agentic-workflow-manager 9.10.2 → 9.11.1

package/dist/src/commands/plan/index.js

@@ -14,6 +14,7 @@ const config_1 = require("../../utils/config");
 const providers_1 = require("../../providers");
 const registries_1 = require("../../core/registries");
 const registry_contracts_1 = require("../../core/admission/registry-contracts");
+const adapter_1 = require("../../core/journal/adapter");
 const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const store_1 = require("../../core/journal/store");
@@ -262,6 +263,7 @@ function registerPlanCommand(program, deps = { validatePlanFile: validate_1.vali
         .option('--runtime-kind <kind>', 'routing runtime kind for compact v2')
         .option('--runtime-version <version>', 'routing runtime version for compact v2')
         .option('--account-scope-digest <sha>', 'routing account scope digest for compact v2')
+        .option('--controller-autonomy <posture>', 'unattended controller autonomy posture (#168)')
         .option('--json', 'emit one stable JSON report')
         .action(async (planPath, options) => {
         assertText(planPath, 'plan path');
@@ -294,7 +296,9 @@ function registerPlanCommand(program, deps = { validatePlanFile: validate_1.vali
         const readRouting = () => { if (!options.runtimeKind || !options.runtimeVersion || !options.accountScopeDigest)
             return undefined; const runtime = (0, capabilities_1.validateRuntimeKey)({ target: options.provider, kind: options.runtimeKind, version: options.runtimeVersion, accountScopeDigest: options.accountScopeDigest }); const policy = (deps.readEffectivePolicy ?? store_2.readEffectivePolicy)(options.cwd); const at = deps.routingNow?.() ?? new Date(); if (!(at instanceof Date) || !Number.isFinite(at.getTime()))
             throw new Error('routingNow must return a finite Date'); const capabilities = (deps.readCapabilities ?? capabilities_1.readCapabilities)(runtime, at); return { runtime, policy: policy.state === 'approved' ? policy.policy : undefined, capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined, now: at }; };
-        const report = await (0, registry_contracts_1.admitRegistryPlan)({ plan: planReport, provider: options.provider, cwd: options.cwd, enabledAgents, executionMode, planPath: normalizedPlanPath, ...journal, requireCurrent: options.requireCurrent === true, verifySensors: options.verifySensors === true }, { admitPlan: admission, listRegistries: registryInventory, checkCurrentness: currentnessCheck, runSensors: sensorRun, readRouting });
+        if (options.controllerAutonomy !== undefined && !(0, adapter_1.isControllerAutonomy)(options.controllerAutonomy))
+            throw new Error(`--controller-autonomy is invalid: ${options.controllerAutonomy} (valid: ${adapter_1.CONTROLLER_AUTONOMIES.join(', ')})`);
+        const report = await (0, registry_contracts_1.admitRegistryPlan)({ plan: planReport, provider: options.provider, cwd: options.cwd, enabledAgents, executionMode, planPath: normalizedPlanPath, ...journal, requireCurrent: options.requireCurrent === true, verifySensors: options.verifySensors === true, ...(options.controllerAutonomy === undefined ? {} : { controllerAutonomy: options.controllerAutonomy }) }, { admitPlan: admission, listRegistries: registryInventory, checkCurrentness: currentnessCheck, runSensors: sensorRun, readRouting });
         process.stdout.write(admissionOutput(report, options.json === true));
         if (report.state !== 'admitted')
             process.exitCode = 2;

package/dist/src/commands/watch/generations.js

@@ -105,7 +105,7 @@ function recoveryAction(action) {
 /** Persiste el intent completo ANTES de delegarlo al wrapper. El wrapper usa
  * claim exclusivo por (controllerJobId, spawnNonce), por lo que reemitir este
  * mismo intent tras un crash nunca lanza dos controllers. */
-function launchControllerGeneration(repoRoot, branch, provider, action, spawner = (0, runner_1.defaultWrapperSpawner)()) {
+function launchControllerGeneration(repoRoot, branch, provider, action, spawner = (0, runner_1.defaultWrapperSpawner)(), autonomy) {
     const requestedAction = recoveryAction(action);
     const s = requireState(repoRoot, branch);
     const gen = activeGeneration(s);
@@ -118,7 +118,7 @@ function launchControllerGeneration(repoRoot, branch, provider, action, spawner
     gen.spawnNonce = gen.spawnNonce ?? crypto_1.default.randomBytes(8).toString('hex');
     gen.provider = gen.provider ?? provider;
     gen.resumeAction = gen.resumeAction ?? requestedAction;
-    const argv = adapter.launchArgv(promptForGeneration(gen));
+    const argv = adapter.launchArgv(promptForGeneration(gen), autonomy);
     const digest = (0, process_1.argvDigest)(argv);
     if (gen.launchArgvDigest !== undefined && gen.launchArgvDigest !== digest)
         throw new Error('controller argv cambio: no se reemite el mismo nonce con otro comando');
@@ -182,7 +182,7 @@ function controllerGenerationHasUnresolvedClaim(repoRoot, branch, gen) {
 /** Recupera tanto crash-before-spawn como crash-after-spawn-before-journal.
  * Claim sin identidad queda ambiguo y se conserva bajo custodia tras la gracia;
  * nunca se resuelve lanzando otro token/nonce a ciegas. */
-function ensureControllerGeneration(repoRoot, branch, provider, action, spawner, ambiguityGraceMs) {
+function ensureControllerGeneration(repoRoot, branch, provider, action, spawner, ambiguityGraceMs, autonomy) {
     const requestedAction = recoveryAction(action);
     if (collectControllerGeneration(repoRoot, branch))
         return;
@@ -194,7 +194,7 @@ function ensureControllerGeneration(repoRoot, branch, provider, action, spawner,
     if (gen.processRef !== undefined || gen.wrapperRef !== undefined)
         return;
     if (gen.controllerJobId === undefined || gen.spawnNonce === undefined) {
-        launchControllerGeneration(repoRoot, branch, provider, requestedAction, spawner);
+        launchControllerGeneration(repoRoot, branch, provider, requestedAction, spawner, autonomy);
         return;
     }
     const logs = (0, paths_1.logsDir)(repoRoot, branch);
@@ -217,7 +217,7 @@ function ensureControllerGeneration(repoRoot, branch, provider, action, spawner,
     // El intent ya estaba durable pero el spawn no ocurrio: es seguro reemitir
     // exactamente el mismo nonce. Si el wrapper original solo estaba demorado,
     // su claim wx arbitra cual de ambos ejecuta.
-    launchControllerGeneration(repoRoot, branch, gen.provider ?? provider, gen.resumeAction ?? requestedAction, spawner);
+    launchControllerGeneration(repoRoot, branch, gen.provider ?? provider, gen.resumeAction ?? requestedAction, spawner, autonomy);
 }
 /** Custodia (R4.5): ciclo BLOCKED con razon auditada. QUIEN NO HACE NADA:
  *  no mata, no relanza, no libera lock — el loop sigue vivo auditando. */

package/dist/src/commands/watch/index.js

@@ -7,8 +7,10 @@ exports.registerWatchCommand = registerWatchCommand;
 const child_process_1 = require("child_process");
 const init_1 = require("./init");
 const supervisor_1 = require("./supervisor");
-const process_1 = require("../../core/journal/process");
+const capabilities_1 = require("../../core/model-policy/capabilities");
 const adapter_1 = require("../../core/journal/adapter");
+const process_1 = require("../../core/journal/process");
+const adapter_2 = require("../../core/journal/adapter");
 const context_1 = require("../../core/tracks/context");
 const concurrency_1 = require("../../core/tracks/concurrency");
 const validate_1 = require("../../core/plan/validate");
@@ -44,10 +46,19 @@ function registerWatchCommand(program) {
         .description('supervisor durable: ejecuta jobs, releva controladores caidos, nunca mata trabajo vivo')
         .option('--init', 'bootstrap: crea el journal de la rama actual, detecta verificadores y sale')
         .option('--plan <path>', 'plan compacto desatendido que se vincula al inicializar')
-        .option('--provider <p>', adapter_1.WATCH_PROVIDERS.join(' | '), 'codex')
+        .option('--provider <p>', adapter_2.WATCH_PROVIDERS.join(' | '), 'codex')
         .option('--heartbeat-timeout <min>', 'minutos de silencio de heartbeat', '5')
         .option('--activity-window <min>', 'minutos extra sin actividad de proceso', '10')
         .option('--max-parallel <n>', 'tope de tracks ACTIVE simultáneos (default: derivado del benchmark empaquetado)')
+        // #166: la admisión compact v2 exige la identidad de runtime. Se declara
+        // acá, igual que en `plan admit`/`plan resolve`: el operador la asserta y
+        // el receipt debe coincidir, nunca al revés.
+        .option('--runtime-kind <kind>', 'identidad de runtime para despacho compact v2')
+        .option('--runtime-version <version>', 'identidad de runtime para despacho compact v2')
+        .option('--account-scope-digest <sha>', 'identidad de runtime para despacho compact v2')
+        // #168: sin esto el controller desatendido arranca y se cuelga en la
+        // primera herramienta pidiendo aprobación. Se declara, no se adivina.
+        .option('--controller-autonomy <postura>', `postura del controller desatendido (${adapter_1.CONTROLLER_AUTONOMIES.join(' | ')})`)
         .action(async (opts) => {
         const repo = process.cwd();
         const branch = currentBranch(repo);
@@ -86,8 +97,37 @@ function registerWatchCommand(program) {
         // desconocido, pero recien en el primer tick — con el journal escrito y el
         // lock tomado, y el error saliendo del supervisor en vez de del flag que lo
         // causo. Un typo en `--provider` tiene que costar un mensaje, no un ciclo.
-        if (!(0, adapter_1.isWatchProvider)(opts.provider)) {
-            process.stderr.write(`--provider invalido: ${String(opts.provider)} (validos: ${adapter_1.WATCH_PROVIDERS.join(', ')})\n`);
+        if (!(0, adapter_2.isWatchProvider)(opts.provider)) {
+            process.stderr.write(`--provider invalido: ${String(opts.provider)} (validos: ${adapter_2.WATCH_PROVIDERS.join(', ')})\n`);
+            process.exitCode = 1;
+            return;
+        }
+        // Los tres viajan juntos o ninguno: una identidad parcial produciría
+        // exactamente el bloqueo silencioso que este flag existe para evitar.
+        const identityFlags = [['--runtime-kind', opts.runtimeKind], ['--runtime-version', opts.runtimeVersion], ['--account-scope-digest', opts.accountScopeDigest]];
+        const suppliedIdentity = identityFlags.filter(([, value]) => value !== undefined);
+        if (suppliedIdentity.length !== 0 && suppliedIdentity.length !== identityFlags.length) {
+            const missing = identityFlags.filter(([, value]) => value === undefined).map(([flag]) => flag);
+            process.stderr.write(`la identidad de runtime requiere los tres flags juntos; faltan: ${missing.join(', ')}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        let routingIdentity;
+        if (suppliedIdentity.length === identityFlags.length) {
+            try {
+                // Valida acá, antes de tomar el lock: un digest mal formado
+                // tiene que costar un mensaje, no un ciclo de custodia.
+                (0, capabilities_1.validateRuntimeKey)({ target: opts.provider, kind: opts.runtimeKind, version: opts.runtimeVersion, accountScopeDigest: opts.accountScopeDigest });
+            }
+            catch (e) {
+                process.stderr.write(`${e.message}\n`);
+                process.exitCode = 1;
+                return;
+            }
+            routingIdentity = { kind: String(opts.runtimeKind), version: String(opts.runtimeVersion), accountScopeDigest: String(opts.accountScopeDigest) };
+        }
+        if (opts.controllerAutonomy !== undefined && !(0, adapter_1.isControllerAutonomy)(opts.controllerAutonomy)) {
+            process.stderr.write(`--controller-autonomy invalido: ${String(opts.controllerAutonomy)} (validos: ${adapter_1.CONTROLLER_AUTONOMIES.join(', ')})\n`);
             process.exitCode = 1;
             return;
         }
@@ -97,6 +137,8 @@ function registerWatchCommand(program) {
             heartbeatTimeoutMs: minutes('--heartbeat-timeout', opts.heartbeatTimeout),
             activityWindowMs: minutes('--activity-window', opts.activityWindow),
             maxParallelTracks: opts.maxParallel !== undefined ? (0, concurrency_1.parseMaxParallel)(opts.maxParallel) : (0, concurrency_1.loadDefaultParallelism)(),
+            ...(routingIdentity === undefined ? {} : { routingIdentity }),
+            ...(opts.controllerAutonomy === undefined ? {} : { controllerAutonomy: opts.controllerAutonomy }),
         };
         process.stdout.write(`awm watch: supervisor activo (${cfg.provider}) — Ctrl-C para terminar\n`);
         await (0, supervisor_1.runSupervisorLoop)(repo, branch, cfg);

package/dist/src/commands/watch/supervisor.js

@@ -1,12 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Supervisor = exports.MAX_SENSOR_DEFERRALS = exports.DEFAULT_SUPERVISOR_CONFIG = void 0;
+exports.routingFacts = routingFacts;
+exports.defaultDispatchAdmission = defaultDispatchAdmission;
+exports.admissionForConfig = admissionForConfig;
 exports.runSupervisorLoop = runSupervisorLoop;
 const store_1 = require("../../core/journal/store");
 const fingerprint_1 = require("../../core/journal/fingerprint");
 const validate_1 = require("../../core/plan/validate");
 const registry_contracts_1 = require("../../core/admission/registry-contracts");
 const config_1 = require("../../utils/config");
+const store_2 = require("../../core/model-policy/store");
+const capabilities_1 = require("../../core/model-policy/capabilities");
 const adapter_1 = require("../../core/journal/adapter");
 const process_1 = require("../../core/journal/process");
 const gate_1 = require("../job/gate");
@@ -16,7 +21,30 @@ const apply_1 = require("./apply");
 const runner_1 = require("./runner");
 const tracks_1 = require("./tracks");
 const generations_1 = require("./generations");
-function defaultDispatchAdmission(repoRoot, branch, provider) {
+/** #166: compact v2 admission requires the runtime identity, and the supervisor
+ *  never supplied it — so `awm watch` blocked on every tick with
+ *  ADMISSION_ROUTING_FACTS_REQUIRED even with every other gate green.
+ *
+ *  The direction of attestation is the one `plan admit`/`plan resolve` already
+ *  use, and is the reason the identity is a flag rather than something derived:
+ *  the OPERATOR asserts the runtime, and the receipt reader is keyed BY that
+ *  assertion. Picking a runtime by hunting for a receipt would let whatever
+ *  receipt happens to be on disk decide what the supervisor claims to run on. */
+function routingFacts(provider, identity, cwd, deps = {}) {
+    if (identity === undefined)
+        return undefined;
+    const runtime = (0, capabilities_1.validateRuntimeKey)({ target: provider, kind: identity.kind, version: identity.version, accountScopeDigest: identity.accountScopeDigest });
+    const at = deps.now?.() ?? new Date();
+    if (!(at instanceof Date) || !Number.isFinite(at.getTime()))
+        throw new Error('routing observation time must be a finite Date');
+    const policy = (deps.readEffectivePolicy ?? store_2.readEffectivePolicy)(cwd);
+    const capabilities = (deps.readCapabilities ?? capabilities_1.readCapabilities)(runtime, at);
+    // Fail open on neither: an unapproved policy or a non-current receipt is
+    // withheld, and admission blocks on the absence rather than on a stale fact.
+    return { runtime, policy: policy.state === 'approved' ? policy.policy : undefined,
+        capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined, now: at };
+}
+function defaultDispatchAdmission(repoRoot, branch, provider, identity, deps = {}, autonomy) {
     return async () => {
         const observed = (0, store_1.readJournal)(repoRoot, branch);
         const binding = observed.state?.schema === 2 ? observed.state.planBinding : undefined;
@@ -25,9 +53,11 @@ function defaultDispatchAdmission(repoRoot, branch, provider) {
         }
         const plan = (0, validate_1.validatePlanFile)(binding.path, repoRoot);
         const preferences = (0, config_1.readPreferences)();
-        return (0, registry_contracts_1.admitRegistryPlan)({ plan, provider, cwd: repoRoot, enabledAgents: preferences.enabledAgents,
+        return (deps.admit ?? registry_contracts_1.admitRegistryPlan)({ plan, provider, cwd: repoRoot, enabledAgents: preferences.enabledAgents,
             executionMode: 'desatendido', requireCurrent: true, verifySensors: true,
-            journalState: observed.state, journalCorrupt: observed.corrupt, planPath: binding.path });
+            journalState: observed.state, journalCorrupt: observed.corrupt, planPath: binding.path,
+            routing: routingFacts(provider, identity, repoRoot, deps),
+            controllerAutonomy: autonomy });
     };
 }
 /** R7/C3/C4 (Task 12) + fix post-review #2 (re-derivado desde cero tras
@@ -120,6 +150,11 @@ exports.DEFAULT_SUPERVISOR_CONFIG = {
     jobStallObservationMs: 5 * 60000, // R3.5 default: mismo orden de magnitud que heartbeatTimeoutMs, concern independiente
     maxParallelTracks: 1, // overridden en tiempo de ejecución con loadDefaultParallelism() (watch/index.ts)
 };
+/** Single place the supervisor's config becomes its admission, so the runtime
+ *  identity cannot be dropped silently between the flag and the gate (#166). */
+function admissionForConfig(repoRoot, branch, cfg, deps = {}) {
+    return defaultDispatchAdmission(repoRoot, branch, cfg.provider, cfg.routingIdentity, deps, cfg.controllerAutonomy);
+}
 // 'frozen' (R5.2/R6.3, Task 10): SOLO puede ocurrir en el journal de un
 // TRACK individual (nunca en el del plan) — el track terminó, con las 6
 // observaciones demostrables (cero jobs vivos, gate local verde, worktree
@@ -165,7 +200,7 @@ class Supervisor {
     lastActivity = null;
     lastGenerationToken = null;
     trackRuntime;
-    constructor(repoRoot, branch, cfg, spawner, trackRuntime, dispatchAdmission = defaultDispatchAdmission(repoRoot, branch, cfg.provider)) {
+    constructor(repoRoot, branch, cfg, spawner, trackRuntime, dispatchAdmission = admissionForConfig(repoRoot, branch, cfg)) {
         this.repoRoot = repoRoot;
         this.branch = branch;
         this.cfg = cfg;
@@ -189,7 +224,7 @@ class Supervisor {
             return 'custody';
         }
         try {
-            (0, generations_1.ensureControllerGeneration)(this.repoRoot, this.branch, this.cfg.provider, action, this.spawner, this.cfg.reconcileGraceMs);
+            (0, generations_1.ensureControllerGeneration)(this.repoRoot, this.branch, this.cfg.provider, action, this.spawner, this.cfg.reconcileGraceMs, this.cfg.controllerAutonomy);
             return 'ok';
         }
         catch (error) {

package/dist/src/core/admission/index.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PROVIDER_EXECUTION_CAPABILITIES = void 0;
+exports.unattendedCapabilities = unattendedCapabilities;
 exports.sanitizeAdmissionReport = sanitizeAdmissionReport;
 exports.admitPlan = admitPlan;
 const providers_1 = require("../../providers");
@@ -11,7 +12,13 @@ const UNKNOWN = {
     artifactDelivery: 'unverified', interactiveExecution: 'unverified', unattendedController: 'unverified', nativeSubagents: 'unverified',
     modelOverride: 'unverified', effortOverride: 'unverified', observedModelEvidence: 'unverified', durableResume: 'unverified',
 };
-/** Deliberate R1 evidence table. Artifact delivery is never used as execution evidence. */
+/** Deliberate R1 evidence table. Artifact delivery is never used as execution evidence.
+ *
+ *  `unattendedController: 'supported'` describes the supervisor<->controller
+ *  CONTRACT, which D-016 certifies with a scripted controller. It does NOT say a
+ *  real agent runtime can occupy the role — D-016 marks that explicitly
+ *  unverified. Read this table through `unattendedCapabilities()`, neverdirectly:
+ *  the raw row overstates what has been established (#168). */
 exports.PROVIDER_EXECUTION_CAPABILITIES = {
     antigravity: { ...UNKNOWN },
     opencode: { ...UNKNOWN },
@@ -20,6 +27,21 @@ exports.PROVIDER_EXECUTION_CAPABILITIES = {
     cursor: { ...UNKNOWN },
     copilot: { ...UNKNOWN },
 };
+/** #168: the controller can only act if it was launched with an autonomy
+ *  posture. That posture is an OPERATOR ASSERTION, exactly like
+ *  `--expected-digest` or the compact v2 runtime identity: AWM cannot verify it
+ *  independently (a codex operator may carry approval policy in their own
+ *  config), so it refuses to guess rather than refusing the operator. Without a
+ *  declaration `unattendedController` degrades to 'unverified' — which is what
+ *  D-016 already said, and what the raw table contradicted. */
+function unattendedCapabilities(provider, autonomy) {
+    const base = exports.PROVIDER_EXECUTION_CAPABILITIES[provider];
+    if (base.unattendedController !== 'supported')
+        return base;
+    if (autonomy !== undefined)
+        return base;
+    return { ...base, unattendedController: 'unverified' };
+}
 const MAX_DIAGNOSTICS = 20;
 const MAX_DIAGNOSTIC_LENGTH = 4096;
 function safe(value) { return value.replace(/[\u0000-\u001F\u007F-\u009F]/g, character => `\\u${character.codePointAt(0).toString(16).padStart(4, '0')}`).slice(0, MAX_DIAGNOSTIC_LENGTH); }
@@ -190,10 +212,18 @@ async function admitPlan(input) {
         const journal = journalStatus(input, plan);
         if (journal !== 'current')
             return blocked(input, [diagnostic('ADMISSION_JOURNAL_BINDING_REQUIRED', 'Unattended execution requires a healthy schema-2 journal binding for this exact plan; run watch --init --plan.')], { planDigest: plan.planDigest, provider, executionMode: mode, journal, currentness: input.requireCurrent ? 'current' : 'not-checked', sensors: input.verifySensors ? 'pass' : 'not-required' });
-        const capabilities = exports.PROVIDER_EXECUTION_CAPABILITIES[provider];
+        const capabilities = unattendedCapabilities(provider, input.controllerAutonomy);
         const resolution = { outcome: capabilities.unattendedController === 'supported' ? 'native' : 'blocked', provider, capabilities, evidenceVersion: 'r1-v1', diagnostics: [] };
-        if (resolution.outcome === 'blocked')
-            return blocked(input, [diagnostic('ADMISSION_CAPABILITY_UNVERIFIED', `Provider ${provider} has no verified unattended execution capability.`)], { planDigest: plan.planDigest, provider, executionMode: mode, journal, currentness: input.requireCurrent ? 'current' : 'not-checked', sensors: input.verifySensors ? 'pass' : 'not-required', capabilityResolution: resolution });
+        if (resolution.outcome === 'blocked') {
+            // Distinguir las dos razones: el provider nunca tuvo la capacidad,
+            // o el operador no declaro postura. Un solo diagnostico las
+            // confundiria y el operador no sabria si le falta una flag o si el
+            // provider directamente no sirve (#168).
+            const reason = exports.PROVIDER_EXECUTION_CAPABILITIES[provider].unattendedController !== 'supported'
+                ? diagnostic('ADMISSION_CAPABILITY_UNVERIFIED', `Provider ${provider} has no verified unattended execution capability.`)
+                : diagnostic('ADMISSION_CONTROLLER_AUTONOMY_REQUIRED', `Unattended dispatch on ${provider} requires an explicit controller autonomy posture; without it the controller blocks on its first tool call.`);
+            return blocked(input, [reason], { planDigest: plan.planDigest, provider, executionMode: mode, journal, currentness: input.requireCurrent ? 'current' : 'not-checked', sensors: input.verifySensors ? 'pass' : 'not-required', capabilityResolution: resolution });
+        }
         return completeAdmission(input, plan, provider, mode, journal, input.requireCurrent ? 'current' : 'not-checked', input.verifySensors ? 'pass' : 'not-required', resolution);
     }
     const capabilities = exports.PROVIDER_EXECUTION_CAPABILITIES[provider];

package/dist/src/core/journal/adapter.js

@@ -1,22 +1,41 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONTROLLER_ARGV_ENV = exports.WATCH_PROVIDERS = void 0;
+exports.CONTROLLER_ARGV_ENV = exports.WATCH_PROVIDERS = exports.CONTROLLER_AUTONOMIES = void 0;
+exports.isControllerAutonomy = isControllerAutonomy;
 exports.isWatchProvider = isWatchProvider;
+exports.controllerAutonomyMapping = controllerAutonomyMapping;
 exports.adapterFor = adapterFor;
 const process_1 = require("./process");
+exports.CONTROLLER_AUTONOMIES = ['approval-free'];
+function isControllerAutonomy(value) {
+    return typeof value === 'string' && exports.CONTROLLER_AUTONOMIES.includes(value);
+}
 const RESUME_PROMPT_PREFIX = 'Sos el orquestador SDD de este repo. Corre `awm job reconcile` y ejecuta ';
 function baseSafeToReplace(ref) {
     return (0, process_1.refIsAlive)(ref) ? 'indeterminate' : 'safe';
 }
+// `codex exec` tiene flags de aprobacion (`-a/--ask-for-approval never`,
+// `-s/--sandbox`), pero la evidencia R0 capturo el `--help` de `codex`, NO el
+// del subcomando `exec`, asi que no consta donde van ni como se llaman ahi.
+// Declarar el mapeo como 'unverified' y bloquear es honesto; adivinar la flag
+// dejaria al controller sin arrancar, que es peor que el stall que arreglamos.
 const codexAdapter = {
     provider: 'codex',
     launchArgv: (resumePrompt) => ['codex', 'exec', `${RESUME_PROMPT_PREFIX}${resumePrompt}`],
+    autonomyMapping: 'unverified',
     activity: process_1.activitySnapshot,
     safeToReplace: baseSafeToReplace,
 };
+// Leido del `--help` de claude 2.1.278:
+//   --permission-mode <mode>  (choices: "acceptEdits", "auto", "bypassPermissions",
+//                              "manual", "dontAsk", "plan")
+// Las flags van ANTES de `-p`, que toma el prompt como posicional.
 const claudeAdapter = {
     provider: 'claude-code',
-    launchArgv: (resumePrompt) => ['claude', '-p', `${RESUME_PROMPT_PREFIX}${resumePrompt}`],
+    launchArgv: (resumePrompt, autonomy) => ['claude',
+        ...(autonomy === 'approval-free' ? ['--permission-mode', 'bypassPermissions'] : []),
+        '-p', `${RESUME_PROMPT_PREFIX}${resumePrompt}`],
+    autonomyMapping: 'verified',
     activity: process_1.activitySnapshot,
     safeToReplace: baseSafeToReplace,
 };
@@ -63,6 +82,13 @@ function controllerArgvOverride() {
     }
     return parsed;
 }
+/** Lookup PURO del mapeo de postura por provider: sin env, sin throw, para que
+ *  la admision pueda preguntarlo sin construir un adapter ni honrar overrides. */
+function controllerAutonomyMapping(provider) {
+    return provider === 'claude-code' ? claudeAdapter.autonomyMapping
+        : provider === 'codex' ? codexAdapter.autonomyMapping
+            : 'unverified';
+}
 function adapterFor(provider) {
     const base = provider === 'codex' ? codexAdapter
         : provider === 'claude-code' ? claudeAdapter
@@ -72,5 +98,8 @@ function adapterFor(provider) {
     const override = controllerArgvOverride();
     if (override === null)
         return base;
+    // El operador es dueno del argv completo: no se le inyecta la postura
+    // (duplicaria o contradiria sus propias flags). Sigue necesitando
+    // declararla para la admision, que es una afirmacion, no un argv.
     return { ...base, launchArgv: (resumePrompt) => [...override, resumePrompt] };
 }

package/dist/tests/commands/plan/index.test.js

@@ -384,7 +384,7 @@ describe('plan admit Commander wiring', () => {
             program.exitOverride();
             program.configureOutput({ writeErr: () => undefined });
             (0, plan_1.registerPlanCommand)(program, { validatePlanFile: () => valid, admitPlan: admit, readPreferences: () => ({ defaultAgent: 'codex', enabledAgents: ['codex'], installMethod: 'symlink', defaultScope: 'local' }) });
-            await program.parseAsync(['node', 'awm', 'plan', 'admit', 'plans/current.md', '--provider', 'codex', '--cwd', root, '--execution-mode', 'desatendido', '--json']);
+            await program.parseAsync(['node', 'awm', 'plan', 'admit', 'plans/current.md', '--provider', 'codex', '--cwd', root, '--execution-mode', 'desatendido', '--controller-autonomy', 'approval-free', '--json']);
             expect(admit).toHaveBeenCalledWith(expect.objectContaining({ executionMode: 'desatendido', planPath: 'plans/current.md', journalCorrupt: false, journalState: expect.objectContaining({ schema: 2, planBinding: expect.objectContaining({ digest: valid.planDigest }) }) }));
         }
         finally {

package/dist/tests/commands/watch/dispatch-routing-identity.test.js

@@ -0,0 +1,198 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const paths_1 = require("../../../src/core/journal/paths");
+const git_fixture_1 = require("../../helpers/git-fixture");
+const supervisor_1 = require("../../../src/commands/watch/supervisor");
+const init_1 = require("../../../src/commands/watch/init");
+const validate_1 = require("../../../src/core/plan/validate");
+// #166: the supervisor's own admission must carry the runtime identity that
+// compact v2 demands. Every other gate could be green and dispatch still blocks
+// with ADMISSION_ROUTING_FACTS_REQUIRED, because these three fields were never
+// supplied. The identity is operator-asserted (as on `plan admit`/`plan resolve`)
+// and the receipt must match it — never the other way round.
+const DIGEST = 'a'.repeat(64);
+function receiptFor(runtime, now) {
+    return {
+        schema: 'routing-capabilities/v1', runtime,
+        recordedAt: new Date(now - 60_000).toISOString(),
+        expiresAt: new Date(now + 3_600_000).toISOString(),
+        capabilities: { artifactDelivery: 'supported', interactiveExecution: 'supported', unattendedController: 'supported',
+            nativeSubagents: 'supported', modelOverride: 'supported', effortOverride: 'unsupported',
+            observedModelEvidence: 'supported', durableResume: 'supported' },
+        availableSelections: [{ selector: { kind: 'model', id: 'test-model' }, effort: { kind: 'runtime-default' } }],
+        runtimeDefaultSelection: { selector: { kind: 'model', id: 'test-model' }, effort: { kind: 'runtime-default' } },
+        evidence: [], approval: { approvalId: 'approval-1', snapshotDigest: DIGEST },
+    };
+}
+describe('unattended dispatch routing identity (#166)', () => {
+    let cwd;
+    beforeEach(() => { cwd = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-dispatch-routing-')); });
+    afterEach(() => { fs_1.default.rmSync(cwd, { recursive: true, force: true }); });
+    test('asserts the operator-supplied runtime and attaches the matching receipt', () => {
+        const now = Date.now();
+        const seen = [];
+        const facts = (0, supervisor_1.routingFacts)('claude-code', { kind: 'native', version: '2.0.0', accountScopeDigest: DIGEST }, cwd, {
+            now: () => new Date(now),
+            readEffectivePolicy: () => ({ state: 'absent' }),
+            readCapabilities: (runtime) => { seen.push(runtime); return { state: 'current', receipt: receiptFor(runtime, now) }; },
+        });
+        // The identity reaches admission intact — this is the whole defect.
+        expect(facts?.runtime).toEqual({ target: 'claude-code', kind: 'native', version: '2.0.0', accountScopeDigest: DIGEST });
+        // The receipt is looked up BY the asserted runtime, not used to choose one.
+        expect(seen).toEqual([{ target: 'claude-code', kind: 'native', version: '2.0.0', accountScopeDigest: DIGEST }]);
+        expect(facts?.capabilities?.runtime).toEqual(facts?.runtime);
+        expect(facts?.now?.getTime()).toBe(now);
+    });
+    test('supplies no routing facts when the operator asserted no identity', () => {
+        expect((0, supervisor_1.routingFacts)('claude-code', undefined, cwd, {
+            readEffectivePolicy: () => { throw new Error('must not read policy without an asserted runtime'); },
+            readCapabilities: () => { throw new Error('must not read capabilities without an asserted runtime'); },
+        })).toBeUndefined();
+    });
+    test('refuses an identity that is not a valid runtime key', () => {
+        expect(() => (0, supervisor_1.routingFacts)('claude-code', { kind: 'native', version: 'not-semver', accountScopeDigest: DIGEST }, cwd, {}))
+            .toThrow(/runtime\.version/);
+        expect(() => (0, supervisor_1.routingFacts)('claude-code', { kind: 'native', version: '2.0.0', accountScopeDigest: 'short' }, cwd, {}))
+            .toThrow(/accountScopeDigest/);
+    });
+    test('withholds a stale receipt rather than admitting on it', () => {
+        const now = Date.now();
+        const facts = (0, supervisor_1.routingFacts)('claude-code', { kind: 'native', version: '2.0.0', accountScopeDigest: DIGEST }, cwd, {
+            now: () => new Date(now),
+            readEffectivePolicy: () => ({ state: 'absent' }),
+            readCapabilities: () => ({ state: 'expired' }),
+        });
+        expect(facts?.runtime).toBeDefined();
+        expect(facts?.capabilities).toBeUndefined();
+    });
+});
+describe('awm watch runtime identity flags (#166)', () => {
+    test('the compiled CLI declares the three identity flags', () => {
+        const result = (0, child_process_1.spawnSync)(process.execPath, [path_1.default.resolve(__dirname, '../../../dist/src/index.js'), 'watch', '--help'], {
+            encoding: 'utf8', env: { ...process.env, AWM_NO_UPDATE_CHECK: '1' },
+        });
+        expect(result.status).toBe(0);
+        for (const flag of ['--runtime-kind', '--runtime-version', '--account-scope-digest'])
+            expect(result.stdout).toContain(flag);
+    });
+    test('a partial identity is refused by name, before the lock is taken', () => {
+        const repo = (0, git_fixture_1.initRepo)();
+        try {
+            const result = (0, child_process_1.spawnSync)(process.execPath, [path_1.default.resolve(__dirname, '../../../dist/src/index.js'),
+                'watch', '--provider', 'claude-code', '--runtime-kind', 'native'], {
+                cwd: repo, encoding: 'utf8', env: { ...process.env, AWM_NO_UPDATE_CHECK: '1' },
+            });
+            expect(result.status).toBe(1);
+            expect(result.stderr).toContain('--runtime-version');
+            expect(result.stderr).toContain('--account-scope-digest');
+            expect(result.stderr).not.toContain('--runtime-kind');
+            // The refusal happens before any journal/lock work.
+            expect(fs_1.default.existsSync((0, paths_1.supervisorLockPath)(repo))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(repo, { recursive: true, force: true });
+        }
+    });
+    test('a malformed digest is refused by the runtime key validator, not by a custody cycle', () => {
+        const repo = (0, git_fixture_1.initRepo)();
+        try {
+            const result = (0, child_process_1.spawnSync)(process.execPath, [path_1.default.resolve(__dirname, '../../../dist/src/index.js'),
+                'watch', '--provider', 'claude-code', '--runtime-kind', 'native',
+                '--runtime-version', '2.0.0', '--account-scope-digest', 'not-a-digest'], {
+                cwd: repo, encoding: 'utf8', env: { ...process.env, AWM_NO_UPDATE_CHECK: '1' },
+            });
+            expect(result.status).toBe(1);
+            expect(result.stderr).toMatch(/accountScopeDigest/);
+            expect(fs_1.default.existsSync((0, paths_1.supervisorLockPath)(repo))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(repo, { recursive: true, force: true });
+        }
+    });
+});
+describe('the supervisor admission actually carries the identity (#166)', () => {
+    // The two suites above would both still pass if `routingFacts` were computed
+    // and then never attached to the admission call — which is precisely the shape
+    // of every defect in this chain: a test that starts one step past the gap.
+    // This one fails if the wiring is removed.
+    function boundRepo() {
+        const repo = (0, git_fixture_1.initRepo)();
+        const planPath = path_1.default.join(repo, 'docs', 'plan.md');
+        fs_1.default.mkdirSync(path_1.default.dirname(planPath), { recursive: true });
+        fs_1.default.writeFileSync(planPath, `**Modo de ejecución:** desatendido\n\n${fs_1.default.readFileSync(path_1.default.join(__dirname, '../../core/plan/fixtures/compact-slices-v2/valid.md'), 'utf8')}`);
+        fs_1.default.copyFileSync(path_1.default.join(__dirname, '../../core/plan/fixtures/compact-slices-v2/source.md'), path_1.default.join(repo, 'source.md'));
+        (0, init_1.initWatch)(repo, 'main', { path: 'docs/plan.md', report: (0, validate_1.validatePlanFile)('docs/plan.md', repo) });
+        return repo;
+    }
+    test('attaches the asserted runtime to the admission input it dispatches on', async () => {
+        const repo = boundRepo();
+        try {
+            const seen = [];
+            const admission = (0, supervisor_1.defaultDispatchAdmission)(repo, 'main', 'claude-code', { kind: 'native', version: '2.0.0', accountScopeDigest: DIGEST }, {
+                admit: (async (input) => { seen.push(input); return { state: 'admitted' }; }),
+                readEffectivePolicy: () => ({ state: 'absent' }),
+                readCapabilities: () => ({ state: 'absent' }),
+            });
+            await admission();
+            expect(seen).toHaveLength(1);
+            expect(seen[0].routing).toBeDefined();
+            expect(seen[0].routing.runtime).toEqual({ target: 'claude-code', kind: 'native', version: '2.0.0', accountScopeDigest: DIGEST });
+        }
+        finally {
+            fs_1.default.rmSync(repo, { recursive: true, force: true });
+        }
+    });
+    test('dispatches without routing facts when no identity was asserted', async () => {
+        const repo = boundRepo();
+        try {
+            const seen = [];
+            const admission = (0, supervisor_1.defaultDispatchAdmission)(repo, 'main', 'claude-code', undefined, {
+                admit: (async (input) => { seen.push(input); return { state: 'admitted' }; }),
+            });
+            await admission();
+            expect(seen).toHaveLength(1);
+            expect(seen[0].routing).toBeUndefined();
+        }
+        finally {
+            fs_1.default.rmSync(repo, { recursive: true, force: true });
+        }
+    });
+});
+describe('the config carries the identity to the admission (#166)', () => {
+    // Covers the plumbing between `awm watch --runtime-*` and the gate. Without
+    // it, `cfg.routingIdentity` could be dropped at the constructor and every
+    // other test here would still pass.
+    function boundRepo() {
+        const repo = (0, git_fixture_1.initRepo)();
+        const planPath = path_1.default.join(repo, 'docs', 'plan.md');
+        fs_1.default.mkdirSync(path_1.default.dirname(planPath), { recursive: true });
+        fs_1.default.writeFileSync(planPath, `**Modo de ejecución:** desatendido\n\n${fs_1.default.readFileSync(path_1.default.join(__dirname, '../../core/plan/fixtures/compact-slices-v2/valid.md'), 'utf8')}`);
+        fs_1.default.copyFileSync(path_1.default.join(__dirname, '../../core/plan/fixtures/compact-slices-v2/source.md'), path_1.default.join(repo, 'source.md'));
+        (0, init_1.initWatch)(repo, 'main', { path: 'docs/plan.md', report: (0, validate_1.validatePlanFile)('docs/plan.md', repo) });
+        return repo;
+    }
+    test('admissionForConfig forwards cfg.routingIdentity to the admission input', async () => {
+        const repo = boundRepo();
+        try {
+            const seen = [];
+            const cfg = { ...supervisor_1.DEFAULT_SUPERVISOR_CONFIG, provider: 'claude-code', routingIdentity: { kind: 'native', version: '2.0.0', accountScopeDigest: DIGEST } };
+            await (0, supervisor_1.admissionForConfig)(repo, 'main', cfg, {
+                admit: (async (input) => { seen.push(input); return { state: 'admitted' }; }),
+                readEffectivePolicy: () => ({ state: 'absent' }),
+                readCapabilities: () => ({ state: 'absent' }),
+            })();
+            expect(seen[0].routing?.runtime)
+                .toEqual({ target: 'claude-code', kind: 'native', version: '2.0.0', accountScopeDigest: DIGEST });
+        }
+        finally {
+            fs_1.default.rmSync(repo, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/commands/watch/e2e-crash.test.js

@@ -196,7 +196,7 @@ while true; do sleep 1; done
             throw new Error(`fixture runSensors failed: ${JSON.stringify({ sensorReport, live })}`);
         }
         expect(sensorReport).toMatchObject({ source: { kind: 'logical', registry: 'baseline' } });
-        const admission = (0, child_process_1.spawnSync)(process.execPath, [CLI, 'plan', 'admit', 'plans/fixture.md', '--provider', 'codex', '--cwd', '.', '--execution-mode', 'desatendido', '--require-current', '--verify-sensors', '--json'], { cwd: repo, env, encoding: 'utf8' });
+        const admission = (0, child_process_1.spawnSync)(process.execPath, [CLI, 'plan', 'admit', 'plans/fixture.md', '--provider', 'codex', '--cwd', '.', '--execution-mode', 'desatendido', '--controller-autonomy', 'approval-free', '--require-current', '--verify-sensors', '--json'], { cwd: repo, env, encoding: 'utf8' });
         if (admission.status !== 0)
             throw new Error(`fixture admission failed: ${admission.stdout}${admission.stderr}`);
     });
@@ -230,7 +230,7 @@ while true; do sleep 1; done
         // in-repo log would make the real currentness/admission gate reject
         // the next tick before it can collect an exited job sidecar.
         const out = fs_1.default.openSync(path_1.default.join(stubBin, `sup-${children.length}.log`), 'a');
-        const child = (0, child_process_1.spawn)(process.execPath, [CLI, 'watch', '--provider', provider], {
+        const child = (0, child_process_1.spawn)(process.execPath, [CLI, 'watch', '--provider', provider, '--controller-autonomy', 'approval-free'], {
             cwd: repo, env, detached: true, stdio: ['ignore', out, out],
         });
         children.push(child);

package/dist/tests/core/admission/index.test.js

@@ -132,9 +132,41 @@ describe('admitPlan', () => {
     it('admits unattended work only with an exact schema-2 plan binding', async () => {
         const unattended = { ...valid, manifest: { ...valid.manifest, executionMode: 'desatendido' } };
         const journal = { ...(0, types_1.emptyState)('main'), schema: 2, planBinding: { path: 'docs/plan.md', digest: 'a'.repeat(64), schema: 'compact-slices/v1', executionMode: 'desatendido', boundAt: '2026-09-15T00:00:00.000Z' } };
-        const admitted = await (0, admission_1.admitPlan)({ plan: unattended, provider: 'codex', cwd: process.cwd(), enabledAgents: ['codex'], journalState: journal, planPath: 'docs/plan.md' });
+        // #168: the posture is now part of what makes unattended work admissible,
+        // so this case declares it; the cases below pin what happens without it.
+        const base = { plan: unattended, cwd: process.cwd(), enabledAgents: ['claude-code'], planPath: 'docs/plan.md', controllerAutonomy: 'approval-free' };
+        const admitted = await (0, admission_1.admitPlan)({ ...base, provider: 'claude-code', journalState: journal });
         expect(admitted).toMatchObject({ state: 'admitted', journal: 'current', executionMode: 'desatendido' });
-        const stale = await (0, admission_1.admitPlan)({ plan: unattended, provider: 'codex', cwd: process.cwd(), enabledAgents: ['codex'], journalState: { ...journal, planBinding: { ...journal.planBinding, digest: 'b'.repeat(64) } }, planPath: 'docs/plan.md' });
+        const stale = await (0, admission_1.admitPlan)({ ...base, provider: 'claude-code', journalState: { ...journal, planBinding: { ...journal.planBinding, digest: 'b'.repeat(64) } } });
         expect(stale).toMatchObject({ state: 'blocked', journal: 'stale' });
     });
+    describe('unattended dispatch needs a controller that can actually act (#168)', () => {
+        const unattended = () => ({ ...valid, manifest: { ...valid.manifest, executionMode: 'desatendido' } });
+        const journal = () => ({ ...(0, types_1.emptyState)('main'), schema: 2, planBinding: { path: 'docs/plan.md', digest: 'a'.repeat(64), schema: 'compact-slices/v1', executionMode: 'desatendido', boundAt: '2026-09-15T00:00:00.000Z' } });
+        it('blocks claude-code when the operator declared no posture', async () => {
+            const report = await (0, admission_1.admitPlan)({ plan: unattended(), provider: 'claude-code', cwd: process.cwd(), enabledAgents: ['claude-code'], journalState: journal(), planPath: 'docs/plan.md' });
+            expect(report.state).toBe('blocked');
+            expect(report.diagnostics[0]).toMatchObject({ code: 'ADMISSION_CONTROLLER_AUTONOMY_REQUIRED' });
+            expect(report.capabilityResolution?.capabilities.unattendedController).toBe('unverified');
+        });
+        it('blocks codex too when no posture was declared', async () => {
+            const report = await (0, admission_1.admitPlan)({ plan: unattended(), provider: 'codex', cwd: process.cwd(), enabledAgents: ['codex'], journalState: journal(), planPath: 'docs/plan.md' });
+            expect(report.state).toBe('blocked');
+            expect(report.diagnostics[0]).toMatchObject({ code: 'ADMISSION_CONTROLLER_AUTONOMY_REQUIRED' });
+        });
+        it('admits codex on the declaration alone, since AWM cannot verify its posture either way', async () => {
+            const report = await (0, admission_1.admitPlan)({ plan: unattended(), provider: 'codex', cwd: process.cwd(), enabledAgents: ['codex'], journalState: journal(), planPath: 'docs/plan.md', controllerAutonomy: 'approval-free' });
+            expect(report.state).toBe('admitted');
+        });
+        it('keeps the original diagnostic for a provider that never had the capability', async () => {
+            const report = await (0, admission_1.admitPlan)({ plan: unattended(), provider: 'cursor', cwd: process.cwd(), enabledAgents: ['cursor'], journalState: journal(), planPath: 'docs/plan.md', controllerAutonomy: 'approval-free' });
+            expect(report.state).toBe('blocked');
+            expect(report.diagnostics[0]).toMatchObject({ code: 'ADMISSION_CAPABILITY_UNVERIFIED' });
+        });
+        it('admits claude-code once the posture is declared', async () => {
+            const report = await (0, admission_1.admitPlan)({ plan: unattended(), provider: 'claude-code', cwd: process.cwd(), enabledAgents: ['claude-code'], journalState: journal(), planPath: 'docs/plan.md', controllerAutonomy: 'approval-free' });
+            expect(report.state).toBe('admitted');
+            expect(report.capabilityResolution?.outcome).toBe('native');
+        });
+    });
 });

package/dist/tests/core/journal/controller-autonomy.test.js

@@ -0,0 +1,89 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const git_fixture_1 = require("../../helpers/git-fixture");
+const path_1 = __importDefault(require("path"));
+const adapter_1 = require("../../../src/core/journal/adapter");
+const admission_1 = require("../../../src/core/admission");
+// #168: `unattendedController: 'supported'` was a hardcoded constant while
+// D-016 explicitly marked "a real LLM can occupy the controller role" as
+// UNVERIFIED. Admission authorized native dispatch on that constant, and the
+// launch path passed no autonomy posture — so the controller blocked on its
+// first tool call and died as a stall. These tests pin both halves.
+describe('controller autonomy posture (#168)', () => {
+    test('claude-code maps the posture onto the flag its own --help documents', () => {
+        const argv = (0, adapter_1.adapterFor)('claude-code').launchArgv('resume-next-action', 'approval-free');
+        expect(argv.slice(0, 4)).toEqual(['claude', '--permission-mode', 'bypassPermissions', '-p']);
+        // The prompt stays the LAST argument, as every adapter promises.
+        expect(argv[argv.length - 1]).toContain('resume-next-action');
+    });
+    test('without a declared posture the launch argv is unchanged — the shipped bug', () => {
+        expect((0, adapter_1.adapterFor)('claude-code').launchArgv('resume-next-action')).toEqual([
+            'claude', '-p', expect.stringContaining('resume-next-action'),
+        ]);
+    });
+    test('codex declares its mapping unverified rather than inventing a flag', () => {
+        // The R0 evidence captured `codex --help`, never `codex exec --help`, so
+        // where the approval flag goes on the subcommand is not established.
+        expect((0, adapter_1.controllerAutonomyMapping)('codex')).toBe('unverified');
+        expect((0, adapter_1.controllerAutonomyMapping)('claude-code')).toBe('verified');
+        expect((0, adapter_1.adapterFor)('codex').launchArgv('resume-next-action', 'approval-free'))
+            .toEqual(['codex', 'exec', expect.stringContaining('resume-next-action')]);
+    });
+    test('the posture vocabulary refuses anything it has not measured', () => {
+        expect(adapter_1.CONTROLLER_AUTONOMIES).toEqual(['approval-free']);
+        for (const invalid of ['acceptEdits', 'bypassPermissions', 'never', '', 'full', undefined, 7]) {
+            expect((0, adapter_1.isControllerAutonomy)(invalid)).toBe(false);
+        }
+        expect((0, adapter_1.isControllerAutonomy)('approval-free')).toBe(true);
+    });
+});
+describe('unattendedController stops being asserted for free (#168)', () => {
+    test('degrades to unverified when no posture was declared', () => {
+        expect(admission_1.PROVIDER_EXECUTION_CAPABILITIES['claude-code'].unattendedController).toBe('supported');
+        expect((0, admission_1.unattendedCapabilities)('claude-code', undefined).unattendedController).toBe('unverified');
+    });
+    test('honours the operator declaration even where AWM injects no flag', () => {
+        // AWM cannot verify codex's posture mapping, but the operator may carry
+        // approval policy in their own config. Refusing to guess the flag is not
+        // the same as refusing the operator — same doctrine as --expected-digest.
+        expect((0, adapter_1.controllerAutonomyMapping)('codex')).toBe('unverified');
+        expect((0, admission_1.unattendedCapabilities)('codex', 'approval-free').unattendedController).toBe('supported');
+    });
+    test('is supported once the posture is declared', () => {
+        expect((0, admission_1.unattendedCapabilities)('claude-code', 'approval-free').unattendedController).toBe('supported');
+    });
+    test('never promotes a provider that never had the capability', () => {
+        expect(admission_1.PROVIDER_EXECUTION_CAPABILITIES.cursor.unattendedController).toBe('unverified');
+        expect((0, admission_1.unattendedCapabilities)('cursor', 'approval-free').unattendedController).toBe('unverified');
+    });
+});
+describe('awm watch surfaces the posture on the compiled binary (#168)', () => {
+    const cli = path_1.default.resolve(__dirname, '../../../dist/src/index.js');
+    test('declares the flag and its vocabulary', () => {
+        const help = (0, child_process_1.spawnSync)(process.execPath, [cli, 'watch', '--help'], { encoding: 'utf8', env: { ...process.env, AWM_NO_UPDATE_CHECK: '1' } });
+        expect(help.status).toBe(0);
+        expect(help.stdout).toContain('--controller-autonomy');
+        expect(help.stdout).toContain('approval-free');
+    });
+    test('refuses a posture it cannot honour instead of launching a controller that stalls', () => {
+        // Hermetic repo on a real branch: without a cwd of its own this inherits
+        // the checkout, and a detached HEAD makes `currentBranch()` fail first —
+        // which is exactly how this test passed locally and failed on all six CI
+        // legs. The assertion must depend on the flag, not on ambient git state.
+        const repo = (0, git_fixture_1.initRepo)();
+        try {
+            const result = (0, child_process_1.spawnSync)(process.execPath, [cli, 'watch', '--provider', 'claude-code', '--controller-autonomy', 'bypassPermissions'], { cwd: repo, encoding: 'utf8', env: { ...process.env, AWM_NO_UPDATE_CHECK: '1' } });
+            expect(result.status).toBe(1);
+            expect(result.stderr).toContain('--controller-autonomy invalido');
+            expect(result.stderr).toContain('approval-free');
+        }
+        finally {
+            fs_1.default.rmSync(repo, { recursive: true, force: true });
+        }
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "9.10.2",
+  "version": "9.11.1",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"