intentdna 1.8.7 → 1.9.0-rc.2

package/dist/runtime/verifier.js

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 import { readFile, realpath, stat } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { EvaluatorResultError, parseEvaluatorResult } from "./evaluator.js";
 export const DEFAULT_VERIFIER_COMMAND_TIMEOUT_MS = 30_000;
 export const MAX_VERIFIER_EVIDENCE_BYTES = 4096;
 export const VERIFIER_DIAGNOSTIC_PREFIX = "INTENTDNA_DIAGNOSTIC:";
@@ -8,6 +9,12 @@ export const MAX_VERIFIER_DIAGNOSTIC_BYTES = 2048;
 const VERIFIER_DIAGNOSTIC_CODE = /^INTENTDNA_DIAGNOSTIC:[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/;
 const SAFE_COMMAND_VARIABLE_RE = /^[A-Za-z0-9_-]+$/;
 const SAFE_PATH_VARIABLE_RE = /^[-A-Za-z0-9_./]+$/;
+function isSafeRelativePathVariable(value) {
+    return SAFE_PATH_VARIABLE_RE.test(value) &&
+        !value.startsWith("/") &&
+        !value.includes("//") &&
+        !value.split(/[\\/]+/).includes("..");
+}
 export function resolveVerifierTemplate(template, variables) {
     let resolved = template;
     if (variables?.ARGUMENTS !== undefined) {
@@ -32,9 +39,10 @@ export function validateVerifierTemplateVariables(template, variables, mode = "c
         const value = variables?.[name];
         if (value === undefined)
             continue;
+        const isPathVariable = /(?:^|_)(?:path|dir|file)$/.test(name);
         const matchesSafeCharacters = mode === "path"
-            ? SAFE_PATH_VARIABLE_RE.test(value) && !value.startsWith("/") && !value.includes("//") && !value.split(/[\\/]+/).includes("..")
-            : SAFE_COMMAND_VARIABLE_RE.test(value);
+            ? isSafeRelativePathVariable(value)
+            : SAFE_COMMAND_VARIABLE_RE.test(value) || (isPathVariable && isSafeRelativePathVariable(value));
         if (!matchesSafeCharacters) {
             return {
                 valid: false,
@@ -308,6 +316,8 @@ export function getCompletionCheckFields(completion) {
         fields.push("file_contains");
     if (completion.command_success !== undefined)
         fields.push("command_success");
+    if (completion.evaluator_result !== undefined)
+        fields.push("evaluator_result");
     return fields;
 }
 export function validateCompletionVerifier(completion) {
@@ -340,6 +350,30 @@ export function validateCompletionVerifier(completion) {
             return { message: "Completion verifier file_contains.pattern must be a non-empty string", evidence: "invalid:file_contains.pattern" };
         }
     }
+    if (field === "evaluator_result") {
+        const evaluatorResult = completion.evaluator_result;
+        if (typeof evaluatorResult !== "object"
+            || evaluatorResult === null
+            || Array.isArray(evaluatorResult)) {
+            return {
+                message: "Completion verifier evaluator_result must define a path and optional require_score",
+                evidence: "invalid:evaluator_result",
+            };
+        }
+        if (typeof evaluatorResult.path !== "string" || !evaluatorResult.path) {
+            return {
+                message: "Completion verifier evaluator_result.path must be a non-empty string",
+                evidence: "invalid:evaluator_result.path",
+            };
+        }
+        if (evaluatorResult.require_score !== undefined
+            && typeof evaluatorResult.require_score !== "boolean") {
+            return {
+                message: "Completion verifier evaluator_result.require_score must be a boolean",
+                evidence: "invalid:evaluator_result.require_score",
+            };
+        }
+    }
     return null;
 }
 export async function runCompletionVerifier(completion, ir, context) {
@@ -417,6 +451,71 @@ export async function runCompletionVerifier(completion, ir, context) {
             return { passed: false, target, evidence, artifact, message: `Required file missing: ${target}` };
         }
     }
+    if (completion.evaluator_result) {
+        const evaluatorResult = completion.evaluator_result;
+        const safeVariables = validateVerifierTemplateVariables(evaluatorResult.path, context.variables, "path");
+        if (safeVariables.valid === false) {
+            return {
+                passed: false,
+                target: evaluatorResult.path,
+                evidence: safeVariables.evidence,
+                message: safeVariables.message,
+            };
+        }
+        const target = resolveVerifierTemplate(evaluatorResult.path, context.variables);
+        if (hasUnresolvedVerifierTemplate(target)) {
+            return {
+                passed: false,
+                target,
+                evidence: "unresolved_template",
+                message: unresolvedVerifierTemplateMessage(target),
+            };
+        }
+        const resolvedTarget = await resolveVerifierTarget(context.projectDir, target);
+        const artifact = resolvedTarget ?? undefined;
+        if (!resolvedTarget) {
+            return {
+                passed: false,
+                target,
+                evidence: "path_escape",
+                artifact,
+                message: `Verifier target escapes project root: ${target}`,
+            };
+        }
+        try {
+            const raw = await readFile(resolvedTarget, "utf-8");
+            const parsed = parseEvaluatorResult(raw, {
+                require_score: evaluatorResult.require_score,
+            });
+            const evidence = `pass=${String(parsed.pass)} score=${parsed.score ?? "n/a"}`;
+            return parsed.pass
+                ? {
+                    passed: true,
+                    target,
+                    evidence,
+                    artifact,
+                }
+                : {
+                    passed: false,
+                    target,
+                    evidence,
+                    artifact,
+                    message: "Evaluator result reported pass=false",
+                };
+        }
+        catch (error) {
+            const message = error instanceof EvaluatorResultError
+                ? error.message
+                : `Required evaluator result missing: ${target}`;
+            return {
+                passed: false,
+                target,
+                evidence: "invalid_evaluator_result",
+                artifact,
+                message,
+            };
+        }
+    }
     const rawCommand = completion.command_success;
     const commandResolution = resolveVerifierCommand(rawCommand, ir.verifier_policy, context.variables);
     if (!commandResolution.command)

package/dist/runtime/workflow-plan-adapter.d.ts

@@ -1,5 +1,5 @@
 import type { RoleDef, WorkflowPlan, WorkflowStep } from "../schema/types.js";
-import type { ControllerStepDefinition, MaterializeStepPacketInput } from "./run-controller.js";
+import type { ControllerStepDefinition, MaterializeStepPacketInput, WorkflowRetryLoopPolicy } from "./run-controller.js";
 import type { TerminalOutcomeKind } from "./run-contracts.js";
 export type WorkflowPlanAdapterErrorCode = "invalid_plan" | "missing_role" | "invalid_handoff" | "unsupported_routing";
 export declare class WorkflowPlanAdapterError extends Error {
@@ -18,6 +18,7 @@ export interface WorkflowPlanAdapterOptions {
     readonly retry_max_delay_ms?: number | null;
     readonly retryable_outcomes?: readonly TerminalOutcomeKind[];
 }
+export declare function adaptWorkflowRetryLoop(plan: WorkflowPlan, options?: Pick<WorkflowPlanAdapterOptions, "retry_initial_delay_ms" | "retry_max_delay_ms">): WorkflowRetryLoopPolicy | null;
 /**
  * Adapt one compiled workflow plan into Controller definitions. Every
  * materializer creates a self-contained packet from Controller-resolved inputs;

package/dist/runtime/workflow-plan-adapter.js

@@ -63,6 +63,12 @@ function completionText(completion, variables) {
     if (completion.file_contains !== undefined) {
         return `Required file ${substitute(completion.file_contains.path, variables)} contains /${completion.file_contains.pattern}/`;
     }
+    if (completion.evaluator_result !== undefined) {
+        const score = completion.evaluator_result.require_score === true
+            ? " and includes a finite numeric score"
+            : "";
+        return `Required evaluator result ${substitute(completion.evaluator_result.path, variables)} reports pass=true${score}`;
+    }
     return `Required command succeeds: ${substitute(completion.command_success ?? "", variables)}`;
 }
 function checkpointText(checkpoint, variables) {
@@ -184,13 +190,14 @@ function createHandoffs(step, stepById, variables) {
     }
     return { handoffs: declarations, external_inputs: externalInputs };
 }
-function retryPolicy(plan, step, options) {
+function retryPolicy(plan, step, options, hasWorkflowLoop) {
     const initialDelay = options.retry_initial_delay_ms ?? 0;
     const maxDelay = options.retry_max_delay_ms ?? null;
     requireNonNegativeInteger(initialDelay, "retry_initial_delay_ms");
     if (maxDelay !== null)
         requireNonNegativeInteger(maxDelay, "retry_max_delay_ms");
-    const maxAttempts = step.max_attempts ?? plan.retry.max_retries + 1;
+    const maxAttempts = step.max_attempts
+        ?? (hasWorkflowLoop ? 1 : plan.retry.max_retries + 1);
     if (!Number.isSafeInteger(maxAttempts) || maxAttempts < 1) {
         throw new WorkflowPlanAdapterError("invalid_plan", `step '${step.id}' has an invalid max attempt count`, step.id);
     }
@@ -304,18 +311,72 @@ function standalonePrompt(plan, adapted, bindings, variables) {
     }
     return lines.join("\n");
 }
-function validatePlanRouting(plan) {
-    if (plan.transitions.length > 0) {
-        throw new WorkflowPlanAdapterError("unsupported_routing", "conditional workflow transitions cannot be represented by the Foundation Controller dependency contract");
+export function adaptWorkflowRetryLoop(plan, options = {}) {
+    const hasLoopRouting = (plan.retry.retry_from !== null
+        || plan.transitions.length > 0);
+    if (!hasLoopRouting)
+        return null;
+    if (plan.retry.max_retries < 1) {
+        throw new WorkflowPlanAdapterError("unsupported_routing", "workflow retry routing requires max_retries greater than zero");
+    }
+    const retryFrom = plan.retry.retry_from
+        ?? plan.transitions.find((transition) => (transition.condition === "fail"
+            || transition.condition === "error"))?.to
+        ?? null;
+    const retryIndex = retryFrom === null
+        ? -1
+        : plan.steps.findIndex((step) => step.id === retryFrom);
+    if (retryFrom === null || retryIndex < 0) {
+        throw new WorkflowPlanAdapterError("unsupported_routing", "workflow retry routing must resolve a valid retry_from Step");
+    }
+    for (const transition of plan.transitions) {
+        const sourceIndex = plan.steps.findIndex((step) => step.id === transition.from);
+        if ((transition.condition !== "fail" && transition.condition !== "error")
+            || transition.to !== retryFrom
+            || sourceIndex < retryIndex) {
+            throw new WorkflowPlanAdapterError("unsupported_routing", `transition '${transition.from}' -> '${transition.to}' (${transition.condition}) is outside the bounded retry segment`, transition.from);
+        }
+    }
+    const loopStepIds = plan.steps
+        .slice(retryIndex)
+        .map((step) => step.id);
+    const loopStepSet = new Set(loopStepIds);
+    if (plan.parallel_groups.some((group) => (group.step_ids.length > 1
+        && group.step_ids.some((stepId) => loopStepSet.has(stepId))))) {
+        throw new WorkflowPlanAdapterError("unsupported_routing", "bounded workflow retry does not yet support a parallel retry segment");
     }
-    if (plan.retry.retry_from !== null) {
-        throw new WorkflowPlanAdapterError("unsupported_routing", "workflow retry_from cannot be represented by per-Step Foundation retries");
+    for (const [index, step] of plan.steps.entries()) {
+        if (step.run_if === null)
+            continue;
+        if (index < retryIndex && step.run_if === "round == 1")
+            continue;
+        throw new WorkflowPlanAdapterError("unsupported_routing", `step '${step.id}' uses unsupported loop condition '${step.run_if}'`, step.id);
     }
+    const initialDelay = options.retry_initial_delay_ms ?? 0;
+    const maxDelay = options.retry_max_delay_ms ?? null;
+    requireNonNegativeInteger(initialDelay, "retry_initial_delay_ms");
+    if (maxDelay !== null) {
+        requireNonNegativeInteger(maxDelay, "retry_max_delay_ms");
+    }
+    return {
+        retry_from: retryFrom,
+        step_ids: loopStepIds,
+        completion_step: loopStepIds[loopStepIds.length - 1],
+        max_retries: plan.retry.max_retries,
+        backoff: plan.retry.backoff,
+        initial_delay_ms: initialDelay,
+        max_delay_ms: maxDelay,
+    };
+}
+function validatePlanRouting(plan, options) {
+    const workflowLoop = adaptWorkflowRetryLoop(plan, options);
     for (const step of plan.steps) {
         if (step.optional) {
             throw new WorkflowPlanAdapterError("unsupported_routing", `step '${step.id}' is optional, which the Foundation Controller cannot preserve on failure`, step.id);
         }
-        if (step.run_if !== null && plan.retry.max_retries > 0) {
+        if (workflowLoop === null
+            && step.run_if !== null
+            && plan.retry.max_retries > 0) {
             throw new WorkflowPlanAdapterError("unsupported_routing", `step '${step.id}' uses run_if across retry rounds, which the Foundation Controller cannot evaluate`, step.id);
         }
         if (step.on_fail === "handoff"
@@ -326,6 +387,7 @@ function validatePlanRouting(plan) {
             throw new WorkflowPlanAdapterError("unsupported_routing", `step '${step.id}' uses legacy failure routing not represented by the Foundation Controller`, step.id);
         }
     }
+    return workflowLoop;
 }
 function runsInSingleRound(condition) {
     if (condition === null)
@@ -349,7 +411,7 @@ function runsInSingleRound(condition) {
  * no provider transcript or prior-session state is accepted by this API.
  */
 export function adaptWorkflowPlan(plan, options) {
-    validatePlanRouting(plan);
+    const workflowLoop = validatePlanRouting(plan, options);
     if (!options.working_directory) {
         throw new WorkflowPlanAdapterError("invalid_plan", "working_directory must be non-empty");
     }
@@ -374,7 +436,7 @@ export function adaptWorkflowPlan(plan, options) {
             external_inputs,
             outputs: createOutputContract(step, variables),
             isolation: isolationForStep(plan.parallel_groups, step.id),
-            retry: retryPolicy(plan, step, options),
+            retry: retryPolicy(plan, step, options, workflowLoop !== null),
         };
     });
     return adapted.map((entry) => ({
@@ -384,6 +446,10 @@ export function adaptWorkflowPlan(plan, options) {
         retry_policy: entry.retry,
         handoffs: entry.handoffs,
         materialize_packet(input) {
+            const packetVariables = {
+                ...variables,
+                round: String(input.workflow_round),
+            };
             const workingDirectory = options.working_directory_for_step?.(entry.step, input) ?? options.working_directory;
             if (!workingDirectory) {
                 throw new WorkflowPlanAdapterError("invalid_plan", `step '${entry.step.id}' resolved an empty working directory`, entry.step.id);
@@ -395,9 +461,10 @@ export function adaptWorkflowPlan(plan, options) {
                 attempt_id: input.attempt_id,
                 worker_session_id: input.worker_session_id,
                 attempt_number: input.attempt_number,
+                workflow_round: input.workflow_round,
                 role: entry.step.role,
                 constraints: entry.constraints,
-                standalone_prompt: standalonePrompt(plan, entry, input.input_bindings, variables),
+                standalone_prompt: standalonePrompt(plan, entry, input.input_bindings, packetVariables),
                 input_bindings: input.input_bindings,
                 output_contract: entry.outputs,
                 workspace: {

package/dist/runtime/workflow-runtime-manifest.d.ts

@@ -0,0 +1,48 @@
+import type { WorkflowPlan } from "../schema/types.js";
+export declare const WORKFLOW_RUNTIME_MANIFEST_SCHEMA = "intentdna.workflow_runtime_manifest.v1";
+export declare const WORKFLOW_RUNTIME_INPUT_VARIABLE_NAMES: Set<string>;
+export interface WorkflowRuntimeBinding {
+    workflow: string;
+    workflow_asset?: string;
+    template_variable_refs: string[];
+    runtime_input_refs: string[];
+    requires_arguments: boolean;
+    resolved_variables: Record<string, string>;
+}
+export interface WorkflowRuntimeManifestPayload {
+    schema_version: typeof WORKFLOW_RUNTIME_MANIFEST_SCHEMA;
+    compiled_at: string;
+    compiled_ir_hash: string;
+    source_dna_ids: string[];
+    workflows: Record<string, WorkflowRuntimeBinding>;
+}
+export interface WorkflowRuntimeManifest extends WorkflowRuntimeManifestPayload {
+    manifest_hash: string;
+}
+export type WorkflowRuntimeManifestValidation = {
+    valid: true;
+    manifest: WorkflowRuntimeManifest;
+} | {
+    valid: false;
+    reason: string;
+};
+export declare function workflowContainsToken(plan: WorkflowPlan, token: string): boolean;
+export declare function workflowUsesArguments(plan: WorkflowPlan, resolvedVariables?: Record<string, string>): boolean;
+export declare function valueUsesArguments(value: unknown, resolvedVariables?: Record<string, string>): boolean;
+export declare function collectTemplateVariableRefs(value: unknown): string[];
+export declare function collectWorkflowTemplateVariableRefs(plan: WorkflowPlan): string[];
+export declare function resolveVariableReferences(variables: Record<string, string>): Record<string, string>;
+export declare function resolveWorkflowVariableReferences(variables: Record<string, string>): Record<string, string>;
+export declare function createWorkflowRuntimeManifest(options: {
+    plans: Array<{
+        plan: WorkflowPlan;
+        resolvedVariables: Record<string, string>;
+        workflowAsset?: string;
+        additionalTemplateVariableRefs?: string[];
+        additionalRuntimeValues?: unknown;
+    }>;
+    compiledAt: string;
+    compiledIrHash: string;
+    sourceDnaIds: string[];
+}): WorkflowRuntimeManifest;
+export declare function validateWorkflowRuntimeManifest(value: unknown, expectedCompiledIrHash?: string): WorkflowRuntimeManifestValidation;

package/dist/runtime/workflow-runtime-manifest.js

@@ -0,0 +1,196 @@
+import { createHash } from "node:crypto";
+export const WORKFLOW_RUNTIME_MANIFEST_SCHEMA = "intentdna.workflow_runtime_manifest.v1";
+export const WORKFLOW_RUNTIME_INPUT_VARIABLE_NAMES = new Set(["ARGUMENTS", "arguments", "task_id"]);
+function canonicalJson(value) {
+    if (Array.isArray(value))
+        return value.map((item) => canonicalJson(item));
+    if (value && typeof value === "object") {
+        const record = value;
+        return Object.fromEntries(Object.keys(record).sort().map((key) => [key, canonicalJson(record[key])]));
+    }
+    return value;
+}
+function payloadHash(payload) {
+    const content = JSON.stringify(canonicalJson(payload));
+    return `sha256:${createHash("sha256").update(content, "utf-8").digest("hex")}`;
+}
+function visitStrings(value, visit) {
+    if (typeof value === "string") {
+        visit(value);
+    }
+    else if (Array.isArray(value)) {
+        for (const item of value)
+            visitStrings(item, visit);
+    }
+    else if (value && typeof value === "object") {
+        for (const item of Object.values(value))
+            visitStrings(item, visit);
+    }
+}
+export function workflowContainsToken(plan, token) {
+    let found = false;
+    visitStrings(plan, (text) => {
+        if (text.includes(token))
+            found = true;
+    });
+    return found;
+}
+export function workflowUsesArguments(plan, resolvedVariables = {}) {
+    return valueUsesArguments(plan, resolvedVariables);
+}
+export function valueUsesArguments(value, resolvedVariables = {}) {
+    let containsArguments = false;
+    visitStrings(value, (text) => {
+        if (text.includes("$ARGUMENTS"))
+            containsArguments = true;
+    });
+    if (containsArguments)
+        return true;
+    const flattenedVariables = resolveWorkflowVariableReferences(resolvedVariables);
+    return collectTemplateVariableRefs(value).some((name) => WORKFLOW_RUNTIME_INPUT_VARIABLE_NAMES.has(name) ||
+        !Object.prototype.hasOwnProperty.call(flattenedVariables, name) ||
+        flattenedVariables[name].includes("$ARGUMENTS"));
+}
+export function collectTemplateVariableRefs(value) {
+    const refs = new Set();
+    const variablePattern = /\{\{(\w+)\}\}/g;
+    visitStrings(value, (text) => {
+        for (const match of text.matchAll(variablePattern))
+            refs.add(match[1]);
+    });
+    return [...refs].sort();
+}
+export function collectWorkflowTemplateVariableRefs(plan) {
+    return collectTemplateVariableRefs(plan);
+}
+export function resolveVariableReferences(variables) {
+    const resolved = {};
+    const resolving = [];
+    const resolveVariable = (name) => {
+        if (resolved[name] !== undefined)
+            return resolved[name];
+        if (!Object.prototype.hasOwnProperty.call(variables, name)) {
+            const parent = resolving[resolving.length - 1] ?? "unknown";
+            throw new Error(`Variable ${parent} references undefined variable ${name}`);
+        }
+        const cycleIndex = resolving.indexOf(name);
+        if (cycleIndex >= 0) {
+            throw new Error(`Variable reference cycle: ${[...resolving.slice(cycleIndex), name].join(" -> ")}`);
+        }
+        resolving.push(name);
+        const value = variables[name].replace(/\{\{(\w+)\}\}/g, (_match, dependency) => resolveVariable(dependency));
+        resolving.pop();
+        resolved[name] = value;
+        return value;
+    };
+    for (const name of Object.keys(variables).sort())
+        resolveVariable(name);
+    return resolved;
+}
+export function resolveWorkflowVariableReferences(variables) {
+    return resolveVariableReferences({
+        ...variables,
+        ARGUMENTS: "$ARGUMENTS",
+        arguments: "$ARGUMENTS",
+        task_id: "$ARGUMENTS",
+    });
+}
+export function createWorkflowRuntimeManifest(options) {
+    const workflows = {};
+    for (const item of [...options.plans].sort((a, b) => {
+        const aId = a.plan.workflow_key ?? a.plan.source_workflow;
+        const bId = b.plan.workflow_key ?? b.plan.source_workflow;
+        return aId.localeCompare(bId);
+    })) {
+        const planVariables = resolveWorkflowVariableReferences(item.resolvedVariables);
+        const { plan } = item;
+        const workflow = plan.workflow_key ?? plan.source_workflow;
+        const templateVariableRefs = [
+            ...new Set([
+                ...collectWorkflowTemplateVariableRefs(plan),
+                ...(item.additionalTemplateVariableRefs ?? []),
+                ...collectTemplateVariableRefs(item.additionalRuntimeValues),
+            ]),
+        ].sort();
+        const resolvedVariables = Object.fromEntries(templateVariableRefs
+            .filter((name) => !WORKFLOW_RUNTIME_INPUT_VARIABLE_NAMES.has(name))
+            .filter((name) => Object.prototype.hasOwnProperty.call(planVariables, name))
+            .map((name) => [name, planVariables[name]]));
+        const undefinedVariableRefs = templateVariableRefs.filter((name) => !WORKFLOW_RUNTIME_INPUT_VARIABLE_NAMES.has(name) &&
+            !Object.prototype.hasOwnProperty.call(planVariables, name));
+        if (undefinedVariableRefs.length > 0) {
+            throw new Error(`Workflow ${workflow} references undefined template variable(s): ${undefinedVariableRefs.join(", ")}. Declare them in DNA variables or use $ARGUMENTS/task_id for runtime input.`);
+        }
+        const runtimeInputRefs = templateVariableRefs.filter((name) => WORKFLOW_RUNTIME_INPUT_VARIABLE_NAMES.has(name) ||
+            !Object.prototype.hasOwnProperty.call(planVariables, name));
+        const requiresArguments = workflowUsesArguments(plan, planVariables) ||
+            valueUsesArguments(item.additionalRuntimeValues, planVariables) ||
+            runtimeInputRefs.length > 0;
+        workflows[workflow] = {
+            workflow,
+            ...(item.workflowAsset ? { workflow_asset: item.workflowAsset } : {}),
+            template_variable_refs: templateVariableRefs,
+            runtime_input_refs: [
+                ...(requiresArguments ? ["ARGUMENTS"] : []),
+                ...runtimeInputRefs.filter((name) => name !== "ARGUMENTS"),
+            ].filter((name, index, names) => names.indexOf(name) === index).sort(),
+            requires_arguments: requiresArguments,
+            resolved_variables: resolvedVariables,
+        };
+    }
+    const payload = {
+        schema_version: WORKFLOW_RUNTIME_MANIFEST_SCHEMA,
+        compiled_at: options.compiledAt,
+        compiled_ir_hash: options.compiledIrHash,
+        source_dna_ids: [...options.sourceDnaIds],
+        workflows,
+    };
+    return { ...payload, manifest_hash: payloadHash(payload) };
+}
+function isStringRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value) &&
+        Object.values(value).every((item) => typeof item === "string");
+}
+export function validateWorkflowRuntimeManifest(value, expectedCompiledIrHash) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return { valid: false, reason: "workflow_runtime manifest must be an object" };
+    }
+    const manifest = value;
+    if (manifest.schema_version !== WORKFLOW_RUNTIME_MANIFEST_SCHEMA) {
+        return { valid: false, reason: `unsupported workflow_runtime schema: ${String(manifest.schema_version)}` };
+    }
+    if (typeof manifest.compiled_at !== "string" || !Array.isArray(manifest.source_dna_ids) ||
+        !manifest.source_dna_ids.every((item) => typeof item === "string") ||
+        !manifest.workflows || typeof manifest.workflows !== "object" || Array.isArray(manifest.workflows) ||
+        typeof manifest.manifest_hash !== "string") {
+        return { valid: false, reason: "workflow_runtime manifest has invalid metadata" };
+    }
+    if (typeof manifest.compiled_ir_hash !== "string") {
+        return { valid: false, reason: "workflow_runtime compiled_ir_hash is required" };
+    }
+    if (expectedCompiledIrHash && manifest.compiled_ir_hash !== expectedCompiledIrHash) {
+        return { valid: false, reason: "workflow_runtime compiled_ir_hash does not match compiled IR" };
+    }
+    const workflows = manifest.workflows;
+    for (const [workflow, rawBinding] of Object.entries(workflows)) {
+        if (!rawBinding || typeof rawBinding !== "object" || Array.isArray(rawBinding)) {
+            return { valid: false, reason: `workflow_runtime binding ${workflow} must be an object` };
+        }
+        const binding = rawBinding;
+        if (binding.workflow !== workflow ||
+            (binding.workflow_asset !== undefined && typeof binding.workflow_asset !== "string") ||
+            !Array.isArray(binding.template_variable_refs) ||
+            !binding.template_variable_refs.every((item) => typeof item === "string") ||
+            !Array.isArray(binding.runtime_input_refs) ||
+            !binding.runtime_input_refs.every((item) => typeof item === "string") ||
+            typeof binding.requires_arguments !== "boolean" ||
+            !isStringRecord(binding.resolved_variables)) {
+            return { valid: false, reason: `workflow_runtime binding ${workflow} is invalid` };
+        }
+    }
+    const { manifest_hash: manifestHash, ...payload } = manifest;
+    if (payloadHash(payload) !== manifestHash) {
+        return { valid: false, reason: "workflow_runtime manifest_hash is invalid" };
+    }
+    return { valid: true, manifest: manifest };
+}

package/dist/runtime/workflow-variable-scopes.d.ts

@@ -0,0 +1,12 @@
+import type { IntentDNA, VariableDef } from "../schema/types.js";
+export interface WorkflowVariableScopeIndex {
+    rawByNamespace: Map<string, Record<string, string | VariableDef>>;
+    namespaceLastIndex: Map<string, number>;
+    workflowNamespaces: Map<string, string>;
+    workflowAssets: Map<string, string>;
+    controllerNamespaces: Map<string, string>;
+}
+export declare function indexWorkflowVariableScopes(dnas: IntentDNA[]): WorkflowVariableScopeIndex;
+export declare function defaultResolvedVariableScopes(index: WorkflowVariableScopeIndex): Map<string, Record<string, string>>;
+export declare function flattenResolvedVariableScopes(index: WorkflowVariableScopeIndex, resolvedByNamespace: Map<string, Record<string, string>>): Record<string, string>;
+export declare function resolvedVariablesForNamespace(resolvedByNamespace: Map<string, Record<string, string>>, namespace: string, overrides?: Record<string, string>): Record<string, string>;

package/dist/runtime/workflow-variable-scopes.js

@@ -0,0 +1,55 @@
+import { resolveVariableReferences } from "./workflow-runtime-manifest.js";
+export function indexWorkflowVariableScopes(dnas) {
+    const sorted = [...dnas].sort((a, b) => a.cascade.priority - b.cascade.priority);
+    const rawByNamespace = new Map();
+    const namespaceLastIndex = new Map();
+    const workflowNamespaces = new Map();
+    const workflowAssets = new Map();
+    const controllerNamespaces = new Map();
+    sorted.forEach((dna, index) => {
+        const namespace = dna.namespace ?? "";
+        const raw = rawByNamespace.get(namespace) ?? {};
+        Object.assign(raw, dna.variables ?? {});
+        rawByNamespace.set(namespace, raw);
+        namespaceLastIndex.set(namespace, index);
+        const workflows = dna.workflows ?? (dna.workflow ? { [dna.workflow.name]: dna.workflow } : {});
+        for (const name of Object.keys(workflows)) {
+            const workflowKey = namespace ? `${namespace}_${name}` : name;
+            workflowNamespaces.set(workflowKey, namespace);
+            workflowAssets.set(workflowKey, dna.id);
+        }
+        for (const name of Object.keys(dna.controllers ?? {})) {
+            controllerNamespaces.set(namespace ? `${namespace}_${name}` : name, namespace);
+        }
+    });
+    return {
+        rawByNamespace,
+        namespaceLastIndex,
+        workflowNamespaces,
+        workflowAssets,
+        controllerNamespaces,
+    };
+}
+export function defaultResolvedVariableScopes(index) {
+    return new Map([...index.rawByNamespace.entries()].map(([namespace, raw]) => [
+        namespace,
+        Object.fromEntries(Object.entries(raw).map(([name, value]) => [
+            name,
+            typeof value === "string" ? value : value.default,
+        ])),
+    ]));
+}
+export function flattenResolvedVariableScopes(index, resolvedByNamespace) {
+    const flat = {};
+    for (const [, resolved] of [...resolvedByNamespace.entries()].sort(([a], [b]) => (index.namespaceLastIndex.get(a) ?? -1) - (index.namespaceLastIndex.get(b) ?? -1))) {
+        Object.assign(flat, resolved);
+    }
+    return flat;
+}
+export function resolvedVariablesForNamespace(resolvedByNamespace, namespace, overrides = {}) {
+    return resolveVariableReferences({
+        ...(namespace ? resolvedByNamespace.get("") : {}),
+        ...(resolvedByNamespace.get(namespace) ?? {}),
+        ...overrides,
+    });
+}

package/dist/schema/types.d.ts

@@ -174,6 +174,10 @@ export declare const WORKFLOW_HANDOFF_EXHAUSTED_VALUES: readonly ["skip", "stop"
 export type WorkflowHandoffExhaustedAction = typeof WORKFLOW_HANDOFF_EXHAUSTED_VALUES[number];
 export declare const WORKFLOW_MERGE_STRATEGY_VALUES: readonly ["escalate"];
 export type WorkflowMergeStrategy = typeof WORKFLOW_MERGE_STRATEGY_VALUES[number];
+export interface EvaluatorResultCompletion {
+    path: string;
+    require_score?: boolean;
+}
 /** Completion check for a workflow step */
 export interface CompletionCheck {
     file_exists?: string;
@@ -183,6 +187,7 @@ export interface CompletionCheck {
         pattern: string;
     };
     command_success?: string;
+    evaluator_result?: EvaluatorResultCompletion;
 }
 /** Single step in a workflow */
 export interface WorkflowStepDef {
@@ -522,6 +527,10 @@ export interface WorkflowState {
     started_at: string;
     inputs?: Record<string, string>;
     resolved_variables?: Record<string, string>;
+    resolved_variables_source?: "compiled_manifest" | "legacy_skill";
+    workflow_runtime_manifest_hash?: string;
+    workflow_runtime_compiled_ir_hash?: string;
+    workflow_inputs_pinned?: boolean;
     completed_artifacts?: CompletedArtifactEntry[];
 }
 export interface ConstraintIR {