agentic-workflow-manager 8.4.0 → 8.5.1

package/dist/src/commands/evidence/index.js

@@ -0,0 +1,160 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerEvidenceCommand = registerEvidenceCommand;
+exports.runEvidenceCapture = runEvidenceCapture;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const capture_1 = require("../../core/evidence/capture");
+const store_1 = require("../../core/evidence/store");
+const store_2 = require("../../core/journal/store");
+const store_3 = require("../../core/ledger/store");
+const plan_state_1 = require("../../core/dashboard/plan-state");
+function assertRepoRelativePlan(value) {
+    if (typeof value !== 'string' || !value || value.startsWith('--') || path_1.default.isAbsolute(value)
+        || value.includes('\\') || value.split('/').some((part) => part === '' || part === '.' || part === '..')) {
+        throw new Error('--plan requires a repo-relative path');
+    }
+    return value;
+}
+function currentRelease(lines) {
+    const releases = lines.flatMap((line) => {
+        const match = /^\s*\d+\.\s+\*\*Release\s+([A-Za-z0-9][A-Za-z0-9_-]*)\s*\/\s*#\d+:\*\*/.exec(line);
+        return match ? [match[1]] : [];
+    });
+    return releases.length > 1 ? releases.at(-1) : undefined;
+}
+function marker(lines, name, release) {
+    const expression = new RegExp(`^\\s*<!--\\s*${name}(?:\\s*:\\s*[^\\r\\n]*?)?\\s*-->\\s*$`);
+    if (release === undefined)
+        return lines.some((line) => expression.test(line));
+    const releaseExpression = new RegExp(`\\bRelease\\s+${release.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\$&')}\\b`, 'i');
+    return lines.some((line) => expression.test(line) && releaseExpression.test(line));
+}
+/** Reads only structural lifecycle syntax; plan prose never crosses into evidence. */
+function planState(root, planPath, journal) {
+    const file = path_1.default.join(root, planPath);
+    const stat = fs_1.default.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error('--plan must reference a regular file');
+    let source;
+    try {
+        source = new TextDecoder('utf-8', { fatal: true }).decode(fs_1.default.readFileSync(file));
+    }
+    catch {
+        throw new Error('--plan must be valid UTF-8');
+    }
+    if (source.includes('\0'))
+        throw new Error('--plan must not contain NUL bytes');
+    let fenced = false;
+    let total = 0;
+    let completed = 0;
+    const visibleLines = [];
+    for (const line of source.split(/\r?\n/)) {
+        if (/^\s*(?:```|~~~)/.test(line)) {
+            fenced = !fenced;
+            continue;
+        }
+        if (fenced)
+            continue;
+        visibleLines.push(line);
+        if (!/^\s*[-*+]\s+\[/.test(line))
+            continue;
+        const candidate = /^\s*[-*+]\s+\[([^\]])\](?:\s+(.*))?$/.exec(line);
+        if (!candidate)
+            throw new Error('--plan contains an invalid checklist task');
+        if ((candidate[1] !== ' ' && candidate[1] !== 'x' && candidate[1] !== 'X') || !candidate[2]?.trim())
+            throw new Error('--plan contains an invalid checklist task');
+        total += 1;
+        if (candidate[1] === 'x' || candidate[1] === 'X')
+            completed += 1;
+    }
+    if (fenced)
+        throw new Error('--plan contains an unclosed fenced block');
+    const status = journal.cycle?.status;
+    if (status !== 'IN_PROGRESS' && status !== 'COMPLETE' && status !== 'BLOCKED')
+        throw new Error('journal cycle status is invalid');
+    const release = currentRelease(visibleLines);
+    return (0, plan_state_1.classifyPlanState)({
+        ...(status === 'IN_PROGRESS' ? { journal: { state: 'active' } } : status === 'BLOCKED' ? { journal: { state: 'blocked' } } : {}),
+        markers: { qaComplete: marker(visibleLines, 'awm-qa-complete', release), retroComplete: marker(visibleLines, 'awm-retro-complete', release) },
+        tasks: { total, completed },
+    });
+}
+function registerEvidenceCommand(program) {
+    const evidence = program.command('evidence').description('durable privacy-preserving cycle observations');
+    evidence.command('capture')
+        .description('capture one local cycle observation')
+        .option('--plan <path>', 'repo-relative plan path')
+        .option('--pr-provider <provider>', 'github | gitlab | other')
+        .option('--pr-number <number>', 'pull request number')
+        .action((opts) => {
+        const result = runEvidenceCapture(process.cwd(), opts.plan, { prProvider: opts.prProvider, prNumber: opts.prNumber });
+        if (result.code === 0)
+            process.stdout.write(result.stdout);
+        else {
+            process.stderr.write(`awm evidence capture: ${result.error}\n`);
+            process.exitCode = 2;
+        }
+    });
+}
+function firstEvaluationGates(state) {
+    return state.cycleVerificationPlan.map((gate) => {
+        if (gate.kind === 'review') {
+            const verdict = state.verdicts.filter((candidate) => candidate.obligationId === gate.id)
+                .sort((left, right) => left.receivedAt.localeCompare(right.receivedAt) || left.id.localeCompare(right.id))[0];
+            return { required: true, passed: verdict?.result === 'pass' };
+        }
+        const evaluated = Object.values(state.jobs).filter((job) => job.satisfies?.includes(gate.id));
+        const first = evaluated.filter((job) => job.attemptOf === undefined || !evaluated.some((candidate) => candidate.id === job.attemptOf))
+            .sort((left, right) => jobTimestamp(left).localeCompare(jobTimestamp(right)) || left.id.localeCompare(right.id))[0];
+        return { required: true, passed: first?.verdict === 'pass' };
+    });
+}
+function jobTimestamp(job) {
+    const timestamp = job.result?.endedAt ?? job.phaseTimestamps.received ?? job.phaseTimestamps.exited;
+    if (typeof timestamp !== 'string' || Number.isNaN(Date.parse(timestamp)))
+        throw new Error(`gate job ${job.id} lacks a durable evaluation timestamp`);
+    return timestamp;
+}
+function repositoryIdentity(root, supplied) {
+    if (supplied !== undefined) {
+        if (typeof supplied !== 'string' || !supplied || supplied.length > 4096 || /[\r\n]/.test(supplied))
+            throw new Error('repository identity is invalid');
+        return supplied;
+    }
+    try {
+        const remote = (0, child_process_1.execFileSync)('git', ['config', '--get', 'remote.origin.url'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 3000 }).trim();
+        if (!remote || remote.length > 4096 || /[\r\n]/.test(remote))
+            throw new Error('invalid');
+        return remote;
+    }
+    catch {
+        throw new Error('repository identity unavailable: configure remote.origin.url');
+    }
+}
+function runEvidenceCapture(root, plan, overrides) {
+    try {
+        const planPath = assertRepoRelativePlan(plan);
+        if (!fs_1.default.existsSync(path_1.default.join(root, planPath)))
+            throw new Error('--plan must reference an existing file');
+        const branch = (0, store_3.detectBranch)(root);
+        const read = overrides?.journal === undefined ? (0, store_2.readJournal)(root, branch) : { corrupt: false, state: overrides.journal };
+        if (read.corrupt || !read.state)
+            throw new Error('current journal is unavailable or corrupt');
+        let pr;
+        if (overrides?.prProvider !== undefined || overrides?.prNumber !== undefined) {
+            if (overrides.prProvider === undefined || overrides.prNumber === undefined || typeof overrides.prNumber !== 'string' || !/^\d+$/.test(overrides.prNumber))
+                throw new Error('--pr-provider and --pr-number must be supplied together');
+            pr = { provider: overrides.prProvider, number: Number(overrides.prNumber) };
+        }
+        const saved = (0, store_1.writeCycleEvidence)(root, (0, capture_1.captureCycleEvidence)({ root, repositoryIdentity: repositoryIdentity(root, overrides?.repositoryIdentity), planPath, journal: read.state, gates: firstEvaluationGates(read.state), ledger: overrides?.ledger ?? (0, store_3.listEntries)(root, branch), pr, planState: planState(root, planPath, read.state) }));
+        return { code: 0, stdout: `${saved.cycleId}\n` };
+    }
+    catch (error) {
+        return { code: 2, stdout: '', error: error.message };
+    }
+}

package/dist/src/core/dashboard/collect.js

@@ -1,9 +1,19 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.REMEDIATION_BY_FINDING_ID = void 0;
 exports.productionDashboardAdapters = productionDashboardAdapters;
 exports.collectDashboardSnapshot = collectDashboardSnapshot;
 const profile_1 = require("../profile");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const history_1 = require("../evidence/history");
+const types_1 = require("../evidence/types");
+const store_1 = require("../ledger/store");
+const paths_1 = require("../journal/paths");
+const store_2 = require("../journal/store");
 const sanitize_1 = require("./sanitize");
 const validate_1 = require("./validate");
 const plan_state_1 = require("./plan-state");
@@ -16,6 +26,7 @@ exports.REMEDIATION_BY_FINDING_ID = {
     'planning.source.unavailable': 'awm preflight',
     'execution.source.unavailable': 'awm sensors status',
 };
+const BLOCKED_CYCLE_REMEDIATION = 'awm preflight';
 const EMPTY_ADAPTERS = {
     machine: () => ({ findings: [] }), project: () => ({ findings: [] }), plans: () => [], execution: () => undefined,
 };
@@ -77,8 +88,88 @@ function productionDashboardAdapters(context) {
     return {
         machine: () => ({ findings: machineFindings }),
         project: () => ({ label: 'Project detected', findings: projectFindings }),
-        plans: () => [],
-        execution: () => undefined,
+        plans: ({ root }) => {
+            const history = readEvidenceHistory(root);
+            const journal = readJournalOverlay(root);
+            const latestCycleId = history.cycles.at(-1)?.cycleId;
+            const latestByPlan = new Map();
+            for (const cycle of history.cycles)
+                latestByPlan.set(cycle.plan.ref, cycle);
+            if (latestByPlan.size === 0 && journal)
+                return [journalPlanFinding(journal)];
+            return [...latestByPlan.values()].map((cycle) => {
+                const overlay = cycle.cycleId === latestCycleId ? journal : undefined;
+                const blocked = overlay?.state === 'blocked' || cycle.plan.state === 'blocked';
+                return {
+                    id: `planning.cycle.${cycle.cycleId}`,
+                    // The plan reference is intentionally never rendered: a plan path
+                    // can expose repository-specific names. Its opaque cycle ID gives
+                    // the dashboard deterministic identity without exporting it.
+                    label: 'Project context',
+                    state: blocked ? 'attention' : 'ok',
+                    ...(blocked ? { remediation: BLOCKED_CYCLE_REMEDIATION, remediationVerified: true } : {}),
+                    lifecycle: overlay ? lifecycleForJournal(overlay) : lifecycleForCycle(cycle),
+                };
+            });
+        },
+        execution: ({ root }) => {
+            const journal = readJournalOverlay(root);
+            if (!evidenceDirectoryExists(root))
+                return journal ? journalExecutionFinding(journal) : undefined;
+            const history = readEvidenceHistory(root);
+            if (history.cycles.length === 0)
+                return journal ? journalExecutionFinding(journal) : undefined;
+            return {
+                execution: history.cycles.map((cycle) => cycleFinding('execution', 'Static preflight', cycle, cycle.cycleState === 'blocked')),
+                qa: history.cycles.map((cycle) => cycleFinding('qa', 'Sensors', cycle, cycle.qa.fixes < cycle.qa.findings)),
+                retro: history.cycles.map((cycle) => cycleFinding('retro', 'Project context', cycle, cycle.plan.state !== 'executed')),
+            };
+        },
+    };
+}
+/** A journal has no durable plan reference. Use a generic fixed row so its
+ * authoritative lifecycle remains visible without publishing branch or path. */
+function journalPlanFinding(overlay) {
+    const blocked = overlay.state === 'blocked';
+    return {
+        id: 'planning.current-journal', label: 'Project context', state: blocked ? 'attention' : 'ok',
+        ...(blocked ? { remediation: BLOCKED_CYCLE_REMEDIATION, remediationVerified: true } : {}),
+        lifecycle: lifecycleForJournal(overlay),
+    };
+}
+function journalExecutionFinding(overlay) {
+    const blocked = overlay.state === 'blocked';
+    return {
+        execution: [{
+                id: 'execution.current-journal', label: 'Static preflight', state: blocked ? 'attention' : 'ok',
+                ...(blocked ? { remediation: BLOCKED_CYCLE_REMEDIATION, remediationVerified: true } : {}),
+            }],
+        qa: [], retro: [],
+    };
+}
+function lifecycleForJournal(overlay) {
+    return { journal: { state: overlay.state }, markers: { qaComplete: false, retroComplete: false }, tasks: overlay.tasks };
+}
+function lifecycleForCycle(cycle) {
+    const total = cycle.tasks.length;
+    if (cycle.plan.state === 'blocked' || cycle.cycleState === 'blocked')
+        return { journal: { state: 'blocked' }, markers: { qaComplete: false, retroComplete: false }, tasks: { total, completed: 0 } };
+    if (cycle.plan.state === 'active')
+        return { journal: { state: 'active' }, markers: { qaComplete: false, retroComplete: false }, tasks: { total, completed: 0 } };
+    if (cycle.plan.state === 'executed')
+        return { markers: { qaComplete: true, retroComplete: true }, tasks: { total, completed: total } };
+    if (cycle.plan.state === 'retro_pending')
+        return { markers: { qaComplete: true, retroComplete: false }, tasks: { total, completed: total } };
+    if (cycle.plan.state === 'qa_pending')
+        return { markers: { qaComplete: false, retroComplete: false }, tasks: { total, completed: total } };
+    return { markers: { qaComplete: false, retroComplete: false }, tasks: { total: 0, completed: 0 } };
+}
+function cycleFinding(section, label, cycle, actionable) {
+    return {
+        id: `${section}.cycle.${cycle.cycleId}`,
+        label,
+        state: actionable ? 'attention' : 'ok',
+        ...(actionable ? { remediation: BLOCKED_CYCLE_REMEDIATION, remediationVerified: true } : {}),
     };
 }
 function findings(items, optional = false) {
@@ -118,6 +209,111 @@ function canonicalOptionalFailure(failure) {
         return [];
     return [{ id: failure.findingId, label: 'Optional source unavailable', state: 'unavailable', remediation: exports.REMEDIATION_BY_FINDING_ID[failure.findingId] }];
 }
+function evidenceDirectoryExists(root) {
+    try {
+        return fs_1.default.lstatSync(path_1.default.join(root, '.awm', 'evidence', 'cycles')).isDirectory();
+    }
+    catch (error) {
+        if (error && typeof error === 'object' && error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+/** Reads only the current branch journal. Missing journals are not observations;
+ * corrupt or redirected journal paths fail closed rather than changing lifecycle
+ * state from untrusted content. */
+function readJournalOverlay(root) {
+    const branch = (0, store_1.detectBranch)(root);
+    const file = (0, paths_1.statePath)(root, branch);
+    if (!safeJournalStateExists(root, branch, file))
+        return undefined;
+    const journal = (0, store_2.readJournal)(root, branch);
+    if (journal.corrupt || !journal.state)
+        throw new Error('current journal is unavailable or corrupt');
+    if (journal.state.cycle.status === 'COMPLETE')
+        return undefined;
+    return {
+        state: journal.state.cycle.status === 'BLOCKED' ? 'blocked' : 'active',
+        tasks: { total: journal.state.tasks.length, completed: journal.state.tasks.filter((task) => task.status === 'done').length },
+    };
+}
+function safeJournalStateExists(root, branch, file) {
+    for (const directory of [path_1.default.join(root, '.awm'), path_1.default.join(root, '.awm', 'journal'), (0, paths_1.journalDir)(root, branch)]) {
+        let stat;
+        try {
+            stat = fs_1.default.lstatSync(directory);
+        }
+        catch (error) {
+            if (error && typeof error === 'object' && error.code === 'ENOENT')
+                return false;
+            throw error;
+        }
+        if (stat.isSymbolicLink() || !stat.isDirectory())
+            throw new Error('journal directory is unsafe');
+    }
+    let stat;
+    try {
+        stat = fs_1.default.lstatSync(file);
+    }
+    catch (error) {
+        if (error && typeof error === 'object' && error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+    if (stat.isSymbolicLink() || !stat.isFile())
+        throw new Error('journal state is unsafe');
+    return true;
+}
+function readEvidenceHistory(root) {
+    const awmDirectory = path_1.default.join(root, '.awm');
+    const evidenceDirectory = path_1.default.join(awmDirectory, 'evidence');
+    const directory = path_1.default.join(evidenceDirectory, 'cycles');
+    for (const ancestor of [awmDirectory, evidenceDirectory, directory]) {
+        let stat;
+        try {
+            stat = fs_1.default.lstatSync(ancestor);
+        }
+        catch (error) {
+            if (error && typeof error === 'object' && error.code === 'ENOENT')
+                return (0, history_1.buildEvidenceHistory)([]);
+            throw error;
+        }
+        if (stat.isSymbolicLink() || !stat.isDirectory())
+            throw new Error('evidence history directory is unsafe');
+    }
+    const seenCycleIds = new Set();
+    const records = fs_1.default.readdirSync(directory, { withFileTypes: true })
+        .sort((left, right) => left.name.localeCompare(right.name))
+        .map((entry) => {
+        if (!entry.isFile() || !entry.name.endsWith('.json'))
+            throw new Error('evidence history contains an unsupported entry');
+        const file = path_1.default.join(directory, entry.name);
+        if (fs_1.default.lstatSync(file).isSymbolicLink())
+            throw new Error('evidence history file is unsafe');
+        const evidence = (0, types_1.validateCycleEvidence)(JSON.parse(fs_1.default.readFileSync(file, 'utf8')));
+        if (entry.name !== `${evidence.cycleId}.json` || seenCycleIds.has(evidence.cycleId))
+            throw new Error('evidence history filename is invalid');
+        seenCycleIds.add(evidence.cycleId);
+        return evidence;
+    });
+    return (0, history_1.buildEvidenceHistory)(records);
+}
+function evidenceHistoryItems(root) {
+    const history = readEvidenceHistory(root);
+    return {
+        confidence: history.confidence,
+        items: history.cycles.map((cycle) => {
+            const cures = cycle.cureEfficacy.length === 0 ? 'none' : cycle.cureEfficacy.map((cure) => cure.efficacy).join(', ');
+            return {
+                id: `history.cycle.${cycle.cycleId}`,
+                label: `Cycle ${cycle.cycleId.slice(0, 12)}`,
+                state: cycle.cycleState === 'blocked' ? 'attention' : 'ok',
+                ...(cycle.cycleState === 'blocked' ? { remediation: BLOCKED_CYCLE_REMEDIATION } : {}),
+                detail: `plan ${cycle.plan.state}; tasks ${cycle.tasks.length}; retries ${cycle.retries}; QA ${cycle.qa.findings}/${cycle.qa.fixes}; first-pass ${cycle.gates.firstPass ? 'yes' : 'no'}; cures ${cures}`,
+            };
+        }),
+    };
+}
 function isolatedFindings(items) {
     return optional(() => findings(items, true));
 }
@@ -150,7 +346,7 @@ function collectDashboardSnapshot(options) {
     const executionItems = isolatedFindings(execution?.execution);
     const qaItems = isolatedFindings(execution?.qa);
     const retroItems = isolatedFindings(execution?.retro);
-    const historyItems = isolatedFindings(execution?.history);
+    const evidenceResult = optional(() => evidenceHistoryItems(root));
     const executionUnavailable = !executionResult.failed && execution === undefined;
     const sections = [
         machineSection,
@@ -163,8 +359,8 @@ function collectDashboardSnapshot(options) {
         // absent execution source is not evidence of a successful empty cycle.
         section('qa', executionResult.failed || executionUnavailable || qaItems.failed ? 'unavailable' : 'available', qaItems.value),
         section('retro', executionResult.failed || executionUnavailable || retroItems.failed ? 'unavailable' : 'available', retroItems.value),
-        section('history', executionResult.failed || executionUnavailable || historyItems.failed ? 'unavailable' : 'available', historyItems.value),
+        section('history', evidenceResult.failed ? 'unavailable' : 'available', evidenceResult.failed ? [] : evidenceResult.value.items),
     ];
     const degraded = sections.some((entry) => entry.availability === 'unavailable' || entry.items.some((item) => item.state !== 'ok' && item.state !== 'not_applicable'));
-    return (0, validate_1.validateDashboardSnapshotV1)({ schema: 1, generatedAt: options.now, overall: degraded ? 'degraded' : 'healthy', project: { detected: true, label: projectSource?.label || 'Project detected' }, confidence: 'provisional', sections });
+    return (0, validate_1.validateDashboardSnapshotV1)({ schema: 1, generatedAt: options.now, overall: degraded ? 'degraded' : 'healthy', project: { detected: true, label: projectSource?.label || 'Project detected' }, confidence: evidenceResult.failed ? 'none' : evidenceResult.value.confidence, sections });
 }

package/dist/src/core/dashboard/render-html.js

@@ -45,8 +45,14 @@ function projectHeaderActions() {
 function projectChrome(project) {
     return `<div class="project-chrome"><p class="eyebrow" data-project-breadcrumb>AWM / Proyecto / ${project}</p><nav data-project-nav aria-label="Project navigation"><span aria-current="page">Proyecto</span><span>Ejecución</span><span>Configuración</span></nav></div>`;
 }
-function projectEvidenceComposition() {
-    return `<div data-project-evidence role="group" aria-labelledby="project-evidence-heading"><h3 id="project-evidence-heading" class="sr-only">Project evidence</h3><div class="evidence-grid compact-composition"><div><h3>Planes de trabajo</h3><div class="plan-card active" data-plan-card="active"><div><strong>Plan activo</strong><span class="state attention">Sin observación</span></div><p>Progreso: sin observación</p><button type="button" disabled aria-describedby="static-controls-note">Ver plan (estático)</button></div><div class="plan-card blocked" data-plan-card="blocked"><div><strong>Plan bloqueado</strong><span class="state unavailable">Sin observación</span></div><p>Progreso: sin observación</p><button type="button" disabled aria-describedby="static-controls-note">Ver plan (estático)</button></div></div><div><h3>Impacto y trazabilidad</h3><table class="evidence-table"><thead><tr><th scope="col">Tipo</th><th scope="col">Fuente</th><th scope="col">Estado</th><th scope="col">Fecha</th></tr></thead><tbody><tr><td colspan="4" class="empty">No hay evidencia de impacto disponible en este snapshot.</td></tr></tbody></table></div></div><div class="closure-actions" data-closure-actions role="group" aria-labelledby="closure-actions-heading"><div><h3 id="closure-actions-heading">Qué falta para cerrar el ciclo</h3><p class="empty">La ausencia de marcador no equivale a cero hallazgos.</p></div><div><button type="button" disabled aria-describedby="static-controls-note">Completar QA (estático)</button><button type="button" disabled aria-describedby="static-controls-note">Registrar retro (estático)</button><button type="button" disabled aria-describedby="static-controls-note">Adjuntar evidencia (estático)</button></div></div></div>`;
+function projectEvidenceComposition(snapshot) {
+    const planning = snapshot.sections.find((section) => section.id === 'planning')?.items ?? [];
+    const history = snapshot.sections.find((section) => section.id === 'history')?.items ?? [];
+    const planCards = planning.length === 0
+        ? `<div class="plan-card active" data-plan-card="active"><div><strong>Plan activo</strong><span class="state attention">Sin observación</span></div><p>Progreso: sin observación</p><button type="button" disabled aria-describedby="static-controls-note">Ver plan (estático)</button></div><div class="plan-card blocked" data-plan-card="blocked"><div><strong>Plan bloqueado</strong><span class="state unavailable">Sin observación</span></div><p>Progreso: sin observación</p><button type="button" disabled aria-describedby="static-controls-note">Ver plan (estático)</button></div>`
+        : planning.map((plan) => `<div class="plan-card ${plan.detail === 'blocked' ? 'blocked' : 'active'}" data-plan-card="${plan.detail === 'blocked' ? 'blocked' : 'active'}"><div><strong>${escapeHtml(plan.label)}</strong><span class="state ${plan.state}">${STATE_GLYPH[plan.state]} ${STATE_TEXT[plan.state]}</span></div><p>Estado: ${escapeHtml(plan.detail ?? 'sin observación')}</p><button type="button" disabled aria-describedby="static-controls-note">Ver plan (estático)</button></div>`).join('');
+    const evidenceRows = history.length === 0 ? '<tr><td colspan="4" class="empty">No hay evidencia de impacto disponible en este snapshot.</td></tr>' : history.map((item) => `<tr><td>ciclo</td><td>${escapeHtml(item.label)}</td><td><span class="state ${item.state}">${STATE_GLYPH[item.state]} ${STATE_TEXT[item.state]}</span><br>${escapeHtml(item.detail ?? '—')}</td><td>—</td></tr>`).join('');
+    return `<div data-project-evidence role="group" aria-labelledby="project-evidence-heading"><h3 id="project-evidence-heading" class="sr-only">Project evidence</h3><div class="evidence-grid compact-composition"><div><h3>Planes de trabajo</h3>${planCards}</div><div><h3>Impacto y trazabilidad</h3><table class="evidence-table"><thead><tr><th scope="col">Tipo</th><th scope="col">Fuente</th><th scope="col">Estado</th><th scope="col">Fecha</th></tr></thead><tbody>${evidenceRows}</tbody></table></div></div><div class="closure-actions" data-closure-actions role="group" aria-labelledby="closure-actions-heading"><div><h3 id="closure-actions-heading">Qué falta para cerrar el ciclo</h3><p class="empty">La ausencia de marcador no equivale a cero hallazgos.</p></div><div><button type="button" disabled aria-describedby="static-controls-note">Completar QA (estático)</button><button type="button" disabled aria-describedby="static-controls-note">Registrar retro (estático)</button><button type="button" disabled aria-describedby="static-controls-note">Adjuntar evidencia (estático)</button></div></div></div>`;
 }
 function projectComposition(snapshot) {
     const stageSections = ['planning', 'execution', 'qa', 'retro', 'history'];
@@ -62,7 +68,7 @@ function projectComposition(snapshot) {
     const prepNames = ['installation', 'sensors', 'persistence'];
     const preparation = `<div class="machine-preparation-strip" data-machine-preparation role="group" aria-labelledby="machine-preparation-heading"><h3 id="machine-preparation-heading">Preparación de máquina</h3><ul class="diagnostic-grid">${prepNames.map((name, index) => { const item = prepItems[index]; return `<li data-machine-preparation-card="${name}">${item ? `<span class="state ${item.state}">${STATE_GLYPH[item.state]} ${STATE_TEXT[item.state]}</span><strong>${escapeHtml(item.label)}</strong><span>${item.detail ? escapeHtml(item.detail) : 'Sin detalle adicional'}</span>` : '<span class="state unavailable">⊘ Unavailable</span><strong>Sin observación</strong><span>Fuente no disponible</span>'}</li>`; }).join('')}</ul></div>`;
     const machineSupplement = `${preparation}<nav class="lifecycle-timeline" data-lifecycle-timeline aria-labelledby="lifecycle-timeline-heading"><h3 id="lifecycle-timeline-heading">Línea de ciclo</h3><ol class="timeline connected-timeline">${stages}</ol></nav>${provisional}`;
-    const historySupplement = projectEvidenceComposition();
+    const historySupplement = projectEvidenceComposition(snapshot);
     return snapshot.sections.map((section) => sectionHtml(section, section.id === 'machine' ? machineSupplement : section.id === 'history' ? historySupplement : '')).join('');
 }
 /** Renders a portable, static, share-safe dashboard document. */

package/dist/src/core/dashboard/render-terminal.js

@@ -28,6 +28,8 @@ function renderFullTerminal(input) {
     ];
     for (const section of snapshot.sections) {
         lines.push('', SECTION_TITLES[section.id]);
+        if (section.id === 'history')
+            lines.push(`  Eligible evidence rows: ${section.items.length}`);
         if (section.availability !== 'available')
             lines.push(`  ⊘ source ${section.availability.replace('_', ' ')}`);
         if (section.items.length === 0)

package/dist/src/core/evidence/capture.js

@@ -0,0 +1,66 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.captureCycleEvidence = captureCycleEvidence;
+const crypto_1 = __importDefault(require("crypto"));
+const types_1 = require("./types");
+const hash = (value) => crypto_1.default.createHash('sha256').update(value).digest('hex');
+const object = (value, name) => { if (!value || typeof value !== 'object' || Array.isArray(value))
+    throw new Error(`${name} must be an object`); return value; };
+const iso = (value, name) => { if (typeof value !== 'string' || Number.isNaN(Date.parse(value)))
+    throw new Error(`${name} must be an ISO timestamp`); return value; };
+const nonNegative = (value, name) => { if (!Number.isSafeInteger(value) || value < 0)
+    throw new Error(`${name} must be a non-negative integer`); return value; };
+function captureCycleEvidence(input) {
+    if (!input || typeof input.root !== 'string' || !input.root)
+        throw new Error('capture root is required');
+    if (typeof input.repositoryIdentity !== 'string' || input.repositoryIdentity.length === 0 || input.repositoryIdentity.length > 4096 || /[\r\n]/.test(input.repositoryIdentity))
+        throw new Error('repository identity is invalid');
+    const repositoryIdentity = hash(input.repositoryIdentity);
+    if (typeof input.planPath !== 'string' || !input.planPath)
+        throw new Error('capture planPath is required');
+    const journal = object(input.journal, 'journal');
+    const cycle = object(journal.cycle, 'journal cycle');
+    const startedAt = iso(cycle.startedAt, 'cycle startedAt');
+    const endedAt = iso(cycle.completedAt ?? journal.controllerHeartbeatAt, 'cycle endedAt');
+    if (cycle.status !== 'COMPLETE' && cycle.status !== 'BLOCKED')
+        throw new Error('journal cycle must be complete or blocked');
+    if (!Array.isArray(journal.tasks) || !Array.isArray(journal.verdicts) || !Array.isArray(journal.fixes) || !Array.isArray(input.gates) || !Array.isArray(input.ledger))
+        throw new Error('capture sources are invalid');
+    const tasks = journal.tasks.map((item, index) => { const task = object(item, `task ${index}`); if (typeof task.id !== 'string')
+        throw new Error('task id is invalid'); const attempts = nonNegative(task.attempts, 'task attempts'); return { id: task.id, attempts, retries: Math.max(attempts - 1, 0) }; });
+    const verdictIds = new Set();
+    const adverseVerdictIds = new Set();
+    const adverseVerdicts = journal.verdicts.filter((item, index) => {
+        const verdict = object(item, `verdict ${index}`);
+        if (typeof verdict.id !== 'string' || !verdict.id)
+            throw new Error('verdict id is invalid');
+        if (verdictIds.has(verdict.id))
+            throw new Error('verdict id is duplicated');
+        verdictIds.add(verdict.id);
+        if (verdict.result !== 'pass' && verdict.result !== 'fail' && verdict.result !== 'inconclusive')
+            throw new Error('verdict result is invalid');
+        iso(verdict.receivedAt, 'verdict receivedAt');
+        if (verdict.result !== 'pass')
+            adverseVerdictIds.add(verdict.id);
+        return verdict.result !== 'pass';
+    });
+    const signatures = adverseVerdicts.map((item) => { const verdict = object(item, 'verdict'); if (typeof verdict.fingerprint !== 'string' || !verdict.fingerprint)
+        throw new Error('verdict fingerprint is required'); return hash(`signature:${verdict.fingerprint}`); });
+    const fixes = journal.fixes.filter((item, index) => {
+        const fix = object(item, `fix ${index}`);
+        if (typeof fix.closed !== 'boolean')
+            throw new Error('fix closed is invalid');
+        if (typeof fix.verdictId !== 'string' || !fix.verdictId || !adverseVerdictIds.has(fix.verdictId))
+            throw new Error('fix verdictId must reference an adverse verdict');
+        return fix.closed;
+    }).length;
+    const gates = input.gates.map((item, index) => { const gate = object(item, `gate ${index}`); if (typeof gate.required !== 'boolean' || typeof gate.passed !== 'boolean')
+        throw new Error('gate is invalid'); return gate; }).filter((gate) => gate.required === true);
+    const cures = input.ledger.filter((item, index) => { const entry = object(item, `ledger ${index}`); if (typeof entry.signature !== 'string' || (entry.polarity !== 'finding' && entry.polarity !== 'win'))
+        throw new Error('ledger entry is invalid'); iso(entry.ts, 'ledger timestamp'); return entry.polarity === 'win'; }).map((entry) => { const source = object(entry, 'ledger'); return { signature: hash(`signature:${source.signature}`), curedAt: iso(source.ts, 'ledger timestamp') }; });
+    const pr = input.pr === undefined ? undefined : (() => { const raw = object(input.pr, 'pr'); return { provider: raw.provider, number: raw.number }; })();
+    return (0, types_1.validateCycleEvidence)({ schema: 1, cycleId: hash(`${repositoryIdentity}\0${input.planPath}\0${startedAt}`), startedAt, endedAt, durationMs: Date.parse(endedAt) - Date.parse(startedAt), cycleState: cycle.status === 'COMPLETE' ? 'completed' : 'blocked', plan: { ref: input.planPath, state: input.planState ?? (cycle.status === 'BLOCKED' ? 'blocked' : 'executed') }, tasks, qa: { findings: signatures.length, fixes: Math.min(fixes, signatures.length), signatures }, gates: { required: gates.length, firstEvaluationsPassed: gates.map((gate) => gate.passed), firstPass: gates.every((gate) => gate.passed === true) }, cures, ...(pr ? { pr } : {}) });
+}

package/dist/src/core/evidence/history.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.confidenceForCycles = confidenceForCycles;
+exports.classifyCure = classifyCure;
+exports.buildEvidenceHistory = buildEvidenceHistory;
+const types_1 = require("./types");
+function confidenceForCycles(count) {
+    if (!Number.isSafeInteger(count) || count < 0)
+        throw new Error('eligible cycle count must be a non-negative integer');
+    const eligibleCycles = count;
+    if (eligibleCycles === 0)
+        return 'none';
+    if (eligibleCycles === 1)
+        return 'provisional';
+    if (eligibleCycles < 5)
+        return 'observing';
+    return 'supported';
+}
+function classifyCure(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        throw new Error('cure observation must be an object');
+    const value = input;
+    if (Object.keys(value).some((key) => key !== 'laterEligibleCycles' && key !== 'recurred') || !Number.isSafeInteger(value.laterEligibleCycles) || value.laterEligibleCycles < 0 || typeof value.recurred !== 'boolean')
+        throw new Error('cure observation is invalid');
+    const laterEligibleCycles = value.laterEligibleCycles;
+    if (value.recurred)
+        return 'recurred';
+    if (laterEligibleCycles === 0)
+        return 'awaiting_observation';
+    return laterEligibleCycles >= 3 ? 'supported' : 'observing';
+}
+/** Validates, retains, and deterministically orders every eligible local observation. */
+function buildEvidenceHistory(records) {
+    if (!Array.isArray(records))
+        throw new Error('evidence history records must be an array');
+    const valid = records.map((record) => (0, types_1.validateCycleEvidence)(record)).sort((left, right) => left.startedAt.localeCompare(right.startedAt) || left.cycleId.localeCompare(right.cycleId));
+    const completed = valid.filter((cycle) => cycle.cycleState === 'completed');
+    const cycles = valid.map((cycle, index) => ({
+        ...cycle,
+        retries: cycle.tasks.reduce((total, task) => total + task.retries, 0),
+        cureEfficacy: cycle.cures.map((cure) => {
+            const later = valid.slice(index + 1).filter((candidate) => candidate.cycleState === 'completed');
+            return {
+                signature: cure.signature,
+                efficacy: classifyCure({ laterEligibleCycles: later.length, recurred: later.some((candidate) => candidate.qa.signatures.includes(cure.signature)) }),
+            };
+        }),
+    }));
+    return { confidence: confidenceForCycles(completed.length), empty: cycles.length === 0, cycles };
+}

package/dist/src/core/evidence/store.js

@@ -0,0 +1,32 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeCycleEvidence = writeCycleEvidence;
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+const atomic_file_1 = require("../atomic-file");
+const types_1 = require("./types");
+function writeCycleEvidence(root, evidence) {
+    if (typeof root !== 'string' || root.length === 0)
+        throw new Error('evidence root must be a non-empty string');
+    const valid = (0, types_1.validateCycleEvidence)(evidence);
+    const safeRoot = safeDirectory(root, 'root');
+    let directory = safeRoot;
+    for (const segment of ['.awm', 'evidence', 'cycles']) {
+        directory = path_1.default.join(directory, segment);
+        if (!fs_1.default.existsSync(directory))
+            fs_1.default.mkdirSync(directory, { mode: 0o700 });
+        directory = safeDirectory(directory, `evidence ${segment}`);
+    }
+    const file = path_1.default.join(directory, `${valid.cycleId}.json`);
+    (0, atomic_file_1.writeFileAtomicDurable)(file, JSON.stringify(valid, null, 2) + '\n', 0o600);
+    return valid;
+}
+function safeDirectory(directory, label) {
+    const stat = fs_1.default.lstatSync(directory);
+    if (stat.isSymbolicLink() || !stat.isDirectory())
+        throw new Error(`unsafe evidence ${label} directory symlink or non-directory`);
+    return fs_1.default.realpathSync(directory);
+}