pi-workflow-engine 0.10.3 → 0.12.0

package/.pi/extensions/pi-workflow-engine/src/concurrency.ts

@@ -1,5 +1,6 @@
 import { performance } from "node:perf_hooks";
 import { abortReason, isFatalWorkflowError, throwIfAborted } from "./cancellation.ts";
+import { unknownErrorMessage } from "./unknown-error.ts";
 
 /**
  * A counting semaphore: bounds how many async tasks run at once.
@@ -66,82 +67,227 @@ export interface ParallelOptions {
   readonly signal?: AbortSignal;
   readonly abortController?: AbortController;
   readonly limit?: number;
+  /** Maximum time to drain already-started tasks after a fatal failure. */
+  readonly drainTimeoutMs?: number;
+}
+
+export interface ParallelSettledOptions {
+  readonly settled: true;
+}
+
+export interface ParallelSettledError {
+  readonly name?: string;
+  readonly message: string;
+  readonly code?: string;
+  readonly details?: Readonly<Record<string, string | number | boolean | null>>;
+}
+
+export type ParallelSettledResult<T> =
+  | { readonly ok: true; readonly value: T }
+  | { readonly ok: false; readonly error: ParallelSettledError };
+
+export interface WorkflowParallel {
+  <T>(thunks: Array<() => Promise<T>>): Promise<Array<T | null>>;
+  <T>(thunks: Array<() => Promise<T>>, options: ParallelSettledOptions): Promise<Array<ParallelSettledResult<T>>>;
 }
 
 export interface PipelineOptions {
   readonly signal?: AbortSignal;
   readonly abortController?: AbortController;
+  /** Maximum time to drain already-started item chains after a fatal failure. */
+  readonly drainTimeoutMs?: number;
 }
 
+const DEFAULT_FATAL_DRAIN_TIMEOUT_MS = 1_000;
+
 export function compactResults<T>(values: ReadonlyArray<T | null | undefined>): T[] {
   return values.filter((value): value is T => value != null);
 }
 
-/** Run every thunk concurrently and wait for all results; recoverable failures become null slots. */
-export async function parallel<T>(thunks: Array<() => Promise<T>>, options: ParallelOptions = {}): Promise<Array<T | null>> {
+/** Run every thunk concurrently and wait for all results; recoverable failures become null slots by default. */
+export function parallel<T>(
+  thunks: Array<() => Promise<T>>,
+  options: ParallelOptions & ParallelSettledOptions,
+): Promise<Array<ParallelSettledResult<T>>>;
+export function parallel<T>(thunks: Array<() => Promise<T>>, options?: ParallelOptions): Promise<Array<T | null>>;
+export async function parallel<T>(
+  thunks: Array<() => Promise<T>>,
+  options: ParallelOptions & Partial<ParallelSettledOptions> = {},
+): Promise<Array<T | null> | Array<ParallelSettledResult<T>>> {
+  if (options.settled) {
+    return await runParallel(
+      thunks,
+      options,
+      (value): ParallelSettledResult<T> => ({ ok: true, value }),
+      (error): ParallelSettledResult<T> => ({ ok: false, error: serializeParallelError(error) }),
+    );
+  }
+
+  return await runParallel(
+    thunks,
+    options,
+    (value): T | null => value,
+    (): T | null => null,
+  );
+}
+
+export function bindParallel(options: ParallelOptions): WorkflowParallel {
+  const executionOptions: ParallelOptions = {
+    signal: options.signal,
+    abortController: options.abortController,
+    limit: options.limit,
+    drainTimeoutMs: options.drainTimeoutMs,
+  };
+
+  function boundParallel<T>(thunks: Array<() => Promise<T>>): Promise<Array<T | null>>;
+  function boundParallel<T>(
+    thunks: Array<() => Promise<T>>,
+    workflowOptions: ParallelSettledOptions,
+  ): Promise<Array<ParallelSettledResult<T>>>;
+  async function boundParallel<T>(
+    thunks: Array<() => Promise<T>>,
+    workflowOptions?: ParallelSettledOptions,
+  ): Promise<Array<T | null> | Array<ParallelSettledResult<T>>> {
+    if (workflowOptions?.settled) {
+      return await parallel(thunks, { ...executionOptions, settled: true });
+    }
+    return await parallel(thunks, executionOptions);
+  }
+
+  return boundParallel;
+}
+
+async function runParallel<T, Result>(
+  thunks: Array<() => Promise<T>>,
+  options: ParallelOptions,
+  onSuccess: (value: T) => Result,
+  onFailure: (error: unknown) => Result,
+): Promise<Result[]> {
   throwIfAborted(options.signal);
-  const results = new Array<T | null>(thunks.length);
-  let remaining = thunks.length;
-  if (remaining === 0) return results;
+  const results = new Array<Result>(thunks.length);
+  if (thunks.length === 0) return results;
 
   const limit = normalizeLimit(options.limit, thunks.length);
-  return await new Promise<Array<T | null>>((resolve, reject) => {
-    let rejected = false;
-    let active = 0;
-    let next = 0;
-    const cleanup = () => options.signal?.removeEventListener("abort", onAbort);
-    const rejectOnce = (error: unknown) => {
-      if (rejected) return;
-      rejected = true;
-      options.abortController?.abort(error);
+  return await new Promise<Result[]>((resolve, reject) => {
+    let terminal = false;
+    let nextIndex = 0;
+    let workersRemaining = limit;
+    let fatalFailure: { readonly error: unknown } | undefined;
+    let drainTimer: ReturnType<typeof setTimeout> | undefined;
+    const cleanup = () => {
+      options.signal?.removeEventListener("abort", onAbort);
+      if (drainTimer) clearTimeout(drainTimer);
+    };
+    const settle = (force = false) => {
+      if (terminal || (!force && workersRemaining > 0)) return;
+      terminal = true;
       cleanup();
-      reject(error);
+      if (fatalFailure) reject(fatalFailure.error);
+      else resolve(results);
     };
-    const settleSlot = (index: number, value: T | null) => {
-      if (rejected) return;
-      active--;
-      results[index] = value;
-      remaining--;
-      if (remaining === 0) {
-        cleanup();
-        resolve(results);
-        return;
-      }
-      launchMore();
+    const recordFatalFailure = (error: unknown) => {
+      if (fatalFailure) return;
+      fatalFailure = { error };
+      options.abortController?.abort(error);
+      const timeoutMs = normalizeDrainTimeout(options.drainTimeoutMs);
+      drainTimer = setTimeout(() => settle(true), timeoutMs);
     };
-    const onAbort = () => rejectOnce(abortReason(options.signal));
-    const launchMore = () => {
-      while (!rejected && active < limit && next < thunks.length) {
-        const index = next++;
-        active++;
-        void Promise.resolve()
-          .then(() => {
-            throwIfAborted(options.signal);
-            return thunks[index]();
-          })
-          .then(
-            (value) => settleSlot(index, value),
-            (error: unknown) => {
-              if (isFatalWorkflowError(error, options.signal)) {
-                rejectOnce(error);
-                return;
-              }
-              settleSlot(index, null);
-            },
-          );
+    const completeWorker = () => {
+      workersRemaining--;
+      settle();
+    };
+    const onAbort = () => recordFatalFailure(abortReason(options.signal));
+    const runWorker = async () => {
+      while (!fatalFailure) {
+        throwIfAborted(options.signal);
+        const index = nextIndex++;
+        if (index >= thunks.length) return;
+        try {
+          const value = await thunks[index]();
+          if (fatalFailure) return;
+          results[index] = onSuccess(value);
+        } catch (error) {
+          if (fatalFailure) return;
+          if (isFatalWorkflowError(error, options.signal)) {
+            recordFatalFailure(error);
+            return;
+          }
+          results[index] = onFailure(error);
+        }
       }
     };
 
     options.signal?.addEventListener("abort", onAbort, { once: true });
-    launchMore();
+    if (options.signal?.aborted) onAbort();
+    for (let worker = 0; worker < limit; worker++) {
+      void runWorker().then(completeWorker, (error) => {
+        recordFatalFailure(error);
+        completeWorker();
+      });
+    }
   });
 }
 
+function serializeParallelError(error: unknown): ParallelSettledError {
+  const message = readStringProperty(error, "message") ?? unknownErrorMessage(error);
+  const name = readStringProperty(error, "name");
+  const code = readStringProperty(error, "code");
+  const details = readSerializableDetails(error);
+  return {
+    ...(name && name.length > 0 ? { name } : {}),
+    message,
+    ...(code && code.length > 0 ? { code } : {}),
+    ...(details ? { details } : {}),
+  };
+}
+
+function readStringProperty(value: unknown, property: "message" | "name" | "code"): string | undefined {
+  const candidate = readProperty(value, property);
+  return typeof candidate === "string" ? candidate : undefined;
+}
+
+function readSerializableDetails(
+  value: unknown,
+): Readonly<Record<string, string | number | boolean | null>> | undefined {
+  const candidate = readProperty(value, "details");
+  if (typeof candidate !== "object" || candidate === null) return undefined;
+  try {
+    const details: Record<string, string | number | boolean | null> = {};
+    for (const [key, detail] of Object.entries(candidate)) {
+      if (
+        typeof detail === "string" ||
+        typeof detail === "boolean" ||
+        detail === null ||
+        (typeof detail === "number" && Number.isFinite(detail))
+      ) {
+        details[key] = detail;
+      }
+    }
+    return Object.keys(details).length > 0 ? details : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function readProperty(value: unknown, property: string): unknown {
+  if ((typeof value !== "object" && typeof value !== "function") || value === null) return undefined;
+  try {
+    return Reflect.get(value, property);
+  } catch {
+    return undefined;
+  }
+}
+
 function normalizeLimit(limit: number | undefined, itemCount: number): number {
   if (limit === undefined || !Number.isFinite(limit)) return Math.max(1, itemCount);
   return Math.max(1, Math.min(itemCount, Math.trunc(limit)));
 }
 
+function normalizeDrainTimeout(timeoutMs: number | undefined): number {
+  if (timeoutMs === undefined || !Number.isFinite(timeoutMs)) return DEFAULT_FATAL_DRAIN_TIMEOUT_MS;
+  return Math.max(0, Math.trunc(timeoutMs));
+}
+
 /**
  * Run each item through all stages independently. There is NO barrier between
  * stages: item A can be in stage 3 while item B is still in stage 1. Actual agent
@@ -165,6 +311,21 @@ export async function pipeline<Item, A, B, C>(
   stage2: (prev: A, item: Item, index: number) => Promise<B>,
   stage3: (prev: B, item: Item, index: number) => Promise<C>,
 ): Promise<Array<C | null>>;
+export async function pipeline<Item, A, B, C, D>(
+  items: readonly Item[],
+  stage1: (prev: Item, item: Item, index: number) => Promise<A>,
+  stage2: (prev: A, item: Item, index: number) => Promise<B>,
+  stage3: (prev: B, item: Item, index: number) => Promise<C>,
+  stage4: (prev: C, item: Item, index: number) => Promise<D>,
+): Promise<Array<D | null>>;
+export async function pipeline<Item, A, B, C, D, E>(
+  items: readonly Item[],
+  stage1: (prev: Item, item: Item, index: number) => Promise<A>,
+  stage2: (prev: A, item: Item, index: number) => Promise<B>,
+  stage3: (prev: B, item: Item, index: number) => Promise<C>,
+  stage4: (prev: C, item: Item, index: number) => Promise<D>,
+  stage5: (prev: D, item: Item, index: number) => Promise<E>,
+): Promise<Array<E | null>>;
 export async function pipeline(
   items: readonly unknown[],
   ...stages: Array<(prev: unknown, item: unknown, index: number) => Promise<unknown>>
@@ -192,6 +353,21 @@ export function bindPipeline(options: PipelineOptions): Pipeline {
     stage2: (prev: A, item: Item, index: number) => Promise<B>,
     stage3: (prev: B, item: Item, index: number) => Promise<C>,
   ): Promise<Array<C | null>>;
+  async function boundPipeline<Item, A, B, C, D>(
+    items: readonly Item[],
+    stage1: (prev: Item, item: Item, index: number) => Promise<A>,
+    stage2: (prev: A, item: Item, index: number) => Promise<B>,
+    stage3: (prev: B, item: Item, index: number) => Promise<C>,
+    stage4: (prev: C, item: Item, index: number) => Promise<D>,
+  ): Promise<Array<D | null>>;
+  async function boundPipeline<Item, A, B, C, D, E>(
+    items: readonly Item[],
+    stage1: (prev: Item, item: Item, index: number) => Promise<A>,
+    stage2: (prev: A, item: Item, index: number) => Promise<B>,
+    stage3: (prev: B, item: Item, index: number) => Promise<C>,
+    stage4: (prev: C, item: Item, index: number) => Promise<D>,
+    stage5: (prev: D, item: Item, index: number) => Promise<E>,
+  ): Promise<Array<E | null>>;
   async function boundPipeline(
     items: readonly unknown[],
     ...stages: Array<(prev: unknown, item: unknown, index: number) => Promise<unknown>>
@@ -207,24 +383,17 @@ export async function pipelineWithOptions(
   options: PipelineOptions = {},
 ): Promise<Array<unknown | null>> {
   throwIfAborted(options.signal);
-  return Promise.all(
-    items.map(async (item, index) => {
+  return await parallel(
+    items.map((item, index) => async () => {
       throwIfAborted(options.signal);
       let acc: unknown = item;
-      try {
-        for (const stage of stages) {
-          throwIfAborted(options.signal);
-          acc = await stage(acc, item, index);
-        }
-        return acc;
-      } catch (error) {
-        if (isFatalWorkflowError(error, options.signal)) {
-          options.abortController?.abort(error);
-          throw error;
-        }
-        return null;
+      for (const stage of stages) {
+        throwIfAborted(options.signal);
+        acc = await stage(acc, item, index);
       }
+      return acc;
     }),
+    options,
   );
 }
 

package/.pi/extensions/pi-workflow-engine/src/diff-capture.ts

@@ -1,19 +1,34 @@
 import type { PerfSink } from "./perf.ts";
-import { runBoundedProcess } from "./process-runner.ts";
+import { runBoundedProcess, type BoundedProcessFailure } from "./process-runner.ts";
+import { parseAllowedDiffCommand, reviewDiffCommand, type ReviewDiffTarget } from "./review-diff-target.ts";
 
-export interface AllowedDiffCommand {
-  readonly file: "git" | "gh";
-  readonly args: readonly string[];
-}
+export {
+  formatReviewDiffTarget,
+  GitReviewDiffTargetSchema,
+  isReviewDiffTarget,
+  parseAllowedDiffCommand,
+  PullRequestReviewDiffTargetSchema,
+  reviewDiffCommand,
+  ReviewDiffTargetSchema,
+  reviewGitDiffBaseline,
+  type GitDiffBaselineTarget,
+  type GitReviewDiffTarget,
+  type PullRequestReviewDiffTarget,
+  type ReviewDiffTarget,
+} from "./review-diff-target.ts";
 
-export interface DiffCaptureResult {
-  readonly ok: boolean;
+interface DiffCaptureResultBase {
   readonly stdout: string;
   readonly durationMs: number;
   readonly bytes: number;
-  readonly error?: string;
 }
 
+export type DiffCaptureResult =
+  | (DiffCaptureResultBase & { readonly ok: true; readonly error?: undefined; readonly failure?: undefined })
+  | (DiffCaptureResultBase & { readonly ok: false; readonly error: string; readonly failure: DiffCaptureFailure });
+
+export type DiffCaptureFailure = BoundedProcessFailure | { readonly kind: "invalid-target"; readonly message: string };
+
 export interface DiffCaptureOptions {
   readonly cwd: string;
   readonly signal?: AbortSignal;
@@ -24,59 +39,27 @@ export interface DiffCaptureOptions {
   readonly killGraceMs?: number;
 }
 
-const SAFE_REF_OR_PATH = /^[A-Za-z0-9_./:@~+=,\-]+$/;
-const SAFE_GH_FLAG = /^--[A-Za-z0-9-]+(=[A-Za-z0-9_./:@~+=,\-]+)?$/;
-const SAFE_GIT_DIFF_FLAGS = new Set(["--cached", "--staged", "--no-color", "--color=never", "--no-ext-diff"]);
-
-export function parseAllowedDiffCommand(command: string): AllowedDiffCommand | { error: string } {
-  const tokens = command.trim().split(/\s+/).filter(Boolean);
-  if (tokens.length < 2) return { error: "empty or incomplete diff command" };
-  if (tokens[0] === "git" && tokens[1] === "diff") return parseGitDiff(tokens);
-  if (tokens[0] === "gh" && tokens[1] === "pr" && tokens[2] === "diff" && /^\d+$/.test(tokens[3] ?? "")) {
-    const flags = tokens.slice(4);
-    const unsafe = flags.find((token) => !SAFE_GH_FLAG.test(token));
-    if (unsafe) return { error: `unsupported gh pr diff token: ${unsafe}` };
-    return { file: "gh", args: ["pr", "diff", tokens[3], ...flags] };
-  }
-  return { error: "diff command is not in the git/gh allowlist" };
-}
-
-function parseGitDiff(tokens: readonly string[]): AllowedDiffCommand | { error: string } {
-  const args = tokens.slice(2);
-  const safeArgs = ["diff", "--no-ext-diff"];
-  let pathMode = false;
-
-  for (const token of args) {
-    if (!SAFE_REF_OR_PATH.test(token)) return { error: `unsupported git diff token: ${token}` };
-    if (token === "--") {
-      pathMode = true;
-      safeArgs.push(token);
-      continue;
-    }
-    if (!pathMode && token.startsWith("-")) {
-      if (!isAllowedGitDiffFlag(token)) return { error: `unsupported git diff option: ${token}` };
-      if (token !== "--no-ext-diff") safeArgs.push(token);
-      continue;
-    }
-    safeArgs.push(token);
-  }
-
-  return { file: "git", args: safeArgs };
-}
-
-function isAllowedGitDiffFlag(token: string): boolean {
-  return SAFE_GIT_DIFF_FLAGS.has(token) || /^-U\d+$/.test(token) || /^--unified=\d+$/.test(token) || /^--inter-hunk-context=\d+$/.test(token);
-}
-
 export async function captureDiff(command: string, options: DiffCaptureOptions): Promise<DiffCaptureResult> {
   const parsed = parseAllowedDiffCommand(command);
   if ("error" in parsed) {
-    return { ok: false, stdout: "", durationMs: 0, bytes: 0, error: parsed.error };
+    return {
+      ok: false,
+      stdout: "",
+      durationMs: 0,
+      bytes: 0,
+      error: parsed.error,
+      failure: { kind: "invalid-target", message: parsed.error },
+    };
   }
 
+  return await captureDiffTarget(parsed, options);
+}
+
+export async function captureDiffTarget(target: ReviewDiffTarget, options: DiffCaptureOptions): Promise<DiffCaptureResult> {
+  const command = reviewDiffCommand(target);
   const result = await runBoundedProcess({
-    file: parsed.file,
-    args: parsed.args,
+    file: command.file,
+    args: command.args,
     cwd: options.cwd,
     env: diffCaptureEnv(options.env),
     signal: options.signal,

package/.pi/extensions/pi-workflow-engine/src/discovery.ts

@@ -1,11 +1,14 @@
 import { readdir } from "node:fs/promises";
-import { homedir } from "node:os";
 import { join } from "node:path";
 import { pathToFileURL } from "node:url";
-import type { WorkflowModule } from "./types.ts";
+import { getAgentDir } from "@earendil-works/pi-coding-agent";
+import type { LoadedWorkflow, WorkflowSourceIdentity } from "./types.ts";
 import type { PerfSink } from "./perf.ts";
-import { parseWorkflowModule } from "./workflow-module.ts";
-import { BUILTIN_WORKFLOW_FILES, BUILTIN_WORKFLOWS } from "./workflows.ts";
+import { loadWorkflow, parseWorkflowModule } from "./workflow-module.ts";
+import { BUILTIN_SOURCE_ROOT, BUILTIN_WORKFLOW_DEFINITIONS, BUILTIN_WORKFLOW_FILES } from "./workflows.ts";
+import { captureTreeFingerprint } from "./tree-fingerprint.ts";
+import { FINGERPRINT_EXCLUDED_RELATIVE_PATHS } from "./resume-context.ts";
+import { unknownErrorMessage } from "./unknown-error.ts";
 
 export interface DiscoverWorkflowsOptions {
   readonly refresh?: boolean;
@@ -13,10 +16,17 @@ export interface DiscoverWorkflowsOptions {
   readonly userWorkflowDir?: string;
 }
 
-const discoveryCache = new Map<string, Map<string, WorkflowModule>>();
+const DISCOVERY_FINGERPRINT_MAX_BYTES = 32 << 20;
+const DISCOVERY_FINGERPRINT_MAX_FILES = 4096;
 
+const discoveryCache = new Map<string, Map<string, LoadedWorkflow>>();
 /** Best-effort dynamic load of every `*.ts` workflow in a directory. */
-async function loadDir(dir: string, excludeFiles: ReadonlySet<string> = new Set()): Promise<WorkflowModule[]> {
+async function loadDir(
+  dir: string,
+  sourceIdentity: (path: string) => WorkflowSourceIdentity,
+  excludeFiles: ReadonlySet<string> = new Set(),
+  provenanceRoot?: string,
+): Promise<LoadedWorkflow[]> {
   let entries: string[];
   try {
     entries = await readdir(dir);
@@ -24,30 +34,43 @@ async function loadDir(dir: string, excludeFiles: ReadonlySet<string> = new Set(
     return [];
   }
 
-  const modules: WorkflowModule[] = [];
+  const before = provenanceRoot ? await captureDiscoveryFingerprint(provenanceRoot) : undefined;
+  const modules: Array<{ readonly path: string; readonly module: Parameters<typeof loadWorkflow>[0] }> = [];
   for (const name of entries) {
     if (excludeFiles.has(name)) continue;
     if (!name.endsWith(".ts") || name.startsWith("_") || name.startsWith(".")) continue;
     try {
-      const loaded: unknown = await import(pathToFileURL(join(dir, name)).href);
+      const path = join(dir, name);
+      const importUrl = pathToFileURL(path);
+      if (before?.kind === "verified") importUrl.searchParams.set("workflowSource", before.fingerprint);
+      const loaded: unknown = await import(importUrl.href);
       const parsed = parseWorkflowModule(loaded);
-      if ("module" in parsed) modules.push(parsed.module);
+      if ("module" in parsed) modules.push({ path, module: parsed.module });
       else console.error(`[workflow-engine] skipped ${name}: ${parsed.reason}`);
     } catch (error) {
       // Drop-in loading depends on the runtime resolving TS + the bundled typebox.
       // Failures here are non-fatal: the static registry still works.
-      console.error(`[workflow-engine] skipped ${name}: ${error instanceof Error ? error.message : String(error)}`);
+      console.error(`[workflow-engine] skipped ${name}: ${unknownErrorMessage(error)}`);
     }
   }
-  return modules;
+  return modules.map(({ path, module }) => loadWorkflow(module, sourceIdentity(path)));
+}
+
+async function captureDiscoveryFingerprint(root: string) {
+  return await captureTreeFingerprint({
+    root,
+    excludedRelativePaths: FINGERPRINT_EXCLUDED_RELATIVE_PATHS,
+    maxBytes: DISCOVERY_FINGERPRINT_MAX_BYTES,
+    maxFiles: DISCOVERY_FINGERPRINT_MAX_FILES,
+  });
 }
 
 /**
  * All available workflows by name. Static registry wins on name collisions, so the
  * bundled example is always the verified one even if a same-named file is dropped in.
  */
-export async function discoverWorkflows(repoDir: string, options: DiscoverWorkflowsOptions = {}): Promise<Map<string, WorkflowModule>> {
-  const userWorkflowDir = options.userWorkflowDir ?? join(homedir(), ".pi", "agent", "workflows");
+export async function discoverWorkflows(repoDir: string, options: DiscoverWorkflowsOptions = {}): Promise<Map<string, LoadedWorkflow>> {
+  const userWorkflowDir = options.userWorkflowDir ?? join(getAgentDir(), "workflows");
   const cacheKey = `${repoDir}\0${userWorkflowDir}`;
   const cached = discoveryCache.get(cacheKey);
   if (cached && !options.refresh) {
@@ -56,13 +79,43 @@ export async function discoverWorkflows(repoDir: string, options: DiscoverWorkfl
   }
 
   const byName = await timed(options.perf, "discovery.total_ms", async () => {
-    const next = new Map<string, WorkflowModule>();
-    for (const mod of BUILTIN_WORKFLOWS) next.set(mod.meta.name, mod);
+    const next = new Map<string, LoadedWorkflow>();
+    const builtinSource = await captureDiscoveryFingerprint(BUILTIN_SOURCE_ROOT);
+    for (const definition of BUILTIN_WORKFLOW_DEFINITIONS) {
+      const source: WorkflowSourceIdentity =
+        builtinSource.kind === "verified"
+          ? {
+              kind: "file",
+              path: definition.path,
+              root: definition.root,
+              fingerprint: builtinSource.fingerprint,
+            }
+          : {
+              kind: "unverifiable",
+              reason: `built-in workflow source capture failed: ${builtinSource.reason}`,
+            };
+      next.set(definition.module.meta.name, loadWorkflow(definition.module, source));
+    }
 
     const repoWorkflowDir = join(repoDir, "workflows");
     const [repoDynamic, userDynamic] = await Promise.all([
-      timed(options.perf, "discovery.repo_dir_ms", () => loadDir(repoWorkflowDir, BUILTIN_WORKFLOW_FILES)),
-      timed(options.perf, "discovery.user_dir_ms", () => loadDir(userWorkflowDir)),
+      timed(options.perf, "discovery.repo_dir_ms", () =>
+        loadDir(
+          repoWorkflowDir,
+          () => ({
+            kind: "unverifiable",
+            reason: "dynamic workflow module graphs are not loaded from an immutable source snapshot",
+          }),
+          BUILTIN_WORKFLOW_FILES,
+          repoDir,
+        ),
+      ),
+      timed(options.perf, "discovery.user_dir_ms", () =>
+        loadDir(userWorkflowDir, () => ({
+          kind: "unverifiable",
+          reason: "dynamic user workflow dependencies do not have a declared trusted source root",
+        })),
+      ),
     ]);
 
     for (const mod of repoDynamic) {