[rockyshi1993]

M4 scope — confirmed P0-A only

Implements a host-owned createInteractiveCoordinator with start / complete / resume / load, scoped under @devcodex-labs/flowkit/interactive. Preserves all six existing Standard root exports and their contracts.

• Compiler-emitted immutable JS Program controls legal routing, phase transitions, and Agent frame effects; Coordinator checks every proposal against programTable, never lowers DSL again at runtime.
• Verified immutable Program bytes are stored before the initial Run; startKey is idempotent and scoped by namespace and intent.
• Every stage transition is an atomic checkpoint+Journal CAS; Agent tasks are prepared, persisted, published and delivered only after a successful CAS.
• Host-only complete accepts typed Agent result/failure with runId / requestId / nodeId / attempt; receipt digest and acceptedRevision committed before validating; duplicates after later advancement receive durable acknowledgment.
• Pure-local synchronous result validation, retries up to retries+1, deterministic errored exit for bad validator, missing when operands, and retry exhaustion; State merges only on validated commit.
• Reopen/resume by run ID using stored bytes and policy hash, no DSL source required. Explicit stage budget returns resumable paused, never fake waiting.
• Formal subpath declarations, installed-package smoke test, and TypeScript negative contracts.

Non-goals

• No runAgent executed internally, no automatic model orchestration, no Human/Action/Verification/Loop/Parallel.
• M5 trusted Host approval, provenance, and transport hardening are not claimed or bypassed.
• No P0-B/P1/P2, publishing, deployment, or Standard root contract changes.

Mandatory gate

Run real Ubuntu 24.04 / Windows 2025 × Node 22.13.0 / 24.22.1 npm run verify, documentation consumers, website checks. Review all code diffs, retry and crash boundaries, reject P0/P1 issues, fix and retest before squash merge.

---

Note

High Risk
Introduces durable workflow execution, checkpoint integrity, and host-only receipt acceptance on top of SQLite CAS—security- and data-consistency–sensitive behavior with a large new coordinator surface area.

Overview
Adds @devcodex-labs/flowkit/interactive as a separate, host-owned execution surface while the six Standard root APIs stay unchanged. createInteractiveCoordinator drives immutable compiled Programs via start / complete / resume / load, with phase-by-phase SQLite compare-and-swap checkpoints, durable Agent pending publication, receipt-before-validate handling, synchronous host validation, retries, explicit stage-budget pauses, and idempotent duplicate receipts.

Packaging and contracts now ship ./interactive (build manifest, export checks, types/interactive.d.ts, consumer smoke test). docs/interactive.md documents P0-A scope, invariants, and integration boundaries. New coordinator and index modules wire the coordinator next to existing interactive compile/load/store pieces. Coordinator, crash (SIGKILL), and type negative tests cover routing, tenancy, policy pinning, concurrency, and recovery.

^{Reviewed by Cursor Bugbot for commit 90dbd55. Bugbot is set up for automated code reviews on this repo. Configure here.}

[rockyshi1993]

M4 gate: source review, negative proofs and verified CI — 2026-11-10 UTC

Reviewed commit: 90dbd5534f3d05b999c2c50b15e90b4312610856
Base: 5cb1b741d4e6980758423a5a79ac80053e1a473d (M3).

Independent source/contract review

• Checked the 13 changed files: original Standard six root SDK APIs remain unchanged; Interactive is isolated under ./interactive, with packaged source/transitive import closure, declarations, TypeScript consumer and installed tarball smoke tests.
• Compiler-emitted Program ABI V1 remains the only routing authority; each returned proposal, target and stack effect is checked against immutable programTable before phase CAS. No runtime DSL re-lowering.
• Store is host-owned and namespace-scoped; Program artifact and policy hashes are pinned. Each phase/checkpoint CAS also appends the matching journal entry.
• pending is published only after a successful durable CAS; no runAgent or external side-effect call inside the Coordinator.
• Host complete verifies runId/requestId/nodeId/attempt, atomically accepts receipt digest and acceptedRevision before local validation, then advances. Same canonical body replays original acknowledgment after later stages; divergent payload fails closed.
• Result validation is synchronous and pure-local by contract, retries at most retries+1, and committed State is changed only at the verified commit phase. Missing when values, malformed pure validators and exhausted attempts have persistent errored states; per-call budget returns paused, not fake waiting.
• P0-B Human/Action/Verification/Loop/Parallel and M5 Host provenance are explicitly excluded; no substitute or auto-authorization implemented.

Findings closed during review

1. Primitive Agent result plus permissive validator could strand commit-state after receipt acceptance: now retries/rejects the object contract before validating the candidate as commit-ready.
2. Host-reported failure with a nonstring message could throw after persisted receipt: now rejected before acceptance, preserving checkpoint bytes.
3. Sparse/proxy/getter validator reasons could be accepted or throw later: canonical snapshot validation converts malformed pure-local output to errored(FK_I_VALIDATOR_CONTRACT).
4. P0-A receipt bound increased to accommodate all statically possible 500 Agent nodes × 11 attempts, rather than prematurely blocking a valid workflow.
5. Fault injection initially assumed a hardcoded revision at receipt acceptance; changed to phase-based before/after CAS cut points and reran.
6. Agent Pending now includes the Standard runAgent id alongside nodeId.

Actual evidence

Final candidate GitHub Actions run 42830624872 COMPLETED / SUCCESS at the reviewed HEAD: Ubuntu 24.04 and Windows 2025 × Node 22.13.0/24.22.1, plus website. Each matrix unit's npm run verify and documentation consumer job completed successfully. Verified full test output on Ubuntu and Windows Node 22: 317 tests / 317 PASS, 0 FAIL, 0 SKIP. The suite includes real independent Node processes racing complete, actual SIGKILL before/after Agent phase writes, result acceptance and commit, restart-only-from-artifact, tampered identity/tenant, invalid JSON, validator failures, Standard export regression and lost post-commit response recovery.

Gate outcome: No known remaining P0/P1 within M4's host-owned Coordinator scope. Important boundaries still open by design: M5 must enforce trusted Host identity/provenance and disclosure, skillResolver is trusted read-only code rather than a side-effect transport, and external providers are not exactly-once. M6 will supply final integrated host acceptance. The full V0.6-R5 design document was not present in this chat session, so this review is against confirmed P0-A invariants, actual compiler/store contracts, source diff, and tests—not claimed to be a line-by-line audit of inaccessible text. No npm publishing, public repo release or deployment authorized.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 90dbd55. Configure here.}

[cursor]

Async validator rejection can crash process

Medium Severity

validateCandidate detects a thenable from validateResult and maps it to FK_I_VALIDATOR_CONTRACT without catching the promise. A rejecting async validator therefore still surfaces as an unhandled rejection, which Node 22/24 can turn into a process abort after the run has already been marked errored.

 

^{Reviewed by Cursor Bugbot for commit 90dbd55. Configure here.}