intentdna 1.8.3 → 1.8.5

package/dist/mcp/tools-artifacts.js

@@ -0,0 +1,137 @@
+import { createHash } from "node:crypto";
+import { readFile, realpath, stat } from "node:fs/promises";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { errorResult, textResult } from "./server.js";
+function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function isContained(root, target) {
+    return target === root || target.startsWith(`${root}${sep}`);
+}
+function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    if (value && typeof value === "object") {
+        const record = value;
+        return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
+    }
+    return JSON.stringify(value) ?? "null";
+}
+function decodeJsonPointer(pointer) {
+    if (!pointer.startsWith("/") || /~(?:[^01]|$)/.test(pointer)) {
+        throw new Error("exclude_json_pointers must contain valid non-root JSON pointers");
+    }
+    return pointer.slice(1).split("/").map((segment) => segment.replace(/~1/g, "/").replace(/~0/g, "~"));
+}
+function omitJsonPointer(value, pointer) {
+    const segments = decodeJsonPointer(pointer);
+    let cursor = value;
+    for (const segment of segments.slice(0, -1)) {
+        if (!cursor || typeof cursor !== "object" || Array.isArray(cursor) || !Object.hasOwn(cursor, segment)) {
+            throw new Error(`JSON pointer does not identify an object member: ${pointer}`);
+        }
+        cursor = cursor[segment];
+    }
+    const leaf = segments.at(-1);
+    if (!cursor || typeof cursor !== "object" || Array.isArray(cursor) || !Object.hasOwn(cursor, leaf)) {
+        throw new Error(`JSON pointer does not identify an object member: ${pointer}`);
+    }
+    delete cursor[leaf];
+}
+async function resolveArtifact(projectDir, requestedPath) {
+    if (!requestedPath || requestedPath.includes("\0") || isAbsolute(requestedPath)) {
+        throw new Error("path must be a non-empty project-relative path");
+    }
+    const root = await realpath(projectDir);
+    const lexicalTarget = resolve(root, requestedPath);
+    if (!isContained(root, lexicalTarget))
+        throw new Error("path escapes project directory");
+    let absolutePath;
+    try {
+        absolutePath = await realpath(lexicalTarget);
+    }
+    catch {
+        throw new Error("artifact is not a readable regular file");
+    }
+    if (!isContained(root, absolutePath))
+        throw new Error("path resolves outside project directory");
+    const artifactStat = await stat(absolutePath);
+    if (!artifactStat.isFile())
+        throw new Error("artifact is not a readable regular file");
+    return {
+        absolutePath,
+        projectRelativePath: relative(root, lexicalTarget).split(sep).join("/"),
+    };
+}
+export function createArtifactTools(projectDir) {
+    return [
+        {
+            name: "dna_artifact_digest",
+            description: "Read-only SHA-256 digest for one project-relative regular file. Supports raw bytes, whitespace-normalized text, and canonical JSON with explicit object-member exclusions; refuses project escapes and writes nothing.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    path: { type: "string", description: "Project-relative path to a regular file" },
+                    mode: {
+                        type: "string",
+                        enum: ["bytes", "whitespace_normalized_text", "canonical_json"],
+                        description: "Digest representation (default: bytes)",
+                    },
+                    exclude_json_pointers: {
+                        type: "array",
+                        items: { type: "string" },
+                        description: "For canonical_json only, object members to omit using RFC 6901 JSON pointers",
+                    },
+                },
+                required: ["path"],
+            },
+            handler: async (args) => {
+                try {
+                    const requestedPath = typeof args.path === "string" ? args.path : "";
+                    const mode = (args.mode ?? "bytes");
+                    if (!["bytes", "whitespace_normalized_text", "canonical_json"].includes(mode)) {
+                        return errorResult("mode must be bytes, whitespace_normalized_text, or canonical_json");
+                    }
+                    const excluded = args.exclude_json_pointers === undefined
+                        ? []
+                        : Array.isArray(args.exclude_json_pointers) && args.exclude_json_pointers.every((item) => typeof item === "string")
+                            ? args.exclude_json_pointers
+                            : undefined;
+                    if (!excluded)
+                        return errorResult("exclude_json_pointers must be an array of strings");
+                    if (mode !== "canonical_json" && excluded.length > 0) {
+                        return errorResult("exclude_json_pointers is only valid with canonical_json mode");
+                    }
+                    const artifact = await resolveArtifact(projectDir, requestedPath);
+                    const content = await readFile(artifact.absolutePath);
+                    const artifactStat = await stat(artifact.absolutePath);
+                    const contentSha256 = sha256(content);
+                    let digest = contentSha256;
+                    if (mode === "whitespace_normalized_text") {
+                        digest = sha256(content.toString("utf-8").replace(/\s+/g, " ").trim());
+                    }
+                    else if (mode === "canonical_json") {
+                        const parsed = JSON.parse(content.toString("utf-8"));
+                        for (const pointer of excluded)
+                            omitJsonPointer(parsed, pointer);
+                        digest = sha256(canonicalJson(parsed));
+                    }
+                    return textResult(JSON.stringify({
+                        schema_version: "intentdna.artifact_digest.v1",
+                        path: artifact.projectRelativePath,
+                        mode,
+                        sha256: digest,
+                        content_sha256: contentSha256,
+                        size_bytes: content.byteLength,
+                        modified_at: artifactStat.mtime.toISOString(),
+                        excluded_json_pointers: excluded,
+                        read_only: true,
+                    }, null, 2));
+                }
+                catch (error) {
+                    return errorResult(error instanceof Error ? error.message : "artifact digest failed");
+                }
+            },
+        },
+    ];
+}

package/dist/runtime/claude-sync-target.d.ts

@@ -1,7 +1,7 @@
 import type { ConstraintIR, RoleDef } from "../schema/types.js";
 import type { SyncOutputArtifactId } from "./output-artifact-registry.js";
 import { type CompiledIRFile } from "./plugin-adapter.js";
-import { type DNASettings, type HookEventKey } from "./settings-adapter.js";
+import { type DNASettings, type HookEventKey, type IntentDNASettingsHookCleanupResult } from "./settings-adapter.js";
 import type { AdapterCapabilityReport, CapabilityReportEntry, PlannedArtifact, SyncTargetPlan } from "./sync-target-plan.js";
 export type ClaudeSyncMode = "plugin" | "bin";
 export interface ClaudeCorePlannedArtifact extends PlannedArtifact {
@@ -31,6 +31,7 @@ export interface ClaudeCoreSyncTargetPlan extends SyncTargetPlan {
     legacyHooksDir: string;
     mcpConfigPath: string;
     settingsHookRegistration?: ClaudeSettingsHookRegistration;
+    pluginSettingsPath?: string;
     pluginSkipsSettings: boolean;
     plannedArtifacts: ClaudeCorePlannedArtifact[];
     capabilityReport: ClaudeCoreAdapterCapabilityReport;
@@ -38,6 +39,7 @@ export interface ClaudeCoreSyncTargetPlan extends SyncTargetPlan {
 export interface ExecuteClaudeCoreSyncTargetPlanResult {
     messages: string[];
     removedLegacyHooks: string[];
+    settingsHookCleanup?: IntentDNASettingsHookCleanupResult;
 }
 /**
  * Remove legacy bash hook scripts written by previous Intent DNA versions.

package/dist/runtime/claude-sync-target.js

@@ -1,7 +1,7 @@
 import { mkdir, readFile, unlink, writeFile } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { createCompiledIR, writeCompiledIR } from "./plugin-adapter.js";
-import { compilePluginSettings, detectEnabledEvents, mergeSettingsFile, recommendHookTimeouts } from "./settings-adapter.js";
+import { compilePluginSettings, detectEnabledEvents, mergeSettingsFile, recommendHookTimeouts, removeIntentDNASettingsHooks, } from "./settings-adapter.js";
 import { formatSyncTargetPlanDiagnostics } from "./sync-target-plan.js";
 const LEGACY_BASH_HOOKS = [
     "dna-pre-tool-use.sh",
@@ -83,6 +83,7 @@ export function createClaudeCoreSyncTargetPlan(options) {
         legacyHooksDir,
         mcpConfigPath,
         settingsHookRegistration,
+        pluginSettingsPath: options.mode === "plugin" ? options.settingsPath : undefined,
         pluginSkipsSettings: options.mode === "plugin" && !!options.settingsPath,
         plannedArtifacts,
         capabilityReport: createClaudeCapabilityReport(plannedArtifacts, options.mode, settingsHookRegistration),
@@ -238,6 +239,7 @@ async function registerDNAMCPServer(projectDir) {
 }
 export async function executeClaudeCoreSyncTargetPlan(plan, projectDir) {
     const messages = [];
+    let settingsHookCleanup;
     const writtenIrPath = await writeCompiledIR(projectDir, plan.compiledIR);
     messages.push(`Wrote compiled IR: ${writtenIrPath}`);
     const removedLegacyHooks = await removeLegacyBashHooks(plan.legacyHooksDir);
@@ -253,9 +255,19 @@ export async function executeClaudeCoreSyncTargetPlan(plan, projectDir) {
         messages.push(`Bin mode: registered ${plan.settingsHookRegistration.enabledEvents.length} hook event(s) in ${plan.settingsHookRegistration.path}`);
     }
     else if (plan.pluginSkipsSettings) {
-        messages.push("Plugin mode: hooks managed by plugin framework (skipping settings.json)");
+        settingsHookCleanup = await removeIntentDNASettingsHooks(plan.pluginSettingsPath);
+        if (settingsHookCleanup.removedCommands > 0) {
+            const action = settingsHookCleanup.removedFile ? "removed" : "cleaned";
+            messages.push(`Plugin mode: ${action} ${settingsHookCleanup.removedCommands} stale bin-mode dna-hook command(s) from ${plan.pluginSettingsPath}; hooks are managed by plugin framework`);
+        }
+        else {
+            messages.push("Plugin mode: hooks managed by plugin framework (settings.json not written)");
+        }
+        if (settingsHookCleanup.warning) {
+            messages.push(`Plugin mode: preserved settings.json without cleanup (${settingsHookCleanup.warning})`);
+        }
     }
-    return { messages, removedLegacyHooks };
+    return { messages, removedLegacyHooks, settingsHookCleanup };
 }
 export function formatClaudeCoreSyncTargetPlanDryRun(plan) {
     const lines = [
@@ -267,7 +279,7 @@ export function formatClaudeCoreSyncTargetPlanDryRun(plan) {
         lines.push(`Dry-run: would register ${plan.settingsHookRegistration.enabledEvents.length} hook event(s) in ${plan.settingsHookRegistration.path}`);
     }
     else if (plan.pluginSkipsSettings) {
-        lines.push("Plugin mode: hooks managed by plugin framework (skipping settings.json)");
+        lines.push("Plugin mode: hooks managed by plugin framework; would remove stale bin-mode dna-hook commands if present and would not register settings hooks");
     }
     const capabilityEntries = Object.entries(plan.capabilityReport.capabilities)
         .sort(([left], [right]) => left.localeCompare(right));

package/dist/runtime/settings-adapter.d.ts

@@ -18,6 +18,13 @@ export interface SettingsHookEntry {
 export interface DNASettings {
     hooks: Record<string, SettingsHookEntry[]>;
 }
+export interface IntentDNASettingsHookCleanupResult {
+    changed: boolean;
+    removedCommands: number;
+    removedEvents: string[];
+    removedFile: boolean;
+    warning?: string;
+}
 /**
  * Compile settings.json hook configuration for dna-hook binary.
  * Uses `dna-hook <event>` commands.
@@ -34,3 +41,8 @@ export declare function detectEnabledEvents(ir: import("../schema/types.js").Con
  * Replaces DNA hooks (identified by "dna-" prefix), keeps user hooks.
  */
 export declare function mergeSettingsFile(dnaSettings: DNASettings, settingsPath: string): Promise<void>;
+/**
+ * Remove bin-mode IntentDNA hook commands when Claude plugin hooks own dispatch.
+ * Invalid or user-owned settings are preserved without rewriting the file.
+ */
+export declare function removeIntentDNASettingsHooks(settingsPath: string): Promise<IntentDNASettingsHookCleanupResult>;

package/dist/runtime/settings-adapter.js

@@ -6,9 +6,9 @@
  *
  * See docs/archive/2026H1/references/cc-source-analysis.md §2 for the full hook event catalog.
  */
-import { readFile, writeFile } from "node:fs/promises";
+import { readFile, unlink, writeFile } from "node:fs/promises";
 import { getHookEventBySettingsKey, settingsHookEventKeys } from "../hooks/event-registry.js";
-// ── Plugin Mode (Node.js hooks via dna-hook binary) ───────
+// ── Bin Mode (project settings via dna-hook binary) ───────
 /**
  * Compile settings.json hook configuration for dna-hook binary.
  * Uses `dna-hook <event>` commands.
@@ -46,6 +46,7 @@ export function recommendHookTimeouts(ir, baseTimeout = 10) {
             spec.checkpoint?.assert === "no_test_regression")) ?? false;
     if (hasStopCommandVerifiers) {
         timeouts.stop = Math.max(baseTimeout, 45);
+        timeouts.subagentStop = Math.max(baseTimeout, 45);
     }
     return timeouts;
 }
@@ -70,7 +71,7 @@ export function detectEnabledEvents(ir) {
     if (ir.prompt_directives.some(d => d.priority === "high")) {
         events.push("userPromptSubmit");
     }
-    if (hasRoleScope) {
+    if (hasRoleScope || hasStopVerifiers) {
         events.push("subagentStop");
     }
     if (ir.prompt_directives.length > 0) {
@@ -130,3 +131,120 @@ export async function mergeSettingsFile(dnaSettings, settingsPath) {
     existing.hooks = mergedHooks;
     await writeFile(settingsPath, JSON.stringify(existing, null, 2) + "\n", "utf-8");
 }
+const INTENTDNA_SETTINGS_HOOK_COMMANDS = new Set(settingsHookEventKeys().map((key) => `dna-hook ${getHookEventBySettingsKey(key).event}`));
+function isIntentDNASettingsHookCommand(value, eventName) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const hook = value;
+    const expectedCommand = `dna-hook ${eventName}`;
+    return hook.type === "command"
+        && typeof hook.command === "string"
+        && hook.command === expectedCommand
+        && INTENTDNA_SETTINGS_HOOK_COMMANDS.has(expectedCommand);
+}
+function isGeneratedIntentDNASettingsHookEntry(entry) {
+    return entry.matcher === ""
+        && Object.keys(entry).every((key) => key === "matcher" || key === "hooks");
+}
+/**
+ * Remove bin-mode IntentDNA hook commands when Claude plugin hooks own dispatch.
+ * Invalid or user-owned settings are preserved without rewriting the file.
+ */
+export async function removeIntentDNASettingsHooks(settingsPath) {
+    const unchanged = (warning) => ({
+        changed: false,
+        removedCommands: 0,
+        removedEvents: [],
+        removedFile: false,
+        ...(warning ? { warning } : {}),
+    });
+    let raw;
+    try {
+        raw = await readFile(settingsPath, "utf-8");
+    }
+    catch (error) {
+        const code = error && typeof error === "object" && "code" in error ? error.code : undefined;
+        return code === "ENOENT" ? unchanged() : unchanged("could not read settings.json");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return unchanged("settings.json is not valid JSON");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return unchanged("settings.json root is not an object");
+    }
+    const settings = parsed;
+    const rawHooks = settings.hooks;
+    if (!rawHooks || typeof rawHooks !== "object" || Array.isArray(rawHooks)) {
+        return unchanged();
+    }
+    const cleanedHooks = {};
+    const removedEvents = [];
+    let removedCommands = 0;
+    for (const [eventName, rawEntries] of Object.entries(rawHooks)) {
+        if (!Array.isArray(rawEntries)) {
+            cleanedHooks[eventName] = rawEntries;
+            continue;
+        }
+        let eventRemoved = false;
+        const cleanedEntries = [];
+        for (const rawEntry of rawEntries) {
+            if (!rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry)) {
+                cleanedEntries.push(rawEntry);
+                continue;
+            }
+            const entry = rawEntry;
+            if (!Array.isArray(entry.hooks)) {
+                cleanedEntries.push(rawEntry);
+                continue;
+            }
+            let entryRemovedCommands = 0;
+            const retainedCommands = entry.hooks.filter((hook) => {
+                const owned = isIntentDNASettingsHookCommand(hook, eventName);
+                if (owned) {
+                    removedCommands += 1;
+                    entryRemovedCommands += 1;
+                    eventRemoved = true;
+                }
+                return !owned;
+            });
+            if (entryRemovedCommands === 0) {
+                cleanedEntries.push(rawEntry);
+            }
+            else if (retainedCommands.length > 0 || !isGeneratedIntentDNASettingsHookEntry(entry)) {
+                cleanedEntries.push({ ...entry, hooks: retainedCommands });
+            }
+        }
+        if (eventRemoved)
+            removedEvents.push(eventName);
+        if (!eventRemoved || cleanedEntries.length > 0)
+            cleanedHooks[eventName] = cleanedEntries;
+    }
+    if (removedCommands === 0)
+        return unchanged();
+    if (Object.keys(cleanedHooks).length > 0) {
+        settings.hooks = cleanedHooks;
+    }
+    else {
+        delete settings.hooks;
+    }
+    if (Object.keys(settings).length === 0) {
+        await unlink(settingsPath);
+        return {
+            changed: true,
+            removedCommands,
+            removedEvents,
+            removedFile: true,
+        };
+    }
+    await writeFile(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
+    return {
+        changed: true,
+        removedCommands,
+        removedEvents,
+        removedFile: false,
+    };
+}

package/dist/runtime/skill-adapter.js

@@ -448,10 +448,19 @@ function workflowSkillMapEntry(skillName, dirName, plan) {
         produces,
     };
 }
+function inferredWorkflowAsset(ir) {
+    const sourceIds = [...new Set(ir?.source_dna_ids ?? [])]
+        .filter((sourceId) => sourceId.length > 0)
+        .filter((sourceId) => !sourceId.startsWith("species:"))
+        .filter((sourceId) => !sourceId.startsWith("enterprise:"));
+    return sourceIds.length === 1 ? sourceIds[0] : undefined;
+}
 export function compileWorkflowToSkill(plan, roles, ir, variables, options) {
     const lines = [];
     const skillName = `dna-${toKebabCase(plan.name)}`;
     const surface = options?.surface ?? "claude_code";
+    const workflowId = plan.workflow_key ?? plan.source_workflow;
+    const workflowAsset = inferredWorkflowAsset(ir);
     assertSafeGeneratedName(skillName, "skill name");
     // Frontmatter
     lines.push("---");
@@ -478,9 +487,20 @@ export function compileWorkflowToSkill(plan, roles, ir, variables, options) {
         lines.push("");
     }
     lines.push("<Workflow_State>");
-    lines.push("At workflow start, persist runtime inputs in DNA workflow state before executing steps.");
+    lines.push("At workflow start, call the MCP tool `dna_workflow_write` before any step or hook-triggering action so hook verifier evidence is attributed to this workflow instead of `*:direct`.");
+    lines.push(`Use workflow id \`${workflowId}\`.`);
+    if (workflowAsset) {
+        lines.push(`Use workflow_asset \`${workflowAsset}\`; it is the single non-species/non-enterprise IR source id.`);
+    }
+    else {
+        lines.push("Do not set workflow_asset: IR does not provide exactly one non-species/non-enterprise source id, so the asset cannot be inferred safely.");
+    }
+    const firstStep = plan.steps[0];
+    lines.push(`Initial state write: workflow=${workflowId}, current_step=${firstStep.id}, current_role=${firstStep.role}, iteration=1, active=true.`);
     lines.push("Record the invocation argument as inputs.ARGUMENTS so handoff artifact paths like $ARGUMENTS can be resolved deterministically.");
     lines.push("If template variables are shown below, persist their resolved values as resolved_variables.");
+    lines.push("Before each workflow step, call `dna_workflow_write` again with workflow, workflow_asset only when safely inferred above, current_step, current_role, iteration, active=true, inputs.ARGUMENTS, and resolved_variables.");
+    lines.push("At workflow completion or terminal failure, call `dna_workflow_write` with active=false using the same workflow id and safe workflow_asset value.");
     lines.push("</Workflow_State>");
     lines.push("");
     // Required Context — context files that must be read before any work
@@ -607,6 +627,7 @@ export function compileWorkflowToSkill(plan, roles, ir, variables, options) {
             const agentPrompt = escapePrompt(promptParts.join(" "));
             lines.push(`${stepNumber}. **${step.id}**${optional}`);
             lines.push(`   ${step.description}${runIf}`);
+            lines.push(`   Before this step, call \`dna_workflow_write\` with workflow=${workflowId}, current_step=${step.id}, current_role=${step.role}, iteration=<current iteration>, active=true, inputs.ARGUMENTS, resolved_variables, and ${workflowAsset ? `workflow_asset=${workflowAsset}` : "no workflow_asset unless one has been explicitly supplied by trusted workflow state"}.`);
             lines.push("");
             if (humanOwned) {
                 lines.push("   **Human-owned gate (`model: human`)**");
@@ -640,6 +661,11 @@ export function compileWorkflowToSkill(plan, roles, ir, variables, options) {
                 const artifacts = step.handoff.produces.map(p => p.description).join(", ");
                 lines.push(`   Verify produced artifacts: ${artifacts}`);
             }
+            pushWorkflowStepVerifierLines(lines, step, "   ");
+            if (step.completion?.length || step.checkpoints?.length) {
+                lines.push("   If any completion/checkpoint gate fails, preserve the exact verifier diagnostics verbatim: id, check/assert or command, message, evidence, target/artifact, and exit_code when available.");
+                lines.push(`   Feed those exact diagnostics to ${step.on_fail === "retry_with_feedback" ? "this step's on_fail retry" : "the retry_from/on_fail step"} before any retry, reanalysis, or downstream transition.`);
+            }
             lines.push("");
             // Reflection gate: inject Reflection_Gate after steps with max_attempts
             if (step.max_attempts) {
@@ -648,8 +674,9 @@ export function compileWorkflowToSkill(plan, roles, ir, variables, options) {
                 const blockedPath = step.blocked_items_path ?? "blocked_items.md";
                 lines.push(`<Reflection_Gate>`);
                 lines.push(`max_attempts=${step.max_attempts}, handoff_to=${handoffStep}, max_handoffs=${maxH}`);
-                lines.push(`No test progress after ${step.max_attempts} attempts → handoff to ${handoffStep} for re-analysis.`);
-                lines.push(`After ${maxH} handoffs with no progress → SKIP and record to ${blockedPath}.`);
+                lines.push(`No declared completion progress after ${step.max_attempts} attempts → handoff to ${handoffStep} for re-analysis.`);
+                lines.push(`When the declared gates are test or no_test_regression gates, preserve the existing test-progress meaning as part of declared completion progress.`);
+                lines.push(`After ${maxH} handoffs with no declared completion progress → SKIP and record to ${blockedPath}.`);
                 lines.push(`</Reflection_Gate>`);
                 lines.push("");
             }
@@ -662,7 +689,9 @@ export function compileWorkflowToSkill(plan, roles, ir, variables, options) {
         lines.push(`- max_retries: ${plan.retry.max_retries}`);
         lines.push(`- retry_from: ${plan.retry.retry_from ?? "first_failed_step"}`);
         lines.push(`- backoff: ${plan.retry.backoff}`);
-        lines.push("- On a blocking checkpoint or validator failure, preserve the exact diagnostics and return them to the retry_from step.");
+        lines.push("- On a blocking completion, checkpoint, or validator failure, preserve the exact diagnostics and return them verbatim to the retry_from/on_fail step.");
+        lines.push("- Exact diagnostics means every available id/result_id, check/assert or command, message, evidence, target/artifact, and exit_code. Do not paraphrase away failed paths, command output, or policy-denied exit codes.");
+        lines.push("- Retry prompts must include the prior failed step id, the declared gates that failed, and the exact verifier diagnostics before asking for another attempt.");
         lines.push("- Repeat only the retry slice and its dependent steps; do not continue to save, adoption, or sync while validation is red.");
         lines.push("- Stop and report the remaining diagnostics when the retry budget is exhausted.");
         lines.push("</Retry_Policy>");
@@ -797,6 +826,7 @@ export function compileWorkflowToSkill(plan, roles, ir, variables, options) {
     }
     // Workflow Boundary — prevent cross-workflow execution
     lines.push("<Workflow_Boundary>");
+    lines.push(`Before reporting final success, terminal failure, or exhaustion, call \`dna_workflow_write\` with workflow=${workflowId}, current_step=workflow_complete, current_role=workflow, active=false, and ${workflowAsset ? `workflow_asset=${workflowAsset}` : "no workflow_asset unless one has been explicitly supplied by trusted workflow state"}.`);
     lines.push("This workflow is COMPLETE. Do NOT proceed to any other workflow.");
     lines.push("Report your results and STOP. The user will decide the next step.");
     lines.push("</Workflow_Boundary>");

package/dist/runtime/verifier.d.ts

@@ -1,6 +1,8 @@
 import type { CompletionCheck, ConstraintIR, StepCheckpoint, VerifierCommandPolicy } from "../schema/types.js";
 export declare const DEFAULT_VERIFIER_COMMAND_TIMEOUT_MS = 30000;
 export declare const MAX_VERIFIER_EVIDENCE_BYTES = 4096;
+export declare const VERIFIER_DIAGNOSTIC_PREFIX = "INTENTDNA_DIAGNOSTIC:";
+export declare const MAX_VERIFIER_DIAGNOSTIC_BYTES = 2048;
 export interface VerifierRuntimeContext {
     projectDir: string;
     variables?: Record<string, string>;
@@ -29,7 +31,7 @@ export declare function hasUnresolvedVerifierTemplate(value: string): boolean;
 export declare function unresolvedVerifierTemplateMessage(value: string): string;
 export declare function hasUnsafeShellControl(command: string): boolean;
 export declare function isVerifierCommandAllowed(policy: VerifierCommandPolicy | undefined, command: string): boolean;
-export declare function verifierCommandPolicyMessage(command: string): string;
+export declare function verifierCommandPolicyMessage(_command: string): string;
 export declare function isBuiltinAssertAllowed(policy: VerifierCommandPolicy | undefined, assertName: string): boolean;
 export declare function verifierAssertPolicyMessage(assertName: string): string;
 export declare function trimVerifierEvidence(raw: string | undefined): string | undefined;