agentic-workflow-manager 8.3.0 → 8.5.0

package/dist/tests/core/dashboard/production-adapters.test.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const collect_1 = require("../../../src/core/dashboard/collect");
+function context() {
+    return {
+        machine: {},
+        project: {
+            root: '/private/project',
+            profile: { present: true, extensions: ['delivery'], registries: { base: '1.2.3' } },
+            activeBundles: { expected: ['delivery'], linked: ['delivery'], broken: [] },
+            orphanLinks: { repairable: [], dead: [], usurped: [] },
+            sensors: { present: true }, constitution: { present: true }, context: { present: true, file: 'AGENTS.md' },
+        },
+        providers: [{
+                id: 'codex', label: 'Codex', tier: 'hooks-native', checks: [
+                    { id: 'binary.version', state: 'supported', target: '0.145.0' },
+                    { id: 'hook.trust', state: 'pending-trust', remediationCode: 'awm hooks trust --agent codex' },
+                ],
+            }],
+    };
+}
+describe('productionDashboardAdapters', () => {
+    it('maps existing diagnostics into canonical, share-safe machine and project facts', () => {
+        const adapters = (0, collect_1.productionDashboardAdapters)(context());
+        const machine = adapters.machine({ cwd: '/private/project' });
+        const project = adapters.project({ root: '/private/project' });
+        expect(machine.findings).toEqual(expect.arrayContaining([
+            expect.objectContaining({ id: 'machine.provider.codex.binary.version', state: 'ok' }),
+            expect.objectContaining({ id: 'machine.provider.codex.hook.trust', state: 'attention' }),
+        ]));
+        expect(project.findings).toEqual(expect.arrayContaining([
+            expect.objectContaining({ id: 'project.profile.present', state: 'ok' }),
+            expect.objectContaining({ id: 'project.extensions.configured', state: 'ok' }),
+            expect.objectContaining({ id: 'project.registry-pins.present', state: 'ok' }),
+            expect.objectContaining({ id: 'project.context.present', state: 'ok' }),
+            expect.objectContaining({ id: 'project.constitution.present', state: 'ok' }),
+            expect.objectContaining({ id: 'project.sensors.present', state: 'ok' }),
+        ]));
+        expect(JSON.stringify({ machine, project })).not.toMatch(/private|0\.145\.0|hooks trust/i);
+    });
+    it('reports only source-verified remediation and leaves unavailable lifecycle sources explicit', () => {
+        const adapters = (0, collect_1.productionDashboardAdapters)({ ...context(), project: null });
+        expect(adapters.machine({ cwd: '/tmp' }).findings).toEqual(expect.arrayContaining([
+            expect.objectContaining({ id: 'machine.provider.codex.hook.trust', remediationVerified: false }),
+        ]));
+        expect(adapters.execution({ root: '/tmp' })).toBeUndefined();
+    });
+    it('contains no diagnostic prose or raw source details', () => {
+        const facts = context();
+        facts.providers[0].checks[1].detail = 'token=secret /private/path <script>';
+        const serialized = JSON.stringify((0, collect_1.productionDashboardAdapters)(facts).machine({ cwd: '/private/project' }));
+        expect(serialized).not.toMatch(/token|secret|private|script/i);
+    });
+    it('retains stable provider ids after collection and maps a verified bundle remedy', () => {
+        const facts = context();
+        facts.project.activeBundles.broken = ['delivery'];
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({
+            cwd: process.cwd(), now: '2026-08-22T00:00:00.000Z', adapters: (0, collect_1.productionDashboardAdapters)(facts),
+        });
+        const machine = snapshot.sections.find((section) => section.id === 'machine');
+        const project = snapshot.sections.find((section) => section.id === 'project');
+        expect(machine.items).toEqual(expect.arrayContaining([
+            expect.objectContaining({ id: 'machine.provider.codex.binary.version', state: 'ok' }),
+        ]));
+        expect(project.items).toEqual(expect.arrayContaining([
+            expect.objectContaining({ id: 'project.bundles.coherent', remediation: 'awm sync' }),
+        ]));
+        expect(JSON.stringify(snapshot)).not.toMatch(/remediationVerified|private|0\.145\.0|token/i);
+    });
+});

package/dist/tests/core/dashboard/render-html.test.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const render_html_1 = require("../../../src/core/dashboard/render-html");
+const types_1 = require("../../../src/core/dashboard/types");
+const validate_1 = require("../../../src/core/dashboard/validate");
+function snapshot(overrides = {}) {
+    return (0, types_1.dashboardSnapshot)({
+        project: { detected: true, label: 'doctor-dashboard' },
+        confidence: 'observing',
+        sections: [
+            { id: 'machine', availability: 'available', items: [{ id: 'machine.cli', label: 'CLI', state: 'ok', detail: 'v8.1.6' }] },
+            { id: 'project', availability: 'available', items: [{ id: 'project.context', label: 'Context', state: 'attention', remediation: 'awm sync' }] },
+            { id: 'planning', availability: 'available', items: [] },
+            { id: 'execution', availability: 'available', items: [] },
+            { id: 'qa', availability: 'available', items: [] },
+            { id: 'retro', availability: 'available', items: [] },
+            { id: 'history', availability: 'available', items: [] },
+        ],
+        ...overrides,
+    });
+}
+describe('renderDashboardHtml', () => {
+    it('emits a self-contained scriptless document with the exact restrictive CSP and escaped dynamic values', () => {
+        const html = (0, render_html_1.renderDashboardHtml)((0, validate_1.validateDashboardSnapshotV1)(snapshot({
+            project: { detected: true, label: '<img src=x onerror=alert(1)>' },
+            sections: [
+                { id: 'machine', availability: 'available', items: [{ id: 'hostile', label: '<script>alert(1)</script>', state: 'attention', detail: '"quoted"', remediation: 'awm sync && echo <unsafe>' }] },
+                { id: 'project', availability: 'not_applicable', items: [] }, { id: 'planning', availability: 'not_applicable', items: [] },
+                { id: 'execution', availability: 'not_applicable', items: [] }, { id: 'qa', availability: 'not_applicable', items: [] },
+                { id: 'retro', availability: 'not_applicable', items: [] }, { id: 'history', availability: 'not_applicable', items: [] },
+            ],
+        })));
+        expect(html).toContain(`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; img-src data:; script-src 'none'; connect-src 'none'; frame-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'">`);
+        expect(html).toContain('&lt;script&gt;alert(1)&lt;/script&gt;');
+        expect(html).toContain('&lt;img src=x onerror=alert(1)&gt;');
+        expect(html).toContain('awm sync &amp;&amp; echo &lt;unsafe&gt;');
+        expect(html).not.toMatch(/<script|https?:\/\//i);
+    });
+    it('uses semantic landmarks and ordered sections with text state, focus, print, responsive, and reduced-motion support', () => {
+        const html = (0, render_html_1.renderDashboardHtml)((0, validate_1.validateDashboardSnapshotV1)(snapshot()));
+        expect(html).toMatch(/<header[\s>]/);
+        expect(html).toContain('data-operational-sidebar aria-label="Dashboard sections"');
+        expect(html).toMatch(/<main[\s>]/);
+        expect(html).toMatch(/<footer[\s>]/);
+        for (const heading of ['Machine / install', 'Project readiness', 'Design / planning', 'Execution', 'QA', 'Retro', 'Final / history'])
+            expect(html).toContain(`<h2>${heading}</h2>`);
+        expect(html).toContain('<table>');
+        expect(html).toContain('<th scope="col">State</th>');
+        expect(html).not.toMatch(/<span class="state [^"]+" aria-label=/);
+        expect(html).toContain(':focus-visible');
+        expect(html).toContain('@media print');
+        expect(html).toContain('@media (max-width: 720px)');
+        expect(html).toContain('@media (prefers-reduced-motion: reduce)');
+        expect(html).not.toMatch(/score|ranking/i);
+    });
+    it('matches the machine-only diagnostic composition with cards, privacy boundary, and prioritized remedies', () => {
+        const html = (0, render_html_1.renderDashboardHtml)((0, validate_1.validateDashboardSnapshotV1)(snapshot({
+            project: { detected: false, label: 'No project detected' },
+            sections: [{ id: 'machine', availability: 'available', items: [
+                        { id: 'machine.cli', label: 'Installation', state: 'ok', detail: 'v8.1.6' },
+                        { id: 'machine.sensors', label: 'Sensors', state: 'attention', remediation: 'awm sensors run' },
+                        { id: 'machine.permissions', label: 'Permissions', state: 'missing', remediation: 'awm init' },
+                    ] }],
+        })));
+        expect(html).toContain('data-machine-bento');
+        expect(html.match(/class="bento-card"/g)).toHaveLength(3);
+        expect(html).toContain('<h2>Instalación</h2>');
+        expect(html).not.toContain('<article class="bento-card"><h3>Instalación</h3>');
+        expect(html).toContain('Privacy &amp; security');
+        expect(html).toContain('data-static-privacy-toggle');
+        expect(html).toContain('type="checkbox" checked disabled');
+        expect(html).toContain('Siguiente acción requerida');
+        expect(html).toContain('Copy command (static)');
+        expect(html).toContain('data-machine-bento');
+        expect(html).toContain('data-next-actions');
+        expect(html.match(/data-next-action=/g)).toHaveLength(3);
+        expect(html).toContain('Inicializar proyecto');
+        expect(html).toContain('<code>awm init</code>');
+        expect(html.indexOf('awm sensors run')).toBeLessThan(html.indexOf('awm init'));
+    });
+    it('uses neutral machine configuration semantics when no project is detected', () => {
+        const html = (0, render_html_1.renderDashboardHtml)((0, validate_1.validateDashboardSnapshotV1)(snapshot({
+            project: { detected: false, label: 'No project detected' },
+            sections: [{ id: 'machine', availability: 'available', items: [] }],
+        })));
+        expect(html).toContain('<h1>Machine configuration</h1>');
+        expect(html).toContain('Machine readiness and safe configuration state outside a project.');
+        expect(html).toContain('aria-label="Machine configuration sections"');
+        expect(html).not.toContain('Project lifecycle');
+        expect(html).not.toContain('Dashboard sections');
+    });
+    it('matches the project lifecycle composition with machine preparation, timeline, provisional evidence, plans, and history', () => {
+        const html = (0, render_html_1.renderDashboardHtml)((0, validate_1.validateDashboardSnapshotV1)(snapshot({ confidence: 'provisional' })));
+        expect(html).toContain('class="machine-preparation-strip" data-machine-preparation');
+        expect(html).toContain('data-machine-preparation role="group" aria-labelledby="machine-preparation-heading"');
+        expect(html).toContain('class="lifecycle-timeline" data-lifecycle-timeline');
+        expect(html).toContain('data-lifecycle-timeline aria-labelledby="lifecycle-timeline-heading"');
+        expect(html).toContain('class="timeline connected-timeline"');
+        expect(html).toContain('<span aria-hidden="true" class="timeline-marker"></span>');
+        for (const stage of ['Planning', 'Execution', 'QA', 'Retro', 'Evidence'])
+            expect(html).toContain(`data-stage="${stage.toLowerCase()}"`);
+        expect(html).toContain('Provisional evidence');
+        expect(html).toContain('data-project-evidence role="group" aria-labelledby="project-evidence-heading"');
+        expect(html).toContain('Planes de trabajo');
+        expect(html).toContain('Impacto y trazabilidad');
+        expect(html).toContain('data-project-header-actions role="group" aria-label="Project actions"');
+        expect(html).toContain('data-project-breadcrumb');
+        expect(html).toContain('data-project-nav');
+        expect(html).toContain('data-machine-preparation-card="installation"');
+        expect(html).toContain('data-machine-preparation-card="sensors"');
+        expect(html).toContain('data-machine-preparation-card="persistence"');
+        expect(html).toContain('data-plan-card="active"');
+        expect(html).toContain('data-plan-card="blocked"');
+        expect(html).toContain('Progreso: sin observación');
+        expect(html).toContain('Ver plan (estático)');
+        expect(html).toContain('<th scope="col">Tipo</th>');
+        expect(html).toContain('<th scope="col">Fuente</th>');
+        expect(html).toContain('<th scope="col">Estado</th>');
+        expect(html).toContain('<th scope="col">Fecha</th>');
+        expect(html).toContain('No hay evidencia de impacto disponible en este snapshot.');
+        expect(html).toContain('data-closure-actions role="group" aria-labelledby="closure-actions-heading"');
+    });
+    it('uses the compact approved desktop composition rather than stretched generic cards', () => {
+        const html = (0, render_html_1.renderDashboardHtml)((0, validate_1.validateDashboardSnapshotV1)(snapshot({ confidence: 'provisional' })));
+        expect(html).toContain('<div class="dashboard-content">');
+        expect(html).toContain('width:min(100%,72rem)');
+        expect(html).toContain('.machine-preparation-strip {');
+        expect(html).toContain('.connected-timeline { border-top:1px solid var(--border);');
+        expect(html).toContain('.timeline-marker {');
+        expect(html).not.toContain('.timeline li::before');
+        expect(html).not.toContain('.connected-timeline::before');
+        expect(html).toContain('.timeline .state.unavailable { background:#38141c; color:#fff0ed;');
+        expect(html).toContain('.evidence-grid.compact-composition');
+        expect(html).toContain('font:14px/1.35');
+    });
+    it('includes the artifact-aligned, noninteractive machine toolbar without weakening static CSP', () => {
+        const html = (0, render_html_1.renderDashboardHtml)((0, validate_1.validateDashboardSnapshotV1)(snapshot({
+            project: { detected: false, label: 'No project detected' },
+            sections: [{ id: 'machine', availability: 'available', items: [] }],
+        })));
+        expect(html).toContain('data-dashboard-toolbar');
+        expect(html).toContain('data-operational-sidebar');
+        for (const label of ['Inicio', 'Estado', 'Configuración', 'Terminal'])
+            expect(html).toContain(`>${label}<`);
+        expect(html).toContain('data-sidebar-diagnose');
+        expect(html).toContain('data-sidebar-operator-controls');
+        expect(html).toContain('aria-label="Search dashboard"');
+        expect(html).toContain('placeholder="Search resources" disabled');
+        for (const label of ['Notifications (static)', 'Help (static)', 'Export dashboard (static)', 'New deployment (static)']) {
+            expect(html).toContain(label);
+        }
+        expect(html).toContain("script-src 'none'");
+    });
+    it('renders every canonical project section once and in lifecycle order', () => {
+        const html = (0, render_html_1.renderDashboardHtml)((0, validate_1.validateDashboardSnapshotV1)(snapshot({ confidence: 'provisional' })));
+        const ids = ['machine', 'project', 'planning', 'execution', 'qa', 'retro', 'history'];
+        const positions = ids.map((id) => html.indexOf(`<section id="${id}"`));
+        expect(positions.every((position) => position >= 0)).toBe(true);
+        expect([...positions].sort((left, right) => left - right)).toEqual(positions);
+        for (const id of ids)
+            expect(html.match(new RegExp(`<section id="${id}"`, 'g'))).toHaveLength(1);
+        expect(html.match(/<section[\s>]/g)).toHaveLength(ids.length);
+    });
+    it('is deterministic and preserves every history and task observation without privacy leakage', () => {
+        const sections = ['machine', 'project', 'planning', 'execution', 'qa', 'retro', 'history'].map((id) => ({
+            id: id, availability: 'available',
+            items: id === 'history' ? Array.from({ length: 500 }, (_, index) => ({ id: `history.${index}`, label: `Cycle ${index}`, state: 'ok' })) : id === 'execution' ? Array.from({ length: 2000 }, (_, index) => ({ id: `execution.${index}`, label: `Task ${index}`, state: 'ok' })) : [],
+        }));
+        const value = (0, validate_1.validateDashboardSnapshotV1)(snapshot({ sections }));
+        const first = (0, render_html_1.renderDashboardHtml)(value);
+        expect((0, render_html_1.renderDashboardHtml)(value)).toBe(first);
+        expect(first).toContain('Cycle 499');
+        expect(first).toContain('Task 1999');
+    });
+    it('renders supplied plans and evidence facts in the dense project panels', () => {
+        const html = (0, render_html_1.renderDashboardHtml)((0, validate_1.validateDashboardSnapshotV1)(snapshot({
+            confidence: 'supported',
+            sections: [
+                { id: 'machine', availability: 'available', items: [] }, { id: 'project', availability: 'available', items: [] },
+                { id: 'planning', availability: 'available', items: [{ id: 'plan.alpha', label: 'Impact plan', state: 'ok', detail: 'executed' }] },
+                { id: 'execution', availability: 'available', items: [] }, { id: 'qa', availability: 'available', items: [] }, { id: 'retro', availability: 'available', items: [] },
+                { id: 'history', availability: 'available', items: [{ id: 'history.cycle.abc', label: 'Cycle abc', state: 'ok', detail: 'plan executed; tasks 3; retries 2; QA 2/2; first-pass yes; cures supported' }] },
+            ],
+        })));
+        expect(html).toContain('Confidence: supported');
+        expect(html).toContain('Impact plan');
+        expect(html).toContain('Cycle abc');
+        expect(html).toContain('retries 2; QA 2/2; first-pass yes; cures supported');
+        expect(html).not.toContain('Progreso: sin observación');
+    });
+});

package/dist/tests/core/dashboard/render-terminal.test.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const render_terminal_1 = require("../../../src/core/dashboard/render-terminal");
+const types_1 = require("../../../src/core/dashboard/types");
+const validate_1 = require("../../../src/core/dashboard/validate");
+function completeSnapshot(overrides = {}) {
+    return (0, types_1.dashboardSnapshot)({
+        project: { detected: true, label: 'agentic-workflow' },
+        confidence: 'provisional',
+        overall: 'degraded',
+        sections: [
+            { id: 'machine', availability: 'available', items: [{ id: 'machine.cli', label: 'CLI installation', state: 'ok', detail: 'v8.1.6' }] },
+            { id: 'project', availability: 'available', items: [{ id: 'project.sensors', label: 'Sensors', state: 'attention', detail: '2 stale', remediation: 'awm sync' }] },
+            { id: 'planning', availability: 'available', items: [{ id: 'planning.plan', label: 'Active plan', state: 'ok', detail: 'executing' }] },
+            { id: 'execution', availability: 'unavailable', items: [{ id: 'execution.source', label: 'Execution source', state: 'unavailable', remediation: 'awm doctor --full' }] },
+            { id: 'qa', availability: 'available', items: [{ id: 'qa.gate', label: 'Verification gate', state: 'missing', remediation: 'awm sensors' }] },
+            { id: 'retro', availability: 'available', items: [{ id: 'retro.cure', label: 'Cure observations', state: 'not_applicable' }] },
+            { id: 'history', availability: 'available', items: [{ id: 'history.cycle', label: 'Eligible cycle', state: 'ok', detail: '5 minutes' }] },
+        ],
+        ...overrides,
+    });
+}
+describe('renderFullTerminal', () => {
+    it('renders all lifecycle sections in canonical order with status and remediation', () => {
+        const output = (0, render_terminal_1.renderFullTerminal)((0, validate_1.validateDashboardSnapshotV1)(completeSnapshot()));
+        const headings = ['Machine / install', 'Project readiness', 'Design / planning', 'Execution', 'QA', 'Retro', 'Final / history'];
+        expect(headings.map((heading) => output.indexOf(heading))).toEqual([...headings.map((_, index) => expect.any(Number))].map((_, index) => expect.any(Number)));
+        for (let index = 1; index < headings.length; index++)
+            expect(output.indexOf(headings[index])).toBeGreaterThan(output.indexOf(headings[index - 1]));
+        expect(output).toContain('⚠ Sensors [project.sensors] — 2 stale');
+        expect(output).toContain('→ awm sync');
+        expect(output).toContain('⊘ Execution source [execution.source] — unavailable');
+        expect(output).toContain('✖ Verification gate [qa.gate] — missing');
+    });
+    it('renders machine-only, unavailable, provisional, and empty states honestly without ANSI color', () => {
+        const output = (0, render_terminal_1.renderFullTerminal)((0, validate_1.validateDashboardSnapshotV1)((0, types_1.dashboardSnapshot)({
+            overall: 'degraded',
+            confidence: 'provisional',
+            sections: [{ id: 'machine', availability: 'unavailable', items: [] }],
+        })));
+        expect(output).toContain('Project: No project detected');
+        expect(output).toContain('Confidence: provisional');
+        expect(output).toContain('source unavailable');
+        expect(output).toContain('No observations reported.');
+        expect(output).not.toMatch(/\u001b\[/);
+    });
+    it('keeps every long-history and large-task observation visible deterministically', () => {
+        const history = Array.from({ length: 500 }, (_, index) => ({ id: `history.${index}`, label: `Cycle ${index}`, state: 'ok', detail: `${index} retries` }));
+        const execution = Array.from({ length: 2000 }, (_, index) => ({ id: `execution.${index}`, label: `Task ${index}`, state: 'ok' }));
+        const snapshot = (0, validate_1.validateDashboardSnapshotV1)(completeSnapshot({ sections: [
+                { id: 'machine', availability: 'available', items: [] },
+                { id: 'project', availability: 'available', items: [] },
+                { id: 'planning', availability: 'available', items: [] },
+                { id: 'execution', availability: 'available', items: execution },
+                { id: 'qa', availability: 'available', items: [] },
+                { id: 'retro', availability: 'available', items: [] },
+                { id: 'history', availability: 'available', items: history },
+            ] }));
+        const first = (0, render_terminal_1.renderFullTerminal)(snapshot);
+        expect((0, render_terminal_1.renderFullTerminal)(snapshot)).toBe(first);
+        expect(first).toContain('Task 1999');
+        expect(first).toContain('Cycle 499');
+        expect(first).not.toMatch(/score|ranking/i);
+    });
+    it('renders explicit confidence and every evidence metric without improvement claims', () => {
+        const output = (0, render_terminal_1.renderFullTerminal)((0, validate_1.validateDashboardSnapshotV1)(completeSnapshot({ confidence: 'supported' })));
+        expect(output).toContain('Confidence: supported');
+        expect(output).toContain('Eligible evidence rows: 1');
+        expect(output).toContain('5 minutes');
+        expect(output).not.toMatch(/trend|percentage|improvement/i);
+    });
+});

package/dist/tests/core/dashboard/write-html.test.js

@@ -0,0 +1,112 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const write_html_1 = require("../../../src/core/dashboard/write-html");
+describe('writeHtmlAtomically', () => {
+    let root;
+    beforeEach(() => { root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-html-')); });
+    afterEach(() => fs_1.default.rmSync(root, { recursive: true, force: true }));
+    it.each(['', '--flag'])('rejects invalid target %s', (target) => {
+        expect(() => (0, write_html_1.resolveHtmlTarget)({ cwd: root, target })).toThrow();
+    });
+    it('resolves relative targets and refuses overwrite without force', () => {
+        const target = (0, write_html_1.resolveHtmlTarget)({ cwd: root, target: 'report.html' });
+        (0, write_html_1.writeHtmlAtomically)({ cwd: root, target, html: '<h1>one</h1>' });
+        expect(fs_1.default.readFileSync(target, 'utf8')).toBe('<h1>one</h1>');
+        expect(() => (0, write_html_1.resolveHtmlTarget)({ cwd: root, target: 'report.html' })).toThrow(/exists/i);
+        expect((0, write_html_1.resolveHtmlTarget)({ cwd: root, target: 'report.html', force: true })).toBe(target);
+    });
+    it('rejects directories and symlinks', () => {
+        fs_1.default.mkdirSync(path_1.default.join(root, 'dir'));
+        fs_1.default.writeFileSync(path_1.default.join(root, 'real.html'), 'x');
+        fs_1.default.symlinkSync(path_1.default.join(root, 'real.html'), path_1.default.join(root, 'link.html'));
+        expect(() => (0, write_html_1.resolveHtmlTarget)({ cwd: root, target: 'dir', force: true })).toThrow();
+        expect(() => (0, write_html_1.resolveHtmlTarget)({ cwd: root, target: 'link.html', force: true })).toThrow();
+    });
+    it('rejects a symlinked parent but accepts an ordinary nested directory', () => {
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-html-outside-'));
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(root, 'safe', 'nested'), { recursive: true });
+            fs_1.default.symlinkSync(outside, path_1.default.join(root, 'escape'));
+            expect((0, write_html_1.resolveHtmlTarget)({ cwd: root, target: 'safe/nested/report.html' })).toBe(path_1.default.join(root, 'safe', 'nested', 'report.html'));
+            expect(() => (0, write_html_1.resolveHtmlTarget)({ cwd: root, target: 'escape/report.html' })).toThrow('HTML parent directory must not contain a symbolic link');
+        }
+        finally {
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    it('rejects absent parents and non-regular existing targets', () => {
+        expect(() => (0, write_html_1.resolveHtmlTarget)({ cwd: root, target: 'missing/report.html' })).toThrow(/parent/i);
+        fs_1.default.mkdirSync(path_1.default.join(root, 'regular-dir'));
+        expect(() => (0, write_html_1.resolveHtmlTarget)({ cwd: root, target: 'regular-dir', force: true })).toThrow(/regular/i);
+    });
+    it('rejects an injected unwritable parent before creating any temporary file', () => {
+        const operations = { ...fs_1.default, accessSync: jest.fn(() => { throw new Error('denied'); }) };
+        expect(() => (0, write_html_1.resolveHtmlTarget)({ cwd: root, target: 'report.html' }, operations)).toThrow(/writable/i);
+        expect(fs_1.default.readdirSync(root)).toEqual([]);
+    });
+    it('accepts a new absolute target and force-replaces only regular files', () => {
+        const target = path_1.default.join(root, 'absolute.html');
+        expect((0, write_html_1.resolveHtmlTarget)({ cwd: root, target })).toBe(target);
+        fs_1.default.writeFileSync(target, 'old');
+        expect((0, write_html_1.resolveHtmlTarget)({ cwd: root, target, force: true })).toBe(target);
+    });
+    it('rejects an existing target at the exported writer boundary without force', () => {
+        const target = path_1.default.join(root, 'existing.html');
+        fs_1.default.writeFileSync(target, 'previous');
+        expect(() => (0, write_html_1.writeHtmlAtomically)({ cwd: root, target, html: 'replacement' })).toThrow(/exists.*force/i);
+        expect(fs_1.default.readFileSync(target, 'utf8')).toBe('previous');
+    });
+    it.each(['openSync', 'writeFileSync', 'fsyncSync', 'closeSync', 'renameSync'])('preserves old target and cleans only owned temp when %s fails', (failedOperation) => {
+        const target = path_1.default.join(root, 'report.html');
+        fs_1.default.writeFileSync(target, 'previous');
+        const operations = { ...fs_1.default };
+        operations[failedOperation] = jest.fn(() => { throw new Error('injected'); });
+        expect(() => (0, write_html_1.writeHtmlAtomically)({ cwd: root, target, html: 'new', force: true }, operations)).toThrow('injected');
+        expect(fs_1.default.readFileSync(target, 'utf8')).toBe('previous');
+        expect(fs_1.default.readdirSync(root).filter((name) => name.includes('.tmp'))).toEqual([]);
+    });
+    it('uses Windows inherited-ACL open semantics without a POSIX mode', () => {
+        const target = path_1.default.join(root, 'windows.html');
+        const open = jest.spyOn(fs_1.default, 'openSync');
+        const original = process.platform;
+        try {
+            Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+            (0, write_html_1.writeHtmlAtomically)({ cwd: root, target, html: 'ok' });
+            expect(open.mock.calls[0]).toHaveLength(2);
+        }
+        finally {
+            Object.defineProperty(process, 'platform', { value: original, configurable: true });
+            open.mockRestore();
+        }
+    });
+    it('uses mode 0600 for a POSIX adjacent temporary file', () => {
+        if (process.platform === 'win32')
+            return;
+        const target = path_1.default.join(root, 'posix.html');
+        const open = jest.spyOn(fs_1.default, 'openSync');
+        try {
+            (0, write_html_1.writeHtmlAtomically)({ cwd: root, target, html: 'ok' });
+            expect(open.mock.calls[0][2]).toBe(0o600);
+        }
+        finally {
+            open.mockRestore();
+        }
+    });
+    it.each([
+        [{ cwd: '', target: path_1.default.join(os_1.default.tmpdir(), 'report.html'), html: 'ok' }, 'writeHtmlAtomically requires a non-empty cwd'],
+        [{ target: '', html: 'ok' }, 'writeHtmlAtomically requires a non-empty absolute target'],
+        [{ target: `${path_1.default.sep}tmp${path_1.default.sep}report\0.html`, html: 'ok' }, 'writeHtmlAtomically target must not contain NUL'],
+        [{ target: 'relative.html', html: 'ok' }, 'writeHtmlAtomically requires a non-empty absolute target'],
+        [{ target: path_1.default.join(os_1.default.tmpdir(), 'report.html'), html: '' }, 'writeHtmlAtomically requires non-empty html'],
+        [{ target: path_1.default.join(os_1.default.tmpdir(), 'report.html'), html: 'ok', force: 'yes' }, 'writeHtmlAtomically force must be boolean'],
+        [{ target: path_1.default.join(os_1.default.tmpdir(), 'report.html'), html: 'ok', platform: 'bad platform' }, 'writeHtmlAtomically platform must be a valid platform'],
+    ])('validates its public input before filesystem calls', (input, message) => {
+        expect(() => (0, write_html_1.writeHtmlAtomically)({ cwd: root, ...input })).toThrow(message);
+    });
+});

package/dist/tests/core/evidence/capture.test.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const capture_1 = require("../../../src/core/evidence/capture");
+describe('captureCycleEvidence', () => {
+    test('derives counts and opaque signatures without journal prose or identities', () => {
+        const evidence = (0, capture_1.captureCycleEvidence)({
+            root: process.cwd(), repositoryIdentity: 'git@example.test:team/repository.git',
+            planPath: 'plans/release.md',
+            journal: {
+                cycle: { status: 'COMPLETE', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:10.000Z' },
+                journalId: 'local-repository-identity',
+                tasks: [{ id: 'task-a', attempts: 3 }],
+                verdicts: [{ result: 'fail', fingerprint: 'unsafe-input', detail: 'Alice saw secret prompt', receivedAt: '2026-08-22T10:00:05.000Z' }],
+                fixes: [{ verdictId: 'v1', closed: true }],
+            },
+            gates: [{ required: true, passed: true }],
+            ledger: [{ signature: 'unsafe-input', polarity: 'win', ts: '2026-08-22T10:00:06.000Z' }],
+            pr: { provider: 'github', number: 12 },
+        });
+        expect(evidence).toMatchObject({
+            schema: 1, cycleState: 'completed', durationMs: 10_000,
+            plan: { ref: 'plans/release.md' }, tasks: [{ id: 'task-a', attempts: 3, retries: 2 }],
+            qa: { findings: 1, fixes: 1 }, gates: { required: 1, firstEvaluationsPassed: [true], firstPass: true },
+            pr: { provider: 'github', number: 12 },
+        });
+        expect(evidence.cycleId).toMatch(/^[a-f0-9]{64}$/);
+        expect(evidence.qa.signatures[0]).toMatch(/^[a-f0-9]{64}$/);
+        expect(evidence.cures[0]).toMatchObject({ signature: expect.stringMatching(/^[a-f0-9]{64}$/) });
+        expect(evidence.cures[0].signature).toBe(evidence.qa.signatures[0]);
+        expect(JSON.stringify(evidence)).not.toContain('Alice');
+        expect(JSON.stringify(evidence)).not.toContain('secret prompt');
+    });
+    test('derives cycle identity from stable repository identity, not checkout or journal identity', () => {
+        const source = {
+            planPath: 'plans/release.md', journal: { journalId: 'repository-identity', cycle: { status: 'BLOCKED', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:01.000Z' }, tasks: [], verdicts: [], fixes: [] }, gates: [], ledger: [],
+        };
+        const first = (0, capture_1.captureCycleEvidence)({ ...source, root: process.cwd(), repositoryIdentity: 'git@example.test:team/repository.git' });
+        const second = (0, capture_1.captureCycleEvidence)({ ...source, root: process.cwd(), repositoryIdentity: 'git@example.test:team/repository.git', journal: { ...source.journal, journalId: 'different-journal-identity' } });
+        const distinct = (0, capture_1.captureCycleEvidence)({ ...source, root: process.cwd(), repositoryIdentity: 'git@example.test:other/repository.git' });
+        expect(first.cycleId).toBe(second.cycleId);
+        expect(first.cycleId).not.toBe(distinct.cycleId);
+        expect(first.cycleState).toBe('blocked');
+    });
+    test('captures a blocked cycle from its durable controller heartbeat when completedAt is absent', () => {
+        const evidence = (0, capture_1.captureCycleEvidence)({ root: process.cwd(), repositoryIdentity: 'git@example.test:team/repository.git', planPath: 'plans/release.md', journal: { cycle: { status: 'BLOCKED', startedAt: '2026-08-22T10:00:00.000Z' }, controllerHeartbeatAt: '2026-08-22T10:00:03.000Z', tasks: [], verdicts: [], fixes: [] }, gates: [], ledger: [] });
+        expect(evidence).toMatchObject({ cycleState: 'blocked', endedAt: '2026-08-22T10:00:03.000Z', durationMs: 3_000 });
+    });
+});

package/dist/tests/core/evidence/command.test.js

@@ -0,0 +1,37 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const evidence_1 = require("../../../src/commands/evidence");
+describe('evidence capture CLI boundary', () => {
+    let root;
+    beforeEach(() => { root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-evidence-command-')); });
+    afterEach(() => { fs_1.default.rmSync(root, { recursive: true, force: true }); });
+    test('returns exit 2 for a missing or invalid plan', () => {
+        expect((0, evidence_1.runEvidenceCapture)(root, undefined).code).toBe(2);
+        expect((0, evidence_1.runEvidenceCapture)(root, '../secret.md').code).toBe(2);
+    });
+    test('returns exactly the captured cycle id on success', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, 'plan.md'), '# plan\n');
+        expect((0, evidence_1.runEvidenceCapture)(root, 'plan.md', { repositoryIdentity: 'git@example.test:team/repository.git', journal: { journalId: 'ignored', cycle: { status: 'COMPLETE', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:01.000Z' }, tasks: [], verdicts: [], fixes: [], jobs: {}, cycleVerificationPlan: [] }, ledger: [] })).toEqual(expect.objectContaining({ code: 0, stdout: expect.stringMatching(/^[a-f0-9]{64}\n$/) }));
+    });
+    test('uses the first attempted gate evaluation instead of final satisfaction', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, 'plan.md'), '# plan\n');
+        const result = (0, evidence_1.runEvidenceCapture)(root, 'plan.md', { repositoryIdentity: 'git@example.test:team/repository.git', journal: { journalId: 'ignored', cycle: { status: 'COMPLETE', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:01.000Z' }, tasks: [], verdicts: [], fixes: [], cycleVerificationPlan: [{ id: 'gate', kind: 'test', satisfiedBy: 'retry' }], jobs: { first: { id: 'first', satisfies: ['gate'], verdict: 'fail', phaseTimestamps: { received: '2026-08-22T10:00:00.000Z' } }, retry: { id: 'retry', satisfies: ['gate'], attemptOf: 'first', verdict: 'pass', phaseTimestamps: { received: '2026-08-22T10:00:01.000Z' } } } }, ledger: [] });
+        expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(root, '.awm', 'evidence', 'cycles', result.stdout.trim() + '.json'), 'utf8')).gates.firstEvaluationsPassed).toEqual([false]);
+    });
+    test('orders independent root evaluations by durable timestamp then id', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, 'plan.md'), '# plan\n');
+        const result = (0, evidence_1.runEvidenceCapture)(root, 'plan.md', { repositoryIdentity: 'git@example.test:team/repository.git', journal: { journalId: 'ignored', cycle: { status: 'COMPLETE', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:03.000Z' }, tasks: [], verdicts: [], fixes: [], cycleVerificationPlan: [{ id: 'gate', kind: 'test', satisfiedBy: 'late-pass' }], jobs: { late: { id: 'late-pass', satisfies: ['gate'], verdict: 'pass', phaseTimestamps: { received: '2026-08-22T10:00:02.000Z' } }, early: { id: 'early-fail', satisfies: ['gate'], verdict: 'fail', phaseTimestamps: { received: '2026-08-22T10:00:01.000Z' } } } }, ledger: [] });
+        expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(root, '.awm', 'evidence', 'cycles', result.stdout.trim() + '.json'), 'utf8')).gates.firstEvaluationsPassed).toEqual([false]);
+    });
+    test('uses the first review verdict rather than satisfiedBy final verdict', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, 'plan.md'), '# plan\n');
+        const result = (0, evidence_1.runEvidenceCapture)(root, 'plan.md', { repositoryIdentity: 'git@example.test:team/repository.git', journal: { journalId: 'ignored', cycle: { status: 'COMPLETE', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:01.000Z' }, tasks: [], fixes: [], cycleVerificationPlan: [{ id: 'review-gate', kind: 'review', satisfiedBy: 'final' }], jobs: {}, verdicts: [{ id: 'first', obligationId: 'review-gate', result: 'fail', fingerprint: 'review-gate', receivedAt: '2026-08-22T10:00:00.000Z' }, { id: 'final', obligationId: 'review-gate', result: 'pass', fingerprint: 'review-gate', receivedAt: '2026-08-22T10:00:01.000Z' }] }, ledger: [] });
+        expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(root, '.awm', 'evidence', 'cycles', result.stdout.trim() + '.json'), 'utf8')).gates.firstEvaluationsPassed).toEqual([false]);
+    });
+});

package/dist/tests/core/evidence/history.test.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const history_1 = require("../../../src/core/evidence/history");
+const evidence_fixtures_1 = require("../../helpers/evidence-fixtures");
+describe('evidence history', () => {
+    it.each([[0, 'none'], [1, 'provisional'], [2, 'observing'], [4, 'observing'], [5, 'supported']])('classifies %i eligible cycles as %s', (count, expected) => expect((0, history_1.confidenceForCycles)(count)).toBe(expected));
+    it.each([
+        [0, false, 'awaiting_observation'], [1, false, 'observing'], [2, false, 'observing'],
+        [3, false, 'supported'], [1, true, 'recurred'],
+    ])('classifies cure observation honestly', (laterEligibleCycles, recurred, expected) => {
+        expect((0, history_1.classifyCure)({ laterEligibleCycles, recurred })).toBe(expected);
+    });
+    it('validates every record, retains every eligible row, and sorts stably by timestamp and cycle id', () => {
+        const later = { ...(0, evidence_fixtures_1.cycleEvidenceFixture)(), cycleId: 'd'.repeat(64), startedAt: '2026-08-22T11:00:00.000Z', endedAt: '2026-08-22T11:01:00.000Z', cures: [] };
+        const sameTimestamp = { ...(0, evidence_fixtures_1.cycleEvidenceFixture)(), cycleId: '0'.repeat(64), cures: [] };
+        const history = (0, history_1.buildEvidenceHistory)([later, (0, evidence_fixtures_1.cycleEvidenceFixture)(), sameTimestamp]);
+        expect(history.confidence).toBe('observing');
+        expect(history.empty).toBe(false);
+        expect(history.cycles.map((cycle) => cycle.cycleId)).toEqual(['0'.repeat(64), 'a'.repeat(64), 'd'.repeat(64)]);
+        expect(() => (0, history_1.buildEvidenceHistory)([{ ...(0, evidence_fixtures_1.cycleEvidenceFixture)(), durationMs: -1 }])).toThrow(/duration/i);
+    });
+    it('reports zero cycles explicitly without a trend, percentage, or improvement claim', () => {
+        const history = (0, history_1.buildEvidenceHistory)([]);
+        expect(history).toEqual(expect.objectContaining({ empty: true, confidence: 'none', cycles: [] }));
+        expect(JSON.stringify(history)).not.toMatch(/trend|percentage|improvement/i);
+    });
+    it('retains blocked records but excludes them from confidence and cure observation windows', () => {
+        const blocked = Array.from({ length: 5 }, (_, index) => ({
+            ...(0, evidence_fixtures_1.cycleEvidenceFixture)(), cycleId: `${index}`.repeat(64), cycleState: 'blocked', cures: [],
+        }));
+        const history = (0, history_1.buildEvidenceHistory)(blocked);
+        expect(history.cycles).toHaveLength(5);
+        expect(history.confidence).toBe('none');
+        const cured = { ...(0, evidence_fixtures_1.cycleEvidenceFixture)(), cycleId: 'c'.repeat(64), endedAt: '2026-08-22T10:01:00.000Z' };
+        const laterBlocked = { ...(0, evidence_fixtures_1.cycleEvidenceFixture)(), cycleId: 'd'.repeat(64), cycleState: 'blocked', startedAt: '2026-08-22T11:00:00.000Z', endedAt: '2026-08-22T11:01:00.000Z', cures: [] };
+        const laterCompleted = { ...(0, evidence_fixtures_1.cycleEvidenceFixture)(), cycleId: 'e'.repeat(64), startedAt: '2026-08-22T12:00:00.000Z', endedAt: '2026-08-22T12:01:00.000Z', cures: [] };
+        const mixed = (0, history_1.buildEvidenceHistory)([cured, laterBlocked, laterCompleted]);
+        expect(mixed.confidence).toBe('observing');
+        expect(mixed.cycles[0].cureEfficacy[0].efficacy).toBe('observing');
+    });
+});

package/dist/tests/core/evidence/store.test.js

@@ -0,0 +1,32 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const evidence_fixtures_1 = require("../../helpers/evidence-fixtures");
+const store_1 = require("../../../src/core/evidence/store");
+describe('cycle evidence store', () => {
+    let root;
+    beforeEach(() => { root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-evidence-')); });
+    afterEach(() => { fs_1.default.rmSync(root, { recursive: true, force: true }); });
+    test('durably replaces one observation for the same opaque cycle id', () => {
+        const evidence = (0, evidence_fixtures_1.cycleEvidenceFixture)();
+        (0, store_1.writeCycleEvidence)(root, evidence);
+        (0, store_1.writeCycleEvidence)(root, { ...evidence, qa: { ...evidence.qa, fixes: 0 } });
+        const dir = path_1.default.join(root, '.awm', 'evidence', 'cycles');
+        expect(fs_1.default.readdirSync(dir)).toEqual([`${evidence.cycleId}.json`]);
+        expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(dir, `${evidence.cycleId}.json`), 'utf8')).qa.fixes).toBe(0);
+    });
+    test('rejects symlinked evidence ancestors without writing outside root', () => {
+        if (process.platform === 'win32')
+            return;
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-evidence-outside-'));
+        fs_1.default.symlinkSync(outside, path_1.default.join(root, '.awm'));
+        expect(() => (0, store_1.writeCycleEvidence)(root, (0, evidence_fixtures_1.cycleEvidenceFixture)())).toThrow(/symlink/);
+        expect(fs_1.default.readdirSync(outside)).toEqual([]);
+        fs_1.default.rmSync(outside, { recursive: true, force: true });
+    });
+});