agentic-workflow-manager 9.11.10 → 9.11.12

package/dist/src/commands/plan/index.js

@@ -209,12 +209,9 @@ function registerPlanCommand(program, deps = { validatePlanFile: validate_1.vali
             const state = journalObservation(cwd).journalState;
             const lineage = state.implementationLineages.find(candidate => candidate.id === options.lineage);
             const next = (0, journal_1.resolveLineageEscalation)(state, options.lineage, lineage.initialProfile);
-            const resolved = (0, resolve_1.resolveSelection)({ role: 'implementer', requestedProfile: next.profile, policy: policy.state === 'approved' ? policy.policy : undefined, capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined, runtime, now: new Date() });
+            const resolved = (0, resolve_1.resolveEscalatedSelection)({ role: 'implementer', requestedProfile: next.profile, expectedEffort: next.effort, policy: policy.state === 'approved' ? policy.policy : undefined, capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined, runtime, now: new Date() });
             if (resolved.state === 'blocked')
                 return resolved;
-            const highRequiresFull = next.effort !== 'high' || (policy.state === 'approved' && (() => { const full = policy.policy.content.mappings.find(row => row.target === runtime.target && row.runtimeKind === runtime.kind)?.fullCapability; return full?.selector.kind === resolved.selection.selector.kind && full.selector.id === resolved.selection.selector.id && full.effort.kind === 'explicit' && full.effort.value === 'high'; })());
-            if (resolved.selection.effort.kind !== 'explicit' || resolved.selection.effort.value !== next.effort || !highRequiresFull)
-                return { state: 'blocked', diagnostics: [{ code: 'ROUTING_ESCALATION_EFFORT_UNAVAILABLE', message: 'The approved selected effort does not match the next lineage escalation.' }] };
             return { ...resolved, envelope: { schema: 'routing-envelope/v1', runtime, role: 'implementer', planDigest: report.planDigest, executionDigest: report.executionDigest, sliceId: lineage.sliceId, requestedProfile: lineage.initialProfile, effectiveProfile: next.profile, resolved: resolved.selection, policyDigest: resolved.policyDigest, capabilityDigest: resolved.capabilityDigest, outcome: resolved.outcome, unavailableEvidence: resolved.unavailableEvidence }, custodyHandoff: { kind: 'routing-reserve', obligationId: lineage.obligationId, lineageId: lineage.id } };
         })();
         process.stdout.write(options.json ? `${JSON.stringify(result)}\n` : `Plan routing: ${result.state}\n`);

package/dist/src/commands/watch/apply.js

@@ -20,6 +20,8 @@ const redact_1 = require("../../core/journal/redact");
 const git_1 = require("../../core/tracks/git");
 const types_1 = require("../../core/journal/types");
 const journal_1 = require("../../core/model-policy/journal");
+const store_2 = require("../../core/model-policy/store");
+const capabilities_1 = require("../../core/model-policy/capabilities");
 function now() { return new Date().toISOString(); }
 const VERIFICATION_KINDS = ['test', 'lint', 'sensors', 'review', 'qa', 'interlock', 'track-integration'];
 function verificationItems(value, field) {
@@ -116,7 +118,13 @@ function applyRequestToState(s, env, digest, repoRoot) {
         const p = env.payload;
         if (typeof p.obligationId !== 'string' || typeof p.lineageId !== 'string' || !(0, types_1.isRoutingEnvelope)(p.envelope) || typeof p.fingerprint !== 'string' || (p.at !== undefined && typeof p.at !== 'string'))
             throw new Error('routing-reserve requiere payload estricto');
-        const reserved = (0, journal_1.reserveRoutingAttempt)(s, { obligationId: p.obligationId, lineageId: p.lineageId, envelope: p.envelope, fingerprint: p.fingerprint }, p.at ?? now());
+        const envelope = p.envelope;
+        const reserved = (0, journal_1.reserveRoutingAttempt)(s, { obligationId: p.obligationId, lineageId: p.lineageId, envelope, fingerprint: p.fingerprint, approval: () => {
+                const checkedAt = new Date();
+                const policy = (0, store_2.readEffectivePolicy)(repoRoot);
+                const capabilities = (0, capabilities_1.readCapabilities)((0, capabilities_1.validateRuntimeKey)(envelope.runtime), checkedAt);
+                return { checkedAt, policy: policy.state === 'approved' ? policy.policy : undefined, capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined };
+            } }, p.at ?? now());
         Object.assign(s, reserved.state);
         (0, requests_1.applyOutcome)(s, { ...base, outcome: 'applied', resultRef: reserved.attemptId });
         return;

package/dist/src/core/model-policy/journal.js

@@ -9,6 +9,8 @@ exports.resolveLineageEscalation = resolveLineageEscalation;
 exports.routingReport = routingReport;
 const crypto_1 = __importDefault(require("crypto"));
 const types_1 = require("../journal/types");
+const resolve_1 = require("./resolve");
+const capabilities_1 = require("./capabilities");
 function assertTimestamp(value) { if (typeof value !== 'string' || !Number.isFinite(Date.parse(value)))
     throw new Error('routing timestamp is invalid'); }
 function canonical(value) { if (Array.isArray(value))
@@ -45,9 +47,19 @@ function reserveRoutingAttempt(state, input, now) {
             throw new Error('routing implementer profile is invalid');
         const expected = resolveLineageEscalation(next, input.lineageId, initial);
         const actualEffort = input.envelope.resolved.effort.kind === 'explicit' ? input.envelope.resolved.effort.value : 'runtime-default';
-        if (input.envelope.effectiveProfile !== expected.profile || actualEffort !== expected.effort)
+        const judgmentHighAfterIntegration = expected.profile === 'judgment' && expected.effort === 'medium' && actualEffort === 'high' && attempts.length > 0 && attempts[attempts.length - 1].envelope.effectiveProfile === 'integration';
+        if (input.envelope.effectiveProfile !== expected.profile || (actualEffort !== expected.effort && !judgmentHighAfterIntegration))
             throw new Error('routing effective escalation mismatch');
     }
+    const approval = input.approval?.();
+    if (!approval)
+        throw new Error('routing reservation requires current approval');
+    const selectionInput = { role: input.envelope.role, requestedProfile: input.envelope.role === 'implementer' ? input.envelope.effectiveProfile : 'full', runtime: (0, capabilities_1.validateRuntimeKey)(input.envelope.runtime), policy: approval.policy, capabilities: approval.capabilities, now: approval.checkedAt };
+    const resolved = input.envelope.role === 'implementer' && input.envelope.effectiveProfile === 'judgment' && input.envelope.resolved.effort.kind === 'explicit' && input.envelope.resolved.effort.value === 'high'
+        ? (0, resolve_1.resolveEscalatedSelection)({ ...selectionInput, role: 'implementer', requestedProfile: 'judgment', expectedEffort: 'high' })
+        : (0, resolve_1.resolveSelection)(selectionInput);
+    if (resolved.state !== 'resolved' || resolved.effectiveProfile !== input.envelope.effectiveProfile || canonical(resolved.selection) !== canonical(input.envelope.resolved) || resolved.policyDigest !== input.envelope.policyDigest || resolved.capabilityDigest !== input.envelope.capabilityDigest || resolved.outcome !== input.envelope.outcome || canonical(resolved.unavailableEvidence) !== canonical(input.envelope.unavailableEvidence))
+        throw new Error('routing reservation approval mismatch');
     const attempt = attempts.length + 1;
     const id = `route-${crypto_1.default.createHash('sha256').update(`${input.lineageId}\0${attempt}\0${envelopeDigest}\0${input.fingerprint}`).digest('hex').slice(0, 24)}`;
     next.routingAttempts.push({ schema: 'routing-attempt/v1', id, obligationId: input.obligationId, lineageId: input.lineageId, attempt, envelope: structuredClone(input.envelope), envelopeDigest, fingerprint: input.fingerprint, state: 'reserved' });
@@ -88,8 +100,10 @@ function resolveLineageEscalation(state, lineageId, initial) {
     const attempts = (state.routingAttempts ?? []).filter((attempt) => attempt.lineageId === lineageId && attempt.envelope.role === 'implementer').sort((left, right) => left.attempt - right.attempt);
     if (attempts.some((attempt) => ['reserved', 'active', 'unknown'].includes(attempt.state)))
         throw new Error('routing lineage has a live or unknown attempt');
-    if (attempts.length === 0)
-        return { profile: initial, effort: 'medium' };
+    if (attempts.length === 0) {
+        const lineage = state.implementationLineages?.find(candidate => candidate.id === lineageId);
+        return { profile: initial, effort: lineage?.initialEffort ?? 'medium' };
+    }
     const last = attempts[attempts.length - 1];
     if (last.verdict !== 'fail')
         throw new Error('routing lineage advances only after a terminal failed verdict');

package/dist/src/core/model-policy/resolve.js

@@ -1,11 +1,35 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveEscalatedSelection = resolveEscalatedSelection;
 exports.resolveDispatch = resolveDispatch;
 exports.resolveV1Dispatch = resolveV1Dispatch;
 exports.resolveSelection = resolveSelection;
 const capabilities_1 = require("./capabilities");
 const validate_1 = require("./validate");
 const validate_2 = require("../plan/validate");
+function resolveEscalatedSelection(input) {
+    if (!input || input.role !== 'implementer' || !['medium', 'high'].includes(input.expectedEffort))
+        throw new Error('escalated selection requires an implementer and a supported effort');
+    const selected = resolveSelection(input);
+    if (selected.state === 'blocked')
+        return selected;
+    const effort = selected.selection.effort;
+    if (input.requestedProfile !== 'judgment')
+        return effort.kind === 'explicit' && effort.value === input.expectedEffort ? selected : blocked('ROUTING_ESCALATION_EFFORT_UNAVAILABLE', 'The approved selected effort does not match the next lineage escalation.');
+    if (effort.kind === 'explicit' && effort.value === 'medium' && input.expectedEffort === 'medium')
+        return selected;
+    const full = resolveSelection({ ...input, role: 'code-quality-reviewer', requestedProfile: 'full' });
+    if (full.state === 'blocked')
+        return full;
+    const sameModel = full.selection.selector.kind === selected.selection.selector.kind && full.selection.selector.id === selected.selection.selector.id;
+    if (!sameModel || full.selection.effort.kind !== 'explicit' || full.selection.effort.value !== 'high')
+        return blocked('ROUTING_ESCALATION_EFFORT_UNAVAILABLE', 'Judgment high requires the same approved full-capability model at explicit high effort.');
+    if (effort.kind === 'explicit' && effort.value === 'high')
+        return selected;
+    if (effort.kind === 'explicit' && effort.value === 'medium' && input.expectedEffort === 'high')
+        return { ...full, effectiveProfile: 'judgment' };
+    return blocked('ROUTING_ESCALATION_EFFORT_UNAVAILABLE', 'The approved selected effort does not match the next lineage escalation.');
+}
 /** Resolve only from the immutable validator report; a reopened plan may never
  * provide a routing profile after validation. */
 function resolveDispatch(input) {

package/dist/tests/commands/job/routing-report-cli.test.js

@@ -11,7 +11,8 @@ const commander_1 = require("commander");
 const job_1 = require("../../../src/commands/job");
 const store_1 = require("../../../src/core/journal/store");
 const journal_1 = require("../../../src/core/model-policy/journal");
-const envelope = { schema: 'routing-envelope/v1', runtime: { target: 'codex', kind: 'native', version: '1', accountScopeDigest: '0'.repeat(64) }, role: 'implementer', sliceId: 'S1', requestedProfile: 'mechanical', effectiveProfile: 'mechanical', resolved: { selector: { kind: 'model', id: 'model-private' }, effort: { kind: 'explicit', value: 'medium' } }, outcome: 'native', unavailableEvidence: [], policyDigest: 'a'.repeat(64), capabilityDigest: 'b'.repeat(64), planDigest: 'c'.repeat(64), executionDigest: 'd'.repeat(64) };
+const capabilities_1 = require("../../../src/core/model-policy/capabilities");
+const routing_approval_1 = require("../../helpers/routing-approval");
 function gitInit(repo) {
     (0, child_process_1.execFileSync)('git', ['-c', 'user.email=t@t.t', '-c', 'user.name=t', 'init', '-q', '-b', 'main'], { cwd: repo });
     fs_1.default.writeFileSync(path_1.default.join(repo, 'fixture'), 'x');
@@ -24,7 +25,12 @@ test('`job routing-report --json` emits only aggregate routing evidence', async
         gitInit(repo);
         (0, store_1.initJournal)(repo, 'main');
         const state = (0, store_1.readJournal)(repo, 'main').state;
-        const reserved = (0, journal_1.reserveRoutingAttempt)(state, { obligationId: 'obligation', lineageId: 'lineage', envelope, fingerprint: 'e'.repeat(64) }, '2026-09-17T00:00:00.000Z');
+        const approved = (0, routing_approval_1.routingApproval)();
+        const privateSelection = { ...routing_approval_1.routingEnvelope.resolved, selector: { kind: 'model', id: 'model-private' } };
+        approved.policy.content.mappings[0].profiles.mechanical = privateSelection;
+        approved.capabilities.availableSelections.push(privateSelection);
+        const envelope = { ...routing_approval_1.routingEnvelope, resolved: privateSelection, capabilityDigest: (0, capabilities_1.capabilityReceiptDigest)(approved.capabilities) };
+        const reserved = (0, journal_1.reserveRoutingAttempt)(state, { obligationId: 'obligation', lineageId: 'lineage', envelope, fingerprint: 'e'.repeat(64), approval: () => approved }, '2026-09-17T00:00:00.000Z');
         (0, store_1.writeJournal)(repo, 'main', (0, journal_1.observeRoutingAttempt)(reserved.state, { attemptId: reserved.attemptId, nativeAgentId: 'native-private' }, '2026-09-17T00:01:00.000Z'));
         const program = new commander_1.Command();
         program.exitOverride();

package/dist/tests/commands/job/routing.test.js

@@ -2,9 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const types_1 = require("../../../src/core/journal/types");
 const journal_1 = require("../../../src/core/model-policy/journal");
-const envelope = { schema: 'routing-envelope/v1', runtime: { target: 'codex', kind: 'native', version: '1', accountScopeDigest: '0'.repeat(64) }, role: 'implementer', sliceId: 'S1', requestedProfile: 'mechanical', effectiveProfile: 'mechanical', resolved: { selector: { kind: 'model', id: 'm' }, effort: { kind: 'explicit', value: 'medium' } }, outcome: 'native', unavailableEvidence: [], policyDigest: 'a'.repeat(64), capabilityDigest: 'b'.repeat(64), planDigest: 'c'.repeat(64), executionDigest: 'd'.repeat(64) };
+const routing_approval_1 = require("../../helpers/routing-approval");
 test('routing report remains read-only across an observed attempt', () => {
-    const reserved = (0, journal_1.reserveRoutingAttempt)((0, types_1.emptyState)('main'), { obligationId: 'o1', lineageId: 'l1', envelope, fingerprint: 'e'.repeat(64) }, '2026-09-17T00:00:00.000Z');
+    const reserved = (0, journal_1.reserveRoutingAttempt)((0, types_1.emptyState)('main'), { obligationId: 'o1', lineageId: 'l1', envelope: routing_approval_1.routingEnvelope, fingerprint: 'e'.repeat(64), approval: routing_approval_1.routingApproval }, '2026-09-17T00:00:00.000Z');
     const observed = (0, journal_1.observeRoutingAttempt)(reserved.state, { attemptId: reserved.attemptId, nativeAgentId: 'native-id' }, '2026-09-17T00:01:00.000Z');
     expect((0, journal_1.routingReport)(observed)).toMatchObject({ attempts: 1, byState: { active: 1 } });
     expect(observed.routingAttempts[0].nativeAgentId).toBe('native-id');

package/dist/tests/commands/plan/index.test.js

@@ -84,7 +84,7 @@ describe('plan validate Commander wiring', () => {
         // not come out of validatePlanFile, so a spread-and-relabel fixture
         // cannot reach this path at all.
         const sliceId = 'S1';
-        const sel = { selector: { kind: 'model', id: 'gpt-5.6-luna' }, effort: { kind: 'explicit', value: 'medium' } };
+        const sel = { selector: { kind: 'model', id: 'gpt-5.6-luna' }, effort: { kind: 'explicit', value: 'high' } };
         const full = { selector: { kind: 'model', id: 'gpt-5.6-sol' }, effort: { kind: 'explicit', value: 'high' } };
         const sha = 'a'.repeat(64);
         const content = { schema: 'model-policy/v1', mappings: [{ target: 'codex', runtimeKind: 'native', profiles: { mechanical: sel, integration: sel, judgment: sel }, fullCapability: full, degradation: { allowMissingModelOverride: false, allowMissingEffortOverride: false, allowMissingObservedIdentity: false } }], implementationBudget: { maxAttempts: 3, escalation: ['mechanical', 'integration', 'judgment'], judgmentEfforts: ['medium', 'high'] } };
@@ -115,7 +115,7 @@ describe('plan validate Commander wiring', () => {
         expect(emitted.envelope.executionDigest).toBe(v2Valid.executionDigest);
         // The point of the whole thing: that envelope reserves a first attempt,
         // which is what creates the lineage the escalation path later needs.
-        const reserved = (0, journal_1.reserveRoutingAttempt)((0, types_1.emptyState)('main'), { obligationId: 'o1', lineageId: 'l1', envelope: emitted.envelope, fingerprint: 'e'.repeat(64) }, '2026-09-19T00:00:00.000Z');
+        const reserved = (0, journal_1.reserveRoutingAttempt)((0, types_1.emptyState)('main'), { obligationId: 'o1', lineageId: 'l1', envelope: emitted.envelope, fingerprint: 'e'.repeat(64), approval: () => ({ policy: readEffectivePolicy().policy, capabilities: receipt, checkedAt: new Date() }) }, '2026-09-19T00:00:00.000Z');
         expect(reserved.attemptId).toEqual(expect.any(String));
         expect(reserved.state.implementationLineages).toEqual([expect.objectContaining({ id: 'l1', sliceId, initialProfile: 'mechanical' })]);
     });

package/dist/tests/commands/watch/apply.test.js

@@ -47,6 +47,9 @@ const store_1 = require("../../../src/core/journal/store");
 const paths_1 = require("../../../src/core/journal/paths");
 const atomicFile = __importStar(require("../../../src/core/atomic-file"));
 const gate_1 = require("../../../src/commands/job/gate");
+const canonical_1 = require("../../../src/core/model-policy/canonical");
+const capabilities_1 = require("../../../src/core/model-policy/capabilities");
+const routing_approval_1 = require("../../helpers/routing-approval");
 function jobPayload(argv) {
     return { argv, paths: [], cwd: '.', fingerprint: 'fp-1', commandDigest: 'cd-1', expandedPaths: [] };
 }
@@ -195,16 +198,35 @@ describe('aplicacion transaccional de requests', () => {
         expect(s.controllerHeartbeatAt).toBeUndefined();
     });
     test('routing reserve/observe es supervisado, idempotente y una generacion vieja no muta intentos', () => {
-        const envelope = { schema: 'routing-envelope/v1', runtime: { target: 'codex', kind: 'native', version: '1', accountScopeDigest: '0'.repeat(64) }, role: 'implementer', sliceId: 'S1', requestedProfile: 'mechanical', effectiveProfile: 'mechanical', resolved: { selector: { kind: 'model', id: 'm' }, effort: { kind: 'explicit', value: 'medium' } }, outcome: 'native', unavailableEvidence: [], policyDigest: 'a'.repeat(64), capabilityDigest: 'b'.repeat(64), planDigest: 'c'.repeat(64), executionDigest: 'd'.repeat(64) };
-        (0, requests_1.emitRequest)(repo, 'rama', { kind: 'routing-reserve', generationToken: 'g1', idempotencyKey: 'routing-1', payload: { obligationId: 'o1', lineageId: 'l1', envelope, fingerprint: 'e'.repeat(64) } });
-        (0, apply_1.consumePendingRequests)(repo, 'rama', 'g1');
-        const attempt = (0, store_1.readJournal)(repo, 'rama').state.routingAttempts[0];
-        (0, requests_1.emitRequest)(repo, 'rama', { kind: 'routing-observe', generationToken: 'g1', idempotencyKey: 'routing-2', payload: { attemptId: attempt.id, nativeAgentId: 'native-1' } });
-        (0, apply_1.consumePendingRequests)(repo, 'rama', 'g1');
-        expect((0, store_1.readJournal)(repo, 'rama').state.routingAttempts[0]).toMatchObject({ state: 'active', nativeAgentId: 'native-1' });
-        (0, requests_1.emitRequest)(repo, 'rama', { kind: 'routing-reserve', generationToken: 'old', idempotencyKey: 'routing-old', payload: { obligationId: 'o1', lineageId: 'l2', envelope, fingerprint: 'f'.repeat(64) } });
-        expect((0, apply_1.consumePendingRequests)(repo, 'rama', 'g1').rejectedStale).toBe(1);
-        expect((0, store_1.readJournal)(repo, 'rama').state.routingAttempts).toHaveLength(1);
+        const priorHome = process.env.AWM_HOME;
+        process.env.AWM_HOME = path_1.default.join(repo, 'operator');
+        try {
+            const approved = (0, routing_approval_1.routingApproval)();
+            approved.policy.contentDigest = (0, canonical_1.canonicalPolicyDigest)(approved.policy.content);
+            approved.capabilities.recordedAt = new Date(Date.now() - 60_000).toISOString();
+            approved.capabilities.expiresAt = new Date(Date.now() + 3_600_000).toISOString();
+            const envelope = { ...routing_approval_1.routingEnvelope, policyDigest: approved.policy.contentDigest, capabilityDigest: (0, capabilities_1.capabilityReceiptDigest)(approved.capabilities) };
+            fs_1.default.mkdirSync(path_1.default.join(repo, '.awm'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(repo, '.awm', 'model-policy.json'), JSON.stringify(approved.policy));
+            const receiptPath = path_1.default.join(process.env.AWM_HOME, 'routing-capabilities', 'codex', 'native.json');
+            fs_1.default.mkdirSync(path_1.default.dirname(receiptPath), { recursive: true });
+            fs_1.default.writeFileSync(receiptPath, JSON.stringify(approved.capabilities));
+            (0, requests_1.emitRequest)(repo, 'rama', { kind: 'routing-reserve', generationToken: 'g1', idempotencyKey: 'routing-1', payload: { obligationId: 'o1', lineageId: 'l1', envelope, fingerprint: 'e'.repeat(64) } });
+            expect((0, apply_1.consumePendingRequests)(repo, 'rama', 'g1').applied).toBe(1);
+            const attempt = (0, store_1.readJournal)(repo, 'rama').state.routingAttempts[0];
+            (0, requests_1.emitRequest)(repo, 'rama', { kind: 'routing-observe', generationToken: 'g1', idempotencyKey: 'routing-2', payload: { attemptId: attempt.id, nativeAgentId: 'native-1' } });
+            (0, apply_1.consumePendingRequests)(repo, 'rama', 'g1');
+            expect((0, store_1.readJournal)(repo, 'rama').state.routingAttempts[0]).toMatchObject({ state: 'active', nativeAgentId: 'native-1' });
+            (0, requests_1.emitRequest)(repo, 'rama', { kind: 'routing-reserve', generationToken: 'old', idempotencyKey: 'routing-old', payload: { obligationId: 'o1', lineageId: 'l2', envelope, fingerprint: 'f'.repeat(64) } });
+            expect((0, apply_1.consumePendingRequests)(repo, 'rama', 'g1').rejectedStale).toBe(1);
+            expect((0, store_1.readJournal)(repo, 'rama').state.routingAttempts).toHaveLength(1);
+        }
+        finally {
+            if (priorHome === undefined)
+                delete process.env.AWM_HOME;
+            else
+                process.env.AWM_HOME = priorHome;
+        }
     });
     test('request corrupta se aparta VISIBLE como .corrupt, jamas se descarta (R1.6)', () => {
         fs_1.default.writeFileSync(path_1.default.join((0, paths_1.requestsDir)(repo, 'rama'), 'req-roto.json'), '{no-json');

package/dist/tests/core/model-policy/journal.test.js

@@ -2,45 +2,87 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const types_1 = require("../../../src/core/journal/types");
 const journal_1 = require("../../../src/core/model-policy/journal");
-const envelope = { schema: 'routing-envelope/v1', runtime: { target: 'codex', kind: 'native', version: '1', accountScopeDigest: '0'.repeat(64) }, role: 'implementer', sliceId: 'S1', requestedProfile: 'mechanical', effectiveProfile: 'mechanical', resolved: { selector: { kind: 'model', id: 'm' }, effort: { kind: 'explicit', value: 'medium' } }, outcome: 'native', unavailableEvidence: [], policyDigest: 'a'.repeat(64), capabilityDigest: 'b'.repeat(64), planDigest: 'c'.repeat(64), executionDigest: 'd'.repeat(64) };
+const capabilities_1 = require("../../../src/core/model-policy/capabilities");
+const routing_approval_1 = require("../../helpers/routing-approval");
 describe('routing journal helpers', () => {
     it('reserves one idempotent attempt and records native observation', () => {
         const state = (0, types_1.emptyState)('main');
-        const reserved = (0, journal_1.reserveRoutingAttempt)(state, { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope, fingerprint: 'e'.repeat(64) }, '2026-09-17T00:00:00.000Z');
-        const replay = (0, journal_1.reserveRoutingAttempt)(reserved.state, { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope, fingerprint: 'e'.repeat(64) }, '2026-09-17T00:01:00.000Z');
+        const reserved = (0, journal_1.reserveRoutingAttempt)(state, { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope: routing_approval_1.routingEnvelope, fingerprint: 'e'.repeat(64), approval: routing_approval_1.routingApproval }, '2026-09-17T00:00:00.000Z');
+        const replay = (0, journal_1.reserveRoutingAttempt)(reserved.state, { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope: routing_approval_1.routingEnvelope, fingerprint: 'e'.repeat(64) }, '2026-09-17T00:01:00.000Z');
         expect(replay.attemptId).toBe(reserved.attemptId);
         const observed = (0, journal_1.observeRoutingAttempt)(replay.state, { attemptId: reserved.attemptId, nativeAgentId: 'native-1' }, '2026-09-17T00:02:00.000Z');
         expect(observed.routingAttempts?.[0]).toMatchObject({ state: 'active', nativeAgentId: 'native-1' });
     });
+    it('reserves an initial mechanical attempt at its approved explicit high effort', () => {
+        const high = { ...routing_approval_1.routingEnvelope, resolved: { ...routing_approval_1.routingEnvelope.resolved, effort: { kind: 'explicit', value: 'high' } } };
+        expect(() => (0, journal_1.reserveRoutingAttempt)((0, types_1.emptyState)('main'), { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope: high, fingerprint: 'e'.repeat(64) }, '2026-09-17T00:00:00.000Z')).toThrow(/approval/i);
+        const approved = (0, routing_approval_1.routingApproval)();
+        approved.policy.content.mappings[0].profiles.mechanical = (0, routing_approval_1.routingSelection)('high');
+        const reserved = (0, journal_1.reserveRoutingAttempt)((0, types_1.emptyState)('main'), { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope: high, fingerprint: 'e'.repeat(64), approval: () => approved }, '2026-09-17T00:00:00.000Z');
+        expect(reserved.state.implementationLineages?.[0].initialEffort).toBe('high');
+    });
+    it('reserves the approved high-effort judgment profile after a failed integration attempt', () => {
+        const integration = { ...routing_approval_1.routingEnvelope, requestedProfile: 'integration', effectiveProfile: 'integration' };
+        const first = (0, journal_1.reserveRoutingAttempt)((0, types_1.emptyState)('main'), { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope: integration, fingerprint: 'e'.repeat(64), approval: routing_approval_1.routingApproval }, '2026-09-17T00:00:00.000Z').state;
+        first.routingAttempts[0].state = 'blocked';
+        first.routingAttempts[0].verdict = 'fail';
+        const judgment = { ...integration, effectiveProfile: 'judgment', resolved: { ...integration.resolved, effort: { kind: 'explicit', value: 'high' } } };
+        const approved = (0, routing_approval_1.routingApproval)();
+        const second = (0, journal_1.reserveRoutingAttempt)(first, { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope: { ...judgment, capabilityDigest: (0, capabilities_1.capabilityReceiptDigest)(approved.capabilities) }, fingerprint: 'f'.repeat(64), approval: () => approved }, '2026-09-17T00:01:00.000Z').state;
+        expect(second.routingAttempts?.[1].envelope.resolved).toEqual(judgment.resolved);
+    });
+    it('rejects judgment high without current matching approval at reservation', () => {
+        const integration = { ...routing_approval_1.routingEnvelope, requestedProfile: 'integration', effectiveProfile: 'integration' };
+        const first = (0, journal_1.reserveRoutingAttempt)((0, types_1.emptyState)('main'), { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope: integration, fingerprint: 'e'.repeat(64), approval: routing_approval_1.routingApproval }, '2026-09-17T00:00:00.000Z').state;
+        first.routingAttempts[0].state = 'blocked';
+        first.routingAttempts[0].verdict = 'fail';
+        const high = { ...integration, effectiveProfile: 'judgment', resolved: (0, routing_approval_1.routingSelection)('high') };
+        const input = { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope: high, fingerprint: 'f'.repeat(64) };
+        expect(() => (0, journal_1.reserveRoutingAttempt)(first, input, '2026-09-17T00:01:00.000Z')).toThrow(/approval/i);
+        const approved = (0, routing_approval_1.routingApproval)();
+        expect(() => (0, journal_1.reserveRoutingAttempt)(first, { ...input, envelope: { ...high, capabilityDigest: 'b'.repeat(64) }, approval: () => approved }, '2026-09-17T00:01:00.000Z')).toThrow(/approval/i);
+        const stale = { ...approved, checkedAt: new Date('2026-09-19T00:00:00.000Z') };
+        expect(() => (0, journal_1.reserveRoutingAttempt)(first, { ...input, envelope: { ...high, capabilityDigest: (0, capabilities_1.capabilityReceiptDigest)(approved.capabilities) }, approval: () => stale }, '2026-09-17T00:01:00.000Z')).toThrow(/approval/i);
+    });
+    it('reserves judgment high after a failed judgment medium attempt without resetting the lineage', () => {
+        const judgment = { ...routing_approval_1.routingEnvelope, requestedProfile: 'judgment', effectiveProfile: 'judgment' };
+        const first = (0, journal_1.reserveRoutingAttempt)((0, types_1.emptyState)('main'), { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope: judgment, fingerprint: 'e'.repeat(64), approval: routing_approval_1.routingApproval }, '2026-09-17T00:00:00.000Z').state;
+        first.routingAttempts[0].state = 'blocked';
+        first.routingAttempts[0].verdict = 'fail';
+        const high = { ...judgment, resolved: { ...judgment.resolved, effort: { kind: 'explicit', value: 'high' } } };
+        const approved = (0, routing_approval_1.routingApproval)();
+        const second = (0, journal_1.reserveRoutingAttempt)(first, { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope: { ...high, capabilityDigest: (0, capabilities_1.capabilityReceiptDigest)(approved.capabilities) }, fingerprint: 'f'.repeat(64), approval: () => approved }, '2026-09-17T00:01:00.000Z').state;
+        expect(second.routingAttempts?.[1]).toMatchObject({ attempt: 2, envelope: { effectiveProfile: 'judgment', resolved: high.resolved } });
+    });
     it('rejects a fourth implementer attempt in one lineage', () => {
         let state = (0, types_1.emptyState)('main');
         for (const [index, profile] of ['mechanical', 'integration', 'judgment'].entries()) {
-            state = (0, journal_1.reserveRoutingAttempt)(state, { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope: { ...envelope, effectiveProfile: profile }, fingerprint: `${'a'.repeat(63)}${index}` }, '2026-09-17T00:00:00.000Z').state;
+            state = (0, journal_1.reserveRoutingAttempt)(state, { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope: { ...routing_approval_1.routingEnvelope, effectiveProfile: profile }, fingerprint: `${'a'.repeat(63)}${index}`, approval: routing_approval_1.routingApproval }, '2026-09-17T00:00:00.000Z').state;
             state.routingAttempts[state.routingAttempts.length - 1].state = 'blocked';
             state.routingAttempts[state.routingAttempts.length - 1].verdict = 'fail';
         }
-        expect(() => (0, journal_1.reserveRoutingAttempt)(state, { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope, fingerprint: 'f'.repeat(64) }, '2026-09-17T00:00:00.000Z')).toThrow(/budget/i);
+        expect(() => (0, journal_1.reserveRoutingAttempt)(state, { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope: routing_approval_1.routingEnvelope, fingerprint: 'f'.repeat(64) }, '2026-09-17T00:00:00.000Z')).toThrow(/budget/i);
     });
     it('reports routing attempts without envelope bodies or native identities', () => {
-        const state = (0, journal_1.reserveRoutingAttempt)((0, types_1.emptyState)('main'), { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope, fingerprint: 'e'.repeat(64) }, '2026-09-17T00:00:00.000Z').state;
+        const state = (0, journal_1.reserveRoutingAttempt)((0, types_1.emptyState)('main'), { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope: routing_approval_1.routingEnvelope, fingerprint: 'e'.repeat(64), approval: routing_approval_1.routingApproval }, '2026-09-17T00:00:00.000Z').state;
         expect((0, journal_1.routingReport)(state)).toEqual({ schema: 'routing-report/v1', attempts: 1, plannedByRole: { implementer: 1 }, actualByRole: {}, byState: { reserved: 1 }, retries: 0, fallbacks: 0, unavailable: {}, verdicts: {}, administrativeRepairs: 0 });
     });
     it('uses the exact deterministic implementation escalation sequence', () => {
         let state = (0, types_1.emptyState)('main');
         expect((0, journal_1.resolveLineageEscalation)(state, 'l1', 'mechanical')).toEqual({ profile: 'mechanical', effort: 'medium' });
-        state = (0, journal_1.reserveRoutingAttempt)(state, { obligationId: 'impl:S1', lineageId: 'l1', envelope, fingerprint: '1'.repeat(64) }, '2026-09-17T00:00:00.000Z').state;
+        state = (0, journal_1.reserveRoutingAttempt)(state, { obligationId: 'impl:S1', lineageId: 'l1', envelope: routing_approval_1.routingEnvelope, fingerprint: '1'.repeat(64), approval: routing_approval_1.routingApproval }, '2026-09-17T00:00:00.000Z').state;
         state.routingAttempts[0].state = 'blocked';
         state.routingAttempts[0].verdict = 'fail';
         expect((0, journal_1.resolveLineageEscalation)(state, 'l1', 'mechanical')).toEqual({ profile: 'integration', effort: 'medium' });
-        state.routingAttempts.push({ ...state.routingAttempts[0], id: 'route-2', attempt: 2, envelope: { ...envelope, effectiveProfile: 'integration' }, state: 'blocked', verdict: 'fail' });
+        state.routingAttempts.push({ ...state.routingAttempts[0], id: 'route-2', attempt: 2, envelope: { ...routing_approval_1.routingEnvelope, effectiveProfile: 'integration' }, state: 'blocked', verdict: 'fail' });
         expect((0, journal_1.resolveLineageEscalation)(state, 'l1', 'mechanical')).toEqual({ profile: 'judgment', effort: 'medium' });
-        state.routingAttempts.push({ ...state.routingAttempts[0], id: 'route-3', attempt: 3, envelope: { ...envelope, effectiveProfile: 'judgment', resolved: { selector: { kind: 'model', id: 'm' }, effort: { kind: 'explicit', value: 'medium' } } }, state: 'blocked', verdict: 'fail' });
+        state.routingAttempts.push({ ...state.routingAttempts[0], id: 'route-3', attempt: 3, envelope: { ...routing_approval_1.routingEnvelope, effectiveProfile: 'judgment', resolved: { selector: { kind: 'model', id: 'm' }, effort: { kind: 'explicit', value: 'medium' } } }, state: 'blocked', verdict: 'fail' });
         expect((0, journal_1.resolveLineageEscalation)(state, 'l1', 'mechanical')).toEqual({ profile: 'judgment', effort: 'high' });
         state.routingAttempts[2].envelope = { ...state.routingAttempts[2].envelope, resolved: { selector: { kind: 'model', id: 'm' }, effort: { kind: 'explicit', value: 'high' } } };
         expect(() => (0, journal_1.resolveLineageEscalation)(state, 'l1', 'mechanical')).toThrow(/exhausted/i);
     });
     it('rejects hostile roles and unavailable provenance before it can reach a report', () => {
-        expect((0, types_1.isRoutingEnvelope)({ ...envelope, role: 'attacker-key' })).toBe(false);
-        expect((0, types_1.isRoutingEnvelope)({ ...envelope, unavailableEvidence: ['secret=leak'] })).toBe(false);
+        expect((0, types_1.isRoutingEnvelope)({ ...routing_approval_1.routingEnvelope, role: 'attacker-key' })).toBe(false);
+        expect((0, types_1.isRoutingEnvelope)({ ...routing_approval_1.routingEnvelope, unavailableEvidence: ['secret=leak'] })).toBe(false);
     });
 });

package/dist/tests/core/model-policy/resolve.test.js

@@ -183,3 +183,20 @@ describe('resolveSelection', () => {
         expect((0, resolve_1.resolveSelection)(value)).toMatchObject({ state: 'resolved', outcome: 'degraded', selection: runtimeDefaultSelection('full'), unavailableEvidence: ['modelOverride'] });
     });
 });
+describe('resolveEscalatedSelection', () => {
+    it('accepts the approved judgment high profile after integration when full capability matches', () => {
+        const value = input();
+        value.policy.content.mappings[0].profiles.judgment = selection('full', 'high');
+        expect((0, resolve_1.resolveEscalatedSelection)({ ...value, requestedProfile: 'judgment', expectedEffort: 'medium' })).toMatchObject({ state: 'resolved', effectiveProfile: 'judgment', selection: selection('full', 'high') });
+    });
+    it('promotes judgment medium to the attested full high selection on its last correction', () => {
+        const value = input();
+        value.policy.content.mappings[0].profiles.judgment = selection('full', 'medium');
+        value.capabilities.availableSelections.push(selection('full', 'medium'));
+        expect((0, resolve_1.resolveEscalatedSelection)({ ...value, requestedProfile: 'judgment', expectedEffort: 'high' })).toMatchObject({ state: 'resolved', effectiveProfile: 'judgment', selection: selection('full', 'high') });
+    });
+    it('blocks judgment high escalation when the full selection uses another model', () => {
+        const value = input();
+        expect((0, resolve_1.resolveEscalatedSelection)({ ...value, requestedProfile: 'judgment', expectedEffort: 'high' })).toMatchObject({ state: 'blocked', diagnostics: [{ code: 'ROUTING_ESCALATION_EFFORT_UNAVAILABLE' }] });
+    });
+});

package/dist/tests/helpers/routing-approval.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.routingEnvelope = exports.routingSelection = exports.routingRuntime = void 0;
+exports.routingApproval = routingApproval;
+const capabilities_1 = require("../../src/core/model-policy/capabilities");
+exports.routingRuntime = { target: 'codex', kind: 'native', version: '1.0.0', accountScopeDigest: '0'.repeat(64) };
+const routingSelection = (value) => ({ selector: { kind: 'model', id: 'm' }, effort: { kind: 'explicit', value } });
+exports.routingSelection = routingSelection;
+function routingApproval() {
+    const policy = { schema: 'approved-model-policy/v1', content: { schema: 'model-policy/v1', mappings: [{ target: 'codex', runtimeKind: 'native', profiles: { mechanical: (0, exports.routingSelection)('medium'), integration: (0, exports.routingSelection)('medium'), judgment: (0, exports.routingSelection)('medium') }, fullCapability: (0, exports.routingSelection)('high'), degradation: { allowMissingModelOverride: false, allowMissingEffortOverride: false, allowMissingObservedIdentity: false } }], implementationBudget: { maxAttempts: 3, escalation: ['mechanical', 'integration', 'judgment'], judgmentEfforts: ['medium', 'high'] } }, contentDigest: 'a'.repeat(64), approval: { approvedAt: '2026-09-17T00:00:00.000Z', approvalId: 'approval-1' }, lineage: { previousDigest: null } };
+    const capabilities = { schema: 'routing-capabilities/v1', runtime: exports.routingRuntime, recordedAt: '2026-09-17T00:00:00.000Z', expiresAt: '2026-09-18T00:00:00.000Z', capabilities: { artifactDelivery: 'unverified', interactiveExecution: 'supported', unattendedController: 'supported', nativeSubagents: 'unverified', modelOverride: 'supported', effortOverride: 'supported', observedModelEvidence: 'supported', durableResume: 'unverified' }, availableSelections: [(0, exports.routingSelection)('medium'), (0, exports.routingSelection)('high')], evidence: ['interactiveExecution', 'unattendedController', 'modelOverride', 'effortOverride', 'observedModelEvidence'].map(capability => ({ capability, kind: 'native-control', receiptDigest: 'a'.repeat(64) })), approval: { approvalId: 'approval-1', snapshotDigest: 'a'.repeat(64) } };
+    return { policy, capabilities, checkedAt: new Date('2026-09-17T12:00:00.000Z') };
+}
+exports.routingEnvelope = { schema: 'routing-envelope/v1', runtime: exports.routingRuntime, role: 'implementer', sliceId: 'S1', requestedProfile: 'mechanical', effectiveProfile: 'mechanical', resolved: (0, exports.routingSelection)('medium'), outcome: 'native', unavailableEvidence: [], policyDigest: 'a'.repeat(64), capabilityDigest: (0, capabilities_1.capabilityReceiptDigest)(routingApproval().capabilities), planDigest: 'c'.repeat(64), executionDigest: 'd'.repeat(64) };

package/dist/tests/structural/native-release-artifacts.test.js

@@ -8,21 +8,90 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const CLI_ROOT = path_1.default.resolve(__dirname, '..', '..');
 const REPO_ROOT = path_1.default.resolve(CLI_ROOT, '..');
+function readWorkflow(name) {
+    return fs_1.default.readFileSync(path_1.default.join(REPO_ROOT, '.github', 'workflows', name), 'utf8').replace(/\r\n/g, '\n');
+}
+function assertArmPartition(source) {
+    const workflow = source.replace(/\r\n/g, '\n');
+    expect(workflow.match(/^  windows-arm-hot:\s*$/gm)).toHaveLength(1);
+    const [matrixJob, rest] = workflow.split(/^  windows-arm-hot:\s*$/m);
+    expect(rest).toBeDefined();
+    const hotJob = rest.split(/^  [a-z][\w-]*:\s*$/m)[0];
+    expect(matrixJob).toMatch(/- name: Tests?\n        if: matrix\.target != 'win32-arm64'\n        working-directory: cli\n        run: npx jest --runInBand --bail\n/);
+    const remainder = matrixJob.match(/- name: Tests? \(Windows ARM remainder\)\n        if: matrix\.target == 'win32-arm64'\n        working-directory: cli\n        run: ([^\n]+)/)?.[1];
+    expect(remainder).toMatch(/^npx jest --runInBand --bail --testPathIgnorePatterns='[^']+'$/);
+    const ignorePattern = remainder?.match(/--testPathIgnorePatterns='([^']+)'/)?.[1];
+    expect(ignorePattern).toBe(String.raw `node_modules|[/\\]cli[/\\]tests[/\\]commands[/\\]watch[/\\]track-(finalize|freeze)\.test\.ts$`);
+    const ignored = new RegExp(ignorePattern);
+    for (const separator of ['/', '\\']) {
+        const root = ['repo', 'cli', 'tests'].join(separator);
+        for (const suite of ['track-finalize', 'track-freeze']) {
+            expect(ignored.test([root, 'commands', 'watch', `${suite}.test.ts`].join(separator))).toBe(true);
+            expect(ignored.test([root, 'other', `${suite}.test.ts`].join(separator))).toBe(false);
+        }
+    }
+    const remainderStep = matrixJob.split(/- name: Tests? \(Windows ARM remainder\)\n/)[1]?.split(/^      - name:/m)[0];
+    expect(remainderStep).toBeDefined();
+    expect(remainderStep).not.toContain('continue-on-error: true');
+    expect(matrixJob.match(/uses: actions\/upload-artifact@v4/g)).toHaveLength(1);
+    expect(hotJob).toContain('runs-on: windows-11-arm');
+    expect(hotJob).toContain('run: npm run native:build');
+    expect(hotJob).toContain('run: npm run native:test-build');
+    expect(hotJob.split('\n')).toContain('        run: npx jest --runTestsByPath tests/commands/watch/track-finalize.test.ts tests/commands/watch/track-freeze.test.ts --runInBand --bail');
+    expect(hotJob).not.toContain('upload-artifact@v4');
+    expect(hotJob).not.toContain('secure-fs-win32-arm64');
+    expect(hotJob).not.toMatch(/^\s*if:/m);
+    expect(hotJob).not.toContain('continue-on-error: true');
+}
 describe('native release artifacts', () => {
     it('runs each platform suite once without weakening publication', () => {
         for (const name of ['ci.yml', 'release.yml']) {
-            const workflow = fs_1.default.readFileSync(path_1.default.join(REPO_ROOT, '.github', 'workflows', name), 'utf8');
+            const workflow = readWorkflow(name);
             expect(workflow).not.toContain('- name: Windows admission smoke');
             expect(workflow).not.toContain('run: npx jest tests/commands/plan/index.test.ts --runInBand --bail');
             expect(workflow).toContain('run: npx jest --runInBand --bail');
         }
-        const release = fs_1.default.readFileSync(path_1.default.join(REPO_ROOT, '.github', 'workflows', 'release.yml'), 'utf8');
-        expect(release).toMatch(/release:\s*\n\s*needs: test/);
+        const release = readWorkflow('release.yml');
+        expect(release).toMatch(/release:\s*\n\s*needs: \[test, windows-arm-hot\]/);
         for (const target of ['linux-x64', 'linux-arm64', 'darwin-x64', 'darwin-arm64', 'win32-x64', 'win32-arm64']) {
             expect(release).toContain(`target: ${target}`);
         }
         expect(release).toContain('cancel-in-progress: false');
     });
+    it('partitions the two hot ARM suites without duplicating the native artifact', () => {
+        for (const name of ['ci.yml', 'release.yml']) {
+            const workflow = readWorkflow(name);
+            assertArmPartition(workflow);
+        }
+    });
+    it('checks the same partition after a Windows CRLF checkout', () => {
+        for (const name of ['ci.yml', 'release.yml']) {
+            const workflow = readWorkflow(name);
+            assertArmPartition(workflow.replace(/\n/g, '\r\n'));
+        }
+    });
+    it('rejects swapped matrix guards, non-gating hot tests and duplicate artifacts', () => {
+        for (const name of ['ci.yml', 'release.yml']) {
+            const workflow = readWorkflow(name);
+            const swapped = workflow.replace(/if: matrix\.target (?:!=|==) 'win32-arm64'/g, (guard) => guard.includes('!=') ? "if: matrix.target == 'win32-arm64'" : "if: matrix.target != 'win32-arm64'");
+            const nonGating = workflow.replace('  windows-arm-hot:\n', '  windows-arm-hot:\n    continue-on-error: true\n');
+            const duplicateArtifact = workflow.replace('uses: actions/upload-artifact@v4', 'uses: actions/upload-artifact@v4\n      - uses: actions/upload-artifact@v4');
+            const broadIgnore = workflow.replace(/(--testPathIgnorePatterns='[^']+)(?=')/, '$1|runner\\.test\\.ts$');
+            const skippedHot = workflow.replace('      - name: Test hot Windows ARM suites\n', '      - name: Test hot Windows ARM suites\n        if: false\n');
+            const nonGatingRemainder = workflow.replace(/(run: npx jest --runInBand --bail --testPathIgnorePatterns='[^']+'\n)/, '$1        continue-on-error: true\n');
+            const maskedHot = workflow.replace(/(run: npx jest --runTestsByPath [^\n]+ --runInBand --bail)(?=\n)/, '$1; exit 0');
+            for (const mutated of [swapped, nonGating, duplicateArtifact, broadIgnore, skippedHot, nonGatingRemainder, maskedHot]) {
+                expect(mutated).not.toBe(workflow);
+            }
+            expect(() => assertArmPartition(swapped)).toThrow();
+            expect(() => assertArmPartition(nonGating)).toThrow();
+            expect(() => assertArmPartition(duplicateArtifact)).toThrow();
+            expect(() => assertArmPartition(broadIgnore)).toThrow();
+            expect(() => assertArmPartition(skippedHot)).toThrow();
+            expect(() => assertArmPartition(nonGatingRemainder)).toThrow();
+            expect(() => assertArmPartition(maskedHot)).toThrow();
+        }
+    });
     it('keeps native prebuilds generated instead of versioned source', () => {
         const gitignore = fs_1.default.readFileSync(path_1.default.join(REPO_ROOT, '.gitignore'), 'utf8');
         const tracked = (0, child_process_1.execFileSync)('git', ['ls-files', '--', 'cli/prebuilds'], {
@@ -37,7 +106,7 @@ describe('native release artifacts', () => {
         const pkg = JSON.parse(fs_1.default.readFileSync(path_1.default.join(CLI_ROOT, 'package.json'), 'utf8'));
         expect(pkg.scripts['native:test-build']).toContain('secure_fs_test');
         for (const name of ['ci.yml', 'release.yml']) {
-            const workflow = fs_1.default.readFileSync(path_1.default.join(REPO_ROOT, '.github', 'workflows', name), 'utf8');
+            const workflow = readWorkflow(name);
             const testBuild = workflow.indexOf('run: npm run native:test-build');
             const jest = workflow.indexOf('run: npx jest --runInBand --bail');
             expect(testBuild).toBeGreaterThanOrEqual(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "9.11.10",
+  "version": "9.11.12",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"