corbitsdev · TheGreatAxios · Aug 20, 2026 · Aug 20, 2026 · Aug 20, 2026
diff --git a/VENDORED.md b/VENDORED.md
diff --git a/docs/revendor-inventory.md b/docs/revendor-inventory.md
@@ -311,3 +311,72 @@ still applies to all 20 rows), but it does close the gap to the run-first /
 self-anchored-run model the workbench-side workarounds were built against,
 which is where the eventual retirement payoff sits once the STILL-OPEN items
 above get their own passes.
+
+## CL-6324 re-pin: `59f5e7b9` → `4ed8baf4` (the workflow.json retirement)
+
+The vendored trees are re-copied at upstream `main` tip `4ed8baf4`
+(2026-08-19, 45 commits on). `VENDORED.md` is the pin of record. This
+section is the map of what the bump costs on the workbench side, because
+the app-side conversion does **not** land with it.
+
+### What landed cleanly
+
+- All 21 `vendor/intx/*` rows re-copied. Only nine trees actually changed
+  (`hub-sessions`, `workflow-host`, `workflow`, `workflow-deploy`, `types`,
+  `hub-api`, `db`, `agent`, `hub-agent`); the other twelve are byte-identical
+  at both commits and were re-pinned so the ledger records one commit rather
+  than a mix (this also collapses `inference-catalog`'s separate `5d2aa94a`
+  pin).
+- Every workbench-local delta re-applied unchanged — upstream subsumed none
+  of them, and none of the five files they touch was modified upstream in the
+  45 commits: the `inference.usage` forward, `ownsWorkflowRunRepo`,
+  `hasConversationText`, and the `needs-you` approval-route carve-out. Their
+  tests pass.
+- `packages/folded-runs`' `wrapHarnessAsSingleStepWorkflow` call moved onto
+  `buildSingleStepAgentDefinition`, which survives the deletion.
+
+### What the bump breaks, and why it is one migration
+
+Upstream retired the on-disk `workflow.json`. A deployed workflow's
+definition is no longer serialized into the deploy tree and re-read by the
+sidecar; it is evaluated from the deployment's own **source closure** and
+re-verified in-child against the approved wire hash. Source-ref is now the
+only deploy lineage, and the live-authored and instance chains are deleted:
+`createWorkflowDeployOrchestrator`, `SessionService.deploySingleStepAtHead`,
+`SessionService.deployInstanceAtHead`, `wrapHarnessAsSingleStepWorkflow`,
+`createWorkflowSpawnChild`, `createWorkflowSpawnSuspendableChild`,
+`loadVerifiedWorkflowDefinition`, and the `definition` field on the deploy
+frame. `SpawnTimeEnv` drops `referencedDefinitionHashes` and gains
+`closurePackageDir`; `RunWorkflowChildBindings` drops
+`workflowDefinitionRepoId`.
+
+Workbench has no code-sourced deploy front. Every run it launches — chat,
+tasks, routines, agent lifecycle — goes through `packages/folded-runs`'
+`deployAtHead`, which synthesizes a single-step definition in memory from a
+system prompt plus tool-package pins and hands it to `deploySingleStepAtHead`.
+The new front (`deployWorkflowFromSource` / `installAndApproveWorkflowSource`
+/ `deployPreparedCodeSourcedWorkflow`) takes a registry `name@range` pin or
+an asset tarball and resolves a dependency closure from it. Converting means
+giving a folded run a real source package, not renaming a call.
+
+That is why the remaining breakage cannot be split by tree:
+`hub-sessions` (deploy front), `workflow-deploy` (orchestrator), `types`
+(deploy frame), `workflow-host` (child definition load), `db` (frozen
+approval bundle, migrations 0082/0083) and `hub-api` (run trigger) all move
+together, and `apps/sidecar` reads the frame both sides write. Leaving any
+one on the old pin leaves the frame contract split down the middle.
+
+Open conversion sites, all blocked on that one decision:
+
+| Site                                                                                    | What it needs                                                                                     |
+| --------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
+| `packages/folded-runs/src/launch.ts` (`deployAtHead`), `wake.ts`                        | A code-sourced deploy for the folded single-step run — the root blocker.                          |
+| `apps/sidecar/src/workflow-host-wiring/index.ts`, `asset-materialization.ts`            | Stop writing `workflow.json` and stop reading `projection.definition`; stage the closure instead. |
+| `apps/sidecar/src/workflow-substrate-factory/index.ts`, `child-runtime.ts`, `config.ts` | Drop `WORKFLOW_DEFINITION_REPO_ID`/`_REF`; in-memory child spawn; `closurePackageDir` plumbing.   |
+| `apps/sidecar/src/workflow-deployment-record.ts`                                        | Drop `referencedDefinitionHashes`; carry the grant-walk snapshot.                                 |
+
+Upstream's own diff over the same span is the reference implementation:
+`apps/sidecar/src/workflow-substrate-factory.ts` and
+`workflow-host-wiring.ts` at `4ed8baf4` show every one of these conversions
+against the same contracts, and `apps/sidecar`'s `VENDORED.md` row stays at
+`59f5e7b9` until workbench's fork is reconciled with them.
diff --git a/packages/folded-runs/src/launch.ts b/packages/folded-runs/src/launch.ts
@@ -28,7 +28,7 @@ import { generateId } from "@intx/hub-common";
 import { InferenceSource } from "@intx/types/runtime";
 import type { WireGrantRule } from "@intx/types/grant-wire";
 import {
-  wrapHarnessAsSingleStepWorkflow,
+  buildSingleStepAgentDefinition,
   type FoldedBody,
 } from "@intx/workflow-deploy";
 import { defineWorkflow, step, type Selector } from "@intx/workflow";
@@ -279,15 +279,23 @@ export async function deployAtHead(
   };
   const deployContent = { systemPrompt: params.foldedBody.systemPrompt };
   // A folded run is a conversation: its one step must service every
-  // inbound mail as another turn, never complete after the first. The
-  // platform's `deployInstanceAtHead` wraps the agent as a step with the
-  // default trigger budget of 1 (batch), which is exactly what made every
-  // chat go silent after its first real reply — so the folded launch
-  // builds the same single-step workflow itself, with the budget
-  // declared, and deploys it through the same head deploy.
+  // inbound mail as another turn, never complete after the first. A wrap
+  // with the platform's default trigger budget of 1 (batch) is exactly what
+  // made every chat go silent after its first real reply — so the folded
+  // launch builds the single-step agent itself, with the budget declared,
+  // and deploys it through the same head deploy. The launch pins its tools
+  // as packages rather than factories, so the step agent carries none.
   const foldedSteps = {
     [FOLDED_STEP_ID]: step({
-      agent: wrapHarnessAsSingleStepWorkflow({ config, deployContent }),
+      agent: buildSingleStepAgentDefinition({
+        id: config.agentId,
+        systemPrompt: deployContent.systemPrompt,
+        inferencePreferences: config.sources.map((source) => ({
+          provider: source.provider,
+          model: source.model,
+        })),
+        toolFactories: [],
+      }),
       triggers: "unbounded",
       ...(params.stepInput !== undefined ? { input: params.stepInput } : {}),
     }),

diff --git a/scripts/checks/kill-dates.txt b/scripts/checks/kill-dates.txt
@@ -14,27 +14,27 @@
 # drift: editing a vendored tree means updating this hash and the
 # package's VENDORED-FROM delta line in the same change.
 apps/sidecar | sawyer | 2026-09-14
-vendor/intx/agent | sawyer | 2026-09-14 | 478b17dfc4e71da8c7b15b51bdf74d6476459e58c7a251aa3eaabfdda6276d45
-vendor/intx/authz | sawyer | 2026-09-14 | 38d6760b35a9ce4ccbadc07b1d4d1d24fbe50dbde2200179009035b7c08bf2ec
-vendor/intx/crypto | sawyer | 2026-09-14 | 98cec0405dec9eadc8daeae161231b9bc980cb076daf43ef4f617a3b1c1d7096
-vendor/intx/db | sawyer | 2026-09-14 | 0841456d5d983773847e442af0813db12705978e866adebe6d3dceed1a6952a8
-vendor/intx/harness | sawyer | 2026-09-14 | 70e6b3dccca2d596c3992911e4515da7f08c2d5df8815c582ea970671c9424ce
-vendor/intx/hub-agent | sawyer | 2026-09-14 | 4426f2436a79e98e29f9ba562895e7d909cb685117af16f0fdb7eaa6a2bfcdbb
-vendor/intx/hub-api | sawyer | 2026-09-14 | f821fb1204ba73892d9f0b5f40fcd4ccdbf14b33ce52f077031f053efd31189b
-vendor/intx/hub-common | sawyer | 2026-09-14 | adf9027bab1c7ebfb627b739c22fd1ce1aeec826ba12c4288564f843bee788f1
-vendor/intx/hub-sessions | sawyer | 2026-09-05 | e3c2e39bfbb8d483271bf2030ecf8c920927a3a3a0ac32b6f25fb47795abab1a
-vendor/intx/inference | sawyer | 2026-09-14 | a4092dc6a43afb1870fe1e47fa6d27433cab25f7ab857ce386c37c71c5610717
-vendor/intx/inference-catalog | sawyer | 2026-09-14 | 7b8fdcc0357d40f265609ddd8b75f517d94d4e0662617e9f9c59aba6e5bfe5cd
-vendor/intx/log | sawyer | 2026-09-14 | b91343965c0feea11051c7f62a7b71e218330c299ef78ba9ef35e663527e6bc3
-vendor/intx/mail-memory | sawyer | 2026-09-14 | 7cd5416cec904d904cf3f8e183b7417cd1bfee85f800031d85fc0d302ce3d744
-vendor/intx/mime | sawyer | 2026-09-14 | 28fbfaf77bd90eeaa2c58735dc8583df7a7fd85327d6489c153b93cdb56b5b76
-vendor/intx/pack-transport | sawyer | 2026-09-14 | 81f230269ae916111bd7242698f4e40c4eb49934cebea47fb16d80dd78e13348
-vendor/intx/storage-isogit | sawyer | 2026-09-14 | 26f30a4fd27645a620bded1e9359fbb8d87d20f759b9e02c52e213efb459ca73
-vendor/intx/tool-packaging | sawyer | 2026-09-14 | 47f29256729105eebab38b23b7326ec9fadc9ebcb9ab460eeba44f94a86d7e45
-vendor/intx/types | sawyer | 2026-09-14 | 29d8a7b2589979a04a38706e40e14491a4c57856d6368f74e944c386afed2ef7
-vendor/intx/workflow | sawyer | 2026-09-14 | 81af2a4cb3669540b98d31a9a530908fb701a2a19da94ae69dcbe55a58f8f73b
-vendor/intx/workflow-deploy | sawyer | 2026-09-14 | de72de087e7b499d42b69b7eae6185a4c5448c34a02d3c21badf7c6d0ad3b66d
-vendor/intx/workflow-host | sawyer | 2026-09-14 | 418ffc162cec5de706fcb8082f0afea6318e89c8ffe71ff010bce1da060bcc59
+vendor/intx/agent | sawyer | 2026-09-14 | 797f8aa6a6fb3986c3c8c3e4df396e1378294b21411a24089e8ddb19d5df304e
+vendor/intx/authz | sawyer | 2026-09-14 | 9d760ef9b5037cead31a2224821e5913c8e7eb66d851271d36a473d4a0e68337
+vendor/intx/crypto | sawyer | 2026-09-14 | 7280b002b09da04b81a53d413580c88c8786f02310408a67f1187b9ca519aba5
+vendor/intx/db | sawyer | 2026-09-14 | 8c8f5379799d6549daba0237db0a830f91fed4ccdbcdde015b645f4d714781bc
+vendor/intx/harness | sawyer | 2026-09-14 | af9b270a297ae1dc6d8684da9005ec9d3d6220d1679e5f569086ef313e17f371
+vendor/intx/hub-agent | sawyer | 2026-09-14 | 6402193dfe48dce3525c9b233bd6974e566df57ff5bc209128633af92abe8b17
+vendor/intx/hub-api | sawyer | 2026-09-14 | 7d82a625c852b9e9bb13fd59e71c6c45be792bcbb9ebb5994586e97840dc66c1
+vendor/intx/hub-common | sawyer | 2026-09-14 | 0e2d71d4754713538d7fd6451c8648c6b277390abfc888e605499fc004ce0349
+vendor/intx/hub-sessions | sawyer | 2026-09-05 | daaf9b2626e3fe66c530d025621c2067ac05716846deb9864c1a3400f6518b29
+vendor/intx/inference | sawyer | 2026-09-14 | f91ac6a6b9621888276c5d2c90bd8a0ff8f9c6d3ce3ad67dd3ba57fdd9c01b0f
+vendor/intx/inference-catalog | sawyer | 2026-09-14 | 6e2ef3af83eafafdf1b773725afcb724cbb712604266919ecd1d67d50ff8016a
+vendor/intx/log | sawyer | 2026-09-14 | 17ba64f2ff751b640dd2db9eb034450876c435f43641b022fbc4a2e9aa9da04d
+vendor/intx/mail-memory | sawyer | 2026-09-14 | 7bac2d26cddc55f3c209ae8090391fac2d9d915bbbedfa9ff387a518c5690d0e
+vendor/intx/mime | sawyer | 2026-09-14 | c5e923b712e16ec8ce2cdc9e1f7fd63b124acff4f986731723e11556678b8cae
+vendor/intx/pack-transport | sawyer | 2026-09-14 | 94578a75112059d31960abdc0b12175f6955cff8a18f5cb549c3cee151525749
+vendor/intx/storage-isogit | sawyer | 2026-09-14 | a89b58687b8738620ce664e81a99250cba7b3bbaddbe0904661778fafef8d586
+vendor/intx/tool-packaging | sawyer | 2026-09-14 | a4f446a5712f906986ddc02b3a9fb133018d15ac661052026527263d942d0249
+vendor/intx/types | sawyer | 2026-09-14 | 21833d272f619f31371e80d752e22bdf8e1d31839169d7faec71240fb2db1139
+vendor/intx/workflow | sawyer | 2026-09-14 | 326a9e10693d5587cc35f9db0a7830b8037b2a81852b9b8bdd7bc276a5eb66fd
+vendor/intx/workflow-deploy | sawyer | 2026-09-14 | ee75c87a3f8141eaa83068ec29731f064b7f27ef108919aac81419755b9bc1e3
+vendor/intx/workflow-host | sawyer | 2026-09-14 | 6522cf5c3efcd8b482e0db418bfa3be350034c76cd63fa9fdd55d6e6718907f6
 
 packages/folded-runs | sawyer | 2026-11-01
 
diff --git a/vendor/intx/agent/VENDORED-FROM b/vendor/intx/agent/VENDORED-FROM
@@ -1,4 +1,4 @@
 Source: https://github.com/faremeter/interchange (packages/agent)
-Commit: 59f5e7b9d94e7bcccfc180e7d9d11434e2e18eec
+Commit: 4ed8baf4789d4b51fcff7f03e1f6146ab45b9f2b
 License: LGPL-2.1-only (see vendor/intx/LICENSE)
 Local modifications: exports map repointed from the upstream intx-src condition to direct TypeScript source resolution (types/default -> ./src/...); dist references removed.
diff --git a/vendor/intx/agent/src/definition.ts b/vendor/intx/agent/src/definition.ts
@@ -55,6 +55,19 @@ export interface AgentDefinition<EnvReq extends BaseEnv = BaseEnv> {
   readonly systemPrompt: string;
   readonly director?: DirectorRef;
   readonly toolFactories: readonly AnnotatedToolFactory<EnvReq>[];
+  /**
+   * Tool-package names whose `definePlugin` factories this agent uses
+   * (`["@intx/tools-lsp"]`). Unlike a tool factory -- which the agent
+   * imports and places in `toolFactories`, so it is agent-visible -- a
+   * plugin package contributes NO agent-visible factory: its plugin
+   * factory reaches the agent only through `env.plugins`, wired by the
+   * host. This explicit per-agent list is therefore the only way per-step
+   * plugin scoping and the plugin's contributed tool grants can be known
+   * from the definition alone. The field is part of the hashed wire
+   * surface (the live->inert projector carries it), so a tampered plugin
+   * set fails re-verify. Absent when the agent uses no plugins.
+   */
+  readonly plugins?: readonly string[];
   readonly capabilities: readonly string[];
   readonly inference: {
     readonly sources: readonly InferencePreference[];
@@ -143,6 +156,8 @@ export interface DefineAgentConfig<
   readonly systemPrompt: string;
   readonly director?: DirectorRef;
   readonly tools: Factories;
+  /** Plugin-package names this agent uses; see `AgentDefinition.plugins`. */
+  readonly plugins?: readonly string[];
   readonly capabilities: readonly string[];
   readonly inference: {
     readonly sources: readonly InferencePreference[];
@@ -174,6 +189,7 @@ export function defineAgent<
     toolFactories,
     capabilities: config.capabilities,
     inference: config.inference,
+    ...(config.plugins !== undefined ? { plugins: config.plugins } : {}),
     ...(config.description !== undefined
       ? { description: config.description }
       : {}),

diff --git a/vendor/intx/agent/src/tool.ts b/vendor/intx/agent/src/tool.ts
@@ -274,6 +274,20 @@ export const PLUGIN_MARKER: unique symbol = Symbol.for("@intx/agent.plugin");
 export interface AnnotatedPluginMeta {
   readonly id: string;
   readonly requires: readonly string[];
+  /**
+   * Static declaration of the tool names this plugin contributes at
+   * runtime, so a caller can enumerate the plugin's tool grant surface
+   * WITHOUT instantiating it (which for a plugin like LSP would start a
+   * language-server subprocess). A plugin adds its tools indirectly -- it
+   * hands a host-defined shape to the tool package that consumes
+   * `env.plugins`, which then registers the plugin's tools under its own
+   * bundle -- so the plugin's contributed tool names are otherwise
+   * invisible until run time. The deploy-time capability walk reads this
+   * field to authorize a plugin-contributed tool the same way it
+   * authorizes a factory-declared tool. Empty when the plugin contributes
+   * no standalone tool (middleware-only plugins).
+   */
+  readonly definitions: readonly ToolDeclaration[];
   readonly [PLUGIN_MARKER]: true;
 }
 
@@ -328,12 +342,21 @@ export function definePlugin<
 >(opts: {
   id: string;
   requires?: readonly string[];
+  /**
+   * Static declaration of the tool names this plugin contributes at run
+   * time. Omit for a middleware-only plugin that adds no standalone tool.
+   * See `AnnotatedPluginMeta.definitions`.
+   */
+  definitions?: readonly ToolDeclaration[];
   factory: PluginFactory<EnvReq, Result>;
 }): AnnotatedPluginFactory<EnvReq, Result & { kind: ToolPluginKind }> {
   validateNamespacedId(opts.id);
   const requires = Object.freeze([
     ...(opts.requires ?? []),
   ]) as readonly string[];
+  const definitions = Object.freeze([
+    ...(opts.definitions ?? []),
+  ]) as readonly ToolDeclaration[];
   const wrapped: PluginFactory<EnvReq, Result & { kind: ToolPluginKind }> = (
     env,
   ) => {
@@ -346,6 +369,7 @@ export function definePlugin<
   return Object.assign(wrapped, {
     id: opts.id,
     requires,
+    definitions,
     [PLUGIN_MARKER]: true as const,
   });
 }

diff --git a/vendor/intx/authz/VENDORED-FROM b/vendor/intx/authz/VENDORED-FROM
@@ -1,4 +1,4 @@
 Source: https://github.com/faremeter/interchange (packages/authz)
-Commit: 59f5e7b9d94e7bcccfc180e7d9d11434e2e18eec
+Commit: 4ed8baf4789d4b51fcff7f03e1f6146ab45b9f2b
 License: LGPL-2.1-only (see vendor/intx/LICENSE)
 Local modifications: exports map repointed from the upstream intx-src condition to direct TypeScript source resolution (types/default -> ./src/...); dist references removed.
diff --git a/vendor/intx/crypto/VENDORED-FROM b/vendor/intx/crypto/VENDORED-FROM
@@ -1,4 +1,4 @@
 Source: https://github.com/faremeter/interchange (packages/crypto)
-Commit: 59f5e7b9d94e7bcccfc180e7d9d11434e2e18eec
+Commit: 4ed8baf4789d4b51fcff7f03e1f6146ab45b9f2b
 License: LGPL-2.1-only (see vendor/intx/LICENSE)
 Local modifications: exports map repointed from the upstream intx-src condition to direct TypeScript source resolution (types/default -> ./src/...); dist references removed.
diff --git a/vendor/intx/db/VENDORED-FROM b/vendor/intx/db/VENDORED-FROM
@@ -1,4 +1,4 @@
 Source: https://github.com/faremeter/interchange (packages/db)
-Commit: 59f5e7b9d94e7bcccfc180e7d9d11434e2e18eec
+Commit: 4ed8baf4789d4b51fcff7f03e1f6146ab45b9f2b
 License: LGPL-2.1-only (see vendor/intx/LICENSE)
 Local modifications: exports map repointed from the upstream intx-src condition to direct TypeScript source resolution (types/default -> ./src/...); dist references removed.
diff --git a/vendor/intx/db/migrations/0082_blue_black_queen.sql b/vendor/intx/db/migrations/0082_blue_black_queen.sql
@@ -0,0 +1 @@
+ALTER TABLE "workflow_definition_version" ADD COLUMN "grant_snapshot" jsonb;
diff --git a/vendor/intx/db/migrations/0083_replace_launch_spec_snapshot_with_frozen_bundle.sql b/vendor/intx/db/migrations/0083_replace_launch_spec_snapshot_with_frozen_bundle.sql
@@ -0,0 +1,3 @@
+ALTER TABLE "workflow_run_launch_spec" ADD COLUMN "frozen_approval_bundle" jsonb NOT NULL;--> statement-breakpoint
+ALTER TABLE "workflow_run_launch_spec" DROP COLUMN "definition_snapshot";--> statement-breakpoint
+ALTER TABLE "workflow_run_launch_spec" DROP COLUMN "definition_hash";
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		ALTER TABLE "workflow_definition_version" ADD COLUMN "grant_snapshot" jsonb;