agentic-workflow-manager 3.4.0 → 3.6.0

package/dist/tests/core/journal/process.test.js

@@ -0,0 +1,213 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const process_1 = require("../../../src/core/journal/process");
+describe('process identity', () => {
+    test('spawnStructured produce ProcessRef con tupla completa (R2.1, R4.7)', async () => {
+        const { child, ref } = (0, process_1.spawnStructured)(['node', '-e', 'setTimeout(()=>{}, 5000)'], process.cwd(), 'nonce-abc');
+        expect(ref.pid).toBe(child.pid);
+        expect(ref.spawnNonce).toBe('nonce-abc');
+        expect(typeof ref.startTime).toBe('string');
+        expect(ref.processGroup).toBeGreaterThan(0);
+        expect(ref.psArgsDigest).toMatch(/^[0-9a-f]{16}$/);
+        expect((0, process_1.refIsAlive)(ref)).toBe(true);
+        const dead = await (0, process_1.terminateGroupConfirmed)(ref, { termGraceMs: 300, killGraceMs: 300 });
+        expect(dead).toBe(true);
+        expect((0, process_1.refIsAlive)(ref)).toBe(false);
+    });
+    test('refIsAlive rechaza cualquier campo distinto de la tupla completa (R2.1)', () => {
+        const { child, ref } = (0, process_1.spawnStructured)(['node', '-e', 'setTimeout(()=>{}, 3000)'], process.cwd(), 'n2');
+        expect((0, process_1.refIsAlive)({ ...ref, startTime: 'otro-momento' })).toBe(false);
+        expect((0, process_1.refIsAlive)({ ...ref, spawnNonce: 'otro-nonce' })).toBe(false);
+        expect((0, process_1.refIsAlive)({ ...ref, argvDigest: 'ffffffffffffffff' })).toBe(false);
+        expect((0, process_1.refIsAlive)({ ...ref, psArgsDigest: 'ffffffffffffffff' })).toBe(false);
+        expect((0, process_1.refIsAlive)({ ...ref, processGroup: ref.processGroup + 1 })).toBe(false);
+        child.kill('SIGKILL');
+    });
+    test('terminateGroupConfirmed no senializa un PGID si la identidad del lider no coincide', async () => {
+        const { child, ref } = (0, process_1.spawnStructured)(['node', '-e', 'setTimeout(()=>{}, 5000)'], process.cwd(), 'n-no-kill');
+        const mismatched = { ...ref, startTime: 'identidad-de-otro-proceso' };
+        const confirmed = await (0, process_1.terminateGroupConfirmed)(mismatched, { termGraceMs: 20, killGraceMs: 20 });
+        expect(confirmed).toBe(false);
+        expect((0, process_1.refIsAlive)(ref)).toBe(true);
+        child.kill('SIGKILL');
+    });
+    test('refIsAlive rechaza un ProcessRef que simula reutilizacion de PID: el pid actual esta vivo, pero pertenecia a un proceso YA MUERTO con identidad distinta (R6)', () => {
+        // El fixture de R6 explicito en el design doc: los PIDs son reciclados
+        // por el SO, asi que la identidad JAMAS puede confiarse solo del pid.
+        // Simulacion deterministica (evita depender de que el SO realmente
+        // recicle un pid dentro del test): un proceso REAL y vivo ahora mismo
+        // (mismo pid), pero un ProcessRef que describe un proceso DISTINTO,
+        // ya finalizado, que alguna vez tuvo ese mismo pid — startTime, nonce,
+        // digest de argv, grupo y digest de `ps args` todos DISTINTOS del
+        // proceso real que hoy ocupa ese pid.
+        const { child, ref } = (0, process_1.spawnStructured)(['node', '-e', 'setTimeout(()=>{}, 3000)'], process.cwd(), 'n-reuse-real');
+        const reusedPidStaleRef = {
+            pid: ref.pid, // el numero de pid SI esta vivo hoy...
+            startTime: 'Mon Jan  1 00:00:00 2024', // ...pero como un proceso YA MUERTO distinto
+            spawnNonce: 'nonce-de-un-job-anterior-ya-terminado',
+            argvDigest: 'deadbeefdeadbeef',
+            processGroup: ref.processGroup + 9999,
+            psArgsDigest: 'cafebabecafebabe',
+        };
+        expect((0, process_1.refIsAlive)(reusedPidStaleRef)).toBe(false); // no es prueba de vida DE ESE proceso logico
+        expect((0, process_1.refIsAlive)(ref)).toBe(true); // el pid real, con su identidad real, sigue vivo
+        child.kill('SIGKILL');
+    });
+    test('terminateGroupConfirmed confirma el GRUPO entero, no solo el lider (R2.1)', async () => {
+        // El hijo spawnea un nieto en su mismo grupo; la confirmacion exige pgrep -g vacio.
+        const spawnGrandchild = "require('child_process').spawn(process.execPath, ['-e', 'setTimeout(()=>{},5000)']); setTimeout(()=>{}, 5000)";
+        const { ref } = (0, process_1.spawnStructured)(['node', '-e', spawnGrandchild], process.cwd(), 'n3');
+        await new Promise((r) => setTimeout(r, 400)); // dejar nacer al nieto
+        const dead = await (0, process_1.terminateGroupConfirmed)(ref, { termGraceMs: 2000, killGraceMs: 2000 });
+        expect(dead).toBe(true);
+        expect((0, process_1.groupIsGone)(ref.processGroup)).toBe(true);
+    }, 15000);
+    test('activitySnapshot reporta cpu y tamanio de grupo de un proceso vivo (soporte R4.2)', () => {
+        const { child, ref } = (0, process_1.spawnStructured)(['node', '-e', 'setTimeout(()=>{}, 3000)'], process.cwd(), 'n4');
+        const snap = (0, process_1.activitySnapshot)(ref);
+        expect(snap).not.toBeNull();
+        expect(typeof snap.cpuTime).toBe('string');
+        expect(snap.groupSize).toBeGreaterThanOrEqual(1);
+        child.kill('SIGKILL');
+    });
+    test('captureSelfRef captura la identidad del proceso actual (R2.1)', () => {
+        const self = (0, process_1.captureSelfRef)('nonce-self');
+        expect(self.pid).toBe(process.pid);
+        expect((0, process_1.refIsAlive)(self)).toBe(true);
+    });
+    test('un grupo compuesto solo por zombies esta terminado; no espera una senial imposible', () => {
+        expect((0, process_1.processStatesAreGone)(['Z', 'Z+', 'Zs', null])).toBe(true);
+        expect((0, process_1.processStatesAreGone)(['Z', 'S'])).toBe(false);
+        expect((0, process_1.processStatesAreGone)(['R'])).toBe(false);
+    });
+    test('refIsAlive nunca declara muerte si ps falla en ejecutarse (no ENOENT como prueba) (R2.1)', () => {
+        const cp = require('child_process');
+        const self = (0, process_1.captureSelfRef)('nonce-ps-fail');
+        const spy = jest.spyOn(cp, 'execFileSync').mockImplementation(() => {
+            const err = new Error('spawn ps ENOENT');
+            err.code = 'ENOENT';
+            throw err;
+        });
+        try {
+            expect((0, process_1.refIsAlive)(self)).toBe(true);
+        }
+        finally {
+            spy.mockRestore();
+        }
+    });
+    test('activitySnapshot no crashea si ps falla en la lectura de cpu time (R2.1)', () => {
+        const cp = require('child_process');
+        const { child, ref } = (0, process_1.spawnStructured)(['node', '-e', 'setTimeout(()=>{}, 3000)'], process.cwd(), 'n5');
+        const spy = jest.spyOn(cp, 'execFileSync').mockImplementation((...args) => {
+            const cmd = args[0];
+            if (cmd === 'ps') {
+                const err = new Error('spawn ps ENOENT');
+                err.code = 'ENOENT';
+                throw err;
+            }
+            throw new Error('unexpected execFileSync call in this test: ' + cmd);
+        });
+        try {
+            expect(() => (0, process_1.activitySnapshot)(ref)).not.toThrow();
+        }
+        finally {
+            spy.mockRestore();
+            child.kill('SIGKILL');
+        }
+    });
+    test('spawnStructured usa stdio:ignore — sin pipes que destruir ni EPIPE posible en el hijo (regresion: wrapper detached moria silenciosamente al escribir a un pipe destruido por el padre)', () => {
+        const { child, ref } = (0, process_1.spawnStructured)(['node', '-e', 'setTimeout(()=>{}, 3000)'], process.cwd(), 'n-stdio-ignore');
+        expect(child.stdout).toBeNull();
+        expect(child.stderr).toBeNull();
+        expect(child.stdin).toBeNull();
+        expect((0, process_1.refIsAlive)(ref)).toBe(true);
+        child.kill('SIGKILL');
+    });
+    test('captureRefFor degrada a unknown si ps falla, nunca crashea al capturar identidad (R2.1)', () => {
+        const cp = require('child_process');
+        const spy = jest.spyOn(cp, 'execFileSync').mockImplementation((...args) => {
+            const err = new Error('spawn ps ENOENT');
+            err.code = 'ENOENT';
+            throw err;
+        });
+        try {
+            expect(() => (0, process_1.captureSelfRef)('nonce-capture-fail')).not.toThrow();
+            const ref = (0, process_1.captureSelfRef)('nonce-capture-fail');
+            expect(ref.startTime).toBe('unknown');
+            expect(ref.psArgsDigest).toBe('unknown');
+        }
+        finally {
+            spy.mockRestore();
+        }
+    });
+});
+/** Defense-in-depth: los execFileSync internos de este archivo (psField,
+ *  sleepSync, groupIsGone, activitySnapshot) deben capturar el stderr del
+ *  subproceso INTERNAMENTE, nunca relayearlo al stderr del proceso llamante
+ *  (`inheritStderr`, el default de Node cuando no se pasa `stdio`). Si el
+ *  proceso llamante corre con su propio stderr como un pipe roto/destruido
+ *  (el patron exacto que crasheaba al wrapper detached antes del fix de
+ *  spawnStructured), un relay de inheritStderr dispara un `write EPIPE` no
+ *  catcheable por ningun try/catch sincronico (el throw ocurre via el
+ *  'error' event del stream, asincronico) — proceso muerto sin excepcion
+ *  visible. Este test reproduce esa condicion contra el `dist/` compilado
+ *  REAL (no mockeado): un hijo real con stdio pipe cuyos extremos el padre
+ *  destruye (igual que hacia el viejo defaultWrapperSpawner), corriendo
+ *  `groupIsGone` contra un `pgrep` stub que escribe a stderr (simulando un
+ *  binario real que emite ruido/warnings en stderr incluso en el caso
+ *  "sin matches") — sin el fix, esto tumba al hijo; con el fix, sobrevive
+ *  y devuelve el resultado correcto. */
+describe('process.ts execFileSync: stdio explicito evita inheritStderr hacia un pipe roto', () => {
+    const DIST_ENTRY = path_1.default.resolve(__dirname, '..', '..', '..', 'dist', 'src', 'core', 'journal', 'process.js');
+    beforeAll(() => {
+        if (!fs_1.default.existsSync(DIST_ENTRY)) {
+            throw new Error('dist ausente: corre `cd cli && npm run build` antes de este test (verifica el dist compilado real, no el source transpilado por ts-jest)');
+        }
+    });
+    test('groupIsGone sobrevive un pgrep que escribe a stderr, corriendo en un hijo con stdio pipe destruido por su padre (regresion: inheritStderr de execFileSync sin stdio explicito)', async () => {
+        const workDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-execfilesync-hardening-'));
+        const stubBin = path_1.default.join(workDir, 'pgrep');
+        // pgrep "real" que, incluso en el caso feliz (sin matches, exit 1),
+        // tambien emite algo en stderr — plausible en entornos reales
+        // (locale warnings, etc.) y suficiente para ejercitar inheritStderr.
+        fs_1.default.writeFileSync(stubBin, '#!/bin/sh\necho "warning: ruido de stderr" 1>&2\nexit 1\n', { mode: 0o755 });
+        const outFile = path_1.default.join(workDir, 'out.txt');
+        const childScript = path_1.default.join(workDir, 'child.js');
+        fs_1.default.writeFileSync(childScript, `
+            const fs = require('fs');
+            const { groupIsGone } = require(${JSON.stringify(DIST_ENTRY)});
+            try {
+                const result = groupIsGone(999999);
+                fs.writeFileSync(${JSON.stringify(outFile)}, 'RESULT:' + result);
+            } catch (e) {
+                fs.writeFileSync(${JSON.stringify(outFile)}, 'THREW:' + e.message);
+            }
+        `);
+        const child = (0, child_process_1.spawn)(process.execPath, [childScript], {
+            cwd: workDir,
+            env: { ...process.env, PATH: `${workDir}:${process.env.PATH}` },
+            stdio: ['ignore', 'pipe', 'pipe'],
+            detached: true,
+        });
+        // El patron exacto que causaba el crash original: el padre destruye
+        // su extremo de los pipes del hijo, cerrando el read-end — cualquier
+        // escritura del hijo a su propio stdout/stderr despues de esto EPIPE-ea.
+        child.stdout?.destroy();
+        child.stderr?.destroy();
+        const exit = await new Promise((resolve) => {
+            child.on('exit', (code, signal) => resolve({ code, signal }));
+        });
+        expect(exit.signal).toBeNull(); // nunca deberia morir por senial (crash de node = SIGABRT/uncaught != signal, pero confirmamos ausencia de kill externo)
+        expect(exit.code).toBe(0); // el hijo debe sobrevivir y salir limpio, NO crashear por EPIPE no catcheable
+        const out = fs_1.default.readFileSync(outFile, 'utf8');
+        expect(out).toBe('RESULT:true'); // logica de negocio intacta: pgrep exit 1 => groupIsGone true
+        fs_1.default.rmSync(workDir, { recursive: true, force: true });
+    });
+});

package/dist/tests/core/journal/redact.test.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const redact_1 = require("../../../src/core/journal/redact");
+describe('redact', () => {
+    test('redactText enmascara asignaciones sospechosas (R2.3)', () => {
+        expect((0, redact_1.redactText)('export API_KEY=abc123secreto')).toContain('[REDACTED]');
+        expect((0, redact_1.redactText)('password: hunter2')).toContain('[REDACTED]');
+        expect((0, redact_1.redactText)('linea inocente')).toBe('linea inocente');
+    });
+    test('findLiteralSecretFlag detecta flags sensibles con valor literal (R2.3)', () => {
+        expect((0, redact_1.findLiteralSecretFlag)(['cmd', '--token', 'abc123'])).toBe('--token');
+        expect((0, redact_1.findLiteralSecretFlag)(['cmd', '--api-key=xyz'])).toBe('--api-key');
+        expect((0, redact_1.findLiteralSecretFlag)(['cmd', '--token-env', 'MY_TOKEN'])).toBeNull();
+        expect((0, redact_1.findLiteralSecretFlag)(['npm', 'test'])).toBeNull();
+    });
+    test('findLiteralSecretFlag detecta un valor literal que empieza con -- (R2.3)', () => {
+        expect((0, redact_1.findLiteralSecretFlag)(['cmd', '--token', '--abc123secretvalue'])).toBe('--token');
+    });
+    test('findLiteralSecretFlag rechaza sin importar si el siguiente token parece otro flag (R2.3)', () => {
+        expect((0, redact_1.findLiteralSecretFlag)(['cmd', '--token', '--password', 'hunter2'])).toBe('--token');
+        expect((0, redact_1.findLiteralSecretFlag)(['cmd', '--token', '--my-secret-data'])).toBe('--token');
+    });
+    test('redactArgv nunca deja el valor de un flag sensible (R2.3)', () => {
+        expect((0, redact_1.redactArgv)(['x', '--password', 'hunter2'])).toEqual(['x', '--password', '[REDACTED]']);
+    });
+    test('redactArgv redacta un valor literal que empieza con -- (R2.3)', () => {
+        expect((0, redact_1.redactArgv)(['cmd', '--token', '--abc123secretvalue'])).toEqual(['cmd', '--token', '[REDACTED]']);
+    });
+    test('redactArgv redacta TODA la cadena ambigua cuando el valor parece otro flag sensible, sin dejar pasar el secreto real (R2.3)', () => {
+        expect((0, redact_1.redactArgv)(['cmd', '--token', '--password', 'hunter2'])).toEqual(['cmd', '--token', '[REDACTED]', '[REDACTED]']);
+        expect((0, redact_1.redactArgv)(['cmd', '--token', '--my-secret-data'])).toEqual(['cmd', '--token', '[REDACTED]']);
+        expect((0, redact_1.redactArgv)(['cmd', '--api-key', '--secret'])).toEqual(['cmd', '--api-key', '[REDACTED]']);
+    });
+    test('findLiteralSecretFlag y redactArgv reconocen flags de un solo guion con palabra clave (R2.3)', () => {
+        expect((0, redact_1.findLiteralSecretFlag)(['cmd', '-token', 'abc123'])).toBe('-token');
+        expect((0, redact_1.redactArgv)(['cmd', '-token', 'abc123'])).toEqual(['cmd', '-token', '[REDACTED]']);
+    });
+    test('findLiteralSecretFlag NO reconoce mnemonicos de una letra sin palabra clave — limitacion aceptada (R2.3)', () => {
+        // Documenta el limite, no lo intenta cerrar: ver comentario en redact.ts.
+        expect((0, redact_1.findLiteralSecretFlag)(['cmd', '-p', 'hunter2secret'])).toBeNull();
+    });
+    test('redactText no sufre backtracking catastrofico con corridas largas sin match (R2.3)', () => {
+        const start = Date.now();
+        (0, redact_1.redactText)('x'.repeat(100000));
+        expect(Date.now() - start).toBeLessThan(500);
+    });
+    test('redactText no pierde secretos con identificadores largos entre keyword y separador (R2.3)', () => {
+        const text = 'api_key' + 'x'.repeat(70) + '=sk-VERY-REAL-SECRET-VALUE-12345';
+        const result = (0, redact_1.redactText)(text);
+        expect(result).not.toContain('sk-VERY-REAL-SECRET-VALUE-12345');
+        expect(result).toContain('[REDACTED]');
+    });
+    test('redactText no sufre backtracking cuadratico con muchas ocurrencias del keyword sin separador (R2.3)', () => {
+        const start = Date.now();
+        const result = (0, redact_1.redactText)('token'.repeat(2400));
+        expect(Date.now() - start).toBeLessThan(500);
+        expect(result).toBe('token'.repeat(2400)); // sin separador en ningun lado: nada que redactar
+    });
+});

package/dist/tests/core/journal/requests.test.js

@@ -0,0 +1,134 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const os_1 = __importDefault(require("os"));
+const crypto_1 = __importDefault(require("crypto"));
+const child_process_1 = require("child_process");
+const requests_1 = require("../../../src/core/journal/requests");
+const store_1 = require("../../../src/core/journal/store");
+const paths_1 = require("../../../src/core/journal/paths");
+// Bootstrap para invocar el codigo REAL de src/ (.ts) desde procesos `node`
+// separados sin depender de un build previo (dist/ esta gitignored) ni de
+// ts-node (no instalado): registra un require.extensions['.ts'] que
+// transpila on-demand via el compilador de TypeScript (devDependency ya
+// presente). NODE_PATH apunta a cli/node_modules para que el propio script
+// bootstrap pueda resolver 'typescript' aunque viva fuera del arbol del repo.
+const CLI_ROOT = path_1.default.resolve(__dirname, '../../..');
+const REQUESTS_TS = path_1.default.join(CLI_ROOT, 'src/core/journal/requests.ts');
+const TS_BOOTSTRAP = `
+const fs = require('fs');
+const ts = require('typescript');
+require.extensions['.ts'] = function (mod, filename) {
+    const source = fs.readFileSync(filename, 'utf8');
+    const { outputText } = ts.transpileModule(source, {
+        compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022, esModuleInterop: true },
+        fileName: filename,
+    });
+    mod._compile(outputText, filename);
+};
+`;
+function runInSeparateProcess(script, args) {
+    const scriptFile = path_1.default.join(os_1.default.tmpdir(), `awm-cross-proc-${crypto_1.default.randomUUID()}.js`);
+    fs_1.default.writeFileSync(scriptFile, TS_BOOTSTRAP + script);
+    try {
+        return (0, child_process_1.execFileSync)('node', [scriptFile, ...args], {
+            encoding: 'utf8',
+            env: { ...process.env, NODE_PATH: path_1.default.join(CLI_ROOT, 'node_modules') },
+        }).trim();
+    }
+    finally {
+        fs_1.default.rmSync(scriptFile, { force: true });
+    }
+}
+describe('requests', () => {
+    let repo;
+    beforeEach(() => { repo = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-req-')); (0, store_1.initJournal)(repo, 'rama'); });
+    afterEach(() => { fs_1.default.rmSync(repo, { recursive: true, force: true }); });
+    test('emitRequest publica atomico: nunca hay .tmp visible como pendiente (R1.3)', () => {
+        const r = (0, requests_1.emitRequest)(repo, 'rama', { kind: 'job-request', generationToken: 'g1', idempotencyKey: 'k1', payload: { argv: ['npm', 'test'] } });
+        expect(r.requestId).toMatch(/^req-/);
+        const files = fs_1.default.readdirSync((0, paths_1.requestsDir)(repo, 'rama'));
+        expect(files.some((f) => f.endsWith('.tmp'))).toBe(false);
+        expect((0, requests_1.listPendingRequests)(repo, 'rama')).toHaveLength(1);
+    });
+    test('request con secreto literal se rechaza sin persistir (R2.3 via emisor)', () => {
+        expect(() => (0, requests_1.emitRequest)(repo, 'rama', { kind: 'job-request', generationToken: 'g1', idempotencyKey: 'k2', payload: { argv: ['x', '--token', 'abc'] } }))
+            .toThrow(/secreto literal/);
+        expect((0, requests_1.listPendingRequests)(repo, 'rama')).toHaveLength(0);
+    });
+    test('JSON con kind conocido pero envelope incompleto se clasifica corrupto antes de consumirlo', () => {
+        const file = path_1.default.join((0, paths_1.requestsDir)(repo, 'rama'), 'bad.json');
+        fs_1.default.writeFileSync(file, JSON.stringify({ requestId: 'bad', kind: 'job-request', generationToken: 'g1', idempotencyKey: 'k1' }));
+        const [pending] = (0, requests_1.listPendingRequests)(repo, 'rama');
+        expect(pending.corrupt).toBe(true);
+        expect(pending.requestId).toBe('bad.json');
+    });
+    test('idempotencyKey repetida: digest distinto se rechaza; mismo digest registra ALIAS con el mismo resultRef (R1.3)', () => {
+        const r1 = (0, requests_1.emitRequest)(repo, 'rama', { kind: 'job-request', generationToken: 'g1', idempotencyKey: 'k3', payload: { argv: ['npm', 'test'] } });
+        let s = (0, store_1.readJournal)(repo, 'rama').state;
+        s = (0, requests_1.applyOutcome)(s, { requestId: r1.requestId, idempotencyKey: r1.idempotencyKey, payloadDigest: r1.payloadDigest, outcome: 'applied', resultRef: 'job-1' });
+        (0, store_1.writeJournal)(repo, 'rama', s);
+        // ack perdido en disco: se regenera desde state.json
+        expect((0, requests_1.ackFor)((0, store_1.readJournal)(repo, 'rama').state, r1.requestId).resultRef).toBe('job-1');
+        // misma key + MISMO payload => alias: el requestId nuevo tiene SU entrada con el mismo resultRef
+        const r2 = (0, requests_1.emitRequest)(repo, 'rama', { kind: 'job-request', generationToken: 'g1', idempotencyKey: 'k3', payload: { argv: ['npm', 'test'] } });
+        const s2 = (0, store_1.readJournal)(repo, 'rama').state;
+        (0, requests_1.applyOutcome)(s2, { requestId: r2.requestId, idempotencyKey: 'k3', payloadDigest: r2.payloadDigest, outcome: 'applied' });
+        expect((0, requests_1.ackFor)(s2, r2.requestId)).not.toBeNull();
+        expect((0, requests_1.ackFor)(s2, r2.requestId).resultRef).toBe('job-1'); // alias regenerable (bloqueador 4)
+        // misma key, payload distinto => rechazo explicito
+        const r3 = (0, requests_1.emitRequest)(repo, 'rama', { kind: 'job-request', generationToken: 'g1', idempotencyKey: 'k3', payload: { argv: ['npm', 'run', 'otro'] } });
+        expect(() => (0, requests_1.applyOutcome)(s2, { requestId: r3.requestId, idempotencyKey: 'k3', payloadDigest: r3.payloadDigest, outcome: 'applied' }))
+            .toThrow(/digest/);
+    });
+    test('Fix1 Parte A: idempotencyKey repetida con digest distinto es SEGURA de registrar cuando el outcome NO es applied (ninguna mutacion ocurrio)', () => {
+        const s = (0, store_1.readJournal)(repo, 'rama').state;
+        (0, requests_1.applyOutcome)(s, { requestId: 'req-a', idempotencyKey: 'kdup', payloadDigest: 'digest-a', outcome: 'applied', resultRef: 'job-1' });
+        // digest DISTINTO, pero outcome de rechazo: no debe tirar (a diferencia de 'applied')
+        expect(() => (0, requests_1.applyOutcome)(s, { requestId: 'req-b', idempotencyKey: 'kdup', payloadDigest: 'digest-b', outcome: 'rejected-digest-mismatch' }))
+            .not.toThrow();
+        expect(s.appliedRequests['req-b'].outcome).toBe('rejected-digest-mismatch');
+        expect(s.appliedRequests['req-b'].payloadDigest).toBe('digest-b'); // registra SU PROPIO digest, no el de la entrada previa
+        // 'applied' con digest distinto sigue tirando (comportamiento previo intacto)
+        expect(() => (0, requests_1.applyOutcome)(s, { requestId: 'req-c', idempotencyKey: 'kdup', payloadDigest: 'digest-c', outcome: 'applied' }))
+            .toThrow(/digest/);
+    });
+    test('replay del MISMO requestId es no-op (R1.3)', () => {
+        const s = (0, store_1.readJournal)(repo, 'rama').state;
+        (0, requests_1.applyOutcome)(s, { requestId: 'req-x', idempotencyKey: 'kx', payloadDigest: 'd', outcome: 'applied', resultRef: 'job-9' });
+        (0, requests_1.applyOutcome)(s, { requestId: 'req-x', idempotencyKey: 'kx', payloadDigest: 'd', outcome: 'applied', resultRef: 'job-9' });
+        expect(Object.keys(s.appliedRequests)).toHaveLength(1);
+    });
+    test('emitRequest preserva orden de emision incluso con Date.now() colisionado (RNF-T.7)', () => {
+        const originalNow = Date.now;
+        Date.now = () => 1700000000000;
+        try {
+            const a = (0, requests_1.emitRequest)(repo, 'rama', { kind: 'job-request', generationToken: 'g1', idempotencyKey: 'ka', payload: { argv: ['npm', 'test'] } });
+            const b = (0, requests_1.emitRequest)(repo, 'rama', { kind: 'job-request', generationToken: 'g1', idempotencyKey: 'kb', payload: { argv: ['npm', 'test'] } });
+            const listed = (0, requests_1.listPendingRequests)(repo, 'rama').map((p) => p.requestId);
+            expect(listed.indexOf(a.requestId)).toBeLessThan(listed.indexOf(b.requestId));
+        }
+        finally {
+            Date.now = originalNow;
+        }
+    });
+    test('emitRequest preserva orden causal entre procesos SEPARADOS (RNF-T.7)', () => {
+        // El propio directorio de requests YA fue inicializado por initJournal
+        // en beforeEach (mismo proceso jest); lo que importa es que emitRequest
+        // A y B corran en procesos `node` DISTINTOS, uno tras otro.
+        const emitScript = `
+            const { emitRequest } = require(${JSON.stringify(REQUESTS_TS)});
+            const [, , repoArg, keyArg] = process.argv;
+            const r = emitRequest(repoArg, 'rama', { kind: 'job-request', generationToken: 'g1', idempotencyKey: keyArg, payload: { argv: ['npm', 'test'] } });
+            console.log(r.requestId);
+        `;
+        const idA = runInSeparateProcess(emitScript, [repo, 'proc-a']);
+        const idB = runInSeparateProcess(emitScript, [repo, 'proc-b']);
+        const listed = (0, requests_1.listPendingRequests)(repo, 'rama').map((p) => p.requestId);
+        expect(listed.indexOf(idA)).toBeLessThan(listed.indexOf(idB));
+    });
+});

package/dist/tests/core/journal/store.test.js

@@ -0,0 +1,88 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const os_1 = __importDefault(require("os"));
+const store_1 = require("../../../src/core/journal/store");
+const paths_1 = require("../../../src/core/journal/paths");
+describe('journal store', () => {
+    let repo;
+    beforeEach(() => { repo = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-store-')); });
+    afterEach(() => { fs_1.default.rmSync(repo, { recursive: true, force: true }); });
+    test('initJournal crea 0700/0600 y estado inicial valido (R1.2)', () => {
+        (0, store_1.initJournal)(repo, 'rama');
+        const dir = (0, paths_1.journalDir)(repo, 'rama');
+        expect(fs_1.default.statSync(dir).mode & 0o777).toBe(0o700);
+        expect(fs_1.default.statSync((0, paths_1.statePath)(repo, 'rama')).mode & 0o777).toBe(0o600);
+        const r = (0, store_1.readJournal)(repo, 'rama');
+        expect(r.corrupt).toBe(false);
+        expect(r.state.revision).toBe(0);
+    });
+    test('writeJournal incrementa revision y rechaza revision vieja (R1.2)', () => {
+        (0, store_1.initJournal)(repo, 'rama');
+        const s1 = (0, store_1.readJournal)(repo, 'rama').state;
+        (0, store_1.writeJournal)(repo, 'rama', s1); // rev 0 -> 1
+        const s2 = (0, store_1.readJournal)(repo, 'rama').state;
+        expect(s2.revision).toBe(1);
+        expect(() => (0, store_1.writeJournal)(repo, 'rama', s1)).toThrow(/revision/); // CAS: s1 quedo vieja
+    });
+    test('nextAction persiste estructurado (R1.5)', () => {
+        (0, store_1.initJournal)(repo, 'rama');
+        const s = (0, store_1.readJournal)(repo, 'rama').state;
+        s.cycle.nextAction = { actionId: 'a1', type: 'implement-task', target: 'T1', preconditions: [], attempt: 1, state: 'pending' };
+        (0, store_1.writeJournal)(repo, 'rama', s);
+        expect((0, store_1.readJournal)(repo, 'rama').state.cycle.nextAction.actionId).toBe('a1');
+    });
+    test('estado corrupto se reporta, jamas se descarta en silencio (R1.6)', () => {
+        (0, store_1.initJournal)(repo, 'rama');
+        fs_1.default.writeFileSync((0, paths_1.statePath)(repo, 'rama'), 'null'); // JSON valido, shape invalido
+        const r = (0, store_1.readJournal)(repo, 'rama');
+        expect(r.corrupt).toBe(true);
+        expect(r.state).toBeNull();
+        fs_1.default.writeFileSync((0, paths_1.statePath)(repo, 'rama'), '{roto'); // sintaxis invalida
+        expect((0, store_1.readJournal)(repo, 'rama').corrupt).toBe(true);
+    });
+    test('normaliza campos aditivos de snapshots schema 1 sin certificar evidencia legacy', () => {
+        (0, store_1.initJournal)(repo, 'rama');
+        const legacy = (0, store_1.readJournal)(repo, 'rama').state;
+        delete legacy.requestProblems;
+        delete legacy.custodyDecisions;
+        delete legacy.cycle.nextAction;
+        legacy.verdicts.push({ id: 'v-old', obligationId: 'o-old', result: 'pass', detail: 'legacy', receivedAt: new Date().toISOString() });
+        fs_1.default.writeFileSync((0, paths_1.statePath)(repo, 'rama'), JSON.stringify(legacy));
+        const read = (0, store_1.readJournal)(repo, 'rama');
+        expect(read.corrupt).toBe(false);
+        expect(read.state.requestProblems).toEqual([]);
+        expect(read.state.cycle.nextAction?.actionId).toBe('bootstrap-cycle');
+        expect(read.state.verdicts[0]).toEqual(expect.objectContaining({ fingerprint: '', argv: [], paths: [], cwd: '.' }));
+    });
+    test('appendEvent agrega lineas de auditoria best-effort (R4.6)', () => {
+        (0, store_1.initJournal)(repo, 'rama');
+        (0, store_1.appendEvent)(repo, 'rama', { kind: 'generation-launched', n: 1 });
+        (0, store_1.appendEvent)(repo, 'rama', { kind: 'request-rejected-stale' });
+        const lines = fs_1.default.readFileSync((0, paths_1.eventsPath)(repo, 'rama'), 'utf8').trim().split('\n');
+        expect(lines).toHaveLength(2);
+        expect(JSON.parse(lines[0]).kind).toBe('generation-launched');
+        expect(typeof JSON.parse(lines[0]).at).toBe('string');
+    });
+    test('writeJournal rechaza un estado propuesto con forma invalida, nunca lo persiste (R1.6)', () => {
+        (0, store_1.initJournal)(repo, 'rama');
+        const s = (0, store_1.readJournal)(repo, 'rama').state;
+        const malformed = { ...s };
+        delete malformed.tasks;
+        expect(() => (0, store_1.writeJournal)(repo, 'rama', malformed)).toThrow(/forma invalida/);
+        // el journal sigue intacto y legible tras el intento rechazado
+        const after = (0, store_1.readJournal)(repo, 'rama');
+        expect(after.corrupt).toBe(false);
+        expect(after.state.revision).toBe(s.revision);
+    });
+    test('writeJournal rechaza un estado cuyo branch no coincide con el branch destino (R1.2)', () => {
+        (0, store_1.initJournal)(repo, 'rama');
+        const s = (0, store_1.readJournal)(repo, 'rama').state;
+        const wrongBranch = { ...s, branch: 'otra-rama' };
+        expect(() => (0, store_1.writeJournal)(repo, 'rama', wrongBranch)).toThrow(/branch/);
+    });
+});

package/dist/tests/core/journal/types.test.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const types_1 = require("../../../src/core/journal/types");
+describe('journal types', () => {
+    test('execution states incluyen orphaned y cancel (R1.7)', () => {
+        expect(types_1.EXECUTION_STATES).toEqual([
+            'received', 'spawn-intent', 'claimed', 'running',
+            'exited', 'cancel-requested', 'cancelled', 'orphaned',
+        ]);
+        expect(types_1.GENERATION_STATES).toEqual([
+            'active', 'controller-suspected-stall', 'terminated', 'superseded',
+        ]);
+    });
+    test('emptyState produce un estado bien formado (R1.4)', () => {
+        const s = (0, types_1.emptyState)('mi-rama');
+        expect((0, types_1.isWellFormedState)(s)).toBe(true);
+        expect(s.schema).toBe(1);
+        expect(s.revision).toBe(0);
+        expect(s.cycle.status).toBe('IN_PROGRESS');
+        expect(typeof s.cycle.startedAt).toBe('string');
+        expect(s.cycle.nextAction?.actionId).toBe('bootstrap-cycle');
+        expect(s.requiredVerifiers).toEqual([]);
+        expect(s.dispatches).toEqual([]);
+    });
+    test('isWellFormedState rechaza no-objetos y shapes rotos (R1.6)', () => {
+        expect((0, types_1.isWellFormedState)(null)).toBe(false);
+        expect((0, types_1.isWellFormedState)(42)).toBe(false);
+        expect((0, types_1.isWellFormedState)({ schema: 1 })).toBe(false);
+        const bad = (0, types_1.emptyState)('x');
+        bad.revision = 'no-un-numero';
+        expect((0, types_1.isWellFormedState)(bad)).toBe(false);
+        const bad2 = (0, types_1.emptyState)('y');
+        delete bad2.requiredVerifiers;
+        expect((0, types_1.isWellFormedState)(bad2)).toBe(false);
+    });
+    test('isWellFormedProcessRef exige la tupla COMPLETA (R2.1)', () => {
+        const full = { pid: 1, startTime: 'x', spawnNonce: 'n', argvDigest: 'd', processGroup: 1, psArgsDigest: 'p' };
+        expect((0, types_1.isWellFormedProcessRef)(full)).toBe(true);
+        expect((0, types_1.isWellFormedProcessRef)({ ...full, psArgsDigest: undefined })).toBe(false);
+        expect((0, types_1.isWellFormedProcessRef)({ ...full, processGroup: 'uno' })).toBe(false);
+        expect((0, types_1.isWellFormedProcessRef)(null)).toBe(false);
+    });
+    test('isWellFormedJob exige TODOS los campos requeridos, no un subset (R1.6)', () => {
+        const full = {
+            id: 'j1',
+            fingerprint: 'f',
+            commandDigest: 'c',
+            argv: ['x'],
+            cwd: '.',
+            paths: ['**/*.ts'],
+            expandedPaths: ['a.ts'],
+            executionState: 'received',
+            observationState: 'progressing',
+            phaseTimestamps: {},
+        };
+        expect((0, types_1.isWellFormedJob)(full)).toBe(true);
+        for (const key of ['paths', 'expandedPaths', 'observationState', 'phaseTimestamps']) {
+            const broken = { ...full };
+            delete broken[key];
+            expect((0, types_1.isWellFormedJob)(broken)).toBe(false);
+        }
+        expect((0, types_1.isWellFormedJob)({ ...full, phaseTimestamps: [] })).toBe(false);
+        expect((0, types_1.isWellFormedJob)({ ...full, argv: [42] })).toBe(false);
+        expect((0, types_1.isWellFormedJob)({ ...full, paths: [{ glob: '**/*' }] })).toBe(false);
+        expect((0, types_1.isWellFormedJob)({ ...full, observationState: 'stuck' })).toBe(false);
+        expect((0, types_1.isWellFormedJob)({ ...full, verdict: 'maybe' })).toBe(false);
+        expect((0, types_1.isWellFormedJob)({ ...full, result: { exitCode: 0 } })).toBe(false);
+        expect((0, types_1.isWellFormedJob)({ ...full, processRef: { pid: 1 } })).toBe(false);
+    });
+    test('IN_PROGRESS exige nextAction estructurada y status del ciclo conocido (R1.5/R1.6)', () => {
+        const missing = (0, types_1.emptyState)('x');
+        delete missing.cycle.nextAction;
+        expect((0, types_1.isWellFormedState)(missing)).toBe(false);
+        const badStatus = (0, types_1.emptyState)('x');
+        badStatus.cycle.status = 'FINISHED';
+        expect((0, types_1.isWellFormedState)(badStatus)).toBe(false);
+    });
+});