intentdna 1.9.0-rc.1 → 1.9.0-rc.2

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "intentdna",
       "description": "Declarative policy layer for AI agent behavior with plugin-managed hook runtime for Claude Code.",
-      "version": "1.9.0-rc.1",
+      "version": "1.9.0-rc.2",
       "author": {
         "name": "Samuel"
       },
@@ -25,5 +25,5 @@
       ]
     }
   ],
-  "version": "1.9.0-rc.1"
+  "version": "1.9.0-rc.2"
 }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "intentdna",
-  "version": "1.9.0-rc.1",
+  "version": "1.9.0-rc.2",
   "description": "Declarative policy layer for AI agent behavior",
   "author": {
     "name": "Samuel"

package/dist/cli/commands/run.js

@@ -10,12 +10,13 @@ import { isAbsolute, join, relative, resolve, sep, } from "node:path";
 import { cascadeDNA } from "../../compiler/cascade.js";
 import { compileFromFiles, expandDNAInputFiles, loadDNA, } from "../../compiler/index.js";
 import { compileWorkflow } from "../../compiler/workflow.js";
-import { trustedEvidenceCaptureAttribution } from "../../governance/index.js";
 import { DNAStateManager } from "../../hooks/state-manager.js";
 import { appendEvidenceCaptureEvent, EVIDENCE_CAPTURE_SCHEMA_VERSION, } from "../../hooks/state.js";
 import { compileAllRolesToAgentMD, toKebabCase, writeAgentMDFiles, } from "../../runtime/agent-md.js";
 import { HandoffResolver } from "../../runtime/handoff-resolver.js";
 import { createCompiledIR, writeCompiledIR } from "../../runtime/plugin-adapter.js";
+import { createWorkflowRuntimeManifest, WORKFLOW_RUNTIME_INPUT_VARIABLE_NAMES, } from "../../runtime/workflow-runtime-manifest.js";
+import { defaultResolvedVariableScopes, indexWorkflowVariableScopes, resolvedVariablesForNamespace, } from "../../runtime/workflow-variable-scopes.js";
 import { ImmutableResultStore } from "../../runtime/result-store.js";
 import { RunController, } from "../../runtime/run-controller.js";
 import { DurableRunStore, RunStoreError, } from "../../runtime/run-store.js";
@@ -191,6 +192,8 @@ async function compileRunAssets(metadata) {
     for (const file of metadata.dna_files)
         dnas.push(await loadDNA(file));
     const cascaded = cascadeDNA(dnas);
+    const variableScopeIndex = indexWorkflowVariableScopes(dnas);
+    const defaultVariableScopes = defaultResolvedVariableScopes(variableScopeIndex);
     const ir = await compileFromFiles([...metadata.dna_files], {
         context: metadata.context ?? undefined,
     });
@@ -199,26 +202,31 @@ async function compileRunAssets(metadata) {
         throw new Error(`workflow '${metadata.workflow_name}' not found; available: `
             + `${Object.keys(cascaded.workflows).join(", ") || "(none)"}`);
     }
-    const result = compileWorkflow(definition, {
-        workflow_key: metadata.workflow_name,
-    });
-    if (!result.ok || !result.plan) {
-        throw new Error("workflow compilation failed:\n"
-            + result.errors.map((error) => `  ${error.path}: ${error.message}`).join("\n"));
+    const runtimePlans = [];
+    for (const [workflowKey, workflowDefinition] of Object.entries(cascaded.workflows)) {
+        const result = compileWorkflow(workflowDefinition, { workflow_key: workflowKey });
+        if (!result.ok || !result.plan) {
+            throw new Error(`workflow '${workflowKey}' compilation failed:\n`
+                + result.errors.map((error) => `  ${error.path}: ${error.message}`).join("\n"));
+        }
+        const namespace = variableScopeIndex.workflowNamespaces.get(workflowKey) ?? "";
+        runtimePlans.push({
+            plan: result.plan,
+            workflow_asset: variableScopeIndex.workflowAssets.get(workflowKey) ?? null,
+            resolved_variables: resolvedVariablesForNamespace(defaultVariableScopes, namespace, workflowKey === metadata.workflow_name ? { ...metadata.variables } : {}),
+        });
     }
-    const plan = result.plan;
-    const attribution = trustedEvidenceCaptureAttribution(ir, {
-        workflowId: metadata.workflow_name,
-    });
-    const workflowAsset = attribution.workflowAsset === "unknown"
-        ? null
-        : attribution.workflowAsset;
+    const plan = runtimePlans.find((item) => item.plan.workflow_key === metadata.workflow_name)?.plan;
+    if (!plan)
+        throw new Error(`compiled workflow '${metadata.workflow_name}' is missing from runtime plans`);
+    const workflowAsset = runtimePlans.find((item) => item.plan.workflow_key === metadata.workflow_name)?.workflow_asset ?? null;
     if (metadata.workflow_asset !== null
         && workflowAsset !== metadata.workflow_asset) {
         throw new Error(`workflow asset changed from '${metadata.workflow_asset}' to '${workflowAsset ?? "unknown"}'`);
     }
     return {
         plan,
+        runtime_plans: runtimePlans,
         roles: cascaded.roles,
         ir,
         plan_digest: planDigest(plan, cascaded.roles),
@@ -227,6 +235,20 @@ async function compileRunAssets(metadata) {
 }
 async function compileCanonicalRun(metadata) {
     const assets = await compileRunAssets(metadata);
+    if (!assets.ir.compiled_ir_hash) {
+        throw new Error("Compiled IR hash is required for canonical workflow runtime bindings");
+    }
+    const workflowRuntime = createWorkflowRuntimeManifest({
+        plans: assets.runtime_plans.map((runtimePlan) => ({
+            plan: runtimePlan.plan,
+            resolvedVariables: runtimePlan.resolved_variables,
+            workflowAsset: runtimePlan.workflow_asset ?? undefined,
+            additionalRuntimeValues: assets.ir.verifier_specs?.filter((spec) => spec.workflow_name === runtimePlan.plan.workflow_key) ?? [],
+        })),
+        compiledAt: assets.ir.compiled_at,
+        compiledIrHash: assets.ir.compiled_ir_hash,
+        sourceDnaIds: assets.ir.source_dna_ids,
+    });
     const adapterOptions = {
         roles: assets.roles,
         variables: metadata.variables,
@@ -236,6 +258,7 @@ async function compileCanonicalRun(metadata) {
     };
     return {
         ...assets,
+        workflow_runtime: workflowRuntime,
         definitions: adaptWorkflowPlan(assets.plan, adapterOptions),
         retry_loop: adaptWorkflowRetryLoop(assets.plan, adapterOptions),
     };
@@ -243,7 +266,7 @@ async function compileCanonicalRun(metadata) {
 async function syncRuntimeArtifacts(compiled, metadata) {
     const agents = compileAllRolesToAgentMD(compiled.roles, compiled.ir);
     await writeAgentMDFiles(agents, metadata.agents_directory);
-    await writeCompiledIR(metadata.project_directory, createCompiledIR(compiled.ir, compiled.roles));
+    await writeCompiledIR(metadata.project_directory, createCompiledIR(compiled.ir, compiled.roles, compiled.workflow_runtime));
 }
 function projectPathInWorkspace(metadata, workspaceDirectory, projectPath) {
     const projectRelative = relative(metadata.project_directory, projectPath);
@@ -262,7 +285,7 @@ async function syncAttemptRuntimeArtifacts(compiled, metadata, workspace) {
         const agents = compileAllRolesToAgentMD(compiled.roles, compiled.ir);
         await writeAgentMDFiles(agents, agentsDirectory);
     }
-    await writeCompiledIR(workspace.working_directory, createCompiledIR(compiled.ir, compiled.roles));
+    await writeCompiledIR(workspace.working_directory, createCompiledIR(compiled.ir, compiled.roles, compiled.workflow_runtime));
 }
 function createProvider(metadata) {
     if (metadata.provider.kind === "codex") {
@@ -462,31 +485,40 @@ function createWorkspaceAwareExecutor(metadata, compiled, runStore) {
         let lifecycleRecorded = false;
         try {
             await syncAttemptRuntimeArtifacts(compiled, metadata, workspace);
-            try {
-                await state.writeWorkflowState({
-                    active: true,
-                    workflow_asset: metadata.workflow_asset ?? undefined,
-                    workflow: metadata.workflow_name,
-                    current_step: packet.step_id,
-                    current_role: packet.role,
-                    iteration: packet.workflow_round,
-                    session_id: packet.worker_session_id,
-                    worker_session_id: packet.worker_session_id,
-                    run_id: packet.run_id,
-                    step_id: packet.step_id,
-                    attempt_id: packet.attempt_id,
-                    started_at: packet.created_at,
-                    inputs: { ...metadata.variables },
-                    resolved_variables: {
-                        ...metadata.variables,
-                        round: String(packet.workflow_round),
-                    },
-                });
-            }
-            catch (error) {
-                log(`Workflow evidence state unavailable for ${packet.step_id}; `
-                    + `continuing fail-open: ${error instanceof Error ? error.message : String(error)}`);
+            const runtimeBinding = compiled.workflow_runtime.workflows[metadata.workflow_name];
+            if (!runtimeBinding)
+                throw new Error(`Missing runtime binding for ${metadata.workflow_name}`);
+            const canonicalArguments = metadata.variables.ARGUMENTS ??
+                metadata.variables.arguments ?? metadata.variables.task_id;
+            const runtimeInputs = {};
+            for (const name of runtimeBinding.runtime_input_refs) {
+                const value = WORKFLOW_RUNTIME_INPUT_VARIABLE_NAMES.has(name)
+                    ? canonicalArguments
+                    : metadata.variables[name];
+                if (value === undefined)
+                    throw new Error(`Missing runtime input ${name} for ${metadata.workflow_name}`);
+                runtimeInputs[name] = value;
             }
+            await state.writeWorkflowState({
+                active: true,
+                workflow_asset: runtimeBinding.workflow_asset,
+                workflow: metadata.workflow_name,
+                current_step: packet.step_id,
+                current_role: packet.role,
+                iteration: packet.workflow_round,
+                session_id: packet.worker_session_id,
+                worker_session_id: packet.worker_session_id,
+                run_id: packet.run_id,
+                step_id: packet.step_id,
+                attempt_id: packet.attempt_id,
+                started_at: packet.created_at,
+                inputs: Object.keys(runtimeInputs).length > 0 ? runtimeInputs : undefined,
+                resolved_variables: runtimeBinding.resolved_variables,
+                resolved_variables_source: "compiled_manifest",
+                workflow_runtime_manifest_hash: compiled.workflow_runtime.manifest_hash,
+                workflow_runtime_compiled_ir_hash: compiled.workflow_runtime.compiled_ir_hash,
+                workflow_inputs_pinned: true,
+            });
             const inheritedProcessObserver = options?.onProcessStart;
             let execution = await executeWorkerAttempt(workerPacket, provider, {
                 ...options,

package/dist/cli/commands/setup.d.ts

@@ -19,4 +19,14 @@ export interface SetupOptions {
     yes: boolean;
     upgrade: boolean;
 }
+/**
+ * Check if intentdna is already registered as a plugin.
+ */
+export interface InstalledPluginInfo {
+    version: string | null;
+    enabled: boolean;
+}
+export declare function parseInstalledPluginInfo(output: string): InstalledPluginInfo | null;
+export declare function releaseChannelForVersion(version: string | null): "latest" | "next";
+export declare function shouldInstallLatestVersion(installedVersion: string, latestVersion: string): boolean;
 export declare function runSetup(opts: SetupOptions): Promise<number>;

package/dist/cli/commands/setup.js

@@ -79,21 +79,32 @@ async function resolvePackagePath() {
     }
     return null;
 }
-/**
- * Check if intentdna is already registered as a plugin.
- */
-function isPluginRegistered() {
+export function parseInstalledPluginInfo(output) {
+    const pluginId = "intentdna@intentdna";
+    const pluginStart = output.indexOf(pluginId);
+    if (pluginStart === -1)
+        return null;
+    const block = output.slice(pluginStart).split(/\n\s*\n/, 1)[0];
+    return {
+        version: block.match(/Version:\s*([^\s]+)/)?.[1] ?? null,
+        enabled: /Status:\s*.*\benabled\b/i.test(block),
+    };
+}
+function getInstalledPluginInfo() {
     try {
         const result = execSync("claude plugin list 2>/dev/null", {
             encoding: "utf-8",
             timeout: 5000,
         });
-        return result.includes("intentdna");
+        return parseInstalledPluginInfo(result);
     }
     catch {
-        return false;
+        return null;
     }
 }
+function isPluginRegistered() {
+    return getInstalledPluginInfo() !== null;
+}
 // ── Main ──────────────────────────────────────────────────
 /**
  * Get the currently installed version of intentdna.
@@ -111,12 +122,10 @@ function getInstalledVersion() {
         return null;
     }
 }
-/**
- * Get the latest published version from npm registry.
- */
-function getLatestVersion() {
+/** Get the version currently published on an npm dist-tag. */
+function getPublishedVersion(channel) {
     try {
-        return execSync("npm view intentdna version 2>/dev/null", {
+        return execSync(`npm view intentdna@${channel} version 2>/dev/null`, {
             encoding: "utf-8",
             timeout: 10000,
         }).trim();
@@ -125,8 +134,63 @@ function getLatestVersion() {
         return null;
     }
 }
+function parseReleaseVersion(version) {
+    const match = version.trim().match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/);
+    if (!match)
+        return null;
+    return {
+        core: [Number(match[1]), Number(match[2]), Number(match[3])],
+        prerelease: match[4]?.split(".") ?? null,
+    };
+}
+function comparePrerelease(left, right) {
+    if (left === null && right === null)
+        return 0;
+    if (left === null)
+        return 1;
+    if (right === null)
+        return -1;
+    const length = Math.max(left.length, right.length);
+    for (let index = 0; index < length; index += 1) {
+        const leftPart = left[index];
+        const rightPart = right[index];
+        if (leftPart === undefined)
+            return -1;
+        if (rightPart === undefined)
+            return 1;
+        if (leftPart === rightPart)
+            continue;
+        const leftNumeric = /^\d+$/.test(leftPart);
+        const rightNumeric = /^\d+$/.test(rightPart);
+        if (leftNumeric && rightNumeric)
+            return Number(leftPart) < Number(rightPart) ? -1 : 1;
+        if (leftNumeric !== rightNumeric)
+            return leftNumeric ? -1 : 1;
+        return leftPart < rightPart ? -1 : 1;
+    }
+    return 0;
+}
+export function releaseChannelForVersion(version) {
+    if (!version)
+        return "latest";
+    return parseReleaseVersion(version)?.prerelease ? "next" : "latest";
+}
+export function shouldInstallLatestVersion(installedVersion, latestVersion) {
+    if (installedVersion === latestVersion)
+        return false;
+    const installed = parseReleaseVersion(installedVersion);
+    const latest = parseReleaseVersion(latestVersion);
+    if (!installed || !latest)
+        return true;
+    for (let index = 0; index < installed.core.length; index += 1) {
+        if (installed.core[index] === latest.core[index])
+            continue;
+        return installed.core[index] < latest.core[index];
+    }
+    return comparePrerelease(installed.prerelease, latest.prerelease) < 0;
+}
 /**
- * Upgrade flow: npm update → re-register marketplace → re-install plugin.
+ * Upgrade flow: install from the current release channel → refresh marketplace → update and verify plugin.
  */
 async function runUpgrade(opts) {
     // Step 1: Detect claude CLI
@@ -138,20 +202,26 @@ async function runUpgrade(opts) {
     log(`Claude Code detected: ${claudeVersion}`);
     // Step 2: Check versions
     const currentVer = getInstalledVersion();
-    const latestVer = getLatestVersion();
+    const releaseChannel = releaseChannelForVersion(currentVer);
+    const publishedVer = getPublishedVersion(releaseChannel);
     if (currentVer)
         log(`Current version: ${currentVer}`);
-    if (latestVer)
-        log(`Latest version:  ${latestVer}`);
-    if (currentVer && latestVer && currentVer === latestVer) {
-        log("Already at latest version.");
+    log(`Target channel:  ${releaseChannel}`);
+    if (publishedVer)
+        log(`Target version:  ${publishedVer}`);
+    if (!publishedVer) {
+        log(`Upgrade failed: could not resolve intentdna@${releaseChannel} from npm.`);
+        return 1;
+    }
+    if (currentVer && !shouldInstallLatestVersion(currentVer, publishedVer)) {
+        log(`Already at the ${releaseChannel} channel version or newer; refusing to downgrade.`);
     }
     else {
         // Step 3: npm update
         log("");
-        log("Updating intentdna...");
+        log(`Updating intentdna from the ${releaseChannel} channel...`);
         try {
-            execSync("npm update -g intentdna", {
+            execSync(`npm install -g intentdna@${releaseChannel}`, {
                 encoding: "utf-8",
                 timeout: 60000,
                 stdio: ["inherit", "pipe", "pipe"],
@@ -162,10 +232,19 @@ async function runUpgrade(opts) {
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
             log(`npm update failed: ${msg}`);
-            log("Try manually: npm update -g intentdna");
+            log(`Try manually: npm install -g intentdna@${releaseChannel}`);
             return 1;
         }
     }
+    const upgradedVersion = getInstalledVersion();
+    if (!upgradedVersion) {
+        log("Upgrade failed: could not verify the installed npm package version.");
+        return 1;
+    }
+    if (shouldInstallLatestVersion(upgradedVersion, publishedVer)) {
+        log(`Upgrade failed: installed npm version ${upgradedVersion} is older than ${releaseChannel} channel version ${publishedVer}.`);
+        return 1;
+    }
     // Step 4: Re-resolve package path
     const pkgPath = await resolvePackagePath();
     if (!pkgPath) {
@@ -173,11 +252,11 @@ async function runUpgrade(opts) {
         return 1;
     }
     log(`Package path: ${pkgPath}`);
-    // Step 5: Re-register marketplace (picks up new plugin.json version)
+    // Step 5: Refresh marketplace (picks up new plugin.json version)
     try {
         log("");
-        log(`Re-registering marketplace: ${pkgPath}`);
-        execSync(`claude plugin marketplace add "${pkgPath}"`, {
+        log("Refreshing marketplace: intentdna");
+        execSync("claude plugin marketplace update intentdna", {
             encoding: "utf-8",
             timeout: 30000,
             stdio: ["inherit", "pipe", "pipe"],
@@ -186,35 +265,49 @@ async function runUpgrade(opts) {
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
-        log(`Warning: marketplace re-register failed: ${msg}`);
+        log(`Marketplace refresh failed: ${msg}`);
+        log(`Try manually: claude plugin marketplace add "${pkgPath}"`);
+        return 1;
     }
-    // Step 6: Re-install plugin (picks up new hooks.json)
+    // Step 6: Update plugin (picks up new hooks.json and MCP runtime)
     try {
-        const installCmd = `claude plugin install intentdna@intentdna --scope ${opts.scope}`;
-        log(`Re-installing plugin: ${installCmd}`);
-        execSync(installCmd, {
+        const updateCmd = "claude plugin update intentdna@intentdna";
+        log(`Updating plugin: ${updateCmd}`);
+        execSync(updateCmd, {
             encoding: "utf-8",
             timeout: 30000,
             stdio: ["inherit", "pipe", "pipe"],
         });
-        log("Plugin re-installed.");
+        log("Plugin updated.");
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
-        log(`Warning: plugin re-install failed: ${msg}`);
+        log(`Plugin update failed: ${msg}`);
+        log(`Try manually: claude plugin install intentdna@intentdna --scope ${opts.scope}`);
+        return 1;
     }
     // Step 7: Verify
-    if (isPluginRegistered()) {
+    const plugin = getInstalledPluginInfo();
+    if (!plugin?.version) {
         log("");
-        log("Upgrade complete. Run 'dna sync' to recompile your DNA templates.");
-        return 0;
+        log("Upgrade failed: the IntentDNA Claude plugin version could not be verified.");
+        log("Try: claude plugin list");
+        return 1;
     }
-    else {
+    if (plugin.version !== upgradedVersion) {
         log("");
-        log("Upgrade completed but plugin verification failed.");
-        log("Try: claude plugin list");
+        log(`Upgrade failed: Claude plugin version ${plugin.version} does not match npm version ${upgradedVersion}.`);
+        return 1;
+    }
+    if (!plugin.enabled) {
+        log("");
+        log("Upgrade failed: the version-matched IntentDNA Claude plugin is disabled.");
         return 1;
     }
+    log("");
+    log(`Upgrade complete: npm and Claude plugin are both ${upgradedVersion}.`);
+    log("Restart Claude Code, then run 'dna sync' in each project before resuming workflows.");
+    return 0;
 }
 export async function runSetup(opts) {
     // Upgrade mode

package/dist/cli/commands/sync.js

@@ -28,6 +28,8 @@ import { removeWorkflowScripts } from "../../runtime/workflow-runner.js";
 import { compileWorkflowToSkill, compileControllerToSkill, writeSkillFiles, removeSkillFiles } from "../../runtime/skill-adapter.js";
 import { getControllerKindMetadata } from "../../schema/controller-registry.js";
 import { createCodexSyncTargetPlan, executeCodexSyncTargetPlan, formatCodexSyncTargetPlanSummary, removeCodexSyncTargetArtifacts } from "../../runtime/codex-sync-target.js";
+import { createWorkflowRuntimeManifest } from "../../runtime/workflow-runtime-manifest.js";
+import { flattenResolvedVariableScopes, indexWorkflowVariableScopes, resolvedVariablesForNamespace, } from "../../runtime/workflow-variable-scopes.js";
 import { trackedOutputsForSyncTargetPlan } from "../../runtime/sync-target-plan.js";
 import { getPackageVersion } from "../util/version.js";
 import { cascadeDNA } from "../../compiler/cascade.js";
@@ -167,6 +169,24 @@ async function resolveVariables(rawVars, configPath, options) {
     }
     return resolved;
 }
+async function resolveVariableScopes(dnas, configPath, options) {
+    const index = indexWorkflowVariableScopes(dnas);
+    const variableNamespaces = [...index.rawByNamespace.entries()]
+        .filter(([, raw]) => Object.keys(raw).length > 0)
+        .map(([namespace]) => namespace);
+    const resolvedByNamespace = new Map();
+    for (const [namespace, raw] of index.rawByNamespace) {
+        const writableConfigPath = variableNamespaces.length === 1 ? configPath : null;
+        resolvedByNamespace.set(namespace, await resolveVariables(raw, writableConfigPath, options));
+    }
+    return {
+        flat: flattenResolvedVariableScopes(index, resolvedByNamespace),
+        workflowNamespaces: index.workflowNamespaces,
+        workflowAssets: index.workflowAssets,
+        controllerNamespaces: index.controllerNamespaces,
+        forNamespace: (namespace) => resolvedVariablesForNamespace(resolvedByNamespace, namespace),
+    };
+}
 /**
  * Auto-detect DNA config file in current directory (legacy single-config).
  * Priority: .dna/config.yaml > .dna/config.yml > .dna/config.json > .dna.yaml > .dna.yml > .dna.json
@@ -783,13 +803,39 @@ export async function runSync(opts) {
                 trackedByLock: true,
             });
         }
+        const cascadedForRuntime = cascadeDNA(loadedDNAs);
+        const variableConfigPath = opts.files.length === 1 ? opts.files[0] : null;
+        const variableScopes = await resolveVariableScopes(loadedDNAs, variableConfigPath, { dryRun: opts.dryRun });
+        const variables = variableScopes.flat;
+        const workflowPlans = [];
+        for (const [workflowKey, workflowDef] of Object.entries(cascadedForRuntime.workflows)) {
+            const result = compileWorkflow(workflowDef, { workflow_key: workflowKey });
+            if (!result.ok || !result.plan) {
+                throw new Error(`Workflow '${workflowKey}' compilation failed:\n${result.errors.map((error) => `  ${error.path}: ${error.message}`).join("\n")}`);
+            }
+            workflowPlans.push(result.plan);
+        }
+        if (!ir.compiled_ir_hash) {
+            throw new Error("Compiled IR hash is required for workflow runtime bindings");
+        }
+        const workflowRuntime = createWorkflowRuntimeManifest({
+            plans: workflowPlans.map((plan) => ({
+                plan,
+                resolvedVariables: variableScopes.forNamespace(variableScopes.workflowNamespaces.get(plan.workflow_key ?? plan.source_workflow) ?? ""),
+                workflowAsset: variableScopes.workflowAssets.get(plan.workflow_key ?? plan.source_workflow),
+                additionalRuntimeValues: ir.verifier_specs?.filter((spec) => spec.workflow_name === (plan.workflow_key ?? plan.source_workflow)) ?? [],
+            })),
+            compiledAt: ir.compiled_at,
+            compiledIrHash: ir.compiled_ir_hash,
+            sourceDnaIds: ir.source_dna_ids,
+        });
         // Step 3.5: Execute Claude Code core target plan (compiled IR, MCP, settings hooks)
         {
-            const cascadedForCore = cascadeDNA(loadedDNAs);
             const claudeCorePlan = createClaudeCoreSyncTargetPlan({
                 projectDir,
                 ir,
-                roles: cascadedForCore.roles,
+                roles: cascadedForRuntime.roles,
+                workflowRuntime,
                 mode: opts.plugin ? "plugin" : "bin",
                 settingsPath: opts.settingsPath,
             });
@@ -913,14 +959,6 @@ export async function runSync(opts) {
             const workflows = cascadedForSkills.workflows;
             const controllers = cascadedForSkills.controllers;
             const roles = cascadedForSkills.roles;
-            // Collect and resolve variables from all DNA files
-            const rawVars = {};
-            for (const d of dnas) {
-                if (d.variables)
-                    Object.assign(rawVars, d.variables);
-            }
-            const configPath = opts.files.length === 1 ? opts.files[0] : null;
-            const variables = await resolveVariables(rawVars, configPath, { dryRun: opts.dryRun });
             // Step 8: Generate project-root .mcp.json only for Claude Code skills.
             if (skillSurface === "claude_code") {
                 const mcpDeps = {};
@@ -947,14 +985,16 @@ export async function runSync(opts) {
                 for (const [name, wfDef] of Object.entries(workflows)) {
                     const result = compileWorkflow(wfDef, { workflow_key: name });
                     if (result.ok) {
-                        skillResults.push(compileWorkflowToSkill(result.plan, roles, ir, variables, { surface: skillSurface }));
+                        const workflowVariables = variableScopes.forNamespace(variableScopes.workflowNamespaces.get(name) ?? "");
+                        skillResults.push(compileWorkflowToSkill(result.plan, roles, ir, workflowVariables, { surface: skillSurface }));
                     }
                 }
                 if (skillSurface === "claude_code") {
                     for (const [name, controllerDef] of Object.entries(controllers)) {
                         const controllerKind = getControllerKindMetadata(controllerDef.kind);
                         if (controllerKind?.supportsSkillGeneration) {
-                            skillResults.push(compileControllerToSkill(name, controllerDef, variables, workflows));
+                            const controllerVariables = variableScopes.forNamespace(variableScopes.controllerNamespaces.get(name) ?? "");
+                            skillResults.push(compileControllerToSkill(name, controllerDef, controllerVariables, workflows));
                         }
                     }
                 }