vgxness 1.20.4 → 1.20.6

package/dist/interfaces/cli/commands/workflow-dispatcher.js

@@ -0,0 +1,566 @@
+import { AgentRegistryService } from '../../../agents/agent-registry-service.js';
+import { canonicalOpenCodeDefaultModel } from '../../../agents/canonical-agent-manifest.js';
+import { createNaturalLanguagePlan } from '../../../orchestrator/natural-language-planner.js';
+import { RunService } from '../../../runs/run-service.js';
+import { normalizeSddPhaseInput, sddPhases } from '../../../sdd/schema.js';
+import { CommandAllowlistAdapter, commandAllowlistIds } from '../../../workflows/command-allowlist-adapter.js';
+import { GuardedProviderWorkflowExecutor, operationMetadataForWorkflowExecution, SafeNonDispatchingWorkflowExecutor, workflowExecutorSafety, } from '../../../workflows/workflow-executor.js';
+import { getWorkflowDefinition, listWorkflows } from '../../../workflows/workflow-registry.js';
+import { optionalStringFlag, requiredFlag } from '../cli-flags.js';
+import { validationFailure } from '../cli-help.js';
+import { jsonResult, resultFailure, toJsonValue } from '../cli-helpers.js';
+function resolveWorkflowRunAgent(input) {
+    if (input.explicitAgentId !== undefined) {
+        const agent = input.registry.getAgent(input.explicitAgentId);
+        if (!agent.ok) {
+            return { ok: false, value: workflowRunBlockedAgentResolution(input, `Explicit --agent-id could not be resolved: ${agent.error.message}`) };
+        }
+        return {
+            ok: true,
+            value: {
+                agent: agent.value,
+                summary: workflowRunAgentSummary(agent.value, {
+                    policy: 'explicit-agent-id',
+                    reasons: ['explicit --agent-id selected a registry agent'],
+                    fallbackReason: null,
+                }),
+            },
+        };
+    }
+    const resolution = input.registry.resolveAgents({
+        project: input.project,
+        scope: 'project',
+        mode: 'agent',
+        workflow: input.workflow,
+        phase: input.phase,
+        providerAdapter: input.providerAdapter,
+        intent: input.intent,
+        taskDescription: input.intent,
+        desiredCapabilities: [],
+    });
+    if (!resolution.ok)
+        return { ok: false, value: workflowRunBlockedAgentResolution(input, resolution.error.message) };
+    const manager = resolution.value.candidates.find((candidate) => candidate.agent.name === 'vgxness-manager');
+    const selected = manager ?? resolution.value.candidates[0];
+    if (selected === undefined) {
+        return {
+            ok: false,
+            value: workflowRunBlockedAgentResolution(input, 'No project agent matched the requested workflow, phase, provider adapter, and project scope. Seed or register vgxness-manager before running workflows.', resolution.value.skipped.map((skipped) => ({ agent: skipped.agent, reasons: skipped.reasons }))),
+        };
+    }
+    return {
+        ok: true,
+        value: {
+            agent: selected.agent,
+            summary: workflowRunAgentSummary(selected.agent, {
+                policy: 'project-manager-preferred',
+                reasons: selected.reasons,
+                fallbackReason: manager === undefined && selected.agent.name !== 'vgxness-manager'
+                    ? 'vgxness-manager was not resolvable for this workflow/phase/provider; selected the highest-scoring project agent instead.'
+                    : null,
+                score: selected.score,
+            }),
+        },
+    };
+}
+function workflowRunAgentSummary(agent, details) {
+    return {
+        id: agent.id,
+        name: agent.name,
+        mode: agent.mode,
+        project: agent.project,
+        scope: agent.scope,
+        workflows: agent.workflows,
+        policy: details.policy,
+        reasons: details.reasons,
+        fallbackReason: details.fallbackReason ?? null,
+        ...(details.score !== undefined ? { score: details.score } : {}),
+    };
+}
+function workflowRunBlockedAgentResolution(input, reason, skipped) {
+    return {
+        ok: false,
+        status: 'blocked',
+        reason,
+        workflow: input.workflow,
+        phase: input.phase,
+        providerAdapter: input.providerAdapter,
+        selectedAgent: null,
+        safety: {
+            executed: false,
+            recordsRuns: false,
+            callsProvider: false,
+            editsFiles: false,
+            writesProviderConfig: false,
+            mutatesSddArtifacts: false,
+        },
+        nextAction: 'Register or seed a real project agent such as vgxness-manager, then retry the workflow run.',
+        ...(skipped !== undefined ? { skipped } : {}),
+    };
+}
+function workflowRunSafety(workflow) {
+    return {
+        executed: true,
+        recordsRuns: true,
+        callsProvider: false,
+        editsFiles: false,
+        writesProviderConfig: false,
+        mutability: workflow.mutability,
+        safetyProfile: workflow.safetyProfile,
+        requiresSddArtifacts: workflow.requiresSddArtifacts,
+        notes: [
+            'Safe run slice: recorded run intent and checkpoint only.',
+            'No provider tools were called, no user files were edited, no provider config was written, and no SDD artifacts were mutated.',
+        ],
+    };
+}
+function workflowRunRecommendation(selected, recommended, planner) {
+    if (selected.id === recommended.id) {
+        return {
+            status: 'aligned',
+            recommendedWorkflow: recommended.id,
+            message: `Planner agrees with explicit ${selected.id} workflow.`,
+        };
+    }
+    return {
+        status: recommended.id === 'sdd' ? 'escalation-recommended' : 'workflow-mismatch',
+        explicitWorkflow: selected.id,
+        recommendedWorkflow: recommended.id,
+        reason: planner.reason,
+        message: recommended.id === 'sdd'
+            ? `Planner recommends formal SDD instead of ${selected.id}; do not continue with mutable lightweight work until reviewed.`
+            : `Planner recommends ${recommended.id} instead of explicit ${selected.id}; review before continuing.`,
+    };
+}
+function workflowRunNextAction(selected, recommended, planner) {
+    if (recommended.id === 'sdd' && selected.id !== 'sdd') {
+        return {
+            type: 'review-escalation',
+            command: planner.suggestedChangeId === undefined ? null : `vgxness sdd next --project ${planner.project} --change ${planner.suggestedChangeId}`,
+            reason: 'Planner detected broad or risky work and recommends the formal SDD workflow before any edits.',
+        };
+    }
+    return {
+        type: selected.id === 'sdd' ? 'continue-sdd' : 'manual-continuation',
+        command: selected.id === 'sdd' && planner.suggestedChangeId !== undefined
+            ? `vgxness sdd next --project ${planner.project} --change ${planner.suggestedChangeId}`
+            : null,
+        reason: selected.id === 'sdd'
+            ? 'Use existing SDD commands to inspect readiness; this run command did not mutate artifacts.'
+            : 'Inspect the recorded checkpoint, then continue manually or through a future approved executor slice.',
+    };
+}
+function appendWorkflowExecutionCheckpoint(service, runId, label, state) {
+    return service.appendCheckpoint({ runId, label, state: toJsonValue(state) });
+}
+function workflowExecutionSafety(preflightRecorded) {
+    return workflowExecutorSafety(preflightRecorded);
+}
+function workflowExecutionBlockedValue(runId, workflow, reason, message, checkpoint, recommendation) {
+    return {
+        ok: false,
+        runId,
+        workflow,
+        status: 'blocked',
+        dispatched: false,
+        reason,
+        message,
+        ...(checkpoint.ok ? { checkpointId: checkpoint.value.id } : {}),
+        ...(recommendation === undefined ? {} : { recommendation }),
+        safety: workflowExecutionSafety(false),
+        nextAction: 'Resolve the blocking safety gate, then re-run the explicit execute command.',
+    };
+}
+function validateWorkflowExecutionAgent(agent, run, workflow) {
+    if (agent.mode !== 'agent')
+        return {
+            ok: false,
+            reason: 'selected-agent-not-primary-agent',
+            message: `Selected registry entry ${agent.id} is ${agent.mode}; delegated workflow execution requires a primary agent.`,
+        };
+    if (agent.id !== run.selectedAgentId)
+        return { ok: false, reason: 'selected-agent-mismatch', message: 'Resolved selected agent does not match run.selectedAgentId.' };
+    if (agent.project !== run.project)
+        return {
+            ok: false,
+            reason: 'selected-agent-project-mismatch',
+            message: `Selected agent belongs to project ${agent.project}, not run project ${run.project}.`,
+        };
+    if (agent.adapters[run.providerAdapter] === undefined)
+        return { ok: false, reason: 'selected-agent-provider-mismatch', message: `Selected agent has no ${run.providerAdapter} adapter.` };
+    if (!agent.workflows.includes(workflow.id) && !agent.workflows.includes(`${workflow.id}:${run.phase}`)) {
+        return {
+            ok: false,
+            reason: 'selected-agent-workflow-mismatch',
+            message: `Selected agent is not registered for workflow ${workflow.id} or phase ${workflow.id}:${run.phase}.`,
+        };
+    }
+    return { ok: true };
+}
+function recordWorkflowPendingApproval(service, runId, operation, executorMode, preflight) {
+    const approvalId = preflight.approval?.id ?? preflight.audit.approvalId;
+    return service.appendEvent({
+        runId,
+        kind: 'operation-execution',
+        title: `Workflow operation pending approval: ${operation.category} ${operation.operation}`,
+        payload: {
+            status: 'pending-approval',
+            executorName: `workflow-${executorMode}`,
+            requestedOperation: operationMetadataForWorkflowExecution(operation),
+            input: operation.input ?? null,
+            decisionEventId: preflight.permissionEvent.id,
+            approvalId: approvalId ?? null,
+            decision: preflight.decision.decision,
+            reason: preflight.decision.reason,
+            message: preflight.decision.message,
+            executorInvoked: false,
+            operationExecuted: false,
+            timestamp: new Date().toISOString(),
+        },
+        relatedType: 'approval',
+        ...(approvalId === undefined ? {} : { relatedId: approvalId }),
+    });
+}
+export function runWorkflowPreviewCommand(workflow, parsed) {
+    const project = optionalStringFlag(parsed.flags, 'project') ?? 'vgxness';
+    const intent = optionalStringFlag(parsed.flags, 'intent') ?? parsed.positionals.slice(2).join(' ').trim();
+    const selected = getWorkflowDefinition(workflow);
+    return jsonResult({
+        ok: true,
+        value: {
+            workflow: selected,
+            registry: listWorkflows(),
+            ...(intent.length > 0 ? { planner: createNaturalLanguagePlan({ project, intent }) } : {}),
+            safety: {
+                executed: false,
+                callsProvider: false,
+                editsFiles: false,
+                writesProviderConfig: false,
+                recordsRuns: false,
+            },
+        },
+    });
+}
+export function runWorkflowRunCommand(workflow, parsed, database) {
+    const project = optionalStringFlag(parsed.flags, 'project') ?? 'vgxness';
+    const intent = requiredFlag(parsed.flags, 'intent');
+    if (!intent.ok)
+        return resultFailure(intent);
+    const selected = getWorkflowDefinition(workflow);
+    const planner = createNaturalLanguagePlan({ project, intent: intent.value });
+    const recommended = getWorkflowDefinition(planner.workflow);
+    const phaseInput = optionalStringFlag(parsed.flags, 'phase') ?? selected.defaultPhase;
+    let phase = phaseInput;
+    if (selected.id === 'sdd') {
+        const canonicalPhase = normalizeSddPhaseInput(phaseInput);
+        if (canonicalPhase === undefined)
+            return resultFailure(validationFailure(`Unknown SDD phase: ${phaseInput}. Expected one of: ${sddPhases.join(', ')}`));
+        phase = canonicalPhase;
+    }
+    const providerAdapter = optionalStringFlag(parsed.flags, 'provider-adapter') ?? 'opencode';
+    const model = optionalStringFlag(parsed.flags, 'model') ?? canonicalOpenCodeDefaultModel;
+    const registry = new AgentRegistryService(database);
+    const explicitAgentId = optionalStringFlag(parsed.flags, 'agent-id');
+    const selectedAgent = resolveWorkflowRunAgent({
+        registry,
+        project,
+        intent: intent.value,
+        workflow: selected.id,
+        phase,
+        providerAdapter,
+        ...(explicitAgentId !== undefined ? { explicitAgentId } : {}),
+    });
+    if (!selectedAgent.ok)
+        return jsonResult({ ok: true, value: selectedAgent.value });
+    const service = new RunService(database);
+    const created = service.createRun({
+        project,
+        userIntent: intent.value,
+        workflow: selected.id,
+        phase,
+        selectedAgentId: selectedAgent.value.agent.id,
+        providerAdapter,
+        model,
+    });
+    if (!created.ok)
+        return resultFailure(created);
+    const executionSafety = workflowRunSafety(selected);
+    const recommendation = workflowRunRecommendation(selected, recommended, planner);
+    const checkpointState = toJsonValue({
+        kind: 'workflow-run-plan',
+        version: 1,
+        workflow: selected,
+        planner,
+        safety: executionSafety,
+        recommendation,
+        selectedAgent: selectedAgent.value.summary,
+        nextAction: workflowRunNextAction(selected, recommended, planner),
+    });
+    const checkpoint = service.appendCheckpoint({
+        runId: created.value.id,
+        label: 'workflow-run-planned',
+        state: checkpointState,
+    });
+    if (!checkpoint.ok)
+        return resultFailure(checkpoint);
+    return jsonResult({
+        ok: true,
+        value: {
+            ok: true,
+            runId: created.value.id,
+            workflow: selected,
+            phase,
+            selectedAgent: selectedAgent.value.summary,
+            planner: {
+                workflow: planner.workflow,
+                flow: planner.flow,
+                confidence: planner.confidence,
+                reason: planner.reason,
+                signals: planner.signals,
+                needsClarification: planner.needsClarification,
+            },
+            safety: executionSafety,
+            checkpointId: checkpoint.value.id,
+            recommendation,
+            nextAction: workflowRunNextAction(selected, recommended, planner),
+        },
+    });
+}
+export function runWorkflowExecuteCommand(workflow, parsed, database, environment) {
+    const runId = requiredFlag(parsed.flags, 'run-id');
+    if (!runId.ok)
+        return resultFailure(runId);
+    const service = new RunService(database);
+    const details = service.getRun(runId.value);
+    if (!details.ok)
+        return resultFailure(details);
+    const selected = getWorkflowDefinition(workflow);
+    if (details.value.workflow !== selected.id) {
+        const checkpoint = appendWorkflowExecutionCheckpoint(service, details.value.id, 'workflow-execution-blocked', {
+            kind: 'workflow-execution-blocked',
+            version: 1,
+            runId: details.value.id,
+            requestedWorkflow: selected.id,
+            runWorkflow: details.value.workflow,
+            status: 'blocked',
+            dispatched: false,
+            reason: 'workflow-mismatch',
+            message: `Run ${details.value.id} belongs to workflow ${details.value.workflow}, not ${selected.id}.`,
+            safety: workflowExecutionSafety(false),
+        });
+        if (!checkpoint.ok)
+            return resultFailure(checkpoint);
+        return jsonResult({
+            ok: true,
+            value: workflowExecutionBlockedValue(details.value.id, selected.id, 'workflow-mismatch', 'Run workflow does not match the execute command.', checkpoint),
+        });
+    }
+    const agent = new AgentRegistryService(database).getAgent(details.value.selectedAgentId);
+    if (!agent.ok) {
+        const checkpoint = appendWorkflowExecutionCheckpoint(service, details.value.id, 'workflow-execution-blocked', {
+            kind: 'workflow-execution-blocked',
+            version: 1,
+            runId: details.value.id,
+            workflow: selected.id,
+            status: 'blocked',
+            dispatched: false,
+            reason: 'selected-agent-unresolved',
+            message: agent.error.message,
+            selectedAgentId: details.value.selectedAgentId,
+            safety: workflowExecutionSafety(false),
+        });
+        if (!checkpoint.ok)
+            return resultFailure(checkpoint);
+        return jsonResult({
+            ok: true,
+            value: workflowExecutionBlockedValue(details.value.id, selected.id, 'selected-agent-unresolved', agent.error.message, checkpoint),
+        });
+    }
+    const agentGate = validateWorkflowExecutionAgent(agent.value, details.value, selected);
+    if (!agentGate.ok) {
+        const checkpoint = appendWorkflowExecutionCheckpoint(service, details.value.id, 'workflow-execution-blocked', {
+            kind: 'workflow-execution-blocked',
+            version: 1,
+            runId: details.value.id,
+            workflow: selected.id,
+            status: 'blocked',
+            dispatched: false,
+            reason: agentGate.reason,
+            message: agentGate.message,
+            selectedAgent: workflowRunAgentSummary(agent.value, { policy: 'run-selected-agent', reasons: ['run.selectedAgentId resolved to a real registry agent'] }),
+            safety: workflowExecutionSafety(false),
+        });
+        if (!checkpoint.ok)
+            return resultFailure(checkpoint);
+        return jsonResult({ ok: true, value: workflowExecutionBlockedValue(details.value.id, selected.id, agentGate.reason, agentGate.message, checkpoint) });
+    }
+    if (parsed.flags.confirm !== true) {
+        const checkpoint = appendWorkflowExecutionCheckpoint(service, details.value.id, 'workflow-execution-blocked', {
+            kind: 'workflow-execution-blocked',
+            version: 1,
+            runId: details.value.id,
+            workflow: selected.id,
+            status: 'blocked',
+            dispatched: false,
+            reason: 'missing-confirmation',
+            message: 'Explicit --confirm is required before delegated workflow execution can be requested.',
+            selectedAgent: workflowRunAgentSummary(agent.value, { policy: 'run-selected-agent', reasons: ['run.selectedAgentId resolved to a real registry agent'] }),
+            safety: workflowExecutionSafety(false),
+            nextAction: `Re-run: vgxness ${selected.id} execute --run-id ${details.value.id} --confirm`,
+        });
+        if (!checkpoint.ok)
+            return resultFailure(checkpoint);
+        return jsonResult({
+            ok: true,
+            value: workflowExecutionBlockedValue(details.value.id, selected.id, 'missing-confirmation', 'Explicit --confirm is required.', checkpoint),
+        });
+    }
+    const planner = createNaturalLanguagePlan({ project: details.value.project, intent: details.value.userIntent });
+    const recommended = getWorkflowDefinition(planner.workflow);
+    const recommendation = workflowRunRecommendation(selected, recommended, planner);
+    if (recommended.id === 'sdd' && selected.id !== 'sdd' && parsed.flags['override-escalation'] !== true) {
+        const checkpoint = appendWorkflowExecutionCheckpoint(service, details.value.id, 'workflow-execution-blocked', {
+            kind: 'workflow-execution-blocked',
+            version: 1,
+            runId: details.value.id,
+            workflow: selected.id,
+            status: 'blocked',
+            dispatched: false,
+            reason: 'escalation-recommended',
+            message: 'Planner recommends formal SDD; delegated lightweight execution is blocked unless --override-escalation is supplied.',
+            recommendation,
+            planner,
+            selectedAgent: workflowRunAgentSummary(agent.value, { policy: 'run-selected-agent', reasons: ['run.selectedAgentId resolved to a real registry agent'] }),
+            safety: workflowExecutionSafety(false),
+            nextAction: workflowRunNextAction(selected, recommended, planner),
+        });
+        if (!checkpoint.ok)
+            return resultFailure(checkpoint);
+        return jsonResult({
+            ok: true,
+            value: workflowExecutionBlockedValue(details.value.id, selected.id, 'escalation-recommended', 'Planner recommends formal SDD; supply --override-escalation only after human review.', checkpoint, recommendation),
+        });
+    }
+    const workspaceRoot = optionalStringFlag(parsed.flags, 'workspace') ?? environment.cwd;
+    const executorMode = optionalStringFlag(parsed.flags, 'executor') ?? 'safe-non-dispatching';
+    if (executorMode !== 'safe-non-dispatching' && executorMode !== 'provider' && executorMode !== 'command')
+        return resultFailure(validationFailure(`Unknown workflow executor: ${executorMode}. Expected safe-non-dispatching, provider, or command.`));
+    const commandId = optionalStringFlag(parsed.flags, 'command');
+    if (executorMode === 'command' && commandId === undefined)
+        return resultFailure(validationFailure(`--executor command requires --command <name>. Allowlisted commands: ${commandAllowlistIds().join(', ')}`));
+    if (executorMode !== 'command' && commandId !== undefined)
+        return resultFailure(validationFailure('--command can only be used with --executor command'));
+    const commandTargets = optionalStringFlag(parsed.flags, 'command-targets')
+        ?.split(',')
+        .map((item) => item.trim())
+        .filter((item) => item.length > 0) ?? [];
+    let commandAdapter;
+    if (executorMode === 'command') {
+        try {
+            const commandCwd = optionalStringFlag(parsed.flags, 'command-cwd');
+            commandAdapter = new CommandAllowlistAdapter({
+                commandId: commandId ?? '',
+                workspaceRoot,
+                targetPaths: commandTargets,
+                ...(commandCwd === undefined ? {} : { cwd: commandCwd }),
+            });
+        }
+        catch (error) {
+            return resultFailure(validationFailure(error instanceof Error ? error.message : 'Command allowlist adapter rejected the request.'));
+        }
+    }
+    const operation = {
+        category: executorMode === 'command' ? 'shell' : 'provider-tool',
+        operation: executorMode === 'command' ? `command-allowlist:${commandId}` : 'workflow-delegated-dispatch',
+        ...(executorMode === 'command' ? {} : { providerToolName: `${details.value.providerAdapter}:workflow-dispatch` }),
+        workspaceRoot,
+        agent: agent.value,
+        ambiguous: executorMode !== 'command',
+        input: toJsonValue({
+            runId: details.value.id,
+            project: details.value.project,
+            workflow: selected.id,
+            phase: details.value.phase,
+            userIntent: details.value.userIntent,
+            providerAdapter: details.value.providerAdapter,
+            model: details.value.model,
+            selectedAgentId: agent.value.id,
+            requestedBy: 'cli-workflow-execute',
+            ...(executorMode === 'command' ? { command: commandId, allowlistedCommand: commandAdapter?.plan.request.argv ?? [] } : {}),
+        }),
+    };
+    const preflight = service.preflightOperation({ runId: details.value.id, ...operation });
+    if (!preflight.ok)
+        return resultFailure(preflight);
+    if (preflight.value.outcome === 'approval-needed') {
+        const pending = recordWorkflowPendingApproval(service, details.value.id, operation, executorMode, preflight.value);
+        if (!pending.ok)
+            return resultFailure(pending);
+    }
+    const selectedAgentSummary = workflowRunAgentSummary(agent.value, {
+        policy: 'run-selected-agent',
+        reasons: ['run.selectedAgentId resolved to a real registry agent'],
+    });
+    const executor = executorMode === 'provider' || executorMode === 'command'
+        ? new GuardedProviderWorkflowExecutor({
+            ...(commandAdapter === undefined ? {} : { adapter: commandAdapter }),
+            capabilities: {
+                sandboxEnforceable: commandAdapter !== undefined,
+                processExecutionEnforceable: commandAdapter !== undefined,
+                workspaceBoundaryEnforced: commandAdapter !== undefined,
+                providerConfigWritesBlocked: commandAdapter !== undefined,
+            },
+        })
+        : new SafeNonDispatchingWorkflowExecutor();
+    const executorResult = executor.execute({
+        run: details.value,
+        workflow: selected,
+        selectedAgent: agent.value,
+        selectedAgentSummary,
+        workspaceRoot,
+        requestedOperation: operation,
+        preflight: preflight.value,
+        ...(commandAdapter === undefined ? {} : { sandboxExecutionEvidence: commandAdapter.plan.evidence }),
+        gates: {
+            validRunId: true,
+            workflowMatchesRun: true,
+            selectedAgentReal: true,
+            selectedAgentMatchesRun: true,
+            workspaceRoot,
+            confirmed: true,
+            escalationOverride: parsed.flags['override-escalation'] === true,
+        },
+        plannerRecommendation: { planner, recommendation },
+    });
+    const checkpoint = appendWorkflowExecutionCheckpoint(service, details.value.id, executorResult.checkpointLabel, executorResult.checkpointPayload);
+    if (!checkpoint.ok)
+        return resultFailure(checkpoint);
+    return jsonResult({
+        ok: true,
+        value: {
+            ok: true,
+            runId: details.value.id,
+            workflow: selected.id,
+            phase: details.value.phase,
+            status: executorResult.status,
+            dispatched: executorResult.dispatched,
+            dispatchMode: executorResult.dispatchMode,
+            executorId: executorResult.executorId,
+            executorKind: executorResult.executorKind,
+            reason: executorResult.reason,
+            message: executorResult.message,
+            selectedAgent: selectedAgentSummary,
+            preflight: {
+                outcome: preflight.value.outcome,
+                decision: preflight.value.decision,
+                audit: preflight.value.audit,
+                eligibleForFutureExecution: preflight.value.eligibleForFutureExecution,
+                safety: preflight.value.safety,
+            },
+            executorAudit: executorResult.audit,
+            checkpointId: checkpoint.value.id,
+            safety: workflowExecutionSafety(true),
+            nextAction: executorResult.nextAction,
+        },
+    });
+}