agentic-workflow-manager 8.5.0 → 8.5.1

package/dist/src/commands/evidence/index.js

@@ -12,6 +12,7 @@ const capture_1 = require("../../core/evidence/capture");
 const store_1 = require("../../core/evidence/store");
 const store_2 = require("../../core/journal/store");
 const store_3 = require("../../core/ledger/store");
+const plan_state_1 = require("../../core/dashboard/plan-state");
 function assertRepoRelativePlan(value) {
     if (typeof value !== 'string' || !value || value.startsWith('--') || path_1.default.isAbsolute(value)
         || value.includes('\\') || value.split('/').some((part) => part === '' || part === '.' || part === '..')) {
@@ -19,6 +20,70 @@ function assertRepoRelativePlan(value) {
     }
     return value;
 }
+function currentRelease(lines) {
+    const releases = lines.flatMap((line) => {
+        const match = /^\s*\d+\.\s+\*\*Release\s+([A-Za-z0-9][A-Za-z0-9_-]*)\s*\/\s*#\d+:\*\*/.exec(line);
+        return match ? [match[1]] : [];
+    });
+    return releases.length > 1 ? releases.at(-1) : undefined;
+}
+function marker(lines, name, release) {
+    const expression = new RegExp(`^\\s*<!--\\s*${name}(?:\\s*:\\s*[^\\r\\n]*?)?\\s*-->\\s*$`);
+    if (release === undefined)
+        return lines.some((line) => expression.test(line));
+    const releaseExpression = new RegExp(`\\bRelease\\s+${release.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\$&')}\\b`, 'i');
+    return lines.some((line) => expression.test(line) && releaseExpression.test(line));
+}
+/** Reads only structural lifecycle syntax; plan prose never crosses into evidence. */
+function planState(root, planPath, journal) {
+    const file = path_1.default.join(root, planPath);
+    const stat = fs_1.default.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error('--plan must reference a regular file');
+    let source;
+    try {
+        source = new TextDecoder('utf-8', { fatal: true }).decode(fs_1.default.readFileSync(file));
+    }
+    catch {
+        throw new Error('--plan must be valid UTF-8');
+    }
+    if (source.includes('\0'))
+        throw new Error('--plan must not contain NUL bytes');
+    let fenced = false;
+    let total = 0;
+    let completed = 0;
+    const visibleLines = [];
+    for (const line of source.split(/\r?\n/)) {
+        if (/^\s*(?:```|~~~)/.test(line)) {
+            fenced = !fenced;
+            continue;
+        }
+        if (fenced)
+            continue;
+        visibleLines.push(line);
+        if (!/^\s*[-*+]\s+\[/.test(line))
+            continue;
+        const candidate = /^\s*[-*+]\s+\[([^\]])\](?:\s+(.*))?$/.exec(line);
+        if (!candidate)
+            throw new Error('--plan contains an invalid checklist task');
+        if ((candidate[1] !== ' ' && candidate[1] !== 'x' && candidate[1] !== 'X') || !candidate[2]?.trim())
+            throw new Error('--plan contains an invalid checklist task');
+        total += 1;
+        if (candidate[1] === 'x' || candidate[1] === 'X')
+            completed += 1;
+    }
+    if (fenced)
+        throw new Error('--plan contains an unclosed fenced block');
+    const status = journal.cycle?.status;
+    if (status !== 'IN_PROGRESS' && status !== 'COMPLETE' && status !== 'BLOCKED')
+        throw new Error('journal cycle status is invalid');
+    const release = currentRelease(visibleLines);
+    return (0, plan_state_1.classifyPlanState)({
+        ...(status === 'IN_PROGRESS' ? { journal: { state: 'active' } } : status === 'BLOCKED' ? { journal: { state: 'blocked' } } : {}),
+        markers: { qaComplete: marker(visibleLines, 'awm-qa-complete', release), retroComplete: marker(visibleLines, 'awm-retro-complete', release) },
+        tasks: { total, completed },
+    });
+}
 function registerEvidenceCommand(program) {
     const evidence = program.command('evidence').description('durable privacy-preserving cycle observations');
     evidence.command('capture')
@@ -86,7 +151,7 @@ function runEvidenceCapture(root, plan, overrides) {
                 throw new Error('--pr-provider and --pr-number must be supplied together');
             pr = { provider: overrides.prProvider, number: Number(overrides.prNumber) };
         }
-        const saved = (0, store_1.writeCycleEvidence)(root, (0, capture_1.captureCycleEvidence)({ root, repositoryIdentity: repositoryIdentity(root, overrides?.repositoryIdentity), planPath, journal: read.state, gates: firstEvaluationGates(read.state), ledger: overrides?.ledger ?? (0, store_3.listEntries)(root, branch), pr }));
+        const saved = (0, store_1.writeCycleEvidence)(root, (0, capture_1.captureCycleEvidence)({ root, repositoryIdentity: repositoryIdentity(root, overrides?.repositoryIdentity), planPath, journal: read.state, gates: firstEvaluationGates(read.state), ledger: overrides?.ledger ?? (0, store_3.listEntries)(root, branch), pr, planState: planState(root, planPath, read.state) }));
         return { code: 0, stdout: `${saved.cycleId}\n` };
     }
     catch (error) {

package/dist/src/core/dashboard/collect.js

@@ -11,6 +11,9 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const history_1 = require("../evidence/history");
 const types_1 = require("../evidence/types");
+const store_1 = require("../ledger/store");
+const paths_1 = require("../journal/paths");
+const store_2 = require("../journal/store");
 const sanitize_1 = require("./sanitize");
 const validate_1 = require("./validate");
 const plan_state_1 = require("./plan-state");
@@ -23,6 +26,7 @@ exports.REMEDIATION_BY_FINDING_ID = {
     'planning.source.unavailable': 'awm preflight',
     'execution.source.unavailable': 'awm sensors status',
 };
+const BLOCKED_CYCLE_REMEDIATION = 'awm preflight';
 const EMPTY_ADAPTERS = {
     machine: () => ({ findings: [] }), project: () => ({ findings: [] }), plans: () => [], execution: () => undefined,
 };
@@ -84,8 +88,88 @@ function productionDashboardAdapters(context) {
     return {
         machine: () => ({ findings: machineFindings }),
         project: () => ({ label: 'Project detected', findings: projectFindings }),
-        plans: () => [],
-        execution: () => undefined,
+        plans: ({ root }) => {
+            const history = readEvidenceHistory(root);
+            const journal = readJournalOverlay(root);
+            const latestCycleId = history.cycles.at(-1)?.cycleId;
+            const latestByPlan = new Map();
+            for (const cycle of history.cycles)
+                latestByPlan.set(cycle.plan.ref, cycle);
+            if (latestByPlan.size === 0 && journal)
+                return [journalPlanFinding(journal)];
+            return [...latestByPlan.values()].map((cycle) => {
+                const overlay = cycle.cycleId === latestCycleId ? journal : undefined;
+                const blocked = overlay?.state === 'blocked' || cycle.plan.state === 'blocked';
+                return {
+                    id: `planning.cycle.${cycle.cycleId}`,
+                    // The plan reference is intentionally never rendered: a plan path
+                    // can expose repository-specific names. Its opaque cycle ID gives
+                    // the dashboard deterministic identity without exporting it.
+                    label: 'Project context',
+                    state: blocked ? 'attention' : 'ok',
+                    ...(blocked ? { remediation: BLOCKED_CYCLE_REMEDIATION, remediationVerified: true } : {}),
+                    lifecycle: overlay ? lifecycleForJournal(overlay) : lifecycleForCycle(cycle),
+                };
+            });
+        },
+        execution: ({ root }) => {
+            const journal = readJournalOverlay(root);
+            if (!evidenceDirectoryExists(root))
+                return journal ? journalExecutionFinding(journal) : undefined;
+            const history = readEvidenceHistory(root);
+            if (history.cycles.length === 0)
+                return journal ? journalExecutionFinding(journal) : undefined;
+            return {
+                execution: history.cycles.map((cycle) => cycleFinding('execution', 'Static preflight', cycle, cycle.cycleState === 'blocked')),
+                qa: history.cycles.map((cycle) => cycleFinding('qa', 'Sensors', cycle, cycle.qa.fixes < cycle.qa.findings)),
+                retro: history.cycles.map((cycle) => cycleFinding('retro', 'Project context', cycle, cycle.plan.state !== 'executed')),
+            };
+        },
+    };
+}
+/** A journal has no durable plan reference. Use a generic fixed row so its
+ * authoritative lifecycle remains visible without publishing branch or path. */
+function journalPlanFinding(overlay) {
+    const blocked = overlay.state === 'blocked';
+    return {
+        id: 'planning.current-journal', label: 'Project context', state: blocked ? 'attention' : 'ok',
+        ...(blocked ? { remediation: BLOCKED_CYCLE_REMEDIATION, remediationVerified: true } : {}),
+        lifecycle: lifecycleForJournal(overlay),
+    };
+}
+function journalExecutionFinding(overlay) {
+    const blocked = overlay.state === 'blocked';
+    return {
+        execution: [{
+                id: 'execution.current-journal', label: 'Static preflight', state: blocked ? 'attention' : 'ok',
+                ...(blocked ? { remediation: BLOCKED_CYCLE_REMEDIATION, remediationVerified: true } : {}),
+            }],
+        qa: [], retro: [],
+    };
+}
+function lifecycleForJournal(overlay) {
+    return { journal: { state: overlay.state }, markers: { qaComplete: false, retroComplete: false }, tasks: overlay.tasks };
+}
+function lifecycleForCycle(cycle) {
+    const total = cycle.tasks.length;
+    if (cycle.plan.state === 'blocked' || cycle.cycleState === 'blocked')
+        return { journal: { state: 'blocked' }, markers: { qaComplete: false, retroComplete: false }, tasks: { total, completed: 0 } };
+    if (cycle.plan.state === 'active')
+        return { journal: { state: 'active' }, markers: { qaComplete: false, retroComplete: false }, tasks: { total, completed: 0 } };
+    if (cycle.plan.state === 'executed')
+        return { markers: { qaComplete: true, retroComplete: true }, tasks: { total, completed: total } };
+    if (cycle.plan.state === 'retro_pending')
+        return { markers: { qaComplete: true, retroComplete: false }, tasks: { total, completed: total } };
+    if (cycle.plan.state === 'qa_pending')
+        return { markers: { qaComplete: false, retroComplete: false }, tasks: { total, completed: total } };
+    return { markers: { qaComplete: false, retroComplete: false }, tasks: { total: 0, completed: 0 } };
+}
+function cycleFinding(section, label, cycle, actionable) {
+    return {
+        id: `${section}.cycle.${cycle.cycleId}`,
+        label,
+        state: actionable ? 'attention' : 'ok',
+        ...(actionable ? { remediation: BLOCKED_CYCLE_REMEDIATION, remediationVerified: true } : {}),
     };
 }
 function findings(items, optional = false) {
@@ -125,7 +209,62 @@ function canonicalOptionalFailure(failure) {
         return [];
     return [{ id: failure.findingId, label: 'Optional source unavailable', state: 'unavailable', remediation: exports.REMEDIATION_BY_FINDING_ID[failure.findingId] }];
 }
-function evidenceHistoryItems(root) {
+function evidenceDirectoryExists(root) {
+    try {
+        return fs_1.default.lstatSync(path_1.default.join(root, '.awm', 'evidence', 'cycles')).isDirectory();
+    }
+    catch (error) {
+        if (error && typeof error === 'object' && error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+/** Reads only the current branch journal. Missing journals are not observations;
+ * corrupt or redirected journal paths fail closed rather than changing lifecycle
+ * state from untrusted content. */
+function readJournalOverlay(root) {
+    const branch = (0, store_1.detectBranch)(root);
+    const file = (0, paths_1.statePath)(root, branch);
+    if (!safeJournalStateExists(root, branch, file))
+        return undefined;
+    const journal = (0, store_2.readJournal)(root, branch);
+    if (journal.corrupt || !journal.state)
+        throw new Error('current journal is unavailable or corrupt');
+    if (journal.state.cycle.status === 'COMPLETE')
+        return undefined;
+    return {
+        state: journal.state.cycle.status === 'BLOCKED' ? 'blocked' : 'active',
+        tasks: { total: journal.state.tasks.length, completed: journal.state.tasks.filter((task) => task.status === 'done').length },
+    };
+}
+function safeJournalStateExists(root, branch, file) {
+    for (const directory of [path_1.default.join(root, '.awm'), path_1.default.join(root, '.awm', 'journal'), (0, paths_1.journalDir)(root, branch)]) {
+        let stat;
+        try {
+            stat = fs_1.default.lstatSync(directory);
+        }
+        catch (error) {
+            if (error && typeof error === 'object' && error.code === 'ENOENT')
+                return false;
+            throw error;
+        }
+        if (stat.isSymbolicLink() || !stat.isDirectory())
+            throw new Error('journal directory is unsafe');
+    }
+    let stat;
+    try {
+        stat = fs_1.default.lstatSync(file);
+    }
+    catch (error) {
+        if (error && typeof error === 'object' && error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+    if (stat.isSymbolicLink() || !stat.isFile())
+        throw new Error('journal state is unsafe');
+    return true;
+}
+function readEvidenceHistory(root) {
     const awmDirectory = path_1.default.join(root, '.awm');
     const evidenceDirectory = path_1.default.join(awmDirectory, 'evidence');
     const directory = path_1.default.join(evidenceDirectory, 'cycles');
@@ -136,7 +275,7 @@ function evidenceHistoryItems(root) {
         }
         catch (error) {
             if (error && typeof error === 'object' && error.code === 'ENOENT')
-                return { confidence: 'none', items: [] };
+                return (0, history_1.buildEvidenceHistory)([]);
             throw error;
         }
         if (stat.isSymbolicLink() || !stat.isDirectory())
@@ -157,7 +296,10 @@ function evidenceHistoryItems(root) {
         seenCycleIds.add(evidence.cycleId);
         return evidence;
     });
-    const history = (0, history_1.buildEvidenceHistory)(records);
+    return (0, history_1.buildEvidenceHistory)(records);
+}
+function evidenceHistoryItems(root) {
+    const history = readEvidenceHistory(root);
     return {
         confidence: history.confidence,
         items: history.cycles.map((cycle) => {
@@ -166,6 +308,7 @@ function evidenceHistoryItems(root) {
                 id: `history.cycle.${cycle.cycleId}`,
                 label: `Cycle ${cycle.cycleId.slice(0, 12)}`,
                 state: cycle.cycleState === 'blocked' ? 'attention' : 'ok',
+                ...(cycle.cycleState === 'blocked' ? { remediation: BLOCKED_CYCLE_REMEDIATION } : {}),
                 detail: `plan ${cycle.plan.state}; tasks ${cycle.tasks.length}; retries ${cycle.retries}; QA ${cycle.qa.findings}/${cycle.qa.fixes}; first-pass ${cycle.gates.firstPass ? 'yes' : 'no'}; cures ${cures}`,
             };
         }),

package/dist/src/core/evidence/capture.js

@@ -31,12 +31,32 @@ function captureCycleEvidence(input) {
         throw new Error('capture sources are invalid');
     const tasks = journal.tasks.map((item, index) => { const task = object(item, `task ${index}`); if (typeof task.id !== 'string')
         throw new Error('task id is invalid'); const attempts = nonNegative(task.attempts, 'task attempts'); return { id: task.id, attempts, retries: Math.max(attempts - 1, 0) }; });
-    const failures = journal.verdicts.filter((item, index) => { const verdict = object(item, `verdict ${index}`); if (verdict.result !== 'pass' && verdict.result !== 'fail' && verdict.result !== 'inconclusive')
-        throw new Error('verdict result is invalid'); iso(verdict.receivedAt, 'verdict receivedAt'); return verdict.result === 'fail'; });
-    const signatures = failures.map((item) => { const verdict = object(item, 'verdict'); if (typeof verdict.fingerprint !== 'string' || !verdict.fingerprint)
+    const verdictIds = new Set();
+    const adverseVerdictIds = new Set();
+    const adverseVerdicts = journal.verdicts.filter((item, index) => {
+        const verdict = object(item, `verdict ${index}`);
+        if (typeof verdict.id !== 'string' || !verdict.id)
+            throw new Error('verdict id is invalid');
+        if (verdictIds.has(verdict.id))
+            throw new Error('verdict id is duplicated');
+        verdictIds.add(verdict.id);
+        if (verdict.result !== 'pass' && verdict.result !== 'fail' && verdict.result !== 'inconclusive')
+            throw new Error('verdict result is invalid');
+        iso(verdict.receivedAt, 'verdict receivedAt');
+        if (verdict.result !== 'pass')
+            adverseVerdictIds.add(verdict.id);
+        return verdict.result !== 'pass';
+    });
+    const signatures = adverseVerdicts.map((item) => { const verdict = object(item, 'verdict'); if (typeof verdict.fingerprint !== 'string' || !verdict.fingerprint)
         throw new Error('verdict fingerprint is required'); return hash(`signature:${verdict.fingerprint}`); });
-    const fixes = journal.fixes.filter((item, index) => { const fix = object(item, `fix ${index}`); if (typeof fix.closed !== 'boolean')
-        throw new Error('fix closed is invalid'); return fix.closed; }).length;
+    const fixes = journal.fixes.filter((item, index) => {
+        const fix = object(item, `fix ${index}`);
+        if (typeof fix.closed !== 'boolean')
+            throw new Error('fix closed is invalid');
+        if (typeof fix.verdictId !== 'string' || !fix.verdictId || !adverseVerdictIds.has(fix.verdictId))
+            throw new Error('fix verdictId must reference an adverse verdict');
+        return fix.closed;
+    }).length;
     const gates = input.gates.map((item, index) => { const gate = object(item, `gate ${index}`); if (typeof gate.required !== 'boolean' || typeof gate.passed !== 'boolean')
         throw new Error('gate is invalid'); return gate; }).filter((gate) => gate.required === true);
     const cures = input.ledger.filter((item, index) => { const entry = object(item, `ledger ${index}`); if (typeof entry.signature !== 'string' || (entry.polarity !== 'finding' && entry.polarity !== 'win'))

package/dist/tests/core/dashboard/collect.test.js

@@ -161,6 +161,16 @@ describe('collectDashboardSnapshot', () => {
         expect(history?.items[0]?.detail).toContain('retries 1; QA 1/1; first-pass yes; cures awaiting_observation');
         fs_1.default.rmSync(root, { recursive: true, force: true });
     });
+    it('renders a blocked evidence cycle as an actionable history item with a verified remedy', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-evidence-dashboard-'));
+        fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), '{}');
+        (0, store_1.writeCycleEvidence)(root, { ...(0, evidence_fixtures_1.cycleEvidenceFixture)(), cycleState: 'blocked', plan: { ref: 'docs/plans/current.md', state: 'blocked' } });
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({ cwd: root, now: fixedNow, adapters: { machine: () => ({ findings: [] }), project: () => ({ findings: [] }), plans: () => [], execution: () => undefined } });
+        expect(snapshot.sections.find((section) => section.id === 'history')?.items).toEqual([
+            expect.objectContaining({ state: 'attention', remediation: 'awm preflight' }),
+        ]);
+        fs_1.default.rmSync(root, { recursive: true, force: true });
+    });
     it.each(['.awm', 'evidence', 'cycles'])('does not follow a symlinked %s evidence ancestor', (ancestor) => {
         const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-evidence-dashboard-'));
         const external = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-evidence-external-'));

package/dist/tests/core/dashboard/production-adapters.test.js

@@ -1,6 +1,17 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 const collect_1 = require("../../../src/core/dashboard/collect");
+const store_1 = require("../../../src/core/evidence/store");
+const store_2 = require("../../../src/core/journal/store");
+const types_1 = require("../../../src/core/journal/types");
+const evidence_fixtures_1 = require("../../helpers/evidence-fixtures");
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
 function context() {
     return {
         machine: {},
@@ -67,4 +78,82 @@ describe('productionDashboardAdapters', () => {
         ]));
         expect(JSON.stringify(snapshot)).not.toMatch(/remediationVerified|private|0\.145\.0|token/i);
     });
+    it('derives plan lifecycle and execution evidence from validated local cycle records', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-dashboard-production-evidence-'));
+        fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), '{}');
+        (0, store_1.writeCycleEvidence)(root, {
+            ...(0, evidence_fixtures_1.cycleEvidenceFixture)(),
+            plan: { ref: 'docs/plans/current.md', state: 'executed' },
+            tasks: [{ id: 'task-1', attempts: 2, retries: 1 }],
+            qa: { findings: 1, fixes: 1, signatures: ['a'.repeat(64)] },
+        });
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({
+            cwd: root, now: '2026-08-22T00:00:00.000Z', adapters: (0, collect_1.productionDashboardAdapters)(context()),
+        });
+        expect(snapshot.sections.find((section) => section.id === 'planning')?.items).toEqual([
+            expect.objectContaining({ detail: 'executed', state: 'ok' }),
+        ]);
+        expect(snapshot.sections.find((section) => section.id === 'execution')?.items).toEqual([
+            expect.objectContaining({ state: 'ok' }),
+        ]);
+        expect(snapshot.sections.find((section) => section.id === 'qa')?.items).toEqual([
+            expect.objectContaining({ state: 'ok' }),
+        ]);
+        expect(snapshot.sections.find((section) => section.id === 'retro')?.items).toEqual([
+            expect.objectContaining({ state: 'ok' }),
+        ]);
+        fs_1.default.rmSync(root, { recursive: true, force: true });
+    });
+    it.each([
+        ['IN_PROGRESS', 'active', 'ok'],
+        ['BLOCKED', 'blocked', 'attention'],
+    ])('overlays the current branch journal %s over prior executed evidence', (status, expectedLifecycle, expectedState) => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-dashboard-journal-overlay-'));
+        const branch = 'dashboard-overlay';
+        fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), '{}');
+        (0, child_process_1.execFileSync)('git', ['init', '--initial-branch', branch], { cwd: root, stdio: 'ignore' });
+        (0, child_process_1.execFileSync)('git', ['config', 'user.email', 'dashboard@example.test'], { cwd: root, stdio: 'ignore' });
+        (0, child_process_1.execFileSync)('git', ['config', 'user.name', 'Dashboard Test'], { cwd: root, stdio: 'ignore' });
+        (0, child_process_1.execFileSync)('git', ['commit', '--allow-empty', '-m', 'fixture'], { cwd: root, stdio: 'ignore' });
+        (0, store_1.writeCycleEvidence)(root, { ...(0, evidence_fixtures_1.cycleEvidenceFixture)(), plan: { ref: 'docs/plans/current.md', state: 'executed' } });
+        (0, store_2.initJournal)(root, branch);
+        const journal = (0, types_1.emptyState)(branch);
+        journal.cycle.status = status;
+        (0, store_2.writeJournal)(root, branch, journal);
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({
+            cwd: root, now: '2026-08-22T00:00:00.000Z', adapters: (0, collect_1.productionDashboardAdapters)(context()),
+        });
+        expect(snapshot.sections.find((section) => section.id === 'planning')?.items).toEqual([
+            expect.objectContaining({ detail: expectedLifecycle, state: expectedState }),
+        ]);
+        expect(JSON.stringify(snapshot)).not.toMatch(/dashboard-overlay|dashboard@example|Dashboard Test/i);
+        fs_1.default.rmSync(root, { recursive: true, force: true });
+    });
+    it.each([
+        ['IN_PROGRESS', 'active', 'ok'],
+        ['BLOCKED', 'blocked', 'attention'],
+    ])('renders the current branch journal %s without prior evidence', (status, expectedLifecycle, expectedState) => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-dashboard-journal-only-'));
+        const branch = 'dashboard-journal-only';
+        fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), '{}');
+        (0, child_process_1.execFileSync)('git', ['init', '--initial-branch', branch], { cwd: root, stdio: 'ignore' });
+        (0, child_process_1.execFileSync)('git', ['config', 'user.email', 'dashboard@example.test'], { cwd: root, stdio: 'ignore' });
+        (0, child_process_1.execFileSync)('git', ['config', 'user.name', 'Dashboard Test'], { cwd: root, stdio: 'ignore' });
+        (0, child_process_1.execFileSync)('git', ['commit', '--allow-empty', '-m', 'fixture'], { cwd: root, stdio: 'ignore' });
+        (0, store_2.initJournal)(root, branch);
+        const journal = (0, types_1.emptyState)(branch);
+        journal.cycle.status = status;
+        (0, store_2.writeJournal)(root, branch, journal);
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({
+            cwd: root, now: '2026-08-22T00:00:00.000Z', adapters: (0, collect_1.productionDashboardAdapters)(context()),
+        });
+        expect(snapshot.sections.find((section) => section.id === 'planning')?.items).toEqual([
+            expect.objectContaining({ detail: expectedLifecycle, state: expectedState }),
+        ]);
+        expect(snapshot.sections.find((section) => section.id === 'execution')).toEqual(expect.objectContaining({
+            availability: 'available', items: [expect.objectContaining({ state: expectedState })],
+        }));
+        expect(JSON.stringify(snapshot)).not.toMatch(/dashboard-journal-only|dashboard@example|Dashboard Test/i);
+        fs_1.default.rmSync(root, { recursive: true, force: true });
+    });
 });

package/dist/tests/core/evidence/capture.test.js

@@ -10,7 +10,7 @@ describe('captureCycleEvidence', () => {
                 cycle: { status: 'COMPLETE', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:10.000Z' },
                 journalId: 'local-repository-identity',
                 tasks: [{ id: 'task-a', attempts: 3 }],
-                verdicts: [{ result: 'fail', fingerprint: 'unsafe-input', detail: 'Alice saw secret prompt', receivedAt: '2026-08-22T10:00:05.000Z' }],
+                verdicts: [{ id: 'v1', result: 'fail', fingerprint: 'unsafe-input', detail: 'Alice saw secret prompt', receivedAt: '2026-08-22T10:00:05.000Z' }],
                 fixes: [{ verdictId: 'v1', closed: true }],
             },
             gates: [{ required: true, passed: true }],
@@ -45,4 +45,38 @@ describe('captureCycleEvidence', () => {
         const evidence = (0, capture_1.captureCycleEvidence)({ root: process.cwd(), repositoryIdentity: 'git@example.test:team/repository.git', planPath: 'plans/release.md', journal: { cycle: { status: 'BLOCKED', startedAt: '2026-08-22T10:00:00.000Z' }, controllerHeartbeatAt: '2026-08-22T10:00:03.000Z', tasks: [], verdicts: [], fixes: [] }, gates: [], ledger: [] });
         expect(evidence).toMatchObject({ cycleState: 'blocked', endedAt: '2026-08-22T10:00:03.000Z', durationMs: 3_000 });
     });
+    test('counts inconclusive verdicts as adverse findings because they create fix obligations', () => {
+        const evidence = (0, capture_1.captureCycleEvidence)({
+            root: process.cwd(), repositoryIdentity: 'git@example.test:team/repository.git', planPath: 'plans/release.md',
+            journal: {
+                cycle: { status: 'COMPLETE', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:01.000Z' },
+                tasks: [], verdicts: [{ id: 'v1', result: 'inconclusive', fingerprint: 'probe-unavailable', receivedAt: '2026-08-22T10:00:00.000Z' }],
+                fixes: [{ verdictId: 'v1', closed: true }],
+            }, gates: [], ledger: [],
+        });
+        expect(evidence.qa).toMatchObject({ findings: 1, fixes: 1, signatures: [expect.stringMatching(/^[a-f0-9]{64}$/)] });
+    });
+    test('counts only closed fixes that reference an adverse verdict', () => {
+        const evidence = (0, capture_1.captureCycleEvidence)({
+            root: process.cwd(), repositoryIdentity: 'git@example.test:team/repository.git', planPath: 'plans/release.md',
+            journal: {
+                cycle: { status: 'COMPLETE', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:01.000Z' }, tasks: [],
+                verdicts: [
+                    { id: 'v-fail', result: 'fail', fingerprint: 'failure', receivedAt: '2026-08-22T10:00:00.000Z' },
+                    { id: 'v-inconclusive', result: 'inconclusive', fingerprint: 'unknown', receivedAt: '2026-08-22T10:00:00.000Z' },
+                ],
+                fixes: [{ verdictId: 'v-fail', closed: true }, { verdictId: 'v-inconclusive', closed: false }],
+            }, gates: [], ledger: [],
+        });
+        expect(evidence.qa).toMatchObject({ findings: 2, fixes: 1 });
+    });
+    test.each([
+        { verdicts: [], verdictId: 'missing' },
+        { verdicts: [{ id: 'v-pass', result: 'pass', fingerprint: 'passed', receivedAt: '2026-08-22T10:00:00.000Z' }], verdictId: 'v-pass' },
+    ])('rejects a fix whose verdict reference is absent or not adverse', ({ verdicts, verdictId }) => {
+        expect(() => (0, capture_1.captureCycleEvidence)({
+            root: process.cwd(), repositoryIdentity: 'git@example.test:team/repository.git', planPath: 'plans/release.md',
+            journal: { cycle: { status: 'COMPLETE', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:01.000Z' }, tasks: [], verdicts, fixes: [{ verdictId, closed: true }] }, gates: [], ledger: [],
+        })).toThrow(/fix verdictId/i);
+    });
 });

package/dist/tests/core/evidence/command.test.js

@@ -34,4 +34,27 @@ describe('evidence capture CLI boundary', () => {
         const result = (0, evidence_1.runEvidenceCapture)(root, 'plan.md', { repositoryIdentity: 'git@example.test:team/repository.git', journal: { journalId: 'ignored', cycle: { status: 'COMPLETE', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:01.000Z' }, tasks: [], fixes: [], cycleVerificationPlan: [{ id: 'review-gate', kind: 'review', satisfiedBy: 'final' }], jobs: {}, verdicts: [{ id: 'first', obligationId: 'review-gate', result: 'fail', fingerprint: 'review-gate', receivedAt: '2026-08-22T10:00:00.000Z' }, { id: 'final', obligationId: 'review-gate', result: 'pass', fingerprint: 'review-gate', receivedAt: '2026-08-22T10:00:01.000Z' }] }, ledger: [] });
         expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(root, '.awm', 'evidence', 'cycles', result.stdout.trim() + '.json'), 'utf8')).gates.firstEvaluationsPassed).toEqual([false]);
     });
+    test('derives retro_pending from completed checklist tasks and the QA marker in the plan file', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, 'plan.md'), '# plan\n<!-- awm-qa-complete: 2026-08-22 -->\n- [x] Build\n- [X] Verify\n');
+        const result = (0, evidence_1.runEvidenceCapture)(root, 'plan.md', { repositoryIdentity: 'git@example.test:team/repository.git', journal: { journalId: 'ignored', cycle: { status: 'COMPLETE', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:01.000Z' }, tasks: [], verdicts: [], fixes: [], jobs: {}, cycleVerificationPlan: [] }, ledger: [] });
+        expect(result.code).toBe(0);
+        expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(root, '.awm', 'evidence', 'cycles', result.stdout.trim() + '.json'), 'utf8')).plan.state).toBe('retro_pending');
+    });
+    test('uses a blocked journal state over completed plan markers', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, 'plan.md'), '# plan\n<!-- awm-qa-complete: 2026-08-22 -->\n<!-- awm-retro-complete: 2026-08-22 -->\n- [x] Build\n');
+        const result = (0, evidence_1.runEvidenceCapture)(root, 'plan.md', { repositoryIdentity: 'git@example.test:team/repository.git', journal: { journalId: 'ignored', cycle: { status: 'BLOCKED', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:01.000Z' }, tasks: [], verdicts: [], fixes: [], jobs: {}, cycleVerificationPlan: [] }, ledger: [] });
+        expect(result.code).toBe(0);
+        expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(root, '.awm', 'evidence', 'cycles', result.stdout.trim() + '.json'), 'utf8')).plan.state).toBe('blocked');
+    });
+    test('does not let Release A markers classify a multi-release plan whose current Release B has no lifecycle markers', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, 'plan.md'), '# plan\n<!-- awm-qa-complete: Release A / #86 -->\n<!-- awm-retro-complete: Release A / #86 -->\n\n## Delivery order\n1. **Release A / #86:** dashboard\n2. **Release B / #87:** evidence\n\n- [x] Release B task\n');
+        const result = (0, evidence_1.runEvidenceCapture)(root, 'plan.md', { repositoryIdentity: 'git@example.test:team/repository.git', journal: { journalId: 'ignored', cycle: { status: 'COMPLETE', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:01.000Z' }, tasks: [], verdicts: [], fixes: [], jobs: {}, cycleVerificationPlan: [] }, ledger: [] });
+        expect(result.code).toBe(0);
+        expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(root, '.awm', 'evidence', 'cycles', result.stdout.trim() + '.json'), 'utf8')).plan.state).toBe('qa_pending');
+    });
+    test('rejects a malformed checklist instead of silently classifying a plan', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, 'plan.md'), '# plan\n- [z] Unknown state\n');
+        const result = (0, evidence_1.runEvidenceCapture)(root, 'plan.md', { repositoryIdentity: 'git@example.test:team/repository.git', journal: { journalId: 'ignored', cycle: { status: 'COMPLETE', startedAt: '2026-08-22T10:00:00.000Z', completedAt: '2026-08-22T10:00:01.000Z' }, tasks: [], verdicts: [], fixes: [], jobs: {}, cycleVerificationPlan: [] }, ledger: [] });
+        expect(result).toEqual(expect.objectContaining({ code: 2, error: expect.stringMatching(/invalid checklist/i) }));
+    });
 });

package/dist/tests/core/evidence/types.test.js

@@ -20,6 +20,23 @@ describe('CycleEvidenceV1 validation', () => {
         const evidence = (0, evidence_fixtures_1.cycleEvidenceFixture)();
         expect((0, types_1.validateCycleEvidence)({ ...evidence, gates: { required: 2, firstEvaluationsPassed: [true, false], firstPass: false } }).gates.firstEvaluationsPassed).toEqual([true, false]);
     });
+    test.each([Number.NaN, Number.POSITIVE_INFINITY, Number.NEGATIVE_INFINITY, -1])('rejects a non-finite or negative duration: %p', (durationMs) => {
+        const evidence = (0, evidence_fixtures_1.cycleEvidenceFixture)();
+        expect(() => (0, types_1.validateCycleEvidence)({
+            ...evidence,
+            startedAt: evidence.endedAt,
+            durationMs,
+        })).toThrow('durationMs must be a non-negative integer');
+    });
+    test.each([
+        ['task attempts', (evidence) => ({ ...evidence, tasks: [{ ...evidence.tasks[0], attempts: -1 }] })],
+        ['task retries', (evidence) => ({ ...evidence, tasks: [{ ...evidence.tasks[0], retries: -1 }] })],
+        ['QA findings', (evidence) => ({ ...evidence, qa: { ...evidence.qa, findings: -1 } })],
+        ['QA fixes', (evidence) => ({ ...evidence, qa: { ...evidence.qa, fixes: -1 } })],
+        ['required gates', (evidence) => ({ ...evidence, gates: { ...evidence.gates, required: -1 } })],
+    ])('rejects a negative %s count', (_label, patch) => {
+        expect(() => (0, types_1.validateCycleEvidence)(patch((0, evidence_fixtures_1.cycleEvidenceFixture)()))).toThrow('must be a non-negative integer');
+    });
     test('permits every dashboard plan state and an absent PR', () => {
         for (const state of ['active', 'blocked', 'qa_pending', 'retro_pending', 'executed', 'legacy_unverifiable']) {
             const evidence = (0, evidence_fixtures_1.cycleEvidenceFixture)();

package/dist/tests/structural/release-registry-provenance.test.js

@@ -0,0 +1,21 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const CLI_ROOT = path_1.default.resolve(__dirname, '..', '..');
+const RELEASE_WORKFLOW = path_1.default.join(CLI_ROOT, '..', '.github', 'workflows', 'release.yml');
+describe('release registry provenance', () => {
+    const workflow = fs_1.default.readFileSync(RELEASE_WORKFLOW, 'utf8');
+    it('resolves the immutable registry tag before publishing the CLI', () => {
+        expect(workflow).toContain('Resolve immutable Task 7 registry commit');
+        expect(workflow).toContain('refs/tags/${REGISTRY_TAG}^{}');
+        expect(workflow).toContain('AWM_PUBLISHED_REGISTRY_TAG: v3.4.0');
+        expect(workflow).not.toContain('AWM_REGISTRY_V3_4_0_COMMIT');
+        expect(workflow.indexOf('Resolve immutable Task 7 registry commit'))
+            .toBeLessThan(workflow.indexOf('- name: Release'));
+        expect(workflow).toMatch(/REGISTRY_TAG: v3\.4\.0[\s\S]*AWM_PUBLISHED_REGISTRY_TAG: v3\.4\.0/);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "8.5.0",
+  "version": "8.5.1",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"