intentdna 1.9.0 → 1.9.3

package/dist/compiler/controller.js

@@ -0,0 +1,693 @@
+import { EXECUTABLE_RUN_PLAN_SCHEMA_VERSION, parseExecutableRunPlanPayload, } from "../runtime/executable-run-plan.js";
+import { canonicalizeJson } from "../runtime/canonical-json.js";
+export class ControllerPlanCompilerError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "ControllerPlanCompilerError";
+        this.code = code;
+    }
+}
+const TERMINAL_NODE_IDS = {
+    passed: "terminal:pass",
+    request_changes: "terminal:request-changes",
+    blocked: "terminal:blocked",
+    diagnosis_invalid: "terminal:diagnosis-contract-invalid",
+    provenance_invalid: "terminal:provenance-invalid",
+    max_rounds: "terminal:max-rounds",
+    cancelled: "terminal:cancelled",
+};
+const DIAGNOSIS_DECISION_NODE_ID = "decision:diagnosis-review";
+const FIX_DECISION_NODE_ID = "decision:fix-verdict";
+const DIAGNOSIS_SOURCE_NODE_ID = "system:resolve-diagnosis-source";
+const DIAGNOSIS_SOURCE_DECISION_NODE_ID = "decision:diagnosis-source";
+const ADOPT_DIAGNOSIS_NODE_ID = "system:adopt-diagnosis";
+const IMPORT_DIAGNOSIS_NODE_ID = "system:import-diagnosis";
+const SEAL_DIAGNOSIS_INPUTS_NODE_ID = "system:seal-diagnosis-inputs";
+const DIAGNOSIS_APPROVAL_SOURCE_DECISION_NODE_ID = "decision:diagnosis-approval-source";
+const IMPORT_DIAGNOSIS_REVIEW_NODE_ID = "system:import-diagnosis-review";
+const SEAL_APPROVED_DIAGNOSIS_NODE_ID = "system:seal-approved-diagnosis";
+const DIAGNOSIS_SOURCE_OUTPUT = "diagnosis-source";
+const DIAGNOSIS_ORIGIN_OUTPUT = "diagnosis-origin";
+const DIAGNOSIS_SOURCE_SCHEMA = "intentdna.controller.diagnosis-source.v1";
+const DIAGNOSIS_ORIGIN_SCHEMA = "intentdna.controller.diagnosis-origin.v1";
+function namespace(prefix, value) {
+    return `${prefix}/${value}`;
+}
+function rewriteHandoffTemplates(value, replacements) {
+    if (typeof value === "string") {
+        let rewritten = value;
+        for (const [source, target] of replacements) {
+            rewritten = rewritten.replaceAll(`{{handoff.${source}.`, `{{handoff.${target}.`);
+        }
+        return rewritten;
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => rewriteHandoffTemplates(item, replacements));
+    }
+    if (value !== null && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => ([key, rewriteHandoffTemplates(item, replacements)])));
+    }
+    return value;
+}
+function componentTerminalStatus(plan, nodeId) {
+    const node = plan.nodes.find((candidate) => candidate.node_id === nodeId);
+    if (node?.kind !== "terminal")
+        return null;
+    return plan.terminals.find((terminal) => terminal.terminal_id === node.terminal_id)?.status ?? null;
+}
+function namespaceComponent(prefix, plan, successTargetNodeId) {
+    if (plan.target.kind !== "workflow") {
+        throw new ControllerPlanCompilerError("invalid_component_plan", `controller component '${prefix}' must be a workflow plan`);
+    }
+    if (plan.retry_segments.length > 0) {
+        throw new ControllerPlanCompilerError("invalid_component_plan", `controller component '${prefix}' cannot contain an independent workflow retry segment`);
+    }
+    const nodeId = (value) => namespace(prefix, value);
+    const routeId = (value) => namespace(prefix, value);
+    const verifierId = (value) => namespace(prefix, value);
+    const handoffId = (value) => namespace(prefix, value);
+    const handoffReplacements = new Map(plan.handoff_plan.map((handoff) => [handoff.handoff_id, handoffId(handoff.handoff_id)]));
+    const terminalIds = new Set(plan.nodes.filter((node) => node.kind === "terminal").map((node) => node.node_id));
+    const successTerminals = plan.nodes.filter((node) => (node.kind === "terminal"
+        && componentTerminalStatus(plan, node.node_id) === "succeeded"));
+    const successDependencies = [...new Set(successTerminals.flatMap((node) => (node.depends_on.map(nodeId))))];
+    const nodes = plan.nodes.flatMap((originalNode) => {
+        const node = rewriteHandoffTemplates(originalNode, handoffReplacements);
+        if (node.kind === "terminal")
+            return [];
+        const depends_on = node.depends_on
+            .filter((dependency) => !terminalIds.has(dependency))
+            .map(nodeId);
+        if (node.kind === "worker") {
+            return [{
+                    ...node,
+                    node_id: nodeId(node.node_id),
+                    depends_on,
+                    attempt_policy: { ...node.attempt_policy, retry_segment_id: null },
+                }];
+        }
+        if (node.kind === "system") {
+            return [{
+                    ...node,
+                    node_id: nodeId(node.node_id),
+                    depends_on,
+                    operation: node.operation.kind === "materialize_handoff"
+                        ? { ...node.operation, handoff_id: handoffId(node.operation.handoff_id) }
+                        : node.operation,
+                }];
+        }
+        if (node.kind === "gate") {
+            return [{
+                    ...node,
+                    node_id: nodeId(node.node_id),
+                    depends_on,
+                    verifier_ids: node.verifier_ids.map(verifierId),
+                    pass_route_ids: node.pass_route_ids.map(routeId),
+                    fail_route_id: routeId(node.fail_route_id),
+                }];
+        }
+        if (node.kind === "decision") {
+            return [{
+                    ...node,
+                    node_id: nodeId(node.node_id),
+                    depends_on,
+                    source: { ...node.source, node_id: nodeId(node.source.node_id) },
+                }];
+        }
+        return [{ ...node, node_id: nodeId(node.node_id), depends_on }];
+    });
+    const routes = plan.routes.flatMap((route) => {
+        const status = componentTerminalStatus(plan, route.to_node_id);
+        const toNodeId = status === "succeeded"
+            ? successTargetNodeId
+            : status === "failed" || status === "unsupported"
+                ? TERMINAL_NODE_IDS.blocked
+                : status === "cancelled"
+                    ? TERMINAL_NODE_IDS.cancelled
+                    : nodeId(route.to_node_id);
+        const condition = route.condition.kind === "gate"
+            ? { ...route.condition, gate_node_id: nodeId(route.condition.gate_node_id) }
+            : route.condition.kind === "decision"
+                ? { ...route.condition, decision_node_id: nodeId(route.condition.decision_node_id) }
+                : route.condition.kind === "interaction"
+                    ? { ...route.condition, interaction_node_id: nodeId(route.condition.interaction_node_id) }
+                    : route.condition;
+        return [{
+                ...route,
+                route_id: routeId(route.route_id),
+                from_node_id: nodeId(route.from_node_id),
+                to_node_id: toNodeId,
+                condition,
+            }];
+    });
+    const incoming = new Set(routes.map((route) => route.to_node_id));
+    const roots = nodes.filter((node) => ((node.kind === "worker" || node.kind === "system" || node.kind === "interaction")
+        && node.depends_on.length === 0
+        && !incoming.has(node.node_id))).map((node) => node.node_id);
+    return {
+        nodes,
+        routes,
+        roots,
+        success_dependencies: successDependencies,
+        node_id: nodeId,
+        verifiers: plan.verifier_plan.map((originalVerifier) => {
+            const verifier = rewriteHandoffTemplates(originalVerifier, handoffReplacements);
+            return {
+                ...verifier,
+                verifier_id: verifierId(verifier.verifier_id),
+                subject_node_id: nodeId(verifier.subject_node_id),
+                ...(verifier.kind === "structured_output"
+                    ? { node_id: nodeId(verifier.node_id) }
+                    : {}),
+            };
+        }),
+        handoffs: plan.handoff_plan.map((handoff) => ({
+            ...handoff,
+            handoff_id: handoffId(handoff.handoff_id),
+            from_node_id: nodeId(handoff.from_node_id),
+            to_node_id: nodeId(handoff.to_node_id),
+        })),
+    };
+}
+function mergeInputs(plans) {
+    const inputs = new Map();
+    for (const plan of plans) {
+        for (const input of plan.input_contract.inputs) {
+            const existing = inputs.get(input.name);
+            if (existing && canonicalizeJson(existing) !== canonicalizeJson(input)) {
+                throw new ControllerPlanCompilerError("invalid_component_plan", `controller component input '${input.name}' has conflicting definitions`);
+            }
+            inputs.set(input.name, input);
+        }
+    }
+    return [...inputs.values()].sort((left, right) => left.name.localeCompare(right.name));
+}
+function assertDecisionOutput(component, decision, label) {
+    const nodeId = component.node_id(`worker:${decision.step_id}`);
+    const node = component.nodes.find((candidate) => candidate.node_id === nodeId);
+    if (node?.kind !== "worker") {
+        throw new ControllerPlanCompilerError("invalid_controller_program", `${label} decision step '${decision.step_id}' is not a worker node`);
+    }
+    const output = node.packet_template.output_contract.find((candidate) => candidate.name === decision.output_name);
+    if (output?.kind !== "structured" || output.schema_ref !== decision.schema_ref) {
+        throw new ControllerPlanCompilerError("invalid_controller_program", `${label} decision output '${decision.output_name}' is not a structured '${decision.schema_ref}' output`);
+    }
+    return nodeId;
+}
+function terminalNode(nodeId, terminalId) {
+    return { kind: "terminal", node_id: nodeId, depends_on: [], terminal_id: terminalId };
+}
+function decisionRoute(id, decisionNodeId, value, toNodeId) {
+    return {
+        route_id: id,
+        from_node_id: decisionNodeId,
+        to_node_id: toNodeId,
+        condition: { kind: "decision", decision_node_id: decisionNodeId, value },
+    };
+}
+function alwaysRoute(id, fromNodeId, toNodeId) {
+    return {
+        route_id: id,
+        from_node_id: fromNodeId,
+        to_node_id: toNodeId,
+        condition: { kind: "always" },
+    };
+}
+function systemArtifactOutput(name, description) {
+    return {
+        name,
+        kind: "reference",
+        artifact_kind: "file",
+        required: true,
+        description,
+        relative_path_template: null,
+        schema_ref: null,
+    };
+}
+function systemStructuredOutput(name, schemaRef, description) {
+    return {
+        name,
+        kind: "structured",
+        artifact_kind: "state",
+        required: true,
+        description,
+        relative_path_template: null,
+        schema_ref: schemaRef,
+    };
+}
+function controllerReuseInputs(controller) {
+    const reuse = controller.runtime_program?.reuse;
+    if (!reuse)
+        return [];
+    const optional = (name, description) => ({
+        name,
+        type: "string",
+        required: false,
+        sensitive: false,
+        description,
+    });
+    return [
+        {
+            name: reuse.mode_input,
+            type: "string",
+            required: false,
+            sensitive: false,
+            description: "Typed diagnosis source mode: fresh, legacy, or canonical",
+            default_value: "fresh",
+        },
+        optional(reuse.legacy.diagnosis_spec_reference_input, "Project-relative legacy diagnosis spec path"),
+        optional(reuse.legacy.diagnosis_spec_digest_input, "Expected immutable digest for the legacy diagnosis spec"),
+        optional(reuse.legacy.diagnosis_contract_reference_input, "Project-relative legacy diagnosis contract path"),
+        optional(reuse.legacy.diagnosis_contract_digest_input, "Expected immutable digest for the legacy diagnosis contract"),
+        optional(reuse.canonical.source_plan_input, "Origin canonical plan id"),
+        optional(reuse.canonical.diagnosis_result_input, "Origin canonical diagnosis result id"),
+        optional(reuse.canonical.review_result_input, "Origin canonical diagnosis review result id"),
+    ];
+}
+function replaceLiteralTemplates(value, replacements) {
+    if (typeof value === "string") {
+        let rewritten = value;
+        for (const [source, target] of replacements) {
+            rewritten = rewritten.replaceAll(source, target);
+        }
+        return rewritten;
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => replaceLiteralTemplates(item, replacements));
+    }
+    if (value !== null && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => ([key, replaceLiteralTemplates(item, replacements)])));
+    }
+    return value;
+}
+function controllerDiagnosisHandoffs(fix, sourceNodeId, outputs) {
+    const outputByPathSuffix = [
+        [".md", outputs.diagnosis_spec],
+        [".contract.json", outputs.diagnosis_contract],
+        [".review.json", outputs.diagnosis_review],
+    ];
+    const addedHandoffs = [];
+    const verifierReplacements = new Map();
+    const nodes = fix.nodes.map((node) => {
+        if (node.kind !== "worker")
+            return node;
+        const literalReplacements = new Map();
+        const handoffInputs = node.packet_template.handoff_inputs.map((input) => {
+            if (input.source !== "external" || input.artifact_kind !== "file")
+                return input;
+            const output = outputByPathSuffix.find(([suffix]) => (input.relative_path_template?.includes("diagnosis-") === true
+                && input.relative_path_template.endsWith(suffix)));
+            if (!output)
+                return input;
+            const handoffId = `controller:${node.node_id}:${output[1]}`;
+            addedHandoffs.push({
+                handoff_id: handoffId,
+                from_node_id: sourceNodeId,
+                output_name: output[1],
+                to_node_id: node.node_id,
+                input_name: input.name,
+                mode: "reference",
+                artifact_kind: "file",
+                required: true,
+                schema_ref: null,
+            });
+            if (input.relative_path_template) {
+                literalReplacements.set(input.relative_path_template, `{{handoff.${handoffId}.materialized_path}}`);
+            }
+            return { ...input, source: "handoff" };
+        });
+        if (literalReplacements.size === 0)
+            return node;
+        verifierReplacements.set(node.node_id, literalReplacements);
+        return {
+            ...replaceLiteralTemplates(node, literalReplacements),
+            depends_on: [...new Set([...node.depends_on, sourceNodeId])],
+            packet_template: {
+                ...replaceLiteralTemplates(node.packet_template, literalReplacements),
+                handoff_inputs: handoffInputs,
+            },
+        };
+    });
+    return {
+        nodes,
+        handoffs: [...fix.handoffs, ...addedHandoffs],
+        verifiers: fix.verifiers.map((verifier) => {
+            const replacements = verifierReplacements.get(verifier.subject_node_id);
+            return replacements ? replaceLiteralTemplates(verifier, replacements) : verifier;
+        }),
+    };
+}
+export function compileControllerPlan(options) {
+    const program = options.controller.runtime_program;
+    if (!program) {
+        throw new ControllerPlanCompilerError("invalid_controller_program", `controller '${options.controller_key}' has no typed runtime_program`);
+    }
+    const reuse = program.reuse;
+    const diagnosis = namespaceComponent("diagnosis", options.diagnosis_plan, DIAGNOSIS_DECISION_NODE_ID);
+    const fix = namespaceComponent("fix", options.fix_plan, FIX_DECISION_NODE_ID);
+    if (diagnosis.roots.length === 0 || fix.roots.length === 0) {
+        throw new ControllerPlanCompilerError("invalid_component_plan", "controller workflows must each expose at least one executable root");
+    }
+    const diagnosisSource = assertDecisionOutput(diagnosis, program.diagnosis.decision, "diagnosis");
+    const fixSource = assertDecisionOutput(fix, program.fix.decision, "fix");
+    const diagnosisDecisionId = DIAGNOSIS_DECISION_NODE_ID;
+    const fixDecisionId = FIX_DECISION_NODE_ID;
+    const diagnosisAllowed = [
+        program.diagnosis.approved_value,
+        program.diagnosis.request_changes_value,
+    ];
+    const fixAllowed = [
+        program.fix.pass_value,
+        program.fix.continue_value,
+        program.fix.request_changes_value,
+        program.fix.blocked_value,
+        program.fix.diagnosis_contract_invalid_value,
+        program.fix.provenance_invalid_value,
+    ];
+    if (new Set(diagnosisAllowed).size !== diagnosisAllowed.length) {
+        throw new ControllerPlanCompilerError("invalid_controller_program", "diagnosis verdict values must be unique");
+    }
+    if (new Set(fixAllowed).size !== fixAllowed.length) {
+        throw new ControllerPlanCompilerError("invalid_controller_program", "fix verdict values must be unique");
+    }
+    const diagnosisDecision = {
+        kind: "decision",
+        node_id: diagnosisDecisionId,
+        depends_on: reuse ? [SEAL_APPROVED_DIAGNOSIS_NODE_ID] : diagnosis.success_dependencies,
+        source: {
+            node_id: reuse ? SEAL_APPROVED_DIAGNOSIS_NODE_ID : diagnosisSource,
+            output_name: program.diagnosis.decision.output_name,
+            json_pointer: program.diagnosis.decision.json_pointer,
+        },
+        allowed_values: diagnosisAllowed,
+    };
+    const fixDecision = {
+        kind: "decision",
+        node_id: fixDecisionId,
+        depends_on: fix.success_dependencies,
+        source: {
+            node_id: fixSource,
+            output_name: program.fix.decision.output_name,
+            json_pointer: program.fix.decision.json_pointer,
+        },
+        allowed_values: fixAllowed,
+    };
+    const continueRouteId = "route:fix:continue";
+    const diagnosisAnalyzerId = diagnosis.node_id(`worker:${program.diagnosis.analyzer_step_id}`);
+    const diagnosisReviewerId = diagnosis.node_id(`worker:${program.diagnosis.reviewer_step_id}`);
+    const diagnosisReviewerGateId = diagnosis.nodes.find((node) => (node.kind === "gate" && node.depends_on.includes(diagnosisReviewerId)))?.node_id;
+    const diagnosisAnalyzerGateId = diagnosis.nodes.find((node) => (node.kind === "gate" && node.depends_on.includes(diagnosisAnalyzerId)))?.node_id;
+    if (reuse && (!diagnosisReviewerGateId || !diagnosisAnalyzerGateId)) {
+        throw new ControllerPlanCompilerError("invalid_component_plan", "diagnosis reuse requires typed analyzer and reviewer gates");
+    }
+    const diagnosisNodes = reuse
+        ? diagnosis.nodes.map((node) => {
+            if (node.node_id !== diagnosisReviewerId || node.kind !== "worker")
+                return node;
+            return { ...node, depends_on: [SEAL_DIAGNOSIS_INPUTS_NODE_ID] };
+        })
+        : diagnosis.nodes;
+    const diagnosisHandoffs = reuse
+        ? diagnosis.handoffs.map((handoff) => (handoff.to_node_id === diagnosisReviewerId
+            ? { ...handoff, from_node_id: SEAL_DIAGNOSIS_INPUTS_NODE_ID }
+            : handoff))
+        : diagnosis.handoffs;
+    const fixWithDiagnosis = reuse
+        ? controllerDiagnosisHandoffs(fix, SEAL_APPROVED_DIAGNOSIS_NODE_ID, reuse.outputs)
+        : { nodes: fix.nodes, verifiers: fix.verifiers, handoffs: fix.handoffs };
+    const baseDiagnosisRoutes = reuse
+        ? diagnosis.routes.filter((route) => (route.from_node_id !== diagnosisAnalyzerGateId
+            && route.from_node_id !== diagnosisReviewerGateId))
+        : diagnosis.routes;
+    const routes = [
+        ...baseDiagnosisRoutes,
+        ...fix.routes,
+        ...(reuse ? [
+            decisionRoute("route:diagnosis-source:fresh", DIAGNOSIS_SOURCE_DECISION_NODE_ID, "fresh", diagnosisAnalyzerId),
+            decisionRoute("route:diagnosis-source:legacy", DIAGNOSIS_SOURCE_DECISION_NODE_ID, "legacy", ADOPT_DIAGNOSIS_NODE_ID),
+            decisionRoute("route:diagnosis-source:canonical", DIAGNOSIS_SOURCE_DECISION_NODE_ID, "canonical", IMPORT_DIAGNOSIS_NODE_ID),
+            {
+                ...diagnosis.routes.find((route) => (route.from_node_id === diagnosisAnalyzerGateId && route.condition.kind === "gate" && route.condition.outcome === "pass")),
+                to_node_id: SEAL_DIAGNOSIS_INPUTS_NODE_ID,
+            },
+            ...diagnosis.routes.filter((route) => (route.from_node_id === diagnosisAnalyzerGateId && route.condition.kind === "gate" && route.condition.outcome === "fail")),
+            alwaysRoute("route:diagnosis:legacy-sealed", ADOPT_DIAGNOSIS_NODE_ID, SEAL_DIAGNOSIS_INPUTS_NODE_ID),
+            alwaysRoute("route:diagnosis:canonical-sealed", IMPORT_DIAGNOSIS_NODE_ID, SEAL_DIAGNOSIS_INPUTS_NODE_ID),
+            decisionRoute("route:diagnosis-approval:fresh", DIAGNOSIS_APPROVAL_SOURCE_DECISION_NODE_ID, "fresh", diagnosisReviewerId),
+            decisionRoute("route:diagnosis-approval:legacy", DIAGNOSIS_APPROVAL_SOURCE_DECISION_NODE_ID, "legacy", diagnosisReviewerId),
+            decisionRoute("route:diagnosis-approval:canonical", DIAGNOSIS_APPROVAL_SOURCE_DECISION_NODE_ID, "canonical", IMPORT_DIAGNOSIS_REVIEW_NODE_ID),
+            {
+                ...diagnosis.routes.find((route) => (route.from_node_id === diagnosisReviewerGateId && route.condition.kind === "gate" && route.condition.outcome === "pass")),
+                to_node_id: SEAL_APPROVED_DIAGNOSIS_NODE_ID,
+            },
+            ...diagnosis.routes.filter((route) => (route.from_node_id === diagnosisReviewerGateId && route.condition.kind === "gate" && route.condition.outcome === "fail")),
+            alwaysRoute("route:diagnosis:imported-review-sealed", IMPORT_DIAGNOSIS_REVIEW_NODE_ID, SEAL_APPROVED_DIAGNOSIS_NODE_ID),
+        ] : []),
+        ...fix.roots.map((root, index) => decisionRoute(`route:diagnosis:approved:${index}`, diagnosisDecisionId, program.diagnosis.approved_value, root)),
+        decisionRoute("route:diagnosis:request-changes", diagnosisDecisionId, program.diagnosis.request_changes_value, TERMINAL_NODE_IDS.diagnosis_invalid),
+        decisionRoute("route:fix:pass", fixDecisionId, program.fix.pass_value, TERMINAL_NODE_IDS.passed),
+        decisionRoute(continueRouteId, fixDecisionId, program.fix.continue_value, TERMINAL_NODE_IDS.max_rounds),
+        decisionRoute("route:fix:request-changes", fixDecisionId, program.fix.request_changes_value, TERMINAL_NODE_IDS.request_changes),
+        decisionRoute("route:fix:blocked", fixDecisionId, program.fix.blocked_value, TERMINAL_NODE_IDS.blocked),
+        decisionRoute("route:fix:diagnosis-invalid", fixDecisionId, program.fix.diagnosis_contract_invalid_value, TERMINAL_NODE_IDS.diagnosis_invalid),
+        decisionRoute("route:fix:provenance-invalid", fixDecisionId, program.fix.provenance_invalid_value, TERMINAL_NODE_IDS.provenance_invalid),
+    ];
+    const retrySegment = {
+        retry_segment_id: "retry:fix-rounds",
+        node_ids: fixWithDiagnosis.nodes.filter((node) => (node.kind === "worker" || node.kind === "system" || node.kind === "interaction")).map((node) => node.node_id),
+        retry_from_node_id: fix.roots[0],
+        max_rounds: options.controller.max_rounds,
+        backoff: "none",
+        initial_delay_ms: 0,
+        max_delay_ms: null,
+        retryable_outcomes: [],
+        continue_route_id: continueRouteId,
+    };
+    const reuseNodes = reuse ? [
+        {
+            kind: "system",
+            node_id: DIAGNOSIS_SOURCE_NODE_ID,
+            depends_on: [],
+            input_ports: [{ name: reuse.mode_input, source: "run_input" }],
+            output_contract: [systemStructuredOutput(DIAGNOSIS_SOURCE_OUTPUT, DIAGNOSIS_SOURCE_SCHEMA, "Typed diagnosis source selection")],
+            operation: { kind: "resolve_diagnosis_source", mode_input: reuse.mode_input, output_name: DIAGNOSIS_SOURCE_OUTPUT },
+        },
+        {
+            kind: "decision",
+            node_id: DIAGNOSIS_SOURCE_DECISION_NODE_ID,
+            depends_on: [DIAGNOSIS_SOURCE_NODE_ID],
+            source: { node_id: DIAGNOSIS_SOURCE_NODE_ID, output_name: DIAGNOSIS_SOURCE_OUTPUT, json_pointer: "/mode" },
+            allowed_values: ["fresh", "legacy", "canonical"],
+        },
+        {
+            kind: "system",
+            node_id: ADOPT_DIAGNOSIS_NODE_ID,
+            depends_on: [DIAGNOSIS_SOURCE_NODE_ID],
+            input_ports: [
+                { name: reuse.legacy.diagnosis_spec_reference_input, source: "run_input" },
+                { name: reuse.legacy.diagnosis_spec_digest_input, source: "run_input" },
+                { name: reuse.legacy.diagnosis_contract_reference_input, source: "run_input" },
+                { name: reuse.legacy.diagnosis_contract_digest_input, source: "run_input" },
+            ],
+            output_contract: [
+                systemArtifactOutput(reuse.outputs.diagnosis_spec, "Adopted diagnosis spec snapshot"),
+                systemArtifactOutput(reuse.outputs.diagnosis_contract, "Adopted diagnosis contract snapshot"),
+            ],
+            operation: {
+                kind: "adopt_artifact_bundle",
+                artifacts: [
+                    { source_reference_input: reuse.legacy.diagnosis_spec_reference_input, expected_digest_input: reuse.legacy.diagnosis_spec_digest_input, output_name: reuse.outputs.diagnosis_spec, artifact_kind: "file" },
+                    { source_reference_input: reuse.legacy.diagnosis_contract_reference_input, expected_digest_input: reuse.legacy.diagnosis_contract_digest_input, output_name: reuse.outputs.diagnosis_contract, artifact_kind: "file" },
+                ],
+            },
+        },
+        {
+            kind: "system",
+            node_id: IMPORT_DIAGNOSIS_NODE_ID,
+            depends_on: [DIAGNOSIS_SOURCE_NODE_ID],
+            input_ports: [
+                { name: reuse.canonical.source_plan_input, source: "run_input" },
+                { name: reuse.canonical.diagnosis_result_input, source: "run_input" },
+            ],
+            output_contract: [
+                systemArtifactOutput(reuse.outputs.diagnosis_spec, "Imported canonical diagnosis spec"),
+                systemArtifactOutput(reuse.outputs.diagnosis_contract, "Imported canonical diagnosis contract"),
+            ],
+            operation: {
+                kind: "import_result_bundle",
+                source_plan_input: reuse.canonical.source_plan_input,
+                source_result_input: reuse.canonical.diagnosis_result_input,
+                required_outputs: [
+                    { source_output_name: reuse.outputs.diagnosis_spec, output_name: reuse.outputs.diagnosis_spec },
+                    { source_output_name: reuse.outputs.diagnosis_contract, output_name: reuse.outputs.diagnosis_contract },
+                ],
+            },
+        },
+        {
+            kind: "system",
+            node_id: SEAL_DIAGNOSIS_INPUTS_NODE_ID,
+            depends_on: [],
+            input_ports: [],
+            output_contract: [
+                systemArtifactOutput(reuse.outputs.diagnosis_spec, "Current-run diagnosis spec"),
+                systemArtifactOutput(reuse.outputs.diagnosis_contract, "Current-run diagnosis contract"),
+                systemStructuredOutput(DIAGNOSIS_ORIGIN_OUTPUT, DIAGNOSIS_ORIGIN_SCHEMA, "Current-run diagnosis origin"),
+            ],
+            operation: {
+                kind: "seal_result_bundle",
+                origin_output_name: DIAGNOSIS_ORIGIN_OUTPUT,
+                candidates: [
+                    { required_node_ids: [diagnosisAnalyzerId, diagnosisAnalyzerGateId], outputs: [
+                            { source_node_id: diagnosisAnalyzerId, source_output_name: reuse.outputs.diagnosis_spec, output_name: reuse.outputs.diagnosis_spec },
+                            { source_node_id: diagnosisAnalyzerId, source_output_name: reuse.outputs.diagnosis_contract, output_name: reuse.outputs.diagnosis_contract },
+                        ] },
+                    { required_node_ids: [ADOPT_DIAGNOSIS_NODE_ID], outputs: [
+                            { source_node_id: ADOPT_DIAGNOSIS_NODE_ID, source_output_name: reuse.outputs.diagnosis_spec, output_name: reuse.outputs.diagnosis_spec },
+                            { source_node_id: ADOPT_DIAGNOSIS_NODE_ID, source_output_name: reuse.outputs.diagnosis_contract, output_name: reuse.outputs.diagnosis_contract },
+                        ] },
+                    { required_node_ids: [IMPORT_DIAGNOSIS_NODE_ID], outputs: [
+                            { source_node_id: IMPORT_DIAGNOSIS_NODE_ID, source_output_name: reuse.outputs.diagnosis_spec, output_name: reuse.outputs.diagnosis_spec },
+                            { source_node_id: IMPORT_DIAGNOSIS_NODE_ID, source_output_name: reuse.outputs.diagnosis_contract, output_name: reuse.outputs.diagnosis_contract },
+                        ] },
+                ],
+            },
+        },
+        {
+            kind: "decision",
+            node_id: DIAGNOSIS_APPROVAL_SOURCE_DECISION_NODE_ID,
+            depends_on: [SEAL_DIAGNOSIS_INPUTS_NODE_ID],
+            source: { node_id: SEAL_DIAGNOSIS_INPUTS_NODE_ID, output_name: DIAGNOSIS_ORIGIN_OUTPUT, json_pointer: "/mode" },
+            allowed_values: ["fresh", "legacy", "canonical"],
+        },
+        {
+            kind: "system",
+            node_id: IMPORT_DIAGNOSIS_REVIEW_NODE_ID,
+            depends_on: [SEAL_DIAGNOSIS_INPUTS_NODE_ID],
+            input_ports: [
+                { name: reuse.canonical.source_plan_input, source: "run_input" },
+                { name: reuse.canonical.diagnosis_result_input, source: "run_input" },
+                { name: reuse.canonical.review_result_input, source: "run_input" },
+            ],
+            output_contract: [
+                systemArtifactOutput(reuse.outputs.diagnosis_review, "Imported canonical diagnosis review"),
+                systemStructuredOutput(reuse.outputs.diagnosis_review_verdict, program.diagnosis.decision.schema_ref, "Imported canonical diagnosis review verdict"),
+            ],
+            operation: {
+                kind: "import_review",
+                source_plan_input: reuse.canonical.source_plan_input,
+                source_diagnosis_result_input: reuse.canonical.diagnosis_result_input,
+                source_review_result_input: reuse.canonical.review_result_input,
+                policy_id: reuse.canonical.approval_reuse.policy_id,
+                required_outputs: [
+                    { source_output_name: reuse.outputs.diagnosis_review, output_name: reuse.outputs.diagnosis_review },
+                    { source_output_name: reuse.outputs.diagnosis_review_verdict, output_name: reuse.outputs.diagnosis_review_verdict },
+                ],
+            },
+        },
+        {
+            kind: "system",
+            node_id: SEAL_APPROVED_DIAGNOSIS_NODE_ID,
+            depends_on: [],
+            input_ports: [],
+            output_contract: [
+                systemArtifactOutput(reuse.outputs.diagnosis_spec, "Approved diagnosis spec"),
+                systemArtifactOutput(reuse.outputs.diagnosis_contract, "Approved diagnosis contract"),
+                systemArtifactOutput(reuse.outputs.diagnosis_review, "Approved diagnosis review"),
+                systemStructuredOutput(reuse.outputs.diagnosis_review_verdict, program.diagnosis.decision.schema_ref, "Approved diagnosis review verdict"),
+            ],
+            operation: {
+                kind: "seal_result_bundle",
+                candidates: [
+                    { required_node_ids: [SEAL_DIAGNOSIS_INPUTS_NODE_ID, diagnosisReviewerId, diagnosisReviewerGateId], outputs: [
+                            { source_node_id: SEAL_DIAGNOSIS_INPUTS_NODE_ID, source_output_name: reuse.outputs.diagnosis_spec, output_name: reuse.outputs.diagnosis_spec },
+                            { source_node_id: SEAL_DIAGNOSIS_INPUTS_NODE_ID, source_output_name: reuse.outputs.diagnosis_contract, output_name: reuse.outputs.diagnosis_contract },
+                            { source_node_id: diagnosisReviewerId, source_output_name: reuse.outputs.diagnosis_review, output_name: reuse.outputs.diagnosis_review },
+                            { source_node_id: diagnosisReviewerId, source_output_name: reuse.outputs.diagnosis_review_verdict, output_name: reuse.outputs.diagnosis_review_verdict },
+                        ] },
+                    { required_node_ids: [SEAL_DIAGNOSIS_INPUTS_NODE_ID, IMPORT_DIAGNOSIS_REVIEW_NODE_ID], outputs: [
+                            { source_node_id: SEAL_DIAGNOSIS_INPUTS_NODE_ID, source_output_name: reuse.outputs.diagnosis_spec, output_name: reuse.outputs.diagnosis_spec },
+                            { source_node_id: SEAL_DIAGNOSIS_INPUTS_NODE_ID, source_output_name: reuse.outputs.diagnosis_contract, output_name: reuse.outputs.diagnosis_contract },
+                            { source_node_id: IMPORT_DIAGNOSIS_REVIEW_NODE_ID, source_output_name: reuse.outputs.diagnosis_review, output_name: reuse.outputs.diagnosis_review },
+                            { source_node_id: IMPORT_DIAGNOSIS_REVIEW_NODE_ID, source_output_name: reuse.outputs.diagnosis_review_verdict, output_name: reuse.outputs.diagnosis_review_verdict },
+                        ] },
+                ],
+            },
+        },
+    ] : [];
+    const nodes = [
+        ...reuseNodes.slice(0, 2),
+        ...diagnosisNodes,
+        ...reuseNodes.slice(2),
+        diagnosisDecision,
+        ...fixWithDiagnosis.nodes,
+        fixDecision,
+        terminalNode(TERMINAL_NODE_IDS.passed, "pass"),
+        terminalNode(TERMINAL_NODE_IDS.request_changes, "request_changes"),
+        terminalNode(TERMINAL_NODE_IDS.blocked, "blocked"),
+        terminalNode(TERMINAL_NODE_IDS.diagnosis_invalid, "diagnosis_contract_invalid"),
+        terminalNode(TERMINAL_NODE_IDS.provenance_invalid, "provenance_invalid"),
+        terminalNode(TERMINAL_NODE_IDS.max_rounds, "max_rounds"),
+        terminalNode(TERMINAL_NODE_IDS.cancelled, "cancelled"),
+    ];
+    const readable = new Set([
+        ...options.diagnosis_plan.workspace_policy.readable_path_templates,
+        ...options.fix_plan.workspace_policy.readable_path_templates,
+    ]);
+    const writable = new Set([
+        ...options.diagnosis_plan.workspace_policy.writable_path_templates,
+        ...options.fix_plan.workspace_policy.writable_path_templates,
+    ]);
+    const payload = {
+        schema_version: EXECUTABLE_RUN_PLAN_SCHEMA_VERSION,
+        target: { kind: "controller", key: options.controller_key },
+        input_contract: {
+            inputs: [...mergeInputs([options.diagnosis_plan, options.fix_plan]), ...controllerReuseInputs(options.controller)]
+                .sort((left, right) => left.name.localeCompare(right.name)),
+            allow_unknown_inputs: false,
+        },
+        nodes,
+        routes,
+        retry_segments: [retrySegment],
+        terminals: [
+            { terminal_id: "pass", status: "succeeded", reason_code: "PASS" },
+            { terminal_id: "request_changes", status: "failed", reason_code: "REQUEST_CHANGES" },
+            { terminal_id: "blocked", status: "failed", reason_code: "BLOCKED" },
+            { terminal_id: "diagnosis_contract_invalid", status: "failed", reason_code: "DIAGNOSIS_CONTRACT_INVALID" },
+            { terminal_id: "provenance_invalid", status: "failed", reason_code: "PROVENANCE_INVALID" },
+            { terminal_id: "max_rounds", status: "failed", reason_code: "MAX_ROUNDS" },
+            { terminal_id: "cancelled", status: "cancelled", reason_code: "run_cancelled" },
+        ],
+        verifier_plan: [...diagnosis.verifiers, ...fixWithDiagnosis.verifiers],
+        handoff_plan: [...diagnosisHandoffs, ...fixWithDiagnosis.handoffs],
+        workspace_policy: {
+            default_isolation: options.diagnosis_plan.workspace_policy.default_isolation === "worktree"
+                || options.fix_plan.workspace_policy.default_isolation === "worktree"
+                ? "worktree"
+                : "none",
+            relative_workspace_root: ".",
+            allow_network: options.diagnosis_plan.workspace_policy.allow_network
+                && options.fix_plan.workspace_policy.allow_network,
+            readable_path_templates: [...readable],
+            writable_path_templates: [...writable],
+        },
+        required_capabilities: {
+            worktree_isolation: options.diagnosis_plan.required_capabilities.worktree_isolation
+                || options.fix_plan.required_capabilities.worktree_isolation,
+            parallelism: options.diagnosis_plan.required_capabilities.parallelism
+                || options.fix_plan.required_capabilities.parallelism,
+            cancellation: false,
+            hook_identity: options.diagnosis_plan.required_capabilities.hook_identity
+                || options.fix_plan.required_capabilities.hook_identity,
+            caller_attestation: options.diagnosis_plan.required_capabilities.caller_attestation
+                || options.fix_plan.required_capabilities.caller_attestation,
+            human_interaction: options.diagnosis_plan.required_capabilities.human_interaction
+                || options.fix_plan.required_capabilities.human_interaction,
+            direct_structured_submission: true,
+            network_policy_enforcement: options.diagnosis_plan.required_capabilities.network_policy_enforcement
+                || options.fix_plan.required_capabilities.network_policy_enforcement,
+        },
+        source_provenance: options.source_provenance,
+    };
+    return parseExecutableRunPlanPayload(payload);
+}