intentdna 1.4.2 → 1.4.4

package/.claude-plugin/hooks/hooks.json

@@ -1,12 +1,12 @@
 {
   "hooks": {
-    "PreToolUse": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook PreToolUse", "timeout": 5000 }] }],
-    "PostToolUse": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook PostToolUse", "timeout": 3000 }] }],
-    "UserPromptSubmit": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook UserPromptSubmit", "timeout": 5000 }] }],
-    "SubagentStop": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook SubagentStop", "timeout": 3000 }] }],
-    "PreCompact": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook PreCompact", "timeout": 3000 }] }],
-    "Notification": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook Notification", "timeout": 3000 }] }],
-    "Stop": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook Stop", "timeout": 3000 }] }],
-    "SessionStart": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook SessionStart", "timeout": 5000 }] }]
+    "PreToolUse": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook PreToolUse", "timeout": 5 }] }],
+    "PostToolUse": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook PostToolUse", "timeout": 3 }] }],
+    "UserPromptSubmit": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook UserPromptSubmit", "timeout": 5 }] }],
+    "SubagentStop": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook SubagentStop", "timeout": 3 }] }],
+    "PreCompact": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook PreCompact", "timeout": 3 }] }],
+    "Notification": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook Notification", "timeout": 3 }] }],
+    "Stop": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook Stop", "timeout": 3 }] }],
+    "SessionStart": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook SessionStart", "timeout": 5 }] }]
   }
 }

package/.claude-plugin/marketplace.json

@@ -9,8 +9,8 @@
     {
       "name": "intentdna",
       "description": "DNA template compilation + runtime enforcement",
-      "version": "1.4.1",
-      "source": "./.claude-plugin"
+      "version": "1.4.4",
+      "source": "./"
     }
   ]
 }

package/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "intentdna",
-  "version": "0.6.0",
+  "version": "1.4.4",
   "description": "Declarative policy layer for AI agent governance"
 }

package/dist/cli/commands/generate.d.ts

@@ -0,0 +1,16 @@
+/**
+ * dna generate <description> [--output <path>] [--match]
+ *
+ * Generate a DNA config from a natural language description.
+ *
+ * Modes:
+ *   Default:  Output a generation prompt (spec + description) for LLM use
+ *   --match:  Score templates against description, recommend best match
+ *   --output: Write generated prompt to file (default: stdout)
+ */
+export interface GenerateOptions {
+    description: string;
+    output?: string;
+    match?: boolean;
+}
+export declare function runGenerate(opts: GenerateOptions): Promise<number>;

package/dist/cli/commands/generate.js

@@ -0,0 +1,151 @@
+/**
+ * dna generate <description> [--output <path>] [--match]
+ *
+ * Generate a DNA config from a natural language description.
+ *
+ * Modes:
+ *   Default:  Output a generation prompt (spec + description) for LLM use
+ *   --match:  Score templates against description, recommend best match
+ *   --output: Write generated prompt to file (default: stdout)
+ */
+import { readFile, writeFile } from "node:fs/promises";
+import { resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+const SPEC_PATH = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "spec", "schema-spec.md");
+const TEMPLATES_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..", "templates");
+/** Keyword → template name mapping for scoring */
+const TEMPLATE_KEYWORDS = {
+    "code-review-pipeline": ["review", "code review", "pr review", "pull request", "审查"],
+    "safe-refactoring": ["refactor", "refactoring", "restructure", "rewrite safely", "重构"],
+    "tdd-strict": ["tdd", "test driven", "test first", "red green", "测试驱动"],
+    "full-pipeline": ["pipeline", "plan implement test", "full workflow", "完整流水线"],
+    "systematic-debugging": ["debug", "debugging", "bug fix", "troubleshoot", "调试"],
+    "verification-loop": ["verify", "verification", "validate", "check", "验证"],
+    "secure-dev": ["security", "secure", "owasp", "vulnerability", "安全"],
+    "enterprise-baseline": ["enterprise", "organization", "company", "corporate", "企业"],
+    "frontend-quality": ["frontend", "react", "vue", "css", "ui", "前端"],
+    "api-backend": ["api", "backend", "rest", "graphql", "server", "后端"],
+    "mobile-dev": ["mobile", "ios", "android", "react native", "移动"],
+    "documentation-writer": ["doc", "documentation", "readme", "wiki", "文档"],
+    "devops-cicd": ["devops", "ci", "cd", "deploy", "pipeline", "运维"],
+    "monorepo-governance": ["monorepo", "workspace", "packages", "governance"],
+    "flutter-behavior-lock": ["flutter", "behavior lock", "behavior spec", "行为锁定"],
+    "flutter-rewrite": ["flutter", "rewrite", "migration", "flutter rewrite"],
+    "flutter-refactoring-rescue": ["flutter", "rescue", "refactoring rescue"],
+    "multi-perspective-review": ["multi perspective", "multiple reviewer", "多角度"],
+    "subagent-parallel": ["parallel", "subagent", "concurrent", "并行"],
+    "yolo-with-guardrails": ["yolo", "fast", "guardrails", "move fast"],
+    "brainstorming-first": ["brainstorm", "explore", "ideation", "探索"],
+    "branch-finishing": ["branch", "finish", "cleanup", "pr prep"],
+    "pr-submitter": ["pr", "pull request", "submit"],
+};
+function scoreTemplates(description) {
+    const lower = description.toLowerCase();
+    const scores = [];
+    for (const [template, keywords] of Object.entries(TEMPLATE_KEYWORDS)) {
+        const matched = [];
+        for (const kw of keywords) {
+            if (lower.includes(kw)) {
+                matched.push(kw);
+            }
+        }
+        if (matched.length > 0) {
+            scores.push({
+                name: template,
+                displayName: template.replace(/-/g, " "),
+                score: matched.length,
+                matchedKeywords: matched,
+            });
+        }
+    }
+    return scores.sort((a, b) => b.score - a.score);
+}
+// ── Prompt Generation ─────────────────────────────────────
+function buildPrompt(description, spec) {
+    return `# DNA Config Generation Request
+
+## Your Scenario
+${description}
+
+## Instructions
+Generate a valid Intent DNA config in YAML format based on the scenario above.
+Follow the schema specification below exactly. Output ONLY the YAML config, no explanation.
+
+Requirements:
+1. Include all required fields (version, id, name, type, cascade, genes, contexts)
+2. Use \`cascade.inherits: ["species:default"]\` unless standalone
+3. Add a \`namespace\` if defining roles or workflows (2-8 lowercase chars)
+4. Define genes with descriptive codons (attract/repel/threshold/weight/sense)
+5. Define roles with appropriate tool_permissions and scope if the scenario needs agents
+6. Define a workflow if the scenario describes a multi-step process
+7. Use handoff artifacts with paths for artifact flow between steps
+8. Add variables for any project-specific values (use \`{{var}}\` syntax)
+
+## Schema Specification
+
+${spec}
+`;
+}
+// ── Main ──────────────────────────────────────────────────
+export async function runGenerate(opts) {
+    const { description } = opts;
+    if (!description || description.trim().length === 0) {
+        process.stderr.write("Usage: dna generate <description> [--output <path>] [--match]\n");
+        process.stderr.write("\nExamples:\n");
+        process.stderr.write('  dna generate "Flutter app with behavior locking and code review"\n');
+        process.stderr.write('  dna generate "Secure API backend with TDD" --match\n');
+        process.stderr.write('  dna generate "Enterprise security baseline" --output .dna/prompt.md\n');
+        return 2;
+    }
+    // Match mode: score templates and recommend
+    if (opts.match) {
+        const scores = scoreTemplates(description);
+        if (scores.length === 0) {
+            process.stderr.write("No matching templates found.\n");
+            process.stderr.write("Use without --match to generate a custom config prompt.\n");
+            process.stderr.write("Or list templates: dna init --template list\n");
+            return 0;
+        }
+        process.stderr.write("Template matches (ranked):\n\n");
+        for (const s of scores.slice(0, 5)) {
+            const stars = "*".repeat(Math.min(s.score, 5));
+            process.stderr.write(`  ${stars.padEnd(5)}  ${s.name}\n`);
+            process.stderr.write(`         matched: ${s.matchedKeywords.join(", ")}\n`);
+        }
+        const best = scores[0];
+        process.stderr.write(`\nRecommended: dna init --template ${best.name}\n`);
+        return 0;
+    }
+    // Default mode: generate prompt with spec
+    let spec;
+    try {
+        spec = await readFile(SPEC_PATH, "utf-8");
+    }
+    catch {
+        // Fallback: try from installed package location
+        const altPath = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "..", "spec", "schema-spec.md");
+        try {
+            spec = await readFile(altPath, "utf-8");
+        }
+        catch {
+            process.stderr.write("Schema spec not found. Run from project root or install intentdna globally.\n");
+            return 1;
+        }
+    }
+    const prompt = buildPrompt(description, spec);
+    if (opts.output) {
+        try {
+            await writeFile(opts.output, prompt, "utf-8");
+        }
+        catch (err) {
+            process.stderr.write(`Error writing to ${opts.output}: ${err instanceof Error ? err.message : String(err)}\n`);
+            return 1;
+        }
+        process.stderr.write(`Generation prompt written to ${opts.output}\n`);
+        process.stderr.write(`Use with: cat ${opts.output} | claude --print\n`);
+    }
+    else {
+        process.stdout.write(prompt);
+    }
+    return 0;
+}

package/dist/cli/commands/verify.js

@@ -150,21 +150,67 @@ async function runStats() {
             process.stderr.write(`  ${wf}: ${list.length} tool calls, ${steps.size} steps, ${blocks} blocks\n`);
         }
     }
-    // Block reasons TOP 3
+    // Block reasons TOP 3 — use actual reason text when available
     const blockEntries = entries.filter(e => e.decision === "block");
     if (blockEntries.length > 0) {
         const reasons = new Map();
         for (const e of blockEntries) {
-            const key = `${e.event}:${e.tool_name ?? "unknown"}`;
+            const key = e.reason
+                ? `${e.event}: ${truncate(e.reason, 70)}`
+                : `${e.event}:${e.tool_name ?? "unknown"}`;
             reasons.set(key, (reasons.get(key) ?? 0) + 1);
         }
-        const sorted = [...reasons.entries()].sort((a, b) => b[1] - a[1]).slice(0, 3);
-        process.stderr.write("\nBlock reasons TOP 3:\n");
+        const sorted = [...reasons.entries()].sort((a, b) => b[1] - a[1]).slice(0, 5);
+        process.stderr.write("\nBlock reasons TOP 5:\n");
         let rank = 0;
         for (const [reason, count] of sorted) {
             rank++;
-            process.stderr.write(`  ${rank}. ${reason} x ${count}\n`);
+            process.stderr.write(`  ${rank}. [x${count}] ${reason}\n`);
+        }
+    }
+    // Blocked paths — aggregate target_path for blocks
+    const blockedPaths = blockEntries.filter(e => e.target_path);
+    if (blockedPaths.length > 0) {
+        const pathCounts = new Map();
+        for (const e of blockedPaths) {
+            pathCounts.set(e.target_path, (pathCounts.get(e.target_path) ?? 0) + 1);
+        }
+        const sorted = [...pathCounts.entries()].sort((a, b) => b[1] - a[1]).slice(0, 5);
+        process.stderr.write("\nBlocked paths TOP 5:\n");
+        for (const [path, count] of sorted) {
+            process.stderr.write(`  [x${count}] ${path}\n`);
+        }
+    }
+    // Role activity — agent_type distribution
+    const withAgent = entries.filter(e => e.agent_type);
+    if (withAgent.length > 0) {
+        const roleCounts = new Map();
+        for (const e of withAgent) {
+            const role = e.agent_type;
+            const stats = roleCounts.get(role) ?? { total: 0, blocks: 0, warns: 0 };
+            stats.total++;
+            if (e.decision === "block")
+                stats.blocks++;
+            if (e.decision === "warn")
+                stats.warns++;
+            roleCounts.set(role, stats);
+        }
+        process.stderr.write("\nRole activity:\n");
+        const sorted = [...roleCounts.entries()].sort((a, b) => b[1].total - a[1].total);
+        for (const [role, stats] of sorted) {
+            const parts = [`${stats.total} calls`];
+            if (stats.blocks > 0)
+                parts.push(`${stats.blocks} blocks`);
+            if (stats.warns > 0)
+                parts.push(`${stats.warns} warns`);
+            process.stderr.write(`  ${role.padEnd(30)} ${parts.join(", ")}\n`);
         }
     }
     return 0;
 }
+/** Truncate string to max length with ellipsis */
+function truncate(s, max) {
+    if (s.length <= max)
+        return s;
+    return s.slice(0, max - 3) + "...";
+}

package/dist/cli/index.js

@@ -23,6 +23,7 @@ Commands:
   verify        Verify synced files match .dna/lock checksums (drift detection)
   run           Execute a workflow directly (TypeScript runtime)
   init          Create a new DNA file interactively
+  generate      Generate DNA config from natural language description
   compile       Compile DNA files to framework configuration
   validate      Validate DNA files for correctness
   show          Show gene expression state
@@ -41,6 +42,8 @@ Examples:
   dna init --template flutter-rewrite Create DNA config from template
   dna init --template list            List all available templates with namespaces
   dna init --register my.dna.yaml     Register a custom template (checks namespace uniqueness)
+  dna generate "Flutter app with behavior locking"  Generate config prompt with schema spec
+  dna generate "Secure API backend" --match         Find matching templates
   dna sync                            Auto-detect .dna/config.yaml + environment, sync all
   dna sync .dna/config.yaml --target claude-md --inject CLAUDE.md --context work
   dna sync my.dna.json --target claude-md --inject CLAUDE.md --hooks .claude/hooks
@@ -240,6 +243,25 @@ async function main() {
             process.exit(code);
             break;
         }
+        case "generate": {
+            const { values: genValues, positionals: genPositionals } = parseArgs({
+                args: rest,
+                options: {
+                    output: { type: "string", short: "o" },
+                    match: { type: "boolean", default: false },
+                },
+                allowPositionals: true,
+                strict: false,
+            });
+            const { runGenerate } = await import("./commands/generate.js");
+            const code = await runGenerate({
+                description: genPositionals.join(" "),
+                output: genValues.output,
+                match: genValues.match,
+            });
+            process.exit(code);
+            break;
+        }
         case "show": {
             const { values, positionals } = parseArgs({
                 args: rest,

package/dist/compiler/workflow.d.ts

@@ -5,10 +5,12 @@
  * Performs topological sort, parallel group detection, transition compilation,
  * retry config resolution, cycle detection, and optional Mermaid diagram generation.
  */
-import type { WorkflowDef, WorkflowPlan } from "../schema/types.js";
+import type { WorkflowDef, WorkflowPlan, RoleDef } from "../schema/types.js";
 export interface CompileWorkflowOptions {
     /** Generate Mermaid diagram (default: false) */
     mermaid?: boolean;
+    /** Roles for scope overlap analysis (needed for isolation: auto) */
+    roles?: Record<string, RoleDef>;
 }
 export interface CompileWorkflowError {
     path: string;
@@ -19,6 +21,12 @@ export interface CompileWorkflowResult {
     plan?: WorkflowPlan;
     errors: CompileWorkflowError[];
 }
+/**
+ * Check if two sets of write glob patterns have overlapping scope.
+ * Uses prefix-based matching: "src/xx" and "src/lib/xx" overlap.
+ * Wildcard-only patterns are treated as overlapping with everything.
+ */
+export declare function hasWriteScopeOverlap(scopeA: string[], scopeB: string[]): boolean;
 /**
  * Compile a WorkflowDef into an executable WorkflowPlan.
  *

package/dist/compiler/workflow.js

@@ -78,6 +78,9 @@ function topologicalSort(steps, graph) {
         groups.push({
             group_index: groupIndex,
             step_ids: [...queue],
+            isolation: "none",
+            merge_strategy: "escalate",
+            scope_overlap: false,
         });
         groupIndex++;
         const nextQueue = [];
@@ -211,6 +214,100 @@ function generateMermaid(plan) {
     return lines.join("\n");
 }
 // ── Public API ───────────────────────────────────────────────
+/**
+ * Check if two sets of write glob patterns have overlapping scope.
+ * Uses prefix-based matching: "src/xx" and "src/lib/xx" overlap.
+ * Wildcard-only patterns are treated as overlapping with everything.
+ */
+export function hasWriteScopeOverlap(scopeA, scopeB) {
+    if (scopeA.length === 0 || scopeB.length === 0)
+        return false;
+    const prefixesA = scopeA.map(globToPrefix);
+    const prefixesB = scopeB.map(globToPrefix);
+    for (const a of prefixesA) {
+        for (const b of prefixesB) {
+            // Empty prefix = root glob ("**/*") — overlaps with everything
+            if (a.length === 0 || b.length === 0)
+                return true;
+            // Check mutual prefix containment
+            if (a.startsWith(b) || b.startsWith(a))
+                return true;
+        }
+    }
+    return false;
+}
+/** Extract directory prefix from a glob (same logic as enforce.ts) */
+function globToPrefix(glob) {
+    const starIdx = glob.indexOf("*");
+    if (starIdx === -1)
+        return glob;
+    return glob.substring(0, starIdx);
+}
+/**
+ * Resolve isolation mode for each parallel group.
+ *
+ * Resolution order: step.isolation > workflow.default_isolation > "none"
+ * For "auto" mode: check write scope overlap between roles in the group.
+ */
+function resolveGroupIsolation(groups, workflow, stepMap, roles) {
+    const defaultIsolation = workflow.default_isolation ?? "none";
+    const mergeStrategy = workflow.merge_strategy ?? "escalate";
+    for (const group of groups) {
+        group.merge_strategy = mergeStrategy;
+        // Single-step groups always use "none" (no parallelism to isolate)
+        if (group.step_ids.length <= 1) {
+            group.isolation = "none";
+            group.scope_overlap = false;
+            continue;
+        }
+        // Collect per-step isolation settings
+        const stepIsolations = group.step_ids.map(id => {
+            const step = stepMap.get(id);
+            return step?.isolation ?? defaultIsolation;
+        });
+        // If any step explicitly requires worktree, use worktree
+        if (stepIsolations.some(i => i === "worktree")) {
+            group.isolation = "worktree";
+            group.scope_overlap = true; // conservative
+            continue;
+        }
+        // If all steps are explicitly "none", use none
+        if (stepIsolations.every(i => i === "none")) {
+            group.isolation = "none";
+            group.scope_overlap = false;
+            continue;
+        }
+        // Auto mode: check scope overlap
+        const hasAuto = stepIsolations.some(i => i === "auto");
+        if (hasAuto && roles) {
+            const writeScopes = group.step_ids.map(id => {
+                const step = stepMap.get(id);
+                const role = step ? roles[step.role] : undefined;
+                return role?.scope?.write ?? [];
+            });
+            // Check pairwise overlap
+            let overlap = false;
+            for (let i = 0; i < writeScopes.length && !overlap; i++) {
+                for (let j = i + 1; j < writeScopes.length && !overlap; j++) {
+                    if (hasWriteScopeOverlap(writeScopes[i], writeScopes[j])) {
+                        overlap = true;
+                    }
+                }
+            }
+            group.scope_overlap = overlap;
+            group.isolation = overlap ? "worktree" : "none";
+        }
+        else if (hasAuto) {
+            // Auto without roles — conservative default to worktree
+            group.isolation = "worktree";
+            group.scope_overlap = true;
+        }
+        else {
+            group.isolation = "none";
+            group.scope_overlap = false;
+        }
+    }
+}
 /**
  * Compile a WorkflowDef into an executable WorkflowPlan.
  *
@@ -248,13 +345,18 @@ export function compileWorkflow(workflow, options) {
         });
         return { ok: false, errors };
     }
-    // 5. Compile transitions
+    // 5. Resolve isolation for parallel groups
+    const stepMap = new Map();
+    for (const s of resolvedSteps)
+        stepMap.set(s.id, s);
+    resolveGroupIsolation(groups, workflow, stepMap, options?.roles);
+    // 6. Compile transitions
     const { defaults, explicit } = compileTransitions(workflow, groups);
-    // 6. Resolve retry config
+    // 7. Resolve retry config
     const retry = resolveRetryConfig(workflow);
-    // 7. Build WorkflowStep[] from sorted steps
+    // 8. Build WorkflowStep[] from sorted steps
     const compiledSteps = sorted.map(toWorkflowStep);
-    // 8. Construct the plan
+    // 9. Construct the plan
     const plan = {
         name: workflow.name,
         description: workflow.description ?? "",
@@ -267,7 +369,7 @@ export function compileWorkflow(workflow, options) {
         compiled_at: new Date().toISOString(),
         source_workflow: workflow.name,
     };
-    // 9. Optional Mermaid diagram
+    // 10. Optional Mermaid diagram
     if (options?.mermaid) {
         plan.mermaid = generateMermaid(plan);
     }

package/dist/hooks/cli.js

@@ -14,7 +14,7 @@
  *
  * Fail-open: all errors → { continue: true, suppressOutput: true }
  */
-import { readFile } from "node:fs/promises";
+import { readFile, stat } from "node:fs/promises";
 import { resolve } from "node:path";
 import { randomUUID } from "node:crypto";
 import { readStdin, writeOutput, silentOutput } from "./protocol.js";
@@ -62,6 +62,9 @@ async function main() {
                 workflow: wfState.workflow,
                 completed_artifacts: wfState.completed_artifacts,
             };
+            // Re-run fallback: scan consumed artifact paths on disk so
+            // enforceHandoffConsumes can skip blocks for files that already exist.
+            state.existingArtifactPaths = await scanConsumedArtifactPaths(projectDir, ir, wfState.workflow, wfState.current_step);
         }
     }
     // Special handling for Stop — needs async workflow state read
@@ -102,6 +105,10 @@ async function main() {
     const decision = output.continue === false ? "block"
         : output.hookSpecificOutput?.additionalContext?.startsWith("WARN") ? "warn"
             : "allow";
+    // Extract target file path from tool_input (Write/Edit/Read)
+    const toolInput = typeof rawInput.tool_input === "object" && rawInput.tool_input !== null
+        ? rawInput.tool_input : undefined;
+    const targetPath = typeof toolInput?.file_path === "string" ? toolInput.file_path : undefined;
     appendTrace(projectDir, {
         trace_id: randomUUID(),
         event,
@@ -110,6 +117,8 @@ async function main() {
         workflow: state.workflowState?.workflow,
         step: state.workflowState?.current_step,
         decision: decision,
+        reason: decision !== "allow" ? output.reason : undefined,
+        target_path: decision !== "allow" ? targetPath : undefined,
         duration_ms: durationMs,
         timestamp: new Date().toISOString(),
     }).catch(() => { }); // Fail-open
@@ -193,6 +202,36 @@ async function loadIR(irPath) {
         return null;
     }
 }
+// ── Artifact Scanning ─────────────────────────────────────
+/**
+ * Check consumed artifact paths on disk for the current workflow step.
+ * Returns a Set of artifact paths that exist, enabling re-run idempotency
+ * (prior run's output files satisfy the current step's consumes).
+ */
+async function scanConsumedArtifactPaths(projectDir, ir, workflowName, currentStep) {
+    const paths = new Set();
+    if (!ir.workflows_ir)
+        return paths;
+    const activeWf = ir.workflows_ir.find(w => w.workflow_name === workflowName);
+    if (!activeWf)
+        return paths;
+    const entry = activeWf.handoff_chain.find(h => h.step_id === currentStep);
+    if (!entry?.consumes)
+        return paths;
+    for (const consumed of entry.consumes) {
+        if (!consumed.path)
+            continue;
+        const fullPath = resolve(projectDir, consumed.path);
+        try {
+            await stat(fullPath);
+            paths.add(consumed.path);
+        }
+        catch {
+            // File doesn't exist — not an error, just means artifact not available
+        }
+    }
+    return paths;
+}
 // ── Entry Point ────────────────────────────────────────────
 main().catch(() => {
     // Fail-open: never block Claude Code on unexpected errors

package/dist/hooks/enforce.d.ts

@@ -28,6 +28,9 @@ export interface EnforceState {
         workflow: string;
         completed_artifacts?: CompletedArtifactEntry[];
     };
+    /** Artifact paths that exist on disk — fallback for re-run idempotency.
+     *  CLI checks disk, passes paths here so enforce stays pure (no I/O). */
+    existingArtifactPaths?: Set<string>;
 }
 /**
  * Enforce PreToolUse constraints.

package/dist/hooks/enforce.js

@@ -48,7 +48,7 @@ export function enforcePreToolUse(ir, input, state, roles) {
     }
     // Layer 6: Handoff — check consumed artifacts are available
     if (state?.workflowState && ir.workflows_ir) {
-        const result = enforceHandoffConsumes(ir, state.workflowState);
+        const result = enforceHandoffConsumes(ir, state.workflowState, state.existingArtifactPaths);
         if (result)
             return result;
     }
@@ -266,7 +266,7 @@ export function enforceStop(ir, input, workflowState) {
  * artifacts have been produced by a preceding step.
  * Returns block output if a required artifact is missing, null if all satisfied.
  */
-function enforceHandoffConsumes(ir, wfState) {
+function enforceHandoffConsumes(ir, wfState, existingPaths) {
     const activeWf = ir.workflows_ir?.find(w => w.workflow_name === wfState.workflow);
     if (!activeWf || activeWf.handoff_chain.length === 0)
         return null;
@@ -280,6 +280,11 @@ function enforceHandoffConsumes(ir, wfState) {
         const producer = activeWf.handoff_chain.find(h => h.produces?.some(p => p.type === consumed.type && ((p.path && consumed.path && p.path === consumed.path) ||
             (consumed.from && h.step_id === consumed.from))));
         if (producer && !completedStepIds.has(producer.step_id)) {
+            // Re-run fallback: if the consumed artifact file exists on disk
+            // (from a prior run), treat the dependency as satisfied.
+            if (consumed.path && existingPaths?.has(consumed.path)) {
+                continue;
+            }
             return blockOutput(`[Intent DNA] Step '${wfState.current_step}' requires artifact from step '${producer.step_id}' (${consumed.description}). Run step '${producer.step_id}' first.`);
         }
     }

package/dist/hooks/state.d.ts

@@ -71,6 +71,8 @@ export interface TraceEntry {
     workflow?: string;
     step?: string;
     decision: "allow" | "block" | "warn";
+    reason?: string;
+    target_path?: string;
     duration_ms: number;
     timestamp: string;
 }

package/dist/schema/types.d.ts

@@ -139,6 +139,7 @@ export interface WorkflowStepDef {
     completion?: CompletionCheck[];
     checkpoints?: StepCheckpoint[];
     handoff?: StepHandoff;
+    isolation?: "none" | "worktree" | "auto";
 }
 /** Top-level workflow definition */
 export interface WorkflowDef {
@@ -150,6 +151,8 @@ export interface WorkflowDef {
     max_rounds?: number;
     produces?: HandoffArtifact[];
     consumes?: HandoffArtifact[];
+    default_isolation?: "none" | "worktree" | "auto";
+    merge_strategy?: "escalate";
 }
 export interface EpigeneticEffect {
     gene?: string;
@@ -320,6 +323,9 @@ export interface WorkflowStep {
 export interface ParallelGroup {
     group_index: number;
     step_ids: string[];
+    isolation: "none" | "worktree";
+    merge_strategy: "escalate";
+    scope_overlap: boolean;
 }
 /** Compiled transition rule */
 export interface TransitionRule {