agentic-workflow-manager 9.11.11 → 9.12.0

package/dist/src/commands/doctor.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderReport = renderReport;
+exports.attachRoutingSetupGuidance = attachRoutingSetupGuidance;
 exports.renderProviderReport = renderProviderReport;
 exports.runDoctor = runDoctor;
 exports.registerDoctorCommand = registerDoctorCommand;
@@ -20,6 +21,8 @@ const render_html_1 = require("../core/dashboard/render-html");
 const render_terminal_1 = require("../core/dashboard/render-terminal");
 const write_html_1 = require("../core/dashboard/write-html");
 const bundles_1 = require("../core/bundles");
+const store_1 = require("../core/model-policy/store");
+const setup_readiness_1 = require("../core/model-policy/setup-readiness");
 function glyph(status) {
     if (status === 'ok')
         return picocolors_1.default.green('✔');
@@ -76,7 +79,26 @@ const CHECK_LABELS = {
     'hook.trust': 'hook SessionStart',
     'guidance.project': 'project guidance',
     'constitution.delivery': 'constitution delivery',
+    'routing.machine': 'model routing on this machine',
 };
+/** Adds a setup prompt without changing existing provider health or mutating the report. */
+function attachRoutingSetupGuidance(report, guidance) {
+    if (!report || !Array.isArray(report.providers) || !Array.isArray(guidance))
+        throw new Error('doctor routing setup input is invalid');
+    const providers = report.providers.map(provider => {
+        const checks = [...provider.checks];
+        for (const item of guidance) {
+            if (item.state === 'policy-invalid' || item.target !== provider.id)
+                continue;
+            if (item.state === 'needs-evidence')
+                checks.push({ id: 'routing.machine', state: 'pending', detail: `native routing evidence not checked for ${item.runtimeKind}`, remediationCode: item.command });
+            else
+                checks.push({ id: 'routing.machine', state: 'supported', detail: `sealed selection coverage for ${item.runtimeKind} only; current runtime/account/config scope is checked at routed dispatch` });
+        }
+        return { ...provider, checks };
+    });
+    return { ...report, providers };
+}
 const OK_STATES = ['supported', 'healthy', 'shared', 'delivered'];
 const PENDING_STATES = ['pending', 'pending-trust'];
 const WARN_STATES = ['stale'];
@@ -179,7 +201,7 @@ function runDoctor(opts = {}) {
     try {
         const ctx = (0, context_1.gatherContext)({ cwd: opts.cwd, agents: targets, reporter });
         const providers = ctx.providers ?? [];
-        report = { providers, overall: (0, checks_1.computeProviderOverall)(providers) };
+        report = attachRoutingSetupGuidance({ providers, overall: (0, checks_1.computeProviderOverall)(providers) }, (0, setup_readiness_1.routingSetupGuidance)((0, store_1.readEffectivePolicy)(opts.cwd ?? process.cwd())));
     }
     catch (err) {
         process.stderr.write(`awm doctor: internal error: ${err.message}\n`);

package/dist/src/commands/hooks/claude.js

@@ -61,6 +61,32 @@ function isAwmEntry(entry, scriptsDir, matcher) {
         Array.isArray(entry?.hooks) &&
         entry.hooks.some((h) => typeof h?.command === 'string' && h.command.includes(scriptsDir)));
 }
+function routingCommand(event) { return `awm model-policy hook-event --event ${event}`; }
+function routingEntry(event) {
+    return { matcher: '.+', hooks: [{ type: 'command', command: routingCommand(event), async: false }] };
+}
+function isRoutingEntry(entry, event) {
+    return entry?.matcher === '.+' && Array.isArray(entry?.hooks) && entry.hooks.some((hook) => hook?.type === 'command' && hook.command === routingCommand(event) && hook.async === false);
+}
+function mergeRoutingEntries(settings) {
+    let changed = false;
+    for (const [eventName, event] of [['SubagentStart', 'start'], ['SubagentStop', 'stop']]) {
+        if (!Array.isArray(settings.hooks[eventName]))
+            settings.hooks[eventName] = [];
+        const entries = settings.hooks[eventName];
+        const expected = routingEntry(event);
+        const index = entries.findIndex(entry => isRoutingEntry(entry, event));
+        if (index < 0) {
+            entries.push(expected);
+            changed = true;
+        }
+        else if (JSON.stringify(entries[index]) !== JSON.stringify(expected)) {
+            entries[index] = expected;
+            changed = true;
+        }
+    }
+    return changed;
+}
 function installClaudeHook(options) {
     const config = (0, providers_1.getSettingsMergeHookConfig)(options.agent);
     // 1. Verify registry sources exist FIRST (before touching settings)
@@ -117,19 +143,24 @@ function installClaudeHook(options) {
             }]
     };
     let status;
+    let sessionChanged = false;
     if (awmEntryIdx >= 0) {
         // Igual que en codex.ts: si la poda saco algo, hay que escribir aunque nuestra
         // entrada ya este identica — si no, la limpieza se calcula y se tira.
-        if (!pruned && JSON.stringify(entries[awmEntryIdx]) === JSON.stringify(newEntry)) {
-            return { status: 'already-up-to-date', scriptsDir: config.scriptsDir, settingsPath: config.settingsPath, backupPath: null };
+        if (pruned || JSON.stringify(entries[awmEntryIdx]) !== JSON.stringify(newEntry)) {
+            entries[awmEntryIdx] = newEntry;
+            sessionChanged = true;
         }
-        entries[awmEntryIdx] = newEntry;
         status = 'installed';
     }
     else {
         entries.push(newEntry);
+        sessionChanged = true;
         status = 'installed';
     }
+    const routingChanged = mergeRoutingEntries(settings);
+    if (!sessionChanged && !routingChanged)
+        return { status: 'already-up-to-date', scriptsDir: config.scriptsDir, settingsPath: config.settingsPath, backupPath: null };
     // 7. Write settings
     fs_1.default.writeFileSync(config.settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf-8');
     return { status, scriptsDir: config.scriptsDir, settingsPath: config.settingsPath, backupPath };
@@ -153,13 +184,24 @@ function checkSettingsEntry(settingsPath, scriptsDir, matcher, eventName) {
     }
     return { ok: true, detail: settingsPath };
 }
+function checkRoutingCapture(settingsPath) {
+    try {
+        const parsed = JSON.parse(fs_1.default.readFileSync(settingsPath, 'utf8'));
+        if (isRoutingEntry((parsed?.hooks?.SubagentStart ?? []).find((entry) => isRoutingEntry(entry, 'start')), 'start')
+            && isRoutingEntry((parsed?.hooks?.SubagentStop ?? []).find((entry) => isRoutingEntry(entry, 'stop')), 'stop'))
+            return { ok: true, detail: settingsPath };
+    }
+    catch { /* missing or invalid settings cannot provide native capture */ }
+    return { ok: false, detail: 'AWM native Claude routing hooks are missing; rerun awm hooks install --agent claude-code' };
+}
 function computeClaudeHookStatus(agent) {
     const config = (0, providers_1.getSettingsMergeHookConfig)(agent);
     const checks = {
         bootstrapSkill: (0, shared_1.checkFile)(path_1.default.join(config.scriptsDir, 'using-awm.md')),
         sessionStartScript: (0, shared_1.checkExecutable)(path_1.default.join(config.scriptsDir, 'session-start')),
         runHookWrapper: (0, shared_1.checkExecutable)(path_1.default.join(config.scriptsDir, 'run-hook.cmd')),
-        settingsEntry: checkSettingsEntry(config.settingsPath, config.scriptsDir, config.matcher, config.eventName)
+        settingsEntry: checkSettingsEntry(config.settingsPath, config.scriptsDir, config.matcher, config.eventName),
+        routingCapture: checkRoutingCapture(config.settingsPath),
     };
     const allOk = Object.values(checks).every((c) => c.ok);
     const settingsOnlyMissing = !checks.settingsEntry.ok && checks.bootstrapSkill.ok && checks.sessionStartScript.ok && checks.runHookWrapper.ok;
@@ -187,19 +229,30 @@ function uninstallClaudeHook(agent) {
     const entries = settings?.hooks?.[config.eventName] ?? [];
     const beforeLength = entries.length;
     const filtered = entries.filter((e) => !isAwmEntry(e, config.scriptsDir, config.matcher));
-    if (filtered.length === beforeLength) {
+    const startEntries = settings?.hooks?.SubagentStart ?? [];
+    const stopEntries = settings?.hooks?.SubagentStop ?? [];
+    const filteredStart = startEntries.filter(entry => !isRoutingEntry(entry, 'start'));
+    const filteredStop = stopEntries.filter(entry => !isRoutingEntry(entry, 'stop'));
+    if (filtered.length === beforeLength && filteredStart.length === startEntries.length && filteredStop.length === stopEntries.length) {
         return { status: 'not-installed', backupPath: null };
     }
     const backupPath = (0, shared_1.backupManagedFile)(config.settingsPath);
     if (filtered.length === 0) {
         delete settings.hooks[config.eventName];
-        if (Object.keys(settings.hooks).length === 0) {
-            delete settings.hooks;
-        }
     }
     else {
         settings.hooks[config.eventName] = filtered;
     }
+    if (filteredStart.length === 0)
+        delete settings.hooks.SubagentStart;
+    else
+        settings.hooks.SubagentStart = filteredStart;
+    if (filteredStop.length === 0)
+        delete settings.hooks.SubagentStop;
+    else
+        settings.hooks.SubagentStop = filteredStop;
+    if (Object.keys(settings.hooks).length === 0)
+        delete settings.hooks;
     fs_1.default.writeFileSync(config.settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf-8');
     return { status: 'uninstalled', backupPath };
 }

package/dist/src/commands/hooks/resync.js

@@ -36,7 +36,7 @@ function resyncInstalledHooks(registryRoot, targets = [...providers_1.AGENT_TARG
                     results.push({ agent, action: 'registry-missing' });
                     continue;
                 }
-                (0, claude_1.resyncClaudeHookFiles)(config, registryRoot, method);
+                (0, claude_1.installClaudeHook)({ agent: 'claude-code', registryRoot, installMethod: method });
                 results.push({ agent, action: 'resynced' });
                 break;
             }

package/dist/src/commands/job/index.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.readBoundedJson = readBoundedJson;
 exports.registerJobCommand = registerJobCommand;
 const child_process_1 = require("child_process");
 const path_1 = __importDefault(require("path"));
@@ -27,6 +28,8 @@ const journal_1 = require("../../core/model-policy/journal");
 const types_1 = require("../../core/journal/types");
 const json_1 = require("../../core/plan/json");
 const fs_1 = __importDefault(require("fs"));
+const native_routing_observe_1 = require("../../core/model-policy/native-routing-observe");
+const native_bridge_1 = require("../../core/secure-fs/native-bridge");
 function branchOf(cwd) {
     // stdio explicito (ver EXEC_STDIO en journal/process.ts): evita el relay
     // default de execFileSync del stderr de git hacia el stderr del llamante,
@@ -52,11 +55,18 @@ function readBoundedJson(file) {
     const stat = fs_1.default.lstatSync(file);
     if (stat.isSymbolicLink() || !stat.isFile() || stat.size > 256 * 1024)
         throw new Error('routing file must be a bounded non-symlink regular file');
+    let bytes;
     try {
-        return (0, json_1.parseJsonNoDuplicate)(fs_1.default.readFileSync(file, 'utf8'));
+        bytes = native_bridge_1.secureFs.readRegularFile(file, 256 * 1024).bytes;
     }
     catch {
-        throw new Error('routing file must contain JSON without duplicate keys');
+        throw new Error('routing file must remain a bounded non-symlink regular file');
+    }
+    try {
+        return (0, json_1.parseJsonNoDuplicate)(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw new Error('routing file must contain UTF-8 JSON without duplicate keys');
     }
 }
 /** Guard de entrada (R9.4): sin descriptor de track, es un no-op — el caso
@@ -175,7 +185,7 @@ function registerJobCommand(program) {
     job.command('routing-observe')
         .requiredOption('--generation <token>').requiredOption('--attempt <id>').requiredOption('--native-agent-id <id>')
         .requiredOption('--observation-file <file>').option('--cwd <root>', 'repository root', '.').option('--json')
-        .action((opts) => {
+        .action(async (opts) => {
         const observation = readBoundedJson(opts.observationFile);
         if (typeof observation !== 'object' || observation === null || Array.isArray(observation))
             throw new Error('routing-observe requires an observation object');
@@ -186,7 +196,32 @@ function registerJobCommand(program) {
         const repo = path_1.default.resolve(opts.cwd);
         const branch = branchOf(repo);
         assertAuthenticatedCwd(repo, branch);
-        const emitted = (0, requests_1.emitRequest)(repo, branch, { kind: 'routing-observe', generationToken: opts.generation, idempotencyKey: crypto_1.default.createHash('sha256').update(`routing-observe:${opts.generation}:${opts.attempt}:${opts.nativeAgentId}:${JSON.stringify(observation)}`).digest('hex'), payload: { attemptId: opts.attempt, nativeAgentId: opts.nativeAgentId, ...(observed === undefined ? {} : { observed }), ...(unavailableReason === undefined ? {} : { unavailableReason }) } });
+        const read = (0, store_1.readJournal)(repo, branch);
+        if (read.corrupt || !read.state)
+            throw new Error('routing-observe requires a healthy journal');
+        const attempt = read.state.routingAttempts?.find(item => item.id === opts.attempt);
+        if (!attempt)
+            throw new Error('routing-observe attempt is unknown');
+        let nativeProof;
+        let reason = unavailableReason;
+        if (attempt.nativeEvidenceRequired && reason === undefined) {
+            try {
+                const parentThreadId = observation.parentThreadId;
+                if (read.state.routingAttempts?.some(item => item.id !== attempt.id && item.nativeEvidenceRequired && item.nativeAgentId === opts.nativeAgentId))
+                    throw new Error('native child was already used by another attempt');
+                nativeProof = await (0, native_routing_observe_1.observeNativeRoutingChild)({ attempt, nativeAgentId: opts.nativeAgentId,
+                    ...(typeof parentThreadId === 'string' ? { parentThreadId } : {}), cwd: repo, now: new Date(),
+                    consumedEventDigests: (read.state.routingAttempts ?? []).map(item => item.nativeEventDigest).filter((item) => item !== undefined) });
+            }
+            catch {
+                reason = 'PROVENANCE_MISSING';
+            }
+        }
+        const payload = { attemptId: opts.attempt, nativeAgentId: opts.nativeAgentId,
+            ...(nativeProof ? { observed: nativeProof.selection, nativeProof } : attempt.nativeEvidenceRequired ? {} : observed === undefined ? {} : { observed }),
+            ...(reason === undefined ? {} : { unavailableReason: reason }) };
+        const emitted = (0, requests_1.emitRequest)(repo, branch, { kind: 'routing-observe', generationToken: opts.generation,
+            idempotencyKey: crypto_1.default.createHash('sha256').update(`routing-observe:${opts.generation}:${opts.attempt}:${opts.nativeAgentId}:${JSON.stringify(payload)}`).digest('hex'), payload });
         process.stdout.write(JSON.stringify({ requestId: emitted.requestId }) + '\n');
     });
     job.command('ps').action(() => {

package/dist/src/commands/model-policy/index.js

@@ -1,12 +1,35 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerModelPolicyCommand = registerModelPolicyCommand;
 const crypto_1 = require("crypto");
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
 const providers_1 = require("../../providers");
 const store_1 = require("../../core/model-policy/store");
 const validate_1 = require("../../core/model-policy/validate");
 const capabilities_1 = require("../../core/model-policy/capabilities");
 const digest_1 = require("../../core/model-policy/digest");
+const native_codex_1 = require("../../core/model-policy/native-codex");
+const native_codex_machine_1 = require("../../core/model-policy/native-codex-machine");
+const native_runtime_1 = require("../../core/model-policy/native-runtime");
+const native_claude_machine_1 = require("../../core/model-policy/native-claude-machine");
+const native_claude_config_1 = require("../../core/model-policy/native-claude-config");
+const machine_key_1 = require("../../core/model-policy/machine-key");
+const event_store_1 = require("../../core/model-policy/event-store");
+const capabilities_v2_1 = require("../../core/model-policy/capabilities-v2");
+const paths_1 = require("../../core/paths");
+const selection_policy_digest_1 = require("../../core/model-policy/selection-policy-digest");
+const claude_hook_events_1 = require("../../core/model-policy/claude-hook-events");
+const native_claude_transcript_1 = require("../../core/model-policy/native-claude-transcript");
+const native_claude_agent_definition_1 = require("../../core/model-policy/native-claude-agent-definition");
+const event_store_2 = require("../../core/model-policy/event-store");
+const local_claude_scope_1 = require("../../core/model-policy/local-claude-scope");
+const json_1 = require("../../core/plan/json");
+const claude_1 = require("../hooks/claude");
+const hook_diagnostics_1 = require("../../core/model-policy/hook-diagnostics");
 const roles = ['implementer', 'specification-reviewer', 'code-quality-reviewer', 'final-reviewer', 'architecture', 'track-a-qa', 'track-b-qa', 'controller', 'documentation', 'retro', 'finishing'];
 const implementerProfiles = ['mechanical', 'integration', 'judgment'];
 const contract = { schema: 'routing-protocol/v1', supportedPlanSchemas: ['compact-slices/v1', 'compact-slices/v2'], roles, implementerProfiles, limits: { maxFileBytes: validate_1.MAX_POLICY_BYTES, maxMappings: validate_1.MAX_MAPPINGS, maxIdentifierChars: 128, maxDiagnostics: 20, maxDiagnosticChars: 4096 } };
@@ -14,6 +37,20 @@ const protocolDigest = (0, crypto_1.createHash)('sha256').update(JSON.stringify(
 function text(value, label) { if (typeof value !== 'string' || value.length === 0 || value.startsWith('--') || value.length > 4096 || /[\u0000-\u001f\u007f-\u009f]/.test(value))
     throw new Error(`${label} requires a non-empty value without control characters`); }
 function output(value, json) { process.stdout.write(json ? `${JSON.stringify(value)}\n` : `${JSON.stringify(value, null, 2)}\n`); }
+function sameSelection(left, right) {
+    return left.selector.kind === right.selector.kind && left.selector.id === right.selector.id
+        && left.effort.kind === right.effort.kind
+        && (left.effort.kind !== 'explicit' || left.effort.value === right.effort.value);
+}
+async function hookStdin() {
+    let content = '';
+    for await (const chunk of process.stdin) {
+        content += Buffer.isBuffer(chunk) ? chunk.toString('utf8') : String(chunk);
+        if (content.length > 64 * 1024)
+            throw new Error('Claude hook event exceeds 64 KiB');
+    }
+    return (0, json_1.parseJsonNoDuplicate)(content);
+}
 function registerModelPolicyCommand(program, deps = {}) {
     if (!program || typeof program.command !== 'function')
         throw new Error('program must be a Commander command');
@@ -25,6 +62,222 @@ function registerModelPolicyCommand(program, deps = {}) {
     const command = program.command('model-policy').description('inspect and explicitly approve portable routing policy');
     command.command('contract').option('--cwd <path>').option('--json').action((options) => { if (options.cwd !== undefined)
         text(options.cwd, '--cwd'); output({ ...contract, protocolDigest }, options.json === true); });
+    command.command('discover').description('compare approved selections with the native catalog; no inference or capability approval').requiredOption('--provider <target>').option('--cwd <path>').option('--json').action(async (options) => {
+        text(options.provider, '--provider');
+        if (options.cwd !== undefined)
+            text(options.cwd, '--cwd');
+        if (!providers_1.AGENT_TARGETS.includes(options.provider))
+            throw new Error('--provider is invalid');
+        if (options.provider !== 'codex') {
+            output({ state: 'unverified', provider: options.provider, reason: 'no native catalog adapter is installed for this provider', inferenceDispatched: false }, options.json === true);
+            process.exitCode = 2;
+            return;
+        }
+        const discovered = await (deps.queryCodexModelCatalog ?? native_codex_1.queryCodexModelCatalog)({ command: 'codex', args: ['app-server', '--stdio'], timeoutMs: 10000 });
+        const effective = read(options.cwd ?? process.cwd());
+        let policyCoverage;
+        if (effective.state === 'absent')
+            policyCoverage = { state: 'not-configured', missing: [] };
+        else if (effective.state === 'invalid')
+            policyCoverage = { state: 'policy-invalid', missing: [] };
+        else {
+            const requested = effective.policy.content.mappings.filter(mapping => mapping.target === 'codex')
+                .flatMap(mapping => [...Object.values(mapping.profiles), mapping.fullCapability]);
+            const missing = requested.filter((candidate, index) => !discovered.selections.some(available => sameSelection(candidate, available))
+                && requested.findIndex(other => sameSelection(candidate, other)) === index);
+            policyCoverage = { state: missing.length ? 'missing' : requested.length ? 'complete' : 'not-configured', missing };
+        }
+        output({ state: 'catalog-only', provider: 'codex', ...discovered, policyCoverage, inferenceDispatched: false }, options.json === true);
+        if (policyCoverage.state !== 'complete')
+            process.exitCode = 2;
+    });
+    command.command('setup').description('inspect one-time machine routing enrollment; never dispatch inference').requiredOption('--provider <target>').option('--cwd <path>').option('--json').action(async (options) => {
+        text(options.provider, '--provider');
+        if (options.cwd !== undefined)
+            text(options.cwd, '--cwd');
+        if (!providers_1.AGENT_TARGETS.includes(options.provider))
+            throw new Error('--provider is invalid');
+        const effective = read(options.cwd ?? process.cwd());
+        if (effective.state !== 'approved') {
+            output({ state: effective.state === 'absent' ? 'policy-absent' : 'policy-invalid', provider: options.provider, inferenceDispatched: false, tokenUsage: 'unknown', remedy: effective.state === 'absent' ? 'Approve a model-policy/v1 candidate before machine enrollment.' : effective.reason }, options.json === true);
+            process.exitCode = 2;
+            return;
+        }
+        const mappings = effective.policy.content.mappings.filter(mapping => mapping.target === options.provider);
+        if (mappings.length === 0) {
+            output({ state: 'mapping-absent', provider: options.provider, inferenceDispatched: false, tokenUsage: 'unknown', remedy: 'Approve a mapping for this provider.' }, options.json === true);
+            process.exitCode = 2;
+            return;
+        }
+        const codex = options.provider === 'codex' ? await Promise.all([
+            (deps.queryCodexModelCatalog ?? native_codex_1.queryCodexModelCatalog)({ command: 'codex', args: ['app-server', '--stdio'], timeoutMs: 10000 }),
+            (deps.queryCodexMachineFacts ?? native_codex_machine_1.queryCodexMachineFacts)({ command: 'codex', args: ['app-server', '--stdio'], timeoutMs: 10000,
+                cwd: path_1.default.resolve(options.cwd ?? process.cwd()), key: (deps.ensureMachineKey ?? machine_key_1.ensureMachineKey)((0, paths_1.awmHome)()) }),
+            (deps.queryRuntimeExecutable ?? native_runtime_1.queryRuntimeExecutable)({ command: 'codex', args: ['--version'], timeoutMs: 10000 }),
+        ]) : undefined;
+        let claude;
+        if (options.provider === 'claude-code') {
+            try {
+                const key = (deps.ensureMachineKey ?? machine_key_1.ensureMachineKey)((0, paths_1.awmHome)());
+                claude = await Promise.all([
+                    (deps.queryRuntimeExecutable ?? native_runtime_1.queryRuntimeExecutable)({ command: 'claude', args: ['--version'], timeoutMs: 10000 }),
+                    (deps.queryClaudeAuthStatus ?? native_claude_machine_1.queryClaudeAuthStatus)({ command: 'claude', args: ['auth', 'status'], timeoutMs: 10000, key }),
+                    Promise.resolve((deps.readClaudeModelConfigDigest ?? native_claude_config_1.readClaudeModelConfigDigest)({ cwd: path_1.default.resolve(options.cwd ?? process.cwd()),
+                        configDir: path_1.default.resolve(process.env.CLAUDE_CONFIG_DIR ?? path_1.default.join(os_1.default.homedir(), '.claude')), key, environment: process.env })),
+                ]);
+            }
+            catch {
+                output({ state: 'setup-pending', provider: 'claude-code', machine: { runtimeState: 'unavailable', accountState: 'unverified', configState: 'unverified' },
+                    inferenceDispatched: false, tokenUsage: 'unknown', remedy: 'Install and authenticate Claude Code, then rerun awm model-policy setup --provider claude-code.' }, options.json === true);
+                process.exitCode = 2;
+                return;
+            }
+        }
+        const catalog = codex?.[0];
+        const codexMachine = codex ? { runtimeVersion: codex[2].version, binaryDigest: codex[2].binaryDigest, configDigest: codex[1].configDigest,
+            accountState: codex[1].accountState, accountScopeDigest: codex[1].accountScopeDigest } : null;
+        const machine = codexMachine ?? (claude ? { runtimeVersion: claude[0].version, binaryDigest: claude[0].binaryDigest, accountState: claude[1].accountState,
+            accountScopeDigest: claude[1].accountScopeDigest, configState: 'local-fingerprint', configDigest: claude[2] } : null);
+        const scope = codexMachine?.accountState === 'identified' && codexMachine.accountScopeDigest ? { runtime: { target: 'codex', kind: 'native', version: codexMachine.runtimeVersion, accountScopeDigest: codexMachine.accountScopeDigest },
+            binaryDigest: codexMachine.binaryDigest, configDigest: codexMachine.configDigest } : claude?.[1].accountState === 'identified' && claude[1].accountScopeDigest ? {
+            runtime: { target: 'claude-code', kind: 'native', version: claude[0].version, accountScopeDigest: claude[1].accountScopeDigest },
+            binaryDigest: claude[0].binaryDigest, configDigest: claude[2]
+        } : null;
+        const receipt = scope ? (deps.readStoredEventReceipt ?? event_store_1.readStoredEventReceipt)(scope.runtime) : { state: 'absent' };
+        const readiness = (mapping, requested) => {
+            if (!scope || mapping.runtimeKind !== scope.runtime.kind || receipt.state !== 'present')
+                return { selection: 'untested', actualModel: 'untested' };
+            if ((0, capabilities_v2_1.evaluateEventReceipt)(receipt.receipt, scope, requested, (0, selection_policy_digest_1.selectionPolicyDigest)(mapping, requested), new Date()).state !== 'current')
+                return { selection: 'untested', actualModel: 'untested' };
+            const claim = receipt.receipt.claims.find(item => sameSelection(item.selection, requested));
+            return { selection: 'verified', actualModel: requested.selector.kind === 'model' && claim?.actualModel !== 'unverified' && claim?.actualModel?.id === requested.selector.id ? 'observed' : 'untested' };
+        };
+        const selections = mappings.flatMap(mapping => [
+            ...Object.entries(mapping.profiles).map(([role, requested]) => ({ runtimeKind: mapping.runtimeKind, role, requested, catalogAvailable: catalog ? catalog.selections.some(available => sameSelection(requested, available)) : null, dispatch: readiness(mapping, requested).selection, acceptedSelection: readiness(mapping, requested).selection, actualModel: readiness(mapping, requested).actualModel })),
+            { runtimeKind: mapping.runtimeKind, role: 'fullCapability', requested: mapping.fullCapability, catalogAvailable: catalog ? catalog.selections.some(available => sameSelection(mapping.fullCapability, available)) : null, dispatch: readiness(mapping, mapping.fullCapability).selection, acceptedSelection: readiness(mapping, mapping.fullCapability).selection, actualModel: readiness(mapping, mapping.fullCapability).actualModel },
+        ]);
+        const hookStatus = options.provider === 'claude-code' ? (0, claude_1.computeClaudeHookStatus)('claude-code').overall : null;
+        const hookDiagnostic = options.provider === 'claude-code' ? (0, hook_diagnostics_1.readRoutingHookStatus)() : null;
+        const ready = selections.length > 0 && selections.every(item => item.dispatch === 'verified' && (item.catalogAvailable === true || (options.provider === 'claude-code' && item.catalogAvailable === null)))
+            && mappings.every(mapping => mapping.degradation.allowMissingObservedIdentity || selections.filter(item => item.runtimeKind === mapping.runtimeKind).every(item => item.actualModel === 'observed'))
+            && (hookStatus === null || hookStatus === 'HEALTHY') && (hookDiagnostic === null || hookDiagnostic.state !== 'failed' && hookDiagnostic.state !== 'invalid');
+        const actualModelVerified = selections.length > 0 && selections.every(item => item.actualModel === 'observed');
+        output({ state: ready ? 'ready-operational' : 'setup-pending', provider: options.provider, machine, selections, hookStatus, hookDiagnostic, nativeDispatchVerified: ready, actualModelVerified, inferenceDispatched: false, tokenUsage: 'unknown', policyAction: mappings.some(mapping => !mapping.degradation.allowMissingObservedIdentity && selections.some(item => item.runtimeKind === mapping.runtimeKind && item.actualModel !== 'observed')) ? 'Review and explicitly approve allowMissingObservedIdentity only if operational/degraded routing without backend identity is acceptable.' : null, remedy: ready ? null : options.provider === 'codex' ? 'Catalog coverage is not native dispatch proof. Capture each missing selection from a recent completed native child with awm model-policy capture.' : hookStatus !== 'HEALTHY' ? 'Run awm hooks install --agent claude-code. For each approved runtime-default model create one named awm-* custom agent with explicit full model ID in frontmatter, dispatch it once, then rerun setup.' : hookDiagnostic?.state === 'failed' || hookDiagnostic?.state === 'invalid' ? 'Claude hook capture failed; inspect hookDiagnostic and rerun one native awm-* subagent after fixing its named cause.' : 'Claude native selection is UNTESTED; create a named awm-* custom agent with an explicit full model ID for each approved runtime-default selection and dispatch it once.' }, options.json === true);
+        if (!ready)
+            process.exitCode = 2;
+    });
+    command.command('capture').description('enroll a completed native child turn for an approved Codex selection; no inference').requiredOption('--provider <target>').requiredOption('--runtime-kind <kind>').requiredOption('--parent-thread-id <id>').requiredOption('--child-thread-id <id>').option('--cwd <path>').option('--json').action(async (options) => {
+        text(options.provider, '--provider');
+        text(options.runtimeKind, '--runtime-kind');
+        text(options.parentThreadId, '--parent-thread-id');
+        text(options.childThreadId, '--child-thread-id');
+        if (options.cwd !== undefined)
+            text(options.cwd, '--cwd');
+        if (options.provider !== 'codex' || !/^[a-z0-9][a-z0-9_-]{0,127}$/.test(options.runtimeKind))
+            throw new Error('native capture supports only a valid Codex runtime kind');
+        const cwd = path_1.default.resolve(options.cwd ?? process.cwd());
+        const effective = read(cwd);
+        if (effective.state !== 'approved')
+            throw new Error('native capture requires an approved routing policy');
+        const mapping = effective.policy.content.mappings.find(row => row.target === 'codex' && row.runtimeKind === options.runtimeKind);
+        if (!mapping)
+            throw new Error('approved Codex runtime mapping is absent');
+        const key = (deps.ensureMachineKey ?? machine_key_1.ensureMachineKey)((0, paths_1.awmHome)());
+        const [machine, runtime, observation] = await Promise.all([
+            (deps.queryCodexMachineFacts ?? native_codex_machine_1.queryCodexMachineFacts)({ command: 'codex', args: ['app-server', '--stdio'], timeoutMs: 10000, cwd, key }),
+            (deps.queryRuntimeExecutable ?? native_runtime_1.queryRuntimeExecutable)({ command: 'codex', args: ['--version'], timeoutMs: 10000 }),
+            (deps.queryCodexChildThreadObservation ?? native_codex_1.queryCodexChildThreadObservation)({ command: 'codex', args: ['app-server', '--stdio'], timeoutMs: 10000,
+                parentThreadId: options.parentThreadId, childThreadId: options.childThreadId, codexHome: path_1.default.resolve(process.env.CODEX_HOME ?? path_1.default.join(os_1.default.homedir(), '.codex')) }),
+        ]);
+        if (machine.accountState !== 'identified' || !machine.accountScopeDigest)
+            throw new Error('Codex account scope is unverified; native capture cannot certify this machine');
+        const selections = [...Object.values(mapping.profiles), mapping.fullCapability];
+        const expectedSelection = selections.find(candidate => sameSelection(candidate, observation.configuredSelection));
+        if (!expectedSelection)
+            throw new Error('Codex native child selection is not approved for this runtime');
+        const mappingDigest = (0, selection_policy_digest_1.selectionPolicyDigest)(mapping, expectedSelection);
+        const receipt = (deps.publishCodexObservation ?? event_store_1.publishCodexObservation)({ scope: { runtime: { target: 'codex', kind: options.runtimeKind, version: runtime.version, accountScopeDigest: machine.accountScopeDigest },
+                binaryDigest: runtime.binaryDigest, configDigest: machine.configDigest }, observation, expectedSelection, mappingDigest, now: new Date() });
+        output({ state: 'captured', provider: 'codex', selection: expectedSelection, receipt, actualModelVerified: false, tokenUsage: 'unknown', inferenceDispatched: false }, options.json === true);
+    });
+    command.command('hook-event').description('collect Claude native subagent lifecycle metadata; no inference').requiredOption('--event <start-or-stop>').option('--cwd <path>').option('--json').action(async (options) => {
+        if (options.event !== 'start' && options.event !== 'stop')
+            throw new Error('--event must be start or stop');
+        if (options.cwd !== undefined)
+            text(options.cwd, '--cwd');
+        const cwd = path_1.default.resolve(options.cwd ?? process.cwd());
+        const effective = read(cwd);
+        if (effective.state !== 'approved') {
+            if (options.json)
+                output({ state: 'ignored', reason: 'approved policy absent', inferenceDispatched: false }, true);
+            return;
+        }
+        const mappings = effective.policy.content.mappings.filter(row => row.target === 'claude-code' && row.runtimeKind === 'native');
+        if (mappings.length !== 1) {
+            if (options.json)
+                output({ state: 'ignored', reason: 'unique Claude native mapping absent', inferenceDispatched: false }, true);
+            return;
+        }
+        let stage = 'HOOK_INPUT_INVALID';
+        try {
+            const value = await hookStdin();
+            const agentType = value && typeof value === 'object' && !Array.isArray(value) ? value.agent_type : undefined;
+            if (typeof agentType === 'string' && !agentType.startsWith('awm-')) {
+                if (options.json)
+                    output({ state: 'ignored', reason: 'non-AWM agent type', inferenceDispatched: false }, true);
+                return;
+            }
+            if (options.event === 'start') {
+                stage = 'HOOK_START_UNVERIFIED';
+                (0, claude_hook_events_1.recordClaudeHookStart)(value, new Date());
+                (0, hook_diagnostics_1.recordRoutingHookStatus)('start', 'success');
+                if (options.json)
+                    output({ state: 'recorded', event: 'SubagentStart', inferenceDispatched: false }, true);
+                return;
+            }
+            const now = new Date();
+            stage = 'HOOK_PAIR_UNVERIFIED';
+            const pair = (0, claude_hook_events_1.readClaudeHookPair)(value, now);
+            const configDir = path_1.default.resolve(process.env.CLAUDE_CONFIG_DIR ?? path_1.default.join(os_1.default.homedir(), '.claude'));
+            stage = 'HOOK_TRANSCRIPT_UNVERIFIED';
+            const transcript = (0, native_claude_transcript_1.readClaudeSubagentTranscript)({ configDir, file: pair.transcriptPath, agentId: pair.lifecycle.agentId });
+            stage = 'HOOK_DECLARED_MODEL_UNVERIFIED';
+            const declaredAgent = (0, native_claude_agent_definition_1.readClaudeAgentDeclaredModel)({ cwd, configDir, agentType: pair.lifecycle.agentType });
+            if (declaredAgent.modelId !== transcript.actualModel)
+                throw new Error('Claude declared model differs from native child model');
+            const mapping = mappings[0];
+            const selections = [...Object.values(mapping.profiles), mapping.fullCapability];
+            const expectedSelection = selections.find(candidate => candidate.selector.kind === 'model' && candidate.selector.id === transcript.actualModel && candidate.effort.kind === 'runtime-default');
+            if (!expectedSelection) {
+                if (options.json)
+                    output({ state: 'ignored', reason: 'Claude subagent selection does not match an approved runtime-default mapping', actualModel: transcript.actualModel, inferenceDispatched: false }, true);
+                return;
+            }
+            stage = 'HOOK_SCOPE_UNVERIFIED';
+            const local = await (0, local_claude_scope_1.queryLocalClaudeScope)(cwd, mapping.runtimeKind, { requireHookHealthy: false });
+            if (local.state !== 'current')
+                throw new Error('Claude native scope is unverified');
+            stage = 'HOOK_RECEIPT_REJECTED';
+            const receipt = (0, event_store_2.publishClaudeObservation)({ scope: local.scope, lifecycle: pair.lifecycle, transcript, declaredAgent, expectedSelection,
+                mappingDigest: (0, selection_policy_digest_1.selectionPolicyDigest)(mapping, expectedSelection), now });
+            (0, hook_diagnostics_1.recordRoutingHookStatus)('stop', 'success');
+            if (options.json)
+                output({ state: 'captured', provider: 'claude-code', selection: expectedSelection, receipt,
+                    actualModelVerified: true, tokenUsage: 'unknown', inferenceDispatched: false }, true);
+        }
+        catch {
+            let alert = true;
+            try {
+                alert = (0, hook_diagnostics_1.recordRoutingHookStatus)(options.event, stage);
+            }
+            catch { /* stderr still exposes failure */ }
+            if (alert)
+                process.stderr.write(`AWM Claude routing capture: ${stage}; inspect awm model-policy setup --provider claude-code --json\n`);
+            if (options.json)
+                output({ state: 'failed', reasonCode: stage, inferenceDispatched: false }, true);
+            // A hook is observability, never a reason to block the native work.
+        }
+    });
     // Approval demands --expected-digest so that it stays an explicit operator
     // act. Without a way to observe the digest first, that safeguard blocked the
     // legitimate path instead of gating it, and the only way through was to