intentdna 1.9.4 → 1.9.5

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "intentdna",
       "description": "Declarative policy layer for AI agent behavior with plugin-managed hook runtime for Claude Code.",
-      "version": "1.9.4",
+      "version": "1.9.5",
       "author": {
         "name": "Samuel"
       },
@@ -25,5 +25,5 @@
       ]
     }
   ],
-  "version": "1.9.4"
+  "version": "1.9.5"
 }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "intentdna",
-  "version": "1.9.4",
+  "version": "1.9.5",
   "description": "Declarative policy layer for AI agent behavior",
   "author": {
     "name": "Samuel"

package/dist/cli/commands/run.js

@@ -1,5 +1,6 @@
 /** Intent DNA - canonical dna run CLI transport. */
 import { createHash } from "node:crypto";
+import { lstatSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { toKebabCase } from "../../runtime/agent-md.js";
 import { CanonicalRunApplication, } from "../../runtime/canonical-run-application.js";
@@ -301,9 +302,11 @@ function createProvider(binding) {
     if (maxBudget === undefined || permissionMode === undefined) {
         throw new Error("Claude run binding is missing launch budget or permission mode");
     }
+    const mcpConfigPath = findProjectMcpConfig(binding.workspace_root);
     return createClaudeExecutionProvider({
         executable,
         agentName: (packet) => `dna-${toKebabCase(packet.role)}`,
+        mcpConfigPath,
         extraArgs: [
             "--max-budget-usd",
             String(maxBudget),
@@ -312,6 +315,22 @@ function createProvider(binding) {
         ],
     });
 }
+/**
+ * Resolve only regular, project-owned MCP config files. A missing config is
+ * valid for projects that do not use IntentDNA's MCP transport.
+ */
+function findProjectMcpConfig(projectRoot) {
+    const candidate = join(projectRoot, ".mcp.json");
+    try {
+        if (lstatSync(candidate).isFile())
+            return candidate;
+    }
+    catch {
+        // A missing or unreadable optional config is handled by Claude's normal
+        // project discovery; do not make provider construction fail.
+    }
+    return undefined;
+}
 function createDriver(runtime, view, metadata, projectDirectory) {
     assertRunComposition(view, metadata, projectDirectory);
     runtime.execution_authority.assertExecutionSupported();
@@ -386,6 +405,8 @@ function startMetadata(opts, projectDirectory) {
         : { kind: "workflow", key: requireText(opts.workflowName, "--workflow") };
     const taskId = requireText(opts.taskId, "--task");
     const timeoutMs = opts.timeoutMs == null ? null : requireNonNegativeInteger(opts.timeoutMs, "--timeout-ms");
+    const provider = opts.provider ?? "claude";
+    const defaultPermissionMode = provider === "claude" ? "bypassPermissions" : "default";
     return {
         schema_version: "intentdna.canonical_run.v3",
         project_directory: projectDirectory,
@@ -402,10 +423,13 @@ function startMetadata(opts, projectDirectory) {
         },
         agents_directory: opts.agentsDir ? resolve(projectDirectory, opts.agentsDir) : join(projectDirectory, ".claude", "agents"),
         provider: {
-            kind: opts.provider ?? "claude",
+            kind: provider,
             executable: opts.providerExecutable === undefined ? null : requireText(opts.providerExecutable, "--provider-executable"),
             max_budget_usd: requirePositiveNumber(opts.maxBudget ?? 5, "--max-budget"),
-            permission_mode: requireText(opts.permissionMode ?? "default", "--permission-mode"),
+            // Durable workers have no interactive prompt available for tool approvals.
+            // Keep an explicitly supplied mode unchanged, but make the unattended
+            // default writable so required artifacts can be produced.
+            permission_mode: requireText(opts.permissionMode ?? defaultPermissionMode, "--permission-mode"),
         },
         max_concurrency: requirePositiveInteger(opts.maxConcurrency ?? 1, "--max-concurrency"),
         timeout_ms: timeoutMs,

package/dist/cli/index.js

@@ -311,7 +311,7 @@ Options:
   --timeout-ms <n>         Per-attempt timeout in milliseconds
   --cancellation-grace-ms <n> Process-tree cancellation grace period (default: 5000)
   --max-budget <usd>       Claude budget per Step attempt (default: 5)
-  --permission-mode <mode> Claude permission mode (default: default)
+  --permission-mode <mode> Claude permission mode (default: bypassPermissions for unattended runs)
   --agents <dir>           Project agent output directory (default: .claude/agents)
   --reason <text>          Cancellation or closure reason
   --json                   Print lifecycle output as JSON

package/dist/compiler/compile.js

@@ -94,6 +94,12 @@ function geneToToolFilters(name, gene) {
 /**
  * Extract pre-execution gates from threshold and sense codons.
  */
+function gateEnforcement(condition) {
+    return /^personal_data_exposure\s*==\s*false$/.test(condition)
+        || /^tool_name\s+in\s+\[[^\]]+\]$/.test(condition)
+        ? "runtime"
+        : "prompt_only";
+}
 function geneToGates(name, gene) {
     if (gene.expression_level === 0)
         return [];
@@ -105,6 +111,7 @@ function geneToGates(name, gene) {
                 action: "block",
                 message: `DNA threshold violation: ${codon.condition} (gene: ${name})`,
                 source_gene: name,
+                enforcement: gateEnforcement(codon.condition),
                 origin: codon.origin,
             });
         }
@@ -114,6 +121,7 @@ function geneToGates(name, gene) {
                 action: "escalate",
                 message: `DNA requires human approval for: ${codon.signal} (gene: ${name})`,
                 source_gene: name,
+                enforcement: "prompt_only",
             });
         }
         if (codon.type === "sense" && codon.response === "block") {
@@ -122,6 +130,7 @@ function geneToGates(name, gene) {
                 action: "block",
                 message: `DNA blocks action on signal: ${codon.signal} (gene: ${name})`,
                 source_gene: name,
+                enforcement: "prompt_only",
             });
         }
     }

package/dist/hooks/cli.js

@@ -625,6 +625,24 @@ export async function runHookEvent(options) {
             await writeRuntimeDecision(mismatch, { output: mismatch, trace: { matched_rule: "workflow_runtime_revision", step_id: wfState?.current_step } }, wfState);
             return finish(mismatch);
         }
+        if (isCanonicalWorkflowState(wfState)) {
+            const stopOutput = silentOutput();
+            const traceId = randomUUID();
+            appendTrace(projectDir, {
+                trace_id: traceId,
+                event: "Stop",
+                workflow: wfState.workflow,
+                step: wfState.current_step,
+                decision: "allow",
+                duration_ms: 0,
+                timestamp: new Date().toISOString(),
+            }, sessionId).catch(() => { });
+            await writeRuntimeDecision(stopOutput, {
+                output: stopOutput,
+                trace: { matched_rule: "workflow_boundary", step_id: wfState.current_step },
+            }, wfState, traceId);
+            return finish(stopOutput);
+        }
         let stopArtifactFacts = [];
         if (wfState?.active) {
             const artifactFacts = await finalizeAndResolveArtifactsForHook(projectDir, ir, wfState, event, sessionId);

package/dist/hooks/enforce.js

@@ -550,11 +550,18 @@ function enforceToolFilters(filters, input) {
 }
 function enforceGates(gates, input, strictBoundary = false) {
     for (const gate of gates) {
+        if (gate.enforcement === "prompt_only")
+            continue;
         const matches = evaluateGateCondition(gate.condition, input);
         if (matches === null) {
+            // Older compiled IR did not declare enforcement. Provenance-backed
+            // thresholds and bare semantic signals were compiler-generated prompt
+            // constraints, so preserve that behavior during the schema transition.
+            if (gate.origin !== undefined || /^\w+$/.test(gate.condition))
+                continue;
             if (!strictBoundary)
                 continue;
-            const detail = `Gate condition '${gate.condition}' could not be evaluated.`;
+            const detail = `Runtime gate condition '${gate.condition}' could not be evaluated.`;
             if (gate.action === "block") {
                 return blockOutput(`[Intent DNA] gate_evaluation: ${detail}`);
             }

package/dist/runtime/canonical-run-service.js

@@ -107,6 +107,7 @@ async function observeAttemptWorkspace(workspaceRoot, workspaceId) {
                 kind: "attempt_workspace",
                 relative_root: ".",
                 excluded_relative_paths: observation.excluded_relative_paths,
+                opaque_external_dependencies: observation.opaque_external_dependencies,
             },
             observed_digest: observation.observed_digest,
             entry_count: observation.entry_count,
@@ -691,7 +692,9 @@ class ContractVerifier {
                 }
                 const receipt = {
                     schema_version: CANONICAL_VERIFIER_EXECUTION_RECEIPT_SCHEMA_VERSION,
-                    evidence_mode: "historical_execution",
+                    evidence_mode: (observation.scope.opaque_external_dependencies?.length ?? 0) === 0
+                        ? "historical_execution"
+                        : "historical_execution_with_unbound_external_dependencies",
                     plan_id: request.plan.plan_id,
                     verifier_id: result.verifier_id,
                     verifier_definition_digest: digest(commandExecution.verifier),

package/dist/runtime/claude-sdk.js

@@ -51,7 +51,7 @@ export function compileForClaude(ir) {
     }
     // Add gate descriptions to prompt (so LLM is aware of constraints)
     if (ir.pre_execution_gates.length > 0) {
-        promptLines.push("## Hard Constraints (will be enforced by system)");
+        promptLines.push("## Policy Constraints");
         for (const gate of ir.pre_execution_gates) {
             promptLines.push(`- ${gate.message}`);
         }
@@ -59,7 +59,9 @@ export function compileForClaude(ir) {
     }
     return {
         system_prompt_addition: promptLines.join("\n"),
-        pre_tool_rules: ir.pre_execution_gates.map((g) => ({
+        pre_tool_rules: ir.pre_execution_gates
+            .filter((g) => g.enforcement !== "prompt_only")
+            .map((g) => ({
             condition: g.condition,
             action: g.action,
             message: g.message,

package/dist/runtime/codex-adapter.js

@@ -988,7 +988,7 @@ function textMatchesCondition(text, condition) {
 }
 function matchingPreExecutionGate(ir, input) {
     const subject = [input.tool_name, input.command, input.resource_ref, JSON.stringify(input.payload)].filter(Boolean).join(" ");
-    return ir.pre_execution_gates.find((gate) => textMatchesCondition(subject, gate.condition));
+    return ir.pre_execution_gates.find((gate) => gate.enforcement !== "prompt_only" && textMatchesCondition(subject, gate.condition));
 }
 function codexHookOutputForGate(gate) {
     if (gate.action === "block") {

package/dist/runtime/execution-provider.d.ts

@@ -32,6 +32,11 @@ export interface WorkerExecution {
 export declare class MalformedProviderResultError extends Error {
     constructor(message: string);
 }
+export type ProviderTerminalReason = "hook_stopped" | "stop_hook_prevented";
+export declare class ProviderTerminatedError extends Error {
+    readonly reason: ProviderTerminalReason;
+    constructor(reason: ProviderTerminalReason, message: string);
+}
 /**
  * Decode the provider's final assistant text into the declared output contract.
  * A single text output may use the assistant text directly. Other contracts use

package/dist/runtime/execution-provider.js

@@ -4,6 +4,14 @@ export class MalformedProviderResultError extends Error {
         this.name = "MalformedProviderResultError";
     }
 }
+export class ProviderTerminatedError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.name = "ProviderTerminatedError";
+        this.reason = reason;
+    }
+}
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }

package/dist/runtime/index.d.ts

@@ -25,8 +25,8 @@ export { CanonicalAttemptOutcomeValidationError, canonicalAttemptOutcomeStatus,
 export type { CanonicalAttemptOutcomeStatus, ValidatedCanonicalAttemptOutcome, } from "./canonical-attempt-outcome.js";
 export { HandoffResolutionError, HandoffResolver, } from "./handoff-resolver.js";
 export type { ReferenceHandoffRequest, QuoteHandoffRequest, StructuredHandoffRequest, NoHandoffRequest, HandoffRequest, StructuredValueValidator, HandoffResolverOptions, HandoffResolutionErrorCode, } from "./handoff-resolver.js";
-export { MalformedProviderResultError, decodeDeclaredOutputs, } from "./execution-provider.js";
-export type { ProviderLaunchSpec, ProviderParseContext, ParsedProviderResult, ExecutionProvider, WorkerExecution, } from "./execution-provider.js";
+export { MalformedProviderResultError, ProviderTerminatedError, decodeDeclaredOutputs, } from "./execution-provider.js";
+export type { ProviderLaunchSpec, ProviderParseContext, ParsedProviderResult, ExecutionProvider, ProviderTerminalReason, WorkerExecution, } from "./execution-provider.js";
 export { createClaudeExecutionProvider } from "./providers/claude.js";
 export type { ClaudeExecutionProviderOptions, } from "./providers/claude.js";
 export { createCodexExecutionProvider } from "./providers/codex.js";

package/dist/runtime/index.js

@@ -13,7 +13,7 @@ export { RUN_STORE_SCHEMA_VERSION, LEGACY_RUN_STORE_SCHEMA_VERSION, CANONICAL_RU
 export { ResultStoreError, ImmutableResultStore, ImmutableCanonicalResultStore, } from "./result-store.js";
 export { CanonicalAttemptOutcomeValidationError, canonicalAttemptOutcomeStatus, validateCanonicalAttemptOutcome, } from "./canonical-attempt-outcome.js";
 export { HandoffResolutionError, HandoffResolver, } from "./handoff-resolver.js";
-export { MalformedProviderResultError, decodeDeclaredOutputs, } from "./execution-provider.js";
+export { MalformedProviderResultError, ProviderTerminatedError, decodeDeclaredOutputs, } from "./execution-provider.js";
 export { createClaudeExecutionProvider } from "./providers/claude.js";
 export { createCodexExecutionProvider } from "./providers/codex.js";
 export { runProcessTree, runProcessTreeWithTimeout, } from "./process-tree.js";

package/dist/runtime/local-execution-authority.js

@@ -662,6 +662,20 @@ function nonlaunchSourceEvidenceDigest(record) {
     });
 }
 function alreadyStoppedSourceEvidenceDigest(record) {
+    if (record.stop_receipt !== null) {
+        return digest({
+            schema_version: "intentdna.local_already_stopped_source_evidence.v2",
+            identity_digest: record.identity_digest,
+            execution_instance_id: record.execution_instance_id,
+            authority_instance_id: record.authority_instance_id,
+            backend: record.backend,
+            supervisor: record.supervisor,
+            provider: record.provider,
+            raw_completion: record.raw_completion,
+            normalized_process_outcome: record.normalized_process_outcome,
+            stop_receipt_digest: record.stop_receipt.receipt_digest,
+        });
+    }
     return digest({
         schema_version: "intentdna.local_already_stopped_source_evidence.v1",
         identity_digest: record.identity_digest,
@@ -674,6 +688,17 @@ function alreadyStoppedSourceEvidenceDigest(record) {
         normalized_process_outcome: record.normalized_process_outcome,
     });
 }
+function alreadyStoppedObservedOutcome(record) {
+    if (record.stop_receipt !== null)
+        return record.stop_receipt.payload.terminal_outcome;
+    if (record.normalized_process_outcome !== null) {
+        return terminalOutcomeToCanonical(record.normalized_process_outcome);
+    }
+    if (record.raw_completion !== null) {
+        return terminalOutcomeToCanonical(rawCompletionToOutcome(record.raw_completion));
+    }
+    throw new LocalExecutionAuthorityError("corrupt_state", "already-stopped evidence has no trusted completion outcome");
+}
 function stopReceiptSourceEvidenceDigest(record) {
     return digest({
         identity_digest: record.identity_digest,
@@ -868,7 +893,7 @@ function parseRecord(value) {
             || record.already_stopped_evidence.payload.started_at !== record.identity.started_at
             || record.already_stopped_evidence.payload.completed_at !== record.raw_completion.completed_at
             || canonicalizeJson(record.already_stopped_evidence.payload.observed_outcome)
-                !== canonicalizeJson(terminalOutcomeToCanonical(rawCompletionToOutcome(record.raw_completion)))
+                !== canonicalizeJson(alreadyStoppedObservedOutcome(record))
             || record.already_stopped_evidence.payload.process_tree_drained !== true
             || !isCanonicalDigest(record.already_stopped_evidence.payload.stop_idempotency_key)
             || !isCanonicalTimestamp(record.already_stopped_evidence.payload.stop_requested_at)
@@ -2698,6 +2723,9 @@ export class LocalAttemptExecutionAuthority {
     async issueReceipt(path, requestedOutcome, stoppedAt, expectedReceipt) {
         return this.withLock(path, async () => {
             const current = this.readRecord(path);
+            if (current.already_stopped_evidence !== null) {
+                throw new LocalExecutionAuthorityError("identity_conflict", "already-stopped evidence already owns the durable terminal transition");
+            }
             if (current.stop_receipt !== null) {
                 if (canonicalizeJson(current.stop_receipt.payload.terminal_outcome) !== canonicalizeJson(requestedOutcome)
                     || current.stop_receipt.payload.stopped_at !== stoppedAt
@@ -2766,13 +2794,14 @@ export class LocalAttemptExecutionAuthority {
             if (request.expected_receipt !== null) {
                 throw new LocalExecutionAuthorityError("identity_conflict", "expected stop receipt cannot match a naturally completed execution");
             }
-            if (current.stop_receipt !== null || current.stop_fact?.kind === "canonical_stop") {
+            if (current.stop_fact?.kind === "canonical_stop") {
                 throw new LocalExecutionAuthorityError("identity_conflict", "canonical stop already owns the durable terminal transition");
             }
             if (current.raw_completion === null) {
                 throw new LocalExecutionAuthorityError("unsupported", "trusted natural completion evidence is unavailable");
             }
-            const fencingEpoch = await this.nextFencingEpoch();
+            const fencingEpoch = current.stop_receipt?.payload.fencing_epoch
+                ?? await this.nextFencingEpoch();
             const evidence = createWorkerAlreadyStoppedEvidence({
                 schema_version: "intentdna.worker_already_stopped_evidence.v1",
                 run_id: current.identity.run_id,
@@ -2787,7 +2816,7 @@ export class LocalAttemptExecutionAuthority {
                 fencing_epoch: fencingEpoch,
                 started_at: current.identity.started_at,
                 completed_at: current.raw_completion.completed_at,
-                observed_outcome: terminalOutcomeToCanonical(rawCompletionToOutcome(current.raw_completion)),
+                observed_outcome: alreadyStoppedObservedOutcome(current),
                 process_tree_drained: true,
                 stop_idempotency_key: request.stop_idempotency_key,
                 stop_requested_at: request.requested_at,
@@ -2795,6 +2824,8 @@ export class LocalAttemptExecutionAuthority {
                 stop_requested_outcome: request.requested_outcome,
                 source_evidence_digest: alreadyStoppedSourceEvidenceDigest(current),
             });
+            if (current.stop_receipt !== null)
+                return evidence;
             const updated = {
                 ...current,
                 phase: "receipted",
@@ -2859,6 +2890,10 @@ export class LocalAttemptExecutionAuthority {
             return { kind: "already_stopped", drain_evidence: evidence };
         }
         if (record.stop_receipt !== null) {
+            if (record.stop_fact?.kind !== "canonical_stop") {
+                const evidence = await this.issueAlreadyStoppedEvidence(path, request);
+                return { kind: "already_stopped", drain_evidence: evidence };
+            }
             const authority = await this.issueReceipt(path, request.requested_outcome, record.stop_receipt.payload.stopped_at, request.expected_receipt);
             return { kind: "stopped_by_request", authority };
         }

package/dist/runtime/providers/claude.d.ts

@@ -3,6 +3,11 @@ import type { StepPacket } from "../run-contracts.js";
 export interface ClaudeExecutionProviderOptions {
     readonly executable?: string;
     readonly agentName?: (packet: StepPacket) => string;
+    /**
+     * Explicit project MCP configuration to load for each standalone attempt.
+     * A function keeps the launch spec bound to the packet's exact workspace.
+     */
+    readonly mcpConfigPath?: string | ((packet: StepPacket) => string | null | undefined);
     readonly extraArgs?: readonly string[];
     readonly env?: NodeJS.ProcessEnv;
 }

package/dist/runtime/providers/claude.js

@@ -1,11 +1,57 @@
-import { decodeDeclaredOutputs, MalformedProviderResultError, } from "../execution-provider.js";
+import { decodeDeclaredOutputs, MalformedProviderResultError, ProviderTerminatedError, } from "../execution-provider.js";
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+const CLAUDE_HOOK_TERMINAL_REASONS = new Set([
+    "hook_stopped",
+    "stop_hook_prevented",
+]);
+const CLAUDE_DIAGNOSTIC_TOOL_NAMES = new Set([
+    "Bash",
+    "Edit",
+    "Glob",
+    "Grep",
+    "NotebookEdit",
+    "Read",
+    "Task",
+    "WebFetch",
+    "WebSearch",
+    "Write",
+]);
+function summarizePermissionDenials(value) {
+    if (!Array.isArray(value))
+        return null;
+    const toolNames = [...new Set(value.flatMap((denial) => (isRecord(denial)
+            && typeof denial.tool_name === "string"
+            && CLAUDE_DIAGNOSTIC_TOOL_NAMES.has(denial.tool_name)
+            ? [denial.tool_name]
+            : [])))].slice(0, 3);
+    const count = value.length > 999 ? "999+" : String(value.length);
+    return toolNames.length > 0
+        ? `permission_denials=${count}; denied_tools=${toolNames.join(",")}`
+        : `permission_denials=${count}`;
+}
+function standaloneClaudePrompt(packet) {
+    const workingDirectory = JSON.stringify(packet.workspace.working_directory);
+    return [
+        "IntentDNA runtime workspace contract:",
+        `- The exact, authoritative process working directory for this attempt is ${workingDirectory}.`,
+        "- Use paths relative to that working directory for repository-local file access whenever possible.",
+        "- Never infer, reconstruct, rename, or guess an absolute repository path from a session name, project name, transcript location, or encoded directory name.",
+        `- If an absolute repository path is required, copy ${workingDirectory} exactly instead of reconstructing it.`,
+        "- This is a standalone attempt. Do not search for or read Claude Code session transcripts, including files under ~/.claude/projects, to recover task context.",
+        "",
+        "Task:",
+        packet.standalone_prompt,
+    ].join("\n");
+}
 export function createClaudeExecutionProvider(options = {}) {
     return {
         name: "claude",
         createLaunch(packet) {
+            const mcpConfigPath = typeof options.mcpConfigPath === "function"
+                ? options.mcpConfigPath(packet)
+                : options.mcpConfigPath;
             return {
                 command: options.executable ?? "claude",
                 args: [
@@ -17,9 +63,12 @@ export function createClaudeExecutionProvider(options = {}) {
                     "--session-id",
                     packet.worker_session_id,
                     "--no-session-persistence",
+                    ...(mcpConfigPath === undefined || mcpConfigPath === null
+                        ? []
+                        : ["--mcp-config", mcpConfigPath]),
                     ...(options.extraArgs ?? []),
                 ],
-                stdin: packet.standalone_prompt,
+                stdin: standaloneClaudePrompt(packet),
                 cwd: packet.workspace.working_directory,
                 ...(options.env ? { env: options.env } : {}),
             };
@@ -35,6 +84,16 @@ export function createClaudeExecutionProvider(options = {}) {
             if (!isRecord(value)) {
                 throw new MalformedProviderResultError("Claude output must be a JSON object");
             }
+            const hookTerminalReason = typeof value.terminal_reason === "string"
+                && CLAUDE_HOOK_TERMINAL_REASONS.has(value.terminal_reason)
+                ? value.terminal_reason
+                : null;
+            if (hookTerminalReason !== null) {
+                const denials = summarizePermissionDenials(value.permission_denials);
+                throw new ProviderTerminatedError(hookTerminalReason, denials
+                    ? `Claude terminal_reason=${hookTerminalReason}; ${denials}`
+                    : `Claude terminal_reason=${hookTerminalReason}`);
+            }
             if (value.is_error === true) {
                 throw new MalformedProviderResultError(typeof value.result === "string"
                     ? value.result

package/dist/runtime/push-driver.d.ts

@@ -4,7 +4,7 @@ import type { ExecutionProvider } from "./execution-provider.js";
 import type { CanonicalAttemptOutcome, CanonicalEvidenceRef, CanonicalResultDigest, RunId, StepOutput, StepPacket, TerminalOutcome, WorkerSessionId } from "./run-contracts.js";
 import { type RunBindingPayload } from "./run-binding.js";
 import { executeWorkerAttempt, type WorkerExecutionAuthorityBinding, type WorkerExecutionWithEvents, type WorkerExecutorOptions } from "./worker-executor.js";
-export type PushDriverErrorCode = "invalid_configuration" | "invalid_service_response" | "invalid_execution_result" | "invalid_provider_output" | "unsupported_output_contract" | "unsupported" | "attempt_relaunch" | "attach_indeterminate" | "authority_preparation_abandon_failed" | "driver_failure_settlement_failed" | "wait_stopped";
+export type PushDriverErrorCode = "invalid_configuration" | "invalid_service_response" | "invalid_execution_result" | "invalid_provider_output" | "unsupported_output_contract" | "unsupported" | "attempt_relaunch" | "attach_indeterminate" | "submission_indeterminate" | "authority_preparation_abandon_failed" | "driver_failure_settlement_failed" | "wait_stopped";
 export declare class PushDriverError extends Error {
     readonly code: PushDriverErrorCode;
     constructor(code: PushDriverErrorCode, message: string, options?: ErrorOptions);
@@ -13,6 +13,10 @@ export declare class PushDriverIndeterminateAttachError extends PushDriverError
     readonly disposition: "retain_preparation";
     constructor(attemptId: string, cause: unknown);
 }
+export declare class PushDriverIndeterminateSubmissionError extends PushDriverError {
+    readonly disposition: "retain_attempt";
+    constructor(attemptId: string, cause: unknown);
+}
 export interface PushDriverService {
     inspect(runId: RunId): Promise<RunView>;
     resume(runId: RunId): Promise<RunView>;
@@ -175,6 +179,9 @@ export declare class PushDriver {
     private attemptError;
     private assertHeartbeatLease;
     private startHeartbeat;
+    private submissionIsCommitted;
+    private submissionIsDefinitivelyFenced;
+    private reconcileSubmission;
     private attachIsDefinitivelyFenced;
     private abandonPreparation;
     private reconcilePreparedAttach;