intentdna 1.8.6 → 1.8.7

package/dist/cli/index.js

@@ -25,7 +25,7 @@ Commands:
   guard         Zero-config guardrails — detect environment, apply safety rules
   sync          Compile + inject DNA into target file (CLAUDE.md, SOUL.md, etc.)
   verify        Verify synced files match .dna/lock checksums (drift detection)
-  run           Execute a workflow directly (TypeScript runtime)
+  run           Execute and inspect a durable Controller workflow run
   init          Create a new DNA file interactively
   generate      Generate DNA config from natural language description
   compile       Compile DNA files to framework configuration
@@ -138,6 +138,10 @@ Examples:
   dna import .                  Import existing harness configs into DNA format
   dna run --dna my.dna.json --workflow dev-pipeline --task P5.8
   dna run --dna my.dna.json --workflow dev-pipeline --task P5.8 --dry-run
+  dna run status <run-id> --json
+  dna run inspect <run-id>
+  dna run resume <run-id>
+  dna run cancel <run-id> --reason "operator request"
   dna compile my.dna.json --context work
   dna show my.dna.json --context work
   dna evolve my_dna_id                  Preview marker changes without persisting
@@ -229,7 +233,35 @@ Boundaries:
     guide: `Usage: dna guide [asset] [--asset <name>] [--name <org>] [--project <project>] [--goal <workflow>] [--sync-target <target>] [--brief] [--json]\n\nShows the current workflow governance route: organization setup, external-agent authoring/validated asset editing, asset governance, runtime sync, evidence review, and manager review.\n\nOptions:\n  --asset <name>           Focus the guide on a workflow asset (default prefers ${WORKFLOW_ASSET_IDS.default})\n  --name <org>             Organization/workspace name to use in suggested setup commands\n  --project <project>      Project name to use in suggested commands\n  --goal <workflow>        Natural-language workflow goal for intake/authoring-packet commands\n  --sync-target <target>   Runtime surface such as codex or claude for suggested commands\n  --project-dir <path>     Read organization state and project-local assets from another project directory\n  --brief                  Print the current stage, current command, checkpoints, and near next steps only\n  --json                   Print JSON to stdout\n\nBoundaries:\n  - dna CLI/core/runtime owns product behavior and governance decisions\n  - Claude Code and Codex are runtime surfaces/adapters\n  - Dashboard is read-only projection\n  - Obsidian/wiki is internal project memory, not product runtime\n  - Web/public surface changes require Vercel CLI deploy + deployed URL verification\n`,
     quickstart: `Usage: dna quickstart [asset] [--asset <name>] [--sync-target <target>] [--project-dir <path>] [--json]\n\nShows the shortest local route for getting value without Online or Supabase: choose a workflow asset, initialize local dna, preview sync, sync the harness, run in the harness, package/sign/verify local evidence, then inspect sync status.\n\nOptions:\n  --asset <name>           Workflow asset to start from (default prefers ${WORKFLOW_ASSET_IDS.default})\n  --sync-target <target>   Runtime surface such as codex or claude for suggested commands\n  --project-dir <path>     Read organization state and project-local assets from another project directory\n  --json                   Print a concise intentdna.local_quickstart.v1 packet\n\nBoundaries:\n  - quickstart is read-only guidance; it does not initialize, sync, run workflows, sign reports, upload reports, or deploy anything\n  - local dna/dna-hook remain runtime truth\n  - Online, marketplace, and Supabase do not execute workflows or make allow/warn/block/validate decisions\n  - MCP remains hidden transport\n`,
     context: `Usage: dna context <index|search|doc> [query|id] [files...]\n\nSubcommands:\n  index                    List explicitly declared planning-only advisory context sources\n  search <query>           Search source metadata\n  doc <id>                 Read a local file/doc source body\n`,
-    run: `Usage: dna run --dna <file> --workflow <name> --task <id> [options]\n\nOptions:\n  --dry-run                Print execution plan only\n  --permission-mode <mode> Claude permission mode (default: default)\n  --project-dir <path>     Run and write project-scoped agents, IR, state, and logs in another project directory\n`,
+    run: `Usage:
+  dna run [start] --dna <file> --workflow <name> --task <id> [options]
+  dna run status  <run-id> [--json] [--project-dir <path>]
+  dna run inspect <run-id> [--json] [--project-dir <path>]
+  dna run resume  <run-id> [--json] [--project-dir <path>]
+  dna run cancel  <run-id> [--reason <text>] [--json] [--project-dir <path>]
+
+Actions:
+  start                    Create a durable run and execute until terminal (default)
+  status                   Read the durable run summary
+  inspect                  Read attempts, worker sessions, handoffs, events, and results
+  resume                   Resume from durable task/attempt/result state
+  cancel                   Persist durable cancellation intent
+
+Options:
+  --run-id <id>            Explicit run id; lifecycle actions also accept a positional id
+  --dry-run                Print the compiled Controller plan without starting a run
+  --provider <name>        claude|codex (default: claude)
+  --provider-executable <path> Override the selected provider executable
+  --max-concurrency <n>    Maximum simultaneously active Steps (default: 1)
+  --timeout-ms <n>         Per-attempt timeout in milliseconds
+  --cancellation-grace-ms <n> Process-tree cancellation grace period (default: 5000)
+  --max-budget <usd>       Claude budget per Step attempt (default: 5)
+  --permission-mode <mode> Claude permission mode (default: default)
+  --agents <dir>           Project agent output directory (default: .claude/agents)
+  --reason <text>          Cancellation reason
+  --json                   Print lifecycle output as JSON
+  --project-dir <path>     Read/write the project-scoped runtime in another directory
+`,
     compile: `Usage: dna compile <files...> [--target claude-sdk] [--context <name>] [--output <path>] [--ir]\n`,
     evolve: `Usage: dna evolve <dna-id> [--store-dir <path>] [--preview] [--apply]\n\nPreview self-evolution marker changes from recorded outcomes. This command is read-only; it never writes markers or runtime artifacts.\n\nOptions:\n  --store-dir <path>       Evolution store directory (default .dna/evolution)\n  --preview                Explicit preview flag; preview is the default behavior\n  --apply                  Rejected in this kernel; use reviewed dna sync --evolve for mutation\n\nRoute:\n  1. Record outcomes: dna epigenetic record <dna-id> --action <action> --genes <gene[,gene]> --feedback '[{\"gene\":\"quality\",\"effect\":\"helped\"}]'\n  2. Inspect outcomes: dna epigenetic summary <dna-id>\n  3. Preview marker changes: dna evolve <dna-id>\n  4. Mutate only after review: dna sync --evolve\n\nBoundaries:\n  - No outcomes means no evidence to evolve\n  - dna evolve is preview-only and does not create missing outcome or marker directories\n  - Marker mutation is allowed only through explicit reviewed sync/evolve gates\n`,
     epigenetic: `Usage: dna epigenetic <record|summary|markers> <dna-id> [options]\n\nSubcommands:\n  record                   Record an execution outcome for self-evolution\n  summary                  Show outcome summary for a DNA id\n  markers                  Show persisted epigenetic markers\n\nOptions:\n  --store-dir <path>       Evolution store directory (default .dna/evolution)\n  --action <action>        Action name for record\n  --success                Mark record outcome as success (default true)\n  --genes <a,b>            Active genes for record\n  --feedback <json>        Constraint feedback JSON array\n  --json                   Print JSON for summary or markers\n\nExamples:\n  dna epigenetic record template_flutter_rewrite --action fix-loop --genes quality --feedback '[{\"gene\":\"quality\",\"effect\":\"helped\"}]'\n  dna epigenetic summary template_flutter_rewrite\n  dna epigenetic markers template_flutter_rewrite\n`,
@@ -400,10 +432,48 @@ async function main() {
                     agents: { type: "string" },
                     hooks: { type: "string" },
                     "project-dir": { type: "string" },
+                    "run-id": { type: "string" },
+                    provider: { type: "string" },
+                    "provider-executable": { type: "string" },
+                    "max-concurrency": { type: "string" },
+                    "timeout-ms": { type: "string" },
+                    "cancellation-grace-ms": { type: "string" },
+                    reason: { type: "string" },
+                    json: { type: "boolean", default: false },
                 },
                 allowPositionals: true,
                 strict: false,
             });
+            const runActions = new Set([
+                "start",
+                "status",
+                "inspect",
+                "resume",
+                "cancel",
+            ]);
+            const actionCandidate = runPositionals[0] ?? "";
+            const runAction = runActions.has(actionCandidate)
+                ? runPositionals.shift()
+                : "start";
+            const positionalRunId = runAction === "start"
+                ? undefined
+                : runPositionals.shift();
+            const optionRunId = runValues["run-id"];
+            if (positionalRunId
+                && optionRunId
+                && positionalRunId !== optionRunId) {
+                process.stderr.write("Error: positional run id and --run-id must match when both are provided\n");
+                return exitWith(2);
+            }
+            if (runAction !== "start" && runPositionals.length > 0) {
+                process.stderr.write(`Error: dna run ${runAction} accepts exactly one run id\n`);
+                return exitWith(2);
+            }
+            const provider = runValues.provider;
+            if (provider && provider !== "claude" && provider !== "codex") {
+                process.stderr.write("Error: --provider must be one of: claude, codex\n");
+                return exitWith(2);
+            }
             // Parse --var key=value pairs
             const varEntries = runValues.var ?? [];
             const vars = {};
@@ -415,6 +485,8 @@ async function main() {
             }
             const { runRun } = await import("./commands/run.js");
             const code = await runRun({
+                action: runAction,
+                runId: optionRunId ?? positionalRunId,
                 dnaFiles: runValues.dna ?? runPositionals,
                 workflowName: runValues.workflow,
                 taskId: runValues.task,
@@ -429,6 +501,19 @@ async function main() {
                 agentsDir: runValues.agents,
                 hooksDir: runValues.hooks,
                 projectDir: runValues["project-dir"],
+                provider: provider,
+                providerExecutable: runValues["provider-executable"],
+                maxConcurrency: runValues["max-concurrency"] === undefined
+                    ? undefined
+                    : Number(runValues["max-concurrency"]),
+                timeoutMs: runValues["timeout-ms"] === undefined
+                    ? undefined
+                    : Number(runValues["timeout-ms"]),
+                cancellationGraceMs: runValues["cancellation-grace-ms"] === undefined
+                    ? undefined
+                    : Number(runValues["cancellation-grace-ms"]),
+                reason: runValues.reason,
+                json: runValues.json,
             });
             return exitWith(code);
             break;

package/dist/compiler/workflow.js

@@ -40,7 +40,7 @@ export function expandParallelBlocks(steps) {
                     // Add depends_on from last step before this block
                     depends_on: lastStepId
                         ? [...(inner.depends_on ?? []), lastStepId]
-                        : inner.depends_on,
+                        : (inner.depends_on ?? []),
                     // Inherit isolation from parallel block if step doesn't override
                     isolation: inner.isolation ?? block.isolation,
                 };
@@ -72,7 +72,7 @@ export function expandParallelBlocks(steps) {
  * Returns a new array of steps with injected deps (never mutates input).
  */
 function inferImplicitDeps(steps) {
-    const anyExplicit = steps.some((s) => s.depends_on !== undefined && s.depends_on.length > 0);
+    const anyExplicit = steps.some((s) => s.depends_on !== undefined);
     if (anyExplicit) {
         return steps;
     }
@@ -237,6 +237,7 @@ function toWorkflowStep(def) {
         completion: def.completion && def.completion.length > 0 ? [...def.completion] : null,
         checkpoints: def.checkpoints && def.checkpoints.length > 0 ? [...def.checkpoints] : null,
         handoff: def.handoff ?? null,
+        enforce: def.enforce ?? null,
     };
     if (def.max_attempts !== undefined)
         step.max_attempts = def.max_attempts;

package/dist/hooks/cli.d.ts

@@ -12,7 +12,7 @@
  *   4. Call enforcement engine
  *   5. Write JSON result to stdout
  *
- * Fail-open: all errors → { continue: true, suppressOutput: true }
+ * Enforcement failures use the explicit advisory/blocking boundary.
  */
 import type { ArtifactFact, ConstraintIR, RoleDef, VerifierSpec } from "../schema/types.js";
 import type { HookEvent, HookOutput } from "./protocol.js";
@@ -122,7 +122,6 @@ export declare function runStopVerifiersForTest(projectDir: string, ir: Constrai
  *   2. Context Gate — block Edit/Write/Bash when required context files unread
  *
  * Returns the first triggered block, or null if all gates pass.
- * Fail-open on any exception.
  */
 export declare function handlePreToolGates(ir: ConstraintIR, rawInput: Record<string, unknown>, wfState: Awaited<ReturnType<typeof readWorkflowState>>, projectDir: string, sessionId?: string): Promise<{
     output: ReturnType<typeof blockOutput>;

package/dist/hooks/cli.js

@@ -12,7 +12,7 @@
  *   4. Call enforcement engine
  *   5. Write JSON result to stdout
  *
- * Fail-open: all errors → { continue: true, suppressOutput: true }
+ * Enforcement failures use the explicit advisory/blocking boundary.
  */
 import { mkdir, readFile, realpath, stat, unlink, writeFile } from "node:fs/promises";
 import { realpathSync } from "node:fs";
@@ -20,10 +20,11 @@ import { spawn } from "node:child_process";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 import { fileURLToPath } from "node:url";
-import { readStdin, writeOutput, silentOutput, allowOutput, blockOutput, stopOutput } from "./protocol.js";
+import { readStdinResult, writeOutput, silentOutput, allowOutput, blockOutput, stopOutput } from "./protocol.js";
 import { validateHookInput } from "./schema.js";
+import { hookFailureOutput } from "./enforcement-boundary.js";
 import { enforcePreToolUse, enforcePostToolUse, enforceUserPromptSubmit, enforceSubagentStop, enforcePreCompact, enforceNotification, enforceSessionStart, enforceStop, extractBashWritePaths, checkReflectionLimit, checkContextReadiness, checkWorkflowBoundary, } from "./enforce.js";
-import { appendAudit, readWorkflowState, appendTrace, appendRuntimeDecisionEvent, appendEvidenceCaptureEvent, rotateTraces, readTraces, cleanStaleState, readSurgeonAttempts, writeSurgeonAttempts, appendSessionRead, readSessionReads, appendVerifierResult, readVerifierResults, appendCompletedArtifact, artifactIdentity, buildArtifactKey, readArtifactManifest, resolveArtifactTemplate, safePathComponent, writeArtifactManifest, EVIDENCE_CAPTURE_SCHEMA_VERSION } from "./state.js";
+import { appendAudit, readWorkflowState, appendTrace, appendRuntimeDecisionEvent, appendEvidenceCaptureEvent, rotateTraces, readTraces, cleanStaleState, readSurgeonAttempts, updateSurgeonAttempts, appendSessionRead, readSessionReads, appendVerifierResult, readVerifierResults, appendCompletedArtifact, artifactIdentity, buildArtifactKey, readArtifactManifest, resolveArtifactTemplate, safePathComponent, writeArtifactManifest, EVIDENCE_CAPTURE_SCHEMA_VERSION } from "./state.js";
 import { hookEventsForSurface } from "./event-registry.js";
 import { writeAuditEvent } from "../audit/index.js";
 import { RUNTIME_DECISION_EVENT_SCHEMA_VERSION, trustedEvidenceCaptureAttribution } from "../governance/index.js";
@@ -201,7 +202,9 @@ function buildClaudeEvidenceCaptureEvent(params) {
         workflow_asset: attribution.workflowAsset,
         workflow_id: attribution.workflowId,
         run_id: params.runtimeEvent.run_id || params.runtimeEvent.session_id || "unknown",
-        step_id: attribution.stepId === "unknown" && !params.wfState
+        step_id: (attribution.stepId === "unknown"
+            && attribution.workflowId === "unknown"
+            && !params.wfState)
             ? `${params.event}:direct`
             : attribution.stepId,
         fact,
@@ -279,13 +282,17 @@ async function main() {
         irPath = args[irFlagIdx + 1];
     }
     // Read stdin
-    const rawStdin = await readStdin(5000);
+    const stdin = await readStdinResult(5000);
+    if (!stdin.ok) {
+        writeOutput(hookFailureOutput(event, "malformed_input", `Hook input could not be read (${stdin.error ?? "unknown"}).`));
+        return;
+    }
+    const rawStdin = stdin.data;
     // Validate + normalize input against CC hook protocol schema.
-    // Fail-open: invalid input → write stderr warning + silent exit.
     const validation = validateHookInput(event, rawStdin);
     if (!validation.valid) {
         process.stderr.write(`\n  Intent DNA: invalid ${event} input — ${validation.errors.join("; ")}\n`);
-        writeOutput(silentOutput());
+        writeOutput(hookFailureOutput(event, "malformed_input", validation.errors.join("; ")));
         return;
     }
     const rawInput = validation.normalized;
@@ -296,7 +303,7 @@ async function main() {
     const resolvedIRPath = resolve(projectDir, irPath);
     const ir = await loadIR(resolvedIRPath);
     if (!ir) {
-        writeOutput(silentOutput());
+        writeOutput(hookFailureOutput(event, "missing_ir", `Compiled IR is missing, unreadable, invalid, or version-incompatible at ${resolvedIRPath}.`));
         return;
     }
     const output = await runHookEvent({ event, ir, rawInput, projectDir, sessionId });
@@ -354,7 +361,16 @@ export async function runHookEvent(options) {
             return finish(workflowState.output);
         }
         wfStateRaw = workflowState.state;
-        if (event === "SubagentStop" && wfStateRaw && !subagentMatchesWorkflowRole(rawInput, wfStateRaw)) {
+        if (wfStateRaw?.active
+            && typeof rawInput.agent_type === "string"
+            && !subagentMatchesWorkflowRole(rawInput, wfStateRaw)) {
+            if (wfStateRaw.worker_session_id
+                && wfStateRaw.run_id
+                && wfStateRaw.attempt_id) {
+                const mismatch = hookFailureOutput(event, "role_mismatch", "Worker role does not match the Controller-owned Step role.");
+                await writeRuntimeDecision(mismatch, { output: mismatch, trace: { matched_rule: "scope", role: wfStateRaw.current_role } }, wfStateRaw);
+                return finish(mismatch);
+            }
             wfStateRaw = null;
         }
         if (wfStateRaw && wfStateRaw.active) {
@@ -365,16 +381,10 @@ export async function runHookEvent(options) {
                 current_role: wfStateRaw.current_role,
                 completed_artifacts: wfStateRaw.completed_artifacts,
                 iteration: wfStateRaw.iteration, // G4: pass iteration for state-driven rules
+                strict_boundary: Boolean(wfStateRaw.worker_session_id
+                    && wfStateRaw.run_id
+                    && wfStateRaw.attempt_id),
             };
-            if (event !== "SubagentStop") {
-                const artifactFacts = await resolveWorkflowArtifactFactsForHook(projectDir, ir, wfStateRaw, event, sessionId);
-                if ("output" in artifactFacts) {
-                    appendArtifactResolverTrace(projectDir, event, wfStateRaw, artifactFacts.output, sessionId);
-                    await writeRuntimeDecision(artifactFacts.output, { output: artifactFacts.output, trace: { matched_rule: "handoff", step_id: wfStateRaw.current_step } }, wfStateRaw);
-                    return finish(artifactFacts.output);
-                }
-                state.artifactFacts = artifactFacts.facts;
-            }
         }
     }
     if (event === "PreToolUse" && wfStateRaw?.active) {
@@ -715,12 +725,14 @@ function subagentMatchesWorkflowRole(rawInput, wfState) {
     return typeof rawInput.agent_type === "string" && rawInput.agent_type === agentTypeForWorkflowRole(wfState.current_role);
 }
 async function runCodexHookWithLoadedIr(rawInput, projectDir, args, ir) {
-    const sessionId = typeof rawInput.session_id === "string"
-        ? rawInput.session_id
-        : typeof rawInput.sessionId === "string"
-            ? rawInput.sessionId
-            : undefined;
-    const workflowState = await readWorkflowStateWithRootFallback(projectDir, sessionId);
+    const sessionId = typeof rawInput.worker_session_id === "string"
+        ? rawInput.worker_session_id
+        : typeof rawInput.session_id === "string"
+            ? rawInput.session_id
+            : typeof rawInput.sessionId === "string"
+                ? rawInput.sessionId
+                : undefined;
+    const workflowState = await readWorkerWorkflowState(projectDir, sessionId, typeof rawInput.worker_session_id !== "string");
     const workflowAsset = inferWorkflowAssetFromIr(ir, workflowState?.workflow);
     return runCodexHook({ ...rawInput, event: codexHookEventForInput(rawInput, args) }, {
         ir,
@@ -735,21 +747,32 @@ async function runCodexHookWithLoadedIr(rawInput, projectDir, args, ir) {
     });
 }
 async function runCodexHookCli(args) {
+    let policyEvent = "PostToolUse";
     try {
-        const rawInput = await readStdin(5000);
+        const stdin = await readStdinResult(5000);
+        const candidateEvent = codexHookEventForInput(stdin.data, args);
+        if (typeof candidateEvent === "string" && VALID_EVENTS.has(candidateEvent)) {
+            policyEvent = candidateEvent;
+        }
+        if (!stdin.ok) {
+            writeOutput(hookFailureOutput(policyEvent, "malformed_input", `Codex Hook input could not be read (${stdin.error ?? "unknown"}).`));
+            return;
+        }
+        const rawInput = stdin.data;
         const projectDir = typeof rawInput.cwd === "string" ? rawInput.cwd : process.cwd();
         const irPath = argValue(args, "--ir") ?? DEFAULT_IR_PATH;
         const ir = await loadIR(resolve(projectDir, irPath));
         if (!ir) {
-            writeOutput(silentOutput());
+            writeOutput(hookFailureOutput(policyEvent, "missing_ir", `Compiled IR is missing, unreadable, invalid, or version-incompatible at ${resolve(projectDir, irPath)}.`));
             return;
         }
         const result = await runCodexHookWithLoadedIr(rawInput, projectDir, args, ir);
         writeOutput(result.output);
     }
     catch (err) {
-        process.stderr.write(`\n  Intent DNA: CodexHook failed open — ${err instanceof Error ? err.message : String(err)}\n`);
-        writeOutput(silentOutput());
+        const detail = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`\n  Intent DNA: CodexHook enforcement failed — ${detail}\n`);
+        writeOutput(hookFailureOutput(policyEvent, "gate_evaluation", detail));
     }
 }
 // ── IR Loading ─────────────────────────────────────────────
@@ -764,6 +787,7 @@ async function loadIR(irPath) {
             if (data.ir_version !== EXPECTED_IR_VERSION) {
                 process.stderr.write(`\n  Intent DNA: IR version mismatch (v${data.ir_version} on disk, v${EXPECTED_IR_VERSION} expected)\n` +
                     `  Fix: run \`dna sync\` to recompile\n\n`);
+                return null;
             }
             return data.ir;
         }
@@ -938,20 +962,25 @@ function artifactResolverErrorOutput(event, error) {
 }
 async function readWorkflowStateForHook(projectDir, event, sessionId) {
     try {
-        const state = event === "SubagentStop"
-            ? await readWorkflowStateWithRootFallback(projectDir, sessionId)
-            : await readWorkflowState(projectDir, sessionId);
+        let state = sessionId
+            ? await readWorkflowState(projectDir, sessionId)
+            : null;
+        if (!state && event === "SubagentStop") {
+            state = await readWorkflowState(projectDir);
+        }
         return { state };
     }
     catch (error) {
         return { output: artifactResolverErrorOutput(event, error) };
     }
 }
-async function readWorkflowStateWithRootFallback(projectDir, sessionId) {
-    if (!sessionId)
-        return readWorkflowState(projectDir);
-    const sessionState = await readWorkflowState(projectDir, sessionId);
-    return sessionState ?? readWorkflowState(projectDir);
+async function readWorkerWorkflowState(projectDir, sessionId, allowRootFallback = false) {
+    const workerState = sessionId
+        ? await readWorkflowState(projectDir, sessionId)
+        : null;
+    if (workerState || !allowRootFallback)
+        return workerState;
+    return readWorkflowState(projectDir);
 }
 async function resolveWorkflowArtifactFactsForHook(projectDir, ir, wfState, event, sessionId) {
     try {
@@ -1302,7 +1331,7 @@ const TEST_PASSED_RE = /(\d+)\s+(?:tests?\s+)?passed/i;
  */
 async function handleSurgeonReflection(ir, input, projectDir, sessionId) {
     const agentType = typeof input.agent_type === "string" ? input.agent_type : undefined;
-    if (!agentType)
+    if (!agentType || !sessionId)
         return null;
     const toolName = String(input.tool_name ?? "");
     const toolOutput = typeof input.tool_output === "string" ? input.tool_output : undefined;
@@ -1341,12 +1370,14 @@ async function handleSurgeonReflection(ir, input, projectDir, sessionId) {
     blockedItemsPath = reflectionConfig.blocked_items_path;
     if (!maxAttempts)
         return null;
-    // Read current surgeon state
-    const surgeonState = await readSurgeonAttempts(projectDir, sessionId);
     // Track edits
     if (toolName === "Edit") {
-        surgeonState.edit_count++;
-        await writeSurgeonAttempts(projectDir, surgeonState, sessionId);
+        if (!sessionId)
+            return null;
+        await updateSurgeonAttempts(projectDir, sessionId, (state) => ({
+            ...state,
+            edit_count: state.edit_count + 1,
+        }));
         return null;
     }
     // Track test results from Bash
@@ -1354,43 +1385,44 @@ async function handleSurgeonReflection(ir, input, projectDir, sessionId) {
         const match = toolOutput.match(TEST_PASSED_RE);
         if (!match)
             return null; // Can't parse — fail-open
-        const greenCount = parseInt(match[1], 10);
-        surgeonState.bash_test_count++;
-        surgeonState.current_green_count = greenCount;
-        if (!surgeonState.baseline_established) {
-            surgeonState.baseline_established = true;
-            surgeonState.last_green_count = greenCount;
-            await writeSurgeonAttempts(projectDir, surgeonState, sessionId);
+        if (!sessionId)
             return null;
-        }
-        // Check progress: green count should increase after edits
-        if (surgeonState.edit_count >= 2 && greenCount <= surgeonState.last_green_count) {
-            surgeonState.fail_count++;
-            const result = checkReflectionLimit(surgeonState.fail_count, maxAttempts, surgeonState.handoff_count, maxHandoffs);
-            // Update last_green_count for next comparison
-            surgeonState.last_green_count = greenCount;
-            surgeonState.edit_count = 0;
-            await writeSurgeonAttempts(projectDir, surgeonState, sessionId);
-            if (result.action === "handoff" || result.action === "warn") {
-                const target = handoffTo ? ` Hand off to '${handoffTo}' for re-analysis.` : "";
-                return allowOutput(`WARN [Intent DNA] Reflection Gate: ${result.reason}${target}\n` +
-                    `Review experience_chain in .dna/state/workflow/surgeon-attempts.json before next attempt.`);
+        const greenCount = parseInt(match[1], 10);
+        let reflectionOutput = null;
+        await updateSurgeonAttempts(projectDir, sessionId, (surgeonState) => {
+            surgeonState.bash_test_count++;
+            surgeonState.current_green_count = greenCount;
+            if (!surgeonState.baseline_established) {
+                surgeonState.baseline_established = true;
+                surgeonState.last_green_count = greenCount;
+                return surgeonState;
             }
-            if (result.action === "skip") {
-                const path = blockedItemsPath ? ` Record blocked item to ${blockedItemsPath}.` : "";
-                return allowOutput(`WARN [Intent DNA] Reflection Gate: ${result.reason}${path}\n` +
-                    `SKIP this item and move to the next.`);
+            if (surgeonState.edit_count >= 2 && greenCount <= surgeonState.last_green_count) {
+                surgeonState.fail_count++;
+                const result = checkReflectionLimit(surgeonState.fail_count, maxAttempts, surgeonState.handoff_count, maxHandoffs);
+                surgeonState.last_green_count = greenCount;
+                surgeonState.edit_count = 0;
+                if (result.action === "handoff" || result.action === "warn") {
+                    const target = handoffTo ? ` Hand off to '${handoffTo}' for re-analysis.` : "";
+                    reflectionOutput = allowOutput(`WARN [Intent DNA] Reflection Gate: ${result.reason}${target}\n` +
+                        `Review experience_chain in the worker Hook state before next attempt.`);
+                }
+                else if (result.action === "skip") {
+                    const path = blockedItemsPath ? ` Record blocked item to ${blockedItemsPath}.` : "";
+                    reflectionOutput = allowOutput(`WARN [Intent DNA] Reflection Gate: ${result.reason}${path}\n` +
+                        `SKIP this item and move to the next.`);
+                }
             }
-        }
-        else {
-            // Progress made — reset counters
-            surgeonState.last_green_count = greenCount;
-            surgeonState.edit_count = 0;
-            if (greenCount > surgeonState.last_green_count) {
-                surgeonState.fail_count = 0;
+            else {
+                const madeProgress = greenCount > surgeonState.last_green_count;
+                surgeonState.last_green_count = greenCount;
+                surgeonState.edit_count = 0;
+                if (madeProgress)
+                    surgeonState.fail_count = 0;
             }
-        }
-        await writeSurgeonAttempts(projectDir, surgeonState, sessionId);
+            return surgeonState;
+        });
+        return reflectionOutput;
     }
     return null;
 }
@@ -1418,7 +1450,6 @@ async function loadReflectionConfig(projectDir, _workflowName, _stepId) {
  *   2. Context Gate — block Edit/Write/Bash when required context files unread
  *
  * Returns the first triggered block, or null if all gates pass.
- * Fail-open on any exception.
  */
 export async function handlePreToolGates(ir, rawInput, wfState, projectDir, sessionId) {
     try {
@@ -1477,8 +1508,12 @@ export async function handlePreToolGates(ir, rawInput, wfState, projectDir, sess
             }
         }
     }
-    catch {
-        // Fail-open: gate failures never block execution
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        return {
+            output: blockOutput(`[Intent DNA] gate_evaluation: PreToolUse gates could not be evaluated safely (${detail}).`),
+            matched_rule: "context_gate",
+        };
     }
     return null;
 }
@@ -1548,8 +1583,12 @@ function isDirectEntryPoint() {
     }
 }
 if (isDirectEntryPoint()) {
-    main().catch(() => {
-        // Fail-open: never block Claude Code on unexpected errors
-        writeOutput(silentOutput());
+    main().catch((error) => {
+        const eventArg = process.argv[2];
+        const event = VALID_EVENTS.has(eventArg)
+            ? eventArg
+            : "PostToolUse";
+        const detail = error instanceof Error ? error.message : String(error);
+        writeOutput(hookFailureOutput(event, "gate_evaluation", detail));
     });
 }

package/dist/hooks/enforce.d.ts

@@ -31,6 +31,8 @@ export interface EnforceState {
         completed_artifacts?: CompletedArtifactEntry[];
         /** G4: current workflow iteration (for relax_after_iteration rules) */
         iteration?: number;
+        /** True only for Controller-owned disposable worker Hook state. */
+        strict_boundary?: boolean;
     };
     /** Resolved artifact facts loaded by CLI/state before pure enforcement. */
     artifactFacts?: ArtifactFact[];