Replaces the U1 stub. All four contract subcommands are now functional:

* prepare <workdir> [<runner_config_json>]
  Honors EVAL_SKIP_VENV_PREPARE=1 (test mode). Otherwise creates a venv
  at EVAL_VENV_DIR (default <workdir>/.venv), pip installs
  <workdir>/requirements.txt if present, and import-checks the module
  named in entry_point. EVAL_VENV_CACHE=1 reuses a per-requirements-hash
  cache at EVAL_VENV_CACHE_DIR (or ~/.cache/eval-harness/langgraph-venv).
  Cross-platform venv binary resolution: POSIX bin/python3 vs Windows
  Scripts/python.exe.

* spawn <workdir> <input> <output> <transcript> [<runner_config_json>]
  Parses entry_point from the config JSON, invokes
  `<venv-python> -m <module> --input <X> --output <Y>` with PYTHONPATH
  prepended to the workdir, captures stdout/stderr, and emits JSONL
  events with shape compatible with opencode --format json (so
  score.sh's output_contains / transcript_contains / jq_path_contains
  work unchanged). Exits 13 with a clear error event on missing or
  malformed entry_point; echoes the elapsed_seconds in a result event
  on success.

* fingerprint <module_path>
  Stable 64-char hex sha256 over (a) the entry-point module, (b) any
  tools/*.py in the workdir, (c) any prompt_template_*.txt, and (d) the
  bodies of @tool-decorated top-level functions (adjacency check: a def
  only counts if the immediately preceding line is @tool). Returns
  'no-module' on missing arg/file so the manifest stays valid; never
  fails the run on a fingerprint glitch.

* teardown <workdir>
  rm -rf the venv unless EVAL_VENV_CACHE=1. Idempotent.

Helpers (_resolve_venv_python, _cache_root, _parse_entry_point,
_requirements_hash, _now_iso) keep the subcommand bodies readable. CLI
guard at the bottom allows direct invocation (`bash langgraph-node.sh
<sub> <args>`) for test and debug use; dispatch via lib/runner.sh is
unchanged.

* lib/spawn.sh: spawn_runner now echoes the spawn's exit code on stdout
  (matches spawn_opencode's contract so run.sh's `$(spawn_runner ...)`
  capture works for both opencode and non-opencode runners), and
  deliberately does NOT return the non-zero code (the caller is under
  `set -e` inside a command substitution — a non-zero return would
  kill the harness before it can write checks.json).

* run.sh: langgraph-node case now passes the full runner_config JSON
  as the 5th arg to spawn_runner (per the plan's spawn signature).
  Same change for the stability-sample re-spawn at the bottom of the
  case loop.

Verified by direct invocation: all 4 subcommands produce expected
exit codes and outputs; spawn happy-path invokes the graph, writes
output.json, and emits start/result events; spawn with missing
entry_point exits 13 with a clear error event; fingerprint is stable
across runs and changes when @tool bodies change.

Closes U2 of nano-step#36.

Two pre-flight bugs that blocked langgraph-node e2e on Windows:

1. python3 os.path.normpath returns backslashes on Windows, but the
   subsequent bash prefix check used forward slashes — so 'graph.py'
   was rejected as 'resolves outside workdir' even though it resolved
   inside the workdir. Now we replace os.sep with '/' after normpath,
   which is a no-op on POSIX and fixes Windows.

2. jq on Windows emits CRLF line endings, so the trailing \r ended up
   inside the 'src' variable after the fixture-loop read. Subsequent
   [[ -f "$src\r" ]] checks then failed for files that existed.
   Strip the CR after the read.

Both fixes are runner-agnostic; they're pre-work for U3's example
case where the langgraph graph.py is materialized via the fixture
mechanism. Found while bringing up the U3 e2e test.

Co-Authored-By: Claude <noreply@anthropic.com>

Demonstrates the 3 check kinds the langgraph-node runner supports,
sharing one stubbed graph. R6 (graph size constraint) honored at 48
lines. R2 (case YAML fields) honored: runner: + runner_config:.

Files:
  examples/langgraph-runner/graph.py          — stubbed LangGraph-compatible
                                                 graph with a no-op @tool
                                                 (exercises fingerprint's
                                                 tool-detection path)
  examples/langgraph-runner/input.json        — sample input
  examples/langgraph-runner/requirements.txt  — langgraph>=0.2
  examples/langgraph-runner/cases/shell-basic.yaml
                                              — file_exists + 2 shell
                                                 checks (kind: shell)
  examples/langgraph-runner/cases/jq-path-contains.yaml
                                              — kind: jq_path_contains on
                                                 output.json sources array
  examples/langgraph-runner/cases/output-contains.yaml
                                              — kind: output_contains
                                                 on the graph's stdout
                                                 marker

The jq_path_contains check uses the array-constructor form
`[.sources[]] | unique` (not `$.sources[*]` as the plan suggested)
because jq 1.8.1 on Windows rejects the bracket-glob syntax. The
score script does set-difference on the jq result, which needs a
single array. `[` ... `]` collects the stream into an array.

Verified:
  - graph.py runs end-to-end (python3 -m graph --input X --output Y)
    and produces {"answer": ..., "sources": [...]}
  - fingerprint is stable across calls and detects @tool body changes
  - all 3 case YAMLs parse via yq; checks list and runner_config
    serialize cleanly to JSON

Co-Authored-By: Claude <noreply@anthropic.com>

U4: scripts/eval/tests/runner_langgraph.sh — end-to-end test for the
langgraph-node runner. Stubs python3 and yq via PATH-prepend; stages
the U3 example into a temp OPENCODE_SKILLS_ROOT. 6 assertions:
  - All 3 example cases PASS under the stubbed graph
  - All 4 subcommands fire (trace log of stub calls)
  - SKILL_CHANGED attribution when graph.py mutates
    (e2e env_delta + unit attribute() with the right keys)
  - MODEL_CHANGED attribution when langgraph_version bumps
  - FIXTURE_STALE attribution when input.json mutates
  - No ANTHROPIC_API_KEY required; EVAL_FAIL_ON_NO_LLM=1 is OK

U5: docs/runners.md — documents the runner contract. 8 sections:
what a runner is, the 4-subcommand contract, authoring steps, the
langgraph-node adapter's knobs, case YAML extensions, manifest and
attribution, examples, and shipped-vs-proposed status.

Co-Authored-By: Claude <noreply@anthropic.com>

Real-LangGraph smoke test: when EVAL_RUN_REAL_LANGGRAPH=1, this builds
a fresh venv, installs langgraph from examples/langgraph-runner/
requirements.txt, and runs the shell-basic case end-to-end. Skips
cleanly (exit 0) in normal CI. Covers R7b in the plan.

Co-Authored-By: Claude <noreply@anthropic.com>

The graph definition is the agent's 'skill', not a model. When the
graph source changes, attribution should be SKILL_CHANGED per the
docs/runners.md contract. This aligns attribute.sh with the documented
behavior.

Three independent fixes in the runner, all on the same file:

- U3 (_parse_entry_point): strip a trailing '.py' from the module
  component so authors can write 'graph.py:run' as documented.

- U4 (langgraph_node_fingerprint): change signature from <module_path>
  to <workdir> <config_json> to match the runner contract in
  docs/runners.md. Extract module_file from config_json.module (default
  'graph.py'). Build a files_to_grep array so an empty 'tools/*.py' glob
  no longer passes a literal glob string to grep.

- U6 (langgraph_node_spawn): absolutize workdir/input/output/transcript
  before 'cd "$workdir"' so relative paths resolve correctly against
  the original $PWD, not the post-cd one.

…view)

The preflight loop iterated CASE_FILES at the top of run.sh, but
CASE_FILES is defined ~30 lines later. So _NEEDED_RUNNERS was always
empty, silently bypassing preflight for every runner — including the
default opencode one. Move the scan to a local pre-scan that resolves
the cases directory from skills_root + SKILL (+ optional CASE_ID),
populates _NEEDED_RUNNERS, then dispatches preflight for each.

… review)

run.sh no longer pre-resolves module_path or walks FIXTURES_DIR. The
fingerprint subcommand now matches the documented contract
'<name>_fingerprint <workdir> <config_json>' and owns its own path
resolution (default module_file 'graph.py', overridable via
config_json.module).

Locks in:
- 7a: graph_fingerprint alone classifies as SKILL_CHANGED
- 7b: graph_fingerprint + langgraph_version → SKILL_CHANGED wins
- 7c: langgraph_version alone still MODEL_CHANGED (regression)
- 7d: _parse_entry_point strips trailing .py from module
- 7e: _parse_entry_point no-op when no .py (regression)
- 7f: langgraph_node_fingerprint stable across config_json forms
- 7g: missing module_file returns 'no-module'
- 7h: missing workdir returns 'no-workdir'
- 7i: CLI guard emits 64-char hash for the new argv shape