agentic-workflow-manager 9.11.0 → 9.11.2

package/dist/scripts/support-matrix.js

@@ -156,7 +156,6 @@ function spliceGenerated(markdown, generated) {
 exports.DOC_PATH = path_1.default.join(__dirname, '..', '..', 'docs', 'support-matrix.md');
 /* istanbul ignore next — entrypoint de CLI, ejercitado por el test via las funciones puras */
 if (require.main === module) {
-    // eslint-disable-next-line @typescript-eslint/no-var-requires
     const fs = require('fs');
     const current = fs.readFileSync(exports.DOC_PATH, 'utf-8');
     fs.writeFileSync(exports.DOC_PATH, spliceGenerated(current, renderProviderTables()), 'utf-8');

package/dist/src/commands/plan/index.js

@@ -14,6 +14,7 @@ const config_1 = require("../../utils/config");
 const providers_1 = require("../../providers");
 const registries_1 = require("../../core/registries");
 const registry_contracts_1 = require("../../core/admission/registry-contracts");
+const adapter_1 = require("../../core/journal/adapter");
 const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const store_1 = require("../../core/journal/store");
@@ -262,6 +263,7 @@ function registerPlanCommand(program, deps = { validatePlanFile: validate_1.vali
         .option('--runtime-kind <kind>', 'routing runtime kind for compact v2')
         .option('--runtime-version <version>', 'routing runtime version for compact v2')
         .option('--account-scope-digest <sha>', 'routing account scope digest for compact v2')
+        .option('--controller-autonomy <posture>', 'unattended controller autonomy posture (#168)')
         .option('--json', 'emit one stable JSON report')
         .action(async (planPath, options) => {
         assertText(planPath, 'plan path');
@@ -294,7 +296,9 @@ function registerPlanCommand(program, deps = { validatePlanFile: validate_1.vali
         const readRouting = () => { if (!options.runtimeKind || !options.runtimeVersion || !options.accountScopeDigest)
             return undefined; const runtime = (0, capabilities_1.validateRuntimeKey)({ target: options.provider, kind: options.runtimeKind, version: options.runtimeVersion, accountScopeDigest: options.accountScopeDigest }); const policy = (deps.readEffectivePolicy ?? store_2.readEffectivePolicy)(options.cwd); const at = deps.routingNow?.() ?? new Date(); if (!(at instanceof Date) || !Number.isFinite(at.getTime()))
             throw new Error('routingNow must return a finite Date'); const capabilities = (deps.readCapabilities ?? capabilities_1.readCapabilities)(runtime, at); return { runtime, policy: policy.state === 'approved' ? policy.policy : undefined, capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined, now: at }; };
-        const report = await (0, registry_contracts_1.admitRegistryPlan)({ plan: planReport, provider: options.provider, cwd: options.cwd, enabledAgents, executionMode, planPath: normalizedPlanPath, ...journal, requireCurrent: options.requireCurrent === true, verifySensors: options.verifySensors === true }, { admitPlan: admission, listRegistries: registryInventory, checkCurrentness: currentnessCheck, runSensors: sensorRun, readRouting });
+        if (options.controllerAutonomy !== undefined && !(0, adapter_1.isControllerAutonomy)(options.controllerAutonomy))
+            throw new Error(`--controller-autonomy is invalid: ${options.controllerAutonomy} (valid: ${adapter_1.CONTROLLER_AUTONOMIES.join(', ')})`);
+        const report = await (0, registry_contracts_1.admitRegistryPlan)({ plan: planReport, provider: options.provider, cwd: options.cwd, enabledAgents, executionMode, planPath: normalizedPlanPath, ...journal, requireCurrent: options.requireCurrent === true, verifySensors: options.verifySensors === true, ...(options.controllerAutonomy === undefined ? {} : { controllerAutonomy: options.controllerAutonomy }) }, { admitPlan: admission, listRegistries: registryInventory, checkCurrentness: currentnessCheck, runSensors: sensorRun, readRouting });
         process.stdout.write(admissionOutput(report, options.json === true));
         if (report.state !== 'admitted')
             process.exitCode = 2;

package/dist/src/commands/update.js

@@ -40,7 +40,6 @@ const defaultDeps = {
     applyInstallPlan: install_transaction_1.applyInstallPlan,
     resyncInstalledHooks: resync_1.resyncInstalledHooks,
     offerSelfUpdate: async (mode) => {
-        // eslint-disable-next-line @typescript-eslint/no-var-requires
         const { offerSelfUpdate: real } = require('../core/update-check');
         await real({ mode });
     },

package/dist/src/commands/watch/generations.js

@@ -105,7 +105,7 @@ function recoveryAction(action) {
 /** Persiste el intent completo ANTES de delegarlo al wrapper. El wrapper usa
  * claim exclusivo por (controllerJobId, spawnNonce), por lo que reemitir este
  * mismo intent tras un crash nunca lanza dos controllers. */
-function launchControllerGeneration(repoRoot, branch, provider, action, spawner = (0, runner_1.defaultWrapperSpawner)()) {
+function launchControllerGeneration(repoRoot, branch, provider, action, spawner = (0, runner_1.defaultWrapperSpawner)(), autonomy) {
     const requestedAction = recoveryAction(action);
     const s = requireState(repoRoot, branch);
     const gen = activeGeneration(s);
@@ -118,7 +118,7 @@ function launchControllerGeneration(repoRoot, branch, provider, action, spawner
     gen.spawnNonce = gen.spawnNonce ?? crypto_1.default.randomBytes(8).toString('hex');
     gen.provider = gen.provider ?? provider;
     gen.resumeAction = gen.resumeAction ?? requestedAction;
-    const argv = adapter.launchArgv(promptForGeneration(gen));
+    const argv = adapter.launchArgv(promptForGeneration(gen), autonomy);
     const digest = (0, process_1.argvDigest)(argv);
     if (gen.launchArgvDigest !== undefined && gen.launchArgvDigest !== digest)
         throw new Error('controller argv cambio: no se reemite el mismo nonce con otro comando');
@@ -182,7 +182,7 @@ function controllerGenerationHasUnresolvedClaim(repoRoot, branch, gen) {
 /** Recupera tanto crash-before-spawn como crash-after-spawn-before-journal.
  * Claim sin identidad queda ambiguo y se conserva bajo custodia tras la gracia;
  * nunca se resuelve lanzando otro token/nonce a ciegas. */
-function ensureControllerGeneration(repoRoot, branch, provider, action, spawner, ambiguityGraceMs) {
+function ensureControllerGeneration(repoRoot, branch, provider, action, spawner, ambiguityGraceMs, autonomy) {
     const requestedAction = recoveryAction(action);
     if (collectControllerGeneration(repoRoot, branch))
         return;
@@ -194,7 +194,7 @@ function ensureControllerGeneration(repoRoot, branch, provider, action, spawner,
     if (gen.processRef !== undefined || gen.wrapperRef !== undefined)
         return;
     if (gen.controllerJobId === undefined || gen.spawnNonce === undefined) {
-        launchControllerGeneration(repoRoot, branch, provider, requestedAction, spawner);
+        launchControllerGeneration(repoRoot, branch, provider, requestedAction, spawner, autonomy);
         return;
     }
     const logs = (0, paths_1.logsDir)(repoRoot, branch);
@@ -217,7 +217,7 @@ function ensureControllerGeneration(repoRoot, branch, provider, action, spawner,
     // El intent ya estaba durable pero el spawn no ocurrio: es seguro reemitir
     // exactamente el mismo nonce. Si el wrapper original solo estaba demorado,
     // su claim wx arbitra cual de ambos ejecuta.
-    launchControllerGeneration(repoRoot, branch, gen.provider ?? provider, gen.resumeAction ?? requestedAction, spawner);
+    launchControllerGeneration(repoRoot, branch, gen.provider ?? provider, gen.resumeAction ?? requestedAction, spawner, autonomy);
 }
 /** Custodia (R4.5): ciclo BLOCKED con razon auditada. QUIEN NO HACE NADA:
  *  no mata, no relanza, no libera lock — el loop sigue vivo auditando. */

package/dist/src/commands/watch/index.js

@@ -8,8 +8,9 @@ const child_process_1 = require("child_process");
 const init_1 = require("./init");
 const supervisor_1 = require("./supervisor");
 const capabilities_1 = require("../../core/model-policy/capabilities");
-const process_1 = require("../../core/journal/process");
 const adapter_1 = require("../../core/journal/adapter");
+const process_1 = require("../../core/journal/process");
+const adapter_2 = require("../../core/journal/adapter");
 const context_1 = require("../../core/tracks/context");
 const concurrency_1 = require("../../core/tracks/concurrency");
 const validate_1 = require("../../core/plan/validate");
@@ -45,7 +46,7 @@ function registerWatchCommand(program) {
         .description('supervisor durable: ejecuta jobs, releva controladores caidos, nunca mata trabajo vivo')
         .option('--init', 'bootstrap: crea el journal de la rama actual, detecta verificadores y sale')
         .option('--plan <path>', 'plan compacto desatendido que se vincula al inicializar')
-        .option('--provider <p>', adapter_1.WATCH_PROVIDERS.join(' | '), 'codex')
+        .option('--provider <p>', adapter_2.WATCH_PROVIDERS.join(' | '), 'codex')
         .option('--heartbeat-timeout <min>', 'minutos de silencio de heartbeat', '5')
         .option('--activity-window <min>', 'minutos extra sin actividad de proceso', '10')
         .option('--max-parallel <n>', 'tope de tracks ACTIVE simultáneos (default: derivado del benchmark empaquetado)')
@@ -55,6 +56,9 @@ function registerWatchCommand(program) {
         .option('--runtime-kind <kind>', 'identidad de runtime para despacho compact v2')
         .option('--runtime-version <version>', 'identidad de runtime para despacho compact v2')
         .option('--account-scope-digest <sha>', 'identidad de runtime para despacho compact v2')
+        // #168: sin esto el controller desatendido arranca y se cuelga en la
+        // primera herramienta pidiendo aprobación. Se declara, no se adivina.
+        .option('--controller-autonomy <postura>', `postura del controller desatendido (${adapter_1.CONTROLLER_AUTONOMIES.join(' | ')})`)
         .action(async (opts) => {
         const repo = process.cwd();
         const branch = currentBranch(repo);
@@ -93,8 +97,8 @@ function registerWatchCommand(program) {
         // desconocido, pero recien en el primer tick — con el journal escrito y el
         // lock tomado, y el error saliendo del supervisor en vez de del flag que lo
         // causo. Un typo en `--provider` tiene que costar un mensaje, no un ciclo.
-        if (!(0, adapter_1.isWatchProvider)(opts.provider)) {
-            process.stderr.write(`--provider invalido: ${String(opts.provider)} (validos: ${adapter_1.WATCH_PROVIDERS.join(', ')})\n`);
+        if (!(0, adapter_2.isWatchProvider)(opts.provider)) {
+            process.stderr.write(`--provider invalido: ${String(opts.provider)} (validos: ${adapter_2.WATCH_PROVIDERS.join(', ')})\n`);
             process.exitCode = 1;
             return;
         }
@@ -122,6 +126,11 @@ function registerWatchCommand(program) {
             }
             routingIdentity = { kind: String(opts.runtimeKind), version: String(opts.runtimeVersion), accountScopeDigest: String(opts.accountScopeDigest) };
         }
+        if (opts.controllerAutonomy !== undefined && !(0, adapter_1.isControllerAutonomy)(opts.controllerAutonomy)) {
+            process.stderr.write(`--controller-autonomy invalido: ${String(opts.controllerAutonomy)} (validos: ${adapter_1.CONTROLLER_AUTONOMIES.join(', ')})\n`);
+            process.exitCode = 1;
+            return;
+        }
         const cfg = {
             ...supervisor_1.DEFAULT_SUPERVISOR_CONFIG,
             provider: opts.provider,
@@ -129,6 +138,7 @@ function registerWatchCommand(program) {
             activityWindowMs: minutes('--activity-window', opts.activityWindow),
             maxParallelTracks: opts.maxParallel !== undefined ? (0, concurrency_1.parseMaxParallel)(opts.maxParallel) : (0, concurrency_1.loadDefaultParallelism)(),
             ...(routingIdentity === undefined ? {} : { routingIdentity }),
+            ...(opts.controllerAutonomy === undefined ? {} : { controllerAutonomy: opts.controllerAutonomy }),
         };
         process.stdout.write(`awm watch: supervisor activo (${cfg.provider}) — Ctrl-C para terminar\n`);
         await (0, supervisor_1.runSupervisorLoop)(repo, branch, cfg);

package/dist/src/commands/watch/supervisor.js

@@ -44,7 +44,7 @@ function routingFacts(provider, identity, cwd, deps = {}) {
     return { runtime, policy: policy.state === 'approved' ? policy.policy : undefined,
         capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined, now: at };
 }
-function defaultDispatchAdmission(repoRoot, branch, provider, identity, deps = {}) {
+function defaultDispatchAdmission(repoRoot, branch, provider, identity, deps = {}, autonomy) {
     return async () => {
         const observed = (0, store_1.readJournal)(repoRoot, branch);
         const binding = observed.state?.schema === 2 ? observed.state.planBinding : undefined;
@@ -56,7 +56,8 @@ function defaultDispatchAdmission(repoRoot, branch, provider, identity, deps = {
         return (deps.admit ?? registry_contracts_1.admitRegistryPlan)({ plan, provider, cwd: repoRoot, enabledAgents: preferences.enabledAgents,
             executionMode: 'desatendido', requireCurrent: true, verifySensors: true,
             journalState: observed.state, journalCorrupt: observed.corrupt, planPath: binding.path,
-            routing: routingFacts(provider, identity, repoRoot, deps) });
+            routing: routingFacts(provider, identity, repoRoot, deps),
+            controllerAutonomy: autonomy });
     };
 }
 /** R7/C3/C4 (Task 12) + fix post-review #2 (re-derivado desde cero tras
@@ -152,7 +153,7 @@ exports.DEFAULT_SUPERVISOR_CONFIG = {
 /** Single place the supervisor's config becomes its admission, so the runtime
  *  identity cannot be dropped silently between the flag and the gate (#166). */
 function admissionForConfig(repoRoot, branch, cfg, deps = {}) {
-    return defaultDispatchAdmission(repoRoot, branch, cfg.provider, cfg.routingIdentity, deps);
+    return defaultDispatchAdmission(repoRoot, branch, cfg.provider, cfg.routingIdentity, deps, cfg.controllerAutonomy);
 }
 // 'frozen' (R5.2/R6.3, Task 10): SOLO puede ocurrir en el journal de un
 // TRACK individual (nunca en el del plan) — el track terminó, con las 6
@@ -223,7 +224,7 @@ class Supervisor {
             return 'custody';
         }
         try {
-            (0, generations_1.ensureControllerGeneration)(this.repoRoot, this.branch, this.cfg.provider, action, this.spawner, this.cfg.reconcileGraceMs);
+            (0, generations_1.ensureControllerGeneration)(this.repoRoot, this.branch, this.cfg.provider, action, this.spawner, this.cfg.reconcileGraceMs, this.cfg.controllerAutonomy);
             return 'ok';
         }
         catch (error) {

package/dist/src/core/admission/index.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PROVIDER_EXECUTION_CAPABILITIES = void 0;
+exports.unattendedCapabilities = unattendedCapabilities;
 exports.sanitizeAdmissionReport = sanitizeAdmissionReport;
 exports.admitPlan = admitPlan;
 const providers_1 = require("../../providers");
@@ -11,7 +12,13 @@ const UNKNOWN = {
     artifactDelivery: 'unverified', interactiveExecution: 'unverified', unattendedController: 'unverified', nativeSubagents: 'unverified',
     modelOverride: 'unverified', effortOverride: 'unverified', observedModelEvidence: 'unverified', durableResume: 'unverified',
 };
-/** Deliberate R1 evidence table. Artifact delivery is never used as execution evidence. */
+/** Deliberate R1 evidence table. Artifact delivery is never used as execution evidence.
+ *
+ *  `unattendedController: 'supported'` describes the supervisor<->controller
+ *  CONTRACT, which D-016 certifies with a scripted controller. It does NOT say a
+ *  real agent runtime can occupy the role — D-016 marks that explicitly
+ *  unverified. Read this table through `unattendedCapabilities()`, neverdirectly:
+ *  the raw row overstates what has been established (#168). */
 exports.PROVIDER_EXECUTION_CAPABILITIES = {
     antigravity: { ...UNKNOWN },
     opencode: { ...UNKNOWN },
@@ -20,6 +27,21 @@ exports.PROVIDER_EXECUTION_CAPABILITIES = {
     cursor: { ...UNKNOWN },
     copilot: { ...UNKNOWN },
 };
+/** #168: the controller can only act if it was launched with an autonomy
+ *  posture. That posture is an OPERATOR ASSERTION, exactly like
+ *  `--expected-digest` or the compact v2 runtime identity: AWM cannot verify it
+ *  independently (a codex operator may carry approval policy in their own
+ *  config), so it refuses to guess rather than refusing the operator. Without a
+ *  declaration `unattendedController` degrades to 'unverified' — which is what
+ *  D-016 already said, and what the raw table contradicted. */
+function unattendedCapabilities(provider, autonomy) {
+    const base = exports.PROVIDER_EXECUTION_CAPABILITIES[provider];
+    if (base.unattendedController !== 'supported')
+        return base;
+    if (autonomy !== undefined)
+        return base;
+    return { ...base, unattendedController: 'unverified' };
+}
 const MAX_DIAGNOSTICS = 20;
 const MAX_DIAGNOSTIC_LENGTH = 4096;
 function safe(value) { return value.replace(/[\u0000-\u001F\u007F-\u009F]/g, character => `\\u${character.codePointAt(0).toString(16).padStart(4, '0')}`).slice(0, MAX_DIAGNOSTIC_LENGTH); }
@@ -190,10 +212,18 @@ async function admitPlan(input) {
         const journal = journalStatus(input, plan);
         if (journal !== 'current')
             return blocked(input, [diagnostic('ADMISSION_JOURNAL_BINDING_REQUIRED', 'Unattended execution requires a healthy schema-2 journal binding for this exact plan; run watch --init --plan.')], { planDigest: plan.planDigest, provider, executionMode: mode, journal, currentness: input.requireCurrent ? 'current' : 'not-checked', sensors: input.verifySensors ? 'pass' : 'not-required' });
-        const capabilities = exports.PROVIDER_EXECUTION_CAPABILITIES[provider];
+        const capabilities = unattendedCapabilities(provider, input.controllerAutonomy);
         const resolution = { outcome: capabilities.unattendedController === 'supported' ? 'native' : 'blocked', provider, capabilities, evidenceVersion: 'r1-v1', diagnostics: [] };
-        if (resolution.outcome === 'blocked')
-            return blocked(input, [diagnostic('ADMISSION_CAPABILITY_UNVERIFIED', `Provider ${provider} has no verified unattended execution capability.`)], { planDigest: plan.planDigest, provider, executionMode: mode, journal, currentness: input.requireCurrent ? 'current' : 'not-checked', sensors: input.verifySensors ? 'pass' : 'not-required', capabilityResolution: resolution });
+        if (resolution.outcome === 'blocked') {
+            // Distinguir las dos razones: el provider nunca tuvo la capacidad,
+            // o el operador no declaro postura. Un solo diagnostico las
+            // confundiria y el operador no sabria si le falta una flag o si el
+            // provider directamente no sirve (#168).
+            const reason = exports.PROVIDER_EXECUTION_CAPABILITIES[provider].unattendedController !== 'supported'
+                ? diagnostic('ADMISSION_CAPABILITY_UNVERIFIED', `Provider ${provider} has no verified unattended execution capability.`)
+                : diagnostic('ADMISSION_CONTROLLER_AUTONOMY_REQUIRED', `Unattended dispatch on ${provider} requires an explicit controller autonomy posture; without it the controller blocks on its first tool call.`);
+            return blocked(input, [reason], { planDigest: plan.planDigest, provider, executionMode: mode, journal, currentness: input.requireCurrent ? 'current' : 'not-checked', sensors: input.verifySensors ? 'pass' : 'not-required', capabilityResolution: resolution });
+        }
         return completeAdmission(input, plan, provider, mode, journal, input.requireCurrent ? 'current' : 'not-checked', input.verifySensors ? 'pass' : 'not-required', resolution);
     }
     const capabilities = exports.PROVIDER_EXECUTION_CAPABILITIES[provider];

package/dist/src/core/journal/adapter.js

@@ -1,22 +1,41 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONTROLLER_ARGV_ENV = exports.WATCH_PROVIDERS = void 0;
+exports.CONTROLLER_ARGV_ENV = exports.WATCH_PROVIDERS = exports.CONTROLLER_AUTONOMIES = void 0;
+exports.isControllerAutonomy = isControllerAutonomy;
 exports.isWatchProvider = isWatchProvider;
+exports.controllerAutonomyMapping = controllerAutonomyMapping;
 exports.adapterFor = adapterFor;
 const process_1 = require("./process");
+exports.CONTROLLER_AUTONOMIES = ['approval-free'];
+function isControllerAutonomy(value) {
+    return typeof value === 'string' && exports.CONTROLLER_AUTONOMIES.includes(value);
+}
 const RESUME_PROMPT_PREFIX = 'Sos el orquestador SDD de este repo. Corre `awm job reconcile` y ejecuta ';
 function baseSafeToReplace(ref) {
     return (0, process_1.refIsAlive)(ref) ? 'indeterminate' : 'safe';
 }
+// `codex exec` tiene flags de aprobacion (`-a/--ask-for-approval never`,
+// `-s/--sandbox`), pero la evidencia R0 capturo el `--help` de `codex`, NO el
+// del subcomando `exec`, asi que no consta donde van ni como se llaman ahi.
+// Declarar el mapeo como 'unverified' y bloquear es honesto; adivinar la flag
+// dejaria al controller sin arrancar, que es peor que el stall que arreglamos.
 const codexAdapter = {
     provider: 'codex',
     launchArgv: (resumePrompt) => ['codex', 'exec', `${RESUME_PROMPT_PREFIX}${resumePrompt}`],
+    autonomyMapping: 'unverified',
     activity: process_1.activitySnapshot,
     safeToReplace: baseSafeToReplace,
 };
+// Leido del `--help` de claude 2.1.278:
+//   --permission-mode <mode>  (choices: "acceptEdits", "auto", "bypassPermissions",
+//                              "manual", "dontAsk", "plan")
+// Las flags van ANTES de `-p`, que toma el prompt como posicional.
 const claudeAdapter = {
     provider: 'claude-code',
-    launchArgv: (resumePrompt) => ['claude', '-p', `${RESUME_PROMPT_PREFIX}${resumePrompt}`],
+    launchArgv: (resumePrompt, autonomy) => ['claude',
+        ...(autonomy === 'approval-free' ? ['--permission-mode', 'bypassPermissions'] : []),
+        '-p', `${RESUME_PROMPT_PREFIX}${resumePrompt}`],
+    autonomyMapping: 'verified',
     activity: process_1.activitySnapshot,
     safeToReplace: baseSafeToReplace,
 };
@@ -63,6 +82,13 @@ function controllerArgvOverride() {
     }
     return parsed;
 }
+/** Lookup PURO del mapeo de postura por provider: sin env, sin throw, para que
+ *  la admision pueda preguntarlo sin construir un adapter ni honrar overrides. */
+function controllerAutonomyMapping(provider) {
+    return provider === 'claude-code' ? claudeAdapter.autonomyMapping
+        : provider === 'codex' ? codexAdapter.autonomyMapping
+            : 'unverified';
+}
 function adapterFor(provider) {
     const base = provider === 'codex' ? codexAdapter
         : provider === 'claude-code' ? claudeAdapter
@@ -72,5 +98,8 @@ function adapterFor(provider) {
     const override = controllerArgvOverride();
     if (override === null)
         return base;
+    // El operador es dueno del argv completo: no se le inyecta la postura
+    // (duplicaria o contradiria sus propias flags). Sigue necesitando
+    // declararla para la admision, que es una afirmacion, no un argv.
     return { ...base, launchArgv: (resumePrompt) => [...override, resumePrompt] };
 }

package/dist/tests/commands/plan/index.test.js

@@ -384,7 +384,7 @@ describe('plan admit Commander wiring', () => {
             program.exitOverride();
             program.configureOutput({ writeErr: () => undefined });
             (0, plan_1.registerPlanCommand)(program, { validatePlanFile: () => valid, admitPlan: admit, readPreferences: () => ({ defaultAgent: 'codex', enabledAgents: ['codex'], installMethod: 'symlink', defaultScope: 'local' }) });
-            await program.parseAsync(['node', 'awm', 'plan', 'admit', 'plans/current.md', '--provider', 'codex', '--cwd', root, '--execution-mode', 'desatendido', '--json']);
+            await program.parseAsync(['node', 'awm', 'plan', 'admit', 'plans/current.md', '--provider', 'codex', '--cwd', root, '--execution-mode', 'desatendido', '--controller-autonomy', 'approval-free', '--json']);
             expect(admit).toHaveBeenCalledWith(expect.objectContaining({ executionMode: 'desatendido', planPath: 'plans/current.md', journalCorrupt: false, journalState: expect.objectContaining({ schema: 2, planBinding: expect.objectContaining({ digest: valid.planDigest }) }) }));
         }
         finally {

package/dist/tests/commands/watch/e2e-crash.test.js

@@ -196,7 +196,7 @@ while true; do sleep 1; done
             throw new Error(`fixture runSensors failed: ${JSON.stringify({ sensorReport, live })}`);
         }
         expect(sensorReport).toMatchObject({ source: { kind: 'logical', registry: 'baseline' } });
-        const admission = (0, child_process_1.spawnSync)(process.execPath, [CLI, 'plan', 'admit', 'plans/fixture.md', '--provider', 'codex', '--cwd', '.', '--execution-mode', 'desatendido', '--require-current', '--verify-sensors', '--json'], { cwd: repo, env, encoding: 'utf8' });
+        const admission = (0, child_process_1.spawnSync)(process.execPath, [CLI, 'plan', 'admit', 'plans/fixture.md', '--provider', 'codex', '--cwd', '.', '--execution-mode', 'desatendido', '--controller-autonomy', 'approval-free', '--require-current', '--verify-sensors', '--json'], { cwd: repo, env, encoding: 'utf8' });
         if (admission.status !== 0)
             throw new Error(`fixture admission failed: ${admission.stdout}${admission.stderr}`);
     });
@@ -230,7 +230,7 @@ while true; do sleep 1; done
         // in-repo log would make the real currentness/admission gate reject
         // the next tick before it can collect an exited job sidecar.
         const out = fs_1.default.openSync(path_1.default.join(stubBin, `sup-${children.length}.log`), 'a');
-        const child = (0, child_process_1.spawn)(process.execPath, [CLI, 'watch', '--provider', provider], {
+        const child = (0, child_process_1.spawn)(process.execPath, [CLI, 'watch', '--provider', provider, '--controller-autonomy', 'approval-free'], {
             cwd: repo, env, detached: true, stdio: ['ignore', out, out],
         });
         children.push(child);

package/dist/tests/core/admission/index.test.js

@@ -132,9 +132,41 @@ describe('admitPlan', () => {
     it('admits unattended work only with an exact schema-2 plan binding', async () => {
         const unattended = { ...valid, manifest: { ...valid.manifest, executionMode: 'desatendido' } };
         const journal = { ...(0, types_1.emptyState)('main'), schema: 2, planBinding: { path: 'docs/plan.md', digest: 'a'.repeat(64), schema: 'compact-slices/v1', executionMode: 'desatendido', boundAt: '2026-09-15T00:00:00.000Z' } };
-        const admitted = await (0, admission_1.admitPlan)({ plan: unattended, provider: 'codex', cwd: process.cwd(), enabledAgents: ['codex'], journalState: journal, planPath: 'docs/plan.md' });
+        // #168: the posture is now part of what makes unattended work admissible,
+        // so this case declares it; the cases below pin what happens without it.
+        const base = { plan: unattended, cwd: process.cwd(), enabledAgents: ['claude-code'], planPath: 'docs/plan.md', controllerAutonomy: 'approval-free' };
+        const admitted = await (0, admission_1.admitPlan)({ ...base, provider: 'claude-code', journalState: journal });
         expect(admitted).toMatchObject({ state: 'admitted', journal: 'current', executionMode: 'desatendido' });
-        const stale = await (0, admission_1.admitPlan)({ plan: unattended, provider: 'codex', cwd: process.cwd(), enabledAgents: ['codex'], journalState: { ...journal, planBinding: { ...journal.planBinding, digest: 'b'.repeat(64) } }, planPath: 'docs/plan.md' });
+        const stale = await (0, admission_1.admitPlan)({ ...base, provider: 'claude-code', journalState: { ...journal, planBinding: { ...journal.planBinding, digest: 'b'.repeat(64) } } });
         expect(stale).toMatchObject({ state: 'blocked', journal: 'stale' });
     });
+    describe('unattended dispatch needs a controller that can actually act (#168)', () => {
+        const unattended = () => ({ ...valid, manifest: { ...valid.manifest, executionMode: 'desatendido' } });
+        const journal = () => ({ ...(0, types_1.emptyState)('main'), schema: 2, planBinding: { path: 'docs/plan.md', digest: 'a'.repeat(64), schema: 'compact-slices/v1', executionMode: 'desatendido', boundAt: '2026-09-15T00:00:00.000Z' } });
+        it('blocks claude-code when the operator declared no posture', async () => {
+            const report = await (0, admission_1.admitPlan)({ plan: unattended(), provider: 'claude-code', cwd: process.cwd(), enabledAgents: ['claude-code'], journalState: journal(), planPath: 'docs/plan.md' });
+            expect(report.state).toBe('blocked');
+            expect(report.diagnostics[0]).toMatchObject({ code: 'ADMISSION_CONTROLLER_AUTONOMY_REQUIRED' });
+            expect(report.capabilityResolution?.capabilities.unattendedController).toBe('unverified');
+        });
+        it('blocks codex too when no posture was declared', async () => {
+            const report = await (0, admission_1.admitPlan)({ plan: unattended(), provider: 'codex', cwd: process.cwd(), enabledAgents: ['codex'], journalState: journal(), planPath: 'docs/plan.md' });
+            expect(report.state).toBe('blocked');
+            expect(report.diagnostics[0]).toMatchObject({ code: 'ADMISSION_CONTROLLER_AUTONOMY_REQUIRED' });
+        });
+        it('admits codex on the declaration alone, since AWM cannot verify its posture either way', async () => {
+            const report = await (0, admission_1.admitPlan)({ plan: unattended(), provider: 'codex', cwd: process.cwd(), enabledAgents: ['codex'], journalState: journal(), planPath: 'docs/plan.md', controllerAutonomy: 'approval-free' });
+            expect(report.state).toBe('admitted');
+        });
+        it('keeps the original diagnostic for a provider that never had the capability', async () => {
+            const report = await (0, admission_1.admitPlan)({ plan: unattended(), provider: 'cursor', cwd: process.cwd(), enabledAgents: ['cursor'], journalState: journal(), planPath: 'docs/plan.md', controllerAutonomy: 'approval-free' });
+            expect(report.state).toBe('blocked');
+            expect(report.diagnostics[0]).toMatchObject({ code: 'ADMISSION_CAPABILITY_UNVERIFIED' });
+        });
+        it('admits claude-code once the posture is declared', async () => {
+            const report = await (0, admission_1.admitPlan)({ plan: unattended(), provider: 'claude-code', cwd: process.cwd(), enabledAgents: ['claude-code'], journalState: journal(), planPath: 'docs/plan.md', controllerAutonomy: 'approval-free' });
+            expect(report.state).toBe('admitted');
+            expect(report.capabilityResolution?.outcome).toBe('native');
+        });
+    });
 });

package/dist/tests/core/export/engine.test.js

@@ -77,7 +77,6 @@ describe('runExport (engine end-to-end)', () => {
         // La lectura sale exclusivamente de roots: un root vacío no resuelve nada.
         // Control negativo real: contentRoots() (el fallback al registry instalado)
         // no debe invocarse en absoluto cuando opts.roots viene dado explícitamente.
-        // eslint-disable-next-line @typescript-eslint/no-var-requires
         const registries = require('../../../src/core/registries');
         const spy = jest.spyOn(registries, 'contentRoots');
         const empty = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-empty-root-'));

package/dist/tests/core/export/pack.test.js

@@ -7,7 +7,6 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const pack_1 = require("../../../src/core/export/pack");
-// eslint-disable-next-line @typescript-eslint/no-var-requires
 const childProcess = require('child_process');
 const okZip = (cwd, zipName) => {
     fs_1.default.writeFileSync(path_1.default.join(cwd, zipName), 'fake-zip');

package/dist/tests/core/journal/controller-autonomy.test.js

@@ -0,0 +1,89 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const git_fixture_1 = require("../../helpers/git-fixture");
+const path_1 = __importDefault(require("path"));
+const adapter_1 = require("../../../src/core/journal/adapter");
+const admission_1 = require("../../../src/core/admission");
+// #168: `unattendedController: 'supported'` was a hardcoded constant while
+// D-016 explicitly marked "a real LLM can occupy the controller role" as
+// UNVERIFIED. Admission authorized native dispatch on that constant, and the
+// launch path passed no autonomy posture — so the controller blocked on its
+// first tool call and died as a stall. These tests pin both halves.
+describe('controller autonomy posture (#168)', () => {
+    test('claude-code maps the posture onto the flag its own --help documents', () => {
+        const argv = (0, adapter_1.adapterFor)('claude-code').launchArgv('resume-next-action', 'approval-free');
+        expect(argv.slice(0, 4)).toEqual(['claude', '--permission-mode', 'bypassPermissions', '-p']);
+        // The prompt stays the LAST argument, as every adapter promises.
+        expect(argv[argv.length - 1]).toContain('resume-next-action');
+    });
+    test('without a declared posture the launch argv is unchanged — the shipped bug', () => {
+        expect((0, adapter_1.adapterFor)('claude-code').launchArgv('resume-next-action')).toEqual([
+            'claude', '-p', expect.stringContaining('resume-next-action'),
+        ]);
+    });
+    test('codex declares its mapping unverified rather than inventing a flag', () => {
+        // The R0 evidence captured `codex --help`, never `codex exec --help`, so
+        // where the approval flag goes on the subcommand is not established.
+        expect((0, adapter_1.controllerAutonomyMapping)('codex')).toBe('unverified');
+        expect((0, adapter_1.controllerAutonomyMapping)('claude-code')).toBe('verified');
+        expect((0, adapter_1.adapterFor)('codex').launchArgv('resume-next-action', 'approval-free'))
+            .toEqual(['codex', 'exec', expect.stringContaining('resume-next-action')]);
+    });
+    test('the posture vocabulary refuses anything it has not measured', () => {
+        expect(adapter_1.CONTROLLER_AUTONOMIES).toEqual(['approval-free']);
+        for (const invalid of ['acceptEdits', 'bypassPermissions', 'never', '', 'full', undefined, 7]) {
+            expect((0, adapter_1.isControllerAutonomy)(invalid)).toBe(false);
+        }
+        expect((0, adapter_1.isControllerAutonomy)('approval-free')).toBe(true);
+    });
+});
+describe('unattendedController stops being asserted for free (#168)', () => {
+    test('degrades to unverified when no posture was declared', () => {
+        expect(admission_1.PROVIDER_EXECUTION_CAPABILITIES['claude-code'].unattendedController).toBe('supported');
+        expect((0, admission_1.unattendedCapabilities)('claude-code', undefined).unattendedController).toBe('unverified');
+    });
+    test('honours the operator declaration even where AWM injects no flag', () => {
+        // AWM cannot verify codex's posture mapping, but the operator may carry
+        // approval policy in their own config. Refusing to guess the flag is not
+        // the same as refusing the operator — same doctrine as --expected-digest.
+        expect((0, adapter_1.controllerAutonomyMapping)('codex')).toBe('unverified');
+        expect((0, admission_1.unattendedCapabilities)('codex', 'approval-free').unattendedController).toBe('supported');
+    });
+    test('is supported once the posture is declared', () => {
+        expect((0, admission_1.unattendedCapabilities)('claude-code', 'approval-free').unattendedController).toBe('supported');
+    });
+    test('never promotes a provider that never had the capability', () => {
+        expect(admission_1.PROVIDER_EXECUTION_CAPABILITIES.cursor.unattendedController).toBe('unverified');
+        expect((0, admission_1.unattendedCapabilities)('cursor', 'approval-free').unattendedController).toBe('unverified');
+    });
+});
+describe('awm watch surfaces the posture on the compiled binary (#168)', () => {
+    const cli = path_1.default.resolve(__dirname, '../../../dist/src/index.js');
+    test('declares the flag and its vocabulary', () => {
+        const help = (0, child_process_1.spawnSync)(process.execPath, [cli, 'watch', '--help'], { encoding: 'utf8', env: { ...process.env, AWM_NO_UPDATE_CHECK: '1' } });
+        expect(help.status).toBe(0);
+        expect(help.stdout).toContain('--controller-autonomy');
+        expect(help.stdout).toContain('approval-free');
+    });
+    test('refuses a posture it cannot honour instead of launching a controller that stalls', () => {
+        // Hermetic repo on a real branch: without a cwd of its own this inherits
+        // the checkout, and a detached HEAD makes `currentBranch()` fail first —
+        // which is exactly how this test passed locally and failed on all six CI
+        // legs. The assertion must depend on the flag, not on ambient git state.
+        const repo = (0, git_fixture_1.initRepo)();
+        try {
+            const result = (0, child_process_1.spawnSync)(process.execPath, [cli, 'watch', '--provider', 'claude-code', '--controller-autonomy', 'bypassPermissions'], { cwd: repo, encoding: 'utf8', env: { ...process.env, AWM_NO_UPDATE_CHECK: '1' } });
+            expect(result.status).toBe(1);
+            expect(result.stderr).toContain('--controller-autonomy invalido');
+            expect(result.stderr).toContain('approval-free');
+        }
+        finally {
+            fs_1.default.rmSync(repo, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/structural/lint-covers-typescript.test.js

@@ -0,0 +1,56 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const child_process_1 = require("child_process");
+const path_1 = __importDefault(require("path"));
+// #171: the lint gate linted 14 files — all js/mjs — and exited 0 on a
+// TypeScript CLI. `eslint.config.awm.mjs` imports a project config that does
+// not exist, swallows the failure, and its remaining objects declare no
+// `files`, so eslint's default universe (js/mjs/cjs) left every .ts out.
+//
+// The gate was green for months and the `lint` sensor certified on it, which
+// `plan admit --verify-sensors` then consumes as the unattended handoff gate.
+//
+// This asserts on the SET OF FILES LINTED, never on the exit code. An exit-code
+// assertion is exactly what let this survive: a lint that examines nothing
+// exits 0.
+const CLI_ROOT = path_1.default.resolve(__dirname, '../..');
+/** One eslint run for the whole suite. Invoked through node against eslint's own
+ *  js entrypoint rather than `npx`: on Windows `npx` resolves to `npx.cmd`, and
+ *  `execFileSync` cannot execute a `.cmd` without a shell — the exact trap this
+ *  repo already documents in tests/integration/published-doctor-evidence.e2e.test.ts,
+ *  and the one this test hit on both Windows legs of its first CI run. Going
+ *  through `process.execPath` needs no shell, so no argument escaping either. */
+function lint() {
+    const raw = (0, child_process_1.execFileSync)(process.execPath, [
+        path_1.default.join(CLI_ROOT, 'node_modules', 'eslint', 'bin', 'eslint.js'),
+        '.', '--config', 'eslint.config.awm.mjs', '--format', 'json',
+    ], { cwd: CLI_ROOT, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+    return JSON.parse(raw);
+}
+describe('the lint gate covers TypeScript (#171)', () => {
+    jest.setTimeout(10 * 60_000);
+    const results = lint();
+    const files = results.map(entry => entry.filePath);
+    const typescript = files.filter(file => file.endsWith('.ts'));
+    test('lints the TypeScript sources, not only the js/mjs tooling', () => {
+        // A floor, not a lock: adding sources must not fail this.
+        expect(typescript.length).toBeGreaterThan(400);
+        expect(typescript.some(file => file.includes(`${path_1.default.sep}src${path_1.default.sep}`))).toBe(true);
+        expect(typescript.some(file => file.includes(`${path_1.default.sep}tests${path_1.default.sep}`))).toBe(true);
+    });
+    test('lints this very file, so the assertion cannot be vacuous', () => {
+        expect(files).toContain(path_1.default.join(CLI_ROOT, 'tests', 'structural', 'lint-covers-typescript.test.ts'));
+    });
+    test('reports no unresolved rule references', () => {
+        // Four stale `eslint-disable @typescript-eslint/no-var-requires` comments
+        // survived precisely because .ts was never linted: eslint errors on a rule
+        // it cannot resolve, and nobody ever saw it. A new one must fail here
+        // rather than wait for the next person to turn the gate on.
+        const unresolved = results.flatMap(entry => entry.messages.filter(m => /Definition for rule .* was not found/.test(m.message))
+            .map(m => `${entry.filePath}: ${m.message}`));
+        expect(unresolved).toEqual([]);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "9.11.0",
+  "version": "9.11.2",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"
@@ -59,6 +59,7 @@
     "@types/js-yaml": "4.0.9",
     "@types/node": "^25.3.0",
     "@types/semver": "^7.7.1",
+    "@typescript-eslint/parser": "^8.70.0",
     "dependency-cruiser": "16.10.4",
     "eslint": "10.8.1",
     "jest": "^30.2.0",