agentic-workflow-manager 8.3.0 → 8.5.0

package/dist/tests/core/evidence/types.test.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const evidence_fixtures_1 = require("../../helpers/evidence-fixtures");
+const types_1 = require("../../../src/core/evidence/types");
+describe('CycleEvidenceV1 validation', () => {
+    test('accepts the minimal privacy-preserving durable observation', () => {
+        expect((0, types_1.validateCycleEvidence)((0, evidence_fixtures_1.cycleEvidenceFixture)())).toEqual((0, evidence_fixtures_1.cycleEvidenceFixture)());
+    });
+    test.each([
+        ['unknown fields', { extra: 'raw prose' }],
+        ['absolute plan refs', { plan: { ref: '/Users/alice/plans/current.md', state: 'executed' } }],
+        ['raw prose', { qa: { findings: 1, fixes: 1, signatures: ['found alice failed a secret prompt'] } }],
+        ['host identities', { pr: { provider: 'github', number: 42, repository: 'alice/private' } }],
+        ['invalid retry totals', { tasks: [{ id: 'task-1', attempts: 2, retries: 0 }] }],
+        ['non-canonical timestamp', { startedAt: '2026-08-22T10:00:00Z' }],
+    ])('rejects %s', (_label, patch) => {
+        expect(() => (0, types_1.validateCycleEvidence)({ ...(0, evidence_fixtures_1.cycleEvidenceFixture)(), ...patch })).toThrow();
+    });
+    test('stores first gate evaluations as booleans, not an aggregate count', () => {
+        const evidence = (0, evidence_fixtures_1.cycleEvidenceFixture)();
+        expect((0, types_1.validateCycleEvidence)({ ...evidence, gates: { required: 2, firstEvaluationsPassed: [true, false], firstPass: false } }).gates.firstEvaluationsPassed).toEqual([true, false]);
+    });
+    test('permits every dashboard plan state and an absent PR', () => {
+        for (const state of ['active', 'blocked', 'qa_pending', 'retro_pending', 'executed', 'legacy_unverifiable']) {
+            const evidence = (0, evidence_fixtures_1.cycleEvidenceFixture)();
+            delete evidence.pr;
+            expect((0, types_1.validateCycleEvidence)({ ...evidence, plan: { ...evidence.plan, state } }).pr).toBeUndefined();
+        }
+    });
+});

package/dist/tests/helpers/dashboard-fixtures.js

@@ -0,0 +1,66 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.captureDoctorJsonFixture = captureDoctorJsonFixture;
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const doctor_1 = require("../../src/commands/doctor");
+/** Captures the legacy doctor JSON in an isolated, deterministic filesystem. */
+function captureDoctorJsonFixture(kind) {
+    const tempRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-doctor-json-fixture-'));
+    const previousHome = process.env.HOME;
+    const previousAwmHome = process.env.AWM_HOME;
+    const output = [];
+    fs_1.default.mkdirSync(path_1.default.join(tempRoot, '.awm'), { recursive: true });
+    const writeSpy = jest.spyOn(process.stdout, 'write').mockImplementation((chunk) => {
+        output.push(String(chunk));
+        return true;
+    });
+    process.env.HOME = tempRoot;
+    process.env.AWM_HOME = path_1.default.join(tempRoot, '.awm');
+    fs_1.default.writeFileSync(path_1.default.join(tempRoot, '.awm', 'preferences.json'), JSON.stringify({
+        defaultAgent: 'copilot',
+        enabledAgents: ['copilot'],
+        installMethod: 'symlink',
+        defaultScope: 'local',
+    }, null, 2) + '\n');
+    if (kind === 'project') {
+        fs_1.default.writeFileSync(path_1.default.join(tempRoot, '.awm', 'profile.json'), '{\n  "extensions": []\n}\n');
+        fs_1.default.writeFileSync(path_1.default.join(tempRoot, 'AGENTS.md'), '<!-- AWM:START -->\nstale project context\n<!-- AWM:END -->\n');
+    }
+    try {
+        const code = (0, doctor_1.runDoctor)({ cwd: tempRoot, json: true });
+        return {
+            code,
+            output: output.join(''),
+            cleanup: () => {
+                writeSpy.mockRestore();
+                fs_1.default.rmSync(tempRoot, { recursive: true, force: true });
+                if (previousHome === undefined)
+                    delete process.env.HOME;
+                else
+                    process.env.HOME = previousHome;
+                if (previousAwmHome === undefined)
+                    delete process.env.AWM_HOME;
+                else
+                    process.env.AWM_HOME = previousAwmHome;
+            },
+        };
+    }
+    catch (error) {
+        writeSpy.mockRestore();
+        fs_1.default.rmSync(tempRoot, { recursive: true, force: true });
+        if (previousHome === undefined)
+            delete process.env.HOME;
+        else
+            process.env.HOME = previousHome;
+        if (previousAwmHome === undefined)
+            delete process.env.AWM_HOME;
+        else
+            process.env.AWM_HOME = previousAwmHome;
+        throw error;
+    }
+}

package/dist/tests/helpers/evidence-fixtures.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cycleEvidenceFixture = void 0;
+const cycleEvidenceFixture = () => ({
+    schema: 1,
+    cycleId: 'a'.repeat(64),
+    startedAt: '2026-08-22T10:00:00.000Z',
+    endedAt: '2026-08-22T10:01:00.000Z',
+    durationMs: 60_000,
+    cycleState: 'completed',
+    plan: { ref: 'plans/current.md', state: 'executed' },
+    tasks: [{ id: 'task-1', attempts: 2, retries: 1 }],
+    qa: { findings: 1, fixes: 1, signatures: ['b'.repeat(64)] },
+    gates: { required: 1, firstEvaluationsPassed: [true], firstPass: true },
+    cures: [{ signature: 'c'.repeat(64), curedAt: '2026-08-22T10:00:30.000Z' }],
+});
+exports.cycleEvidenceFixture = cycleEvidenceFixture;

package/dist/tests/integration/doctor-dashboard.e2e.test.js

@@ -0,0 +1,177 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = __importDefault(require("crypto"));
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const cli = path_1.default.resolve(__dirname, '../../dist/src/index.js');
+function treeHash(root, ignored = new Set()) {
+    const hash = crypto_1.default.createHash('sha256');
+    const walk = (directory) => {
+        for (const entry of fs_1.default.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            const item = path_1.default.join(directory, entry.name);
+            const relative = path_1.default.relative(root, item).split(path_1.default.sep).join('/');
+            if (ignored.has(relative))
+                continue;
+            hash.update(relative);
+            if (entry.isDirectory())
+                walk(item);
+            else if (entry.isFile())
+                hash.update(fs_1.default.readFileSync(item));
+        }
+    };
+    walk(root);
+    return hash.digest('hex');
+}
+function treeEntries(root, ignored = new Set()) {
+    const entries = [];
+    const walk = (directory) => {
+        for (const entry of fs_1.default.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            const item = path_1.default.join(directory, entry.name);
+            const relative = path_1.default.relative(root, item).split(path_1.default.sep).join('/');
+            if (ignored.has(relative))
+                continue;
+            entries.push(relative);
+            if (entry.isDirectory())
+                walk(item);
+        }
+    };
+    walk(root);
+    return entries;
+}
+function fixture(name, project = true) {
+    const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), `awm-doctor-${name}-`));
+    const directory = project ? path_1.default.join(root, 'project') : path_1.default.join(root, 'machine-only');
+    const home = path_1.default.join(root, 'home');
+    fs_1.default.mkdirSync(directory, { recursive: true });
+    fs_1.default.mkdirSync(home, { recursive: true });
+    if (project)
+        fs_1.default.writeFileSync(path_1.default.join(directory, 'package.json'), JSON.stringify({ name, private: true }));
+    return { root, project: directory, home };
+}
+function command(f, ...args) {
+    return (0, child_process_1.spawnSync)(process.execPath, [cli, ...args], {
+        cwd: f.project,
+        encoding: 'utf8',
+        // The dashboard examines provider homes too.  Do not inherit the
+        // runner's HOME/CODEX_HOME: that turns the machine-only fixture into
+        // a report about whatever agent state happens to be installed on CI.
+        env: {
+            ...process.env,
+            HOME: f.home,
+            USERPROFILE: f.home,
+            CODEX_HOME: path_1.default.join(f.home, '.codex'),
+            AWM_HOME: f.home,
+            AWM_NO_UPDATE_CHECK: '1',
+        },
+    });
+}
+function snapshot(result) {
+    if (!result.stdout.trim())
+        throw new Error(`doctor emitted no JSON: ${result.stderr}`);
+    return JSON.parse(result.stdout);
+}
+function writeEvidence(f, id) {
+    const directory = path_1.default.join(f.project, '.awm', 'evidence', 'cycles');
+    fs_1.default.mkdirSync(directory, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(directory, `${id}.json`), JSON.stringify({
+        schema: 1, cycleId: id, startedAt: '2026-08-22T10:00:00.000Z', endedAt: '2026-08-22T10:01:00.000Z', durationMs: 60_000,
+        cycleState: 'completed', plan: { ref: 'docs/plans/current.md', state: 'executed' }, tasks: [{ id: 'task-1', attempts: 1, retries: 0 }],
+        qa: { findings: 0, fixes: 0, signatures: [] }, gates: { required: 1, firstEvaluationsPassed: [true], firstPass: true }, cures: [],
+    }));
+}
+describe('built doctor dashboard end-to-end (R4.8, R8.3-R8.5)', () => {
+    jest.setTimeout(60_000);
+    afterEach(() => jest.restoreAllMocks());
+    test('machine-only-uninitialized, degraded, partial, and corrupt fixtures are real on-disk states with exact exits and discriminating output', () => {
+        const machine = fixture('machine', false);
+        const degraded = fixture('degraded');
+        const partial = fixture('partial');
+        const corrupt = fixture('corrupt');
+        fs_1.default.mkdirSync(path_1.default.join(degraded.project, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(degraded.project, '.awm', 'profile.json'), '{not-json');
+        fs_1.default.mkdirSync(path_1.default.join(partial.project, '.awm', 'evidence', 'cycles'), { recursive: true });
+        fs_1.default.mkdirSync(path_1.default.join(corrupt.project, '.awm', 'evidence', 'cycles'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(corrupt.project, '.awm', 'evidence', 'cycles', `${'d'.repeat(64)}.json`), '{broken');
+        const cases = [
+            ['machine-only-uninitialized', machine, 1, /Machine \/ install/],
+            ['degraded-project', degraded, 1, /Project readiness/],
+            ['partial-source', partial, 1, /source unavailable/i],
+            ['corrupt-source', corrupt, 1, /Final \/ history\n  Eligible evidence rows: 0\n  ⊘ source unavailable/],
+        ];
+        try {
+            for (const [, f, exit, discriminant] of cases) {
+                const before = treeHash(f.root);
+                const result = command(f, 'doctor', '--full');
+                if (result.status !== exit) {
+                    throw new Error(`${f.project}\nexpected exit ${exit}, received ${result.status}\nstdout:\n${result.stdout}\nstderr:\n${result.stderr}`);
+                }
+                expect(result.stdout).toMatch(discriminant);
+                expect(treeHash(f.root)).toBe(before);
+            }
+        }
+        finally {
+            for (const [, f] of cases)
+                fs_1.default.rmSync(f.root, { recursive: true, force: true });
+        }
+    });
+    test('json compatibility, full static HTML CSP, hostile source text, long history, and large fixture counts remain safe', () => {
+        const f = fixture('hostile');
+        try {
+            // A hostile optional evidence file must not turn raw markup into HTML.
+            writeEvidence(f, 'a'.repeat(64));
+            for (let index = 1; index < 500; index++)
+                writeEvidence(f, crypto_1.default.createHash('sha256').update(String(index)).digest('hex'));
+            const json = command(f, 'doctor', '--json');
+            expect([0, 1]).toContain(json.status);
+            expect(snapshot(json)).toEqual(expect.objectContaining({ overall: expect.any(String), providers: expect.any(Array) }));
+            const before = treeHash(f.root);
+            const full = command(f, 'doctor', '--full');
+            expect(full.stdout).toContain('Final / history');
+            expect(full.stdout).toContain('Cycle');
+            expect(treeHash(f.root)).toBe(before);
+            // Feed hostile text through the evidence reader itself, not an
+            // unrelated project file: malformed evidence is isolated and its
+            // raw script is never copied into the static dashboard.
+            fs_1.default.writeFileSync(path_1.default.join(f.project, '.awm', 'evidence', 'cycles', `${'f'.repeat(64)}.json`), JSON.stringify({
+                schema: 1, cycleId: 'f'.repeat(64), startedAt: '2026-08-22T10:00:00.000Z', endedAt: '2026-08-22T10:01:00.000Z', durationMs: 60_000,
+                cycleState: 'completed', plan: { ref: 'docs/plans/current.md', state: 'executed' }, tasks: [{ id: '<script>hostile</script>', attempts: 1, retries: 0 }],
+                qa: { findings: 0, fixes: 0, signatures: [] }, gates: { required: 0, firstEvaluationsPassed: [], firstPass: true }, cures: [],
+            }));
+            const hostileBeforeHtml = treeHash(f.root);
+            const entriesBeforeHtml = treeEntries(f.root, new Set(['project/dashboard.html']));
+            const html = command(f, 'doctor', '--html', 'dashboard.html');
+            expect([0, 1]).toContain(html.status);
+            const page = fs_1.default.readFileSync(path_1.default.join(f.project, 'dashboard.html'), 'utf8');
+            expect(page).toContain('Content-Security-Policy');
+            expect(page).toContain("script-src 'none'");
+            expect(page).toContain('data-project-evidence');
+            expect(page).not.toContain('<script>hostile</script>');
+            expect(page).toContain('Source unavailable');
+            const afterHtml = treeHash(f.root, new Set(['project/dashboard.html']));
+            if (afterHtml !== hostileBeforeHtml) {
+                throw new Error(`doctor --html mutated files other than dashboard.html: before=${entriesBeforeHtml.join(',')} after=${treeEntries(f.root, new Set(['project/dashboard.html'])).join(',')}`);
+            }
+        }
+        finally {
+            fs_1.default.rmSync(f.root, { recursive: true, force: true });
+        }
+    });
+    test('invalid dashboard combinations exit 2 without mutation', () => {
+        const f = fixture('invalid');
+        try {
+            const before = treeHash(f.root);
+            const result = command(f, 'doctor', '--json', '--full');
+            expect(result.status).toBe(2);
+            expect(result.stderr).toMatch(/cannot be combined/i);
+            expect(treeHash(f.root)).toBe(before);
+        }
+        finally {
+            fs_1.default.rmSync(f.root, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/integration/published-doctor-evidence.e2e.test.js

@@ -0,0 +1,180 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertImmutableArtifacts = assertImmutableArtifacts;
+exports.assertIssue87RegistryPin = assertIssue87RegistryPin;
+exports.assertRetroCaptureContract = assertRetroCaptureContract;
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const cliVersion = process.env.AWM_PUBLISHED_CLI_VERSION;
+const registryTag = process.env.AWM_PUBLISHED_REGISTRY_TAG;
+const registryCommit = process.env.AWM_PUBLISHED_REGISTRY_COMMIT;
+const registryRemote = process.env.AWM_PUBLISHED_REGISTRY_REMOTE ?? 'https://github.com/Kodria/awm-baseline-registry.git';
+// Local contributors lack publish coordinates and skip this network acceptance.
+// A CI run that supplies the published CLI/tag but omits the commit MUST run and
+// fail at the provenance assertion rather than silently describe.skip.
+const enabled = Boolean(cliVersion && registryTag);
+const acceptance = enabled ? describe : describe.skip;
+function command(cwd, executable, args, env = process.env) {
+    return (0, child_process_1.spawnSync)(executable, args, { cwd, encoding: 'utf8', env });
+}
+/** Published evidence accepts only exact versions and immutable git tags. */
+function assertImmutableArtifacts(version, tag, commit, remote) {
+    if (!version || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version))
+        throw new Error('published CLI version must be an exact immutable semver');
+    if (version.includes('file:') || version.includes('/') || version.includes('@'))
+        throw new Error('published CLI must not be a workspace, file dependency, or mutable tag');
+    if (!tag || !/^v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(tag))
+        throw new Error('published registry ref must be an exact immutable tag');
+    if (!commit || !/^[a-f0-9]{40}$/.test(commit))
+        throw new Error('published registry commit must be a full immutable SHA');
+    if (!/^https:\/\/github\.com\/Kodria\/awm-baseline-registry\.git$/.test(remote))
+        throw new Error('published registry remote must be the canonical immutable release remote');
+}
+/** R8.7 is bound to the Task 7 registry release, never the preceding tag. */
+function assertIssue87RegistryPin(tag) {
+    if (tag !== 'v3.4.0')
+        throw new Error('published doctor evidence requires immutable registry tag v3.4.0');
+}
+function json(result) {
+    if (!result.stdout.trim())
+        throw new Error(`missing JSON output: ${result.stderr}`);
+    return JSON.parse(result.stdout);
+}
+function compareSemver(left, right) {
+    const parse = (value) => value.match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/);
+    const a = parse(left);
+    const b = parse(right);
+    if (!a || !b)
+        throw new Error('published compatibility versions must be exact semver');
+    for (let index = 1; index <= 3; index++) {
+        const difference = Number(a[index]) - Number(b[index]);
+        if (difference !== 0)
+            return difference;
+    }
+    return (a[4] ? -1 : 0) - (b[4] ? -1 : 0);
+}
+/** The cloned registry, not a loose prose regex, owns the retro ordering contract. */
+function assertRetroCaptureContract(registry, retro, version) {
+    if (!registry || typeof registry !== 'object' || Array.isArray(registry))
+        throw new Error('published registry metadata is invalid');
+    const floor = registry.minCliVersion;
+    if (typeof floor !== 'string' || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(floor))
+        throw new Error('published registry must declare minCliVersion');
+    if (compareSemver(version, floor) < 0)
+        throw new Error(`published CLI ${version} is below registry minCliVersion ${floor}`);
+    const commands = retro.split(/\r?\n/).map((line, index) => ({ line: line.trim(), index }))
+        .filter(({ line }) => !line.startsWith('#') && !line.startsWith('<!--'))
+        .filter(({ line }) => /^(?:\d+\.\s+)?`?awm (?:evidence capture|ledger archive)(?:\s|`|$)/.test(line));
+    const captures = commands.filter(({ line }) => /awm evidence capture(?:\s|`|$)/.test(line));
+    const archives = commands.filter(({ line }) => /awm ledger archive(?:\s|`|$)/.test(line));
+    if (captures.length !== 1)
+        throw new Error('installed harness-retro contract requires exactly one executable evidence capture command');
+    if (archives.length !== 1 || captures[0].index > archives[0].index)
+        throw new Error('installed harness-retro must capture evidence before archive');
+}
+acceptance('published doctor and evidence acceptance (R8.7)', () => {
+    jest.setTimeout(10 * 60_000);
+    test('installs exact npm and registry artifacts into a fresh consumer and executes the dashboard/evidence contract', () => {
+        assertImmutableArtifacts(cliVersion, registryTag, registryCommit, registryRemote);
+        assertIssue87RegistryPin(registryTag);
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-published-doctor-'));
+        try {
+            const artifacts = path_1.default.join(root, 'artifacts');
+            const registry = path_1.default.join(root, 'registry');
+            const project = path_1.default.join(root, 'project');
+            const home = path_1.default.join(root, 'home');
+            fs_1.default.mkdirSync(project, { recursive: true });
+            fs_1.default.mkdirSync(home, { recursive: true });
+            expect(command(root, 'npm', ['install', '--prefix', artifacts, '--ignore-scripts', '--no-audit', '--no-fund', `agentic-workflow-manager@${cliVersion}`]).status).toBe(0);
+            expect(command(root, 'git', ['clone', '--depth', '1', '--branch', registryTag, registryRemote, registry]).status).toBe(0);
+            expect(command(registry, 'git', ['describe', '--exact-match', '--tags', 'HEAD']).stdout.trim()).toBe(registryTag);
+            expect(command(registry, 'git', ['rev-parse', 'HEAD']).stdout.trim()).toBe(registryCommit);
+            expect(command(registry, 'git', ['rev-parse', `${registryTag}^{}`]).stdout.trim()).toBe(registryCommit);
+            const cliRoot = path_1.default.join(artifacts, 'node_modules', 'agentic-workflow-manager');
+            expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(cliRoot, 'package.json'), 'utf8'))).toEqual(expect.objectContaining({ version: cliVersion }));
+            expect(fs_1.default.existsSync(path_1.default.join(cliRoot, 'dist', 'src', 'index.js'))).toBe(true);
+            const registryMetadata = JSON.parse(fs_1.default.readFileSync(path_1.default.join(registry, 'awm-registry.json'), 'utf8'));
+            const retro = fs_1.default.readFileSync(path_1.default.join(registry, 'skills', 'harness-retro', 'SKILL.md'), 'utf8');
+            assertRetroCaptureContract(registryMetadata, retro, cliVersion);
+            fs_1.default.writeFileSync(path_1.default.join(project, 'package.json'), JSON.stringify({ name: 'published-doctor-fixture', private: true }));
+            fs_1.default.writeFileSync(path_1.default.join(project, 'plan.md'), '# published evidence fixture\n');
+            expect(command(project, 'git', ['init']).status).toBe(0);
+            expect(command(project, 'git', ['config', 'user.email', 'published@example.invalid']).status).toBe(0);
+            expect(command(project, 'git', ['config', 'user.name', 'Published acceptance']).status).toBe(0);
+            expect(command(project, 'git', ['add', '.']).status).toBe(0);
+            expect(command(project, 'git', ['commit', '-m', 'fixture']).status).toBe(0);
+            const branch = command(project, 'git', ['branch', '--show-current']).stdout.trim();
+            expect(branch).not.toBe('');
+            expect(command(project, 'git', ['remote', 'add', 'origin', 'https://github.com/example/published-doctor-fixture.git']).status).toBe(0);
+            const env = { ...process.env, AWM_HOME: home, AWM_NO_UPDATE_CHECK: '1' };
+            const invoke = (...args) => command(project, process.execPath, [path_1.default.join(cliRoot, 'dist', 'src', 'index.js'), ...args], env);
+            expect([0, 1]).toContain(invoke('doctor').status);
+            const report = invoke('doctor', '--json');
+            expect([0, 1]).toContain(report.status);
+            expect(json(report)).toHaveProperty('providers');
+            expect([0, 1]).toContain(invoke('doctor', '--full').status);
+            const html = invoke('doctor', '--html', 'doctor.html');
+            expect([0, 1]).toContain(html.status);
+            expect(fs_1.default.readFileSync(path_1.default.join(project, 'doctor.html'), 'utf8')).toContain("script-src 'none'");
+            // Seed a completed durable journal using the downloaded package's own
+            // journal store: this stays on the published-artifact boundary while
+            // making capture exercise its real CLI path, not an injected helper.
+            const journalScript = [
+                `const store=require(${JSON.stringify(path_1.default.join(cliRoot, 'dist', 'src', 'core', 'journal', 'store.js'))});`,
+                'store.initJournal(process.argv[1], process.argv[2]);',
+                'const state=store.readJournal(process.argv[1], process.argv[2]).state;',
+                "state.cycle={...state.cycle,status:'COMPLETE',completedAt:'2026-08-22T10:00:01.000Z'};",
+                'store.writeJournal(process.argv[1], process.argv[2], state);',
+            ].join('');
+            expect(command(project, process.execPath, ['-e', journalScript, project, branch], env).status).toBe(0);
+            const capture = invoke('evidence', 'capture', '--plan', 'plan.md');
+            expect(capture.status).toBe(0);
+            expect(capture.stdout.trim()).toMatch(/^[a-f0-9]{64}$/);
+            expect(fs_1.default.existsSync(path_1.default.join(project, '.awm', 'evidence', 'cycles', `${capture.stdout.trim()}.json`))).toBe(true);
+            // The retrospective/ledger lifecycle happens after the durable
+            // observation, never instead of it.
+            expect(invoke('ledger', 'add', '--branch', branch, '--polarity', 'finding', '--class', 'quality', '--signature', 'published-retro-contract', '--severity', 'important', '--desc', 'published acceptance').status).toBe(0);
+            expect(invoke('ledger', 'archive', '--branch', branch).status).toBe(0);
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+});
+describe('published artifact provenance guard', () => {
+    test.each(['file:../cli', '../cli', 'latest', 'workspace:*', '8.4.0@latest'])('rejects mutable CLI reference %s', (version) => {
+        expect(() => assertImmutableArtifacts(version, 'v3.2.0', 'a'.repeat(40), registryRemote)).toThrow(/published CLI/i);
+    });
+    test.each(['main', 'HEAD', '', 'v3', 'refs/heads/main'])('rejects mutable registry ref %s', (tag) => {
+        expect(() => assertImmutableArtifacts('8.4.0', tag, 'a'.repeat(40), registryRemote)).toThrow(/registry ref/i);
+    });
+    test('rejects a short or retagged registry commit pin', () => {
+        expect(() => assertImmutableArtifacts('8.4.1', 'v3.4.0', 'deadbeef', registryRemote)).toThrow(/full immutable SHA/);
+        expect(() => assertImmutableArtifacts('8.4.1', 'v3.4.0', undefined, registryRemote)).toThrow(/full immutable SHA/);
+    });
+});
+describe('future registry retro capture contract', () => {
+    const metadata = { minCliVersion: '8.4.1' };
+    const contract = '1. awm evidence capture --plan docs/plan.md\n2. awm ledger archive\n';
+    test('requires the declared semver floor and capture-before-archive ordering', () => {
+        expect(() => assertRetroCaptureContract(metadata, contract, '8.4.1')).not.toThrow();
+        expect(() => assertRetroCaptureContract(metadata, contract, '8.4.0')).toThrow(/below registry minCliVersion/);
+    });
+    test('fails when minCliVersion is removed or retro ordering is swapped', () => {
+        expect(() => assertRetroCaptureContract({}, contract, '8.4.1')).toThrow(/minCliVersion/);
+        expect(() => assertRetroCaptureContract(metadata, 'awm ledger archive\nawm evidence capture', '8.4.1')).toThrow(/before archive/);
+    });
+    test('ignores comments and rejects duplicate or non-executable capture text', () => {
+        expect(() => assertRetroCaptureContract(metadata, '# awm evidence capture\nawm ledger archive', '8.4.1')).toThrow(/exactly one executable/);
+        expect(() => assertRetroCaptureContract(metadata, `${contract}awm evidence capture --plan again`, '8.4.1')).toThrow(/exactly one executable/);
+    });
+    test('rejects the prepublication CLI and a preceding registry pin', () => {
+        expect(() => assertRetroCaptureContract(metadata, contract, '8.4.0')).toThrow(/below registry minCliVersion/);
+        expect(() => assertIssue87RegistryPin('v3.2.0')).toThrow(/v3\.4\.0/);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "8.3.0",
+  "version": "8.5.0",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"