intentdna 1.5.16 → 1.5.18

package/dist/hooks/enforce.js

@@ -713,8 +713,9 @@ export function checkReflectionLimit(failCount, maxAttempts, handoffCount, maxHa
  * Pure function — no I/O.
  */
 export function checkContextReadiness(sessionReads, required) {
-    const readSet = new Set(sessionReads);
-    const missing = required.filter(f => !readSet.has(f));
+    const normalizePath = (value) => normalize(value);
+    const readSet = new Set(sessionReads.map(normalizePath));
+    const missing = required.filter((f) => !readSet.has(normalizePath(f)));
     return { ready: missing.length === 0, missing };
 }
 // ── Workflow Boundary Gate ────────────────────────────────────

package/dist/hooks/state.d.ts

@@ -9,7 +9,7 @@
  * All read operations are fail-safe (return null on error, never throw).
  * All write operations use atomic temp+rename pattern.
  */
-import type { CompletedArtifactEntry } from "../schema/types.js";
+import type { CompletedArtifactEntry, VerifierKind, VerifierSeverity, VerifierWhen } from "../schema/types.js";
 /** Workflow state written by runtime and read by hooks */
 export interface DNAWorkflowState {
     active: boolean;
@@ -115,6 +115,25 @@ export declare function writeSessionReads(projectDir: string, state: SessionRead
  * @deprecated Prefer `DNAStateManager.appendSessionRead()`.
  */
 export declare function appendSessionRead(projectDir: string, filePath: string, sessionId?: string): Promise<void>;
+export interface VerifierResultEntry {
+    verifier_id: string;
+    when: VerifierWhen;
+    severity: VerifierSeverity;
+    kind: VerifierKind;
+    workflow?: string;
+    step_id?: string;
+    source_genes?: string[];
+    status: "pass" | "fail";
+    target?: string;
+    evidence?: string;
+    exit_code?: number;
+    artifact?: string;
+    message?: string;
+    timestamp: string;
+}
+export declare function readVerifierResults(projectDir: string, sessionId?: string): Promise<VerifierResultEntry[]>;
+export declare function writeVerifierResults(projectDir: string, results: VerifierResultEntry[], sessionId?: string): Promise<void>;
+export declare function appendVerifierResult(projectDir: string, result: VerifierResultEntry, sessionId?: string): Promise<void>;
 /** Trace entry for hook call observability */
 export interface TraceEntry {
     trace_id: string;

package/dist/hooks/state.js

@@ -214,6 +214,61 @@ export async function appendSessionRead(projectDir, filePath, sessionId) {
         await writeSessionReads(projectDir, state, sessionId);
     }
 }
+const VERIFIER_RESULTS_FILE = "workflow/verifier-results.json";
+async function readVerifierResultsFile(projectDir, sessionId) {
+    const stateDir = resolveStateDir(projectDir, sessionId);
+    const filePath = join(stateDir, VERIFIER_RESULTS_FILE);
+    try {
+        const raw = await readFile(filePath, "utf-8");
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}
+function verifierResultKey(result) {
+    return [
+        result.verifier_id,
+        result.when,
+        result.severity,
+        result.kind,
+        result.workflow ?? "",
+        result.step_id ?? "",
+        result.status,
+        result.target ?? "",
+        result.timestamp,
+    ].join("|");
+}
+export async function readVerifierResults(projectDir, sessionId) {
+    if (sessionId) {
+        return readVerifierResultsFile(projectDir, sessionId);
+    }
+    const sessions = await listSessions(projectDir);
+    const all = await readVerifierResultsFile(projectDir);
+    for (const id of sessions) {
+        const results = await readVerifierResultsFile(projectDir, id);
+        all.push(...results);
+    }
+    const seen = new Set();
+    return all.filter((result) => {
+        const key = verifierResultKey(result);
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    }).sort((a, b) => a.timestamp.localeCompare(b.timestamp));
+}
+export async function writeVerifierResults(projectDir, results, sessionId) {
+    const stateDir = resolveStateDir(projectDir, sessionId);
+    const filePath = join(stateDir, VERIFIER_RESULTS_FILE);
+    await atomicWrite(filePath, JSON.stringify(results, null, 2));
+}
+export async function appendVerifierResult(projectDir, result, sessionId) {
+    const results = await readVerifierResultsFile(projectDir, sessionId);
+    results.push(result);
+    await writeVerifierResults(projectDir, results, sessionId);
+}
 const TRACE_DIR = "trace";
 const MAX_TRACE_SIZE = 10 * 1024 * 1024; // 10MB
 const TRACE_RETENTION_DAYS = 7;

package/dist/runtime/markdown.d.ts

@@ -13,7 +13,7 @@
  *   <!-- intentdna:end -->
  */
 import type { ConstraintIR } from "../schema/types.js";
-export type MarkdownTarget = "claude-md" | "soul-md" | "cursorrules" | "system-prompt";
+export type MarkdownTarget = "claude-md" | "soul-md" | "cursorrules" | "system-prompt" | "agents-md";
 /**
  * Compile Constraint IR to a markdown block suitable for the target format.
  */

package/dist/runtime/markdown.js

@@ -28,6 +28,8 @@ export function compileToMarkdown(ir, target) {
             return renderCursorrules(ir);
         case "system-prompt":
             return renderSystemPrompt(ir);
+        case "agents-md":
+            return renderAgentsMd(ir);
     }
 }
 /**
@@ -191,6 +193,153 @@ function renderCursorrules(ir) {
     }
     return lines.join("\n");
 }
+function renderAgentsMd(ir) {
+    const lines = [];
+    const high = ir.prompt_directives.filter(d => d.priority === "high");
+    const med = ir.prompt_directives.filter(d => d.priority === "medium");
+    const low = ir.prompt_directives.filter(d => d.priority === "low");
+    lines.push("# Intent DNA — Codex Instructions");
+    lines.push("");
+    lines.push("Codex loads AGENTS.md at session start. After running `dna sync`, restart Codex so these instructions are reloaded.");
+    lines.push("These instructions are behavioral guidance; use Codex sandbox/config for deterministic enforcement.");
+    lines.push("");
+    if (ir.active_context) {
+        lines.push(`Active context: ${ir.active_context}`);
+        lines.push("");
+    }
+    if (high.length > 0) {
+        lines.push("## Critical Directives");
+        for (const d of high)
+            lines.push(`- ${d.text}`);
+        lines.push("");
+    }
+    if (med.length > 0) {
+        lines.push("## Standard Directives");
+        for (const d of med)
+            lines.push(`- ${d.text}`);
+        lines.push("");
+    }
+    if (low.length > 0) {
+        lines.push("## Preferences");
+        for (const d of low)
+            lines.push(`- ${d.text}`);
+        lines.push("");
+    }
+    if (ir.context_files || ir.legibility_assets) {
+        lines.push("## Required Context");
+        const files = collectContextFiles(ir);
+        if (files.length > 0) {
+            lines.push("Read these files before work that depends on project context:");
+            for (const file of files)
+                lines.push(`- ${file}`);
+        }
+        else {
+            lines.push("Follow any required-read assets declared by the active DNA.");
+        }
+        lines.push("");
+    }
+    if (ir.roles_scope_map && ir.roles_scope_map.length > 0) {
+        lines.push("## Role Boundaries");
+        for (const role of ir.roles_scope_map) {
+            lines.push(`- ${role.role_name}: read ${formatList(role.scope.read)}; write ${formatList(role.scope.write)}${formatToolPermissions(role.tool_permissions)}`);
+        }
+        lines.push("");
+    }
+    else if (ir.role_scope || ir.role_tool_permissions) {
+        lines.push("## Active Role Boundary");
+        if (ir.role_scope)
+            lines.push(`- Read: ${formatList(ir.role_scope.read)}`);
+        if (ir.role_scope)
+            lines.push(`- Write: ${formatList(ir.role_scope.write)}`);
+        if (ir.role_tool_permissions)
+            lines.push(`- Tools:${formatToolPermissions(ir.role_tool_permissions).replace(/^;/, "")}`);
+        lines.push("");
+    }
+    if (ir.pre_execution_gates.length > 0) {
+        lines.push("## Runtime Constraints");
+        for (const g of ir.pre_execution_gates) {
+            const action = g.action === "block" ? "must not" : g.action === "escalate" ? "ask first" : "warn";
+            lines.push(`- [${action}] ${g.message}`);
+        }
+        lines.push("");
+    }
+    if (ir.tool_filters.length > 0) {
+        lines.push("## Tool and Sandbox Guidance");
+        for (const f of ir.tool_filters)
+            lines.push(`- ${f.action}: ${f.target ?? f.reason} (${f.reason})`);
+        lines.push("- Prefer Codex `workspace-write` with `on-request` approvals for editable work; use `read-only` for planning/review.");
+        lines.push("");
+    }
+    if ((ir.workflows_ir && ir.workflows_ir.length > 0) || (ir.verifier_specs && ir.verifier_specs.length > 0)) {
+        lines.push("## Workflow and Verification Expectations");
+        for (const wf of ir.workflows_ir ?? []) {
+            lines.push(`- Workflow ${wf.workflow_name}: roles ${formatList(wf.active_roles)}.`);
+            for (const handoff of wf.handoff_chain ?? []) {
+                const produced = handoff.produces?.map(a => a.path ?? a.type).join(", ");
+                if (produced)
+                    lines.push(`  - Step ${handoff.step_id} should produce: ${produced}`);
+            }
+        }
+        for (const spec of ir.verifier_specs ?? []) {
+            const target = spec.checkpoint?.assert ?? spec.completion?.file_exists ?? spec.completion?.file_not_empty ?? spec.completion?.command_success ?? spec.id;
+            lines.push(`- Verify ${spec.when}/${spec.severity}: ${target}`);
+        }
+        lines.push("");
+    }
+    if (ir.post_execution_validators.length > 0) {
+        lines.push("## Post-Work Checks");
+        for (const v of ir.post_execution_validators)
+            lines.push(`- ${v.check}`);
+        lines.push("");
+    }
+    lines.push(`_Compiled: ${ir.compiled_at} | Sources: ${ir.source_dna_ids.join(", ")}_`);
+    return lines.join("\n");
+}
+function collectContextFiles(ir) {
+    const files = [];
+    const add = (file) => {
+        if (file && !files.includes(file))
+            files.push(file);
+    };
+    for (const file of ir.context_files?.mandatory ?? [])
+        add(file);
+    for (const roleFiles of Object.values(ir.context_files?.per_role ?? {})) {
+        for (const file of roleFiles)
+            add(file);
+    }
+    for (const workflowFiles of Object.values(ir.context_files?.per_workflow ?? {})) {
+        for (const file of workflowFiles)
+            add(file);
+    }
+    for (const asset of ir.legibility_assets?.mandatory ?? []) {
+        if (asset.type === "required_read")
+            add(asset.path);
+    }
+    for (const roleAssets of Object.values(ir.legibility_assets?.per_role ?? {})) {
+        for (const asset of roleAssets)
+            if (asset.type === "required_read")
+                add(asset.path);
+    }
+    for (const workflowAssets of Object.values(ir.legibility_assets?.per_workflow ?? {})) {
+        for (const asset of workflowAssets)
+            if (asset.type === "required_read")
+                add(asset.path);
+    }
+    return files;
+}
+function formatList(values) {
+    return values && values.length > 0 ? values.join(", ") : "none";
+}
+function formatToolPermissions(permissions) {
+    if (!permissions)
+        return "";
+    const parts = [];
+    if (permissions.allow?.length)
+        parts.push(`allow ${permissions.allow.join(", ")}`);
+    if (permissions.deny?.length)
+        parts.push(`deny ${permissions.deny.join(", ")}`);
+    return parts.length > 0 ? `; tools ${parts.join("; ")}` : "";
+}
 function renderSystemPrompt(ir) {
     const lines = [];
     lines.push("# Behavioral Guidelines");

package/dist/runtime/settings-adapter.d.ts

@@ -6,7 +6,7 @@
  *
  * See docs/references/cc-source-analysis.md §2 for the full hook event catalog.
  */
-export type HookEventKey = "preToolUse" | "postToolUse" | "userPromptSubmit" | "subagentStop" | "preCompact" | "notification";
+export type HookEventKey = "preToolUse" | "postToolUse" | "userPromptSubmit" | "subagentStop" | "preCompact" | "notification" | "stop";
 export interface SettingsHookEntry {
     matcher: string;
     hooks: Array<{
@@ -21,7 +21,8 @@ export interface DNASettings {
  * Compile settings.json hook configuration for dna-hook binary.
  * Uses `dna-hook <event>` commands.
  */
-export declare function compilePluginSettings(enabledEvents: HookEventKey[], timeout?: number): DNASettings;
+export declare function compilePluginSettings(enabledEvents: HookEventKey[], timeout?: number, timeouts?: Partial<Record<HookEventKey, number>>): DNASettings;
+export declare function recommendHookTimeouts(ir: import("../schema/types.js").ConstraintIR, baseTimeout?: number): Partial<Record<HookEventKey, number>>;
 /**
  * Determine which hook events are needed based on IR content.
  */

package/dist/runtime/settings-adapter.js

@@ -16,17 +16,19 @@ const HOOK_EVENT_MAP = {
     subagentStop: "SubagentStop",
     preCompact: "PreCompact",
     notification: "Notification",
+    stop: "Stop",
 };
 /**
  * Compile settings.json hook configuration for dna-hook binary.
  * Uses `dna-hook <event>` commands.
  */
-export function compilePluginSettings(enabledEvents, timeout = 10) {
+export function compilePluginSettings(enabledEvents, timeout = 10, timeouts) {
     const settings = { hooks: {} };
     for (const key of enabledEvents) {
         const eventName = HOOK_EVENT_MAP[key];
         if (!eventName)
             continue;
+        const eventTimeout = timeouts?.[key] ?? timeout;
         settings.hooks[eventName] = [
             {
                 matcher: "",
@@ -34,7 +36,7 @@ export function compilePluginSettings(enabledEvents, timeout = 10) {
                     {
                         type: "command",
                         command: `dna-hook ${eventName}`,
-                        ...(timeout > 0 ? { timeout } : {}),
+                        ...(eventTimeout > 0 ? { timeout: eventTimeout } : {}),
                     },
                 ],
             },
@@ -42,6 +44,20 @@ export function compilePluginSettings(enabledEvents, timeout = 10) {
     }
     return settings;
 }
+export function recommendHookTimeouts(ir, baseTimeout = 10) {
+    const timeouts = {};
+    const hasStopCommandVerifiers = ir.verifier_specs?.some((spec) => (spec.when === "stop" || spec.when === "pre_handoff" || spec.when === "post_step") &&
+        ((spec.kind === "checkpoint" && !!spec.checkpoint?.command) ||
+            (spec.kind === "completion" && !!spec.completion?.command_success) ||
+            spec.checkpoint?.assert === "build_passing" ||
+            spec.checkpoint?.assert === "lint_passing" ||
+            spec.checkpoint?.assert === "clean_working_tree" ||
+            spec.checkpoint?.assert === "no_test_regression")) ?? false;
+    if (hasStopCommandVerifiers) {
+        timeouts.stop = Math.max(baseTimeout, 45);
+    }
+    return timeouts;
+}
 /**
  * Determine which hook events are needed based on IR content.
  */
@@ -51,10 +67,13 @@ export function detectEnabledEvents(ir) {
     const hasFilters = ir.tool_filters.length > 0;
     const hasRoleScope = ir.roles_scope_map && ir.roles_scope_map.length > 0;
     const hasCheckpoints = ir.step_checkpoints && ir.step_checkpoints.length > 0;
+    const hasStopVerifiers = ir.verifier_specs?.some((spec) => spec.when === "stop" || spec.when === "pre_handoff" || spec.when === "post_step") ?? false;
+    const hasPostToolVerifiers = ir.verifier_specs?.some((spec) => spec.when === "post_tool_use") ?? false;
+    const hasHandoffs = ir.workflows_ir?.some((wf) => wf.handoff_chain.length > 0) ?? false;
     if (hasGates || hasFilters || hasRoleScope || hasCheckpoints) {
         events.push("preToolUse");
     }
-    if (ir.post_execution_validators.length > 0) {
+    if (ir.post_execution_validators.length > 0 || hasPostToolVerifiers) {
         events.push("postToolUse");
     }
     if (ir.prompt_directives.some(d => d.priority === "high")) {
@@ -69,7 +88,10 @@ export function detectEnabledEvents(ir) {
     if (hasGates || hasFilters) {
         events.push("notification");
     }
-    return events;
+    if (hasStopVerifiers || hasCheckpoints || hasHandoffs) {
+        events.push("stop");
+    }
+    return [...new Set(events)];
 }
 // ── File Operations ────────────────────────────────────────
 /**

package/dist/runtime/skill-adapter.js

@@ -43,39 +43,65 @@ export function compileWorkflowToSkill(plan, roles, ir, variables) {
         lines.push("");
     }
     // Required Context — context files that must be read before any work
-    if (ir?.context_files) {
-        const contextFiles = [];
+    const workflowKeys = [plan.workflow_key, plan.source_workflow, plan.name].filter((key, index, keys) => Boolean(key) && keys.indexOf(key) === index);
+    const requiredReadAssets = [];
+    if (ir?.legibility_assets) {
+        const assets = ir.legibility_assets;
+        for (const asset of assets.mandatory ?? []) {
+            if (asset.type === "required_read" && !requiredReadAssets.includes(asset.path))
+                requiredReadAssets.push(asset.path);
+        }
+        for (const workflowKey of workflowKeys) {
+            for (const asset of assets.per_workflow?.[workflowKey] ?? []) {
+                if (asset.type === "required_read" && !requiredReadAssets.includes(asset.path))
+                    requiredReadAssets.push(asset.path);
+            }
+        }
+        for (const step of plan.steps) {
+            for (const asset of assets.per_role?.[step.role] ?? []) {
+                if (asset.type === "required_read" && !requiredReadAssets.includes(asset.path))
+                    requiredReadAssets.push(asset.path);
+            }
+        }
+    }
+    const contextFiles = requiredReadAssets.length > 0 ? requiredReadAssets : (() => {
+        if (!ir?.context_files)
+            return [];
+        const files = [];
         if (ir.context_files.mandatory)
-            contextFiles.push(...ir.context_files.mandatory);
-        // per_workflow for this workflow
-        if (ir.context_files.per_workflow?.[plan.source_workflow]) {
-            contextFiles.push(...ir.context_files.per_workflow[plan.source_workflow]);
+            files.push(...ir.context_files.mandatory);
+        for (const workflowKey of workflowKeys) {
+            const workflowFiles = ir.context_files.per_workflow?.[workflowKey] ?? [];
+            for (const file of workflowFiles) {
+                if (!files.includes(file))
+                    files.push(file);
+            }
         }
-        // per_role for all roles used in this workflow
         if (ir.context_files.per_role) {
             for (const step of plan.steps) {
                 const roleFiles = ir.context_files.per_role[step.role];
                 if (roleFiles) {
                     for (const f of roleFiles) {
-                        if (!contextFiles.includes(f))
-                            contextFiles.push(f);
+                        if (!files.includes(f))
+                            files.push(f);
                     }
                 }
             }
         }
-        if (contextFiles.length > 0) {
-            lines.push("<Required_Context>");
-            lines.push("Your context is EMPTY at startup. You MUST read these files first:");
-            lines.push("");
-            for (let i = 0; i < contextFiles.length; i++) {
-                lines.push(`${i + 1}. ${contextFiles[i]}`);
-            }
-            lines.push("");
-            lines.push("Without reading these, you cannot perform your role.");
-            lines.push("Hook will warn on first Edit/Bash/Write until these are read.");
-            lines.push("</Required_Context>");
-            lines.push("");
+        return files;
+    })();
+    if (contextFiles.length > 0) {
+        lines.push("<Required_Context>");
+        lines.push("Your context is EMPTY at startup. You MUST read these files first:");
+        lines.push("");
+        for (let i = 0; i < contextFiles.length; i++) {
+            lines.push(`${i + 1}. ${contextFiles[i]}`);
         }
+        lines.push("");
+        lines.push("Without reading these, you cannot perform your role.");
+        lines.push("Hook will warn on first Edit/Bash/Write until these are read.");
+        lines.push("</Required_Context>");
+        lines.push("");
     }
     // Steps — each step MUST be executed via Agent() tool call
     const usedRoles = new Set(plan.steps.map((s) => s.role));
@@ -153,9 +179,9 @@ export function compileWorkflowToSkill(plan, roles, ir, variables) {
     // Execution Policy — force Agent dispatch
     lines.push("<Execution_Policy>");
     lines.push("- **CRITICAL**: Each step MUST be executed by spawning an Agent using the Agent tool with the specified subagent_type. DO NOT perform any step's work directly in the main session.");
-    lines.push("- Use TodoWrite to track each step as pending/in_progress/completed.");
+    lines.push("- Use the task tracker to track each step only as pending/in_progress/completed; use deleted only for skipped dependent tasks.");
     lines.push("- After completing each step, immediately proceed to the next — do not stop, summarize, or wait for confirmation.");
-    lines.push("- If a step fails, mark it as failed in TodoWrite, log the error, and continue to the next non-dependent step.");
+    lines.push("- If a step cannot complete, do not use a failed status. Keep the current task in_progress or record the blocker in the task description/output, delete skipped dependent tasks, and continue only to non-dependent steps.");
     lines.push("- Do not ask the user for permission between steps — the workflow is pre-approved.");
     lines.push("- Wait for each Agent to complete and read its output before proceeding to the next step.");
     lines.push("</Execution_Policy>");

package/dist/schema/types.d.ts

@@ -83,6 +83,11 @@ export interface RoleDef {
     success_criteria?: string[];
     failure_modes?: string[];
 }
+export interface VerifierCommandPolicy {
+    allow_commands?: string[];
+    allow_command_prefixes?: string[];
+    allow_builtin_asserts?: string[];
+}
 /** Handoff artifact type — what kind of artifact is passed between steps */
 export type HandoffType = "file" | "directory" | "test_result" | "git_commit" | "summary" | "state";
 /** A single artifact consumed or produced by a workflow step */
@@ -218,6 +223,18 @@ export interface MCPServerDef {
     timeout?: number;
     optional?: boolean;
 }
+export type LegibilityAssetType = "required_read" | "repo_map" | "manifest" | "artifact_index";
+export interface LegibilityAsset {
+    type: LegibilityAssetType;
+    path: string;
+    description?: string;
+    tags?: string[];
+}
+export interface LegibilityAssetMap {
+    mandatory?: LegibilityAsset[];
+    per_role?: Record<string, LegibilityAsset[]>;
+    per_workflow?: Record<string, LegibilityAsset[]>;
+}
 export interface IntentDNA {
     $schema?: string;
     version: string;
@@ -232,11 +249,13 @@ export interface IntentDNA {
     workflows?: Record<string, WorkflowDef>;
     variables?: Record<string, string | VariableDef>;
     mcp?: Record<string, MCPServerDef>;
+    legibility_assets?: LegibilityAssetMap;
     context_files?: {
         mandatory?: string[];
         per_role?: Record<string, string[]>;
         per_workflow?: Record<string, string[]>;
     };
+    verifier_policy?: VerifierCommandPolicy;
     epigenetic: {
         markers: EpigeneticMarker[];
     };
@@ -267,6 +286,22 @@ export interface PostExecutionValidator {
     threshold?: number;
     source_gene: string;
 }
+export type VerifierWhen = "stop" | "post_tool_use" | "pre_handoff" | "post_step";
+export type VerifierSeverity = "block" | "warn";
+export type VerifierKind = "checkpoint" | "completion";
+export interface VerifierSpec {
+    id: string;
+    when: VerifierWhen;
+    severity: VerifierSeverity;
+    kind: VerifierKind;
+    workflow_name?: string;
+    step_id?: string;
+    step_role?: string;
+    source_genes?: string[];
+    checkpoint?: StepCheckpoint;
+    completion?: CompletionCheck;
+    source?: "workflow_checkpoint" | "workflow_completion" | "role_post_check";
+}
 export interface ContextInjection {
     type: "experience" | "preference" | "warning";
     text: string;
@@ -333,6 +368,7 @@ export interface ConstraintIR {
     tool_filters: ToolFilter[];
     pre_execution_gates: PreExecutionGate[];
     post_execution_validators: PostExecutionValidator[];
+    verifier_specs?: VerifierSpec[];
     context_injections: ContextInjection[];
     source_dna_ids: string[];
     compiled_at: string;
@@ -343,11 +379,13 @@ export interface ConstraintIR {
     roles_scope_map?: RoleScopeEntry[];
     step_checkpoints?: StepCheckpointIR[];
     workflows_ir?: WorkflowIR[];
+    legibility_assets?: LegibilityAssetMap;
     context_files?: {
         mandatory?: string[];
         per_role?: Record<string, string[]>;
         per_workflow?: Record<string, string[]>;
     };
+    verifier_policy?: VerifierCommandPolicy;
 }
 /** A compiled workflow step with resolved metadata */
 export interface WorkflowStep {
@@ -416,4 +454,5 @@ export interface WorkflowPlan {
     /** Compilation metadata */
     compiled_at: string;
     source_workflow: string;
+    workflow_key?: string;
 }