agentic-workflow-manager 8.4.0 → 8.5.0

package/dist/src/commands/evidence/index.js

@@ -0,0 +1,95 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerEvidenceCommand = registerEvidenceCommand;
+exports.runEvidenceCapture = runEvidenceCapture;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const capture_1 = require("../../core/evidence/capture");
+const store_1 = require("../../core/evidence/store");
+const store_2 = require("../../core/journal/store");
+const store_3 = require("../../core/ledger/store");
+function assertRepoRelativePlan(value) {
+    if (typeof value !== 'string' || !value || value.startsWith('--') || path_1.default.isAbsolute(value)
+        || value.includes('\\') || value.split('/').some((part) => part === '' || part === '.' || part === '..')) {
+        throw new Error('--plan requires a repo-relative path');
+    }
+    return value;
+}
+function registerEvidenceCommand(program) {
+    const evidence = program.command('evidence').description('durable privacy-preserving cycle observations');
+    evidence.command('capture')
+        .description('capture one local cycle observation')
+        .option('--plan <path>', 'repo-relative plan path')
+        .option('--pr-provider <provider>', 'github | gitlab | other')
+        .option('--pr-number <number>', 'pull request number')
+        .action((opts) => {
+        const result = runEvidenceCapture(process.cwd(), opts.plan, { prProvider: opts.prProvider, prNumber: opts.prNumber });
+        if (result.code === 0)
+            process.stdout.write(result.stdout);
+        else {
+            process.stderr.write(`awm evidence capture: ${result.error}\n`);
+            process.exitCode = 2;
+        }
+    });
+}
+function firstEvaluationGates(state) {
+    return state.cycleVerificationPlan.map((gate) => {
+        if (gate.kind === 'review') {
+            const verdict = state.verdicts.filter((candidate) => candidate.obligationId === gate.id)
+                .sort((left, right) => left.receivedAt.localeCompare(right.receivedAt) || left.id.localeCompare(right.id))[0];
+            return { required: true, passed: verdict?.result === 'pass' };
+        }
+        const evaluated = Object.values(state.jobs).filter((job) => job.satisfies?.includes(gate.id));
+        const first = evaluated.filter((job) => job.attemptOf === undefined || !evaluated.some((candidate) => candidate.id === job.attemptOf))
+            .sort((left, right) => jobTimestamp(left).localeCompare(jobTimestamp(right)) || left.id.localeCompare(right.id))[0];
+        return { required: true, passed: first?.verdict === 'pass' };
+    });
+}
+function jobTimestamp(job) {
+    const timestamp = job.result?.endedAt ?? job.phaseTimestamps.received ?? job.phaseTimestamps.exited;
+    if (typeof timestamp !== 'string' || Number.isNaN(Date.parse(timestamp)))
+        throw new Error(`gate job ${job.id} lacks a durable evaluation timestamp`);
+    return timestamp;
+}
+function repositoryIdentity(root, supplied) {
+    if (supplied !== undefined) {
+        if (typeof supplied !== 'string' || !supplied || supplied.length > 4096 || /[\r\n]/.test(supplied))
+            throw new Error('repository identity is invalid');
+        return supplied;
+    }
+    try {
+        const remote = (0, child_process_1.execFileSync)('git', ['config', '--get', 'remote.origin.url'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 3000 }).trim();
+        if (!remote || remote.length > 4096 || /[\r\n]/.test(remote))
+            throw new Error('invalid');
+        return remote;
+    }
+    catch {
+        throw new Error('repository identity unavailable: configure remote.origin.url');
+    }
+}
+function runEvidenceCapture(root, plan, overrides) {
+    try {
+        const planPath = assertRepoRelativePlan(plan);
+        if (!fs_1.default.existsSync(path_1.default.join(root, planPath)))
+            throw new Error('--plan must reference an existing file');
+        const branch = (0, store_3.detectBranch)(root);
+        const read = overrides?.journal === undefined ? (0, store_2.readJournal)(root, branch) : { corrupt: false, state: overrides.journal };
+        if (read.corrupt || !read.state)
+            throw new Error('current journal is unavailable or corrupt');
+        let pr;
+        if (overrides?.prProvider !== undefined || overrides?.prNumber !== undefined) {
+            if (overrides.prProvider === undefined || overrides.prNumber === undefined || typeof overrides.prNumber !== 'string' || !/^\d+$/.test(overrides.prNumber))
+                throw new Error('--pr-provider and --pr-number must be supplied together');
+            pr = { provider: overrides.prProvider, number: Number(overrides.prNumber) };
+        }
+        const saved = (0, store_1.writeCycleEvidence)(root, (0, capture_1.captureCycleEvidence)({ root, repositoryIdentity: repositoryIdentity(root, overrides?.repositoryIdentity), planPath, journal: read.state, gates: firstEvaluationGates(read.state), ledger: overrides?.ledger ?? (0, store_3.listEntries)(root, branch), pr }));
+        return { code: 0, stdout: `${saved.cycleId}\n` };
+    }
+    catch (error) {
+        return { code: 2, stdout: '', error: error.message };
+    }
+}

package/dist/src/core/dashboard/collect.js

@@ -1,9 +1,16 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.REMEDIATION_BY_FINDING_ID = void 0;
 exports.productionDashboardAdapters = productionDashboardAdapters;
 exports.collectDashboardSnapshot = collectDashboardSnapshot;
 const profile_1 = require("../profile");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const history_1 = require("../evidence/history");
+const types_1 = require("../evidence/types");
 const sanitize_1 = require("./sanitize");
 const validate_1 = require("./validate");
 const plan_state_1 = require("./plan-state");
@@ -118,6 +125,52 @@ function canonicalOptionalFailure(failure) {
         return [];
     return [{ id: failure.findingId, label: 'Optional source unavailable', state: 'unavailable', remediation: exports.REMEDIATION_BY_FINDING_ID[failure.findingId] }];
 }
+function evidenceHistoryItems(root) {
+    const awmDirectory = path_1.default.join(root, '.awm');
+    const evidenceDirectory = path_1.default.join(awmDirectory, 'evidence');
+    const directory = path_1.default.join(evidenceDirectory, 'cycles');
+    for (const ancestor of [awmDirectory, evidenceDirectory, directory]) {
+        let stat;
+        try {
+            stat = fs_1.default.lstatSync(ancestor);
+        }
+        catch (error) {
+            if (error && typeof error === 'object' && error.code === 'ENOENT')
+                return { confidence: 'none', items: [] };
+            throw error;
+        }
+        if (stat.isSymbolicLink() || !stat.isDirectory())
+            throw new Error('evidence history directory is unsafe');
+    }
+    const seenCycleIds = new Set();
+    const records = fs_1.default.readdirSync(directory, { withFileTypes: true })
+        .sort((left, right) => left.name.localeCompare(right.name))
+        .map((entry) => {
+        if (!entry.isFile() || !entry.name.endsWith('.json'))
+            throw new Error('evidence history contains an unsupported entry');
+        const file = path_1.default.join(directory, entry.name);
+        if (fs_1.default.lstatSync(file).isSymbolicLink())
+            throw new Error('evidence history file is unsafe');
+        const evidence = (0, types_1.validateCycleEvidence)(JSON.parse(fs_1.default.readFileSync(file, 'utf8')));
+        if (entry.name !== `${evidence.cycleId}.json` || seenCycleIds.has(evidence.cycleId))
+            throw new Error('evidence history filename is invalid');
+        seenCycleIds.add(evidence.cycleId);
+        return evidence;
+    });
+    const history = (0, history_1.buildEvidenceHistory)(records);
+    return {
+        confidence: history.confidence,
+        items: history.cycles.map((cycle) => {
+            const cures = cycle.cureEfficacy.length === 0 ? 'none' : cycle.cureEfficacy.map((cure) => cure.efficacy).join(', ');
+            return {
+                id: `history.cycle.${cycle.cycleId}`,
+                label: `Cycle ${cycle.cycleId.slice(0, 12)}`,
+                state: cycle.cycleState === 'blocked' ? 'attention' : 'ok',
+                detail: `plan ${cycle.plan.state}; tasks ${cycle.tasks.length}; retries ${cycle.retries}; QA ${cycle.qa.findings}/${cycle.qa.fixes}; first-pass ${cycle.gates.firstPass ? 'yes' : 'no'}; cures ${cures}`,
+            };
+        }),
+    };
+}
 function isolatedFindings(items) {
     return optional(() => findings(items, true));
 }
@@ -150,7 +203,7 @@ function collectDashboardSnapshot(options) {
     const executionItems = isolatedFindings(execution?.execution);
     const qaItems = isolatedFindings(execution?.qa);
     const retroItems = isolatedFindings(execution?.retro);
-    const historyItems = isolatedFindings(execution?.history);
+    const evidenceResult = optional(() => evidenceHistoryItems(root));
     const executionUnavailable = !executionResult.failed && execution === undefined;
     const sections = [
         machineSection,
@@ -163,8 +216,8 @@ function collectDashboardSnapshot(options) {
         // absent execution source is not evidence of a successful empty cycle.
         section('qa', executionResult.failed || executionUnavailable || qaItems.failed ? 'unavailable' : 'available', qaItems.value),
         section('retro', executionResult.failed || executionUnavailable || retroItems.failed ? 'unavailable' : 'available', retroItems.value),
-        section('history', executionResult.failed || executionUnavailable || historyItems.failed ? 'unavailable' : 'available', historyItems.value),
+        section('history', evidenceResult.failed ? 'unavailable' : 'available', evidenceResult.failed ? [] : evidenceResult.value.items),
     ];
     const degraded = sections.some((entry) => entry.availability === 'unavailable' || entry.items.some((item) => item.state !== 'ok' && item.state !== 'not_applicable'));
-    return (0, validate_1.validateDashboardSnapshotV1)({ schema: 1, generatedAt: options.now, overall: degraded ? 'degraded' : 'healthy', project: { detected: true, label: projectSource?.label || 'Project detected' }, confidence: 'provisional', sections });
+    return (0, validate_1.validateDashboardSnapshotV1)({ schema: 1, generatedAt: options.now, overall: degraded ? 'degraded' : 'healthy', project: { detected: true, label: projectSource?.label || 'Project detected' }, confidence: evidenceResult.failed ? 'none' : evidenceResult.value.confidence, sections });
 }

package/dist/src/core/dashboard/render-html.js

@@ -45,8 +45,14 @@ function projectHeaderActions() {
 function projectChrome(project) {
     return `<div class="project-chrome"><p class="eyebrow" data-project-breadcrumb>AWM / Proyecto / ${project}</p><nav data-project-nav aria-label="Project navigation"><span aria-current="page">Proyecto</span><span>Ejecución</span><span>Configuración</span></nav></div>`;
 }
-function projectEvidenceComposition() {
-    return `<div data-project-evidence role="group" aria-labelledby="project-evidence-heading"><h3 id="project-evidence-heading" class="sr-only">Project evidence</h3><div class="evidence-grid compact-composition"><div><h3>Planes de trabajo</h3><div class="plan-card active" data-plan-card="active"><div><strong>Plan activo</strong><span class="state attention">Sin observación</span></div><p>Progreso: sin observación</p><button type="button" disabled aria-describedby="static-controls-note">Ver plan (estático)</button></div><div class="plan-card blocked" data-plan-card="blocked"><div><strong>Plan bloqueado</strong><span class="state unavailable">Sin observación</span></div><p>Progreso: sin observación</p><button type="button" disabled aria-describedby="static-controls-note">Ver plan (estático)</button></div></div><div><h3>Impacto y trazabilidad</h3><table class="evidence-table"><thead><tr><th scope="col">Tipo</th><th scope="col">Fuente</th><th scope="col">Estado</th><th scope="col">Fecha</th></tr></thead><tbody><tr><td colspan="4" class="empty">No hay evidencia de impacto disponible en este snapshot.</td></tr></tbody></table></div></div><div class="closure-actions" data-closure-actions role="group" aria-labelledby="closure-actions-heading"><div><h3 id="closure-actions-heading">Qué falta para cerrar el ciclo</h3><p class="empty">La ausencia de marcador no equivale a cero hallazgos.</p></div><div><button type="button" disabled aria-describedby="static-controls-note">Completar QA (estático)</button><button type="button" disabled aria-describedby="static-controls-note">Registrar retro (estático)</button><button type="button" disabled aria-describedby="static-controls-note">Adjuntar evidencia (estático)</button></div></div></div>`;
+function projectEvidenceComposition(snapshot) {
+    const planning = snapshot.sections.find((section) => section.id === 'planning')?.items ?? [];
+    const history = snapshot.sections.find((section) => section.id === 'history')?.items ?? [];
+    const planCards = planning.length === 0
+        ? `<div class="plan-card active" data-plan-card="active"><div><strong>Plan activo</strong><span class="state attention">Sin observación</span></div><p>Progreso: sin observación</p><button type="button" disabled aria-describedby="static-controls-note">Ver plan (estático)</button></div><div class="plan-card blocked" data-plan-card="blocked"><div><strong>Plan bloqueado</strong><span class="state unavailable">Sin observación</span></div><p>Progreso: sin observación</p><button type="button" disabled aria-describedby="static-controls-note">Ver plan (estático)</button></div>`
+        : planning.map((plan) => `<div class="plan-card ${plan.detail === 'blocked' ? 'blocked' : 'active'}" data-plan-card="${plan.detail === 'blocked' ? 'blocked' : 'active'}"><div><strong>${escapeHtml(plan.label)}</strong><span class="state ${plan.state}">${STATE_GLYPH[plan.state]} ${STATE_TEXT[plan.state]}</span></div><p>Estado: ${escapeHtml(plan.detail ?? 'sin observación')}</p><button type="button" disabled aria-describedby="static-controls-note">Ver plan (estático)</button></div>`).join('');
+    const evidenceRows = history.length === 0 ? '<tr><td colspan="4" class="empty">No hay evidencia de impacto disponible en este snapshot.</td></tr>' : history.map((item) => `<tr><td>ciclo</td><td>${escapeHtml(item.label)}</td><td><span class="state ${item.state}">${STATE_GLYPH[item.state]} ${STATE_TEXT[item.state]}</span><br>${escapeHtml(item.detail ?? '—')}</td><td>—</td></tr>`).join('');
+    return `<div data-project-evidence role="group" aria-labelledby="project-evidence-heading"><h3 id="project-evidence-heading" class="sr-only">Project evidence</h3><div class="evidence-grid compact-composition"><div><h3>Planes de trabajo</h3>${planCards}</div><div><h3>Impacto y trazabilidad</h3><table class="evidence-table"><thead><tr><th scope="col">Tipo</th><th scope="col">Fuente</th><th scope="col">Estado</th><th scope="col">Fecha</th></tr></thead><tbody>${evidenceRows}</tbody></table></div></div><div class="closure-actions" data-closure-actions role="group" aria-labelledby="closure-actions-heading"><div><h3 id="closure-actions-heading">Qué falta para cerrar el ciclo</h3><p class="empty">La ausencia de marcador no equivale a cero hallazgos.</p></div><div><button type="button" disabled aria-describedby="static-controls-note">Completar QA (estático)</button><button type="button" disabled aria-describedby="static-controls-note">Registrar retro (estático)</button><button type="button" disabled aria-describedby="static-controls-note">Adjuntar evidencia (estático)</button></div></div></div>`;
 }
 function projectComposition(snapshot) {
     const stageSections = ['planning', 'execution', 'qa', 'retro', 'history'];
@@ -62,7 +68,7 @@ function projectComposition(snapshot) {
     const prepNames = ['installation', 'sensors', 'persistence'];
     const preparation = `<div class="machine-preparation-strip" data-machine-preparation role="group" aria-labelledby="machine-preparation-heading"><h3 id="machine-preparation-heading">Preparación de máquina</h3><ul class="diagnostic-grid">${prepNames.map((name, index) => { const item = prepItems[index]; return `<li data-machine-preparation-card="${name}">${item ? `<span class="state ${item.state}">${STATE_GLYPH[item.state]} ${STATE_TEXT[item.state]}</span><strong>${escapeHtml(item.label)}</strong><span>${item.detail ? escapeHtml(item.detail) : 'Sin detalle adicional'}</span>` : '<span class="state unavailable">⊘ Unavailable</span><strong>Sin observación</strong><span>Fuente no disponible</span>'}</li>`; }).join('')}</ul></div>`;
     const machineSupplement = `${preparation}<nav class="lifecycle-timeline" data-lifecycle-timeline aria-labelledby="lifecycle-timeline-heading"><h3 id="lifecycle-timeline-heading">Línea de ciclo</h3><ol class="timeline connected-timeline">${stages}</ol></nav>${provisional}`;
-    const historySupplement = projectEvidenceComposition();
+    const historySupplement = projectEvidenceComposition(snapshot);
     return snapshot.sections.map((section) => sectionHtml(section, section.id === 'machine' ? machineSupplement : section.id === 'history' ? historySupplement : '')).join('');
 }
 /** Renders a portable, static, share-safe dashboard document. */

package/dist/src/core/dashboard/render-terminal.js

@@ -28,6 +28,8 @@ function renderFullTerminal(input) {
     ];
     for (const section of snapshot.sections) {
         lines.push('', SECTION_TITLES[section.id]);
+        if (section.id === 'history')
+            lines.push(`  Eligible evidence rows: ${section.items.length}`);
         if (section.availability !== 'available')
             lines.push(`  ⊘ source ${section.availability.replace('_', ' ')}`);
         if (section.items.length === 0)

package/dist/src/core/evidence/capture.js

@@ -0,0 +1,46 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.captureCycleEvidence = captureCycleEvidence;
+const crypto_1 = __importDefault(require("crypto"));
+const types_1 = require("./types");
+const hash = (value) => crypto_1.default.createHash('sha256').update(value).digest('hex');
+const object = (value, name) => { if (!value || typeof value !== 'object' || Array.isArray(value))
+    throw new Error(`${name} must be an object`); return value; };
+const iso = (value, name) => { if (typeof value !== 'string' || Number.isNaN(Date.parse(value)))
+    throw new Error(`${name} must be an ISO timestamp`); return value; };
+const nonNegative = (value, name) => { if (!Number.isSafeInteger(value) || value < 0)
+    throw new Error(`${name} must be a non-negative integer`); return value; };
+function captureCycleEvidence(input) {
+    if (!input || typeof input.root !== 'string' || !input.root)
+        throw new Error('capture root is required');
+    if (typeof input.repositoryIdentity !== 'string' || input.repositoryIdentity.length === 0 || input.repositoryIdentity.length > 4096 || /[\r\n]/.test(input.repositoryIdentity))
+        throw new Error('repository identity is invalid');
+    const repositoryIdentity = hash(input.repositoryIdentity);
+    if (typeof input.planPath !== 'string' || !input.planPath)
+        throw new Error('capture planPath is required');
+    const journal = object(input.journal, 'journal');
+    const cycle = object(journal.cycle, 'journal cycle');
+    const startedAt = iso(cycle.startedAt, 'cycle startedAt');
+    const endedAt = iso(cycle.completedAt ?? journal.controllerHeartbeatAt, 'cycle endedAt');
+    if (cycle.status !== 'COMPLETE' && cycle.status !== 'BLOCKED')
+        throw new Error('journal cycle must be complete or blocked');
+    if (!Array.isArray(journal.tasks) || !Array.isArray(journal.verdicts) || !Array.isArray(journal.fixes) || !Array.isArray(input.gates) || !Array.isArray(input.ledger))
+        throw new Error('capture sources are invalid');
+    const tasks = journal.tasks.map((item, index) => { const task = object(item, `task ${index}`); if (typeof task.id !== 'string')
+        throw new Error('task id is invalid'); const attempts = nonNegative(task.attempts, 'task attempts'); return { id: task.id, attempts, retries: Math.max(attempts - 1, 0) }; });
+    const failures = journal.verdicts.filter((item, index) => { const verdict = object(item, `verdict ${index}`); if (verdict.result !== 'pass' && verdict.result !== 'fail' && verdict.result !== 'inconclusive')
+        throw new Error('verdict result is invalid'); iso(verdict.receivedAt, 'verdict receivedAt'); return verdict.result === 'fail'; });
+    const signatures = failures.map((item) => { const verdict = object(item, 'verdict'); if (typeof verdict.fingerprint !== 'string' || !verdict.fingerprint)
+        throw new Error('verdict fingerprint is required'); return hash(`signature:${verdict.fingerprint}`); });
+    const fixes = journal.fixes.filter((item, index) => { const fix = object(item, `fix ${index}`); if (typeof fix.closed !== 'boolean')
+        throw new Error('fix closed is invalid'); return fix.closed; }).length;
+    const gates = input.gates.map((item, index) => { const gate = object(item, `gate ${index}`); if (typeof gate.required !== 'boolean' || typeof gate.passed !== 'boolean')
+        throw new Error('gate is invalid'); return gate; }).filter((gate) => gate.required === true);
+    const cures = input.ledger.filter((item, index) => { const entry = object(item, `ledger ${index}`); if (typeof entry.signature !== 'string' || (entry.polarity !== 'finding' && entry.polarity !== 'win'))
+        throw new Error('ledger entry is invalid'); iso(entry.ts, 'ledger timestamp'); return entry.polarity === 'win'; }).map((entry) => { const source = object(entry, 'ledger'); return { signature: hash(`signature:${source.signature}`), curedAt: iso(source.ts, 'ledger timestamp') }; });
+    const pr = input.pr === undefined ? undefined : (() => { const raw = object(input.pr, 'pr'); return { provider: raw.provider, number: raw.number }; })();
+    return (0, types_1.validateCycleEvidence)({ schema: 1, cycleId: hash(`${repositoryIdentity}\0${input.planPath}\0${startedAt}`), startedAt, endedAt, durationMs: Date.parse(endedAt) - Date.parse(startedAt), cycleState: cycle.status === 'COMPLETE' ? 'completed' : 'blocked', plan: { ref: input.planPath, state: input.planState ?? (cycle.status === 'BLOCKED' ? 'blocked' : 'executed') }, tasks, qa: { findings: signatures.length, fixes: Math.min(fixes, signatures.length), signatures }, gates: { required: gates.length, firstEvaluationsPassed: gates.map((gate) => gate.passed), firstPass: gates.every((gate) => gate.passed === true) }, cures, ...(pr ? { pr } : {}) });
+}

package/dist/src/core/evidence/history.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.confidenceForCycles = confidenceForCycles;
+exports.classifyCure = classifyCure;
+exports.buildEvidenceHistory = buildEvidenceHistory;
+const types_1 = require("./types");
+function confidenceForCycles(count) {
+    if (!Number.isSafeInteger(count) || count < 0)
+        throw new Error('eligible cycle count must be a non-negative integer');
+    const eligibleCycles = count;
+    if (eligibleCycles === 0)
+        return 'none';
+    if (eligibleCycles === 1)
+        return 'provisional';
+    if (eligibleCycles < 5)
+        return 'observing';
+    return 'supported';
+}
+function classifyCure(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        throw new Error('cure observation must be an object');
+    const value = input;
+    if (Object.keys(value).some((key) => key !== 'laterEligibleCycles' && key !== 'recurred') || !Number.isSafeInteger(value.laterEligibleCycles) || value.laterEligibleCycles < 0 || typeof value.recurred !== 'boolean')
+        throw new Error('cure observation is invalid');
+    const laterEligibleCycles = value.laterEligibleCycles;
+    if (value.recurred)
+        return 'recurred';
+    if (laterEligibleCycles === 0)
+        return 'awaiting_observation';
+    return laterEligibleCycles >= 3 ? 'supported' : 'observing';
+}
+/** Validates, retains, and deterministically orders every eligible local observation. */
+function buildEvidenceHistory(records) {
+    if (!Array.isArray(records))
+        throw new Error('evidence history records must be an array');
+    const valid = records.map((record) => (0, types_1.validateCycleEvidence)(record)).sort((left, right) => left.startedAt.localeCompare(right.startedAt) || left.cycleId.localeCompare(right.cycleId));
+    const completed = valid.filter((cycle) => cycle.cycleState === 'completed');
+    const cycles = valid.map((cycle, index) => ({
+        ...cycle,
+        retries: cycle.tasks.reduce((total, task) => total + task.retries, 0),
+        cureEfficacy: cycle.cures.map((cure) => {
+            const later = valid.slice(index + 1).filter((candidate) => candidate.cycleState === 'completed');
+            return {
+                signature: cure.signature,
+                efficacy: classifyCure({ laterEligibleCycles: later.length, recurred: later.some((candidate) => candidate.qa.signatures.includes(cure.signature)) }),
+            };
+        }),
+    }));
+    return { confidence: confidenceForCycles(completed.length), empty: cycles.length === 0, cycles };
+}

package/dist/src/core/evidence/store.js

@@ -0,0 +1,32 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeCycleEvidence = writeCycleEvidence;
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+const atomic_file_1 = require("../atomic-file");
+const types_1 = require("./types");
+function writeCycleEvidence(root, evidence) {
+    if (typeof root !== 'string' || root.length === 0)
+        throw new Error('evidence root must be a non-empty string');
+    const valid = (0, types_1.validateCycleEvidence)(evidence);
+    const safeRoot = safeDirectory(root, 'root');
+    let directory = safeRoot;
+    for (const segment of ['.awm', 'evidence', 'cycles']) {
+        directory = path_1.default.join(directory, segment);
+        if (!fs_1.default.existsSync(directory))
+            fs_1.default.mkdirSync(directory, { mode: 0o700 });
+        directory = safeDirectory(directory, `evidence ${segment}`);
+    }
+    const file = path_1.default.join(directory, `${valid.cycleId}.json`);
+    (0, atomic_file_1.writeFileAtomicDurable)(file, JSON.stringify(valid, null, 2) + '\n', 0o600);
+    return valid;
+}
+function safeDirectory(directory, label) {
+    const stat = fs_1.default.lstatSync(directory);
+    if (stat.isSymbolicLink() || !stat.isDirectory())
+        throw new Error(`unsafe evidence ${label} directory symlink or non-directory`);
+    return fs_1.default.realpathSync(directory);
+}

package/dist/src/core/evidence/types.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLAN_STATES = void 0;
+exports.validateCycleEvidence = validateCycleEvidence;
+exports.PLAN_STATES = ['active', 'blocked', 'qa_pending', 'retro_pending', 'executed', 'legacy_unverifiable'];
+const DIGEST = /^[a-f0-9]{64}$/;
+const SAFE_ID = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+function record(value, label) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        throw new Error(`${label} must be an object`);
+    return value;
+}
+function keys(value, label, allowed) {
+    if (Object.keys(value).some((key) => !allowed.includes(key)))
+        throw new Error(`${label} has unsupported fields`);
+}
+function timestamp(value, label) {
+    if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value) || Number.isNaN(Date.parse(value)) || new Date(value).toISOString() !== value)
+        throw new Error(`${label} must be a canonical ISO timestamp`);
+    return value;
+}
+function count(value, label) {
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0)
+        throw new Error(`${label} must be a non-negative integer`);
+    return value;
+}
+function digest(value, label) {
+    if (typeof value !== 'string' || !DIGEST.test(value))
+        throw new Error(`${label} must be a SHA-256 digest`);
+    return value;
+}
+function relativePlanRef(value) {
+    if (typeof value !== 'string' || !value || value.includes('\\') || value.startsWith('/') || /^[A-Za-z]:/.test(value)
+        || value.split('/').some((part) => part === '' || part === '.' || part === '..'))
+        throw new Error('plan.ref must be repo-relative');
+    return value;
+}
+/** Strict public durable-boundary validator: accepted evidence intentionally has no prose or identities. */
+function validateCycleEvidence(input) {
+    const value = record(input, 'cycle evidence');
+    keys(value, 'cycle evidence', ['schema', 'cycleId', 'startedAt', 'endedAt', 'durationMs', 'cycleState', 'plan', 'tasks', 'qa', 'gates', 'cures', 'pr']);
+    if (value.schema !== 1)
+        throw new Error('cycle evidence schema must be 1');
+    const startedAt = timestamp(value.startedAt, 'startedAt');
+    const endedAt = timestamp(value.endedAt, 'endedAt');
+    const durationMs = count(value.durationMs, 'durationMs');
+    if (Date.parse(endedAt) < Date.parse(startedAt) || durationMs !== Date.parse(endedAt) - Date.parse(startedAt))
+        throw new Error('cycle duration is invalid');
+    if (value.cycleState !== 'completed' && value.cycleState !== 'blocked')
+        throw new Error('cycleState is invalid');
+    const plan = record(value.plan, 'plan');
+    keys(plan, 'plan', ['ref', 'state']);
+    if (typeof plan.state !== 'string' || !exports.PLAN_STATES.includes(plan.state))
+        throw new Error('plan state is invalid');
+    if (!Array.isArray(value.tasks))
+        throw new Error('tasks must be an array');
+    const tasks = value.tasks.map((item, index) => {
+        const task = record(item, `tasks[${index}]`);
+        keys(task, `tasks[${index}]`, ['id', 'attempts', 'retries']);
+        if (typeof task.id !== 'string' || !SAFE_ID.test(task.id))
+            throw new Error('task id is invalid');
+        const attempts = count(task.attempts, 'task attempts');
+        const retries = count(task.retries, 'task retries');
+        if (retries !== Math.max(attempts - 1, 0))
+            throw new Error('task retries must derive from attempts');
+        return { id: task.id, attempts, retries };
+    });
+    const qa = record(value.qa, 'qa');
+    keys(qa, 'qa', ['findings', 'fixes', 'signatures']);
+    if (!Array.isArray(qa.signatures))
+        throw new Error('qa signatures must be an array');
+    const signatures = qa.signatures.map((signature, index) => digest(signature, `qa.signatures[${index}]`));
+    const findings = count(qa.findings, 'qa findings');
+    const fixes = count(qa.fixes, 'qa fixes');
+    if (signatures.length !== findings || fixes > findings)
+        throw new Error('qa counts are inconsistent');
+    const gates = record(value.gates, 'gates');
+    keys(gates, 'gates', ['required', 'firstEvaluationsPassed', 'firstPass']);
+    const required = count(gates.required, 'required gates');
+    if (!Array.isArray(gates.firstEvaluationsPassed) || !gates.firstEvaluationsPassed.every((passed) => typeof passed === 'boolean') || gates.firstEvaluationsPassed.length !== required || typeof gates.firstPass !== 'boolean' || gates.firstPass !== gates.firstEvaluationsPassed.every(Boolean))
+        throw new Error('gate evaluations are inconsistent');
+    if (!Array.isArray(value.cures))
+        throw new Error('cures must be an array');
+    const cures = value.cures.map((item, index) => { const cure = record(item, `cures[${index}]`); keys(cure, `cures[${index}]`, ['signature', 'curedAt']); return { signature: digest(cure.signature, 'cure signature'), curedAt: timestamp(cure.curedAt, 'curedAt') }; });
+    let pr;
+    if (value.pr !== undefined) {
+        const raw = record(value.pr, 'pr');
+        keys(raw, 'pr', ['provider', 'number']);
+        if (raw.provider !== 'github' && raw.provider !== 'gitlab' && raw.provider !== 'other')
+            throw new Error('pr provider is invalid');
+        const number = count(raw.number, 'pr number');
+        if (number < 1)
+            throw new Error('pr number is invalid');
+        pr = { provider: raw.provider, number };
+    }
+    return { schema: 1, cycleId: digest(value.cycleId, 'cycleId'), startedAt, endedAt, durationMs, cycleState: value.cycleState, plan: { ref: relativePlanRef(plan.ref), state: plan.state }, tasks, qa: { findings, fixes, signatures }, gates: { required, firstEvaluationsPassed: [...gates.firstEvaluationsPassed], firstPass: gates.firstPass }, cures, ...(pr ? { pr } : {}) };
+}

package/dist/src/index.js

@@ -41,6 +41,7 @@ const agent_1 = require("./commands/agent");
 const job_1 = require("./commands/job");
 const watch_1 = require("./commands/watch");
 const track_1 = require("./commands/track");
+const evidence_1 = require("./commands/evidence");
 const add_1 = require("./commands/add");
 const sync_1 = require("./commands/sync");
 const update_1 = require("./commands/update");
@@ -733,6 +734,7 @@ miroCmd.command('sync <storyMapPath>')
 (0, job_1.registerJobCommand)(program);
 (0, watch_1.registerWatchCommand)(program);
 (0, track_1.registerTrackCommand)(program);
+(0, evidence_1.registerEvidenceCommand)(program);
 // Commander only waits for async action handlers through parseAsync().  The CLI has
 // async commands (including `sensors coverage`), so returning its promise keeps the
 // process alive until their JSON/output contract has been completed.

package/dist/tests/core/dashboard/collect.test.js

@@ -1,7 +1,15 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 const collect_1 = require("../../../src/core/dashboard/collect");
 const sanitize_1 = require("../../../src/core/dashboard/sanitize");
+const store_1 = require("../../../src/core/evidence/store");
+const evidence_fixtures_1 = require("../../helpers/evidence-fixtures");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
 const fixedNow = '2026-08-22T00:00:00.000Z';
 describe('collectDashboardSnapshot', () => {
     it('returns only a healthy machine section outside a project', () => {
@@ -35,13 +43,13 @@ describe('collectDashboardSnapshot', () => {
                 machine: () => ({ findings: [{ id: 'machine.preferences.missing', label: 'Preferences', state: 'missing' }] }),
                 project: () => ({ label: 'Demo', findings: [{ id: 'project.profile.missing', label: 'Profile', state: 'missing' }] }),
                 plans: () => Array.from({ length: 2000 }, (_, index) => ({ id: `plan.${index}`, label: `Plan ${index}`, state: 'ok' })),
-                execution: () => ({ history: Array.from({ length: 500 }, (_, index) => ({ id: `history.${index}`, label: `History ${index}`, state: 'ok' })) }),
+                execution: () => ({}),
             },
         });
         expect(snapshot.sections.map((section) => section.id)).toEqual(['machine', 'project', 'planning', 'execution', 'qa', 'retro', 'history']);
         expect(snapshot.sections.find((section) => section.id === 'machine')?.items[0].remediation).toBe('awm init');
         expect(snapshot.sections.find((section) => section.id === 'planning')?.items).toHaveLength(2000);
-        expect(snapshot.sections.find((section) => section.id === 'history')?.items).toHaveLength(500);
+        expect(snapshot.sections.find((section) => section.id === 'history')?.items).toHaveLength(0);
         expect(JSON.stringify(snapshot)).not.toMatch(/score|ranking/i);
     });
     it('isolates optional adapter failures and omits unverified remediation', () => {
@@ -62,7 +70,7 @@ describe('collectDashboardSnapshot', () => {
             cwd: process.cwd(), now: fixedNow,
             adapters: { machine: () => ({ findings: [] }), project: () => ({ findings: [] }), plans: () => [], execution: () => undefined },
         });
-        for (const id of ['execution', 'qa', 'retro', 'history']) {
+        for (const id of ['execution', 'qa', 'retro']) {
             expect(snapshot.sections.find((section) => section.id === id)?.availability).toBe('unavailable');
         }
     });
@@ -83,7 +91,7 @@ describe('collectDashboardSnapshot', () => {
         expect(snapshot.sections.find((section) => section.id === 'project')?.availability).toBe('unavailable');
         expect(snapshot.sections.find((section) => section.id === 'planning')?.availability).toBe('available');
     });
-    it.each(['execution', 'qa', 'retro', 'history'])('isolates malformed %s findings', (key) => {
+    it.each(['execution', 'qa', 'retro'])('isolates malformed %s findings', (key) => {
         const snapshot = (0, collect_1.collectDashboardSnapshot)({ cwd: process.cwd(), now: fixedNow, adapters: { machine: () => ({ findings: [] }), project: () => ({ findings: [] }), plans: () => [], execution: () => ({ [key]: [{ id: '', label: 'Profile', state: 'ok' }] }) } });
         expect(snapshot.sections.find((section) => section.id === key)?.availability).toBe('unavailable');
     });
@@ -142,6 +150,67 @@ describe('collectDashboardSnapshot', () => {
         expect(snapshot.sections.map((section) => section.id)).toEqual(['machine']);
         expect(snapshot.overall).toBe('degraded');
     });
+    it('loads validated local evidence only after a project is detected and renders every cycle fact', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-evidence-dashboard-'));
+        fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), '{}');
+        (0, store_1.writeCycleEvidence)(root, (0, evidence_fixtures_1.cycleEvidenceFixture)());
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({ cwd: root, now: fixedNow, adapters: { machine: () => ({ findings: [] }), project: () => ({ findings: [] }), plans: () => [], execution: () => undefined } });
+        const history = snapshot.sections.find((section) => section.id === 'history');
+        expect(snapshot.confidence).toBe('provisional');
+        expect(history?.availability).toBe('available');
+        expect(history?.items[0]?.detail).toContain('retries 1; QA 1/1; first-pass yes; cures awaiting_observation');
+        fs_1.default.rmSync(root, { recursive: true, force: true });
+    });
+    it.each(['.awm', 'evidence', 'cycles'])('does not follow a symlinked %s evidence ancestor', (ancestor) => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-evidence-dashboard-'));
+        const external = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-evidence-external-'));
+        fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), '{}');
+        const externalCycles = ancestor === '.awm' ? path_1.default.join(external, 'evidence', 'cycles') : path_1.default.join(external, 'cycles');
+        fs_1.default.mkdirSync(externalCycles, { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(externalCycles, `${'a'.repeat(64)}.json`), JSON.stringify((0, evidence_fixtures_1.cycleEvidenceFixture)()));
+        if (ancestor === '.awm')
+            fs_1.default.symlinkSync(external, path_1.default.join(root, '.awm'));
+        else if (ancestor === 'evidence') {
+            fs_1.default.mkdirSync(path_1.default.join(root, '.awm'));
+            fs_1.default.symlinkSync(external, path_1.default.join(root, '.awm', 'evidence'));
+        }
+        else {
+            fs_1.default.mkdirSync(path_1.default.join(root, '.awm', 'evidence'), { recursive: true });
+            fs_1.default.symlinkSync(external, path_1.default.join(root, '.awm', 'evidence', 'cycles'));
+        }
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({ cwd: root, now: fixedNow, adapters: { machine: () => ({ findings: [] }), project: () => ({ findings: [] }), plans: () => [], execution: () => undefined } });
+        const history = snapshot.sections.find((section) => section.id === 'history');
+        expect(history).toEqual(expect.objectContaining({ availability: 'unavailable', items: [] }));
+        fs_1.default.rmSync(root, { recursive: true, force: true });
+        fs_1.default.rmSync(external, { recursive: true, force: true });
+    });
+    it('does not follow a symlinked evidence file', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-evidence-dashboard-'));
+        const external = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-evidence-external-'));
+        fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), '{}');
+        const cycleId = 'a'.repeat(64);
+        const externalFile = path_1.default.join(external, `${cycleId}.json`);
+        fs_1.default.writeFileSync(externalFile, JSON.stringify((0, evidence_fixtures_1.cycleEvidenceFixture)()));
+        const directory = path_1.default.join(root, '.awm', 'evidence', 'cycles');
+        fs_1.default.mkdirSync(directory, { recursive: true });
+        fs_1.default.symlinkSync(externalFile, path_1.default.join(directory, `${cycleId}.json`));
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({ cwd: root, now: fixedNow, adapters: { machine: () => ({ findings: [] }), project: () => ({ findings: [] }), plans: () => [], execution: () => undefined } });
+        expect(snapshot.sections.find((section) => section.id === 'history')).toEqual(expect.objectContaining({ availability: 'unavailable', items: [] }));
+        fs_1.default.rmSync(root, { recursive: true, force: true });
+        fs_1.default.rmSync(external, { recursive: true, force: true });
+    });
+    it.each(['duplicate', 'mismatch'])('does not accept %s evidence filenames', (caseName) => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-evidence-dashboard-'));
+        fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), '{}');
+        (0, store_1.writeCycleEvidence)(root, (0, evidence_fixtures_1.cycleEvidenceFixture)());
+        const directory = path_1.default.join(root, '.awm', 'evidence', 'cycles');
+        const record = (0, evidence_fixtures_1.cycleEvidenceFixture)();
+        const filename = caseName === 'duplicate' ? `${'b'.repeat(64)}.json` : `${'b'.repeat(64)}.json`;
+        fs_1.default.writeFileSync(path_1.default.join(directory, filename), JSON.stringify(caseName === 'duplicate' ? record : { ...record, cycleId: 'c'.repeat(64) }));
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({ cwd: root, now: fixedNow, adapters: { machine: () => ({ findings: [] }), project: () => ({ findings: [] }), plans: () => [], execution: () => undefined } });
+        expect(snapshot.sections.find((section) => section.id === 'history')).toEqual(expect.objectContaining({ availability: 'unavailable', items: [] }));
+        fs_1.default.rmSync(root, { recursive: true, force: true });
+    });
 });
 describe('sanitizeDashboardSource', () => {
     it('removes hostile paths and secrets before rendering', () => {

package/dist/tests/core/dashboard/render-html.test.js

@@ -172,4 +172,20 @@ describe('renderDashboardHtml', () => {
         expect(first).toContain('Cycle 499');
         expect(first).toContain('Task 1999');
     });
+    it('renders supplied plans and evidence facts in the dense project panels', () => {
+        const html = (0, render_html_1.renderDashboardHtml)((0, validate_1.validateDashboardSnapshotV1)(snapshot({
+            confidence: 'supported',
+            sections: [
+                { id: 'machine', availability: 'available', items: [] }, { id: 'project', availability: 'available', items: [] },
+                { id: 'planning', availability: 'available', items: [{ id: 'plan.alpha', label: 'Impact plan', state: 'ok', detail: 'executed' }] },
+                { id: 'execution', availability: 'available', items: [] }, { id: 'qa', availability: 'available', items: [] }, { id: 'retro', availability: 'available', items: [] },
+                { id: 'history', availability: 'available', items: [{ id: 'history.cycle.abc', label: 'Cycle abc', state: 'ok', detail: 'plan executed; tasks 3; retries 2; QA 2/2; first-pass yes; cures supported' }] },
+            ],
+        })));
+        expect(html).toContain('Confidence: supported');
+        expect(html).toContain('Impact plan');
+        expect(html).toContain('Cycle abc');
+        expect(html).toContain('retries 2; QA 2/2; first-pass yes; cures supported');
+        expect(html).not.toContain('Progreso: sin observación');
+    });
 });

package/dist/tests/core/dashboard/render-terminal.test.js

@@ -62,4 +62,11 @@ describe('renderFullTerminal', () => {
         expect(first).toContain('Cycle 499');
         expect(first).not.toMatch(/score|ranking/i);
     });
+    it('renders explicit confidence and every evidence metric without improvement claims', () => {
+        const output = (0, render_terminal_1.renderFullTerminal)((0, validate_1.validateDashboardSnapshotV1)(completeSnapshot({ confidence: 'supported' })));
+        expect(output).toContain('Confidence: supported');
+        expect(output).toContain('Eligible evidence rows: 1');
+        expect(output).toContain('5 minutes');
+        expect(output).not.toMatch(/trend|percentage|improvement/i);
+    });
 });

package/dist/tests/core/evidence/capture.test.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const capture_1 = require("../../../src/core/evidence/capture");
+describe('captureCycleEvidence', () => {
+    test('derives counts and opaque signatures without journal prose or identities', () => {
+        const evidence = (0, capture_1.captureCycleEvidence)({
+            root: process.cwd(), repositoryIdentity: 'git@example.test:team/repository.git',
+            planPath: 'plans/release.md',
+            journal: {
+                cycle: { status: 'COMPLETE', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:10.000Z' },
+                journalId: 'local-repository-identity',
+                tasks: [{ id: 'task-a', attempts: 3 }],
+                verdicts: [{ result: 'fail', fingerprint: 'unsafe-input', detail: 'Alice saw secret prompt', receivedAt: '2026-08-22T10:00:05.000Z' }],
+                fixes: [{ verdictId: 'v1', closed: true }],
+            },
+            gates: [{ required: true, passed: true }],
+            ledger: [{ signature: 'unsafe-input', polarity: 'win', ts: '2026-08-22T10:00:06.000Z' }],
+            pr: { provider: 'github', number: 12 },
+        });
+        expect(evidence).toMatchObject({
+            schema: 1, cycleState: 'completed', durationMs: 10_000,
+            plan: { ref: 'plans/release.md' }, tasks: [{ id: 'task-a', attempts: 3, retries: 2 }],
+            qa: { findings: 1, fixes: 1 }, gates: { required: 1, firstEvaluationsPassed: [true], firstPass: true },
+            pr: { provider: 'github', number: 12 },
+        });
+        expect(evidence.cycleId).toMatch(/^[a-f0-9]{64}$/);
+        expect(evidence.qa.signatures[0]).toMatch(/^[a-f0-9]{64}$/);
+        expect(evidence.cures[0]).toMatchObject({ signature: expect.stringMatching(/^[a-f0-9]{64}$/) });
+        expect(evidence.cures[0].signature).toBe(evidence.qa.signatures[0]);
+        expect(JSON.stringify(evidence)).not.toContain('Alice');
+        expect(JSON.stringify(evidence)).not.toContain('secret prompt');
+    });
+    test('derives cycle identity from stable repository identity, not checkout or journal identity', () => {
+        const source = {
+            planPath: 'plans/release.md', journal: { journalId: 'repository-identity', cycle: { status: 'BLOCKED', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:01.000Z' }, tasks: [], verdicts: [], fixes: [] }, gates: [], ledger: [],
+        };
+        const first = (0, capture_1.captureCycleEvidence)({ ...source, root: process.cwd(), repositoryIdentity: 'git@example.test:team/repository.git' });
+        const second = (0, capture_1.captureCycleEvidence)({ ...source, root: process.cwd(), repositoryIdentity: 'git@example.test:team/repository.git', journal: { ...source.journal, journalId: 'different-journal-identity' } });
+        const distinct = (0, capture_1.captureCycleEvidence)({ ...source, root: process.cwd(), repositoryIdentity: 'git@example.test:other/repository.git' });
+        expect(first.cycleId).toBe(second.cycleId);
+        expect(first.cycleId).not.toBe(distinct.cycleId);
+        expect(first.cycleState).toBe('blocked');
+    });
+    test('captures a blocked cycle from its durable controller heartbeat when completedAt is absent', () => {
+        const evidence = (0, capture_1.captureCycleEvidence)({ root: process.cwd(), repositoryIdentity: 'git@example.test:team/repository.git', planPath: 'plans/release.md', journal: { cycle: { status: 'BLOCKED', startedAt: '2026-08-22T10:00:00.000Z' }, controllerHeartbeatAt: '2026-08-22T10:00:03.000Z', tasks: [], verdicts: [], fixes: [] }, gates: [], ledger: [] });
+        expect(evidence).toMatchObject({ cycleState: 'blocked', endedAt: '2026-08-22T10:00:03.000Z', durationMs: 3_000 });
+    });
+});

package/dist/tests/core/evidence/command.test.js

@@ -0,0 +1,37 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const evidence_1 = require("../../../src/commands/evidence");
+describe('evidence capture CLI boundary', () => {
+    let root;
+    beforeEach(() => { root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-evidence-command-')); });
+    afterEach(() => { fs_1.default.rmSync(root, { recursive: true, force: true }); });
+    test('returns exit 2 for a missing or invalid plan', () => {
+        expect((0, evidence_1.runEvidenceCapture)(root, undefined).code).toBe(2);
+        expect((0, evidence_1.runEvidenceCapture)(root, '../secret.md').code).toBe(2);
+    });
+    test('returns exactly the captured cycle id on success', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, 'plan.md'), '# plan\n');
+        expect((0, evidence_1.runEvidenceCapture)(root, 'plan.md', { repositoryIdentity: 'git@example.test:team/repository.git', journal: { journalId: 'ignored', cycle: { status: 'COMPLETE', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:01.000Z' }, tasks: [], verdicts: [], fixes: [], jobs: {}, cycleVerificationPlan: [] }, ledger: [] })).toEqual(expect.objectContaining({ code: 0, stdout: expect.stringMatching(/^[a-f0-9]{64}\n$/) }));
+    });
+    test('uses the first attempted gate evaluation instead of final satisfaction', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, 'plan.md'), '# plan\n');
+        const result = (0, evidence_1.runEvidenceCapture)(root, 'plan.md', { repositoryIdentity: 'git@example.test:team/repository.git', journal: { journalId: 'ignored', cycle: { status: 'COMPLETE', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:01.000Z' }, tasks: [], verdicts: [], fixes: [], cycleVerificationPlan: [{ id: 'gate', kind: 'test', satisfiedBy: 'retry' }], jobs: { first: { id: 'first', satisfies: ['gate'], verdict: 'fail', phaseTimestamps: { received: '2026-08-22T10:00:00.000Z' } }, retry: { id: 'retry', satisfies: ['gate'], attemptOf: 'first', verdict: 'pass', phaseTimestamps: { received: '2026-08-22T10:00:01.000Z' } } } }, ledger: [] });
+        expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(root, '.awm', 'evidence', 'cycles', result.stdout.trim() + '.json'), 'utf8')).gates.firstEvaluationsPassed).toEqual([false]);
+    });
+    test('orders independent root evaluations by durable timestamp then id', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, 'plan.md'), '# plan\n');
+        const result = (0, evidence_1.runEvidenceCapture)(root, 'plan.md', { repositoryIdentity: 'git@example.test:team/repository.git', journal: { journalId: 'ignored', cycle: { status: 'COMPLETE', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:03.000Z' }, tasks: [], verdicts: [], fixes: [], cycleVerificationPlan: [{ id: 'gate', kind: 'test', satisfiedBy: 'late-pass' }], jobs: { late: { id: 'late-pass', satisfies: ['gate'], verdict: 'pass', phaseTimestamps: { received: '2026-08-22T10:00:02.000Z' } }, early: { id: 'early-fail', satisfies: ['gate'], verdict: 'fail', phaseTimestamps: { received: '2026-08-22T10:00:01.000Z' } } } }, ledger: [] });
+        expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(root, '.awm', 'evidence', 'cycles', result.stdout.trim() + '.json'), 'utf8')).gates.firstEvaluationsPassed).toEqual([false]);
+    });
+    test('uses the first review verdict rather than satisfiedBy final verdict', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, 'plan.md'), '# plan\n');
+        const result = (0, evidence_1.runEvidenceCapture)(root, 'plan.md', { repositoryIdentity: 'git@example.test:team/repository.git', journal: { journalId: 'ignored', cycle: { status: 'COMPLETE', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:01.000Z' }, tasks: [], fixes: [], cycleVerificationPlan: [{ id: 'review-gate', kind: 'review', satisfiedBy: 'final' }], jobs: {}, verdicts: [{ id: 'first', obligationId: 'review-gate', result: 'fail', fingerprint: 'review-gate', receivedAt: '2026-08-22T10:00:00.000Z' }, { id: 'final', obligationId: 'review-gate', result: 'pass', fingerprint: 'review-gate', receivedAt: '2026-08-22T10:00:01.000Z' }] }, ledger: [] });
+        expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(root, '.awm', 'evidence', 'cycles', result.stdout.trim() + '.json'), 'utf8')).gates.firstEvaluationsPassed).toEqual([false]);
+    });
+});

package/dist/tests/core/evidence/history.test.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const history_1 = require("../../../src/core/evidence/history");
+const evidence_fixtures_1 = require("../../helpers/evidence-fixtures");
+describe('evidence history', () => {
+    it.each([[0, 'none'], [1, 'provisional'], [2, 'observing'], [4, 'observing'], [5, 'supported']])('classifies %i eligible cycles as %s', (count, expected) => expect((0, history_1.confidenceForCycles)(count)).toBe(expected));
+    it.each([
+        [0, false, 'awaiting_observation'], [1, false, 'observing'], [2, false, 'observing'],
+        [3, false, 'supported'], [1, true, 'recurred'],
+    ])('classifies cure observation honestly', (laterEligibleCycles, recurred, expected) => {
+        expect((0, history_1.classifyCure)({ laterEligibleCycles, recurred })).toBe(expected);
+    });
+    it('validates every record, retains every eligible row, and sorts stably by timestamp and cycle id', () => {
+        const later = { ...(0, evidence_fixtures_1.cycleEvidenceFixture)(), cycleId: 'd'.repeat(64), startedAt: '2026-08-22T11:00:00.000Z', endedAt: '2026-08-22T11:01:00.000Z', cures: [] };
+        const sameTimestamp = { ...(0, evidence_fixtures_1.cycleEvidenceFixture)(), cycleId: '0'.repeat(64), cures: [] };
+        const history = (0, history_1.buildEvidenceHistory)([later, (0, evidence_fixtures_1.cycleEvidenceFixture)(), sameTimestamp]);
+        expect(history.confidence).toBe('observing');
+        expect(history.empty).toBe(false);
+        expect(history.cycles.map((cycle) => cycle.cycleId)).toEqual(['0'.repeat(64), 'a'.repeat(64), 'd'.repeat(64)]);
+        expect(() => (0, history_1.buildEvidenceHistory)([{ ...(0, evidence_fixtures_1.cycleEvidenceFixture)(), durationMs: -1 }])).toThrow(/duration/i);
+    });
+    it('reports zero cycles explicitly without a trend, percentage, or improvement claim', () => {
+        const history = (0, history_1.buildEvidenceHistory)([]);
+        expect(history).toEqual(expect.objectContaining({ empty: true, confidence: 'none', cycles: [] }));
+        expect(JSON.stringify(history)).not.toMatch(/trend|percentage|improvement/i);
+    });
+    it('retains blocked records but excludes them from confidence and cure observation windows', () => {
+        const blocked = Array.from({ length: 5 }, (_, index) => ({
+            ...(0, evidence_fixtures_1.cycleEvidenceFixture)(), cycleId: `${index}`.repeat(64), cycleState: 'blocked', cures: [],
+        }));
+        const history = (0, history_1.buildEvidenceHistory)(blocked);
+        expect(history.cycles).toHaveLength(5);
+        expect(history.confidence).toBe('none');
+        const cured = { ...(0, evidence_fixtures_1.cycleEvidenceFixture)(), cycleId: 'c'.repeat(64), endedAt: '2026-08-22T10:01:00.000Z' };
+        const laterBlocked = { ...(0, evidence_fixtures_1.cycleEvidenceFixture)(), cycleId: 'd'.repeat(64), cycleState: 'blocked', startedAt: '2026-08-22T11:00:00.000Z', endedAt: '2026-08-22T11:01:00.000Z', cures: [] };
+        const laterCompleted = { ...(0, evidence_fixtures_1.cycleEvidenceFixture)(), cycleId: 'e'.repeat(64), startedAt: '2026-08-22T12:00:00.000Z', endedAt: '2026-08-22T12:01:00.000Z', cures: [] };
+        const mixed = (0, history_1.buildEvidenceHistory)([cured, laterBlocked, laterCompleted]);
+        expect(mixed.confidence).toBe('observing');
+        expect(mixed.cycles[0].cureEfficacy[0].efficacy).toBe('observing');
+    });
+});

package/dist/tests/core/evidence/store.test.js

@@ -0,0 +1,32 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const evidence_fixtures_1 = require("../../helpers/evidence-fixtures");
+const store_1 = require("../../../src/core/evidence/store");
+describe('cycle evidence store', () => {
+    let root;
+    beforeEach(() => { root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-evidence-')); });
+    afterEach(() => { fs_1.default.rmSync(root, { recursive: true, force: true }); });
+    test('durably replaces one observation for the same opaque cycle id', () => {
+        const evidence = (0, evidence_fixtures_1.cycleEvidenceFixture)();
+        (0, store_1.writeCycleEvidence)(root, evidence);
+        (0, store_1.writeCycleEvidence)(root, { ...evidence, qa: { ...evidence.qa, fixes: 0 } });
+        const dir = path_1.default.join(root, '.awm', 'evidence', 'cycles');
+        expect(fs_1.default.readdirSync(dir)).toEqual([`${evidence.cycleId}.json`]);
+        expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(dir, `${evidence.cycleId}.json`), 'utf8')).qa.fixes).toBe(0);
+    });
+    test('rejects symlinked evidence ancestors without writing outside root', () => {
+        if (process.platform === 'win32')
+            return;
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-evidence-outside-'));
+        fs_1.default.symlinkSync(outside, path_1.default.join(root, '.awm'));
+        expect(() => (0, store_1.writeCycleEvidence)(root, (0, evidence_fixtures_1.cycleEvidenceFixture)())).toThrow(/symlink/);
+        expect(fs_1.default.readdirSync(outside)).toEqual([]);
+        fs_1.default.rmSync(outside, { recursive: true, force: true });
+    });
+});

package/dist/tests/core/evidence/types.test.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const evidence_fixtures_1 = require("../../helpers/evidence-fixtures");
+const types_1 = require("../../../src/core/evidence/types");
+describe('CycleEvidenceV1 validation', () => {
+    test('accepts the minimal privacy-preserving durable observation', () => {
+        expect((0, types_1.validateCycleEvidence)((0, evidence_fixtures_1.cycleEvidenceFixture)())).toEqual((0, evidence_fixtures_1.cycleEvidenceFixture)());
+    });
+    test.each([
+        ['unknown fields', { extra: 'raw prose' }],
+        ['absolute plan refs', { plan: { ref: '/Users/alice/plans/current.md', state: 'executed' } }],
+        ['raw prose', { qa: { findings: 1, fixes: 1, signatures: ['found alice failed a secret prompt'] } }],
+        ['host identities', { pr: { provider: 'github', number: 42, repository: 'alice/private' } }],
+        ['invalid retry totals', { tasks: [{ id: 'task-1', attempts: 2, retries: 0 }] }],
+        ['non-canonical timestamp', { startedAt: '2026-08-22T10:00:00Z' }],
+    ])('rejects %s', (_label, patch) => {
+        expect(() => (0, types_1.validateCycleEvidence)({ ...(0, evidence_fixtures_1.cycleEvidenceFixture)(), ...patch })).toThrow();
+    });
+    test('stores first gate evaluations as booleans, not an aggregate count', () => {
+        const evidence = (0, evidence_fixtures_1.cycleEvidenceFixture)();
+        expect((0, types_1.validateCycleEvidence)({ ...evidence, gates: { required: 2, firstEvaluationsPassed: [true, false], firstPass: false } }).gates.firstEvaluationsPassed).toEqual([true, false]);
+    });
+    test('permits every dashboard plan state and an absent PR', () => {
+        for (const state of ['active', 'blocked', 'qa_pending', 'retro_pending', 'executed', 'legacy_unverifiable']) {
+            const evidence = (0, evidence_fixtures_1.cycleEvidenceFixture)();
+            delete evidence.pr;
+            expect((0, types_1.validateCycleEvidence)({ ...evidence, plan: { ...evidence.plan, state } }).pr).toBeUndefined();
+        }
+    });
+});

package/dist/tests/helpers/evidence-fixtures.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cycleEvidenceFixture = void 0;
+const cycleEvidenceFixture = () => ({
+    schema: 1,
+    cycleId: 'a'.repeat(64),
+    startedAt: '2026-08-22T10:00:00.000Z',
+    endedAt: '2026-08-22T10:01:00.000Z',
+    durationMs: 60_000,
+    cycleState: 'completed',
+    plan: { ref: 'plans/current.md', state: 'executed' },
+    tasks: [{ id: 'task-1', attempts: 2, retries: 1 }],
+    qa: { findings: 1, fixes: 1, signatures: ['b'.repeat(64)] },
+    gates: { required: 1, firstEvaluationsPassed: [true], firstPass: true },
+    cures: [{ signature: 'c'.repeat(64), curedAt: '2026-08-22T10:00:30.000Z' }],
+});
+exports.cycleEvidenceFixture = cycleEvidenceFixture;

package/dist/tests/integration/doctor-dashboard.e2e.test.js

@@ -0,0 +1,177 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = __importDefault(require("crypto"));
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const cli = path_1.default.resolve(__dirname, '../../dist/src/index.js');
+function treeHash(root, ignored = new Set()) {
+    const hash = crypto_1.default.createHash('sha256');
+    const walk = (directory) => {
+        for (const entry of fs_1.default.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            const item = path_1.default.join(directory, entry.name);
+            const relative = path_1.default.relative(root, item).split(path_1.default.sep).join('/');
+            if (ignored.has(relative))
+                continue;
+            hash.update(relative);
+            if (entry.isDirectory())
+                walk(item);
+            else if (entry.isFile())
+                hash.update(fs_1.default.readFileSync(item));
+        }
+    };
+    walk(root);
+    return hash.digest('hex');
+}
+function treeEntries(root, ignored = new Set()) {
+    const entries = [];
+    const walk = (directory) => {
+        for (const entry of fs_1.default.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            const item = path_1.default.join(directory, entry.name);
+            const relative = path_1.default.relative(root, item).split(path_1.default.sep).join('/');
+            if (ignored.has(relative))
+                continue;
+            entries.push(relative);
+            if (entry.isDirectory())
+                walk(item);
+        }
+    };
+    walk(root);
+    return entries;
+}
+function fixture(name, project = true) {
+    const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), `awm-doctor-${name}-`));
+    const directory = project ? path_1.default.join(root, 'project') : path_1.default.join(root, 'machine-only');
+    const home = path_1.default.join(root, 'home');
+    fs_1.default.mkdirSync(directory, { recursive: true });
+    fs_1.default.mkdirSync(home, { recursive: true });
+    if (project)
+        fs_1.default.writeFileSync(path_1.default.join(directory, 'package.json'), JSON.stringify({ name, private: true }));
+    return { root, project: directory, home };
+}
+function command(f, ...args) {
+    return (0, child_process_1.spawnSync)(process.execPath, [cli, ...args], {
+        cwd: f.project,
+        encoding: 'utf8',
+        // The dashboard examines provider homes too.  Do not inherit the
+        // runner's HOME/CODEX_HOME: that turns the machine-only fixture into
+        // a report about whatever agent state happens to be installed on CI.
+        env: {
+            ...process.env,
+            HOME: f.home,
+            USERPROFILE: f.home,
+            CODEX_HOME: path_1.default.join(f.home, '.codex'),
+            AWM_HOME: f.home,
+            AWM_NO_UPDATE_CHECK: '1',
+        },
+    });
+}
+function snapshot(result) {
+    if (!result.stdout.trim())
+        throw new Error(`doctor emitted no JSON: ${result.stderr}`);
+    return JSON.parse(result.stdout);
+}
+function writeEvidence(f, id) {
+    const directory = path_1.default.join(f.project, '.awm', 'evidence', 'cycles');
+    fs_1.default.mkdirSync(directory, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(directory, `${id}.json`), JSON.stringify({
+        schema: 1, cycleId: id, startedAt: '2026-08-22T10:00:00.000Z', endedAt: '2026-08-22T10:01:00.000Z', durationMs: 60_000,
+        cycleState: 'completed', plan: { ref: 'docs/plans/current.md', state: 'executed' }, tasks: [{ id: 'task-1', attempts: 1, retries: 0 }],
+        qa: { findings: 0, fixes: 0, signatures: [] }, gates: { required: 1, firstEvaluationsPassed: [true], firstPass: true }, cures: [],
+    }));
+}
+describe('built doctor dashboard end-to-end (R4.8, R8.3-R8.5)', () => {
+    jest.setTimeout(60_000);
+    afterEach(() => jest.restoreAllMocks());
+    test('machine-only-uninitialized, degraded, partial, and corrupt fixtures are real on-disk states with exact exits and discriminating output', () => {
+        const machine = fixture('machine', false);
+        const degraded = fixture('degraded');
+        const partial = fixture('partial');
+        const corrupt = fixture('corrupt');
+        fs_1.default.mkdirSync(path_1.default.join(degraded.project, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(degraded.project, '.awm', 'profile.json'), '{not-json');
+        fs_1.default.mkdirSync(path_1.default.join(partial.project, '.awm', 'evidence', 'cycles'), { recursive: true });
+        fs_1.default.mkdirSync(path_1.default.join(corrupt.project, '.awm', 'evidence', 'cycles'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(corrupt.project, '.awm', 'evidence', 'cycles', `${'d'.repeat(64)}.json`), '{broken');
+        const cases = [
+            ['machine-only-uninitialized', machine, 1, /Machine \/ install/],
+            ['degraded-project', degraded, 1, /Project readiness/],
+            ['partial-source', partial, 1, /source unavailable/i],
+            ['corrupt-source', corrupt, 1, /Final \/ history\n  Eligible evidence rows: 0\n  ⊘ source unavailable/],
+        ];
+        try {
+            for (const [, f, exit, discriminant] of cases) {
+                const before = treeHash(f.root);
+                const result = command(f, 'doctor', '--full');
+                if (result.status !== exit) {
+                    throw new Error(`${f.project}\nexpected exit ${exit}, received ${result.status}\nstdout:\n${result.stdout}\nstderr:\n${result.stderr}`);
+                }
+                expect(result.stdout).toMatch(discriminant);
+                expect(treeHash(f.root)).toBe(before);
+            }
+        }
+        finally {
+            for (const [, f] of cases)
+                fs_1.default.rmSync(f.root, { recursive: true, force: true });
+        }
+    });
+    test('json compatibility, full static HTML CSP, hostile source text, long history, and large fixture counts remain safe', () => {
+        const f = fixture('hostile');
+        try {
+            // A hostile optional evidence file must not turn raw markup into HTML.
+            writeEvidence(f, 'a'.repeat(64));
+            for (let index = 1; index < 500; index++)
+                writeEvidence(f, crypto_1.default.createHash('sha256').update(String(index)).digest('hex'));
+            const json = command(f, 'doctor', '--json');
+            expect([0, 1]).toContain(json.status);
+            expect(snapshot(json)).toEqual(expect.objectContaining({ overall: expect.any(String), providers: expect.any(Array) }));
+            const before = treeHash(f.root);
+            const full = command(f, 'doctor', '--full');
+            expect(full.stdout).toContain('Final / history');
+            expect(full.stdout).toContain('Cycle');
+            expect(treeHash(f.root)).toBe(before);
+            // Feed hostile text through the evidence reader itself, not an
+            // unrelated project file: malformed evidence is isolated and its
+            // raw script is never copied into the static dashboard.
+            fs_1.default.writeFileSync(path_1.default.join(f.project, '.awm', 'evidence', 'cycles', `${'f'.repeat(64)}.json`), JSON.stringify({
+                schema: 1, cycleId: 'f'.repeat(64), startedAt: '2026-08-22T10:00:00.000Z', endedAt: '2026-08-22T10:01:00.000Z', durationMs: 60_000,
+                cycleState: 'completed', plan: { ref: 'docs/plans/current.md', state: 'executed' }, tasks: [{ id: '<script>hostile</script>', attempts: 1, retries: 0 }],
+                qa: { findings: 0, fixes: 0, signatures: [] }, gates: { required: 0, firstEvaluationsPassed: [], firstPass: true }, cures: [],
+            }));
+            const hostileBeforeHtml = treeHash(f.root);
+            const entriesBeforeHtml = treeEntries(f.root, new Set(['project/dashboard.html']));
+            const html = command(f, 'doctor', '--html', 'dashboard.html');
+            expect([0, 1]).toContain(html.status);
+            const page = fs_1.default.readFileSync(path_1.default.join(f.project, 'dashboard.html'), 'utf8');
+            expect(page).toContain('Content-Security-Policy');
+            expect(page).toContain("script-src 'none'");
+            expect(page).toContain('data-project-evidence');
+            expect(page).not.toContain('<script>hostile</script>');
+            expect(page).toContain('Source unavailable');
+            const afterHtml = treeHash(f.root, new Set(['project/dashboard.html']));
+            if (afterHtml !== hostileBeforeHtml) {
+                throw new Error(`doctor --html mutated files other than dashboard.html: before=${entriesBeforeHtml.join(',')} after=${treeEntries(f.root, new Set(['project/dashboard.html'])).join(',')}`);
+            }
+        }
+        finally {
+            fs_1.default.rmSync(f.root, { recursive: true, force: true });
+        }
+    });
+    test('invalid dashboard combinations exit 2 without mutation', () => {
+        const f = fixture('invalid');
+        try {
+            const before = treeHash(f.root);
+            const result = command(f, 'doctor', '--json', '--full');
+            expect(result.status).toBe(2);
+            expect(result.stderr).toMatch(/cannot be combined/i);
+            expect(treeHash(f.root)).toBe(before);
+        }
+        finally {
+            fs_1.default.rmSync(f.root, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/integration/published-doctor-evidence.e2e.test.js

@@ -0,0 +1,180 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertImmutableArtifacts = assertImmutableArtifacts;
+exports.assertIssue87RegistryPin = assertIssue87RegistryPin;
+exports.assertRetroCaptureContract = assertRetroCaptureContract;
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const cliVersion = process.env.AWM_PUBLISHED_CLI_VERSION;
+const registryTag = process.env.AWM_PUBLISHED_REGISTRY_TAG;
+const registryCommit = process.env.AWM_PUBLISHED_REGISTRY_COMMIT;
+const registryRemote = process.env.AWM_PUBLISHED_REGISTRY_REMOTE ?? 'https://github.com/Kodria/awm-baseline-registry.git';
+// Local contributors lack publish coordinates and skip this network acceptance.
+// A CI run that supplies the published CLI/tag but omits the commit MUST run and
+// fail at the provenance assertion rather than silently describe.skip.
+const enabled = Boolean(cliVersion && registryTag);
+const acceptance = enabled ? describe : describe.skip;
+function command(cwd, executable, args, env = process.env) {
+    return (0, child_process_1.spawnSync)(executable, args, { cwd, encoding: 'utf8', env });
+}
+/** Published evidence accepts only exact versions and immutable git tags. */
+function assertImmutableArtifacts(version, tag, commit, remote) {
+    if (!version || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version))
+        throw new Error('published CLI version must be an exact immutable semver');
+    if (version.includes('file:') || version.includes('/') || version.includes('@'))
+        throw new Error('published CLI must not be a workspace, file dependency, or mutable tag');
+    if (!tag || !/^v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(tag))
+        throw new Error('published registry ref must be an exact immutable tag');
+    if (!commit || !/^[a-f0-9]{40}$/.test(commit))
+        throw new Error('published registry commit must be a full immutable SHA');
+    if (!/^https:\/\/github\.com\/Kodria\/awm-baseline-registry\.git$/.test(remote))
+        throw new Error('published registry remote must be the canonical immutable release remote');
+}
+/** R8.7 is bound to the Task 7 registry release, never the preceding tag. */
+function assertIssue87RegistryPin(tag) {
+    if (tag !== 'v3.4.0')
+        throw new Error('published doctor evidence requires immutable registry tag v3.4.0');
+}
+function json(result) {
+    if (!result.stdout.trim())
+        throw new Error(`missing JSON output: ${result.stderr}`);
+    return JSON.parse(result.stdout);
+}
+function compareSemver(left, right) {
+    const parse = (value) => value.match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/);
+    const a = parse(left);
+    const b = parse(right);
+    if (!a || !b)
+        throw new Error('published compatibility versions must be exact semver');
+    for (let index = 1; index <= 3; index++) {
+        const difference = Number(a[index]) - Number(b[index]);
+        if (difference !== 0)
+            return difference;
+    }
+    return (a[4] ? -1 : 0) - (b[4] ? -1 : 0);
+}
+/** The cloned registry, not a loose prose regex, owns the retro ordering contract. */
+function assertRetroCaptureContract(registry, retro, version) {
+    if (!registry || typeof registry !== 'object' || Array.isArray(registry))
+        throw new Error('published registry metadata is invalid');
+    const floor = registry.minCliVersion;
+    if (typeof floor !== 'string' || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(floor))
+        throw new Error('published registry must declare minCliVersion');
+    if (compareSemver(version, floor) < 0)
+        throw new Error(`published CLI ${version} is below registry minCliVersion ${floor}`);
+    const commands = retro.split(/\r?\n/).map((line, index) => ({ line: line.trim(), index }))
+        .filter(({ line }) => !line.startsWith('#') && !line.startsWith('<!--'))
+        .filter(({ line }) => /^(?:\d+\.\s+)?`?awm (?:evidence capture|ledger archive)(?:\s|`|$)/.test(line));
+    const captures = commands.filter(({ line }) => /awm evidence capture(?:\s|`|$)/.test(line));
+    const archives = commands.filter(({ line }) => /awm ledger archive(?:\s|`|$)/.test(line));
+    if (captures.length !== 1)
+        throw new Error('installed harness-retro contract requires exactly one executable evidence capture command');
+    if (archives.length !== 1 || captures[0].index > archives[0].index)
+        throw new Error('installed harness-retro must capture evidence before archive');
+}
+acceptance('published doctor and evidence acceptance (R8.7)', () => {
+    jest.setTimeout(10 * 60_000);
+    test('installs exact npm and registry artifacts into a fresh consumer and executes the dashboard/evidence contract', () => {
+        assertImmutableArtifacts(cliVersion, registryTag, registryCommit, registryRemote);
+        assertIssue87RegistryPin(registryTag);
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-published-doctor-'));
+        try {
+            const artifacts = path_1.default.join(root, 'artifacts');
+            const registry = path_1.default.join(root, 'registry');
+            const project = path_1.default.join(root, 'project');
+            const home = path_1.default.join(root, 'home');
+            fs_1.default.mkdirSync(project, { recursive: true });
+            fs_1.default.mkdirSync(home, { recursive: true });
+            expect(command(root, 'npm', ['install', '--prefix', artifacts, '--ignore-scripts', '--no-audit', '--no-fund', `agentic-workflow-manager@${cliVersion}`]).status).toBe(0);
+            expect(command(root, 'git', ['clone', '--depth', '1', '--branch', registryTag, registryRemote, registry]).status).toBe(0);
+            expect(command(registry, 'git', ['describe', '--exact-match', '--tags', 'HEAD']).stdout.trim()).toBe(registryTag);
+            expect(command(registry, 'git', ['rev-parse', 'HEAD']).stdout.trim()).toBe(registryCommit);
+            expect(command(registry, 'git', ['rev-parse', `${registryTag}^{}`]).stdout.trim()).toBe(registryCommit);
+            const cliRoot = path_1.default.join(artifacts, 'node_modules', 'agentic-workflow-manager');
+            expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(cliRoot, 'package.json'), 'utf8'))).toEqual(expect.objectContaining({ version: cliVersion }));
+            expect(fs_1.default.existsSync(path_1.default.join(cliRoot, 'dist', 'src', 'index.js'))).toBe(true);
+            const registryMetadata = JSON.parse(fs_1.default.readFileSync(path_1.default.join(registry, 'awm-registry.json'), 'utf8'));
+            const retro = fs_1.default.readFileSync(path_1.default.join(registry, 'skills', 'harness-retro', 'SKILL.md'), 'utf8');
+            assertRetroCaptureContract(registryMetadata, retro, cliVersion);
+            fs_1.default.writeFileSync(path_1.default.join(project, 'package.json'), JSON.stringify({ name: 'published-doctor-fixture', private: true }));
+            fs_1.default.writeFileSync(path_1.default.join(project, 'plan.md'), '# published evidence fixture\n');
+            expect(command(project, 'git', ['init']).status).toBe(0);
+            expect(command(project, 'git', ['config', 'user.email', 'published@example.invalid']).status).toBe(0);
+            expect(command(project, 'git', ['config', 'user.name', 'Published acceptance']).status).toBe(0);
+            expect(command(project, 'git', ['add', '.']).status).toBe(0);
+            expect(command(project, 'git', ['commit', '-m', 'fixture']).status).toBe(0);
+            const branch = command(project, 'git', ['branch', '--show-current']).stdout.trim();
+            expect(branch).not.toBe('');
+            expect(command(project, 'git', ['remote', 'add', 'origin', 'https://github.com/example/published-doctor-fixture.git']).status).toBe(0);
+            const env = { ...process.env, AWM_HOME: home, AWM_NO_UPDATE_CHECK: '1' };
+            const invoke = (...args) => command(project, process.execPath, [path_1.default.join(cliRoot, 'dist', 'src', 'index.js'), ...args], env);
+            expect([0, 1]).toContain(invoke('doctor').status);
+            const report = invoke('doctor', '--json');
+            expect([0, 1]).toContain(report.status);
+            expect(json(report)).toHaveProperty('providers');
+            expect([0, 1]).toContain(invoke('doctor', '--full').status);
+            const html = invoke('doctor', '--html', 'doctor.html');
+            expect([0, 1]).toContain(html.status);
+            expect(fs_1.default.readFileSync(path_1.default.join(project, 'doctor.html'), 'utf8')).toContain("script-src 'none'");
+            // Seed a completed durable journal using the downloaded package's own
+            // journal store: this stays on the published-artifact boundary while
+            // making capture exercise its real CLI path, not an injected helper.
+            const journalScript = [
+                `const store=require(${JSON.stringify(path_1.default.join(cliRoot, 'dist', 'src', 'core', 'journal', 'store.js'))});`,
+                'store.initJournal(process.argv[1], process.argv[2]);',
+                'const state=store.readJournal(process.argv[1], process.argv[2]).state;',
+                "state.cycle={...state.cycle,status:'COMPLETE',completedAt:'2026-08-22T10:00:01.000Z'};",
+                'store.writeJournal(process.argv[1], process.argv[2], state);',
+            ].join('');
+            expect(command(project, process.execPath, ['-e', journalScript, project, branch], env).status).toBe(0);
+            const capture = invoke('evidence', 'capture', '--plan', 'plan.md');
+            expect(capture.status).toBe(0);
+            expect(capture.stdout.trim()).toMatch(/^[a-f0-9]{64}$/);
+            expect(fs_1.default.existsSync(path_1.default.join(project, '.awm', 'evidence', 'cycles', `${capture.stdout.trim()}.json`))).toBe(true);
+            // The retrospective/ledger lifecycle happens after the durable
+            // observation, never instead of it.
+            expect(invoke('ledger', 'add', '--branch', branch, '--polarity', 'finding', '--class', 'quality', '--signature', 'published-retro-contract', '--severity', 'important', '--desc', 'published acceptance').status).toBe(0);
+            expect(invoke('ledger', 'archive', '--branch', branch).status).toBe(0);
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+});
+describe('published artifact provenance guard', () => {
+    test.each(['file:../cli', '../cli', 'latest', 'workspace:*', '8.4.0@latest'])('rejects mutable CLI reference %s', (version) => {
+        expect(() => assertImmutableArtifacts(version, 'v3.2.0', 'a'.repeat(40), registryRemote)).toThrow(/published CLI/i);
+    });
+    test.each(['main', 'HEAD', '', 'v3', 'refs/heads/main'])('rejects mutable registry ref %s', (tag) => {
+        expect(() => assertImmutableArtifacts('8.4.0', tag, 'a'.repeat(40), registryRemote)).toThrow(/registry ref/i);
+    });
+    test('rejects a short or retagged registry commit pin', () => {
+        expect(() => assertImmutableArtifacts('8.4.1', 'v3.4.0', 'deadbeef', registryRemote)).toThrow(/full immutable SHA/);
+        expect(() => assertImmutableArtifacts('8.4.1', 'v3.4.0', undefined, registryRemote)).toThrow(/full immutable SHA/);
+    });
+});
+describe('future registry retro capture contract', () => {
+    const metadata = { minCliVersion: '8.4.1' };
+    const contract = '1. awm evidence capture --plan docs/plan.md\n2. awm ledger archive\n';
+    test('requires the declared semver floor and capture-before-archive ordering', () => {
+        expect(() => assertRetroCaptureContract(metadata, contract, '8.4.1')).not.toThrow();
+        expect(() => assertRetroCaptureContract(metadata, contract, '8.4.0')).toThrow(/below registry minCliVersion/);
+    });
+    test('fails when minCliVersion is removed or retro ordering is swapped', () => {
+        expect(() => assertRetroCaptureContract({}, contract, '8.4.1')).toThrow(/minCliVersion/);
+        expect(() => assertRetroCaptureContract(metadata, 'awm ledger archive\nawm evidence capture', '8.4.1')).toThrow(/before archive/);
+    });
+    test('ignores comments and rejects duplicate or non-executable capture text', () => {
+        expect(() => assertRetroCaptureContract(metadata, '# awm evidence capture\nawm ledger archive', '8.4.1')).toThrow(/exactly one executable/);
+        expect(() => assertRetroCaptureContract(metadata, `${contract}awm evidence capture --plan again`, '8.4.1')).toThrow(/exactly one executable/);
+    });
+    test('rejects the prepublication CLI and a preceding registry pin', () => {
+        expect(() => assertRetroCaptureContract(metadata, contract, '8.4.0')).toThrow(/below registry minCliVersion/);
+        expect(() => assertIssue87RegistryPin('v3.2.0')).toThrow(/v3\.4\.0/);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "8.4.0",
+  "version": "8.5.0",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"