intentdna 1.9.0 → 1.9.1

package/dist/cli/commands/run.js

@@ -1,68 +1,90 @@
-/**
- * Intent DNA - canonical dna run command.
- *
- * The CLI compiles one workflow into Controller definitions, persists one
- * durable run ledger, and launches one disposable provider session per Step
- * attempt. Cross-Step inputs come only from committed results.
- */
-import { createHash, randomUUID } from "node:crypto";
-import { isAbsolute, join, relative, resolve, sep, } from "node:path";
-import { cascadeDNA } from "../../compiler/cascade.js";
-import { compileFromFiles, expandDNAInputFiles, loadDNA, } from "../../compiler/index.js";
-import { compileWorkflow } from "../../compiler/workflow.js";
-import { DNAStateManager } from "../../hooks/state-manager.js";
-import { appendEvidenceCaptureEvent, EVIDENCE_CAPTURE_SCHEMA_VERSION, } from "../../hooks/state.js";
-import { compileAllRolesToAgentMD, toKebabCase, writeAgentMDFiles, } from "../../runtime/agent-md.js";
-import { HandoffResolver } from "../../runtime/handoff-resolver.js";
-import { createCompiledIR, writeCompiledIR } from "../../runtime/plugin-adapter.js";
-import { createWorkflowRuntimeManifest, WORKFLOW_RUNTIME_INPUT_VARIABLE_NAMES, } from "../../runtime/workflow-runtime-manifest.js";
-import { defaultResolvedVariableScopes, indexWorkflowVariableScopes, resolvedVariablesForNamespace, } from "../../runtime/workflow-variable-scopes.js";
-import { ImmutableResultStore } from "../../runtime/result-store.js";
-import { RunController, } from "../../runtime/run-controller.js";
-import { DurableRunStore, RunStoreError, } from "../../runtime/run-store.js";
+/** Intent DNA - canonical dna run CLI transport. */
+import { createHash } from "node:crypto";
+import { join, resolve } from "node:path";
+import { toKebabCase } from "../../runtime/agent-md.js";
+import { CanonicalRunApplication, } from "../../runtime/canonical-run-application.js";
+import { canonicalRuntimeRoot as runtimeRoot, createCanonicalRuntimeComposition, } from "../../runtime/canonical-runtime-composition.js";
+import { LocalAttemptExecutionAuthority, } from "../../runtime/local-execution-authority.js";
+import { reconcileLocalExecutionPreparations } from "../../runtime/local-execution-reconciliation.js";
+import { LocalProviderNetworkSandbox } from "../../runtime/local-provider-sandbox.js";
+import { ProductionLocalVerifierExecutionPort } from "../../runtime/local-verifier-execution.js";
+import { canonicalizeJson } from "../../runtime/canonical-json.js";
 import { createClaudeExecutionProvider } from "../../runtime/providers/claude.js";
 import { createCodexExecutionProvider } from "../../runtime/providers/codex.js";
-import { runCheckpointVerifier, runCompletionVerifier, } from "../../runtime/verifier.js";
-import { adaptWorkflowPlan, adaptWorkflowRetryLoop, } from "../../runtime/workflow-plan-adapter.js";
-import { executeWorkerAttempt, } from "../../runtime/worker-executor.js";
-import { allocateAttemptWorkspace, applyWorkspaceLifecycleDecision, planAttemptWorkspace, } from "../../runtime/workspace-isolation.js";
-import { runLifecycleCancel, runLifecycleInspect, runLifecycleResume, runLifecycleStart, runLifecycleStatus, } from "./run-lifecycle.js";
+import { PushDriver, } from "../../runtime/push-driver.js";
+import { CALLER_ATTESTATION_SCHEMA_VERSION, } from "../../runtime/run-contracts.js";
+import { validateWorkflowRuntimeManifest, WORKFLOW_RUNTIME_INPUT_VARIABLE_NAMES, } from "../../runtime/workflow-runtime-manifest.js";
+import { DurableRunStore } from "../../runtime/run-store.js";
+import { LocalAttemptWorkspaceAuthority } from "../../runtime/workspace-isolation.js";
+import { createRunAttemptObservers, durableRuntimeProjection, syncRuntimeProjection, writeTerminalDriverFailure, } from "./run-observer.js";
+import { runLifecycleCancel, runLifecycleClose, runLifecycleInspect, runLifecycleResume, runLifecycleStatus, writeCanonicalOperation, } from "./run-lifecycle.js";
+function canonicalInputs(metadata) {
+    const { workflow: _workflow, ...inputs } = metadata.variables;
+    return inputs;
+}
+function metadataForBinding(metadata, binding) {
+    const variables = {
+        workflow: metadata.target.key,
+    };
+    for (const [name, value] of Object.entries(binding.binding.validated_inputs)) {
+        if (typeof value === "string")
+            variables[name] = value;
+    }
+    return { ...metadata, variables };
+}
+function callerAttestationDigest(payload) {
+    return `sha256:${createHash("sha256")
+        .update(canonicalizeJson(payload), "utf8")
+        .digest("hex")}`;
+}
+function createCallerAttestationAuthority(authorityId) {
+    if (authorityId.length === 0) {
+        throw new Error("caller attestation authority id must not be empty");
+    }
+    return {
+        authority_id: authorityId,
+        attest: (request) => {
+            const payload = {
+                schema_version: CALLER_ATTESTATION_SCHEMA_VERSION,
+                authority_id: authorityId,
+                agent_id: request.worker_session_id,
+                session_id: request.provider_session_id ?? request.worker_session_id,
+                run_id: request.run_id,
+                step_id: request.step_id,
+                activation_id: request.activation_id,
+                attempt_id: request.attempt_id,
+                claim_epoch: request.claim_epoch,
+                worker_session_id: request.worker_session_id,
+                submission_key_digest: request.submission_key_digest,
+                execution_digest: request.execution_digest,
+            };
+            return {
+                kind: "caller_attestation",
+                attestation_ref: [
+                    "attestation:/local-cli",
+                    encodeURIComponent(authorityId),
+                    encodeURIComponent(request.run_id),
+                    encodeURIComponent(request.attempt_id),
+                ].join("/"),
+                attestation_digest: callerAttestationDigest(payload),
+                payload,
+            };
+        },
+    };
+}
 class RunUsageError extends Error {
     constructor(message) {
         super(message);
         this.name = "RunUsageError";
     }
 }
-// ── Compatibility-only pure helpers ───────────────────────
 export function substituteTemplate(template, vars) {
-    return template.replace(/\{\{(\w+)\}\}/g, (match, key) => (key in vars ? vars[key] : match));
+    const argumentsValue = vars.ARGUMENTS ?? vars.arguments ?? vars.task_id;
+    const resolved = argumentsValue === undefined
+        ? template
+        : template.replace(/(^|[^\\])\$ARGUMENTS/g, (_match, prefix) => `${prefix}${argumentsValue}`);
+    return resolved.replace(/\{\{(\w+)\}\}/g, (match, key) => key in vars ? vars[key] : match);
 }
-export function evaluateRunIf(condition, round) {
-    if (condition === null)
-        return true;
-    const eqMatch = condition.match(/^round\s*==\s*(\d+)$/);
-    if (eqMatch)
-        return round === parseInt(eqMatch[1], 10);
-    const gtMatch = condition.match(/^round\s*>\s*(\d+)$/);
-    if (gtMatch)
-        return round > parseInt(gtMatch[1], 10);
-    const geMatch = condition.match(/^round\s*>=\s*(\d+)$/);
-    if (geMatch)
-        return round >= parseInt(geMatch[1], 10);
-    if (condition === "retry")
-        return round > 1;
-    return true;
-}
-export function checkRetryNeeded(stepResults, transitions) {
-    for (const transition of transitions) {
-        if (transition.condition === "fail"
-            && stepResults.get(transition.from)?.status === "fail") {
-            return true;
-        }
-    }
-    return false;
-}
-// ── Validation and durable metadata ───────────────────────
 function requireText(value, label) {
     const trimmed = value?.trim();
     if (!trimmed)
@@ -70,21 +92,18 @@ function requireText(value, label) {
     return trimmed;
 }
 function requirePositiveNumber(value, label) {
-    if (!Number.isFinite(value) || value <= 0) {
+    if (!Number.isFinite(value) || value <= 0)
         throw new RunUsageError(`${label} must be a positive number`);
-    }
     return value;
 }
 function requirePositiveInteger(value, label) {
-    if (!Number.isSafeInteger(value) || value <= 0) {
+    if (!Number.isSafeInteger(value) || value <= 0)
         throw new RunUsageError(`${label} must be a positive integer`);
-    }
     return value;
 }
 function requireNonNegativeInteger(value, label) {
-    if (!Number.isSafeInteger(value) || value < 0) {
+    if (!Number.isSafeInteger(value) || value < 0)
         throw new RunUsageError(`${label} must be a non-negative integer`);
-    }
     return value;
 }
 function asRunId(value) {
@@ -93,679 +112,471 @@ function asRunId(value) {
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function readStringRecord(value, label) {
-    if (!isRecord(value))
-        throw new Error(`${label} must be an object`);
-    const result = {};
-    for (const [key, entry] of Object.entries(value)) {
-        if (typeof entry !== "string") {
-            throw new Error(`${label}.${key} must be a string`);
-        }
-        result[key] = entry;
-    }
-    return result;
+function hasExactKeys(value, keys) {
+    const expected = new Set(keys);
+    return Object.keys(value).length === expected.size
+        && Object.keys(value).every((key) => expected.has(key));
+}
+function metadataError(detail) {
+    throw new Error(`run metadata is invalid: ${detail}`);
 }
 function readCanonicalMetadata(value) {
-    if (!isRecord(value) || value.schema_version !== "intentdna.canonical_run.v1") {
-        throw new Error("run metadata is not intentdna.canonical_run.v1");
+    if (isRecord(value)
+        && value.schema_version === "intentdna.canonical_run.v2"
+        && typeof value.workflow_name === "string") {
+        const { workflow_name: workflowName, ...legacy } = value;
+        return readCanonicalMetadata({
+            ...legacy,
+            schema_version: "intentdna.canonical_run.v3",
+            target: { kind: "workflow", key: workflowName },
+        });
     }
-    const dnaFiles = value.dna_files;
-    const context = value.context;
-    const provider = value.provider;
-    const timeoutMs = value.timeout_ms;
-    const workflowAsset = value.workflow_asset;
-    if (typeof value.project_directory !== "string"
-        || !Array.isArray(dnaFiles)
-        || !dnaFiles.every((entry) => typeof entry === "string")
-        || typeof value.workflow_name !== "string"
+    if (!isRecord(value)
+        || value.schema_version !== "intentdna.canonical_run.v3"
+        || !hasExactKeys(value, [
+            "schema_version",
+            "project_directory",
+            "dna_files",
+            "target",
+            "task_id",
+            "context",
+            "variables",
+            "agents_directory",
+            "provider",
+            "max_concurrency",
+            "timeout_ms",
+            "cancellation_grace_ms",
+            "workflow_asset",
+            "runtime_projection",
+        ])
+        || typeof value.project_directory !== "string"
+        || value.project_directory.length === 0
+        || !Array.isArray(value.dna_files)
+        || !value.dna_files.every((file) => typeof file === "string" && file.length > 0)
+        || !isRecord(value.target)
+        || !hasExactKeys(value.target, ["kind", "key"])
+        || (value.target.kind !== "workflow" && value.target.kind !== "controller")
+        || typeof value.target.key !== "string"
+        || value.target.key.length === 0
         || typeof value.task_id !== "string"
-        || (context !== null && typeof context !== "string")
+        || value.task_id.length === 0
+        || (value.context !== null && typeof value.context !== "string")
+        || !isRecord(value.variables)
+        || !Object.values(value.variables).every((item) => typeof item === "string")
         || typeof value.agents_directory !== "string"
-        || !isRecord(provider)
-        || !["claude", "codex"].includes(String(provider.kind))
-        || (provider.executable !== null && typeof provider.executable !== "string")
-        || typeof provider.max_budget_usd !== "number"
-        || typeof provider.permission_mode !== "string"
+        || value.agents_directory.length === 0
+        || !isRecord(value.provider)
+        || !hasExactKeys(value.provider, [
+            "kind",
+            "executable",
+            "max_budget_usd",
+            "permission_mode",
+        ])
+        || (value.provider.kind !== "claude" && value.provider.kind !== "codex")
+        || (value.provider.executable !== null && (typeof value.provider.executable !== "string"
+            || value.provider.executable.length === 0))
+        || typeof value.provider.max_budget_usd !== "number"
+        || !Number.isFinite(value.provider.max_budget_usd)
+        || value.provider.max_budget_usd <= 0
+        || typeof value.provider.permission_mode !== "string"
+        || value.provider.permission_mode.length === 0
         || typeof value.max_concurrency !== "number"
-        || (timeoutMs !== null && typeof timeoutMs !== "number")
+        || !Number.isSafeInteger(value.max_concurrency)
+        || value.max_concurrency <= 0
+        || (value.timeout_ms !== null && (typeof value.timeout_ms !== "number"
+            ||
+                !Number.isSafeInteger(value.timeout_ms)
+            || value.timeout_ms < 0))
         || typeof value.cancellation_grace_ms !== "number"
-        || (workflowAsset !== null && typeof workflowAsset !== "string")) {
-        throw new Error("run metadata is malformed");
+        || !Number.isSafeInteger(value.cancellation_grace_ms)
+        || value.cancellation_grace_ms < 0
+        || (value.workflow_asset !== null && typeof value.workflow_asset !== "string")
+        || !isRecord(value.runtime_projection)
+        || value.runtime_projection.ir_version !== 1
+        || !isRecord(value.runtime_projection.ir)
+        || !isRecord(value.runtime_projection.workflow_runtime)) {
+        metadataError("expected strict intentdna.canonical_run.v3 data");
+    }
+    const compiledHash = value.runtime_projection.compiled_ir_hash;
+    if (typeof compiledHash !== "string"
+        || value.runtime_projection.ir.compiled_ir_hash !== compiledHash) {
+        metadataError("runtime projection digest is missing or inconsistent");
+    }
+    const manifest = validateWorkflowRuntimeManifest(value.runtime_projection.workflow_runtime, compiledHash);
+    if (!manifest.valid) {
+        metadataError(manifest.reason);
+    }
+    if (value.target.kind === "workflow" && !manifest.manifest.workflows[value.target.key]) {
+        metadataError(`runtime projection does not contain workflow ${value.target.key}`);
     }
-    const metadata = {
-        schema_version: "intentdna.canonical_run.v1",
-        project_directory: value.project_directory,
-        dna_files: dnaFiles,
-        workflow_name: value.workflow_name,
-        task_id: value.task_id,
-        context,
-        variables: readStringRecord(value.variables, "run metadata variables"),
-        agents_directory: value.agents_directory,
-        provider: {
-            kind: provider.kind,
-            executable: provider.executable === null
-                ? null
-                : requireText(provider.executable, "run metadata provider.executable"),
-            max_budget_usd: requirePositiveNumber(provider.max_budget_usd, "run metadata provider.max_budget_usd"),
-            permission_mode: requireText(provider.permission_mode, "run metadata provider.permission_mode"),
+    return value;
+}
+function providerConfiguration(metadata) {
+    return {
+        provider: metadata.provider.kind,
+        model: null,
+        options: {
+            ...(metadata.provider.executable === null
+                ? {}
+                : { executable: metadata.provider.executable }),
+            max_budget_usd: metadata.provider.max_budget_usd,
+            permission_mode: metadata.provider.permission_mode,
         },
-        max_concurrency: requirePositiveInteger(value.max_concurrency, "run metadata max_concurrency"),
-        timeout_ms: timeoutMs === null
-            ? null
-            : requireNonNegativeInteger(timeoutMs, "run metadata timeout_ms"),
-        cancellation_grace_ms: requireNonNegativeInteger(value.cancellation_grace_ms, "run metadata cancellation_grace_ms"),
-        workflow_asset: workflowAsset,
+        credential_references: [],
     };
-    requireText(metadata.project_directory, "run metadata project_directory");
-    requireText(metadata.workflow_name, "run metadata workflow_name");
-    requireText(metadata.task_id, "run metadata task_id");
-    requireText(metadata.agents_directory, "run metadata agents_directory");
-    if (metadata.dna_files.length === 0) {
-        throw new Error("run metadata dna_files must not be empty");
-    }
-    return metadata;
-}
-function stableJson(value) {
-    if (Array.isArray(value)) {
-        return `[${value.map(stableJson).join(",")}]`;
-    }
-    if (value !== null && typeof value === "object") {
-        const entries = Object.entries(value)
-            .filter(([, entry]) => entry !== undefined)
-            .sort(([left], [right]) => left.localeCompare(right));
-        return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`).join(",")}}`;
-    }
-    return JSON.stringify(value) ?? "null";
-}
-function planDigest(plan, roles) {
-    const stablePlan = { ...plan, compiled_at: null };
-    return createHash("sha256")
-        .update(stableJson({ plan: stablePlan, roles }), "utf-8")
-        .digest("hex");
 }
-function runtimeRoot(projectDirectory) {
-    return join(projectDirectory, ".dna", "runtime");
-}
-// ── Compilation and provider construction ─────────────────
-async function compileRunAssets(metadata) {
-    const dnas = [];
-    for (const file of metadata.dna_files)
-        dnas.push(await loadDNA(file));
-    const cascaded = cascadeDNA(dnas);
-    const variableScopeIndex = indexWorkflowVariableScopes(dnas);
-    const defaultVariableScopes = defaultResolvedVariableScopes(variableScopeIndex);
-    const ir = await compileFromFiles([...metadata.dna_files], {
-        context: metadata.context ?? undefined,
-    });
-    const definition = cascaded.workflows[metadata.workflow_name];
-    if (!definition) {
-        throw new Error(`workflow '${metadata.workflow_name}' not found; available: `
-            + `${Object.keys(cascaded.workflows).join(", ") || "(none)"}`);
-    }
-    const runtimePlans = [];
-    for (const [workflowKey, workflowDefinition] of Object.entries(cascaded.workflows)) {
-        const result = compileWorkflow(workflowDefinition, { workflow_key: workflowKey });
-        if (!result.ok || !result.plan) {
-            throw new Error(`workflow '${workflowKey}' compilation failed:\n`
-                + result.errors.map((error) => `  ${error.path}: ${error.message}`).join("\n"));
+function assertRunComposition(view, metadata, projectDirectory) {
+    const binding = view.run.run_binding.binding;
+    if (resolve(binding.project_root) !== projectDirectory
+        || resolve(binding.workspace_root) !== projectDirectory
+        || resolve(metadata.project_directory) !== projectDirectory) {
+        throw new Error(`run ${view.run.run_id} belongs to project ${binding.project_root}, not ${projectDirectory}`);
+    }
+    if (view.run.target.kind !== metadata.target.kind
+        || view.run.target.key !== metadata.target.key) {
+        throw new Error("run metadata target does not match the immutable run target");
+    }
+    const expectedProvider = providerConfiguration(metadata);
+    if (canonicalizeJson(binding.provider_config)
+        !== canonicalizeJson(expectedProvider)) {
+        throw new Error("run metadata provider projection does not match the immutable run binding");
+    }
+    for (const name of WORKFLOW_RUNTIME_INPUT_VARIABLE_NAMES) {
+        const pinned = binding.validated_inputs[name];
+        if (pinned !== undefined && pinned !== metadata.task_id) {
+            throw new Error(`run metadata task_id does not match pinned input ${name}`);
         }
-        const namespace = variableScopeIndex.workflowNamespaces.get(workflowKey) ?? "";
-        runtimePlans.push({
-            plan: result.plan,
-            workflow_asset: variableScopeIndex.workflowAssets.get(workflowKey) ?? null,
-            resolved_variables: resolvedVariablesForNamespace(defaultVariableScopes, namespace, workflowKey === metadata.workflow_name ? { ...metadata.variables } : {}),
-        });
     }
-    const plan = runtimePlans.find((item) => item.plan.workflow_key === metadata.workflow_name)?.plan;
-    if (!plan)
-        throw new Error(`compiled workflow '${metadata.workflow_name}' is missing from runtime plans`);
-    const workflowAsset = runtimePlans.find((item) => item.plan.workflow_key === metadata.workflow_name)?.workflow_asset ?? null;
-    if (metadata.workflow_asset !== null
-        && workflowAsset !== metadata.workflow_asset) {
-        throw new Error(`workflow asset changed from '${metadata.workflow_asset}' to '${workflowAsset ?? "unknown"}'`);
-    }
-    return {
-        plan,
-        runtime_plans: runtimePlans,
-        roles: cascaded.roles,
-        ir,
-        plan_digest: planDigest(plan, cascaded.roles),
-        workflow_asset: workflowAsset,
-    };
 }
-async function compileCanonicalRun(metadata) {
-    const assets = await compileRunAssets(metadata);
-    if (!assets.ir.compiled_ir_hash) {
-        throw new Error("Compiled IR hash is required for canonical workflow runtime bindings");
-    }
-    const workflowRuntime = createWorkflowRuntimeManifest({
-        plans: assets.runtime_plans.map((runtimePlan) => ({
-            plan: runtimePlan.plan,
-            resolvedVariables: runtimePlan.resolved_variables,
-            workflowAsset: runtimePlan.workflow_asset ?? undefined,
-            additionalRuntimeValues: assets.ir.verifier_specs?.filter((spec) => spec.workflow_name === runtimePlan.plan.workflow_key) ?? [],
-        })),
-        compiledAt: assets.ir.compiled_at,
-        compiledIrHash: assets.ir.compiled_ir_hash,
-        sourceDnaIds: assets.ir.source_dna_ids,
+function buildRuntime(projectDirectory, composition, runStore = new DurableRunStore({ root_directory: runtimeRoot(projectDirectory) })) {
+    const root = runtimeRoot(projectDirectory);
+    const configuredExecutionAuthority = composition.execution_authority_factory?.(join(root, "execution-authority"));
+    const localExecutionAuthority = configuredExecutionAuthority === undefined
+        ? new LocalAttemptExecutionAuthority({
+            root_directory: join(root, "execution-authority"),
+        })
+        : null;
+    const executionAuthority = configuredExecutionAuthority
+        ?? localExecutionAuthority;
+    const composed = createCanonicalRuntimeComposition({
+        project_directory: projectDirectory,
+        run_store: runStore,
+        workspace_authority: new LocalAttemptWorkspaceAuthority({
+            lock_root: join(root, "workspace-locks"),
+        }),
+        execution_authority: executionAuthority,
+        verifier_execution_port: new ProductionLocalVerifierExecutionPort({
+            root_directory: join(root, "verifier-execution-authority"),
+        }),
     });
-    const adapterOptions = {
-        roles: assets.roles,
-        variables: metadata.variables,
-        working_directory: metadata.project_directory,
-        timeout_ms: metadata.timeout_ms,
-        cancellation_grace_ms: metadata.cancellation_grace_ms,
-    };
     return {
-        ...assets,
-        workflow_runtime: workflowRuntime,
-        definitions: adaptWorkflowPlan(assets.plan, adapterOptions),
-        retry_loop: adaptWorkflowRetryLoop(assets.plan, adapterOptions),
+        run_store: runStore,
+        execution_authority: executionAuthority,
+        local_execution_authority: localExecutionAuthority,
+        service: composed.service,
     };
 }
-async function syncRuntimeArtifacts(compiled, metadata) {
-    const agents = compileAllRolesToAgentMD(compiled.roles, compiled.ir);
-    await writeAgentMDFiles(agents, metadata.agents_directory);
-    await writeCompiledIR(metadata.project_directory, createCompiledIR(compiled.ir, compiled.roles, compiled.workflow_runtime));
-}
-function projectPathInWorkspace(metadata, workspaceDirectory, projectPath) {
-    const projectRelative = relative(metadata.project_directory, projectPath);
-    const outsideProject = (projectRelative === ".."
-        || projectRelative.startsWith(`..${sep}`)
-        || isAbsolute(projectRelative));
-    return outsideProject
-        ? projectPath
-        : resolve(workspaceDirectory, projectRelative);
+function buildInspectionService(projectDirectory, runStore) {
+    return createCanonicalRuntimeComposition({
+        project_directory: projectDirectory,
+        run_store: runStore,
+    }).service;
 }
-async function syncAttemptRuntimeArtifacts(compiled, metadata, workspace) {
-    if (workspace.isolation !== "worktree")
+async function reconcileLocalPreparations(runtime, view) {
+    if (runtime.local_execution_authority === null)
         return;
-    const agentsDirectory = projectPathInWorkspace(metadata, workspace.working_directory, metadata.agents_directory);
-    if (agentsDirectory !== metadata.agents_directory) {
-        const agents = compileAllRolesToAgentMD(compiled.roles, compiled.ir);
-        await writeAgentMDFiles(agents, agentsDirectory);
-    }
-    await writeCompiledIR(workspace.working_directory, createCompiledIR(compiled.ir, compiled.roles, compiled.workflow_runtime));
+    await reconcileLocalExecutionPreparations(runtime.local_execution_authority, view);
 }
-function createProvider(metadata) {
-    if (metadata.provider.kind === "codex") {
-        return createCodexExecutionProvider({
-            executable: metadata.provider.executable ?? undefined,
-        });
+function createProvider(binding) {
+    const configuration = binding.provider_config;
+    const executable = configuration.options.executable;
+    if (configuration.provider === "codex") {
+        return createCodexExecutionProvider({ executable });
+    }
+    if (configuration.provider !== "claude") {
+        throw new Error(`unsupported provider in immutable run binding: ${configuration.provider}`);
+    }
+    const maxBudget = configuration.options.max_budget_usd;
+    const permissionMode = configuration.options.permission_mode;
+    if (maxBudget === undefined || permissionMode === undefined) {
+        throw new Error("Claude run binding is missing launch budget or permission mode");
     }
     return createClaudeExecutionProvider({
-        executable: metadata.provider.executable ?? undefined,
+        executable,
         agentName: (packet) => `dna-${toKebabCase(packet.role)}`,
         extraArgs: [
             "--max-budget-usd",
-            String(metadata.provider.max_budget_usd),
+            String(maxBudget),
             "--permission-mode",
-            metadata.provider.permission_mode,
+            permissionMode,
         ],
     });
 }
-function preservationReason(packet) {
-    return packet.workspace.isolation === "worktree"
-        ? "integration_pending"
-        : "controller_policy";
-}
-function preserveWorkspace(workspace, reason, detail) {
-    const result = applyWorkspaceLifecycleDecision(workspace, {
-        action: "preserve",
-        reason,
-        detail,
-    });
-    if (result.status === "preserved") {
-        log(`Preserved worktree ${result.working_directory}: `
-            + `${result.reason}${result.detail ? ` (${result.detail})` : ""}`);
-    }
-}
-async function recordAttemptProcess(runStore, packet, processId) {
-    if (!Number.isSafeInteger(processId) || processId <= 0) {
-        throw new Error(`provider returned invalid process id ${processId}`);
-    }
-    while (true) {
-        const snapshot = await runStore.requireRun(packet.run_id);
-        const attempt = snapshot.attempts.find((entry) => entry.attempt_id === packet.attempt_id);
-        if (!attempt
-            || attempt.step_id !== packet.step_id
-            || attempt.worker_session_id !== packet.worker_session_id) {
-            throw new Error(`attempt ${packet.attempt_id} disappeared before process registration`);
-        }
-        const recordedProcessId = attempt.process_id ?? null;
-        if (recordedProcessId === processId || attempt.phase === "terminal")
-            return;
-        if (recordedProcessId !== null) {
-            throw new Error(`attempt ${packet.attempt_id} already owns process ${recordedProcessId}`);
-        }
-        try {
-            await runStore.updateRun({
-                run_id: packet.run_id,
-                expected_record_version: snapshot.record_version,
-                attempts: [{ ...attempt, process_id: processId }],
-            });
-            return;
-        }
-        catch (error) {
-            if (error instanceof RunStoreError && error.code === "version_conflict") {
-                continue;
-            }
-            throw error;
-        }
-    }
-}
-const reconcileLocalProcess = async (attempt) => {
-    const processId = attempt.process_id ?? null;
-    if (processId === null
-        || !Number.isSafeInteger(processId)
-        || processId <= 0) {
-        return "unknown";
-    }
-    try {
-        process.kill(processId, 0);
-        return "live";
-    }
-    catch (error) {
-        const code = error instanceof Error
-            ? error.code
-            : undefined;
-        if (code === "EPERM")
-            return "live";
-        if (code === "ESRCH")
-            return "dead";
-        return "unknown";
-    }
-};
-function verifierFailureMessage(prefix, stepId, result) {
-    const exitCode = result.exit_code === undefined
-        ? ""
-        : ` exit_code=${result.exit_code}`;
-    const target = result.target ? ` target=${result.target}` : "";
-    const message = result.message ? ` - ${result.message}` : "";
-    const detail = `${prefix}${target}${exitCode}${message}`;
-    log(`${detail} (step: ${stepId})`);
-    return detail;
-}
-async function applyStepValidation(metadata, compiled, packet, execution) {
-    if (execution.result.outcome.kind !== "success")
-        return execution;
-    const step = compiled.plan.steps.find((entry) => entry.id === packet.step_id);
-    if (!step) {
-        throw new Error(`compiled Step ${packet.step_id} disappeared before validation`);
-    }
-    const variables = {
-        ...metadata.variables,
-        round: String(packet.workflow_round),
-    };
-    let failure = null;
-    for (const completion of step.completion ?? []) {
-        const result = await runCompletionVerifier(completion, compiled.ir, {
-            projectDir: packet.workspace.working_directory,
-            variables,
-        });
-        if (!result.passed) {
-            failure = verifierFailureMessage("Completion failed", step.id, result);
-            break;
-        }
-    }
-    if (!failure) {
-        for (const checkpoint of step.checkpoints ?? []) {
-            const result = await runCheckpointVerifier(checkpoint, compiled.ir, {
-                projectDir: packet.workspace.working_directory,
-                variables,
-            });
-            if (result.passed)
-                continue;
-            const detail = verifierFailureMessage(`Checkpoint failed: ${checkpoint.assert}`, step.id, result);
-            if ((checkpoint.action ?? "block") === "block") {
-                failure = detail;
-                break;
-            }
-        }
-    }
-    if (!failure)
-        return execution;
-    return {
-        ...execution,
-        result: {
-            ...execution.result,
-            outputs: [],
-            outcome: {
-                kind: "malformed_result",
-                exit_code: 0,
-                signal: null,
-                error: failure,
-            },
+function createDriver(runtime, view, metadata, projectDirectory) {
+    assertRunComposition(view, metadata, projectDirectory);
+    runtime.execution_authority.assertExecutionSupported();
+    const networkSandbox = new LocalProviderNetworkSandbox();
+    return new PushDriver({
+        service: runtime.service,
+        provider_factory: ({ run, binding }) => {
+            assertRunComposition(run, readCanonicalMetadata(run.run.metadata), projectDirectory);
+            return run.plan.plan.workspace_policy.allow_network
+                ? createProvider(binding)
+                : networkSandbox.wrap(createProvider(binding));
+        },
+        capabilities: {
+            network_policy_enforcement: networkSandbox.network_policy_enforcement,
         },
-    };
-}
-async function recordStepResultEvidence(metadata, packet, execution) {
-    const outcome = execution.result.outcome;
-    const succeeded = outcome.kind === "success";
-    const startedAt = Date.parse(execution.result.started_at);
-    const completedAt = Date.parse(execution.result.completed_at);
-    await appendEvidenceCaptureEvent(metadata.project_directory, {
-        schema_version: EVIDENCE_CAPTURE_SCHEMA_VERSION,
-        event_id: `c5:${randomUUID()}`,
-        captured_at: execution.result.completed_at,
-        project_root: metadata.project_directory,
-        source: "dna_cli",
-        workflow_asset: metadata.workflow_asset ?? "unknown",
-        workflow_id: metadata.workflow_name,
-        run_id: packet.run_id,
-        step_id: packet.step_id,
-        fact: "result",
-        summary: `dna run recorded ${succeeded ? "success" : "failure"} for workflow step ${packet.step_id}`,
-        result: succeeded ? "success" : "failure",
-        exit_code: "exit_code" in outcome
-            ? outcome.exit_code ?? undefined
-            : undefined,
-        duration_ms: Number.isFinite(startedAt) && Number.isFinite(completedAt)
-            ? Math.max(0, completedAt - startedAt)
-            : undefined,
-    });
-}
-function createWorkspaceAwareExecutor(metadata, compiled, runStore) {
-    return async (packet, provider, options) => {
-        const workspace = allocateAttemptWorkspace(planAttemptWorkspace({
-            isolation: packet.workspace.isolation,
-            repository_directory: metadata.project_directory,
-            run_id: packet.run_id,
-            step_id: packet.step_id,
-            attempt_id: packet.attempt_id,
-        }));
-        const workerPacket = {
-            ...packet,
-            workspace: {
-                isolation: workspace.isolation,
-                working_directory: workspace.working_directory,
-            },
-        };
-        const state = new DNAStateManager(workspace.working_directory, packet.worker_session_id);
-        let lifecycleRecorded = false;
-        try {
-            await syncAttemptRuntimeArtifacts(compiled, metadata, workspace);
-            const runtimeBinding = compiled.workflow_runtime.workflows[metadata.workflow_name];
-            if (!runtimeBinding)
-                throw new Error(`Missing runtime binding for ${metadata.workflow_name}`);
-            const canonicalArguments = metadata.variables.ARGUMENTS ??
-                metadata.variables.arguments ?? metadata.variables.task_id;
-            const runtimeInputs = {};
-            for (const name of runtimeBinding.runtime_input_refs) {
-                const value = WORKFLOW_RUNTIME_INPUT_VARIABLE_NAMES.has(name)
-                    ? canonicalArguments
-                    : metadata.variables[name];
-                if (value === undefined)
-                    throw new Error(`Missing runtime input ${name} for ${metadata.workflow_name}`);
-                runtimeInputs[name] = value;
-            }
-            await state.writeWorkflowState({
-                active: true,
-                workflow_asset: runtimeBinding.workflow_asset,
-                workflow: metadata.workflow_name,
-                current_step: packet.step_id,
-                current_role: packet.role,
-                iteration: packet.workflow_round,
-                session_id: packet.worker_session_id,
-                worker_session_id: packet.worker_session_id,
-                run_id: packet.run_id,
-                step_id: packet.step_id,
-                attempt_id: packet.attempt_id,
-                started_at: packet.created_at,
-                inputs: Object.keys(runtimeInputs).length > 0 ? runtimeInputs : undefined,
-                resolved_variables: runtimeBinding.resolved_variables,
-                resolved_variables_source: "compiled_manifest",
-                workflow_runtime_manifest_hash: compiled.workflow_runtime.manifest_hash,
-                workflow_runtime_compiled_ir_hash: compiled.workflow_runtime.compiled_ir_hash,
-                workflow_inputs_pinned: true,
-            });
-            const inheritedProcessObserver = options?.onProcessStart;
-            let execution = await executeWorkerAttempt(workerPacket, provider, {
-                ...options,
-                onProcessStart: async (processId) => {
-                    await recordAttemptProcess(runStore, workerPacket, processId);
-                    await inheritedProcessObserver?.(processId);
-                },
-            });
-            execution = await applyStepValidation(metadata, compiled, workerPacket, execution);
-            await recordStepResultEvidence(metadata, workerPacket, execution);
-            const reason = execution.result.outcome.kind === "cancelled"
-                ? "attempt_cancelled"
-                : execution.result.outcome.kind === "success"
-                    ? preservationReason(workerPacket)
-                    : "attempt_failed";
-            preserveWorkspace(workspace, reason, `attempt outcome: ${execution.result.outcome.kind}`);
-            lifecycleRecorded = true;
-            return execution;
-        }
-        catch (error) {
-            if (!lifecycleRecorded) {
-                preserveWorkspace(workspace, "controller_policy", `attempt launch failed: ${error instanceof Error ? error.message : String(error)}`);
-            }
-            throw error;
-        }
-        finally {
-            try {
-                await state.cleanup();
-            }
-            catch (error) {
-                log(`Worker Hook state cleanup failed for ${packet.worker_session_id}: `
-                    + `${error instanceof Error ? error.message : String(error)}`);
-            }
-        }
-    };
-}
-function buildRuntime(metadata, compiled) {
-    const runStore = new DurableRunStore({
-        root_directory: runtimeRoot(metadata.project_directory),
-    });
-    const resultStore = new ImmutableResultStore(runStore);
-    const resolver = new HandoffResolver(resultStore);
-    const provider = createProvider(metadata);
-    const controller = new RunController({
-        run_store: runStore,
-        handoff_resolver: resolver,
-        steps: compiled.definitions,
-        workflow_retry_loop: compiled.retry_loop,
-        provider_for_step: () => provider,
-        reconcile_attempt: reconcileLocalProcess,
-        execute_attempt: createWorkspaceAwareExecutor(metadata, compiled, runStore),
         max_concurrency: metadata.max_concurrency,
-        lease_duration_ms: 15_000,
-        lease_heartbeat_ms: 3_000,
-        scheduler_poll_ms: 50,
-    });
-    return { run_store: runStore, controller };
-}
-function buildCancellationController(runStore) {
-    return new RunController({
-        run_store: runStore,
-        steps: [],
-        provider_for_step: () => {
-            throw new Error("cancellation-only Controller cannot launch a Step");
+        caller_attestation_authority: createCallerAttestationAuthority(runtime.execution_authority.authority_instance_id),
+        execution_authority: {
+            prepare: async (context) => {
+                await reconcileLocalPreparations(runtime, await runtime.service.inspect(context.lease.run_id));
+                return runtime.execution_authority.prepareExecution({
+                    run_id: context.lease.run_id,
+                    step_id: context.lease.step_id,
+                    activation_id: context.lease.activation_id,
+                    attempt_id: context.lease.attempt_id,
+                    execution_claim_epoch: context.execution_claim_epoch,
+                    worker_session_id: context.worker_session_id,
+                });
+            },
+            abandon: (_context, preparation) => runtime.execution_authority.abandonPreparedExecution(preparation),
+            bind: (context, preparation) => runtime.execution_authority.bindExecution(preparation, { started_at: context.started_at }),
+            recover: (context) => {
+                const preparationRequest = {
+                    run_id: context.lease.run_id,
+                    step_id: context.lease.step_id,
+                    activation_id: context.lease.activation_id,
+                    attempt_id: context.lease.attempt_id,
+                    execution_claim_epoch: context.execution_claim_epoch,
+                    worker_session_id: context.worker_session_id,
+                };
+                const prepared = runtime.execution_authority.recoverPreparedExecution(preparationRequest);
+                if (prepared !== null) {
+                    return {
+                        kind: "launch",
+                        binding: runtime.execution_authority.bindExecution(prepared, { started_at: context.started_at }),
+                    };
+                }
+                return runtime.execution_authority.recoverExecution({
+                    run_id: context.lease.run_id,
+                    step_id: context.lease.step_id,
+                    activation_id: context.lease.activation_id,
+                    attempt_id: context.lease.attempt_id,
+                    execution_claim_epoch: context.execution_claim_epoch,
+                    executor: { kind: "worker", worker_session_id: context.worker_session_id },
+                    started_at: context.started_at,
+                });
+            },
         },
-        reconcile_attempt: reconcileLocalProcess,
-        max_concurrency: 1,
-        lease_duration_ms: 15_000,
-        lease_heartbeat_ms: 3_000,
-        scheduler_poll_ms: 50,
+        lifecycle_hooks: createRunAttemptObservers((context) => (readCanonicalMetadata(context.run.run.metadata))),
     });
 }
-async function startMetadata(opts, projectDirectory) {
-    if (opts.dnaFiles.length === 0) {
+function startMetadata(opts, projectDirectory) {
+    if (opts.dnaFiles.length === 0)
         throw new RunUsageError("--dna requires at least one DNA file");
-    }
-    const workflowName = requireText(opts.workflowName, "--workflow");
+    const selectedTargets = [opts.workflowName, opts.controllerName]
+        .filter((value) => value?.trim()).length;
+    if (selectedTargets !== 1) {
+        throw new RunUsageError("exactly one of --workflow or --controller is required");
+    }
+    const target = opts.controllerName?.trim()
+        ? { kind: "controller", key: requireText(opts.controllerName, "--controller") }
+        : { kind: "workflow", key: requireText(opts.workflowName, "--workflow") };
     const taskId = requireText(opts.taskId, "--task");
-    const expanded = await expandDNAInputFiles(opts.dnaFiles, {
-        cwd: projectDirectory,
-    });
-    if (expanded.length === 0) {
-        throw new RunUsageError("--dna did not resolve any DNA files");
-    }
-    const variables = {
-        ...(opts.vars ?? {}),
-        task_id: taskId,
-        ARGUMENTS: taskId,
-        workflow: workflowName,
-    };
-    const maxBudget = requirePositiveNumber(opts.maxBudget ?? 5, "--max-budget");
-    const maxConcurrency = requirePositiveInteger(opts.maxConcurrency ?? 1, "--max-concurrency");
-    const timeoutMs = opts.timeoutMs === null || opts.timeoutMs === undefined
-        ? null
-        : requireNonNegativeInteger(opts.timeoutMs, "--timeout-ms");
-    const cancellationGraceMs = requireNonNegativeInteger(opts.cancellationGraceMs ?? 5_000, "--cancellation-grace-ms");
-    const permissionMode = requireText(opts.permissionMode ?? "default", "--permission-mode");
+    const timeoutMs = opts.timeoutMs == null ? null : requireNonNegativeInteger(opts.timeoutMs, "--timeout-ms");
     return {
-        schema_version: "intentdna.canonical_run.v1",
+        schema_version: "intentdna.canonical_run.v3",
         project_directory: projectDirectory,
-        dna_files: expanded.map((file) => resolve(projectDirectory, file)),
-        workflow_name: workflowName,
+        dna_files: opts.dnaFiles.map((file) => resolve(projectDirectory, file)),
+        target,
         task_id: taskId,
         context: opts.context ?? null,
-        variables,
-        agents_directory: opts.agentsDir
-            ? resolve(projectDirectory, opts.agentsDir)
-            : join(projectDirectory, ".claude", "agents"),
+        variables: {
+            ...(opts.vars ?? {}),
+            ARGUMENTS: taskId,
+            arguments: taskId,
+            task_id: taskId,
+            workflow: target.key,
+        },
+        agents_directory: opts.agentsDir ? resolve(projectDirectory, opts.agentsDir) : join(projectDirectory, ".claude", "agents"),
         provider: {
             kind: opts.provider ?? "claude",
-            executable: opts.providerExecutable === undefined
-                ? null
-                : requireText(opts.providerExecutable, "--provider-executable"),
-            max_budget_usd: maxBudget,
-            permission_mode: permissionMode,
+            executable: opts.providerExecutable === undefined ? null : requireText(opts.providerExecutable, "--provider-executable"),
+            max_budget_usd: requirePositiveNumber(opts.maxBudget ?? 5, "--max-budget"),
+            permission_mode: requireText(opts.permissionMode ?? "default", "--permission-mode"),
         },
-        max_concurrency: maxConcurrency,
+        max_concurrency: requirePositiveInteger(opts.maxConcurrency ?? 1, "--max-concurrency"),
         timeout_ms: timeoutMs,
-        cancellation_grace_ms: cancellationGraceMs,
+        cancellation_grace_ms: requireNonNegativeInteger(opts.cancellationGraceMs ?? 5_000, "--cancellation-grace-ms"),
         workflow_asset: null,
+        runtime_projection: null,
     };
 }
-async function runtimeForExistingRun(runStore, runId, projectDirectory) {
-    const snapshot = await runStore.requireRun(runId);
-    const metadata = readCanonicalMetadata(snapshot.run.metadata);
-    if (resolve(metadata.project_directory) !== projectDirectory) {
-        throw new Error(`run ${runId} belongs to project ${metadata.project_directory}, not ${projectDirectory}`);
-    }
-    const compiled = await compileCanonicalRun(metadata);
-    if (compiled.plan_digest !== snapshot.run.plan_digest) {
-        throw new Error(`run ${runId} plan digest changed; resume requires the original DNA and role definitions`);
-    }
-    await syncRuntimeArtifacts(compiled, metadata);
-    return buildRuntime(metadata, compiled);
+async function previewRun(metadata) {
+    const app = new CanonicalRunApplication({});
+    const compiled = await app.compileTarget({
+        dna_sources: metadata.dna_files,
+        target: metadata.target,
+        inputs: canonicalInputs(metadata),
+        input_policy: "declared_only",
+        environment: { project_root: metadata.project_directory },
+        provider: providerConfiguration(metadata),
+        max_concurrency: metadata.max_concurrency,
+        context: metadata.context,
+        attempt_policy: { timeout_ms: metadata.timeout_ms, cancellation_grace_ms: metadata.cancellation_grace_ms },
+    });
+    if (!compiled.projection)
+        throw new Error("canonical compiler did not produce a runtime projection");
+    const pinnedMetadata = metadataForBinding(metadata, compiled.run_binding);
+    return printDryRun(compiled.projection.workflow_plan, pinnedMetadata, compiled.run_binding.binding.plan_id);
 }
-// ── CLI entry ──────────────────────────────────────────────
-export async function runRun(opts) {
+export async function runRun(opts, composition = {}) {
     const action = opts.action ?? "start";
     const projectDirectory = resolve(opts.projectDir ?? process.cwd());
-    const runStore = new DurableRunStore({
-        root_directory: runtimeRoot(projectDirectory),
-    });
     try {
-        if (action !== "start"
-            && action !== "status"
-            && action !== "inspect"
-            && action !== "resume"
-            && action !== "cancel") {
+        if (!["start", "status", "inspect", "resume", "cancel", "close"].includes(action)) {
             throw new RunUsageError(`unsupported run action '${String(action)}'`);
         }
+        const runStore = new DurableRunStore({ root_directory: runtimeRoot(projectDirectory) });
+        const existingRunId = () => asRunId(requireText(opts.runId, "run_id"));
         if (action === "status") {
             return runLifecycleStatus({
                 run_store: runStore,
-                run_id: asRunId(requireText(opts.runId, "run_id")),
+                service_factory: async () => buildInspectionService(projectDirectory, runStore),
+                run_id: existingRunId(),
                 json: opts.json,
             });
         }
         if (action === "inspect") {
             return runLifecycleInspect({
                 run_store: runStore,
-                run_id: asRunId(requireText(opts.runId, "run_id")),
+                service_factory: async () => buildInspectionService(projectDirectory, runStore),
+                run_id: existingRunId(),
                 json: opts.json,
             });
         }
-        if (action === "resume") {
-            const runId = asRunId(requireText(opts.runId, "run_id"));
-            const runtime = await runtimeForExistingRun(runStore, runId, projectDirectory);
-            return runLifecycleResume({
-                controller: runtime.controller,
-                run_id: runId,
+        if (action === "close") {
+            return runLifecycleClose({
+                run_store: runStore,
+                run_id: existingRunId(),
+                reason: opts.reason,
                 json: opts.json,
             });
         }
+        if (action === "start") {
+            const initialMetadata = startMetadata(opts, projectDirectory);
+            if (opts.dryRun)
+                return await previewRun(initialMetadata);
+        }
+        let runtimeComposition = null;
+        const requireRuntime = () => {
+            runtimeComposition ??= buildRuntime(projectDirectory, composition, runStore);
+            return runtimeComposition;
+        };
         if (action === "cancel") {
-            const runId = asRunId(requireText(opts.runId, "run_id"));
             return runLifecycleCancel({
-                controller: buildCancellationController(runStore),
-                run_id: runId,
+                run_store: runStore,
+                service_factory: async () => {
+                    const composed = requireRuntime();
+                    return {
+                        inspect: (runId) => composed.service.inspect(runId),
+                        inspectAudit: (runId) => composed.service.inspectAudit(runId),
+                        resume: (runId) => composed.service.resume(runId),
+                        cancel: async (runId, reason) => {
+                            await reconcileLocalPreparations(composed, await composed.service.inspect(runId));
+                            const cancelled = await composed.service.cancel(runId, reason);
+                            await reconcileLocalPreparations(composed, cancelled);
+                            return cancelled;
+                        },
+                    };
+                },
+                run_id: existingRunId(),
                 reason: opts.reason,
                 json: opts.json,
             });
         }
-        const initialMetadata = await startMetadata(opts, projectDirectory);
-        if (opts.dryRun) {
-            const firstPreview = await compileRunAssets(initialMetadata);
-            const previewMetadata = {
-                ...initialMetadata,
-                workflow_asset: firstPreview.workflow_asset,
-            };
-            const preview = previewMetadata.workflow_asset
-                === initialMetadata.workflow_asset
-                ? firstPreview
-                : await compileRunAssets(previewMetadata);
-            return printDryRun(preview.plan, previewMetadata, preview.plan_digest);
+        if (action === "resume") {
+            const runId = existingRunId();
+            return runLifecycleResume({
+                run_store: runStore,
+                service_factory: async () => requireRuntime().service,
+                run_id: runId,
+                drive: async (service, id) => {
+                    const composed = requireRuntime();
+                    const view = await service.inspect(id);
+                    await reconcileLocalPreparations(composed, view);
+                    const metadata = readCanonicalMetadata(view.run.metadata);
+                    const resumed = await createDriver(composed, view, metadata, projectDirectory).run(id, { resume: true });
+                    await reconcileLocalPreparations(composed, resumed);
+                    writeTerminalDriverFailure(resumed);
+                    return resumed;
+                },
+                json: opts.json,
+            });
         }
-        const firstCompilation = await compileCanonicalRun(initialMetadata);
-        const metadata = {
-            ...initialMetadata,
-            workflow_asset: firstCompilation.workflow_asset,
-        };
-        const compiled = metadata.workflow_asset === initialMetadata.workflow_asset
-            ? firstCompilation
-            : await compileCanonicalRun(metadata);
-        await syncRuntimeArtifacts(compiled, metadata);
-        const runtime = buildRuntime(metadata, compiled);
-        const now = new Date().toISOString();
-        const runId = opts.runId?.trim()
-            ? asRunId(opts.runId)
-            : `run_${randomUUID()}`;
-        const run = {
-            run_id: runId,
-            workflow_id: metadata.workflow_name,
-            workflow_version: null,
-            plan_digest: compiled.plan_digest,
-            status: "active",
-            cancellation: null,
-            terminal: null,
-            metadata: metadata,
-            created_at: now,
-            updated_at: now,
-        };
-        return runLifecycleStart({
-            controller: runtime.controller,
-            run,
-            json: opts.json,
+        const initialMetadata = startMetadata(opts, projectDirectory);
+        const runtime = requireRuntime();
+        const app = new CanonicalRunApplication({
+            starter: runtime.service,
+            metadata_factory: ({ compiled }) => {
+                if (!compiled.projection) {
+                    throw new Error("canonical compiler did not produce a runtime projection");
+                }
+                return metadataForBinding({
+                    ...initialMetadata,
+                    workflow_asset: compiled.projection.workflow_asset,
+                    runtime_projection: durableRuntimeProjection(compiled.projection),
+                }, compiled.run_binding);
+            },
+            projection_sink: async ({ phase, projection }) => {
+                if (phase !== "before_start")
+                    return;
+                await syncRuntimeProjection(projectDirectory, initialMetadata.agents_directory, projection, durableRuntimeProjection(projection));
+            },
+        });
+        const started = await app.startTarget({
+            dna_sources: initialMetadata.dna_files,
+            target: initialMetadata.target,
+            inputs: canonicalInputs(initialMetadata),
+            input_policy: "declared_only",
+            environment: { project_root: projectDirectory, workspace_root: projectDirectory },
+            provider: providerConfiguration(initialMetadata),
+            max_concurrency: initialMetadata.max_concurrency,
+            context: initialMetadata.context,
+            attempt_policy: { timeout_ms: initialMetadata.timeout_ms, cancellation_grace_ms: initialMetadata.cancellation_grace_ms },
+            metadata: initialMetadata,
+            run_id: opts.runId?.trim() ? asRunId(opts.runId) : undefined,
         });
+        const storedMetadata = readCanonicalMetadata(started.view.run.metadata);
+        const view = await createDriver(runtime, started.view, storedMetadata, projectDirectory).run(started.run_id, { initial_view: started.view });
+        await reconcileLocalPreparations(runtime, view);
+        writeTerminalDriverFailure(view);
+        writeCanonicalOperation("start", view, opts.json === true);
+        return view.run.status === "failed" ? 1 : 0;
     }
     catch (error) {
         const usage = error instanceof RunUsageError;
-        process.stderr.write(`${usage ? "Usage error" : "Error"}: `
-            + `${error instanceof Error ? error.message : String(error)}\n`);
+        const typedCode = error instanceof Error
+            && "code" in error
+            && typeof error.code === "string"
+            ? error.code
+            : null;
+        const detail = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`${usage ? "Usage error" : "Error"}: ${typedCode === null ? "" : `${typedCode}: `}${detail}\n`);
         return usage ? 2 : 1;
     }
 }
 function printDryRun(plan, metadata, digest) {
     process.stderr.write("\n=== DRY RUN - Canonical Controller Plan ===\n\n");
-    process.stderr.write(`Workflow: ${plan.name}\n`);
-    process.stderr.write(`Plan digest: ${digest}\n`);
-    process.stderr.write(`Provider: ${metadata.provider.kind}\n`);
-    process.stderr.write(`Max concurrency: ${metadata.max_concurrency}\n`);
-    process.stderr.write(`Durable root: ${runtimeRoot(metadata.project_directory)}\n`);
-    process.stderr.write(`Steps: ${plan.steps.length}\n\n`);
-    process.stderr.write(`Groups: ${plan.parallel_groups.length}\n`);
+    process.stderr.write(`Target: ${metadata.target.kind}:${metadata.target.key}\n`);
+    process.stderr.write(`Projection workflow: ${plan.name}\nPlan digest: ${digest}\nProvider: ${metadata.provider.kind}\n`);
+    process.stderr.write(`Max concurrency: ${metadata.max_concurrency}\nDurable root: ${runtimeRoot(metadata.project_directory)}\n`);
+    process.stderr.write(`Steps: ${plan.steps.length}\n\nGroups: ${plan.parallel_groups.length}\n`);
     process.stderr.write(`Max retries: ${plan.retry.max_retries}\n`);
-    if (plan.retry.retry_from) {
+    if (plan.retry.retry_from)
         process.stderr.write(`Retry from: ${plan.retry.retry_from}\n`);
-    }
     process.stderr.write(`Variables: ${JSON.stringify(metadata.variables)}\n\n`);
     for (const group of plan.parallel_groups) {
         process.stderr.write(`Group ${group.group_index + 1} (${group.isolation}):\n`);
@@ -774,24 +585,15 @@ function printDryRun(plan, metadata, digest) {
             if (!step)
                 continue;
             const prompt = substituteTemplate(step.prompt ?? step.description, metadata.variables);
-            const runIf = step.run_if ? ` [run_if: ${step.run_if}]` : "";
-            const optional = step.optional ? " (optional)" : "";
-            process.stderr.write(`  - ${step.id} -> agent: dna-${toKebabCase(step.role)}`
-                + `${runIf}${optional}; independent session\n`);
+            process.stderr.write(`  - ${step.id} -> agent: dna-${toKebabCase(step.role)}${step.run_if ? ` [run_if: ${step.run_if}]` : ""}${step.optional ? " (optional)" : ""}; independent session\n`);
             process.stderr.write(`    prompt: ${prompt.slice(0, 120)}${prompt.length > 120 ? "..." : ""}\n`);
         }
     }
     if (plan.transitions.length > 0) {
         process.stderr.write("\nTransitions:\n");
-        for (const transition of plan.transitions) {
-            process.stderr.write(`  ${transition.from} -> ${transition.to} `
-                + `(on ${transition.condition})\n`);
-        }
+        for (const transition of plan.transitions)
+            process.stderr.write(`  ${transition.from} -> ${transition.to} (on ${transition.condition})\n`);
     }
     process.stderr.write("\n");
     return 0;
 }
-function log(message) {
-    const timestamp = new Date().toLocaleTimeString("en-US", { hour12: false });
-    process.stderr.write(`[${timestamp}] ${message}\n`);
-}