow_reclaim_ownership_unproven", ("reason" in cleanupResult ? cleanupResult.reason : undefined) ??
                             "workspace cleanup preconditions could not be proved");
                     }
+                    if (cleanupResult.status === "released" || cleanupResult.status === "already_released")
+                        audit?.complete();
                     return {
                         ...preview,
                         action: "reclaimed",
@@ -891,7 +946,7 @@ function cleanupUnderLease(coordRoot, binding, claim, intent, reclaimRequest, be
         };
     }
     const liveness = readWorkflowLiveness(coordRoot, binding.run_id);
-    if (liveness !== "inactive") {
+    if (liveness !== "inactive" && !(liveness === "unknown" && reclaimRequest?.recovery)) {
         return {
             ...base,
             status: "blocked",
@@ -962,7 +1017,7 @@ function cleanupUnderLease(coordRoot, binding, claim, intent, reclaimRequest, be
         };
     }
     if (reclaimRequest) {
-        assertReclaimLiveness(coordRoot, binding);
+        assertReclaimLiveness(coordRoot, binding, reclaimRequest.recovery);
         assertReclaimOwnership(coordRoot, binding);
         revalidateClaimResources(claim, root);
         reclaimRequest.prepared(prepareReclaim({
@@ -1002,6 +1057,7 @@ function cleanupUnderLease(coordRoot, binding, claim, intent, reclaimRequest, be
             return { ...base, status: "blocked", reason: "workspace ref changed during cleanup" };
         }
         revalidateClaimResources(claim, root);
+        reclaimRequest?.beforeRefEffect();
         const deleted = gitMaybe(repository.source_root.realpath, [
             "update-ref",
             "-d",

package/dist/core/workflow/workspaces/reclaim.d.ts

@@ -14,10 +14,11 @@
  * always has. So reclaim adds no second removal path that could diverge from the
  * audited one, and a force-delete of live work exists nowhere in the codebase.
  */
+import type { WorkflowRecoveryAuthorization } from "../recovery-audit.js";
 import type { WorkflowLiveness } from "./recovery.js";
 import type { WorkspaceCleanupAttempt, WorkspaceCleanupReceipt } from "./types.js";
 export type ReclaimMode = "salvage" | "discard";
-export type WorkflowReclaimRefusalCode = "workflow_reclaim_run_live" | "workflow_reclaim_liveness_unknown" | "workflow_reclaim_ownership_unproven" | "workflow_reclaim_lease_held";
+export type WorkflowReclaimRefusalCode = "workflow_reclaim_run_live" | "workflow_reclaim_liveness_unknown" | "workflow_reclaim_recovery_mismatch" | "workflow_reclaim_ownership_unproven" | "workflow_reclaim_lease_held";
 export declare class WorkflowReclaimError extends Error {
     readonly code: WorkflowReclaimRefusalCode;
     constructor(code: WorkflowReclaimRefusalCode, message: string);
@@ -25,6 +26,9 @@ export declare class WorkflowReclaimError extends Error {
 export interface WorkspaceReclaimOptions {
     mode: ReclaimMode;
     yes?: boolean;
+    unknownLiveness?: WorkflowRecoveryAuthorization & {
+        evidenceSha256: string;
+    };
 }
 export interface ReclaimLeaseHolder {
     scope: "binding" | "repository" | "resume";
@@ -38,6 +42,7 @@ export interface WorkspaceReclaimPreview {
     run_id: string;
     mode: ReclaimMode;
     liveness: WorkflowLiveness;
+    evidence_sha256: string;
     ownership: "ok" | "unproven";
     ownership_detail?: string;
     dirty_paths: string[] | null;

package/dist/core/workflow/workspaces/reclaim.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reclaim.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/reclaim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAEnF,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhD,MAAM,MAAM,0BAA0B,GAClC,2BAA2B,GAC3B,mCAAmC,GACnC,qCAAqC,GACrC,6BAA6B,CAAC;AAElC,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,IAAI,EAAE,0BAA0B;gBAAhC,IAAI,EAAE,0BAA0B,EACzC,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,SAAS,EAAE,IAAI,GAAG,UAAU,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,kBAAkB,EAAE,CAAC;CACpC;AAED,MAAM,MAAM,sBAAsB,GAC9B,uBAAuB,GACvB,CAAC,IAAI,CAAC,uBAAuB,EAAE,QAAQ,CAAC,GAAG;IACzC,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,kBAAkB,CAAC;IAChC,OAAO,EAAE,uBAAuB,GAAG,uBAAuB,CAAC;CAC5D,CAAC,CAAC;AAEP,MAAM,MAAM,kBAAkB,GAC1B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/C,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,WAAW,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,kBAAkB,CAwD7E;AAYD;qEACqE;AACrE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD"}
+{"version":3,"file":"reclaim.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/reclaim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AAE1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAEnF,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhD,MAAM,MAAM,0BAA0B,GAClC,2BAA2B,GAC3B,mCAAmC,GACnC,oCAAoC,GACpC,qCAAqC,GACrC,6BAA6B,CAAC;AAElC,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,IAAI,EAAE,0BAA0B;gBAAhC,IAAI,EAAE,0BAA0B,EACzC,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,eAAe,CAAC,EAAE,6BAA6B,GAAG;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9E;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,IAAI,GAAG,UAAU,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,kBAAkB,EAAE,CAAC;CACpC;AAED,MAAM,MAAM,sBAAsB,GAC9B,uBAAuB,GACvB,CAAC,IAAI,CAAC,uBAAuB,EAAE,QAAQ,CAAC,GAAG;IACzC,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,kBAAkB,CAAC;IAChC,OAAO,EAAE,uBAAuB,GAAG,uBAAuB,CAAC;CAC5D,CAAC,CAAC;AAEP,MAAM,MAAM,kBAAkB,GAC1B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/C,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,WAAW,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,kBAAkB,CAwD7E;AAYD;qEACqE;AACrE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD"}

package/dist/core/workflow/workspaces/recovery.d.ts

@@ -1,3 +1,5 @@
 export type WorkflowLiveness = "active" | "inactive" | "unknown";
+/** Corruption must not hide a readable active marker from an audited override. */
+export declare function hasActiveWorkflowEvidence(coordRoot: string, runId: string): boolean;
 export declare function readWorkflowLiveness(coordRoot: string, runId: string): WorkflowLiveness;
 //# sourceMappingURL=recovery.d.ts.map

package/dist/core/workflow/workspaces/recovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recovery.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/recovery.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAEjE,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,gBAAgB,CA6DvF"}
+{"version":3,"file":"recovery.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/recovery.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAEjE,kFAAkF;AAClF,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBnF;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,gBAAgB,CA6DvF"}

package/dist/core/workflow/workspaces/recovery.js

@@ -1,6 +1,30 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { readWorkflowProof } from "../proof.js";
+/** Corruption must not hide a readable active marker from an audited override. */
+export function hasActiveWorkflowEvidence(coordRoot, runId) {
+    const path = join(resolve(coordRoot), ".harnery", "workflows", runId, "transcript.jsonl");
+    if (!existsSync(path))
+        return false;
+    let active = false;
+    for (const line of readFileSync(path, "utf8").split("\n")) {
+        try {
+            const event = JSON.parse(line);
+            if (event?.run_id !== runId)
+                continue;
+            if (["run.start", "run.resume", "agent.start"].includes(event.event))
+                active = true;
+            if (event.event === "run.parked" ||
+                (event.event === "run.end" && typeof event.ok === "boolean") ||
+                (event.event === "workspace.reattach.failed" && ["blocked", "lost"].includes(event.status)))
+                active = false;
+        }
+        catch {
+            /* Unreadable evidence cannot establish inactivity. */
+        }
+    }
+    return active;
+}
 export function readWorkflowLiveness(coordRoot, runId) {
     const root = resolve(coordRoot);
     const transcriptPath = join(root, ".harnery", "workflows", runId, "transcript.jsonl");

package/dist/lib/identities/assume.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assume.d.ts","sourceRoot":"","sources":["../../../src/lib/identities/assume.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA0BH,MAAM,MAAM,uBAAuB,GAC/B,eAAe,GACf,iBAAiB,GACjB,sBAAsB,GACtB,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,GACpB,aAAa,GACb,mBAAmB,CAAC;AAExB,qBAAa,mBAAoB,SAAQ,KAAK;aAE1B,IAAI,EAAE,uBAAuB;gBAA7B,IAAI,EAAE,uBAAuB,EAC7C,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,+DAA+D;IAC/D,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAOD;+EAC+E;AAC/E,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,KAAK,SAAa,EAClB,mBAAmB,GAAE,WAAW,CAAC,MAAM,CAAa,GACnD,gBAAgB,GAAG,IAAI,CA6BzB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CA6CT;AAuED,gEAAgE;AAChE,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,GACjC,oBAAoB,CAyHtB"}
+{"version":3,"file":"assume.d.ts","sourceRoot":"","sources":["../../../src/lib/identities/assume.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA0BH,MAAM,MAAM,uBAAuB,GAC/B,eAAe,GACf,iBAAiB,GACjB,sBAAsB,GACtB,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,GACpB,aAAa,GACb,mBAAmB,CAAC;AAExB,qBAAa,mBAAoB,SAAQ,KAAK;aAE1B,IAAI,EAAE,uBAAuB;gBAA7B,IAAI,EAAE,uBAAuB,EAC7C,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,+DAA+D;IAC/D,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAOD;+EAC+E;AAC/E,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,KAAK,SAAa,EAClB,mBAAmB,GAAE,WAAW,CAAC,MAAM,CAAa,GACnD,gBAAgB,GAAG,IAAI,CA6BzB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAyCT;AAuED,gEAAgE;AAChE,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,GACjC,oBAAoB,CAyHtB"}

package/dist/lib/identities/assume.js

@@ -85,7 +85,6 @@ export function reclaimAbandonedLocalConflict(coordRoot, conflict) {
     let sessionId = conflict.instance_id;
     let ageSecs;
     const liveRow = readLiveCoordinationRow(coordRoot, conflict.instance_id);
-    let expectedGenerationId = liveRow?.v3_generation_id ?? null;
     if (liveRow) {
         adapter = adapterOf(liveRow.platform);
         sessionId = liveRow.session_id || conflict.instance_id;
@@ -100,10 +99,8 @@ export function reclaimAbandonedLocalConflict(coordRoot, conflict) {
             // It is required to join the exact producer state when recording the sweep.
             adapter = adapterOf(hb.platform);
             sessionId = hb.session_id || conflict.instance_id;
-            expectedGenerationId = hb.v3_generation_id ?? null;
         }
         catch {
-            expectedGenerationId = null;
             /* content unreadable — still reclaim the file */
         }
         try {
@@ -119,7 +116,6 @@ export function reclaimAbandonedLocalConflict(coordRoot, conflict) {
         owner: conflict.instance_id,
         nativeSessionId: sessionId,
         adapter,
-        expectedGenerationId,
         observation: "stale_heartbeat",
         ageMs: Math.max(0, (ageSecs ?? 0) * 1_000),
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harnery",
-  "version": "0.44.0",
+  "version": "0.45.1",
   "description": "Multi-agent coordination for AI coding agents - Claude Code, Cursor, and Codex.",
   "license": "MIT",
   "author": "Ryan Kelly",

package/src/commands/workflow.ts

@@ -73,6 +73,15 @@ interface WorkflowConfirmedMutationOpts {
 
 interface WorkflowReclaimOpts extends WorkflowConfirmedMutationOpts {
   discard?: boolean;
+  unknownLiveness?: string;
+  actor?: string;
+  reason?: string;
+}
+
+interface WorkflowUnlockOpts extends WorkflowConfirmedMutationOpts {
+  lockSha256?: string;
+  actor?: string;
+  reason?: string;
 }
 
 export function registerWorkflowCommand(program: Command, emit: EmitContext): void {
@@ -622,6 +631,12 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
     )
     .option("--yes", "Confirm that this commits or discards uncommitted work, then releases")
     .option("--discard", "Throw the uncommitted work away instead of salvaging it")
+    .option(
+      "--unknown-liveness <sha256>",
+      "Recover unknown evidence pinned by the preview digest; active evidence still refuses",
+    )
+    .option("--actor <id>", "Actor responsible for an audited recovery")
+    .option("--reason <text>", "Reason for an audited recovery")
     .option("--json", "Emit the reclaim preview or confirmed result as JSON")
     .action(async (runId: string, opts: WorkflowReclaimOpts) => {
       const coordRoot = resolveCoordRoot();
@@ -648,6 +663,13 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
         const result = await provider.reclaim(binding, {
           mode: opts.discard ? "discard" : "salvage",
           yes: opts.yes,
+          unknownLiveness: opts.unknownLiveness
+            ? {
+                evidenceSha256: opts.unknownLiveness,
+                actor: opts.actor!,
+                reason: opts.reason!,
+              }
+            : undefined,
         });
         if (opts.json) {
           emit.config({ format: "json" });
@@ -662,6 +684,7 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
           emit.text(
             `reclaim preview: ${result.run_id}\n` +
               `mode: ${result.mode}\nliveness: ${result.liveness}\nownership: ${result.ownership}\n` +
+              `evidence sha256: ${result.evidence_sha256}\n` +
               `lease holder: ${holders.length > 0 ? holders.join(", ") : "none observed"}\n` +
               `dirty paths: ${result.dirty_paths === null ? "unknown" : result.dirty_paths.length > 0 ? result.dirty_paths.join(", ") : "none"}\n` +
               (result.ownership_detail ? `ownership detail: ${result.ownership_detail}\n` : "") +
@@ -685,6 +708,42 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
       }
     });
 
+  workflow
+    .command("unlock <run-id>")
+    .description(
+      "Preview or explicitly retire one exact resume lock whose local owner is proven dead.",
+    )
+    .option("--lock-sha256 <sha256>", "Exact lock identity digest returned by the preview")
+    .option("--actor <id>", "Actor responsible for the recovery")
+    .option("--reason <text>", "Reason for the recovery")
+    .option("--yes", "Confirm removal after dead-owner and exact-lock checks")
+    .option("--json", "Emit the recovery preview or result as JSON")
+    .action(async (runId: string, opts: WorkflowUnlockOpts) => {
+      try {
+        const coordRoot = resolveCoordRoot();
+        if (!coordRoot) throw new Error("no .harnery/ coordination root found");
+        const { recoverWorkflowResumeLease } = await import("../core/workflow/index.ts");
+        const result = recoverWorkflowResumeLease(coordRoot, runId, opts);
+        if (opts.json) {
+          emit.config({ format: "json" });
+          emit.data(result);
+          return;
+        }
+        emit.text(
+          `resume lock ${result.action}: ${runId}\nowner: ${result.owner_state}\nlock sha256: ${result.lock_sha256 ?? "absent"}\n` +
+            (result.action === "preview"
+              ? "Pass --lock-sha256, --actor, --reason and --yes to confirm exact dead-owner recovery.\n"
+              : `recovery: ${result.recovery_id}\n`),
+        );
+      } catch (error) {
+        emit.error({
+          code: "workflow_resume_unlock_failed",
+          message: error instanceof Error ? error.message : String(error),
+        });
+        process.exit(1);
+      }
+    });
+
   const approvals = program
     .command("approval")
     .description("Inspect and resolve durable run-policy approvals.");

package/src/core/agents/coord-client.ts

@@ -265,7 +265,27 @@ export function parsePidmapRowStartToken(row: string): string | undefined {
  * a test can hold this one against `processStartToken` and fail on drift.
  */
 export function pidStartToken(pid: number): string | null {
+  if (!Number.isInteger(pid) || pid <= 0) return null;
   const forced = process.env.HARNERY_PID_PROBE;
+  if (process.platform === "win32" && forced !== "procfs" && forced !== "ps") {
+    try {
+      const out = spawnSync(
+        "powershell.exe",
+        [
+          "-NoLogo",
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `$process = [Diagnostics.Process]::GetProcessById(${pid}); try { 'w' + $process.StartTime.ToFileTimeUtc().ToString([Globalization.CultureInfo]::InvariantCulture) } finally { $process.Dispose() }`,
+        ],
+        { encoding: "utf8", timeout: 10_000, windowsHide: true },
+      );
+      const token = String(out.stdout ?? "").trim();
+      return out.status === 0 && /^w\d+$/.test(token) ? token : null;
+    } catch {
+      return null;
+    }
+  }
   const useProcfs = forced === "procfs" || (forced !== "ps" && existsSync("/proc/self/stat"));
   // One machine, one probe. Falling back to the other on a read failure would
   // answer in the wrong dialect and read as a recycled pid.

package/src/core/agents/live-authority-v3.ts

@@ -88,7 +88,6 @@ interface LiveAuthorityBaseV3 {
   nativeSessionId: string;
   adapter: Adapter;
   observationId?: string;
-  expectedGenerationId?: `gen_${string}`;
 }
 
 /**
@@ -649,13 +648,6 @@ function recordLiveAuthority<S extends CoordinationAuthoritySignalV3>(
     platform: livePlatformV3(),
     expected_prior_state_digest: coordinationAuthorityStateDigestV3(expected),
     desired_state_digest: coordinationAuthorityStateDigestV3(desired),
-    expected_generation_id:
-      input.expectedGenerationId ??
-      ((subject === input.owner
-        ? expected.v3_generation_id
-        : readLiveCoordinationRow(input.coordRoot, input.owner)?.v3_generation_id) as
-        | `gen_${string}`
-        | undefined),
     reconciler: {
       readStateDigest: () => {
         const heartbeat = readHeartbeat(input.coordRoot, subject);
@@ -689,12 +681,6 @@ export function liveCoordinationWriteModeV3(coordRoot: string): EventV3WriteMode
 }
 
 function requireHeartbeat(input: LiveAuthorityBaseV3, owner: string): Heartbeat {
-  if (
-    input.expectedGenerationId &&
-    readLiveCoordinationRow(input.coordRoot, owner)?.v3_generation_id !== input.expectedGenerationId
-  ) {
-    throw new LiveCoordinationAuthorityV3Error("expected_generation_changed");
-  }
   const heartbeat = ensureLiveCoordinationHeartbeat(
     input.coordRoot,
     owner,
@@ -702,9 +688,6 @@ function requireHeartbeat(input: LiveAuthorityBaseV3, owner: string): Heartbeat
     input.adapter,
   );
   if (!heartbeat) throw new LiveCoordinationAuthorityV3Error(`heartbeat_missing:${owner}`);
-  if (input.expectedGenerationId && heartbeat.v3_generation_id !== input.expectedGenerationId) {
-    throw new LiveCoordinationAuthorityV3Error("expected_generation_changed");
-  }
   return heartbeat;
 }
 

package/src/core/agents/live-lifecycle-v3.ts

@@ -5,7 +5,6 @@ import { normalizeNativeIdV3 } from "../events/v3/canonical.ts";
 import type { EventV3 } from "../events/v3/contract.ts";
 import { readEventV3ControlState } from "../events/v3/control.ts";
 import { fingerprintContextV3 } from "../events/v3/fingerprint-keys.ts";
-import { withGenerationCustodyV3 } from "../events/v3/generation-custody.ts";
 import {
   liveInstanceIdV3,
   livePlatformV3,
@@ -26,34 +25,17 @@ interface LiveLifecycleObservationBaseV3 {
   observedAt?: string;
 }
 
-interface LiveSweepObservationV3Input extends LiveLifecycleObservationBaseV3 {
-  expectedGenerationId: `gen_${string}` | null;
-  observation: "stale_heartbeat" | "killed" | "unparseable_heartbeat" | "missing_timestamp";
-  ageMs: number;
-}
-
 export function recordLiveSweepObservationV3(
-  input: LiveSweepObservationV3Input,
+  input: LiveLifecycleObservationBaseV3 & {
+    observation: "stale_heartbeat" | "killed" | "unparseable_heartbeat" | "missing_timestamp";
+    ageMs: number;
+  },
 ): LiveLifecycleObservationV3Result {
-  input = { ...input };
-  // Reject stale observations before preparing durable custody state. The
-  // in-custody checks cover replacement while acquiring custody and reentry.
-  requireSweepHookState(input);
-  return withGenerationCustodyV3(input.coordRoot, [liveInstanceIdV3(input.owner)], () => {
-    requireSweepHookState(input);
-    return recordObservation(
-      input,
-      "lifecycle.sweep_observed",
-      {
-        subject_instance_id: liveInstanceIdV3(input.owner),
-        observation: input.observation,
-        provisional: true,
-        age_ms: Math.max(0, Math.floor(input.ageMs)),
-      },
-      () => {
-        requireSweepHookState(input);
-      },
-    );
+  return recordObservation(input, "lifecycle.sweep_observed", {
+    subject_instance_id: liveInstanceIdV3(input.owner),
+    observation: input.observation,
+    provisional: true,
+    age_ms: Math.max(0, Math.floor(input.ageMs)),
   });
 }
 
@@ -62,16 +44,11 @@ export function recordLiveResumeObservationV3(
 ): LiveLifecycleObservationV3Result {
   const normalized = withAttestedAdapter(input);
   const hook = requireHookState(normalized);
-  return recordObservation(
-    normalized,
-    "session.resumed",
-    {
-      prior_generation_id: hook.generation_id,
-      continuity: "native",
-      evidence_reference: "heartbeat_recreated",
-    },
-    () => {},
-  );
+  return recordObservation(normalized, "session.resumed", {
+    prior_generation_id: hook.generation_id,
+    continuity: "native",
+    evidence_reference: "heartbeat_recreated",
+  });
 }
 
 function recordObservation<T extends "lifecycle.sweep_observed" | "session.resumed">(
@@ -89,7 +66,6 @@ function recordObservation<T extends "lifecycle.sweep_observed" | "session.resum
         continuity: "native";
         evidence_reference: string;
       },
-  beforeWrite: () => void,
 ): LiveLifecycleObservationV3Result {
   const route = resolveLiveEventLedgerRouteV3(input.coordRoot);
   if (route.state === "blocked") throw new LiveCoordinationAuthorityV3Error(route.reason);
@@ -145,7 +121,6 @@ function recordObservation<T extends "lifecycle.sweep_observed" | "session.resum
     monotonic_ns: process.hrtime.bigint().toString(),
   };
   const event = buildEventV3(eventType, { ...common, payload } as never) as EventV3;
-  beforeWrite();
   const durability = writeEventV3(input.coordRoot, event, {
     expectedGenesisId: control.genesis.event.payload.genesis_id as `gex_${string}`,
   });
@@ -155,19 +130,6 @@ function recordObservation<T extends "lifecycle.sweep_observed" | "session.resum
   return { state: "recorded", event };
 }
 
-function requireSweepHookState(input: LiveSweepObservationV3Input): void {
-  if (
-    typeof input.expectedGenerationId !== "string" ||
-    !/^gen_[a-zA-Z0-9._-]+$/.test(input.expectedGenerationId)
-  ) {
-    throw new LiveCoordinationAuthorityV3Error("hook_generation_not_joinable");
-  }
-  const hook = requireHookState(withAttestedAdapter(input));
-  if (hook.generation_id !== input.expectedGenerationId) {
-    throw new LiveCoordinationAuthorityV3Error("expected_generation_changed");
-  }
-}
-
 function withAttestedAdapter<T extends LiveLifecycleObservationBaseV3>(input: T): T {
   const adapter = liveCoordinationAdapterV3(input.coordRoot, input.owner);
   if (!adapter) return input;