harnery 0.45.0 → 0.45.2

package/dist/core/workflow/resume-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume-lock.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/resume-lock.ts"],"names":[],"mappings":"AAqBA,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAEnE,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;+DAE+D;AAC/D,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,IAAI,CAsDvF;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAG/E;AAED;oFACoF;AACpF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,uBAAuB,GAAG,wBAAwB,CAUjG;AAkCD,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,uBAAuB,GAAG,IAAI,CAEhC"}

package/dist/core/workflow/resume-lock.js

@@ -0,0 +1,158 @@
+// Kept apart from run-state.ts: the resume lock reads process identity, and
+// run-state.ts is also reached from read-only dashboard modules.
+import { randomUUID } from "node:crypto";
+import { chmodSync, closeSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
+import { hostname } from "node:os";
+import { dirname, join } from "node:path";
+import { processStartToken, verifyProcessGeneration } from "../agents/state/proc-start.js";
+import { stateFileMode } from "../storage/modes.js";
+import { assertWorkflowRunId } from "./approvals.js";
+/** Acquire the exclusive lease shared by resume and reclaim. A lock whose
+ * same-host owner has exited, or whose PID now names a different process, is
+ * retired automatically. Every other existing lock refuses. */
+export function acquireWorkflowResumeLease(coordRoot, runId) {
+    const path = workflowResumeLockPath(coordRoot, runId);
+    const owner = {
+        owner_id: randomUUID(),
+        pid: process.pid,
+        host: hostname(),
+        created_at: new Date().toISOString(),
+        start_token: processStartToken(process.pid),
+    };
+    const ownerBytes = `${JSON.stringify(owner)}\n`;
+    mkdirSync(dirname(path), { recursive: true });
+    const acquire = () => {
+        try {
+            const fd = openSync(path, "wx", stateFileMode());
+            try {
+                writeFileSync(fd, ownerBytes, "utf8");
+            }
+            finally {
+                closeSync(fd);
+            }
+            chmodSync(path, stateFileMode());
+            const identity = lstatSync(path);
+            return { device: identity.dev, inode: identity.ino };
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            return false;
+        }
+    };
+    const acquired = acquire() || (retireDeadResumeLock(path) && acquire());
+    if (!acquired) {
+        const existing = readWorkflowResumeLock(coordRoot, runId);
+        const holder = existing
+            ? ` by pid ${existing.pid} on ${existing.host} (owner ${workflowResumeOwnerState(existing)})`
+            : "; its owner could not be read";
+        throw new Error(`workflow run ${runId} resume lease is already held${holder}`);
+    }
+    return () => {
+        try {
+            // Pin identity and bytes, so a stale closure never removes a replacement.
+            const identity = lstatSync(path);
+            if (identity.isFile() &&
+                identity.dev === acquired.device &&
+                identity.ino === acquired.inode &&
+                readFileSync(path, "utf8") === ownerBytes) {
+                unlinkSync(path);
+            }
+        }
+        catch {
+            // Leave an unreadable or replaced lock untouched.
+        }
+    };
+}
+export function workflowResumeLockPath(coordRoot, runId) {
+    assertWorkflowRunId(runId);
+    return join(coordRoot, ".harnery", "workflows", runId, "resume.lock");
+}
+/** Only a same-host owner can be proven gone: by ESRCH, or by a recorded start
+ * token that no longer matches its PID. Foreign and unreadable owners stay live. */
+export function workflowResumeOwnerState(owner) {
+    if (owner.host !== hostname())
+        return "unknown";
+    try {
+        process.kill(owner.pid, 0);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ESRCH")
+            return "dead";
+        if (code !== "EPERM")
+            return "unknown";
+    }
+    return verifyProcessGeneration(owner.pid, owner.start_token) === "different" ? "dead" : "live";
+}
+/** Move a dead owner's exact lock aside before deleting it. If a contender
+ * replaced it in between, the moved bytes (a fresh owner_id) differ, and that
+ * live lock is linked back. */
+function retireDeadResumeLock(path) {
+    let bytes;
+    try {
+        bytes = readFileSync(path, "utf8");
+    }
+    catch (error) {
+        return error.code === "ENOENT";
+    }
+    const owner = parseResumeLock(bytes);
+    if (!owner || workflowResumeOwnerState(owner) !== "dead")
+        return false;
+    const aside = `${path}.dead-${randomUUID()}`;
+    try {
+        renameSync(path, aside);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return true;
+        throw error;
+    }
+    const exact = readFileSync(aside, "utf8") === bytes;
+    if (!exact) {
+        try {
+            linkSync(aside, path);
+        }
+        catch {
+            // A third contender already holds the path; the moved owner's release
+            // finds a different inode and leaves that lock alone.
+        }
+    }
+    unlinkSync(aside);
+    return exact;
+}
+export function readWorkflowResumeLock(coordRoot, runId) {
+    return readResumeLease(workflowResumeLockPath(coordRoot, runId));
+}
+function readResumeLease(path) {
+    try {
+        return parseResumeLock(readFileSync(path, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function parseResumeLock(bytes) {
+    try {
+        const value = JSON.parse(bytes);
+        return typeof value.pid === "number" &&
+            Number.isSafeInteger(value.pid) &&
+            value.pid > 0 &&
+            typeof value.host === "string" &&
+            value.host.length > 0 &&
+            validTimestamp(value.created_at)
+            ? {
+                pid: value.pid,
+                host: value.host,
+                created_at: value.created_at,
+                start_token: typeof value.start_token === "string" ? value.start_token : null,
+            }
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function validTimestamp(value) {
+    return typeof value === "string" && value.length <= 40 && Number.isFinite(Date.parse(value));
+}

package/dist/core/workflow/run-state.d.ts

@@ -1,6 +1,5 @@
 import type { RepoSnapshot } from "../context/index.js";
 import { type NormalizedPolicy, type PolicyIsolation, type PolicyNetworkAccess } from "../policy/index.js";
-import { type WorkflowRecoveryAuthorization } from "./recovery-audit.js";
 import type { WorkflowAttemptContext, WorkflowDiagnosticAdmissionConfig, WorkflowSpecialistProfile, WorkflowWorkContext } from "./types.js";
 import type { WorkspaceBinding, WorkspaceCompatibilityExecutionEvidence } from "./workspaces/index.js";
 export declare const WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION: 2;
@@ -48,24 +47,4 @@ export declare function assertWorkflowRunResumable(coordRoot: string, runId: str
 };
 export declare function assertWorkflowScriptUnchanged(manifest: WorkflowRunManifest): void;
 export declare function workflowRunManifestPath(coordRoot: string, runId: string): string;
-/** Acquire an exclusive lease shared by resume and reclaim. Existing locks
- * always refuse; explicit audited recovery is a separate operation. */
-export declare function acquireWorkflowResumeLease(coordRoot: string, runId: string): () => void;
-export interface WorkflowResumeRecoveryOptions extends Partial<WorkflowRecoveryAuthorization> {
-    yes?: boolean;
-    lockSha256?: string;
-}
-export interface WorkflowResumeRecoveryResult {
-    action: "preview" | "unlocked";
-    run_id: string;
-    lock_sha256: string | null;
-    owner_state: "dead" | "live" | "unknown" | "absent";
-    owner: {
-        pid: number;
-        host: string;
-        created_at: string;
-    } | null;
-    recovery_id?: string;
-}
-export declare function recoverWorkflowResumeLease(coordRoot: string, runId: string, options: WorkflowResumeRecoveryOptions): WorkflowResumeRecoveryResult;
 //# sourceMappingURL=run-state.d.ts.map

package/dist/core/workflow/run-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-state.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/run-state.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAEzB,MAAM,oBAAoB,CAAC;AAU5B,OAAO,EAAyB,KAAK,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAEhG,OAAO,KAAK,EACV,sBAAsB,EACtB,iCAAiC,EACjC,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,EAEV,gBAAgB,EAChB,uCAAuC,EACxC,MAAM,uBAAuB,CAAC;AAQ/B,eAAO,MAAM,oCAAoC,EAAG,CAAU,CAAC;AAI/D,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,iBAAiB,EAAE,YAAY,CAAC;IAChC,SAAS,EAAE;QACT,GAAG,EAAE,MAAM,CAAC;QACZ,eAAe,EAAE,MAAM,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,oBAAoB,CAAC,EAAE,iCAAiC,CAAC;QACzD,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;QAC/B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,SAAS,EAAE,eAAe,CAAC;QAC3B,cAAc,EAAE,mBAAmB,CAAC;QACpC,MAAM,CAAC,EAAE,gBAAgB,CAAC;QAC1B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;QACxD,iBAAiB,CAAC,EAAE,gBAAgB,CAAC;QACrC,kBAAkB,CAAC,EAAE,uCAAuC,CAAC;KAC9D,CAAC;CACH;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,6BAA6B,GAAG,MAAM,CAgBrF;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAgD7F;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CA4BvD;AAED,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CASjF;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGhF;AAED;uEACuE;AACvE,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,IAAI,CA6DvF;AAED,MAAM,WAAW,6BAA8B,SAAQ,OAAO,CAAC,6BAA6B,CAAC;IAC3F,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;IACpD,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,6BAA6B,GACrC,4BAA4B,CAkE9B"}
+{"version":3,"file":"run-state.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/run-state.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAEzB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EACV,sBAAsB,EACtB,iCAAiC,EACjC,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,EAEV,gBAAgB,EAChB,uCAAuC,EACxC,MAAM,uBAAuB,CAAC;AAO/B,eAAO,MAAM,oCAAoC,EAAG,CAAU,CAAC;AAI/D,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,iBAAiB,EAAE,YAAY,CAAC;IAChC,SAAS,EAAE;QACT,GAAG,EAAE,MAAM,CAAC;QACZ,eAAe,EAAE,MAAM,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,oBAAoB,CAAC,EAAE,iCAAiC,CAAC;QACzD,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;QAC/B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,SAAS,EAAE,eAAe,CAAC;QAC3B,cAAc,EAAE,mBAAmB,CAAC;QACpC,MAAM,CAAC,EAAE,gBAAgB,CAAC;QAC1B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;QACxD,iBAAiB,CAAC,EAAE,gBAAgB,CAAC;QACrC,kBAAkB,CAAC,EAAE,uCAAuC,CAAC;KAC9D,CAAC;CACH;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,6BAA6B,GAAG,MAAM,CAgBrF;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAgD7F;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CA4BvD;AAED,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CASjF;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGhF"}

package/dist/core/workflow/run-state.js

@@ -1,17 +1,13 @@
-import { createHash, randomUUID } from "node:crypto";
-import { chmodSync, closeSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
-import { hostname } from "node:os";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { normalizePolicy, policyDigest, } from "../policy/index.js";
-import { stateFileMode } from "../storage/modes.js";
 import { assertWorkflowRunId, readWorkflowApproval } from "./approvals.js";
 import { isCanonicalWorkflowAttemptContext } from "./attempt-context.js";
-import { fsyncParentDirectory, readJsonRecord, stableDigest, writeImmutableJson, } from "./durable-record.js";
-import { beginWorkflowRecovery } from "./recovery-audit.js";
+import { readJsonRecord, writeImmutableJson } from "./durable-record.js";
 import { normalizeWorkflowSpecialists } from "./specialists.js";
 import { WORKFLOW_DIAGNOSTIC_ADMISSION_SCHEMA_VERSION } from "./types.js";
 import { isCanonicalWorkflowWorkContext } from "./work-context.js";
-import { acquireNoClobberLease } from "./workspaces/leases.js";
 import { assertWorkspaceManifestAuthority, isWorkspaceBinding, isWorkspaceCompatibilityExecutionEvidence, } from "./workspaces/validate.js";
 export const WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION = 2;
 const MANIFEST_LIMIT_BYTES = 256 * 1024;
@@ -129,173 +125,6 @@ export function workflowRunManifestPath(coordRoot, runId) {
     assertWorkflowRunId(runId);
     return join(coordRoot, ".harnery", "workflows", runId, "run.json");
 }
-/** Acquire an exclusive lease shared by resume and reclaim. Existing locks
- * always refuse; explicit audited recovery is a separate operation. */
-export function acquireWorkflowResumeLease(coordRoot, runId) {
-    assertWorkflowRunId(runId);
-    const path = join(coordRoot, ".harnery", "workflows", runId, "resume.lock");
-    const owner = {
-        owner_id: randomUUID(),
-        pid: process.pid,
-        host: hostname(),
-        created_at: new Date().toISOString(),
-    };
-    const ownerBytes = `${JSON.stringify(owner)}\n`;
-    mkdirSync(dirname(path), { recursive: true });
-    const acquire = () => {
-        try {
-            const fd = openSync(path, "wx", stateFileMode());
-            try {
-                writeFileSync(fd, ownerBytes, "utf8");
-                fsyncSync(fd);
-            }
-            finally {
-                closeSync(fd);
-            }
-            chmodSync(path, stateFileMode());
-            fsyncParentDirectory(path);
-            const identity = lstatSync(path);
-            return { device: identity.dev, inode: identity.ino };
-        }
-        catch (error) {
-            if (error.code !== "EEXIST")
-                throw error;
-            return false;
-        }
-    };
-    const acquired = withResumeLeaseMutation(coordRoot, runId, acquire);
-    if (!acquired) {
-        const existing = readResumeLease(path);
-        const holder = existing
-            ? ` by pid ${existing.pid} on ${existing.host}; its liveness has not been verified`
-            : "; its owner could not be verified";
-        throw new Error(`workflow run ${runId} resume lease is already held${holder}`);
-    }
-    return () => {
-        try {
-            // Only this live process can release this nonce. Acquisition never
-            // replaces a present lock, and unlock requires ESRCH for its owner, so
-            // neither supported writer can replace this lock during synchronous
-            // release. Taking their mutation gate would strand a live owner's lock
-            // on ordinary contention. Pin both identity and bytes for stale closures.
-            const identity = lstatSync(path);
-            if (identity.isFile() &&
-                identity.dev === acquired.device &&
-                identity.ino === acquired.inode &&
-                readFileSync(path, "utf8") === ownerBytes) {
-                unlinkSync(path);
-                fsyncParentDirectory(path);
-            }
-        }
-        catch {
-            // Leave an unreadable or replaced lock untouched.
-        }
-    };
-}
-export function recoverWorkflowResumeLease(coordRoot, runId, options) {
-    assertWorkflowRunId(runId);
-    const path = join(coordRoot, ".harnery", "workflows", runId, "resume.lock");
-    const inspect = () => {
-        let lockSha256;
-        try {
-            const stat = lstatSync(path);
-            if (!stat.isFile() || stat.size > 8 * 1024)
-                throw new Error("resume lock is not a bounded regular file");
-            lockSha256 = stableDigest({
-                bytes: readFileSync(path, "utf8"),
-                device: stat.dev,
-                inode: stat.ino,
-            });
-        }
-        catch (error) {
-            if (error.code !== "ENOENT")
-                throw error;
-            return {
-                action: "preview",
-                run_id: runId,
-                lock_sha256: null,
-                owner_state: "absent",
-                owner: null,
-            };
-        }
-        const owner = readResumeLease(path);
-        let ownerState = "unknown";
-        if (owner?.host === hostname()) {
-            try {
-                process.kill(owner.pid, 0);
-                ownerState = "live";
-            }
-            catch (error) {
-                if (error.code === "ESRCH")
-                    ownerState = "dead";
-            }
-        }
-        return {
-            action: "preview",
-            run_id: runId,
-            lock_sha256: lockSha256,
-            owner_state: ownerState,
-            owner,
-        };
-    };
-    if (!options.yes)
-        return inspect();
-    return withResumeLeaseMutation(coordRoot, runId, () => {
-        const observed = inspect();
-        if (observed.owner_state !== "dead")
-            throw new Error(`workflow resume unlock refused: owner is ${observed.owner_state}`);
-        if (!options.lockSha256 || options.lockSha256 !== observed.lock_sha256)
-            throw new Error("workflow resume unlock requires the exact current preview digest");
-        const audit = beginWorkflowRecovery(coordRoot, {
-            run_id: runId,
-            action: "unlock_resume",
-            target_sha256: options.lockSha256,
-            target: { lock: "resume.lock", owner: observed.owner },
-            actor: options.actor,
-            reason: options.reason,
-        });
-        const current = inspect();
-        if (current.lock_sha256 !== observed.lock_sha256 || current.owner_state !== "dead")
-            throw new Error("workflow resume lock authority changed before unlock");
-        audit.assertCurrent();
-        unlinkSync(path);
-        fsyncParentDirectory(path);
-        audit.complete();
-        return { ...observed, action: "unlocked", recovery_id: audit.intent.operation_id };
-    });
-}
-function withResumeLeaseMutation(coordRoot, runId, action) {
-    const authority = stableDigest({ run_id: runId, lock: "resume.lock" });
-    const lease = acquireNoClobberLease({
-        path: join(coordRoot, ".harnery", "workflows", runId, "resume-mutation.lease"),
-        scope: "workflow-resume-mutation",
-        authoritySha256: authority,
-        staleAfterMs: 300_000,
-        validateStaleOwner: (owner) => owner.authority_sha256 === authority,
-    });
-    try {
-        return action();
-    }
-    finally {
-        lease.release();
-    }
-}
-function readResumeLease(path) {
-    try {
-        const value = JSON.parse(readFileSync(path, "utf8"));
-        return typeof value.pid === "number" &&
-            Number.isSafeInteger(value.pid) &&
-            value.pid > 0 &&
-            typeof value.host === "string" &&
-            value.host.length > 0 &&
-            validTimestamp(value.created_at)
-            ? { pid: value.pid, host: value.host, created_at: value.created_at }
-            : null;
-    }
-    catch {
-        return null;
-    }
-}
 function validExecution(value) {
     if (!value || typeof value !== "object")
         return false;

package/dist/core/workflow/spawn-claude.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-claude.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-claude.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAMhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAYrE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CA0B1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAexE;AA+ED,eAAO,MAAM,iBAAiB,EAAE,OAiB/B,CAAC"}
+{"version":3,"file":"spawn-claude.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-claude.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAKhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAYrE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CA0B1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CA2ExE;AAED,eAAO,MAAM,iBAAiB,EAAE,OAiB/B,CAAC"}

package/dist/core/workflow/spawn-claude.js

@@ -21,7 +21,6 @@ import { exec } from "../../lib/exec.js";
 import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profiles.js";
 import { notFoundError } from "./adapters.js";
 import { buildChildEnv } from "./child-env.js";
-import { observeSpawnFailure } from "./failure-evidence.js";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.js";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
 export function buildClaudeInvocation(req) {
@@ -51,24 +50,6 @@ export function buildClaudeInvocation(req) {
     return { argv };
 }
 export function normalizeClaudeResult(raw) {
-    const result = normalizeClaudeTransportResult(raw);
-    if (result.ok)
-        return result;
-    let text = raw.stdout.trim();
-    let source = "stdout";
-    try {
-        const envelope = JSON.parse(raw.stdout);
-        if (typeof envelope.result === "string" && envelope.result.length > 0) {
-            text = envelope.result;
-            source = "vendor_envelope";
-        }
-    }
-    catch {
-        // Retain unstructured output without treating it as native authority.
-    }
-    return { ...result, text, failureEvidence: observeSpawnFailure(raw, text, source) };
-}
-function normalizeClaudeTransportResult(raw) {
     if (raw.timedOut) {
         return {
             ok: false,

package/dist/core/workflow/spawn-codex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-codex.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAQH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAMhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAErE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,iBAAiB,CA6C9F;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAUvE;AA4CD,eAAO,MAAM,YAAY,EAAE,OA8B1B,CAAC"}
+{"version":3,"file":"spawn-codex.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAQH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAKhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAErE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,iBAAiB,CA6C9F;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAwCvE;AAED,eAAO,MAAM,YAAY,EAAE,OA8B1B,CAAC"}

package/dist/core/workflow/spawn-codex.js

@@ -24,7 +24,6 @@ import { exec } from "../../lib/exec.js";
 import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profiles.js";
 import { notFoundError } from "./adapters.js";
 import { buildChildEnv } from "./child-env.js";
-import { observeSpawnFailure } from "./failure-evidence.js";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.js";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
 export function buildCodexInvocation(req, resultFile) {
@@ -72,18 +71,6 @@ export function buildCodexInvocation(req, resultFile) {
     return { argv, resultFile };
 }
 export function normalizeCodexResult(raw) {
-    const result = normalizeCodexTransportResult(raw);
-    if (result.ok)
-        return result;
-    const finalText = raw.resultFileText?.trim();
-    const text = finalText || raw.stdout.trim();
-    return {
-        ...result,
-        text,
-        failureEvidence: observeSpawnFailure(raw, text, finalText ? "final_message" : "stdout"),
-    };
-}
-function normalizeCodexTransportResult(raw) {
     if (raw.timedOut) {
         return {
             ok: false,

package/dist/core/workflow/spawn-cursor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-cursor.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAMhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASrE,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAWA;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAsB1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAexE;AAyDD,eAAO,MAAM,aAAa,EAAE,OAkB3B,CAAC"}
+{"version":3,"file":"spawn-cursor.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAKhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASrE,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAWA;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAsB1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAqDxE;AAED,eAAO,MAAM,aAAa,EAAE,OAkB3B,CAAC"}

package/dist/core/workflow/spawn-cursor.js

@@ -22,7 +22,6 @@ import { exec } from "../../lib/exec.js";
 import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profiles.js";
 import { notFoundError } from "./adapters.js";
 import { buildChildEnv } from "./child-env.js";
-import { observeSpawnFailure } from "./failure-evidence.js";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.js";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
 /** Exported for unit tests (no live binary to test against). */
@@ -61,24 +60,6 @@ export function buildCursorInvocation(req) {
     return { argv };
 }
 export function normalizeCursorResult(raw) {
-    const result = normalizeCursorTransportResult(raw);
-    if (result.ok)
-        return result;
-    let text = raw.stdout;
-    let source = "stdout";
-    try {
-        const envelope = JSON.parse(raw.stdout);
-        if (typeof envelope.result === "string" && envelope.result.length > 0) {
-            text = envelope.result;
-            source = "vendor_envelope";
-        }
-    }
-    catch {
-        // Raw output remains evidence, not an inferred refusal or effect result.
-    }
-    return { ...result, text, failureEvidence: observeSpawnFailure(raw, text, source) };
-}
-function normalizeCursorTransportResult(raw) {
     if (raw.timedOut) {
         return {
             ok: false,

package/dist/core/workflow/spawn-opencode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-opencode.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-opencode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAMhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAQrE;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAoBA;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAoB5E;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAW1E;AA+CD,eAAO,MAAM,eAAe,EAAE,OAkB7B,CAAC"}
+{"version":3,"file":"spawn-opencode.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-opencode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAKhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAQrE;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAoBA;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAoB5E;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CA2C1E;AAED,eAAO,MAAM,eAAe,EAAE,OAkB7B,CAAC"}

package/dist/core/workflow/spawn-opencode.js

@@ -20,7 +20,6 @@ import { exec } from "../../lib/exec.js";
 import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profiles.js";
 import { notFoundError } from "./adapters.js";
 import { buildChildEnv } from "./child-env.js";
-import { observeSpawnFailure } from "./failure-evidence.js";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.js";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
 /**
@@ -73,19 +72,6 @@ export function buildOpenCodeInvocation(req) {
     return { argv };
 }
 export function normalizeOpenCodeResult(raw) {
-    const result = normalizeOpenCodeTransportResult(raw);
-    if (result.ok)
-        return result;
-    const parsed = parseOpenCodeStream(raw.stdout);
-    const text = parsed.text || raw.stdout.trim();
-    return {
-        ...result,
-        text,
-        sessionId: parsed.sessionId,
-        failureEvidence: observeSpawnFailure(raw, text, parsed.text ? "vendor_envelope" : "stdout"),
-    };
-}
-function normalizeOpenCodeTransportResult(raw) {
     if (raw.timedOut) {
         return {
             ok: false,

package/dist/core/workflow/types.d.ts

@@ -103,12 +103,11 @@ export interface WorkflowAgentProof {
     session_id?: string;
     result?: ResultDigest;
     error?: string;
-    /** Failed-spawn transport class. It is retained even when a script swallows
-     * the rejection; charging additionally requires validated failure evidence. */
+    /** Set on a failed agent whose spawn was classified uninformative about the
+     * work (ADR 0046): environment (binary absent) or upstream (vendor refused).
+     * Absent ⇒ a work failure. Recorded even when a script's parallel() swallows
+     * the rejection, so the run-level class can still be derived from proof. */
     class?: SpawnFailureClass;
-    /** Failure observations carried from the adapter. Missing observations are
-     * unknown and cannot authorize an uncharged attempt. */
-    failure_evidence?: SpawnFailureEvidence;
     /** Which vendor sandbox mode this agent launched with and why (ADR 0192).
      * Absent on a cached agent, which launched nothing. */
     access?: WorkerAccessDecision;
@@ -310,16 +309,15 @@ export interface WorkflowSpecialistProfile {
     maxTurns?: number;
 }
 /**
- * The positively identified transport cause of a failed spawn (ADR 0046).
- * This class alone proves neither absence of effects nor retry eligibility.
+ * Why a failed run was uninformative about the work (ADR 0046). Absent means
+ * the attempt produced information about the work (or succeeded), which is the
+ * default and is charged against the attempt budget exactly as before.
  *
  * - `environment`: the run never started — a precondition was missing (the
- *   vendor binary was absent). With positive no-effect/output evidence it is
- *   uncharged and not retried: retrying an unchanged
+ *   vendor binary was absent). Uncharged AND not retried: retrying an unchanged
  *   environment cannot help, so the work item stops and names the precondition.
  * - `upstream`: the vendor was reached and refused (5xx, 429, circuit open).
- *   Retry/free-attempt eligibility also requires positive no-effect evidence,
- *   observed absent output, and no refusal. Unsupported evidence stays unknown.
+ *   Uncharged, but retry stays available (bounded by max_uncharged_attempts).
  */
 export type SpawnFailureClass = "environment" | "upstream";
 /**
@@ -339,43 +337,6 @@ export type SpawnFailureClass = "environment" | "upstream";
  * waiting for is a person who was never told.
  */
 export type RunFailureClass = SpawnFailureClass | "decision";
-/** Positive claims name the observation that supports them. A transport error
- * or an empty reply is never evidence that no effects occurred. */
-export type SpawnEffectEvidence = {
-    state: "unknown";
-} | {
-    state: "none";
-    source: "spawn_errno";
-    reference: "ENOENT";
-} | {
-    state: "none" | "observed";
-    source: "adapter_evidence";
-    reference: string;
-};
-export type SpawnRefusalEvidence = {
-    state: "unknown";
-} | {
-    state: "refused";
-    source: "vendor_envelope";
-    reference: string;
-};
-export type SpawnOutputSource = "final_message" | "vendor_envelope" | "stdout";
-export type SpawnPartialOutputEvidence = {
-    state: "unknown";
-} | {
-    state: "absent";
-    source: SpawnOutputSource;
-} | {
-    state: "present";
-    source: SpawnOutputSource;
-    bytes: number;
-    sha256: string;
-};
-export interface SpawnFailureEvidence {
-    effect: SpawnEffectEvidence;
-    refusal: SpawnRefusalEvidence;
-    partial_output: SpawnPartialOutputEvidence;
-}
 /** What a spawn adapter returns for one subagent run. */
 export interface SpawnResult {
     ok: boolean;
@@ -387,13 +348,9 @@ export interface SpawnResult {
     durationMs: number;
     /** Populated when ok=false. */
     error?: string;
-    /** Transport classification when ok=false; never sufficient by itself to
-     * grant free work or automatic redispatch. */
+    /** Set when ok=false and the failure was positively identified as
+     * uninformative about the work. Absent ⇒ a work failure (charged). */
     class?: SpawnFailureClass;
-    /** Transport classification alone grants neither a retry nor free work.
-     * Absent evidence is explicitly unknown. Positive adapter_evidence claims
-     * require a documented producer observation, never an HTTP/text heuristic. */
-    failureEvidence?: SpawnFailureEvidence;
 }
 export interface SpawnRequest {
     prompt: string;