@tacuchi/agent-workflow-cli 25.1.2 → 25.3.0

package/dist/domain/obligation-correspondence.js

@@ -0,0 +1,95 @@
+/**
+ * WHETHER A LEGACY OBLIGATION IS ACTUALLY A HANDOFF THE PLAN ALREADY DECLARED.
+ *
+ * A note published before obligations carried a class says only what the work
+ * is. Read as compensation — the safe half — it blocks a closure forever when
+ * the work was never this lineage's to do. And the plan very often says so
+ * already: it enumerates that same step under its operative handoff or its open
+ * questions, because whoever wrote the note was copying it from there.
+ *
+ * So the reading is an IDENTITY test over something the plan enumerates, never a
+ * judgement about words. No token list, no vocabulary, no similarity score: a
+ * detector of words would silently reclassify compensation as handoff the day
+ * somebody phrased it differently, and the failure would be a plan closing over
+ * work nobody did. Containment in either direction is what makes the test
+ * survive the two edits that actually happen — the note quoting a longer plan
+ * item, and the plan item quoting a shorter note — and the minimum length is
+ * what stops a common fragment from matching everything.
+ */
+/** Below this, a containment is a coincidence rather than a citation. */
+const MIN_CORRESPONDENCE_CHARS = 24;
+/**
+ * The sections of a plan whose items are handoffs by construction.
+ *
+ * `## Handoff` in any of its spellings (`## Handoff operativo` included) and the
+ * open questions: the first is work explicitly handed to somebody else, the
+ * second is work explicitly NOT taken on. Nothing else counts — a step named in
+ * the tasks is precisely the work the lineage owes.
+ */
+const HANDOFF_SECTION_RE = /^##\s+(handoff\b.*|open questions|preguntas abiertas)\s*$/i;
+const SECTION_RE = /^##\s+/;
+const FENCE_RE = /^\s*(?:```|~~~)/;
+const ITEM_RE = /^\s*(?:[-*+]|\d+[.)])\s+(.*)$/;
+const CHECKBOX_RE = /^\[[ xX]\]\s*/;
+/** Collapse every run of whitespace so a rewrap is not a different sentence. */
+function normalizeForCorrespondence(text) {
+    return text.replace(/\s+/gu, " ").trim();
+}
+/**
+ * The enumerated items of the plan's handoff and open-question sections.
+ *
+ * Enumerated and not "every line": prose under those headings is context, and
+ * matching against it would make a paragraph that merely mentions the work read
+ * as a declaration that somebody else owns it.
+ */
+export function planHandoffItems(planText) {
+    const items = [];
+    let inside = false;
+    let fenced = false;
+    for (const line of planText.split(/\r?\n/u)) {
+        // A fenced block is quoted text, not structure. Plans quote their own
+        // template, so a fence holding `## Handoff operativo` would otherwise open a
+        // section that does not exist and let its example lines pass as handoffs.
+        if (FENCE_RE.test(line)) {
+            fenced = !fenced;
+            continue;
+        }
+        if (fenced)
+            continue;
+        if (SECTION_RE.test(line)) {
+            inside = HANDOFF_SECTION_RE.test(line);
+            continue;
+        }
+        if (!inside)
+            continue;
+        const item = ITEM_RE.exec(line)?.[1];
+        if (item === undefined)
+            continue;
+        const normalized = normalizeForCorrespondence(item.replace(CHECKBOX_RE, ""));
+        if (normalized.length > 0)
+            items.push(normalized);
+    }
+    return items;
+}
+/**
+ * The plan item this obligation cites, or `null` when it cites none.
+ *
+ * Returning the item rather than a boolean is deliberate: a reading that
+ * reclassifies work has to be able to say WHICH line of the plan it read, or
+ * nobody can check it.
+ */
+export function correspondingPlanItem(text, items) {
+    const needle = normalizeForCorrespondence(text);
+    if (needle.length === 0)
+        return null;
+    for (const item of items) {
+        const shorter = needle.length <= item.length ? needle : item;
+        const longer = needle.length <= item.length ? item : needle;
+        if (shorter.length < MIN_CORRESPONDENCE_CHARS)
+            continue;
+        if (longer.includes(shorter))
+            return item;
+    }
+    return null;
+}
+//# sourceMappingURL=obligation-correspondence.js.map

package/dist/domain/obligation-correspondence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"obligation-correspondence.js","sourceRoot":"","sources":["../../src/domain/obligation-correspondence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,yEAAyE;AACzE,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAEpC;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,4DAA4D,CAAC;AACxF,MAAM,UAAU,GAAG,QAAQ,CAAC;AAC5B,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AACnC,MAAM,OAAO,GAAG,+BAA+B,CAAC;AAChD,MAAM,WAAW,GAAG,eAAe,CAAC;AAEpC,gFAAgF;AAChF,SAAS,0BAA0B,CAAC,IAAY;IAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,sEAAsE;QACtE,6EAA6E;QAC7E,0EAA0E;QAC1E,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,GAAG,CAAC,MAAM,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,MAAM;YAAE,SAAS;QACrB,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,MAAM,UAAU,GAAG,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,KAAwB;IAC1E,MAAM,MAAM,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,wBAAwB;YAAE,SAAS;QACxD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/domain/reconciliation.js

@@ -1,3 +1,4 @@
+import { correspondingPlanItem, planHandoffItems } from "./obligation-correspondence.js";
 /**
  * Project what the composed contract still owes.
  *
@@ -5,46 +6,162 @@
  * is the one place that already decided which notes are in force. Walking the
  * chain again here would be a second answer to that question.
  */
-export function reconciliationOf(contract, chain) {
+export function reconciliationOf(contract, chain, planText) {
     const resumeOf = new Map(chain.map((note) => [note.id, note.resume_point]));
+    // Read once for the whole reconciliation: every legacy obligation of one plan
+    // is judged against one reading of that plan's own enumerated handoffs.
+    const items = planText === undefined ? [] : planHandoffItems(planText);
     const pending = [];
+    const handoffs = [];
     for (const obligation of contract.obligations) {
         const resume = resumeOf.get(obligation.by);
         // An obligation whose note is not in the chain handed over cannot say where
         // to resume, and inventing a point would send the run somewhere nobody
         // decided. It stays pending — which is the safe half — and names its note.
-        pending.push({
+        const cited = obligation.declared ? null : correspondingPlanItem(obligation.text, items);
+        const entry = {
             text: obligation.text,
             by: obligation.by,
-            resume_point: resume ?? `${obligation.by} (nota ausente de la cadena)`,
-        });
+            index: obligation.index,
+            declared_point: resume ?? `${obligation.by} (nota ausente de la cadena)`,
+            // A declared class is the note's own word and is never second-guessed. An
+            // undeclared one reads as a handoff only when the plan itself enumerates
+            // that exact work; anything else keeps the safe reading.
+            kind: obligation.declared ? obligation.kind : cited === null ? "compensation" : "handoff",
+            legacy: !obligation.declared,
+            ...(cited === null ? {} : { corresponds_to: cited }),
+        };
+        (entry.kind === "handoff" ? handoffs : pending).push(entry);
     }
+    return { pending, handoffs, closable: pending.length === 0 };
+}
+/**
+ * WHAT A PLAN OWES AND HOW SOMEBODY GETS OUT OF IT — said once, for everybody.
+ *
+ * Three surfaces used to describe this one situation in three sets of words: the
+ * refusal that would not let the plan be sealed, the board's headline, and the
+ * action under the pipeline row. They drifted, as three texts about one fact
+ * always do — and the drift was not cosmetic. One of them sent the reader back
+ * to the point a note recorded at birth, one offered no command at all, and none
+ * of them mentioned the command that actually settles anything. So the exit is
+ * derived HERE, and each surface takes the part it renders.
+ *
+ * `null` means nothing is owed. Otherwise there is always a `command`: a refusal
+ * with no exit is a wall, and this whole phase exists because the board had one.
+ */
+export function obligationExit(reconciliation, context) {
+    const owed = whatIsOwed(reconciliation);
+    if (owed === null)
+        return null;
+    if (owed.repair !== undefined)
+        return unreadableExit(owed.text, owed.repair, context);
+    return owed.kind === "compensation"
+        ? compensationExit(owed.text, context)
+        : handoffExit(owed.text, context);
+}
+/**
+ * The first thing owed, and of which class — compensation before handoff.
+ *
+ * A plan owing both is held by the compensation, so that is what its exit has to
+ * be about; the handoff is still listed underneath. And "not closable with
+ * nothing named" is the composition refusing itself — reported as the shape it
+ * is, because falling through to the handoffs there would describe a plan that
+ * cannot be read as one that merely delegated some work.
+ */
+function whatIsOwed(reconciliation) {
+    const [compensation] = reconciliation.pending;
+    if (compensation !== undefined) {
+        return {
+            kind: "compensation",
+            text: named(compensation, reconciliation.pending.length),
+            ...(compensation.repair === undefined ? {} : { repair: compensation.repair }),
+        };
+    }
+    if (!reconciliation.closable) {
+        return { kind: "compensation", text: "el contrato efectivo no se puede componer" };
+    }
+    const [handoff] = reconciliation.handoffs;
+    if (handoff === undefined)
+        return null;
+    return { kind: "handoff", text: named(handoff, reconciliation.handoffs.length) };
+}
+/**
+ * How a surface says that a class is a READING, not the note's own word.
+ *
+ * One phrase for every surface that shows it, because two spellings of it is
+ * two answers to "did a person ratify this?" — and that question is the whole
+ * point of keeping the distinction.
+ */
+export function readingMark(kind) {
+    return `clase no declarada, leída ${kind === "handoff" ? "traspaso" : "compensación"}`;
+}
+/** `DEC-001 — revalidar F1 (+2 más)`: the cause, the work, and the rest of them. */
+function named(obligation, total) {
+    const more = total - 1;
+    const rest = more > 0 ? ` (+${more} más)` : "";
+    // A fabricated pending has no cause to keep: its `by` is a label the
+    // projection invented for a note nobody wrote, and printing it as the author
+    // of the work would be the second wrong text about the same fact.
+    const cause = obligation.repair === undefined ? `${obligation.by} — ` : "";
+    // And an undeclared class travels as what it is. The non-blocking reading is
+    // the one most worth flagging: a legacy handoff makes the plan closable, and a
+    // board asserting it as the note's own word hides that nobody ratified it.
+    const read = obligation.legacy ? ` (${readingMark(obligation.kind)})` : "";
+    return `${cause}${obligation.text}${read}${rest}`;
+}
+function compensationExit(owed, context) {
+    const settle = `aw settle prepare ${context.plan}`;
+    const run = context.run;
     return {
-        pending,
-        resume_point: pending[0]?.resume_point ?? null,
-        closable: pending.length === 0,
+        kind: "compensation",
+        owed,
+        point: context.current_point,
+        command: run === null ? settle : run.command,
+        // With a run open the settlement rows are inside it, and the hedge is not
+        // padding: the cursor only ever grows, so a run already past them cannot go
+        // back — and for that one the exit is the command, once its journey ends.
+        action: run === null
+            ? `no hay corrida abierta sobre '${context.plan}': leé y declará el saldo con '${settle}', y aplicalo con el digest que devuelve`
+            : `la sesión ${run.session} ${run.why}, y la frontera de saldo de una corrida es donde se declara la evidencia: si todavía no la pasó, seguila con '${run.command}'; si ya la pasó, la salida es '${settle}' cuando el recorrido termine`,
+        headline: `COMPENSACIÓN VIGENTE por ${owed}: retomá en ${context.current_point}, ni ejecutable ni cerrable tal cual`,
     };
 }
 /**
- * Whether this plan may be declared closed, and what to do when it may not.
+ * The exit of a lineage nobody can read — the repair, and nothing about phases.
  *
- * The refusal is the point of the whole phase: a validated result stops counting
- * as sufficient proof of a contract it no longer satisfies. Letting the plan
- * close anyway would file the compensatory work as finished by the very run that
- * created it.
+ * `point` carries the plan's current point anyway, because a caller may still
+ * want to say where the plan stands; what changes is that no TEXT offers it,
+ * since a broken chain is not fixed by going back to a phase. The old board
+ * printed `retomá en <repair>` — the right instruction under the wrong label —
+ * and F4's rule that a declared point never reaches a surface would have dropped
+ * it altogether: the one actionable sentence in the whole situation.
  */
-export function checkClosable(reconciliation) {
-    if (reconciliation.closable)
-        return [];
-    const owed = reconciliation.pending
-        .map((obligation) => `${obligation.by}: ${obligation.text}`)
-        .join("; ");
-    return [
-        {
-            code: "RECONCILIATION_PENDING",
-            message: `el plan tiene compensación abierta y no se puede declarar cerrado — ${owed}`,
-            action: `resolvé el trabajo compensatorio desde ${reconciliation.resume_point} y publicá una nota que sustituya a la que lo creó sin volver a arrastrarlo: así se salda una obligación en una cadena append-only`,
-        },
-    ];
+function unreadableExit(owed, repair, context) {
+    const settle = `aw settle prepare ${context.plan}`;
+    const run = context.run;
+    return {
+        kind: "compensation",
+        owed,
+        point: context.current_point,
+        command: run === null ? settle : run.command,
+        action: `${repair}. Después de eso el linaje vuelve a leerse${run === null
+            ? `, y la salida es '${settle}'`
+            : `, y la sesión ${run.session} —que ${run.why}— sigue con '${run.command}'`}`,
+        headline: `LINAJE ILEGIBLE por ${owed} — ${repair}: ni ejecutable ni cerrable tal cual`,
+    };
+}
+function handoffExit(owed, context) {
+    const settle = `aw settle prepare ${context.plan}`;
+    const run = context.run;
+    return {
+        kind: "handoff",
+        owed,
+        point: context.current_point,
+        command: run === null ? settle : run.command,
+        action: run === null
+            ? `el traspaso no bloquea nada: reconocelo con '${settle}', y saldalo ahí mismo cuando el trabajo de afuera esté hecho`
+            : `el traspaso no bloquea nada: la sesión ${run.session} ${run.why}, así que lo ve en la frontera de saldo de esa corrida; fuera de una corrida se reconoce con '${settle}'`,
+        headline: `TRASPASO VIGENTE por ${owed}: es trabajo de afuera y no bloquea el cierre; el plan está en ${context.current_point}`,
+    };
 }
 //# sourceMappingURL=reconciliation.js.map

package/dist/domain/reconciliation.js.map

@@ -1 +1 @@
-{"version":3,"file":"reconciliation.js","sourceRoot":"","sources":["../../src/domain/reconciliation.ts"],"names":[],"mappings":"AAgDA;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA2B,EAC3B,KAA8B;IAE9B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC3C,4EAA4E;QAC5E,uEAAuE;QACvE,2EAA2E;QAC3E,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,YAAY,EAAE,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,8BAA8B;SACvE,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,OAAO;QACP,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI;QAC9C,QAAQ,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,cAAkC;IAC9D,IAAI,cAAc,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO;SAChC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;SAC3D,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;QACL;YACE,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,uEAAuE,IAAI,EAAE;YACtF,MAAM,EAAE,0CAA0C,cAAc,CAAC,YAAY,oIAAoI;SAClN;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"reconciliation.js","sourceRoot":"","sources":["../../src/domain/reconciliation.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAuFzF;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA2B,EAC3B,KAA8B,EAC9B,QAAiB;IAEjB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5E,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,KAAK,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACvE,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC3C,4EAA4E;QAC5E,uEAAuE;QACvE,2EAA2E;QAC3E,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzF,MAAM,KAAK,GAAsB;YAC/B,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,cAAc,EAAE,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,8BAA8B;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,yDAAyD;YACzD,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;YACzF,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ;YAC5B,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;SACrD,CAAC;QACF,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;AAC/D,CAAC;AAgCD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAC5B,cAAkC,EAClC,OAAoB;IAEpB,MAAM,IAAI,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtF,OAAO,IAAI,CAAC,IAAI,KAAK,cAAc;QACjC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACtC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAkBD;;;;;;;;GAQG;AACH,SAAS,UAAU,CACjB,cAAkC;IAElC,MAAM,CAAC,YAAY,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC;IAC9C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC;YACxD,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC;SAC9E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,GAAG,cAAc,CAAC,QAAQ,CAAC;IAC1C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;AACnF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,IAAoB;IAC9C,OAAO,6BAA6B,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;AACzF,CAAC;AAED,oFAAoF;AACpF,SAAS,KAAK,CAAC,UAA6B,EAAE,KAAa;IACzD,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,qEAAqE;IACrE,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,6EAA6E;IAC7E,+EAA+E;IAC/E,2EAA2E;IAC3E,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,OAAO,GAAG,KAAK,GAAG,UAAU,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAoB;IAC1D,MAAM,MAAM,GAAG,qBAAqB,OAAO,CAAC,IAAI,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,IAAI;QACJ,KAAK,EAAE,OAAO,CAAC,aAAa;QAC5B,OAAO,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO;QAC5C,0EAA0E;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,MAAM,EACJ,GAAG,KAAK,IAAI;YACV,CAAC,CAAC,iCAAiC,OAAO,CAAC,IAAI,kCAAkC,MAAM,0CAA0C;YACjI,CAAC,CAAC,aAAa,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,GAAG,iHAAiH,GAAG,CAAC,OAAO,mCAAmC,MAAM,+BAA+B;QAC7O,QAAQ,EAAE,4BAA4B,IAAI,eAAe,OAAO,CAAC,aAAa,sCAAsC;KACrH,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,MAAc,EAAE,OAAoB;IACxE,MAAM,MAAM,GAAG,qBAAqB,OAAO,CAAC,IAAI,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,IAAI;QACJ,KAAK,EAAE,OAAO,CAAC,aAAa;QAC5B,OAAO,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO;QAC5C,MAAM,EAAE,GAAG,MAAM,6CACf,GAAG,KAAK,IAAI;YACV,CAAC,CAAC,qBAAqB,MAAM,GAAG;YAChC,CAAC,CAAC,iBAAiB,GAAG,CAAC,OAAO,SAAS,GAAG,CAAC,GAAG,gBAAgB,GAAG,CAAC,OAAO,GAC7E,EAAE;QACF,QAAQ,EAAE,uBAAuB,IAAI,MAAM,MAAM,sCAAsC;KACxF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,OAAoB;IACrD,MAAM,MAAM,GAAG,qBAAqB,OAAO,CAAC,IAAI,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,OAAO;QACL,IAAI,EAAE,SAAS;QACf,IAAI;QACJ,KAAK,EAAE,OAAO,CAAC,aAAa;QAC5B,OAAO,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO;QAC5C,MAAM,EACJ,GAAG,KAAK,IAAI;YACV,CAAC,CAAC,gDAAgD,MAAM,+DAA+D;YACvH,CAAC,CAAC,0CAA0C,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,GAAG,iGAAiG,MAAM,GAAG;QAChL,QAAQ,EAAE,wBAAwB,IAAI,kEAAkE,OAAO,CAAC,aAAa,EAAE;KAChI,CAAC;AACJ,CAAC"}

package/dist/domain/redaction.js

@@ -20,6 +20,46 @@ export function isSensitiveKey(key) {
         .toLowerCase();
     return SENSITIVE_KEY.test(normalized);
 }
+/**
+ * Whether one string carries credential-shaped material.
+ *
+ * The boolean core of the MCP receipt's `assertSecretFree`, lifted here because
+ * a second caller appeared — the custody gate over a declared authentication
+ * flow's `argv` — and two copies of this expression is how one surface starts
+ * accepting what the other rejects. The extra pattern beside the redactor's own
+ * is deliberate: `redactSensitiveText` only rewrites an assignment when it can
+ * see a VALUE after it, and a bare `--token=` with nothing behind it is still a
+ * request for a credential.
+ */
+export function carriesSecretMaterial(value) {
+    return (redactSensitiveText(value) !== value ||
+        /(?:^|[?&;\s-])(?:password|passwd|secret|token|api[-_]?key|dsn|pgpassword|pgpassfile)\s*=/i.test(value));
+}
+/**
+ * Whether one argument is a flag ASKING for a credential, value or not.
+ *
+ * Two expressions, and the union is the point: neither list alone is the answer.
+ * The literal one catches the spellings written without a separator (`--apikey`),
+ * which the normalized key list cannot see; `isSensitiveKey` catches the compound
+ * names (`--access-token`, `--client-secret`, `--credentials`, `--private-key`,
+ * `--connection-string`) that the literal list missed — and those were being let
+ * through by the custody gate, which is the whole reason this is not one list any
+ * more. Deriving the second half from `SENSITIVE_KEY` also means a name added
+ * there is a name blocked here, instead of a third list to keep in sync.
+ *
+ * What no name list can cover is a flag that does not say what it carries
+ * (`--pat`, `-t`). Those still pass, and the caller's docblock says so rather
+ * than implying this predicate is a complete defense.
+ */
+export function isSecretFlag(value) {
+    if (/^--?(?:token|secret|password|passwd|pwd|api[-_]?key|key|auth|dsn|database[-_]?url|pgpassword|pgpassfile)(?:=|$)/i.test(value)) {
+        return true;
+    }
+    if (!value.startsWith("-"))
+        return false;
+    const name = value.replace(/^-+/, "").split("=")[0] ?? "";
+    return name.length > 0 && isSensitiveKey(name);
+}
 /** Safe predicate for configuration shapes that must never reflect credentials. */
 export function containsSensitiveData(value) {
     if (typeof value === "string")

package/dist/domain/redaction.js.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../src/domain/redaction.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,cAAc,GAAG,kEAAkE,CAAC;AAC1F,MAAM,iBAAiB,GACrB,2SAA2S,CAAC;AAC9S,MAAM,aAAa,GACjB,4QAA4Q,CAAC;AAE/Q,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAI;SACR,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC;SAChC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC;SACnC,OAAO,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,UAAU,GAAG,GAAG;SACnB,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,WAAW,EAAE,CAAC;IACjB,OAAO,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,mBAAmB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC;IAC3E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACnE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAC/B,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,qBAAqB,CAAC,MAAM,CAAC,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACjE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YAC3C,GAAG;YACH,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC;SAC3D,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../src/domain/redaction.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,cAAc,GAAG,kEAAkE,CAAC;AAC1F,MAAM,iBAAiB,GACrB,2SAA2S,CAAC;AAC9S,MAAM,aAAa,GACjB,4QAA4Q,CAAC;AAE/Q,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAI;SACR,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC;SAChC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC;SACnC,OAAO,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,UAAU,GAAG,GAAG;SACnB,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,WAAW,EAAE,CAAC;IACjB,OAAO,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,CACL,mBAAmB,CAAC,KAAK,CAAC,KAAK,KAAK;QACpC,2FAA2F,CAAC,IAAI,CAC9F,KAAK,CACN,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IACE,kHAAkH,CAAC,IAAI,CACrH,KAAK,CACN,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,mBAAmB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC;IAC3E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACnE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAC/B,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,qBAAqB,CAAC,MAAM,CAAC,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACjE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YAC3C,GAAG;YACH,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC;SAC3D,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/domain/settlement.js

@@ -0,0 +1,129 @@
+/**
+ * The successor of one carrier note, or `null` when it would change nothing.
+ *
+ * Everything but the settled obligations crosses over: the decision, its reason,
+ * the assertions it amends, its scope, its consumers and its evidence. What the
+ * settlement adds is the evidence each discharge produced — evidence that still
+ * counts is exactly what `evidence_preserved` is for — and what it removes is
+ * the obligations somebody actually did.
+ *
+ * `null` and not an empty note: publishing a successor identical in force to its
+ * predecessor would grow the chain by one record per attempt and say nothing.
+ */
+export function deriveSettlementNote(carrier, settlements, at) {
+    const mine = settlements.filter((settlement) => settlement.note === carrier.id);
+    const failures = checkSettlements(carrier, mine);
+    if (failures.length > 0)
+        return { ok: false, failures };
+    const byIndex = new Map(mine.map((settlement) => [settlement.index, settlement]));
+    const kept = [];
+    const classified = [];
+    const settled = [];
+    const evidence = [];
+    for (const [index, obligation] of carrier.obligations.entries()) {
+        const settlement = byIndex.get(index);
+        if (settlement !== undefined && settlement.outcome === "settled") {
+            settled.push(obligation.text);
+            if (settlement.evidence !== undefined)
+                evidence.push(settlement.evidence);
+            continue;
+        }
+        const held = settlement?.outcome === "handoff" ? reclassified(obligation, "handoff") : obligation;
+        kept.push(held);
+        // Anything still unclassed leaves carrying the reading the board already
+        // reported FOR THAT POSITION — that is what "clasifica lo que queda" means,
+        // and without it the successor could not be appended at all. The position is
+        // the carrier's, never the survivors': dropping one shifts the rest.
+        classified.push(held.declared ? held : reclassified(held, at.resolved.get(index) ?? held.kind));
+    }
+    if (settled.length === 0 && sameObligations(carrier.obligations, classified)) {
+        return { ok: true, draft: null, settled: [] };
+    }
+    return {
+        ok: true,
+        settled,
+        draft: {
+            schema: carrier.schema,
+            lineage: {
+                spec: carrier.lineage.spec,
+                plan: carrier.lineage.plan,
+                // The settling run when there is one; the carrier's own when `aw settle`
+                // acts on a plan whose run is long closed. Either way it is a real
+                // session and a real phase, never a placeholder.
+                execution: { session: at.session, phase: at.phase },
+            },
+            decision: carrier.decision,
+            reason: carrier.reason,
+            supersedes_assertions: [...carrier.supersedes_assertions],
+            supersedes_note: carrier.id,
+            scope: carrier.scope,
+            consumers: [...carrier.consumers],
+            evidence_preserved: [...carrier.evidence_preserved, ...evidence],
+            evidence_invalidated: [...carrier.evidence_invalidated],
+            obligations: classified,
+            resume_point: carrier.resume_point,
+            date: at.date,
+        },
+    };
+}
+function reclassified(obligation, kind) {
+    return { text: obligation.text, kind, declared: true };
+}
+function sameObligations(before, after) {
+    return (before.length === after.length &&
+        before.every((obligation, index) => {
+            const other = after[index];
+            return (other !== undefined &&
+                other.text === obligation.text &&
+                other.kind === obligation.kind &&
+                other.declared === obligation.declared);
+        }));
+}
+/**
+ * Every way a settlement can fail to name real work, each with its own code.
+ *
+ * A settlement that points at an obligation the note does not carry, or that
+ * claims work is done without saying what proves it, is not a slightly worse
+ * settlement: it is a discharge nobody can audit, and the chain would record it
+ * as authoritative.
+ */
+function checkSettlements(carrier, settlements) {
+    const failures = [];
+    const seen = new Set();
+    for (const settlement of settlements) {
+        const obligation = carrier.obligations[settlement.index];
+        if (obligation === undefined) {
+            failures.push({
+                code: "SETTLEMENT_OBLIGATION_ABSENT",
+                message: `${carrier.id} no tiene una obligación en la posición ${settlement.index}`,
+                action: `esa nota carga ${carrier.obligations.length} obligación(es): saldá una que exista`,
+            });
+            continue;
+        }
+        if (seen.has(settlement.index)) {
+            failures.push({
+                code: "SETTLEMENT_OBLIGATION_REPEATED",
+                message: `${carrier.id} recibe dos saldos para la misma obligación: ${obligation.text}`,
+                action: "una obligación se salda una vez; decidí cuál de las dos lecturas vale",
+            });
+            continue;
+        }
+        seen.add(settlement.index);
+        if (settlement.outcome === "settled" && (settlement.evidence ?? "").trim().length === 0) {
+            failures.push({
+                code: "SETTLEMENT_EVIDENCE_MISSING",
+                message: `se declara cumplida '${obligation.text}' sin decir qué lo prueba`,
+                action: "declará la evidencia del saldo: un comando corrido, una prueba o una inspección; sin eso no es un saldo, es una afirmación",
+            });
+        }
+        if (settlement.outcome !== "settled" && settlement.evidence !== undefined) {
+            failures.push({
+                code: "SETTLEMENT_EVIDENCE_UNEXPECTED",
+                message: `'${obligation.text}' no se declara cumplida y aun así trae evidencia`,
+                action: "la evidencia acredita un saldo: sacala, o declará la obligación cumplida",
+            });
+        }
+    }
+    return failures;
+}
+//# sourceMappingURL=settlement.js.map

package/dist/domain/settlement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settlement.js","sourceRoot":"","sources":["../../src/domain/settlement.ts"],"names":[],"mappings":"AAgEA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAqB,EACrB,WAA4C,EAC5C,EAAqB;IAErB,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAExD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,IAAI,GAAqB,EAAE,CAAC;IAClC,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QAChE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC1E,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GACR,UAAU,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,yEAAyE;QACzE,4EAA4E;QAC5E,6EAA6E;QAC7E,qEAAqE;QACrE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAChD,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO;QACP,KAAK,EAAE;YACL,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE;gBACP,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;gBAC1B,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;gBAC1B,yEAAyE;gBACzE,mEAAmE;gBACnE,iDAAiD;gBACjD,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE;aACpD;YACD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,qBAAqB,EAAE,CAAC,GAAG,OAAO,CAAC,qBAAqB,CAAC;YACzD,eAAe,EAAE,OAAO,CAAC,EAAE;YAC3B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;YACjC,kBAAkB,EAAE,CAAC,GAAG,OAAO,CAAC,kBAAkB,EAAE,GAAG,QAAQ,CAAC;YAChE,oBAAoB,EAAE,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC;YACvD,WAAW,EAAE,UAAU;YACvB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,IAAI,EAAE,EAAE,CAAC,IAAI;SACd;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,UAA0B,EAAE,IAAoB;IACpE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,eAAe,CACtB,MAAiC,EACjC,KAAgC;IAEhC,OAAO,CACL,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE;YACjC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3B,OAAO,CACL,KAAK,KAAK,SAAS;gBACnB,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI;gBAC9B,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI;gBAC9B,KAAK,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,CACvC,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CACvB,OAAqB,EACrB,WAA4C;IAE5C,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,2CAA2C,UAAU,CAAC,KAAK,EAAE;gBACnF,MAAM,EAAE,kBAAkB,OAAO,CAAC,WAAW,CAAC,MAAM,uCAAuC;aAC5F,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gCAAgC;gBACtC,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,gDAAgD,UAAU,CAAC,IAAI,EAAE;gBACvF,MAAM,EAAE,uEAAuE;aAChF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxF,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,wBAAwB,UAAU,CAAC,IAAI,2BAA2B;gBAC3E,MAAM,EACJ,4HAA4H;aAC/H,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC1E,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gCAAgC;gBACtC,OAAO,EAAE,IAAI,UAAU,CAAC,IAAI,mDAAmD;gBAC/E,MAAM,EAAE,0EAA0E;aACnF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tacuchi/agent-workflow-cli",
-  "version": "25.1.2",
+  "version": "25.3.0",
   "description": "Runtime CLI for Workline — the stages + loops + artifacts system for agent work. Bundles the universal `w` skill set under `skills/w/` (slash commands `/w:*`: spec-new/spec-refine, plan-new/plan-exec, quick, persist, workspace-init, export-*); `self install --target <host>` copies SKILL + commands + hooks into the host. Pluggable capability skills resolve through `.workflow/skills.toml`. Namespace auto-detected from any `.<ns>/sessions/` dir in CWD; default `workflow`.",
   "type": "module",
   "bin": {

package/skills/w/SKILL.md

@@ -111,10 +111,11 @@ The flows are **composable with host-native work, never exclusive**. The host is
 - `/w:quick` — starts `quick-loop` (shortcut, no `docs/`; escalates live to SPEC when the objective exceeds a quick).
 - `/w:export-scripts` · `/w:export-manuals` · `/w:export-diagrams` · `/w:export-reports` — promote artifacts to `docs/`.
 
-### Transversal skills (no flow) — `/w:status` · `/w:fix-git` · `/w:generate-launch` · `/w:persist` · `/w:resume`
+### Transversal skills (no flow) — `/w:status` · `/w:doctor` · `/w:fix-git` · `/w:generate-launch` · `/w:persist` · `/w:resume`
 
 **Flow-independent invocable** skills: triggered with `/w:` like any command, but they do **not** belong to SPEC/PLAN/QUICK, do **not** manage `docs/`, and do **not** count in **6 flow commands / 5 loops**. *(In the bundle they are packaged under `commands/` so `/w:` can invoke them; in the design they are the `workflow-skills/` category.)*
 
+- `/w:doctor` — read-only diagnosis of the Workline install, MCPs, skills, auth, hooks and workspace visibility across every detected host, with coverage per category and the verdict in the exit code; repairs only what is attributable to Workline, over a sealed batch the person approves by digest. Backed by `aw doctor`.
 - `/w:status` — read-only workspace dashboard (Done/Missing/Discarded, dates humanized in the user's language), opportunistically enriched with host context when the host exposes cheap memory. Writes nothing; backed by `aw status`.
 - `/w:fix-git` — resolves an in-progress merge's conflicts in any repo (identifies origin↔destination, analyzes intent, *structured-choice* on ambiguity). No session, never touches `docs/`; git-safe; backed by `aw merge-state`.
 - `/w:generate-launch` — (re)generates the per-source launch scripts (`.workflow/launch/<alias>/`) by detecting each source's stack; idempotent (preserves hand-edited scripts, `--force` overwrites). Complements the launch flow's on-demand generation. No session, never touches `docs/`; backed by `aw generate-launch`.

package/skills/w/commands/README.md

@@ -21,6 +21,7 @@ Every invoked directory is a usable implicit workspace. The closest ancestor wit
 | [`plan-refine`](plan-refine.md) | Refines the plan **in place** before executing (aux, optional) | starts `plan-refine-loop` |
 | [`plan-exec`](plan-exec.md) | Executes the plan (code/DB/git) and maintains it as a living doc | starts `plan-exec-loop` |
 | [`quick`](quick.md) | Lightweight shortcut for scoped work; never touches `docs/` | starts `quick-loop` |
+| [`doctor`](doctor.md) | Read-only diagnosis across every host + repair of what Workline owns | single-pass (transversal) |
 | [`status`](status.md) | Read-only workspace dashboard | single-pass (transversal) |
 | [`fix-git`](fix-git.md) | Resolves an in-progress merge, git-safe | single-pass (transversal) |
 | [`generate-launch`](generate-launch.md) | (Re)generates the per-source launch scripts (`.workflow/launch/<alias>/`) | single-pass (transversal) |
@@ -33,7 +34,7 @@ Every invoked directory is a usable implicit workspace. The closest ancestor wit
 
 > **Intentional asymmetry:** in SPEC, `spec-new` generates the draft single-pass (no loop) and the loop lives in `spec-refine`; in PLAN, all 3 commands start loops. Total: **6 flow commands / 5 loops**.
 >
-> **Transversal (no flow):** `status`, `fix-git`, `generate-launch`, `persist` and `resume` belong to no SPEC/PLAN/QUICK flow and do not count in 6/5. In the design they are their own category (`workflow-skills/`); here they are packaged under `commands/` so `/w:` can invoke them — see [`../harness/HARNESS.md`](../harness/HARNESS.md) § *Command packaging*.
+> **Transversal (no flow):** `status`, `doctor`, `fix-git`, `generate-launch`, `persist` and `resume` belong to no SPEC/PLAN/QUICK flow and do not count in 6/5. In the design they are their own category (`workflow-skills/`); here they are packaged under `commands/` so `/w:` can invoke them — see [`../harness/HARNESS.md`](../harness/HARNESS.md) § *Command packaging*.
 
 ## Schema of each command file
 

package/skills/w/commands/doctor.md

@@ -0,0 +1,31 @@
+---
+description: Use when the user asks if the install, MCPs, skills or auth are healthy across hosts, or to repair what Workline owns.
+argument-hint: "(none) | prepare --select <id>… | apply --approval <digest> --select <id>…"
+allowed-tools:
+  [
+    "Bash",
+    "Read",
+  ]
+---
+
+# doctor — diagnosis across every host
+
+The report is read-only and leaves no trace. `prepare` seals and is logged; `apply` is the only step that writes. No loop, no session.
+
+## Run
+
+1. `aw doctor --format human` — emits coverage, findings and a verdict for every detected host. **The exit code IS the verdict**, and `ok:true` keeps the report printing even when it blocks. The default pass asks Claude and Codex for their MCPs, which connects them; `--skip-native` declines it and leaves that coverage `omitida`.
+2. **Relay it verbatim** — never paraphrase, re-sort, add or drop a line.
+3. `aw doctor prepare --format human`, with no selection, lists what can be repaired (`automatizable`); the report's `accionable` count also includes manual findings no batch accepts, so take the listing, not the count. **One option per listed finding**, in its order, plus the `flow` slot. Canonical [option shape](../loops/CHASSIS.md#structured-choice-design--batching) and [host binding](../harness/HARNESS.md#harness-binding-matrix); the id is the label, `impacto` + `acción` the sentence.
+4. `aw doctor prepare --select <id> … --format human` seals that batch. Relay its preview and ask for **its digest**: the approval is over what the preview shows.
+5. `aw doctor apply --approval <digest> --select <id> … --format human` applies in order and re-checks each resource. Relay it action by action: that is where a partial batch matters.
+
+> **Nothing here is re-derived.** Ownership, effects, order and what the digest covers are the CLI's answers; never call a resource ours. `EVIDENCE_MISSING` names both digests: the state moved, so run `prepare` again.
+
+> **`--verify-connection` authorizes leaving the machine** to verify a credential. Without it every deep verification degrades and says so: a present variable never reads as a working one. The CLI never holds a secret: guidance names the variable, not its value.
+
+Degradation is declared, never silent: with no structured-choice, list the options as labeled markdown with the `flow` control among them.
+
+## More context
+
+`aw context-plan --command doctor --signal <s> --root "${CLAUDE_PLUGIN_ROOT}/skills/w"` returns the extra documents a case needs; read exactly what it lists.

package/skills/w/commands/resume.md

@@ -32,10 +32,10 @@ No target → **every** pending item as `candidates` in the CLI's order, `propos
 
 ## What the CLI decides (do not re-derive)
 
-- **Priority**: unrefined spec → refined spec with no plan → plan not `done`; started first. A loose session is a notice, never a candidate.
+- **Priority**: unrefined spec → refined spec with no plan → plan not `done` → live handoff; started first. A loose session is a notice, never a candidate.
 - **Ties**: equal priority and progress → no single recommendation; date never splits.
 - **Spec→plan link**: `Derived from` or `## Origin`, never the slug; unproven stays unplanned.
-- **The route**: `/w:spec-refine`, `/w:plan-new`, `/w:plan-exec`, `aw session-resume --reopen`.
+- **The route**: `/w:spec-refine`, `/w:plan-new`, `/w:plan-exec`, `aw settle prepare`, `aw session-resume --reopen`.
 
 > A plan is not finished because its boxes are ticked: re-entry is the first phase not `validada`, a `bloqueada` phase with its declared reason, or — phases green, plan never closed — the final validation. One declaring `done` over open work comes back as inconsistent. An obligation leaving it neither runnable nor closable is said before its percentage.
 

package/skills/w/context/MANIFEST.json

@@ -65,6 +65,10 @@
     "quick.db-touched": "the task read from or wrote to a database, so there is a statement to derive into the session script"
   },
   "commands": {
+    "doctor": {
+      "core": ["commands/doctor.md"],
+      "modules": [{ "path": "modules/PLAN-MODE.md", "signal": "plan-mode" }]
+    },
     "discard": {
       "core": ["commands/discard.md"],
       "modules": []