agentic-workflow-manager 9.0.2 → 9.2.0

package/dist/src/commands/context/index.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runContextOrchestrators = runContextOrchestrators;
+exports.registerContextCommand = registerContextCommand;
+const orchestrators_1 = require("../../core/orchestrators");
+const provider_1 = require("../../core/context/provider");
+const text_1 = require("../../core/text");
+const command_result_1 = require("../../core/command-result");
+function runContextOrchestrators(collected, opts) {
+    const stderr = (0, command_result_1.diagnosticsToStderr)(collected.diagnostics);
+    const composed = (0, provider_1.composedOrchestrators)(collected.declared);
+    if (opts.verify !== undefined) {
+        // opts.verify es el argumento CRUDO tal como lo tipeo el usuario; composed[].name
+        // ya paso por sanitizeDeclaredField. Sin normalizar este lado con la MISMA funcion,
+        // un usuario que tipee el nombre declarado exacto (con un caracter que el saneo
+        // quita, p.ej. `_` o un byte de control) se lleva un falso "not composed" (R3.5/R3.6).
+        const verifyNormalized = (0, text_1.sanitizeDeclaredField)(opts.verify);
+        const found = composed.some((o) => o.name === verifyNormalized);
+        if (!found) {
+            const available = composed.map((o) => o.name).join(', ') || '(none)';
+            return {
+                code: 2, stdout: '',
+                stderr: `${stderr}awm context orchestrators: "${verifyNormalized}" is not composed — available: ${available}\n`,
+            };
+        }
+        return { code: 0, stdout: `"${verifyNormalized}" is composed into the session context.\n`, stderr };
+    }
+    if (opts.json) {
+        return { code: 0, stdout: `${JSON.stringify({ orchestrators: composed }, null, 2)}\n`, stderr };
+    }
+    if (composed.length === 0) {
+        return { code: 0, stdout: 'No declared orchestrators in the installed registries.\n', stderr };
+    }
+    const rows = composed
+        .map((o) => `${o.name}  applies when: ${o.appliesWhen}  -> ${o.terminatesTo}`)
+        .join('\n');
+    return { code: 0, stdout: `${rows}\n`, stderr };
+}
+function registerContextCommand(program) {
+    const context = program.command('context').description('read-only view of the context AWM delivers to every agent session');
+    context
+        .command('orchestrators')
+        .description('list the declared orchestrators as they are composed into the session context')
+        .option('--json', 'emit the composed list as JSON')
+        .option('--verify <name>', 'exit 0 only if that orchestrator is composed; 2 otherwise')
+        .action((opts) => (0, command_result_1.emit)(runContextOrchestrators((0, orchestrators_1.collectDeclaredOrchestrators)(), { json: opts.json === true, verify: opts.verify })));
+}

package/dist/src/commands/ledger/index.js

@@ -6,6 +6,15 @@ const types_1 = require("../../core/ledger/types");
 function archiveLabel() {
     return new Date().toISOString().replace(/[-:]/g, '').replace(/\.\d+Z$/, '');
 }
+// R1a's own retro: across this session, reviewer subagents repeatedly verified
+// this command's flags by issuing a live `ledger add` with a placeholder
+// --desc ("test", "test-check", "test-x", ...) instead of reading --help,
+// polluting the real branch ledger at least six separate times despite
+// explicit prompt instructions not to. --help already documents every flag —
+// the missing piece was a structural backstop, since prompt text alone kept
+// failing to prevent it. This denylist catches the exact placeholder shapes
+// observed; it is not a general anti-test-data filter.
+const PLACEHOLDER_DESC = /^(test|test[-_]?\w{0,10}|placeholder|foo|bar|example|todo|tbd)$/i;
 function registerLedgerCommand(program) {
     const ledger = program.command('ledger').description('persistent per-branch findings ledger (working memory for harness-retro)');
     ledger
@@ -25,6 +34,10 @@ function registerLedgerCommand(program) {
         if (opts.defectClass !== undefined && !types_1.DEFECT_CLASS.test(opts.defectClass)) {
             throw new Error('--defect-class requires a lowercase kebab-case value');
         }
+        if (PLACEHOLDER_DESC.test(opts.desc.trim())) {
+            throw new Error(`--desc "${opts.desc}" looks like a placeholder, not a real finding — ` +
+                'run "awm ledger add --help" to check flag syntax instead of a live add.');
+        }
         const cwd = process.cwd();
         const branch = opts.branch ?? (0, store_1.detectBranch)(cwd);
         const entry = {

package/dist/src/commands/process/index.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runProcessList = runProcessList;
+exports.runProcessShow = runProcessShow;
+exports.registerProcessCommand = registerProcessCommand;
+const discover_1 = require("../../core/process/discover");
+const text_1 = require("../../core/text");
+const command_result_1 = require("../../core/command-result");
+/** `source` es un path absoluto del filesystem local: identifica la máquina, no
+ *  el proceso. Se usa internamente para diagnósticos, y se omite de toda salida
+ *  destinada a ser compartida o consumida por otro programa. */
+function publicView(model) {
+    const { source: _source, ...rest } = model;
+    return rest;
+}
+function runProcessList(discovered) {
+    const stderr = (0, command_result_1.diagnosticsToStderr)(discovered.diagnostics);
+    if (discovered.models.length === 0) {
+        return { code: 0, stdout: 'No process models declared by the installed registries.\n', stderr };
+    }
+    const rows = discovered.models
+        .map((m) => `${m.name}  ${m.status}  ${m.entryPoint ? 'entry-point' : 'phase'}  -> ${m.terminatesTo}`)
+        .join('\n');
+    return { code: 0, stdout: `${rows}\n`, stderr };
+}
+function runProcessShow(discovered, name, json) {
+    const stderr = (0, command_result_1.diagnosticsToStderr)(discovered.diagnostics);
+    const found = discovered.models.find((m) => m.name === name);
+    if (!found) {
+        const available = discovered.models.map((m) => m.name).join(', ') || '(none)';
+        return { code: 2, stdout: '', stderr: `${stderr}awm process show: no process named "${name}" — available: ${available}\n` };
+    }
+    if (!json) {
+        // Vista mínima deliberada: name/status/objective/structure. appliesWhen,
+        // routing, termination y unverified no se renderizan aquí — el detalle
+        // completo del body está disponible vía --json (ver Task 4 del plan R1A).
+        const view = publicView(found);
+        const structure = view.body.structure
+            .map((sg) => [
+            `${(0, text_1.stripControlChars)(sg.id)} — ${(0, text_1.stripControlChars)(sg.text)}`,
+            ...sg.operations.map((op) => `  ${(0, text_1.stripControlChars)(op.id)} — ${(0, text_1.stripControlChars)(op.text)}`),
+        ].join('\n')).join('\n');
+        return { code: 0, stdout: `${view.name} (${view.status})\n\n${(0, text_1.stripControlChars)(view.body.objective)}\n\n${structure}\n`, stderr };
+    }
+    return { code: 0, stdout: `${JSON.stringify(publicView(found), null, 2)}\n`, stderr };
+}
+function registerProcessCommand(program) {
+    const process_ = program.command('process').description('declared process models (the CLI is their only parser)');
+    process_
+        .command('list')
+        .description('list process models declared by the installed registries')
+        .action(() => (0, command_result_1.emit)(runProcessList((0, discover_1.discoverProcessModels)())));
+    process_
+        .command('show <name>')
+        .description('show one process model')
+        .option('--json', 'emit the parsed model as JSON')
+        .action((name, opts) => (0, command_result_1.emit)(runProcessShow((0, discover_1.discoverProcessModels)(), name, opts.json === true)));
+}

package/dist/src/core/command-result.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.diagnosticsToStderr = diagnosticsToStderr;
+exports.emit = emit;
+/** Formatea diagnósticos como líneas `warning: ...\n` listas para stderr.
+ *  Compartido entre comandos para no divergir el formato. */
+function diagnosticsToStderr(diagnostics) {
+    return diagnostics.map((d) => `warning: ${d}\n`).join('');
+}
+function emit(result) {
+    if (result.stderr)
+        process.stderr.write(result.stderr);
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.code !== 0)
+        process.exitCode = result.code;
+}

package/dist/src/core/context/provider.js

@@ -4,11 +4,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sha256 = sha256;
+exports.composedOrchestrators = composedOrchestrators;
 exports.buildContext = buildContext;
 // cli/src/core/context/provider.ts
 const crypto_1 = __importDefault(require("crypto"));
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
+const text_1 = require("../text");
 function sha256(input) {
     return crypto_1.default.createHash('sha256').update(input, 'utf-8').digest('hex');
 }
@@ -17,29 +19,36 @@ function parseVersion(skill) {
     return m ? m[1].trim() : '0.0.0';
 }
 /**
- * Neutraliza contenido no confiable proveniente de registries declarados
- * (name/appliesWhen/terminatesTo) antes de interpolarlo en markdown.
- * Sin esto, un registry malicioso/comprometido podria inyectar saltos de
- * linea, marcadores markdown (##, `, *, _) o pseudo-tags XML/HTML (<, >)
- * para forjar una seccion nueva o un bloque instruccional dentro del
- * payload de contexto que consume el proveedor de IA — un vector de
- * prompt-injection. `readDeclaredOrchestrators` solo valida que los
- * campos sean strings no vacios; el saneo pertenece a esta frontera de
- * render, no a la validacion de lectura.
+ * La lista de orquestadores declarados TAL COMO entra al payload de contexto:
+ * saneada campo por campo con `sanitizeDeclaredField` (core/text.ts) — que
+ * neutraliza tanto marcado markdown/saltos de linea (prompt-injection via
+ * `##`, `` ` ``, `*`, `_`, `<`, `>`) COMO bytes de control C0/DEL (ANSI
+ * escapes hacia una terminal real). `readDeclaredOrchestrators` solo valida
+ * que los campos sean strings no vacios; el saneo pertenece a esta frontera
+ * de render, no a la validacion de lectura.
+ *
+ * ESTA es la UNICA funcion que hace este saneo — es la que consume
+ * `renderDeclared` (el payload materializado en cada sesion de agente via
+ * `buildContext`) y la que consume `awm context orchestrators` (comando).
+ * Ningun consumidor necesita sanear de nuevo por su cuenta: si el comando
+ * aplicara su propio saneo, comando y payload podrian divergir en silencio
+ * — el modo de falla que R5.2 prohíbe para el modelo de proceso y que vale
+ * igual acá. Por la misma razon, cualquier comparacion contra un nombre
+ * declarado (p.ej. `--verify` en `commands/context/index.ts`) debe normalizar
+ * su lado tambien con `sanitizeDeclaredField`, no con una copia del regex.
  */
-function sanitizeForMarkdown(s) {
-    return s.replace(/\r?\n/g, ' ').replace(/[`*_#<>]/g, '');
+function composedOrchestrators(list) {
+    return list.map(o => ({
+        name: (0, text_1.sanitizeDeclaredField)(o.name),
+        appliesWhen: (0, text_1.sanitizeDeclaredField)(o.appliesWhen),
+        terminatesTo: (0, text_1.sanitizeDeclaredField)(o.terminatesTo),
+    }));
 }
 function renderDeclared(list) {
     if (list.length === 0)
         return '';
-    const rows = list
-        .map(o => {
-        const name = sanitizeForMarkdown(o.name);
-        const appliesWhen = sanitizeForMarkdown(o.appliesWhen);
-        const terminatesTo = sanitizeForMarkdown(o.terminatesTo);
-        return `- **${name}** — applies when: ${appliesWhen}. Terminates to: \`${terminatesTo}\`.`;
-    })
+    const rows = composedOrchestrators(list)
+        .map(o => `- **${o.name}** — applies when: ${o.appliesWhen}. Terminates to: \`${o.terminatesTo}\`.`)
         .join('\n');
     return `## Declared orchestrators\n\nConsider these before the built-in pair:\n\n${rows}\n\n`;
 }

package/dist/src/core/dashboard/collect.js

@@ -15,6 +15,7 @@ const types_1 = require("../evidence/types");
 const store_1 = require("../ledger/store");
 const paths_1 = require("../journal/paths");
 const store_2 = require("../journal/store");
+const discover_1 = require("../process/discover");
 const sanitize_1 = require("./sanitize");
 const validate_1 = require("./validate");
 const plan_state_1 = require("./plan-state");
@@ -29,7 +30,7 @@ exports.REMEDIATION_BY_FINDING_ID = {
 };
 const BLOCKED_CYCLE_REMEDIATION = 'awm preflight';
 const EMPTY_ADAPTERS = {
-    machine: () => ({ findings: [] }), project: () => ({ findings: [] }), plans: () => [], execution: () => undefined,
+    machine: () => ({ findings: [] }), project: () => ({ findings: [] }), plans: () => [], execution: () => undefined, processes: () => [],
 };
 const SAFE_REMEDIATIONS = new Set(['awm init', 'awm update', 'awm sync', 'awm sensors status', 'awm preflight']);
 const HEALTHY_PROVIDER_STATES = new Set(['supported', 'healthy', 'shared', 'delivered']);
@@ -127,6 +128,7 @@ function productionDashboardAdapters(context) {
                 retro: history.cycles.map((cycle) => cycleFinding('retro', 'Project context', cycle, cycle.plan.state !== 'executed')),
             };
         },
+        processes: () => (0, discover_1.discoverProcessModels)().models.map((m) => ({ name: m.name, status: m.status })),
     };
 }
 /** A journal has no durable plan reference. Use a generic fixed row so its
@@ -358,6 +360,29 @@ function collectDashboardSnapshot(options) {
     const retroItems = isolatedFindings(execution?.retro);
     const evidenceResult = optional(() => evidenceHistoryItems(root));
     const executionUnavailable = !executionResult.failed && execution === undefined;
+    const processesResult = optional(() => (0, sanitize_1.sanitizeDashboardSource)(adapters.processes({ root })));
+    // `id`/`label`/`detail` se construyen acá, en código de aplicación, DESPUÉS de
+    // la sanitización de source — igual que `planning` hace con `classifyPlanState`:
+    // el sanitizador descarta todo `detail` que venga del adapter (sanitize.ts), así
+    // que ponerlo antes sería escribirlo para que se borre en silencio. Y como estos
+    // tres campos nunca pasan por el recorrido recursivo de sanitizeDashboardSource
+    // de arriba, se los corre por las mismas ramas de sanitize() (sanitizeDashboardId/
+    // sanitizeDashboardLabel) para sostener la segunda barrera: un `p.name` que no es
+    // slug cae al id hasheado `item-*` en vez de colarse como `process.<bad-name>`.
+    // El estado `attention` es accionable (ver validate.ts): un modelo en draft no
+    // tiene un comando que lo "arregle" — el remediation apunta a inspeccionarlo, no
+    // a resolverlo automáticamente.
+    const processItems = (processesResult.value ?? []).map((p) => ({
+        id: (0, sanitize_1.sanitizeDashboardId)(`process.${p.name}`),
+        // El literal 'Process' ya está en CANONICAL_LABELS, así que el branch
+        // [redacted] de sanitizeDashboardLabel nunca se ejecuta desde este call
+        // site hoy — el wrapper queda por simetría con sanitizeDashboardId y como
+        // guardia ante un futuro label dinámico, no porque esta llamada pueda fallar.
+        label: (0, sanitize_1.sanitizeDashboardLabel)('Process'),
+        state: p.status === 'active' ? 'ok' : 'attention',
+        detail: p.status,
+        ...(p.status === 'active' ? {} : { remediation: 'awm process list' }),
+    }));
     const sections = [
         machineSection,
         section('project', projectResult.failed || projectItemsResult.failed ? 'unavailable' : 'available', projectResult.failed
@@ -371,10 +396,10 @@ function collectDashboardSnapshot(options) {
         section('docs', executionResult.failed || executionUnavailable || docsItems.failed ? 'unavailable' : 'available', docsItems.value),
         section('retro', executionResult.failed || executionUnavailable || retroItems.failed ? 'unavailable' : 'available', retroItems.value),
         section('history', evidenceResult.failed ? 'unavailable' : 'available', evidenceResult.failed ? [] : evidenceResult.value.items),
-        // `processes` is a reserved section id with no adapter yet: a later
-        // release (R1) populates it. `not_applicable` here means exactly
-        // "this section doesn't apply here", not dead code.
-        section('processes', 'not_applicable', []),
+        // R1a puebla `processes` desde su adapter. Sin modelos declarados la
+        // sección conserva `not_applicable` — el mismo valor que R0 dejó
+        // reservado — para que un proyecto sin procesos se vea igual que antes.
+        section('processes', processesResult.failed ? 'unavailable' : processItems.length === 0 ? 'not_applicable' : 'available', processesResult.failed ? [] : processItems),
     ];
     const degraded = sections.some((entry) => entry.availability === 'unavailable' || entry.items.some((item) => item.state !== 'ok' && item.state !== 'not_applicable'));
     return (0, validate_1.validateDashboardSnapshotV1)({ schema: 2, generatedAt: options.now, overall: degraded ? 'degraded' : 'healthy', project: { detected: true, label: projectSource?.label || 'Project detected' }, confidence: evidenceResult.failed ? 'none' : evidenceResult.value.confidence, sections });

package/dist/src/core/dashboard/sanitize.js

@@ -1,12 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sanitizeDashboardSource = sanitizeDashboardSource;
+exports.sanitizeDashboardId = sanitizeDashboardId;
+exports.sanitizeDashboardLabel = sanitizeDashboardLabel;
 const crypto_1 = require("crypto");
 const STATES = new Set(['ok', 'attention', 'missing', 'unavailable', 'not_applicable', 'active', 'blocked']);
-const ALLOWED_KEYS = new Set(['findings', 'label', 'id', 'state', 'detail', 'remediation', 'remediationVerified', 'execution', 'qa', 'docs', 'retro', 'history', 'lifecycle', 'journal', 'markers', 'tasks', 'total', 'completed', 'qaComplete', 'docsComplete', 'retroComplete']);
+const ALLOWED_KEYS = new Set(['findings', 'label', 'id', 'state', 'detail', 'remediation', 'remediationVerified', 'execution', 'qa', 'docs', 'retro', 'history', 'lifecycle', 'journal', 'markers', 'tasks', 'total', 'completed', 'qaComplete', 'docsComplete', 'retroComplete', 'processes', 'name', 'status']);
 const CANONICAL_LABELS = new Set([
     'Preferences', 'Registries', 'Profile', 'Sensors', 'Optional source unavailable',
     'Extensions', 'Registry pins', 'Active bundles', 'Project context', 'Constitution', 'Static preflight', 'Documentation',
+    'Process',
 ]);
 const CANONICAL_FINDING_IDS = new Set([
     'machine.preferences.missing', 'machine.registries.stale', 'project.profile.missing',
@@ -15,6 +18,10 @@ const CANONICAL_FINDING_IDS = new Set([
 const PROVIDER_FINDING_ID = /^machine\.provider\.(?:claude-code|codex|opencode|cursor|copilot|antigravity)\.(?:binary\.version|skills\.global|agents\.native|workflows\.global|context\.global|hook\.trust|guidance\.project|constitution\.delivery)$/;
 const PROJECT_FINDING_ID = /^project\.(?:profile\.present|extensions\.configured|registry-pins\.present|bundles\.coherent|context\.present|constitution\.present|sensors\.present|preflight\.not_collected)$/;
 const PROVIDER_LABEL = /^Provider (?:claude-code|codex|opencode|cursor|copilot|antigravity): (?:binary\.version|skills\.global|agents\.native|workflows\.global|context\.global|hook\.trust|guidance\.project|constitution\.delivery)$/;
+// El slug ya lo validó PROCESS_NAME en core/process/model.ts. Repetir la forma
+// acá es deliberado: este módulo es la frontera de render y no puede confiar en
+// que su input pasó por aquel validador — un adapter nuevo podría no hacerlo.
+const PROCESS_FINDING_ID = /^process\.[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
 const DANGEROUS = /(?:ghp_|sk-[A-Za-z]|<|>|\\\\[^\\\s]+\\[^\\\s]+|\/[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*|[A-Za-z]:\\|\b[A-Za-z_][A-Za-z0-9_]*=|token|secret|password)/iu;
 function sanitize(value, key) {
     if (value === null || typeof value === 'boolean')
@@ -33,7 +40,7 @@ function sanitize(value, key) {
         if (key === 'id') {
             if (value.trim() === '')
                 throw new Error('Dashboard finding id is invalid');
-            return CANONICAL_FINDING_IDS.has(value) || PROVIDER_FINDING_ID.test(value) || PROJECT_FINDING_ID.test(value)
+            return CANONICAL_FINDING_IDS.has(value) || PROVIDER_FINDING_ID.test(value) || PROJECT_FINDING_ID.test(value) || PROCESS_FINDING_ID.test(value)
                 ? value : `item-${(0, crypto_1.createHash)('sha256').update(value).digest('hex').slice(0, 16)}`;
         }
         if (key === 'label' && !CANONICAL_LABELS.has(value) && !PROVIDER_LABEL.test(value))
@@ -60,3 +67,18 @@ function sanitize(value, key) {
 function sanitizeDashboardSource(value) {
     return sanitize(value);
 }
+// Sections that build an item's `id`/`label` in application code (rather than
+// receiving them ready-made inside an adapter's `findings` array) never pass
+// through `sanitizeDashboardSource`'s recursive walk — there is no `findings`
+// array for it to walk. These wrappers let such call sites run the exact same
+// `id`/`label` branches sanitize() applies to every other section, so a
+// constructed value gets the same canonical-vocabulary / hashed-fallback
+// treatment instead of skipping validation entirely.
+/** Validates a dashboard item id against the canonical id vocabulary, falling back to a hashed id otherwise. */
+function sanitizeDashboardId(value) {
+    return sanitize(value, 'id');
+}
+/** Validates a dashboard item label against the canonical label vocabulary, redacting it otherwise. */
+function sanitizeDashboardLabel(value) {
+    return sanitize(value, 'label');
+}

package/dist/src/core/orchestrators.js

@@ -17,6 +17,7 @@ exports.collectAndWarn = collectAndWarn;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const registries_1 = require("./registries");
+const text_1 = require("./text");
 const ALLOWED_FIELDS = ['name', 'appliesWhen', 'terminatesTo'];
 // These fields are semantically short (a short identity, a short trigger condition, a
 // short target name) — no legitimate declaration needs more than this. A registry is
@@ -109,21 +110,41 @@ function readDeclaredOrchestrators(root) {
  * de emitir ambas filas al markdown compuesto, gana la primera en el orden de
  * listRegistries() (= orden de registries.json, ver registries.ts) y la duplicada se
  * descarta con un diagnostico — misma degradacion tolerante (reportar, no lanzar) que el
- * resto de este modulo (R1.2, R5.1).
+ * resto de este modulo (R1.2, R5.1). `orch.name` es contenido no confiable del registry:
+ * se pasa por `stripControlChars` (core/text.ts) antes de interpolarlo en el diagnostico,
+ * que termina crudo en stderr real via `command-result.ts`'s `diagnosticsToStderr`/`emit`.
+ *
+ * Ademas del dedupe por nombre CRUDO, dos orquestadores con nombres crudos distintos
+ * (p.ej. `foo_bar` y `foo*bar`) pueden colisionar DESPUES del saneo que aplica
+ * `composedOrchestrators` (core/context/provider.ts) — ambos renderizarian como el mismo
+ * `foobar` visible, sin explicacion. Como son declaraciones genuinamente distintas, no se
+ * descarta ninguna (eso perderia una declaracion real) — se emite un diagnostico
+ * accionable en su lugar. `sanitizeDeclaredField` vive en core/text.ts (no en provider.ts)
+ * precisamente para que este modulo -- que debe seguir siendo hoja y no puede importar
+ * context/provider.ts, el cual ya importa `DeclaredOrchestrator` DESDE este archivo -- pueda
+ * calcular el mismo nombre saneado sin duplicar el regex.
  */
 function collectDeclaredOrchestrators() {
     const declared = [];
     const diagnostics = [];
     const seenNames = new Set();
+    const seenSanitizedNames = new Set();
     for (const reg of (0, registries_1.listRegistries)()) {
         const r = readDeclaredOrchestrators(reg.contentRoot);
         for (const orch of r.orchestrators) {
+            const file = path_1.default.join(reg.contentRoot, registries_1.REGISTRY_MANIFEST_NAME);
             if (seenNames.has(orch.name)) {
-                const file = path_1.default.join(reg.contentRoot, registries_1.REGISTRY_MANIFEST_NAME);
-                diagnostics.push(`${file}: orchestrator "${orch.name}" duplicates one already declared by an earlier registry — shadowed duplicate dropped`);
+                diagnostics.push(`${file}: orchestrator "${(0, text_1.stripControlChars)(orch.name)}" duplicates one already declared by an earlier registry — shadowed duplicate dropped`);
                 continue;
             }
             seenNames.add(orch.name);
+            const sanitizedName = (0, text_1.sanitizeDeclaredField)(orch.name);
+            if (seenSanitizedNames.has(sanitizedName)) {
+                diagnostics.push(`${file}: orchestrator "${(0, text_1.stripControlChars)(orch.name)}" sanitizes to the same composed name "${sanitizedName}" as an already declared orchestrator — both will render as indistinguishable duplicates in the composed context`);
+            }
+            else {
+                seenSanitizedNames.add(sanitizedName);
+            }
             declared.push(orch);
         }
         diagnostics.push(...r.diagnostics);

package/dist/src/core/process/body.js

@@ -0,0 +1,181 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseProcessBody = parseProcessBody;
+const REQUIRED = ['Objetivo', 'Cuándo aplica', 'Estructura', 'Ruteo', 'Terminación', 'Sin verificar'];
+const SG = /^-\s+(SG-\d+)\s+—\s+(.+)$/;
+const OP = /^\s+-\s+(OP-(\d+)\.\d+)\s+—\s+(.+)$/;
+// Mismo razonamiento que MAX_FIELD_LENGTH en orchestrators.ts: este texto
+// llega al payload de contexto de un proveedor de IA, así que ningún campo
+// puede ser ilimitado — un `## Objetivo` de 10MB en un registry no confiable
+// debe rechazarse con diagnóstico, no aceptarse. Dos anchos, no uno, porque
+// las secciones de prosa (Objetivo/Cuándo aplica/Terminación) son párrafos
+// libres que legítimamente exceden una sola oración, mientras que los ítems
+// estructurales (texto de SG-#/OP-#, celdas de la tabla Ruteo, entradas de
+// "Sin verificar") son título-cortos por contrato — igual de acotados que los
+// campos de orchestrators.ts.
+const MAX_SECTION_LENGTH = 5000;
+const MAX_ITEM_LENGTH = 500;
+/** Corta el documento en secciones de nivel 2. Las de nivel 1 (`# Titulo`) y el
+ *  contenido previo al primer `##` se descartan: el contrato vive en los `##`.
+ *  Un heading repetido NO se fusiona con el anterior — eso corrompería en
+ *  silencio los parsers posicionales (p.ej. `parseRouting` tomaría la fila de
+ *  cabecera de la segunda sección como una fila de datos). En su lugar se
+ *  registra como problema y el llamador debe abortar. */
+function splitSections(source, problems) {
+    const out = new Map();
+    const seen = new Set();
+    let current = null;
+    for (const line of source.split(/\r?\n/)) {
+        // Greedy capture a fin-de-línea + trim en código, no en el regex: un
+        // `(.+?)` perezoso seguido de `\s*` sobre una clase que lo solapa
+        // (`.` incluye `\s`) es ReDoS cuadrático — ver AGENTS.md
+        // "regex-cuantificador-adyacente-a-clase-que-lo-solapa" y el mismo
+        // patrón ya corregido en cli/src/commands/evidence/index.ts marker().
+        const m = /^##\s+(.*)$/.exec(line);
+        // Un `##` seguido solo de espacio (grupo capturado vacío tras el trim)
+        // NO es un heading real: la regex vieja `(.+?)\s*$` exigía al menos un
+        // carácter no-blanco antes del `\s*$` final, así que una línea así
+        // nunca matcheaba como sección. `(.*)` sí puede capturar cero
+        // caracteres — sin este guard, una línea "## " perdida dentro de p.ej.
+        // `## Ruteo` abriría una sección fantasma "" y desviaría las filas de
+        // tabla reales hacia ella en silencio (ver finding-1 del reviewer).
+        if (m && m[1].trim() !== '') {
+            const heading = m[1].trim();
+            if (seen.has(heading)) {
+                problems.push(`duplicate section heading "## ${heading}"`);
+                current = null; // deja de recolectar: no fusionar con la primera aparición
+                continue;
+            }
+            seen.add(heading);
+            out.set(heading, []);
+            current = heading;
+            continue;
+        }
+        if (current !== null)
+            out.get(current).push(line);
+    }
+    return out;
+}
+function paragraph(lines) {
+    return lines.map((l) => l.trim()).filter((l) => l !== '').join(' ');
+}
+function parseStructure(lines, problems) {
+    const subgoals = [];
+    const seenSg = new Set();
+    for (const raw of lines) {
+        if (raw.trim() === '')
+            continue;
+        const sg = SG.exec(raw);
+        if (sg) {
+            // Un SG-# repetido produciría dos entradas con el mismo `id` en
+            // `structure` — inconsistente para cualquier consumidor que
+            // indexe por id. Mismo patrón `problems` que el resto del archivo.
+            if (seenSg.has(sg[1])) {
+                problems.push(`duplicate "Estructura" id ${sg[1]}`);
+                continue;
+            }
+            seenSg.add(sg[1]);
+            const text = sg[2].trim();
+            if (text.length > MAX_ITEM_LENGTH) {
+                problems.push(`"${sg[1]}" text must be at most ${MAX_ITEM_LENGTH} characters`);
+                continue;
+            }
+            subgoals.push({ id: sg[1], text, operations: [] });
+            continue;
+        }
+        const op = OP.exec(raw);
+        if (!op) {
+            problems.push(`"Estructura" line is neither an SG-# nor an OP-#: ${JSON.stringify(raw.trim().slice(0, 80))}`);
+            continue;
+        }
+        const owner = subgoals[subgoals.length - 1];
+        // El prefijo numérico de la operación DEBE coincidir con su subobjetivo:
+        // sin esto, OP-9.1 colgando de SG-2 pasaría y la jerarquía HTA sería una
+        // ilusión tipográfica.
+        if (!owner) {
+            problems.push(`${op[1]} appears before any SG-#`);
+            continue;
+        }
+        if (`SG-${op[2]}` !== owner.id) {
+            problems.push(`${op[1]} does not belong to ${owner.id}`);
+            continue;
+        }
+        const opText = op[3].trim();
+        if (opText.length > MAX_ITEM_LENGTH) {
+            problems.push(`"${op[1]}" text must be at most ${MAX_ITEM_LENGTH} characters`);
+            continue;
+        }
+        owner.operations.push({ id: op[1], text: opText });
+    }
+    if (subgoals.length === 0)
+        problems.push('"Estructura" declares no SG-#');
+    return subgoals;
+}
+function parseRouting(lines, problems) {
+    const rows = [];
+    const tableLines = lines.map((l) => l.trim()).filter((l) => l.startsWith('|'));
+    for (const [index, line] of tableLines.entries()) {
+        // `| a | b |` -> ['a','b']: se descartan los extremos vacíos que deja el
+        // split, no las celdas internas vacías — la columna "Estado requerido"
+        // vacía es WCP18 "sin hito", un valor con significado.
+        const cells = line.split('|').slice(1, -1).map((c) => c.trim());
+        if (index === 0) {
+            if (cells.length !== 4)
+                problems.push('"Ruteo" header must have exactly 4 columns');
+            continue;
+        }
+        // Separador GFM: dashes puros (`|---|`) o con colons de alineación
+        // (`|:---|:---:|`). Se prueba celda por celda con un regex anclado y
+        // sin cuantificadores anidados (`^:?-+:?$`) — lineal, sin riesgo ReDoS
+        // — y se exige que cada celda tenga al menos un `-` real para no
+        // aceptar una fila de solo colons/vacíos como falso separador.
+        if (cells.length > 0 && cells.every((c) => /^:?-+:?$/.test(c)))
+            continue; // separador
+        if (cells.length !== 4) {
+            problems.push(`"Ruteo" row ${index} must have exactly 4 columns, found ${cells.length}`);
+            continue;
+        }
+        if (cells[0] === '' || cells[2] === '' || cells[3] === '') {
+            problems.push(`"Ruteo" row ${index} needs Cuándo, Va a and Termina en`);
+            continue;
+        }
+        if (cells.some((c) => c.length > MAX_ITEM_LENGTH)) {
+            problems.push(`"Ruteo" row ${index} has a cell longer than ${MAX_ITEM_LENGTH} characters`);
+            continue;
+        }
+        rows.push({ when: cells[0], requiredState: cells[1], goesTo: cells[2], endsAt: cells[3] });
+    }
+    if (rows.length === 0)
+        problems.push('"Ruteo" declares no transitions');
+    return rows;
+}
+function parseProcessBody(source, file) {
+    const problems = [];
+    const sections = splitSections(source, problems);
+    for (const heading of REQUIRED) {
+        if (!sections.has(heading))
+            problems.push(`missing required section "## ${heading}"`);
+    }
+    if (problems.length > 0)
+        return { diagnostics: [`${file}: invalid process model body — ${problems.join('; ')}`] };
+    const structure = parseStructure(sections.get('Estructura'), problems);
+    const routing = parseRouting(sections.get('Ruteo'), problems);
+    const objective = paragraph(sections.get('Objetivo'));
+    const appliesWhen = paragraph(sections.get('Cuándo aplica'));
+    const termination = paragraph(sections.get('Terminación'));
+    const unverified = sections.get('Sin verificar')
+        .map((l) => l.trim()).filter((l) => l.startsWith('- ')).map((l) => l.slice(2).trim());
+    for (const [label, value] of [['Objetivo', objective], ['Cuándo aplica', appliesWhen], ['Terminación', termination]]) {
+        if (value === '')
+            problems.push(`"${label}" is empty`);
+        else if (value.length > MAX_SECTION_LENGTH)
+            problems.push(`"${label}" must be at most ${MAX_SECTION_LENGTH} characters`);
+    }
+    for (const [index, entry] of unverified.entries()) {
+        if (entry.length > MAX_ITEM_LENGTH)
+            problems.push(`"Sin verificar" entry ${index} must be at most ${MAX_ITEM_LENGTH} characters`);
+    }
+    if (problems.length > 0)
+        return { diagnostics: [`${file}: invalid process model body — ${problems.join('; ')}`] };
+    return { model: { objective, appliesWhen, structure, routing, termination, unverified }, diagnostics: [] };
+}