mustflow 2.21.1 → 2.22.0

package/dist/cli/commands/run/executor.js

@@ -1,7 +1,7 @@
 import { spawn } from 'node:child_process';
 import { BoundedOutputBuffer } from '../../../core/bounded-output.js';
 import { createPendingTimeoutTermination, forceTerminateProcessTree, getKillMethod, terminateProcessTree, } from './process-tree.js';
-import { createOutputLimitError, isOutputLimitExceededError, writeStreamChunk } from './output.js';
+import { createOutputLimitError, isOutputLimitExceededError, writeOutputLimitTerminationMarker, writeStreamChunk, writeStreamChunkPrefix, } from './output.js';
 const TERMINATION_CONFIRMATION_FALLBACK_MS = 1000;
 function runSpawnedCommandStreaming(command, cwd, env, timeoutSeconds, killAfterSeconds, maxOutputBytes, stdoutTailBytes, stderrTailBytes, reporter, streamOutput, enforceOutputLimit) {
     return new Promise((resolve) => {
@@ -17,6 +17,7 @@ function runSpawnedCommandStreaming(command, cwd, env, timeoutSeconds, killAfter
         let forceKillTimeout;
         let terminationFallbackTimeout;
         let terminationStarted = false;
+        let outputLimitMarkerWritten = false;
         let termination = null;
         const child = spawn(command.executable, command.args ?? [], {
             cwd,
@@ -92,25 +93,43 @@ function runSpawnedCommandStreaming(command, cwd, env, timeoutSeconds, killAfter
             }
             beginTermination();
         };
-        child.stdout?.on('data', (chunk) => {
-            stdout.append(chunk);
-            stdoutBytes += chunk.byteLength;
-            if (streamOutput) {
-                writeStreamChunk(reporter, 'stdout', chunk);
+        const writeOutputLimitMarkerOnce = () => {
+            if (!streamOutput || outputLimitMarkerWritten) {
+                return;
             }
-            if (enforceOutputLimit && stdoutBytes > maxOutputBytes) {
-                stopForOutputLimit('stdout');
+            outputLimitMarkerWritten = true;
+            writeOutputLimitTerminationMarker(reporter);
+        };
+        const handleOutputChunk = (stream, buffer, chunk) => {
+            const previousBytes = stream === 'stdout' ? stdoutBytes : stderrBytes;
+            const nextBytes = previousBytes + chunk.byteLength;
+            const exceedsLimit = enforceOutputLimit && nextBytes > maxOutputBytes;
+            const remainingStreamBytes = enforceOutputLimit ? Math.max(0, maxOutputBytes - previousBytes) : chunk.byteLength;
+            buffer.append(chunk);
+            if (stream === 'stdout') {
+                stdoutBytes = nextBytes;
+            }
+            else {
+                stderrBytes = nextBytes;
             }
-        });
-        child.stderr?.on('data', (chunk) => {
-            stderr.append(chunk);
-            stderrBytes += chunk.byteLength;
             if (streamOutput) {
-                writeStreamChunk(reporter, 'stderr', chunk);
+                if (exceedsLimit) {
+                    writeStreamChunkPrefix(reporter, stream, chunk, remainingStreamBytes);
+                    writeOutputLimitMarkerOnce();
+                }
+                else {
+                    writeStreamChunk(reporter, stream, chunk);
+                }
             }
-            if (enforceOutputLimit && stderrBytes > maxOutputBytes) {
-                stopForOutputLimit('stderr');
+            if (exceedsLimit) {
+                stopForOutputLimit(stream);
             }
+        };
+        child.stdout?.on('data', (chunk) => {
+            handleOutputChunk('stdout', stdout, chunk);
+        });
+        child.stderr?.on('data', (chunk) => {
+            handleOutputChunk('stderr', stderr, chunk);
         });
         child.once('error', (error) => {
             childError = error;

package/dist/cli/commands/run/output.js

@@ -1,5 +1,6 @@
 const OUTPUT_LIMIT_ERROR_CODE = 'ENOBUFS';
 const OUTPUT_LIMIT_ERROR_MESSAGE = /\bmaxBuffer\b.*\bexceeded\b/i;
+const OUTPUT_LIMIT_TERMINATION_MARKER = '[mustflow] output limit exceeded; terminating command before streaming more child output.';
 export function emitOutput(reporter, output, stream) {
     if (!output) {
         return;
@@ -45,6 +46,29 @@ export function writeStreamChunk(reporter, stream, chunk) {
     }
     reporter.stderr(chunk.toString());
 }
+function isUtf8ContinuationByte(value) {
+    return value !== undefined && (value & 0xc0) === 0x80;
+}
+function findUtf8PrefixEnd(buffer, maxBytes) {
+    let end = Math.min(buffer.byteLength, Math.max(0, Math.trunc(maxBytes)));
+    if (end >= buffer.byteLength) {
+        return buffer.byteLength;
+    }
+    while (end > 0 && isUtf8ContinuationByte(buffer[end])) {
+        end -= 1;
+    }
+    return end;
+}
+export function writeStreamChunkPrefix(reporter, stream, chunk, maxBytes) {
+    const prefixEnd = findUtf8PrefixEnd(chunk, maxBytes);
+    if (prefixEnd <= 0) {
+        return;
+    }
+    writeStreamChunk(reporter, stream, chunk.subarray(0, prefixEnd));
+}
+export function writeOutputLimitTerminationMarker(reporter) {
+    reporter.stderr(OUTPUT_LIMIT_TERMINATION_MARKER);
+}
 export function createOutputLimitError(stream, maxOutputBytes) {
     return Object.assign(new Error(`${stream} exceeded per-stream max_output_bytes (${maxOutputBytes})`), {
         code: OUTPUT_LIMIT_ERROR_CODE,

package/dist/cli/commands/run.js

@@ -171,7 +171,9 @@ export async function runRun(args, reporter, lang = 'en', options = {}) {
     }
     const runReceiptPolicy = profiler.measure('retention_policy', () => resolveRunReceiptRetentionPolicy(readMustflowConfigIfExists(projectRoot)));
     const env = profiler.measure('environment', () => createCommandEnv(projectRoot, { policy: plan.envPolicy, allowlist: plan.envAllowlist }));
-    const writeTracker = profiler.measure('write_drift_before', () => startRunWriteTracking(projectRoot, contract, intentName));
+    const writeTracker = profiler.measure('write_drift_before', () => startRunWriteTracking(projectRoot, contract, intentName, {
+        additionalDeclaredPaths: options.additionalDeclaredWritePaths,
+    }));
     const stdoutTailBytes = Math.min(runReceiptPolicy.stdoutTailBytes, plan.maxOutputBytes);
     const stderrTailBytes = Math.min(runReceiptPolicy.stderrTailBytes, plan.maxOutputBytes);
     let streamedOutput = false;

package/dist/cli/commands/verify/args.js

@@ -1,4 +1,6 @@
+import { availableParallelism } from 'node:os';
 export const DEFAULT_VERIFY_PARALLELISM = 1;
+export const MAX_VERIFY_PARALLELISM = 8;
 export function parseVerifyArgs(args) {
     let reason;
     let fromClassification;
@@ -10,6 +12,7 @@ export function parseVerifyArgs(args) {
     let planOnly = false;
     let changed = false;
     let parallelism = DEFAULT_VERIFY_PARALLELISM;
+    let parallelismSpecified = false;
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
         if (arg === '--json') {
@@ -34,6 +37,7 @@ export function parseVerifyArgs(args) {
                 return { json, planOnly, changed, reason, parallelism, error: 'invalid_parallel_value' };
             }
             parallelism = parsedParallelism;
+            parallelismSpecified = true;
             index += 1;
             continue;
         }
@@ -144,6 +148,7 @@ export function parseVerifyArgs(args) {
                 return { json, planOnly, changed, reason, parallelism, error: 'invalid_parallel_value' };
             }
             parallelism = parsedParallelism;
+            parallelismSpecified = true;
             continue;
         }
         if (arg.startsWith('--from-plan=')) {
@@ -251,6 +256,7 @@ export function parseVerifyArgs(args) {
         reproEvidence,
         externalEvidence,
         parallelism,
+        parallelismSpecified,
     };
 }
 function parseVerifyParallelism(value) {
@@ -260,3 +266,31 @@ function parseVerifyParallelism(value) {
     const parsed = Number(value);
     return Number.isSafeInteger(parsed) ? parsed : null;
 }
+function readAvailableParallelism() {
+    try {
+        const value = availableParallelism();
+        return Number.isSafeInteger(value) && value > 0 ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function resolveVerifyParallelism(requested, cpuAvailable = readAvailableParallelism()) {
+    const cpuLimit = cpuAvailable === null ? MAX_VERIFY_PARALLELISM : Math.max(DEFAULT_VERIFY_PARALLELISM, cpuAvailable);
+    const effectiveLimit = Math.max(DEFAULT_VERIFY_PARALLELISM, Math.min(MAX_VERIFY_PARALLELISM, cpuLimit));
+    const effective = Math.max(DEFAULT_VERIFY_PARALLELISM, Math.min(requested, effectiveLimit));
+    const capped = effective !== requested;
+    const mode = effective > DEFAULT_VERIFY_PARALLELISM ? 'parallel_chunks' : 'serial';
+    const note = mode === 'parallel_chunks'
+        ? 'Parallel verification is a bounded optimization for eligible non-conflicting entries; it is not stronger evidence than serial verification.'
+        : 'Verification runs serially unless an eligible non-conflicting batch receives an effective parallelism greater than 1.';
+    return {
+        requested,
+        effective,
+        repositoryMax: MAX_VERIFY_PARALLELISM,
+        cpuAvailable,
+        capped,
+        mode,
+        note,
+    };
+}

package/dist/cli/commands/verify.js

@@ -1,10 +1,9 @@
 import { createHash } from 'node:crypto';
-import { readFileSync } from 'node:fs';
 import path from 'node:path';
 import { createClassifyOutput } from './classify.js';
 import { runRun } from './run.js';
 import { createChangeVerificationReport, } from '../../core/change-verification.js';
-import { writeJsonFileInsideWithoutSymlinks } from '../../core/safe-filesystem.js';
+import { readUtf8FileInsideWithoutSymlinks, writeJsonFileInsideWithoutSymlinks } from '../../core/safe-filesystem.js';
 import { createVerifyCompletionVerdict, } from '../../core/completion-verdict.js';
 import { createStateRunId } from '../../core/atomic-state-write.js';
 import { createExternalEvidenceRisks, } from '../../core/external-evidence.js';
@@ -13,8 +12,9 @@ import { countReproEvidenceVerdictEffects, createReproEvidenceRisks, } from '../
 import { createVerifyEvidenceModel } from '../../core/verification-evidence.js';
 import { createScopeDiffRisks } from '../../core/scope-risk.js';
 import { countValidationRatchetVerdictEffects, createValidationRatchetRisks, } from '../../core/validation-ratchet.js';
+import { finishRunWriteBatchTracking, startRunWriteBatchTracking, } from '../../core/run-write-drift.js';
 import { readCommandContract } from '../../core/config-loading.js';
-import { DEFAULT_VERIFY_PARALLELISM, parseVerifyArgs } from './verify/args.js';
+import { DEFAULT_VERIFY_PARALLELISM, parseVerifyArgs, resolveVerifyParallelism, } from './verify/args.js';
 import { printUsageError, renderHelp } from '../lib/cli-output.js';
 import { t } from '../lib/i18n.js';
 import { readLocalCommandEffectGraphs, readLocalPathSurfaces, readLocalSourceAnchorVerdictRisks, } from '../lib/local-index.js';
@@ -240,15 +240,27 @@ function resolvePlanPath(projectRoot, inputPath) {
     }
     return resolved;
 }
-export function readInputFromClassificationReport(projectRoot, inputPath) {
-    let parsed;
-    const planPath = resolvePlanPath(projectRoot, inputPath);
+function readJsonInputFile(projectRoot, inputPath, invalidCode) {
+    const inputFilePath = resolvePlanPath(projectRoot, inputPath);
+    let content;
     try {
-        parsed = JSON.parse(readFileSync(planPath, 'utf8'));
+        content = readUtf8FileInsideWithoutSymlinks(projectRoot, inputFilePath);
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith('Path must not contain symlinks:')) {
+            throw new Error('input_path_contains_symlink');
+        }
+        throw new Error(invalidCode);
+    }
+    try {
+        return JSON.parse(content);
     }
     catch {
-        throw new Error('invalid_plan_file');
+        throw new Error(invalidCode);
     }
+}
+export function readInputFromClassificationReport(projectRoot, inputPath) {
+    const parsed = readJsonInputFile(projectRoot, inputPath, 'invalid_plan_file');
     const classificationReport = readStrictClassifyPlan(projectRoot, parsed);
     return {
         reasons: classificationReport.summary.validationReasons,
@@ -469,14 +481,7 @@ function readRegressionGuardEvidence(value) {
     };
 }
 function readReproEvidenceFile(projectRoot, inputPath) {
-    let parsed;
-    const evidencePath = resolvePlanPath(projectRoot, inputPath);
-    try {
-        parsed = JSON.parse(readFileSync(evidencePath, 'utf8'));
-    }
-    catch {
-        throw new Error('invalid_repro_evidence_file');
-    }
+    const parsed = readJsonInputFile(projectRoot, inputPath, 'invalid_repro_evidence_file');
     if (!isPlainRecord(parsed) || parsed.schema_version !== '1' || parsed.command !== 'repro-evidence') {
         throw new Error('unsupported_repro_evidence_source');
     }
@@ -500,14 +505,7 @@ function readReproEvidenceFile(projectRoot, inputPath) {
     };
 }
 function readExternalEvidenceFile(projectRoot, inputPath) {
-    let parsed;
-    const evidencePath = resolvePlanPath(projectRoot, inputPath);
-    try {
-        parsed = JSON.parse(readFileSync(evidencePath, 'utf8'));
-    }
-    catch {
-        throw new Error('invalid_external_evidence_file');
-    }
+    const parsed = readJsonInputFile(projectRoot, inputPath, 'invalid_external_evidence_file');
     if (!isPlainRecord(parsed) || parsed.schema_version !== '1' || parsed.command !== 'external-evidence') {
         throw new Error('unsupported_external_evidence_source');
     }
@@ -552,6 +550,8 @@ export function planErrorMessageKey(code) {
     switch (code) {
         case 'plan_path_outside_root':
             return 'verify.error.plan_path_outside_root';
+        case 'input_path_contains_symlink':
+            return 'verify.error.input_path_contains_symlink';
         case 'missing_plan_reasons':
             return 'verify.error.missing_plan_reasons';
         case 'unsupported_plan_source':
@@ -628,11 +628,12 @@ function testTargetsByScheduledIntent(report) {
         candidate.appliedTestTargets.length > 0)
         .map((candidate) => [candidate.intent, candidate.appliedTestTargets]));
 }
-async function runVerificationIntent(intent, lang, verificationPlanId, testTargets = []) {
+async function runVerificationIntent(intent, lang, verificationPlanId, testTargets = [], additionalDeclaredWritePaths = []) {
     const output = createBufferedOutput();
     const exitCode = await runRun([intent, '--json'], output.reporter, lang, {
         writeLatestReceipt: false,
         testTargets,
+        additionalDeclaredWritePaths,
     });
     const rawStdout = output.stdout().trim();
     let receipt = null;
@@ -676,14 +677,52 @@ async function runVerificationEntriesSequentially(entries, lang, verificationPla
     }
     return results;
 }
-async function runVerificationEntriesInParallelChunks(entries, parallelism, lang, verificationPlanId, scheduledTestTargets) {
+async function runVerificationEntriesInParallelChunks(projectRoot, entries, parallelism, lang, verificationPlanId, scheduledTestTargets) {
     const results = [];
     for (let index = 0; index < entries.length; index += parallelism) {
         const chunk = entries.slice(index, index + parallelism);
-        results.push(...(await Promise.all(chunk.map((entry) => runVerificationIntent(entry.intent, lang, verificationPlanId, scheduledTestTargets.get(entry.intent) ?? [])))));
+        const batchTracker = startRunWriteBatchTracking(projectRoot);
+        const chunkResults = await Promise.all(chunk.map((entry) => runVerificationIntent(entry.intent, lang, verificationPlanId, scheduledTestTargets.get(entry.intent) ?? [])));
+        const writeDriftByIntent = finishRunWriteBatchTracking(batchTracker, chunk.map((entry) => ({
+            intentName: entry.intent,
+            declaredPaths: declaredWritePathsForScheduleEntry(entry),
+            observedPaths: observedWriteDriftPaths(chunkResults.find((result) => result.intent === entry.intent)),
+        })));
+        results.push(...chunkResults.map((result) => applyParallelChunkWriteDrift(result, writeDriftByIntent)));
     }
     return results;
 }
+function declaredWritePathsForScheduleEntry(entry) {
+    return [
+        ...new Set(entry.effects
+            .filter((effect) => effect.access === 'write' && typeof effect.path === 'string')
+            .map((effect) => effect.path)),
+    ].sort((left, right) => left.localeCompare(right));
+}
+function observedWriteDriftPaths(result) {
+    const writeDrift = objectField(result?.receipt?.write_drift);
+    const observedPaths = writeDrift?.observed_paths;
+    if (!Array.isArray(observedPaths)) {
+        return [];
+    }
+    return observedPaths.filter((value) => typeof value === 'string');
+}
+function applyParallelChunkWriteDrift(result, writeDriftByIntent) {
+    if (!result.intent || !result.receipt) {
+        return result;
+    }
+    const writeDrift = writeDriftByIntent.get(result.intent);
+    if (!writeDrift) {
+        return result;
+    }
+    return {
+        ...result,
+        receipt: {
+            ...result.receipt,
+            write_drift: writeDrift,
+        },
+    };
+}
 function verificationResultFailed(result) {
     return (!result.skipped &&
         (result.status === 'failed' ||
@@ -691,7 +730,7 @@ function verificationResultFailed(result) {
             result.status === 'start_failed' ||
             result.status === 'output_limit_exceeded'));
 }
-async function runScheduledVerificationIntents(report, lang, verificationPlanId, scheduledTestTargets, parallelism) {
+async function runScheduledVerificationIntents(report, projectRoot, lang, verificationPlanId, scheduledTestTargets, parallelism) {
     const results = [];
     for (let batchIndex = 0; batchIndex < report.schedule.batches.length; batchIndex += 1) {
         const batch = report.schedule.batches[batchIndex];
@@ -703,7 +742,7 @@ async function runScheduledVerificationIntents(report, lang, verificationPlanId,
         if (entries.length > 1 && entries.every((entry) => entry.parallelEligible)) {
             batchResults =
                 parallelism > DEFAULT_VERIFY_PARALLELISM
-                    ? await runVerificationEntriesInParallelChunks(entries, parallelism, lang, verificationPlanId, scheduledTestTargets)
+                    ? await runVerificationEntriesInParallelChunks(projectRoot, entries, parallelism, lang, verificationPlanId, scheduledTestTargets)
                     : await runVerificationEntriesSequentially(entries, lang, verificationPlanId, scheduledTestTargets);
         }
         else {
@@ -995,7 +1034,7 @@ function readVerificationFailureFingerprint(value) {
 }
 function readPreviousVerifyLatestSummary(projectRoot) {
     try {
-        const parsed = JSON.parse(readFileSync(path.join(projectRoot, LATEST_RUN_RECEIPT_PATH), 'utf8'));
+        const parsed = JSON.parse(readUtf8FileInsideWithoutSymlinks(projectRoot, path.join(projectRoot, LATEST_RUN_RECEIPT_PATH)));
         if (parsed.command !== 'verify' ||
             parsed.kind !== 'verify_run_summary' ||
             typeof parsed.verification_plan_id !== 'string' ||
@@ -1055,6 +1094,17 @@ function createVerificationPlanId(report, contract) {
     };
     return hashTextSha256(stableJson(fingerprintSource));
 }
+function toParallelismReport(settings) {
+    return {
+        requested: settings.requested,
+        effective: settings.effective,
+        repository_max: settings.repositoryMax,
+        cpu_available: settings.cpuAvailable,
+        capped: settings.capped,
+        mode: settings.mode,
+        note: settings.note,
+    };
+}
 function writeVerifyRunReceipts(projectRoot, output, report, sourceAnchorRisks, scopeDiffRisks, validationRatchetRisks, reproEvidence, externalChecks) {
     const statePaths = createVerifyRunStatePaths(projectRoot);
     const receipts = [];
@@ -1204,7 +1254,7 @@ function writeVerifyRunReceipts(projectRoot, output, report, sourceAnchorRisks,
     writeJsonFileInsideWithoutSymlinks(projectRoot, path.join(projectRoot, LATEST_RUN_RECEIPT_PATH), latest);
     return outputWithReceiptPaths;
 }
-async function createVerifyOutput(input, planSource, projectRoot, lang, reproEvidence = null, externalChecks = [], parallelism = DEFAULT_VERIFY_PARALLELISM) {
+async function createVerifyOutput(input, planSource, projectRoot, lang, reproEvidence = null, externalChecks = [], parallelism = DEFAULT_VERIFY_PARALLELISM, parallelismReport = null) {
     const contract = readCommandContract(projectRoot);
     const report = createChangeVerificationReport(input.classificationReport, contract, projectRoot);
     const verificationPlanId = createVerificationPlanId(report, contract);
@@ -1217,7 +1267,7 @@ async function createVerifyOutput(input, planSource, projectRoot, lang, reproEvi
     const reproEvidenceRisks = createReproEvidenceRisks(reproEvidence, { verificationPlanId });
     const reproEvidenceVerdictEffects = countReproEvidenceVerdictEffects(reproEvidenceRisks);
     const externalEvidenceRisks = createExternalEvidenceRisks(externalChecks);
-    const results = await runScheduledVerificationIntents(report, lang, verificationPlanId, scheduledTestTargets, parallelism);
+    const results = await runScheduledVerificationIntents(report, projectRoot, lang, verificationPlanId, scheduledTestTargets, parallelism);
     results.push(...createSkippedResults(report.candidates, scheduledIntents, report.gaps));
     const summary = summarizeResults(results);
     const status = getVerificationStatus(summary);
@@ -1285,6 +1335,7 @@ async function createVerifyOutput(input, planSource, projectRoot, lang, reproEvi
         failure_fingerprint: failureFingerprint,
         repeated_failure_summary: null,
         summary,
+        ...(parallelismReport ? { parallelism: parallelismReport } : {}),
         ...(reproEvidence ? { repro_evidence: reproEvidence } : {}),
         ...(externalChecks.length > 0 ? { external_checks: externalChecks } : {}),
         run_dir: '',
@@ -1340,9 +1391,15 @@ function renderVerifyOutput(output, lang) {
         `passed: ${output.summary.passed}`,
         `failed: ${output.summary.failed}`,
         `skipped: ${output.summary.skipped}`,
-        '',
-        t(lang, 'verify.label.results'),
     ];
+    if (output.parallelism) {
+        const cpuAvailable = output.parallelism.cpu_available ?? t(lang, 'value.none');
+        lines.push(`parallelism: requested ${output.parallelism.requested}, effective ${output.parallelism.effective}, repository max ${output.parallelism.repository_max}, cpu available ${cpuAvailable}, mode ${output.parallelism.mode}`);
+        if (output.parallelism.capped) {
+            lines.push(`parallelism note: ${output.parallelism.note}`);
+        }
+    }
+    lines.push('', t(lang, 'verify.label.results'));
     for (const result of output.results) {
         const intent = result.intent ?? t(lang, 'value.none');
         const reason = result.reason ? ` (${result.reason})` : '';
@@ -1460,7 +1517,9 @@ export async function runVerify(args, reporter, lang = 'en') {
         reporter.stdout(JSON.stringify(await createPlanOnlyOutput(input, projectRoot), null, 2));
         return 0;
     }
-    const output = await createVerifyOutput(input, parsed.fromClassification ?? parsed.fromPlan ?? (parsed.changed ? 'changed' : null), projectRoot, lang, reproEvidence, externalChecks, parsed.parallelism ?? DEFAULT_VERIFY_PARALLELISM);
+    const parallelismSettings = resolveVerifyParallelism(parsed.parallelism ?? DEFAULT_VERIFY_PARALLELISM);
+    const parallelismReport = parsed.parallelismSpecified ? toParallelismReport(parallelismSettings) : null;
+    const output = await createVerifyOutput(input, parsed.fromClassification ?? parsed.fromPlan ?? (parsed.changed ? 'changed' : null), projectRoot, lang, reproEvidence, externalChecks, parallelismSettings.effective, parallelismReport);
     if (parsed.json) {
         reporter.stdout(JSON.stringify(output, null, 2));
     }

package/dist/cli/i18n/en.js

@@ -757,7 +757,7 @@ Read these files before working:
     "verify.help.option.writePlan": "Compatibility option that writes the changed-file classification report",
     "verify.help.option.reproEvidence": "Read structured bug-fix reproduction evidence from a repository-local JSON summary",
     "verify.help.option.externalEvidence": "Read lower-authority external CI evidence from a repository-local JSON summary",
-    "verify.help.option.parallel": "Run safe non-conflicting schedule batches with up to this many commands; default is 1",
+    "verify.help.option.parallel": "Run safe non-conflicting schedule batches with up to this many commands, capped by local limits; default is 1",
     "verify.help.option.planOnly": "Print the verification plan without running commands; requires --json",
     "verify.help.exit.ok": "All selected verification intents passed",
     "verify.help.exit.fail": "Verification failed, was partial, was blocked, or input was invalid",
@@ -778,6 +778,7 @@ Read these files before working:
     "verify.error.plan_root_mismatch": "Classification report must come from this mustflow root",
     "verify.error.missing_plan_reasons": "Classification report must include summary.validationReasons",
     "verify.error.plan_path_outside_root": "Classification report path must stay inside the mustflow root",
+    "verify.error.input_path_contains_symlink": "Input file path must not contain symlinks",
     "verify.error.changed_files_unavailable": "Unable to inspect changed files with git status",
     "verify.error.invalid_repro_evidence_file": "Repro evidence must be a readable JSON summary with structured evidence fields",
     "verify.error.unsupported_repro_evidence_source": "Repro evidence input must use command repro-evidence",

package/dist/cli/i18n/es.js

@@ -757,7 +757,7 @@ Lee estos archivos antes de trabajar:
     "verify.help.option.writePlan": "Opción de compatibilidad que escribe el informe de clasificación de cambios",
     "verify.help.option.reproEvidence": "Lee evidencia estructurada de reproducción de errores desde un resumen JSON local del repositorio",
     "verify.help.option.externalEvidence": "Lee evidencia de CI externa de menor autoridad desde un resumen JSON local del repositorio",
-    "verify.help.option.parallel": "Ejecuta lotes programados seguros y sin conflictos con hasta esta cantidad de comandos; el valor predeterminado es 1",
+    "verify.help.option.parallel": "Ejecuta lotes programados seguros y sin conflictos con hasta esta cantidad de comandos, limitada por topes locales; el valor predeterminado es 1",
     "verify.help.option.planOnly": "Imprime el plan de verificación sin ejecutar comandos; requiere --json",
     "verify.help.exit.ok": "Todas las intenciones de verificación seleccionadas pasaron",
     "verify.help.exit.fail": "La verificación falló, fue parcial, quedó bloqueada o la entrada no fue válida",
@@ -778,6 +778,7 @@ Lee estos archivos antes de trabajar:
     "verify.error.plan_root_mismatch": "El informe de clasificación debe provenir de esta raíz mustflow",
     "verify.error.missing_plan_reasons": "El informe de clasificación debe incluir summary.validationReasons",
     "verify.error.plan_path_outside_root": "La ruta del informe de clasificación debe permanecer dentro de la raíz mustflow",
+    "verify.error.input_path_contains_symlink": "La ruta del archivo de entrada no debe contener enlaces simbólicos",
     "verify.error.changed_files_unavailable": "No se pudieron inspeccionar los archivos cambiados con git status",
     "verify.error.invalid_repro_evidence_file": "La evidencia de reproducción debe ser un resumen JSON legible con campos de evidencia estructurados",
     "verify.error.unsupported_repro_evidence_source": "La entrada de evidencia de reproducción debe usar command repro-evidence",

package/dist/cli/i18n/fr.js

@@ -757,7 +757,7 @@ Lisez ces fichiers avant de travailler :
     "verify.help.option.writePlan": "Option de compatibilité qui écrit le rapport de classification des changements",
     "verify.help.option.reproEvidence": "Lit une preuve structurée de reproduction de bogue depuis un résumé JSON local au dépôt",
     "verify.help.option.externalEvidence": "Lit une preuve CI externe de moindre autorité depuis un résumé JSON local au dépôt",
-    "verify.help.option.parallel": "Exécute les lots planifiés sûrs et sans conflit avec au plus ce nombre de commandes ; valeur par défaut : 1",
+    "verify.help.option.parallel": "Exécute les lots planifiés sûrs et sans conflit avec au plus ce nombre de commandes, plafonné par les limites locales ; valeur par défaut : 1",
     "verify.help.option.planOnly": "Affiche le plan de vérification sans exécuter de commandes; nécessite --json",
     "verify.help.exit.ok": "Toutes les intentions de vérification sélectionnées ont réussi",
     "verify.help.exit.fail": "La vérification a échoué, est partielle, est bloquée ou l'entrée est invalide",
@@ -778,6 +778,7 @@ Lisez ces fichiers avant de travailler :
     "verify.error.plan_root_mismatch": "Le rapport de classification doit venir de cette racine mustflow",
     "verify.error.missing_plan_reasons": "Le rapport de classification doit inclure summary.validationReasons",
     "verify.error.plan_path_outside_root": "Le chemin du rapport de classification doit rester dans la racine mustflow",
+    "verify.error.input_path_contains_symlink": "Le chemin du fichier d'entrée ne doit pas contenir de liens symboliques",
     "verify.error.changed_files_unavailable": "Impossible d'inspecter les fichiers modifies avec git status",
     "verify.error.invalid_repro_evidence_file": "La preuve de reproduction doit être un résumé JSON lisible avec des champs de preuve structurés",
     "verify.error.unsupported_repro_evidence_source": "L'entrée de preuve de reproduction doit utiliser command repro-evidence",

package/dist/cli/i18n/hi.js

@@ -757,7 +757,7 @@ export const hiMessages = {
     "verify.help.option.writePlan": "Changed-file classification report लिखने वाला compatibility option",
     "verify.help.option.reproEvidence": "Repository-local JSON summary से structured bug reproduction evidence पढ़ें",
     "verify.help.option.externalEvidence": "Repository-local JSON summary से lower-authority external CI evidence पढ़ें",
-    "verify.help.option.parallel": "Safe और non-conflicting schedule batches को इतने commands तक साथ चलाएं; default 1 है",
+    "verify.help.option.parallel": "Safe और non-conflicting schedule batches को इतने commands तक साथ चलाएं, local limits से capped; default 1 है",
     "verify.help.option.planOnly": "Commands चलाए बिना verification plan print करें; --json चाहिए",
     "verify.help.exit.ok": "सभी selected verification intents pass हुए",
     "verify.help.exit.fail": "Verification fail हुआ, partial रहा, blocked रहा, या input invalid था",
@@ -778,6 +778,7 @@ export const hiMessages = {
     "verify.error.plan_root_mismatch": "Classification report इसी mustflow root से आना चाहिए",
     "verify.error.missing_plan_reasons": "Classification report में summary.validationReasons होना चाहिए",
     "verify.error.plan_path_outside_root": "Classification report path mustflow root के अंदर रहना चाहिए",
+    "verify.error.input_path_contains_symlink": "Input file path में symbolic link नहीं होना चाहिए",
     "verify.error.changed_files_unavailable": "git status से बदली फ़ाइलें नहीं पढ़ी जा सकीं",
     "verify.error.invalid_repro_evidence_file": "Repro evidence structured evidence fields वाला readable JSON summary होना चाहिए",
     "verify.error.unsupported_repro_evidence_source": "Repro evidence input को command repro-evidence इस्तेमाल करना चाहिए",

package/dist/cli/i18n/ko.js

@@ -757,7 +757,7 @@ export const koMessages = {
     "verify.help.option.writePlan": "변경 파일 분류 보고서를 쓰는 호환 옵션입니다",
     "verify.help.option.reproEvidence": "저장소 안의 JSON 요약에서 구조화된 버그 재현 증거를 읽습니다",
     "verify.help.option.externalEvidence": "저장소 안의 JSON 요약에서 낮은 권한의 외부 CI 증거를 읽습니다",
-    "verify.help.option.parallel": "안전하고 서로 충돌하지 않는 예정 실행 묶음을 이 개수까지 함께 실행합니다. 기본값은 1입니다",
+    "verify.help.option.parallel": "안전하고 서로 충돌하지 않는 예정 실행 묶음을 이 개수까지 함께 실행하되, 로컬 상한을 적용합니다. 기본값은 1입니다",
     "verify.help.option.planOnly": "명령을 실행하지 않고 검증 계획만 출력합니다. --json이 필요합니다",
     "verify.help.exit.ok": "선택된 모든 검증 의도가 통과했습니다",
     "verify.help.exit.fail": "검증이 실패했거나, 일부만 실행됐거나, 막혔거나, 입력이 올바르지 않습니다",
@@ -778,6 +778,7 @@ export const koMessages = {
     "verify.error.plan_root_mismatch": "분류 보고서는 현재 mustflow 루트에서 나온 것이어야 합니다",
     "verify.error.missing_plan_reasons": "분류 보고서에는 summary.validationReasons가 있어야 합니다",
     "verify.error.plan_path_outside_root": "분류 보고서 경로는 mustflow 루트 안에 있어야 합니다",
+    "verify.error.input_path_contains_symlink": "입력 파일 경로에는 심볼릭 링크가 포함되면 안 됩니다",
     "verify.error.changed_files_unavailable": "git status로 변경 파일을 확인할 수 없습니다",
     "verify.error.invalid_repro_evidence_file": "재현 증거는 구조화된 증거 필드를 포함한 읽을 수 있는 JSON 요약이어야 합니다",
     "verify.error.unsupported_repro_evidence_source": "재현 증거 입력은 command repro-evidence를 사용해야 합니다",

package/dist/cli/i18n/zh.js

@@ -757,7 +757,7 @@ export const zhMessages = {
     "verify.help.option.writePlan": "写入变更文件分类报告的兼容选项",
     "verify.help.option.reproEvidence": "从仓库本地 JSON 摘要读取结构化的 bug 复现证据",
     "verify.help.option.externalEvidence": "从仓库本地 JSON 摘要读取低权限外部 CI 证据",
-    "verify.help.option.parallel": "最多并行执行这个数量的安全、无冲突计划批次命令；默认值为 1",
+    "verify.help.option.parallel": "最多并行执行这个数量的安全、无冲突计划批次命令，并受本地上限限制；默认值为 1",
     "verify.help.option.planOnly": "仅输出验证计划，不执行命令；需要 --json",
     "verify.help.exit.ok": "选中的所有验证意图均已通过",
     "verify.help.exit.fail": "验证失败、部分完成、被阻止，或输入无效",
@@ -778,6 +778,7 @@ export const zhMessages = {
     "verify.error.plan_root_mismatch": "分类报告必须来自当前 mustflow 根目录",
     "verify.error.missing_plan_reasons": "分类报告必须包含 summary.validationReasons",
     "verify.error.plan_path_outside_root": "分类报告路径必须位于 mustflow 根目录内",
+    "verify.error.input_path_contains_symlink": "输入文件路径不得包含符号链接",
     "verify.error.changed_files_unavailable": "无法通过 git status 检查变更文件",
     "verify.error.invalid_repro_evidence_file": "复现证据必须是包含结构化证据字段的可读取 JSON 摘要",
     "verify.error.unsupported_repro_evidence_source": "复现证据输入必须使用 command repro-evidence",

package/dist/cli/lib/filesystem.js

@@ -1,113 +1,43 @@
-import { closeSync, constants, copyFileSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, statSync, writeFileSync, } from 'node:fs';
+import { existsSync, lstatSync, readdirSync, statSync } from 'node:fs';
 import path from 'node:path';
-const NOFOLLOW_FLAG = typeof constants.O_NOFOLLOW === 'number' ? constants.O_NOFOLLOW : 0;
+export { ensureFileTargetInsideWithoutSymlinks, ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks, readUtf8FileInsideWithoutSymlinks, writeFileInsideWithoutSymlinks, writeUtf8FileInsideWithoutSymlinks, } from '../../core/safe-filesystem.js';
+import { readFileInsideWithoutSymlinks, writeFileInsideWithoutSymlinks, } from '../../core/safe-filesystem.js';
 export function toPosixPath(value) {
     return value.split(path.sep).join('/');
 }
-export function ensureInside(parentPath, childPath) {
-    const parent = path.resolve(parentPath);
-    const child = path.resolve(childPath);
-    const relative = path.relative(parent, child);
-    if (relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative))) {
-        return;
-    }
-    throw new Error(`Path escapes allowed directory: ${childPath}`);
-}
-function isMissingPathError(error) {
-    return error instanceof Error && 'code' in error && error.code === 'ENOENT';
-}
-export function ensureInsideWithoutSymlinks(parentPath, childPath, options = {}) {
-    ensureInside(parentPath, childPath);
-    const parent = path.resolve(parentPath);
-    const child = path.resolve(childPath);
-    const relative = path.relative(parent, child);
-    const segments = relative === '' ? [] : relative.split(path.sep).filter((segment) => segment.length > 0);
-    let currentPath = parent;
-    const parentStats = lstatSync(parent);
-    if (parentStats.isSymbolicLink()) {
-        throw new Error(`Path must not contain symlinks: ${childPath}`);
-    }
-    for (const [index, segment] of segments.entries()) {
-        currentPath = path.join(currentPath, segment);
-        const isLeaf = index === segments.length - 1;
-        try {
-            const stats = lstatSync(currentPath);
-            if (stats.isSymbolicLink()) {
-                throw new Error(`Path must not contain symlinks: ${childPath}`);
-            }
-            if (!isLeaf && !stats.isDirectory()) {
-                throw new Error(`Path component is not a directory: ${currentPath}`);
-            }
-        }
-        catch (error) {
-            if (isMissingPathError(error) && options.allowMissingLeaf) {
-                return;
-            }
-            throw error;
-        }
-    }
-}
-export function readUtf8FileInsideWithoutSymlinks(parentPath, childPath) {
-    return readFileInsideWithoutSymlinks(parentPath, childPath).toString('utf8');
-}
-export function readFileInsideWithoutSymlinks(parentPath, childPath) {
-    const absoluteChildPath = path.resolve(childPath);
-    ensureInsideWithoutSymlinks(parentPath, absoluteChildPath);
-    const fileDescriptor = openSync(absoluteChildPath, constants.O_RDONLY | NOFOLLOW_FLAG);
-    try {
-        return readFileSync(fileDescriptor);
-    }
-    finally {
-        closeSync(fileDescriptor);
-    }
+export function copyFileInsideWithoutSymlinks(sourceParentPath, sourcePath, targetParentPath, targetPath) {
+    const content = readFileInsideWithoutSymlinks(sourceParentPath, sourcePath);
+    writeFileInsideWithoutSymlinks(targetParentPath, targetPath, content);
 }
-export function ensureFileTargetInsideWithoutSymlinks(parentPath, childPath, options = {}) {
-    const absoluteChildPath = path.resolve(childPath);
-    ensureInside(parentPath, absoluteChildPath);
-    ensureInsideWithoutSymlinks(parentPath, path.dirname(absoluteChildPath), { allowMissingLeaf: true });
+function pathExistsWithoutFollowingLeaf(filePath) {
     try {
-        const stats = lstatSync(absoluteChildPath);
-        if (stats.isSymbolicLink()) {
-            throw new Error(`Path must not contain symlinks: ${childPath}`);
-        }
-        if (!stats.isFile()) {
-            throw new Error(`Path must be a regular file: ${childPath}`);
-        }
+        lstatSync(filePath);
+        return true;
     }
     catch (error) {
-        if (isMissingPathError(error) && options.allowMissingLeaf) {
-            return;
+        if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+            return false;
         }
         throw error;
     }
 }
-export function writeUtf8FileInsideWithoutSymlinks(parentPath, childPath, content) {
-    writeFileInsideWithoutSymlinks(parentPath, childPath, content);
-}
-export function writeFileInsideWithoutSymlinks(parentPath, childPath, content) {
-    const absoluteChildPath = path.resolve(childPath);
-    const directoryPath = path.dirname(absoluteChildPath);
-    ensureInsideWithoutSymlinks(parentPath, directoryPath, { allowMissingLeaf: true });
-    mkdirSync(directoryPath, { recursive: true });
-    ensureFileTargetInsideWithoutSymlinks(parentPath, absoluteChildPath, { allowMissingLeaf: true });
-    const fileDescriptor = openSync(absoluteChildPath, constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | NOFOLLOW_FLAG);
-    try {
-        writeFileSync(fileDescriptor, content);
-    }
-    finally {
-        closeSync(fileDescriptor);
+function nearestExistingAncestor(filePath) {
+    let currentPath = path.resolve(path.dirname(filePath));
+    while (!pathExistsWithoutFollowingLeaf(currentPath)) {
+        const parentPath = path.dirname(currentPath);
+        if (parentPath === currentPath) {
+            throw new Error(`No existing parent directory for path: ${filePath}`);
+        }
+        currentPath = parentPath;
     }
-}
-export function copyFileInsideWithoutSymlinks(sourceParentPath, sourcePath, targetParentPath, targetPath) {
-    const content = readFileInsideWithoutSymlinks(sourceParentPath, sourcePath);
-    writeFileInsideWithoutSymlinks(targetParentPath, targetPath, content);
+    return currentPath;
 }
 export function copyFileIfMissing(sourcePath, targetPath, relativePath) {
-    if (existsSync(targetPath)) {
+    if (pathExistsWithoutFollowingLeaf(targetPath)) {
         return { status: 'skipped', relativePath };
     }
-    mkdirSync(path.dirname(targetPath), { recursive: true });
-    copyFileSync(sourcePath, targetPath);
+    const content = readFileInsideWithoutSymlinks(path.dirname(sourcePath), sourcePath);
+    writeFileInsideWithoutSymlinks(nearestExistingAncestor(targetPath), targetPath, content);
     return { status: 'created', relativePath };
 }
 export function listFilesRecursive(rootPath, options = {}) {

package/dist/cli/lib/local-index/index.js

@@ -310,6 +310,15 @@ function readIndexedFileMetadataRecord(projectRoot, relativePath, sourceScope) {
         mtimeMs: Math.round(stats.mtimeMs),
     };
 }
+function hashIndexedFileMetadataRecord(projectRoot, metadata) {
+    return {
+        ...metadata,
+        contentHash: sha256Bytes(readFileSync(path.join(projectRoot, ...metadata.path.split('/')))),
+    };
+}
+function hashIndexedFileMetadataRecords(projectRoot, metadataRecords) {
+    return metadataRecords.map((metadata) => hashIndexedFileMetadataRecord(projectRoot, metadata));
+}
 function collectIndexedFileRecords(projectRoot, documents, sourceAnchors, sourceAnchorCandidatePaths = []) {
     const records = new Map();
     for (const document of documents) {
@@ -332,16 +341,16 @@ function collectSourceAnchorCandidatePaths(projectRoot, sourceConfig) {
         excludeGeneratedOrVendor: true,
     });
 }
-function collectFastPreflightIndexedFileRecords(projectRoot, includeSource, sourceConfig) {
+function collectFastPreflightIndexedFileMetadataRecords(projectRoot, includeSource, sourceConfig) {
     const records = new Map();
     for (const relativePath of getExistingIndexablePaths(projectRoot)) {
-        records.set(relativePath, readIndexedFileRecord(projectRoot, relativePath, 'workflow'));
+        records.set(relativePath, readIndexedFileMetadataRecord(projectRoot, relativePath, 'workflow'));
     }
     if (includeSource) {
         try {
             for (const sourcePath of collectSourceAnchorCandidatePaths(projectRoot, sourceConfig)) {
                 if (!records.has(sourcePath)) {
-                    records.set(sourcePath, readIndexedFileRecord(projectRoot, sourcePath, 'source_anchor'));
+                    records.set(sourcePath, readIndexedFileMetadataRecord(projectRoot, sourcePath, 'source_anchor'));
                 }
             }
         }
@@ -350,7 +359,7 @@ function collectFastPreflightIndexedFileRecords(projectRoot, includeSource, sour
         }
     }
     if (existsSync(path.join(projectRoot, ...LATEST_RUN_STATE_RELATIVE_PATH.split('/')))) {
-        records.set(LATEST_RUN_STATE_RELATIVE_PATH, readIndexedFileRecord(projectRoot, LATEST_RUN_STATE_RELATIVE_PATH, 'state'));
+        records.set(LATEST_RUN_STATE_RELATIVE_PATH, readIndexedFileMetadataRecord(projectRoot, LATEST_RUN_STATE_RELATIVE_PATH, 'state'));
     }
     return [...records.values()].sort((left, right) => left.path.localeCompare(right.path));
 }
@@ -2074,6 +2083,27 @@ function indexedFilesMatch(database, currentFiles) {
     }
     return true;
 }
+function indexedFileMetadataMatch(database, currentFiles) {
+    const rows = queryRows(database, 'SELECT path, source_scope, size_bytes, mtime_ms, parser_version FROM indexed_files ORDER BY path');
+    if (rows.length !== currentFiles.length) {
+        return false;
+    }
+    const currentByPath = new Map(currentFiles.map((file) => [file.path, file]));
+    for (const row of rows) {
+        const storedPath = toSearchString(row.path);
+        const current = currentByPath.get(storedPath);
+        if (!current) {
+            return false;
+        }
+        if (normalizeIndexedFileSourceScope(row.source_scope) !== current.sourceScope ||
+            toNullableNumber(row.size_bytes) !== current.sizeBytes ||
+            toNullableNumber(row.mtime_ms) !== current.mtimeMs ||
+            toSearchString(row.parser_version) !== LOCAL_INDEX_PARSER_VERSION) {
+            return false;
+        }
+    }
+    return true;
+}
 async function readIncrementalPreflightReuse(SQL, databasePath, projectRoot, currentFiles, sourceScopeHash, dryRun, indexMode) {
     if (!currentFiles) {
         return { result: null, rebuildReason: null };
@@ -2096,7 +2126,11 @@ async function readIncrementalPreflightReuse(SQL, databasePath, projectRoot, cur
         if (!hasTable(database, 'indexed_files')) {
             return { result: null, rebuildReason: 'indexed_files_missing' };
         }
-        if (!indexedFilesMatch(database, currentFiles)) {
+        if (!indexedFileMetadataMatch(database, currentFiles)) {
+            return { result: null, rebuildReason: 'file_fingerprint_mismatch' };
+        }
+        const hashedCurrentFiles = hashIndexedFileMetadataRecords(projectRoot, currentFiles);
+        if (!indexedFilesMatch(database, hashedCurrentFiles)) {
             return { result: null, rebuildReason: 'file_fingerprint_mismatch' };
         }
         const capabilities = readStoredSearchCapabilities(database);
@@ -2170,7 +2204,7 @@ export async function createLocalIndex(projectRoot, options = {}) {
     capabilities = detectLocalSearchCapabilities(capabilityDatabase);
     capabilityDatabase.close();
     if (incremental) {
-        const preflightFiles = collectFastPreflightIndexedFileRecords(projectRoot, includeSource, sourceConfig);
+        const preflightFiles = collectFastPreflightIndexedFileMetadataRecords(projectRoot, includeSource, sourceConfig);
         const preflightReuse = await readIncrementalPreflightReuse(SQL, databasePath, projectRoot, preflightFiles, sourceScopeHash, dryRun, indexMode);
         if (preflightReuse.result) {
             return preflightReuse.result;
@@ -2245,7 +2279,7 @@ export async function createLocalIndex(projectRoot, options = {}) {
         max_snippet_bytes_per_document: MAX_SNIPPET_BYTES_PER_DOCUMENT,
         excluded_raw_data_kinds: [...LOCAL_INDEX_EXCLUDED_RAW_DATA_KINDS],
         indexed_file_count: indexedFiles.length,
-        indexed_paths: documents.map((document) => document.path),
+        indexed_paths: indexedFiles.map((file) => file.path),
     };
 }
 function readStoredSchemaVersion(database) {
@@ -2828,8 +2862,8 @@ function getSectionHeadings(database, documentPath) {
 function getDocumentTerms(database, documentPath) {
     return queryRows(database, 'SELECT term FROM document_terms WHERE document_path = ? ORDER BY term', [documentPath]).map((row) => toSearchString(row.term));
 }
-function getCommandEffects(database, intent) {
-    return queryRows(database, 'SELECT intent, source, access, mode, path, lock, concurrency FROM command_effects WHERE intent = ? ORDER BY lock, path, mode', [intent]).map((row) => ({
+function commandEffectFromRow(row) {
+    return {
         intent: toSearchString(row.intent),
         source: toSearchString(row.source),
         access: toSearchString(row.access),
@@ -2837,7 +2871,35 @@ function getCommandEffects(database, intent) {
         path: row.path === null || row.path === undefined ? null : toSearchString(row.path),
         lock: toSearchString(row.lock),
         concurrency: toSearchString(row.concurrency),
-    }));
+    };
+}
+function sqlPlaceholders(values) {
+    return values.map(() => '?').join(', ');
+}
+function queryCandidateRows(database, sql, keyColumn, candidates, indexedMatches) {
+    if (!indexedMatches.active || candidates.size === 0) {
+        return queryRows(database, sql);
+    }
+    const keys = [...candidates].sort((left, right) => left.localeCompare(right));
+    return queryRows(database, `${sql} WHERE ${keyColumn} IN (${sqlPlaceholders(keys)})`, keys);
+}
+function getCommandEffectsByIntent(database, intents) {
+    const uniqueIntents = [...new Set(intents)].sort((left, right) => left.localeCompare(right));
+    const effectsByIntent = new Map(uniqueIntents.map((intent) => [intent, []]));
+    if (uniqueIntents.length === 0) {
+        return effectsByIntent;
+    }
+    for (const row of queryRows(database, `SELECT intent, source, access, mode, path, lock, concurrency
+FROM command_effects
+WHERE intent IN (${sqlPlaceholders(uniqueIntents)})
+ORDER BY intent, lock, path, mode`, uniqueIntents)) {
+        const effect = commandEffectFromRow(row);
+        const effects = effectsByIntent.get(effect.intent);
+        if (effects) {
+            effects.push(effect);
+        }
+    }
+    return effectsByIntent;
 }
 const EMPTY_INDEXED_SEARCH_MATCHES = {
     active: false,
@@ -2921,11 +2983,11 @@ function getIndexedSearchMatches(database, query) {
     }
 }
 function matchesIndexedOrTableScan(fields, query, indexedMatches, matchSet, key) {
-    return (indexedMatches.active && matchSet.has(key)) || isMatched(fields, query);
+    return indexedMatches.active && matchSet.size > 0 ? matchSet.has(key) : isMatched(fields, query);
 }
 function scoreIndexedOrTableScan(primaryFields, secondaryFields, query, indexedMatches, matchSet, key) {
     const tableScore = scoreMatch(primaryFields, secondaryFields, query);
-    return indexedMatches.active && matchSet.has(key) ? Math.max(tableScore, 20) : tableScore;
+    return indexedMatches.active && matchSet.size > 0 && matchSet.has(key) ? Math.max(tableScore, 20) : tableScore;
 }
 /**
  * mf:anchor cli.search.local-index
@@ -2958,7 +3020,7 @@ export async function searchLocalIndex(projectRoot, query, options = {}) {
             throw new Error(`Local mustflow index is stale: ${stalePaths.join(', ')}. Run \`mf index\` before searching. Refresh command: mf index`);
         }
         if (scope === 'workflow' || scope === 'all') {
-            for (const row of queryRows(database, 'SELECT path, type, title, content_snippet FROM documents')) {
+            for (const row of queryCandidateRows(database, 'SELECT path, type, title, content_snippet FROM documents', 'path', indexedMatches.documents, indexedMatches)) {
                 const pathValue = toSearchString(row.path);
                 const typeValue = toSearchString(row.type);
                 const title = toSearchString(row.title);
@@ -2981,7 +3043,7 @@ export async function searchLocalIndex(projectRoot, query, options = {}) {
                     score: scoreIndexedOrTableScan(primaryFields, secondaryFields, normalizedQuery, indexedMatches, indexedMatches.documents, pathValue),
                 }, cacheLayers));
             }
-            for (const row of queryRows(database, 'SELECT name, path, title FROM skills')) {
+            for (const row of queryCandidateRows(database, 'SELECT name, path, title FROM skills', 'name', indexedMatches.skills, indexedMatches)) {
                 const name = toSearchString(row.name);
                 const pathValue = toSearchString(row.path);
                 const title = toSearchString(row.title);
@@ -2999,7 +3061,8 @@ export async function searchLocalIndex(projectRoot, query, options = {}) {
                     score: scoreIndexedOrTableScan([name, pathValue, title], [], normalizedQuery, indexedMatches, indexedMatches.skills, name),
                 }, cacheLayers));
             }
-            for (const row of queryRows(database, 'SELECT skill_name, skill_path, trigger, required_input, edit_scope, risk, verification_intents, expected_output FROM skill_routes')) {
+            const matchedSkillRouteNames = new Set([...indexedMatches.skillRoutes].map((routeKey) => routeKey.split('\u0000')[0] ?? ''));
+            for (const row of queryCandidateRows(database, 'SELECT skill_name, skill_path, trigger, required_input, edit_scope, risk, verification_intents, expected_output FROM skill_routes', 'skill_name', matchedSkillRouteNames, indexedMatches)) {
                 const name = toSearchString(row.skill_name);
                 const pathValue = toSearchString(row.skill_path);
                 const trigger = toSearchString(row.trigger);
@@ -3012,7 +3075,8 @@ export async function searchLocalIndex(projectRoot, query, options = {}) {
                 const secondaryFields = [pathValue, requiredInput, editScope, risk, expectedOutput];
                 const fields = [...primaryFields, ...secondaryFields];
                 const routeKey = skillRouteKey({ skillName: name, trigger });
-                if (!matchesIndexedOrTableScan(fields, normalizedQuery, indexedMatches, indexedMatches.skillRoutes, routeKey)) {
+                const indexedRouteMatch = indexedMatches.active && indexedMatches.skillRoutes.has(routeKey);
+                if (!indexedRouteMatch && !isMatched(fields, normalizedQuery)) {
                     continue;
                 }
                 results.push(withCacheHint({
@@ -3025,16 +3089,20 @@ export async function searchLocalIndex(projectRoot, query, options = {}) {
                     verification_intents: verificationIntents,
                     ...skillAuthority(),
                     match: getMatchSnippet(fields, normalizedQuery),
-                    score: scoreIndexedOrTableScan(primaryFields, secondaryFields, normalizedQuery, indexedMatches, indexedMatches.skillRoutes, routeKey),
+                    score: indexedRouteMatch
+                        ? Math.max(scoreMatch(primaryFields, secondaryFields, normalizedQuery), 20)
+                        : scoreMatch(primaryFields, secondaryFields, normalizedQuery),
                 }, cacheLayers));
             }
-            for (const row of queryRows(database, 'SELECT name, status, lifecycle, run_policy, description FROM command_intents')) {
+            const commandRows = queryCandidateRows(database, 'SELECT name, status, lifecycle, run_policy, description FROM command_intents', 'name', indexedMatches.commandIntents, indexedMatches);
+            const effectsByIntent = getCommandEffectsByIntent(database, commandRows.map((row) => toSearchString(row.name)));
+            for (const row of commandRows) {
                 const name = toSearchString(row.name);
                 const status = toSearchString(row.status);
                 const lifecycle = toSearchString(row.lifecycle);
                 const runPolicy = toSearchString(row.run_policy);
                 const description = toSearchString(row.description);
-                const effects = getCommandEffects(database, name);
+                const effects = effectsByIntent.get(name) ?? [];
                 const effectLocks = [...new Set(effects.map((effect) => effect.lock))].sort((left, right) => left.localeCompare(right));
                 const effectPaths = [
                     ...new Set(effects.map((effect) => effect.path).filter((effectPath) => effectPath !== null)),
@@ -3060,7 +3128,7 @@ export async function searchLocalIndex(projectRoot, query, options = {}) {
             }
         }
         if (scope === 'source' || scope === 'all') {
-            for (const row of queryRows(database, 'SELECT source_anchors.id, path, line_start, purpose, search_terms, invariant, risk, source_anchors.navigation_only, source_anchors.can_instruct_agent, status, confidence FROM source_anchors LEFT JOIN source_anchor_status ON source_anchor_status.anchor_id = source_anchors.id')) {
+            for (const row of queryCandidateRows(database, 'SELECT source_anchors.id, path, line_start, purpose, search_terms, invariant, risk, source_anchors.navigation_only, source_anchors.can_instruct_agent, status, confidence FROM source_anchors LEFT JOIN source_anchor_status ON source_anchor_status.anchor_id = source_anchors.id', 'source_anchors.id', indexedMatches.sourceAnchors, indexedMatches)) {
                 const id = toSearchString(row.id);
                 const pathValue = toSearchString(row.path);
                 const purpose = toSearchString(row.purpose);

package/dist/core/command-effects.js

@@ -17,12 +17,11 @@ function validateEffectPath(projectRoot, intent, rawPath) {
     const cwd = resolveSafeProjectCwd(projectRoot, readString(intent, 'cwd'));
     const resolved = path.resolve(cwd, rawPath);
     const root = path.resolve(projectRoot);
-    const resolvedLower = resolved.toLowerCase();
-    const rootLower = root.toLowerCase();
-    if (resolvedLower !== rootLower && !resolvedLower.startsWith(`${rootLower}${path.sep}`)) {
+    const relative = path.relative(root, resolved);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
         throw new Error(`Command effect path must stay inside the current root: ${rawPath}`);
     }
-    return normalizeRelativePath(path.relative(projectRoot, resolved));
+    return normalizeRelativePath(relative);
 }
 function readResourcePaths(commandContract, lock) {
     const resource = commandContract.resources[lock];

package/dist/core/run-write-drift.js

@@ -11,7 +11,7 @@ const GIT_STATUS_UNTRACKED_MODE = 'normal';
 const MAX_HASH_BYTES = 5 * 1024 * 1024;
 const RECURSIVE_SNAPSHOT_ENV = 'MUSTFLOW_WRITE_DRIFT_SNAPSHOT';
 const EXCLUDED_DIRECTORY_NAMES = new Set(['.git', 'node_modules']);
-const EXCLUDED_RELATIVE_DIRECTORY_PATHS = new Set(['.mustflow/state/runs']);
+const EXCLUDED_RELATIVE_DIRECTORY_PATHS = new Set(['.mustflow/state/perf', '.mustflow/state/runs']);
 function isRecursiveSnapshotEnabled() {
     const value = process.env[RECURSIVE_SNAPSHOT_ENV];
     return value === '1' || value?.toLowerCase() === 'true';
@@ -186,42 +186,132 @@ function truncatePaths(paths) {
     }
     return { paths: paths.slice(0, MAX_REPORTED_PATHS), truncated: true };
 }
-export function startRunWriteTracking(projectRoot, contract, intentName) {
+function uniqueSortedPaths(paths) {
+    return [...new Set([...paths].map(normalizeRelativePath))].sort((left, right) => left.localeCompare(right));
+}
+function pathsCoverObservedPath(declaredPaths, observedPath) {
+    return declaredPaths.some((declaredPath) => declaredPathCoversObservedPath(declaredPath, observedPath));
+}
+function createUnavailableWriteDriftReceipt(declaredPaths, reason) {
+    return {
+        status: 'unavailable',
+        declared_paths: declaredPaths,
+        observed_paths: [],
+        declared_observed_paths: [],
+        undeclared_paths: [],
+        observed_count: 0,
+        undeclared_count: 0,
+        has_undeclared_changes: false,
+        truncated: false,
+        reason,
+    };
+}
+export function startRunWriteTracking(projectRoot, contract, intentName, options = {}) {
+    const declaredPaths = [
+        ...listDeclaredWritePaths(projectRoot, contract, intentName),
+        ...(options.additionalDeclaredPaths ?? []).map(normalizeRelativePath),
+    ];
+    return {
+        projectRoot,
+        declaredPaths: [...new Set(declaredPaths)].sort((left, right) => left.localeCompare(right)),
+        before: captureSnapshot(projectRoot),
+    };
+}
+export function startRunWriteBatchTracking(projectRoot) {
     return {
         projectRoot,
-        declaredPaths: listDeclaredWritePaths(projectRoot, contract, intentName),
         before: captureSnapshot(projectRoot),
     };
 }
+export function finishRunWriteBatchTracking(tracker, intents) {
+    const chunkIntents = intents.map((intent) => intent.intentName).sort((left, right) => left.localeCompare(right));
+    const fallbackReceipts = new Map();
+    for (const intent of intents) {
+        fallbackReceipts.set(intent.intentName, createUnavailableWriteDriftReceipt(uniqueSortedPaths(intent.declaredPaths), tracker.before.reason));
+    }
+    if (tracker.before.status === 'unavailable') {
+        return fallbackReceipts;
+    }
+    const after = captureSnapshot(tracker.projectRoot);
+    if (after.status === 'unavailable') {
+        return new Map(intents.map((intent) => [
+            intent.intentName,
+            createUnavailableWriteDriftReceipt(uniqueSortedPaths(intent.declaredPaths), after.reason),
+        ]));
+    }
+    const observedPaths = listObservedChangedPaths(tracker.before.entries, after.entries);
+    const declaredObservedByIntent = new Map();
+    const undeclaredByIntent = new Map();
+    const ambiguousByIntent = new Map();
+    for (const intent of intents) {
+        declaredObservedByIntent.set(intent.intentName, []);
+        undeclaredByIntent.set(intent.intentName, []);
+        ambiguousByIntent.set(intent.intentName, []);
+    }
+    for (const observedPath of observedPaths) {
+        const declaredOwners = intents.filter((intent) => pathsCoverObservedPath(intent.declaredPaths, observedPath));
+        if (declaredOwners.length === 1) {
+            declaredObservedByIntent.get(declaredOwners[0]?.intentName ?? '')?.push(observedPath);
+            continue;
+        }
+        if (declaredOwners.length > 1) {
+            for (const owner of declaredOwners) {
+                ambiguousByIntent.get(owner.intentName)?.push(observedPath);
+            }
+            continue;
+        }
+        const observedWitnesses = intents.filter((intent) => intent.observedPaths.some((intentObservedPath) => pathKey(intentObservedPath) === pathKey(observedPath)));
+        if (observedWitnesses.length === 1) {
+            undeclaredByIntent.get(observedWitnesses[0]?.intentName ?? '')?.push(observedPath);
+            continue;
+        }
+        const ambiguousTargets = observedWitnesses.length > 0 ? observedWitnesses : intents;
+        for (const intent of ambiguousTargets) {
+            ambiguousByIntent.get(intent.intentName)?.push(observedPath);
+        }
+    }
+    const status = tracker.before.status === 'partial' || after.status === 'partial' ? 'partial' : 'checked';
+    const reason = status === 'partial'
+        ? tracker.before.reason ?? after.reason ?? 'partial_snapshot'
+        : null;
+    const receipts = new Map();
+    for (const intent of intents) {
+        const declaredPaths = uniqueSortedPaths(intent.declaredPaths);
+        const declaredObservedPaths = uniqueSortedPaths(declaredObservedByIntent.get(intent.intentName) ?? []);
+        const undeclaredPaths = uniqueSortedPaths(undeclaredByIntent.get(intent.intentName) ?? []);
+        const ambiguousPaths = uniqueSortedPaths(ambiguousByIntent.get(intent.intentName) ?? []);
+        const intentObservedPaths = uniqueSortedPaths([...declaredObservedPaths, ...undeclaredPaths, ...ambiguousPaths]);
+        const observed = truncatePaths(intentObservedPaths);
+        const declaredObserved = truncatePaths(declaredObservedPaths);
+        const undeclared = truncatePaths(undeclaredPaths);
+        const ambiguous = truncatePaths(ambiguousPaths);
+        receipts.set(intent.intentName, {
+            status,
+            declared_paths: declaredPaths,
+            observed_paths: observed.paths,
+            declared_observed_paths: declaredObserved.paths,
+            undeclared_paths: undeclared.paths,
+            observed_count: intentObservedPaths.length,
+            undeclared_count: undeclaredPaths.length,
+            has_undeclared_changes: undeclaredPaths.length > 0 || ambiguousPaths.length > 0,
+            truncated: observed.truncated || declaredObserved.truncated || undeclared.truncated || ambiguous.truncated,
+            reason,
+            attribution_mode: 'parallel_chunk',
+            chunk_intents: chunkIntents,
+            attributed_paths: uniqueSortedPaths([...declaredObservedPaths, ...undeclaredPaths]),
+            ambiguous_paths: ambiguous.paths,
+            ambiguous_count: ambiguousPaths.length,
+        });
+    }
+    return receipts;
+}
 export function finishRunWriteTracking(tracker) {
     if (tracker.before.status === 'unavailable') {
-        return {
-            status: 'unavailable',
-            declared_paths: tracker.declaredPaths,
-            observed_paths: [],
-            declared_observed_paths: [],
-            undeclared_paths: [],
-            observed_count: 0,
-            undeclared_count: 0,
-            has_undeclared_changes: false,
-            truncated: false,
-            reason: tracker.before.reason,
-        };
+        return createUnavailableWriteDriftReceipt(tracker.declaredPaths, tracker.before.reason);
     }
     const after = captureSnapshot(tracker.projectRoot);
     if (after.status === 'unavailable') {
-        return {
-            status: 'unavailable',
-            declared_paths: tracker.declaredPaths,
-            observed_paths: [],
-            declared_observed_paths: [],
-            undeclared_paths: [],
-            observed_count: 0,
-            undeclared_count: 0,
-            has_undeclared_changes: false,
-            truncated: false,
-            reason: after.reason,
-        };
+        return createUnavailableWriteDriftReceipt(tracker.declaredPaths, after.reason);
     }
     const observedPaths = listObservedChangedPaths(tracker.before.entries, after.entries);
     const declaredObservedPaths = observedPaths.filter((observedPath) => tracker.declaredPaths.some((declaredPath) => declaredPathCoversObservedPath(declaredPath, observedPath)));

package/dist/core/safe-filesystem.js

@@ -114,6 +114,9 @@ export function readFileInsideWithoutSymlinks(parentPath, childPath) {
         closeSync(fileDescriptor);
     }
 }
+export function readUtf8FileInsideWithoutSymlinks(parentPath, childPath) {
+    return readFileInsideWithoutSymlinks(parentPath, childPath).toString('utf8');
+}
 export function writeFileInsideWithoutSymlinks(parentPath, childPath, content) {
     const absoluteChildPath = path.resolve(childPath);
     const directoryPath = path.dirname(absoluteChildPath);

package/dist/core/verification-scheduler.js

@@ -180,7 +180,7 @@ export function createVerificationSchedule(projectRoot, commandContract, candida
             'Only entries backed by explicit effects are marked parallel eligible; writes fallback remains serial-only.',
             ...uniqueSorted(latestUndeclaredWriteIntents).map((intent) => `Latest receipt for ${intent} reported undeclared writes; it is not parallel eligible.`),
             'If a future parallel batch has already started, let it finish and stop before the next batch on failure.',
-            'mf verify still executes copied commands serially and writes the latest run summary after the batch completes.',
+            'The runner names the default copied-command path; mf verify --parallel may execute eligible entries in bounded chunks and writes the latest run summary after each batch completes.',
         ],
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mustflow",
-  "version": "2.21.1",
+  "version": "2.22.0",
   "description": "Agent workflow documents and CLI for mustflow repository roots.",
   "type": "module",
   "license": "MIT-0",

package/schemas/run-receipt.schema.json

@@ -281,7 +281,21 @@
         "undeclared_count": { "type": "integer" },
         "has_undeclared_changes": { "type": "boolean" },
         "truncated": { "type": "boolean" },
-        "reason": { "type": ["string", "null"] }
+        "reason": { "type": ["string", "null"] },
+        "attribution_mode": { "const": "parallel_chunk" },
+        "chunk_intents": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "attributed_paths": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "ambiguous_paths": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "ambiguous_count": { "type": "integer", "minimum": 0 }
       }
     }
   }

package/schemas/verify-report.schema.json

@@ -64,6 +64,7 @@
         "skipped": { "type": "integer" }
       }
     },
+    "parallelism": { "$ref": "#/$defs/parallelism" },
     "repro_evidence": { "$ref": "#/$defs/reproEvidence" },
     "external_checks": {
       "type": "array",
@@ -113,6 +114,33 @@
     }
   },
   "$defs": {
+    "parallelism": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "requested",
+        "effective",
+        "repository_max",
+        "cpu_available",
+        "capped",
+        "mode",
+        "note"
+      ],
+      "properties": {
+        "requested": { "type": "integer", "minimum": 1 },
+        "effective": { "type": "integer", "minimum": 1 },
+        "repository_max": { "type": "integer", "minimum": 1 },
+        "cpu_available": {
+          "anyOf": [
+            { "type": "integer", "minimum": 1 },
+            { "type": "null" }
+          ]
+        },
+        "capped": { "type": "boolean" },
+        "mode": { "enum": ["serial", "parallel_chunks"] },
+        "note": { "type": "string" }
+      }
+    },
     "failureFingerprint": {
       "type": "object",
       "additionalProperties": false,

package/templates/default/manifest.toml

@@ -1,6 +1,6 @@
 id = "default"
 name = "default"
-version = "2.21.1"
+version = "2.22.0"
 description = "Minimal workflow for LLM agents to read, edit, and verify their work in a repository."
 common_root = "common"
 locales_root = "locales"