agentic-workflow-manager 6.2.1 → 6.3.0

package/dist/tests/commands/job/gate-reconcile.test.js

@@ -6,10 +6,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
+const child_process_1 = require("child_process");
+const commander_1 = require("commander");
 const gate_1 = require("../../../src/commands/job/gate");
 const reconcile_1 = require("../../../src/commands/job/reconcile");
 const reap_1 = require("../../../src/commands/job/reap");
+const job_1 = require("../../../src/commands/job");
+const watch_1 = require("../../../src/commands/watch");
 const types_1 = require("../../../src/core/journal/types");
+const store_1 = require("../../../src/core/journal/store");
+const descriptor_1 = require("../../../src/core/tracks/descriptor");
 function job(partial) {
     return {
         id: 'j1', fingerprint: 'fp', commandDigest: 'cd', argv: ['npm', 'test'], cwd: '.',
@@ -168,6 +174,137 @@ describe('gate', () => {
         expect(g2.pass).toBe(false);
         expect(g2.reasons.some((r) => r.category === 'adverse-verdict')).toBe(true);
     });
+    test('computeGate produce el mismo conjunto de categorias que antes de la extraccion de evaluateEvidence (regresion R1)', () => {
+        const s = passingState();
+        s.cycle.status = 'BLOCKED';
+        s.cycle.blockedReason = 'custodia';
+        s.cycleVerificationPlan = [];
+        s.tasks[0].status = 'pending';
+        s.tasks[0].reviewObligations = [];
+        s.jobs['live'] = job({ id: 'live', executionState: 'running' });
+        const g = (0, gate_1.computeGate)(s, false, fpCurrent);
+        const categories = [...new Set(g.reasons.map((r) => r.category))].sort();
+        expect(categories).toEqual(['cycle-blocked', 'empty-cycle-plan', 'live-job', 'missing-verifier', 'open-obligation', 'pending-task'].sort());
+    });
+});
+/** Task 12 (R7/C4) — brecha de scope cerrada: el file-list del plan
+ *  requeria tocar `gate.ts` para el nuevo `VerificationKind` 'track-integration',
+ *  pero `evaluateEvidence` (arriba, linea ~78-111) ya es generico sobre TODO
+ *  kind salvo 'review' — cae al mismo lookup `state.jobs[item.satisfiedBy]` +
+ *  chequeo de verdict/vigencia de fingerprint sin importar el kind. Como
+ *  `apply.ts` (`linkSatisfies`, llamado una vez por id en el bucle de
+ *  job-request) enlaza VARIOS items `track-integration:*` al MISMO jobId
+ *  cuando un solo job canonico de integracion satisface a toda la cohorte
+ *  (C4 — un unico job, nunca uno por track), el bucle generico por-item ya
+ *  evalua ese escenario correctamente: cada item hace su propio lookup
+ *  independiente del MISMO job, así que ambos certifican juntos cuando pasa
+ *  con fingerprint vigente, y ambos caen a 'stale-fingerprint' juntos cuando
+ *  ese UNICO job deja de estar vigente. Esta suite documenta esa conclusion
+ *  con evidencia real — CERO cambios de logica en gate.ts eran necesarios. */
+describe('track-integration: un unico job satisface a MULTIPLES items de cohorte (R7/C4, Task 12 — scope gap)', () => {
+    function stateWithSharedIntegrationJob() {
+        const s = (0, types_1.emptyState)('r');
+        s.requiredVerifiers = ['test', 'sensors'];
+        s.cycleVerificationPlan = [
+            { id: 'qa', kind: 'qa', satisfiedBy: 'job-qa' },
+            { id: 'interlock', kind: 'interlock', satisfiedBy: 'job-interlock' },
+            { id: 'test', kind: 'test', satisfiedBy: 'job-test' },
+            { id: 'sensors', kind: 'sensors', satisfiedBy: 'job-sensors' },
+            // Dos tracks ('a', 'b'), UN solo job canonico de integracion
+            // (`job-integration`) satisface a AMBOS items — exactamente lo
+            // que `runRequestFinalIntegration` (watch/tracks.ts) produce vía
+            // `requestJob({ satisfies: ids, ... })` con `ids` = el conjunto
+            // COMPLETO y ordenado de `track-integration:*` de la cohorte.
+            { id: 'track-integration:a', kind: 'track-integration', satisfiedBy: 'job-integration' },
+            { id: 'track-integration:b', kind: 'track-integration', satisfiedBy: 'job-integration' },
+        ];
+        for (const id of ['job-qa', 'job-interlock', 'job-test', 'job-sensors', 'job-integration']) {
+            s.jobs[id] = job({ id, fingerprint: 'fp', executionState: 'exited', verdict: 'pass' });
+        }
+        return s;
+    }
+    test('un job pasando con fingerprint vigente certifica AMBOS items de track-integration a la vez, sin cambios en gate.ts', () => {
+        const s = stateWithSharedIntegrationJob();
+        const g = (0, gate_1.computeGate)(s, false, fpCurrent);
+        expect(g.pass).toBe(true);
+        expect(g.reasons).toEqual([]);
+    });
+    test('cuando ESE UNICO job pierde vigencia, AMBOS items de track-integration caen a stale-fingerprint juntos (nunca uno sin el otro)', () => {
+        const s = stateWithSharedIntegrationJob();
+        const g = (0, gate_1.computeGate)(s, false, fpStale);
+        expect(g.pass).toBe(false);
+        const staleTrackIntegration = g.reasons.filter((r) => r.category === 'stale-fingerprint' && /track-integration:/.test(r.detail));
+        expect(staleTrackIntegration).toHaveLength(2);
+        expect(staleTrackIntegration.some((r) => /track-integration:a/.test(r.detail))).toBe(true);
+        expect(staleTrackIntegration.some((r) => /track-integration:b/.test(r.detail))).toBe(true);
+    });
+    test('si el job compartido falla (verdict no-pass), AMBOS items de track-integration bloquean por adverse-verdict', () => {
+        const s = stateWithSharedIntegrationJob();
+        s.jobs['job-integration'].verdict = 'fail';
+        const g = (0, gate_1.computeGate)(s, false, fpCurrent);
+        expect(g.pass).toBe(false);
+        const adverse = g.reasons.filter((r) => r.category === 'adverse-verdict' && /track-integration:/.test(r.detail));
+        expect(adverse).toHaveLength(2);
+    });
+});
+/** Estado de journal de un TRACK individual (C6, R3.5): trackContext con la
+ *  tarea asignada ya `done`, cycleVerificationPlan VACIO (un track no exige
+ *  QA/interlock de ambito de plan), y evidencia local completa (item de
+ *  test/sensors satisfecho, obligaciones spec/quality con verdict pass) —
+ *  todo con el MISMO fingerprint que el gate va a recomputar ('same'). */
+function stateWithCompletedTrackTask() {
+    const s = (0, types_1.emptyState)('track/cli');
+    s.trackContext = { trackId: 'cli', taskIds: ['T1'], planDigest: 'x', baseSha: 'y', planJournalId: 'j-1' };
+    s.requiredVerifiers = ['test', 'sensors'];
+    s.tasks.push({
+        id: 'T1', title: 't', status: 'done', attempts: 1,
+        verificationPlan: [
+            { id: 'v1', kind: 'test', satisfiedBy: 'j1' },
+            { id: 'v-sensors', kind: 'sensors', satisfiedBy: 'j2' },
+        ],
+        reviewObligations: [
+            { id: 'o-spec', taskId: 'T1', kind: 'spec', verdictId: 'verd-spec' },
+            { id: 'o-quality', taskId: 'T1', kind: 'quality', verdictId: 'verd-quality' },
+        ],
+    });
+    s.jobs['j1'] = job({ id: 'j1', fingerprint: 'same', executionState: 'exited', verdict: 'pass' });
+    s.jobs['j2'] = job({ id: 'j2', fingerprint: 'same', executionState: 'exited', verdict: 'pass' });
+    s.verdicts.push({ id: 'verd-spec', obligationId: 'o-spec', result: 'pass', detail: 'ok', receivedAt: 'now', fingerprint: 'same', argv: ['review', 'o-spec'], paths: [], cwd: '.' }, { id: 'verd-quality', obligationId: 'o-quality', result: 'pass', detail: 'ok', receivedAt: 'now', fingerprint: 'same', argv: ['review', 'o-quality'], paths: [], cwd: '.' });
+    return s;
+}
+describe('computeTrackGate — gate local de un track (C6, R3.5)', () => {
+    test('computeTrackGate no exige qa/interlock global (R3.5, C6)', () => {
+        const s = stateWithCompletedTrackTask();
+        expect((0, gate_1.computeTrackGate)(s, false, () => 'same')).toEqual({ pass: true, reasons: [] });
+        expect((0, gate_1.computeGate)(s, false, () => 'same').pass).toBe(false);
+    });
+    test('corrupcion o journal ausente bloquea con categoria propia (corrupt-state)', () => {
+        const g = (0, gate_1.computeTrackGate)(null, true, () => 'same');
+        expect(g.pass).toBe(false);
+        expect(g.reasons).toEqual([{ category: 'corrupt-state', detail: expect.any(String) }]);
+    });
+    test('journal sin trackContext no es un journal de track: bloquea con wrong-context', () => {
+        const s = stateWithCompletedTrackTask();
+        delete s.trackContext;
+        const g = (0, gate_1.computeTrackGate)(s, false, () => 'same');
+        expect(g.pass).toBe(false);
+        expect(g.reasons).toEqual([{ category: 'wrong-context', detail: expect.any(String) }]);
+    });
+    test('una tarea ajena colada en el journal del track se rechaza, jamas certifica por ella (R2.3)', () => {
+        const s = stateWithCompletedTrackTask();
+        s.tasks.push({ id: 'ajena', title: 'x', status: 'done', attempts: 1, verificationPlan: [], reviewObligations: [] });
+        const g = (0, gate_1.computeTrackGate)(s, false, () => 'same');
+        expect(g.pass).toBe(false);
+        expect(g.reasons).toEqual([{ category: 'foreign-task', detail: expect.stringContaining('ajena') }]);
+    });
+    test('sigue exigiendo verificadores mecanicos y fingerprint vigente localmente (no es un gate vacio)', () => {
+        const s = stateWithCompletedTrackTask();
+        s.jobs['j1'].fingerprint = 'cambiado';
+        expect((0, gate_1.computeTrackGate)(s, false, () => 'same').reasons.some((r) => r.category === 'stale-fingerprint')).toBe(true);
+        const s2 = stateWithCompletedTrackTask();
+        s2.requiredVerifiers = ['test', 'sensors', 'lint'];
+        expect((0, gate_1.computeTrackGate)(s2, false, () => 'same').reasons.some((r) => r.category === 'missing-verifier' && /lint/.test(r.detail))).toBe(true);
+    });
 });
 describe('reconcile — matriz unica R1.8 (R3.3)', () => {
     let logs;
@@ -321,3 +458,133 @@ describe('reap — limpieza explicita con identidad validada (R2.2)', () => {
         child.kill('SIGKILL');
     });
 });
+// El guard de contexto (R9.4) se prueba a nivel de comando REGISTRADO: `job
+// gate` y `watch --init` deben rechazar un cwd cuyo descriptor no autentica,
+// y deben proceder EXACTAMENTE igual que antes cuando no hay descriptor
+// (caso comun) o cuando el descriptor si autentica.
+class ExitSignal extends Error {
+    code;
+    constructor(code) {
+        super(`process.exit(${code})`);
+        this.code = code;
+    }
+}
+function gitInitAt(repo, branch) {
+    (0, child_process_1.execFileSync)('git', ['-c', 'user.email=t@t.t', '-c', 'user.name=t', '-c', 'commit.gpgsign=false', 'init', '-q', '-b', branch], { cwd: repo });
+    fs_1.default.writeFileSync(path_1.default.join(repo, 'f.txt'), 'x');
+    (0, child_process_1.execFileSync)('git', ['-c', 'user.email=t@t.t', '-c', 'user.name=t', '-c', 'commit.gpgsign=false', 'add', '.'], { cwd: repo });
+    (0, child_process_1.execFileSync)('git', ['-c', 'user.email=t@t.t', '-c', 'user.name=t', '-c', 'commit.gpgsign=false', 'commit', '-qm', 'c'], { cwd: repo });
+}
+function trackRefFixture(overrides, worktreePath) {
+    return {
+        trackId: 'cli', worktreePath, branch: 'track/cli', ownership: [], sharedResources: [], dependsOn: [],
+        fencingToken: 'f'.repeat(32), phase: 'ACTIVE', readinessNonce: 'n'.repeat(8), ...overrides,
+    };
+}
+function descriptorFixture(overrides, planRoot) {
+    return { schema: 1, planRoot, planBranch: 'main', trackId: 'cli', planJournalId: 'j-1', fencingToken: 'f'.repeat(32), ...overrides };
+}
+async function runCommand(register, argv, cwd) {
+    const prog = new commander_1.Command();
+    prog.exitOverride();
+    register(prog);
+    const outSpy = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    const errSpy = jest.spyOn(process.stderr, 'write').mockImplementation(() => true);
+    const cwdSpy = jest.spyOn(process, 'cwd').mockReturnValue(cwd);
+    let exitCode = null;
+    const exitSpy = jest.spyOn(process, 'exit').mockImplementation(((code) => {
+        exitCode = code ?? 0;
+        throw new ExitSignal(exitCode);
+    }));
+    try {
+        await prog.parseAsync(['node', 'awm', ...argv]);
+    }
+    catch (e) {
+        if (!(e instanceof ExitSignal))
+            throw e;
+    }
+    finally {
+        cwdSpy.mockRestore();
+        exitSpy.mockRestore();
+    }
+    const out = outSpy.mock.calls.map((c) => String(c[0])).join('');
+    const err = errSpy.mock.calls.map((c) => String(c[0])).join('');
+    outSpy.mockRestore();
+    errSpy.mockRestore();
+    return { out, err, exitCode };
+}
+const runJob = (argv, cwd) => runCommand(job_1.registerJobCommand, ['job', ...argv], cwd);
+const runWatch = (argv, cwd) => runCommand(watch_1.registerWatchCommand, ['watch', ...argv], cwd);
+describe('guard de contexto en awm job / awm watch (R9.4)', () => {
+    let planRoot;
+    let trackRoot;
+    let otherRoot;
+    beforeEach(() => {
+        planRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-guard-plan-'));
+        trackRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-guard-track-'));
+        otherRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-guard-other-'));
+        gitInitAt(planRoot, 'main');
+        gitInitAt(trackRoot, 'track/cli');
+        gitInitAt(otherRoot, 'track/cli');
+        (0, store_1.initJournal)(planRoot, 'main');
+        const planState = (0, store_1.readJournal)(planRoot, 'main').state;
+        planState.journalId = 'j-1';
+        planState.tracks = [trackRefFixture({ fencingToken: 'f'.repeat(32) }, trackRoot)];
+        (0, store_1.writeJournal)(planRoot, 'main', planState);
+        (0, store_1.initJournal)(trackRoot, 'track/cli');
+        const trackState = (0, store_1.readJournal)(trackRoot, 'track/cli').state;
+        trackState.trackContext = { trackId: 'cli', taskIds: [], planDigest: 'x', baseSha: 'y', planJournalId: 'j-1' };
+        (0, store_1.writeJournal)(trackRoot, 'track/cli', trackState);
+        (0, descriptor_1.writeDescriptor)(trackRoot, descriptorFixture({ planJournalId: 'j-1', fencingToken: 'f'.repeat(32) }, planRoot));
+        // otherRoot: mismo descriptor (mismo plan/trackId/fencing) pero NO es
+        // el worktree que el TrackRef del plan declara — su realpath jamas
+        // puede autenticar (R9.4), aunque el resto del descriptor "calce".
+        (0, store_1.initJournal)(otherRoot, 'track/cli');
+        const otherState = (0, store_1.readJournal)(otherRoot, 'track/cli').state;
+        otherState.trackContext = { trackId: 'cli', taskIds: [], planDigest: 'x', baseSha: 'y', planJournalId: 'j-1' };
+        (0, store_1.writeJournal)(otherRoot, 'track/cli', otherState);
+        (0, descriptor_1.writeDescriptor)(otherRoot, descriptorFixture({ planJournalId: 'j-1', fencingToken: 'f'.repeat(32) }, planRoot));
+    });
+    afterEach(() => {
+        for (const dir of [planRoot, trackRoot, otherRoot])
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    test('`job gate` desde un cwd cuyo descriptor no autentica (realpath no coincide con el TrackRef) rechaza con "cwd no autenticado"', async () => {
+        const { err, exitCode } = await runJob(['gate'], otherRoot);
+        expect(exitCode).toBe(1);
+        expect(err).toContain('cwd no autenticado');
+    });
+    test('`job gate` desde el cwd autenticado (trackRoot) atraviesa el guard sin bloquear por autenticacion', async () => {
+        const { out, err, exitCode } = await runJob(['gate'], trackRoot);
+        // el guard NO bloqueo (nunca imprime "cwd no autenticado"); computeGate
+        // (todavia global, sin distinguir modo track — eso es de otra task)
+        // bloquea por otras razones, lo cual es esperado y no es objeto de este test.
+        expect(err).not.toContain('cwd no autenticado');
+        expect(exitCode).toBe(1);
+        expect(JSON.parse(out).pass).toBe(false);
+    });
+    test('`watch --init` desde un cwd SIN descriptor (repo comun, sin tracks) procede exactamente como antes de esta task', async () => {
+        const plainRepo = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-guard-plain-'));
+        try {
+            gitInitAt(plainRepo, 'main');
+            const { out, err, exitCode } = await runWatch(['--init'], plainRepo);
+            expect(exitCode).toBeNull();
+            expect(err).toBe('');
+            expect(out).toContain('journal inicializado');
+        }
+        finally {
+            fs_1.default.rmSync(plainRepo, { recursive: true, force: true });
+        }
+    });
+    test('`watch --init` desde el cwd autenticado (trackRoot) procede con normalidad', async () => {
+        const { out, err, exitCode } = await runWatch(['--init'], trackRoot);
+        expect(err).not.toContain('cwd no autenticado');
+        expect(exitCode).toBeNull();
+        expect(out).toContain('journal inicializado');
+    });
+    test('`watch --init` desde un cwd cuyo descriptor no autentica rechaza con "cwd no autenticado"', async () => {
+        const { err, exitCode } = await runWatch(['--init'], otherRoot);
+        expect(exitCode).toBe(1);
+        expect(err).toContain('cwd no autenticado');
+    });
+});

package/dist/tests/commands/track/fixtures.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.trackRefFixture = trackRefFixture;
+exports.descriptorFixture = descriptorFixture;
+function trackRefFixture(overrides, worktreePath) {
+    return {
+        trackId: 'cli', worktreePath, branch: 'track/cli', ownership: [], sharedResources: [], dependsOn: [],
+        fencingToken: 'f'.repeat(32), phase: 'ACTIVE', readinessNonce: 'n'.repeat(8), ...overrides,
+    };
+}
+function descriptorFixture(overrides, planRoot) {
+    return { schema: 1, planRoot, planBranch: 'main', trackId: 'cli', planJournalId: 'j-1', fencingToken: 'f'.repeat(32), ...overrides };
+}

package/dist/tests/commands/track/status.test.js

@@ -0,0 +1,157 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const os_1 = __importDefault(require("os"));
+const child_process_1 = require("child_process");
+const status_1 = require("../../../src/commands/track/status");
+const fingerprint_1 = require("../../../src/core/journal/fingerprint");
+const store_1 = require("../../../src/core/journal/store");
+const paths_1 = require("../../../src/core/journal/paths");
+const fixtures_1 = require("./fixtures");
+// R9.5/R9.6: `aggregateTrackStatus` COMPONE el gate de cada journal de track
+// leyendolo al momento de necesitarlo — jamas escribe de vuelta al journal
+// del plan ni persiste el resultado en el TrackRef.
+function git(cwd, ...args) {
+    (0, child_process_1.execFileSync)('git', ['-c', 'user.email=t@t.t', '-c', 'user.name=t', '-c', 'commit.gpgsign=false', ...args], { cwd });
+}
+function gitInitAt(repo, branch) {
+    fs_1.default.mkdirSync(repo, { recursive: true });
+    git(repo, 'init', '-q', '-b', branch);
+    fs_1.default.writeFileSync(path_1.default.join(repo, 'f.txt'), 'x');
+    git(repo, 'add', '.');
+    git(repo, 'commit', '-qm', 'c');
+}
+describe('aggregateTrackStatus — agregado read-only (R9.5, R9.6)', () => {
+    let planRoot;
+    let trackRoot;
+    const planBranch = 'main';
+    const trackBranch = 'track/cli';
+    beforeEach(() => {
+        planRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-status-plan-'));
+        trackRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-status-track-'));
+        gitInitAt(planRoot, planBranch);
+        gitInitAt(trackRoot, trackBranch);
+        (0, store_1.initJournal)(planRoot, planBranch);
+        (0, store_1.initJournal)(trackRoot, trackBranch);
+    });
+    afterEach(() => {
+        fs_1.default.rmSync(planRoot, { recursive: true, force: true });
+        fs_1.default.rmSync(trackRoot, { recursive: true, force: true });
+    });
+    /** Journal de track que satisface computeTrackGate integramente, con
+     *  fingerprints REALES de `trackRoot` (fingerprintFor usa computeFingerprint
+     *  de verdad, no un stub inyectado). */
+    function writeCompletedTrackJournal() {
+        const fp = (0, fingerprint_1.computeFingerprint)(trackRoot, ['npm', 'test'], [], '.');
+        const s = (0, store_1.readJournal)(trackRoot, trackBranch).state;
+        s.trackContext = { trackId: 'cli', taskIds: ['T1'], planDigest: 'x', baseSha: 'y', planJournalId: 'j-1' };
+        s.requiredVerifiers = ['test', 'sensors'];
+        s.tasks.push({
+            id: 'T1', title: 't', status: 'done', attempts: 1,
+            verificationPlan: [
+                { id: 'v1', kind: 'test', satisfiedBy: 'j1' },
+                { id: 'v-sensors', kind: 'sensors', satisfiedBy: 'j2' },
+            ],
+            reviewObligations: [
+                { id: 'o-spec', taskId: 'T1', kind: 'spec', verdictId: 'verd-spec' },
+                { id: 'o-quality', taskId: 'T1', kind: 'quality', verdictId: 'verd-quality' },
+            ],
+        });
+        const job = (id) => ({
+            id, fingerprint: fp.fingerprint, commandDigest: fp.commandDigest, argv: ['npm', 'test'], cwd: '.',
+            paths: [], expandedPaths: fp.expandedPaths, executionState: 'exited',
+            observationState: 'progressing', verdict: 'pass', phaseTimestamps: {},
+        });
+        s.jobs['j1'] = job('j1');
+        s.jobs['j2'] = job('j2');
+        s.verdicts.push({ id: 'verd-spec', obligationId: 'o-spec', result: 'pass', detail: 'ok', receivedAt: 'now', fingerprint: fp.fingerprint, argv: ['npm', 'test'], paths: [], cwd: '.' }, { id: 'verd-quality', obligationId: 'o-quality', result: 'pass', detail: 'ok', receivedAt: 'now', fingerprint: fp.fingerprint, argv: ['npm', 'test'], paths: [], cwd: '.' });
+        (0, store_1.writeJournal)(trackRoot, trackBranch, s);
+    }
+    test('compone journals al leer y no los espeja (R9.5, R9.6)', () => {
+        writeCompletedTrackJournal();
+        const planState = (0, store_1.readJournal)(planRoot, planBranch).state;
+        planState.tracks = [(0, fixtures_1.trackRefFixture)({}, trackRoot)];
+        (0, store_1.writeJournal)(planRoot, planBranch, planState);
+        const planBefore = fs_1.default.readFileSync((0, paths_1.statePath)(planRoot, planBranch), 'utf8');
+        const currentPlanState = (0, store_1.readJournal)(planRoot, planBranch).state;
+        const out = (0, status_1.aggregateTrackStatus)(planRoot, currentPlanState);
+        expect(out.tracks.cli.gate.pass).toBe(true);
+        expect(currentPlanState.tracks[0]).not.toHaveProperty('gate');
+        expect(fs_1.default.readFileSync((0, paths_1.statePath)(planRoot, planBranch), 'utf8')).toBe(planBefore);
+    });
+    test('journal de track corrupto/ausente nunca se descarta en silencio: gate rojo con corrupt-state', () => {
+        // ni siquiera se inicializa el journal del segundo track: readJournal
+        // sobre un directorio sin state.json => corrupt:true (R1.6).
+        const missingTrackRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-status-missing-'));
+        try {
+            const planState = (0, store_1.readJournal)(planRoot, planBranch).state;
+            planState.tracks = [(0, fixtures_1.trackRefFixture)({ trackId: 'ghost', branch: 'track/ghost' }, missingTrackRoot)];
+            (0, store_1.writeJournal)(planRoot, planBranch, planState);
+            const out = (0, status_1.aggregateTrackStatus)(planRoot, (0, store_1.readJournal)(planRoot, planBranch).state);
+            expect(out.tracks.ghost.gate.pass).toBe(false);
+            expect(out.tracks.ghost.gate.reasons).toEqual([{ category: 'corrupt-state', detail: expect.any(String) }]);
+        }
+        finally {
+            fs_1.default.rmSync(missingTrackRoot, { recursive: true, force: true });
+        }
+    });
+    test('journal de track roto (fingerprint stale) reporta gate rojo, no lo esconde', () => {
+        writeCompletedTrackJournal();
+        // el worktree del track cambia DESPUES de que el job registro su
+        // fingerprint: la evidencia queda historica.
+        fs_1.default.writeFileSync(path_1.default.join(trackRoot, 'f.txt'), 'cambiado');
+        const planState = (0, store_1.readJournal)(planRoot, planBranch).state;
+        planState.tracks = [(0, fixtures_1.trackRefFixture)({}, trackRoot)];
+        (0, store_1.writeJournal)(planRoot, planBranch, planState);
+        const out = (0, status_1.aggregateTrackStatus)(planRoot, (0, store_1.readJournal)(planRoot, planBranch).state);
+        expect(out.tracks.cli.gate.pass).toBe(false);
+        expect(out.tracks.cli.gate.reasons.some((r) => r.category === 'stale-fingerprint')).toBe(true);
+    });
+    test('sin tracks declarados, el agregado es vacio y el cohort lo dice explicitamente', () => {
+        const out = (0, status_1.aggregateTrackStatus)(planRoot, (0, store_1.readJournal)(planRoot, planBranch).state);
+        expect(out).toEqual({ cohort: 'sin tracks declarados', tracks: {} });
+    });
+});
+describe('deriveCohortPhase — string de display, no decide protocolo', () => {
+    function ref(trackId, phase) {
+        return (0, fixtures_1.trackRefFixture)({ trackId, phase }, `/tmp/${trackId}`);
+    }
+    test('sin tracks: mensaje explicito', () => {
+        expect((0, status_1.deriveCohortPhase)([])).toBe('sin tracks declarados');
+    });
+    test('cualquier BLOCKED domina el mensaje, nombrando los ids ordenados', () => {
+        const out = (0, status_1.deriveCohortPhase)([ref('b', 'ACTIVE'), ref('a', 'BLOCKED'), ref('c', 'BLOCKED')]);
+        expect(out).toBe('BLOCKED: a, c');
+    });
+    test('sin BLOCKED, reporta la fase MENOS avanzada como cuello de botella', () => {
+        // ARMED antecede a ACTIVE en TRACK_PHASES: el track menos avanzado
+        // marca el ritmo de la cohorte, no el mas adelantado.
+        const out = (0, status_1.deriveCohortPhase)([ref('a', 'ACTIVE'), ref('b', 'ARMED')]);
+        expect(out).toBe('ARMED (1/2)');
+    });
+    test('todos en la misma fase: cuenta el total', () => {
+        expect((0, status_1.deriveCohortPhase)([ref('a', 'ACTIVE'), ref('b', 'ACTIVE')])).toBe('ACTIVE (2/2)');
+    });
+});
+describe('fingerprintFor — espejo de realFingerprintNow cerrado sobre el worktree observado', () => {
+    let worktree;
+    beforeEach(() => {
+        worktree = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-fpfor-'));
+        gitInitAt(worktree, 'main');
+    });
+    afterEach(() => { fs_1.default.rmSync(worktree, { recursive: true, force: true }); });
+    test('coincide con computeFingerprint contra el MISMO worktree que cierra', () => {
+        const expected = (0, fingerprint_1.computeFingerprint)(worktree, ['npm', 'test'], [], '.').fingerprint;
+        expect((0, status_1.fingerprintFor)(worktree)(['npm', 'test'], [], '.')).toBe(expected);
+    });
+    test('argv invalido (vacio) nunca lanza — se degrada a null, nunca certifica', () => {
+        expect((0, status_1.fingerprintFor)(worktree)([], [], '.')).toBeNull();
+    });
+    test('cwd fuera del repo tambien se degrada a null en vez de propagar la excepcion', () => {
+        expect((0, status_1.fingerprintFor)(worktree)(['npm', 'test'], [], '../fuera')).toBeNull();
+    });
+});

package/dist/tests/commands/track/supervisor-wrapper-cli.test.js

@@ -0,0 +1,129 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Task 8 post-review item 3: CLI-level coverage de `awm track supervisor-wrapper`
+// — el registro de flags requeridos y el guard de descriptor, invocados vía
+// Commander (mismo patrón que verbs.test.ts), no llamando a
+// `runSupervisorWrapper` directamente. El único escenario que llega a
+// ejecutar el wrapper real deja el track BLOCKED en el journal del plan para
+// que retorne sin nunca spawnear `awm watch` de verdad.
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const os_1 = __importDefault(require("os"));
+const child_process_1 = require("child_process");
+const commander_1 = require("commander");
+const track_1 = require("../../../src/commands/track");
+const store_1 = require("../../../src/core/journal/store");
+const descriptor_1 = require("../../../src/core/tracks/descriptor");
+const fixtures_1 = require("./fixtures");
+class ExitSignal extends Error {
+    code;
+    constructor(code) {
+        super(`process.exit(${code})`);
+        this.code = code;
+    }
+}
+function git(repo, args) {
+    return (0, child_process_1.execFileSync)('git', args, { cwd: repo, encoding: 'utf8' }).trim();
+}
+function gitInit(repo, branch) {
+    (0, child_process_1.execFileSync)('git', ['-c', 'user.email=t@t.t', '-c', 'user.name=t', '-c', 'commit.gpgsign=false', 'init', '-q', '-b', branch], { cwd: repo });
+    fs_1.default.writeFileSync(path_1.default.join(repo, 'f.txt'), 'x');
+    (0, child_process_1.execFileSync)('git', ['-c', 'user.email=t@t.t', '-c', 'user.name=t', '-c', 'commit.gpgsign=false', 'add', '.'], { cwd: repo });
+    (0, child_process_1.execFileSync)('git', ['-c', 'user.email=t@t.t', '-c', 'user.name=t', '-c', 'commit.gpgsign=false', 'commit', '-qm', 'c'], { cwd: repo });
+}
+async function runCli(repo, argv) {
+    const prog = new commander_1.Command();
+    prog.exitOverride();
+    (0, track_1.registerTrackCommand)(prog);
+    const outSpy = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    const errSpy = jest.spyOn(process.stderr, 'write').mockImplementation(() => true);
+    const cwdSpy = jest.spyOn(process, 'cwd').mockReturnValue(repo);
+    let exitCode = 0;
+    const exitSpy = jest.spyOn(process, 'exit').mockImplementation(((code) => {
+        exitCode = code ?? 0;
+        throw new ExitSignal(exitCode);
+    }));
+    try {
+        await prog.parseAsync(['node', 'awm', ...argv]);
+    }
+    catch (e) {
+        if (e instanceof ExitSignal) {
+            // ya capturado por el spy de process.exit
+        }
+        else if (typeof e.exitCode === 'number') {
+            exitCode = e.exitCode;
+        }
+        else {
+            throw e;
+        }
+    }
+    finally {
+        cwdSpy.mockRestore();
+        exitSpy.mockRestore();
+    }
+    const out = outSpy.mock.calls.map((c) => String(c[0])).join('');
+    const err = errSpy.mock.calls.map((c) => String(c[0])).join('');
+    outSpy.mockRestore();
+    errSpy.mockRestore();
+    return { out, err, exitCode };
+}
+describe('awm track supervisor-wrapper — CLI (R4.7, R9.4, post-review item 3)', () => {
+    let planRoot;
+    let trackRoot;
+    beforeEach(() => {
+        planRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-wrapper-cli-plan-'));
+        trackRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-wrapper-cli-track-'));
+        gitInit(planRoot, 'main');
+        gitInit(trackRoot, 'track/cli');
+        (0, store_1.initJournal)(planRoot, 'main');
+    });
+    afterEach(() => {
+        fs_1.default.rmSync(planRoot, { recursive: true, force: true });
+        fs_1.default.rmSync(trackRoot, { recursive: true, force: true });
+    });
+    test.each([
+        ['sin --track', ['track', 'supervisor-wrapper', '--readiness', 'r', '--fence', 'f', '--nonce', 'n']],
+        ['sin --readiness', ['track', 'supervisor-wrapper', '--track', 'cli', '--fence', 'f', '--nonce', 'n']],
+        ['sin --fence', ['track', 'supervisor-wrapper', '--track', 'cli', '--readiness', 'r', '--nonce', 'n']],
+        ['sin --nonce', ['track', 'supervisor-wrapper', '--track', 'cli', '--readiness', 'r', '--fence', 'f']],
+    ])('%s: commander rechaza antes de tocar ningún descriptor/journal', async (_label, argv) => {
+        const out = await runCli(trackRoot, argv);
+        expect(out.exitCode).not.toBe(0);
+    });
+    test('sin descriptor de track en el cwd: rechaza sin autenticar (R9.4)', async () => {
+        const out = await runCli(trackRoot, ['track', 'supervisor-wrapper', '--track', 'cli', '--readiness', 'r', '--fence', 'f', '--nonce', 'n']);
+        expect(out.exitCode).toBe(1);
+        expect(out.err).toContain('sin descriptor de track');
+    });
+    test('descriptor presente pero trackId no coincide con --track: aborta antes de reclamar nada', async () => {
+        (0, descriptor_1.writeDescriptor)(trackRoot, (0, fixtures_1.descriptorFixture)({ trackId: 'cli' }, planRoot));
+        const out = await runCli(trackRoot, ['track', 'supervisor-wrapper', '--track', 'otro-track', '--readiness', 'r', '--fence', 'f'.repeat(32), '--nonce', 'n']);
+        expect(out.exitCode).toBe(1);
+        expect(out.err).toContain('no coincide');
+        expect(fs_1.default.existsSync(path_1.default.join(trackRoot, '.awm', 'supervisor.claim'))).toBe(false);
+    });
+    test('descriptor presente pero fencingToken no coincide con --fence: aborta antes de reclamar nada', async () => {
+        (0, descriptor_1.writeDescriptor)(trackRoot, (0, fixtures_1.descriptorFixture)({ trackId: 'cli', fencingToken: 'f'.repeat(32) }, planRoot));
+        const out = await runCli(trackRoot, ['track', 'supervisor-wrapper', '--track', 'cli', '--readiness', 'r', '--fence', 'g'.repeat(32), '--nonce', 'n']);
+        expect(out.exitCode).toBe(1);
+        expect(out.err).toContain('no coincide');
+        expect(fs_1.default.existsSync(path_1.default.join(trackRoot, '.awm', 'supervisor.claim'))).toBe(false);
+    });
+    test('descriptor autenticado: reclama, escribe sidecars, y sale 0 sin lanzar `awm watch` cuando el plan bloquea el track', async () => {
+        (0, descriptor_1.writeDescriptor)(trackRoot, (0, fixtures_1.descriptorFixture)({ trackId: 'cli', planBranch: 'main', fencingToken: 'f'.repeat(32) }, planRoot));
+        const planState = (0, store_1.readJournal)(planRoot, 'main').state;
+        planState.tracks = [(0, fixtures_1.trackRefFixture)({ trackId: 'cli', phase: 'BLOCKED', readinessNonce: 'nonce-cli'.padEnd(32, '0') }, trackRoot)];
+        (0, store_1.writeJournal)(planRoot, 'main', planState);
+        const out = await runCli(trackRoot, [
+            'track', 'supervisor-wrapper', '--track', 'cli',
+            '--readiness', 'nonce-cli'.padEnd(32, '0'), '--fence', 'f'.repeat(32), '--nonce', 'real-nonce',
+        ]);
+        expect(out.exitCode).toBe(0);
+        expect(fs_1.default.existsSync(path_1.default.join(trackRoot, '.awm', 'supervisor.claim'))).toBe(true);
+        const identity = JSON.parse(fs_1.default.readFileSync(path_1.default.join(trackRoot, '.awm', 'supervisor.identity.json'), 'utf8'));
+        expect(identity.nonce).toBe('real-nonce'); // el eco end-to-end del nonce también se ejercita vía CLI
+    });
+});