[rockyshi1993]

M2 of confirmed P0-A plan. Adds a deterministic JS emitter for M1's real-analyzer IR, an immutable-byte SHA-256 Program identity, a zero-import ESM loader with AST rejection of static/dynamic imports and Function.toString byte-consistency validation, and an internal compileInteractive memory/file compiler. No Store, Coordinator, Public SDK subpath or side-effecting Host operations introduced. Existing Standard run and public exports unchanged. New ESM, Condition/Terminal, Agent-phase, source identity and loader-adversarial tests. Review and CI required before squash merge; do not start M3 until M2 gate passes.

---

Note

Medium Risk
New compiler output and a loader that executes verified JS via dynamic import; security depends on hash/AST checks and IR validation, but this expands the trusted execution surface for interactive workflows.

Overview
Introduces M2 of the interactive P0-A pipeline: workflows can be compiled into deterministic, import-free ESM with a SHA-256 artifact identity and loaded only from verified bytes.

emitInteractive turns validated interactive IR into a frozen standalone module exporting interactiveProgram, programTable, and a synchronous advance state machine (conditions via inlined evaluateWhenAst, agent frame/retry/commit flow, terminal routing). compileInteractive wires analyze → lower → emit for .workflow.js/.ts, supporting memory or atomic file output (*.interactive.mjs) without executing the DSL source.

loadInteractiveProgram enforces digest match, size limits, zero static/dynamic imports, export shape, advance body byte-consistency, and re-validates the embedded program table against the interactive IR rules. identity helpers standardize SHA-256 handling. Packaging and emitter.test.mjs cover determinism, routing semantics, agent transitions, loader hardening, and the compile API.

^{Reviewed by Cursor Bugbot for commit 7578cc7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[rockyshi1993]

M2 implementation self-review (review gate; not an independent external approver):

• Scope limited to executable Program ABI V1 emission, immutable program identity, same-byte loader and internal compile API. No M3–M6/runtime APIs leaked.
• Fixes made during review: nested AST ImportExpression traversal; compile-option upfront own-data snapshot; static ProgramTable/IR revalidation at load.
• Runtime and identity checks: zero module imports, exact hash, advance Function#toString equality, original evaluateWhenAst inlined from Standard implementation, checked phase/edge/failed-when behavior, Agent frame/attempt and candidate commitment proposal rules.
• CI #42820318617: Ubuntu 24.04 / Windows 2025 × Node 22.13.0 / 24.22.1 all PASS 283/283; website PASS; existing Standard exports unaffected.
• M3–M6 (Store, Coordinator, auth and public SDK) are intentionally not asserted to exist. No external exactly-once claim.

Verdict: PASS for M2 milestone; ready for squash merge only. Documentation and model-host safety gates remain in later milestones.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7578cc7. Configure here.}

[cursor]

Embedded JSON mishandles proto keys

High Severity

emitInteractive splices JSON.stringify(manifest) and JSON.stringify(table) into generated object literals. A quoted "__proto__" key is a prototype setter in JavaScript, so own __proto__ keys in Agent output schemas are dropped and the object's prototype is replaced. loadInteractiveProgram then rejects the table as untrusted metadata, so programs that M1 already preserves fail to load.

 

^{Reviewed by Cursor Bugbot for commit 7578cc7. Configure here.}

[cursor]

Loader rejects valid schema keys

Medium Severity

ownJSON throws on constructor or prototype keys while copying programTable. Those names are valid JSON Schema property keys and are already preserved by the Standard analyzer, dataflow, and M1 IR. A compiled Program whose Agent output lists them cannot be loaded even though the copy target is a null-prototype object.

 

^{Reviewed by Cursor Bugbot for commit 7578cc7. Configure here.}

[cursor]

Compiler uses wrong project root

Medium Severity

compileInteractive passes projectRoot: path.dirname(filename) into analyzeSource, which skips resolveProjectRoot's walk to package.json. Skill checks then resolve skills/ next to the workflow file instead of the project root. Agent workflows in a subdirectory fail with missing-skill diagnostics, and callers cannot override projectRoot or skillsRoot.

 

^{Reviewed by Cursor Bugbot for commit 7578cc7. Configure here.}