agentic-workflow-manager 9.11.11 → 9.12.0

package/dist/src/core/model-policy/capabilities-v2.js

@@ -0,0 +1,152 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateEventReceipt = validateEventReceipt;
+exports.evaluateEventReceipt = evaluateEventReceipt;
+const capabilities_1 = require("./capabilities");
+const validate_1 = require("./validate");
+function record(value, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error(`${label} must be an object`);
+    return value;
+}
+function exact(value, keys, label) {
+    if (Object.keys(value).length !== keys.length || Object.keys(value).some(key => !keys.includes(key)))
+        throw new Error(`${label} has unknown or missing fields`);
+}
+function digest(value, label) {
+    (0, validate_1.assertDigest)(value, label);
+    return value;
+}
+function selection(value) {
+    const item = record(value, 'selection');
+    exact(item, ['selector', 'effort'], 'selection');
+    const selector = record(item.selector, 'selection.selector');
+    exact(selector, ['kind', 'id'], 'selection.selector');
+    if (selector.kind !== 'model' && selector.kind !== 'tier')
+        throw new Error('selection.selector.kind is invalid');
+    if (typeof selector.id !== 'string' || selector.id.length === 0 || selector.id.length > 128 || /[\u0000-\u001f\u007f-\u009f]/.test(selector.id))
+        throw new Error('selection.selector.id is invalid');
+    const effort = record(item.effort, 'selection.effort');
+    if (effort.kind === 'runtime-default') {
+        exact(effort, ['kind'], 'selection.effort');
+        return { selector: { kind: selector.kind, id: selector.id }, effort: { kind: 'runtime-default' } };
+    }
+    exact(effort, ['kind', 'value'], 'selection.effort');
+    if (effort.kind !== 'explicit' || typeof effort.value !== 'string' || effort.value.length === 0 || effort.value.length > 128 || /[\u0000-\u001f\u007f-\u009f]/.test(effort.value))
+        throw new Error('selection.effort is invalid');
+    return { selector: { kind: selector.kind, id: selector.id }, effort: { kind: 'explicit', value: effort.value } };
+}
+function key(value) { return `${value.selector.kind}\0${value.selector.id}\0${value.effort.kind}\0${value.effort.kind === 'explicit' ? value.effort.value : ''}`; }
+function finiteTokens(value, label) {
+    if (!Number.isSafeInteger(value) || value < 0)
+        throw new Error(`${label} is invalid`);
+    return value;
+}
+/** Schema v2 is internal native evidence, never a candidate for v1 approval. */
+function validateEventReceipt(value) {
+    const item = record(value, 'event receipt');
+    exact(item, ['schema', 'runtime', 'binaryDigest', 'configDigest', 'recordedAt', 'claims'], 'event receipt');
+    if (item.schema !== 'routing-capabilities/v2')
+        throw new Error('event receipt schema is invalid');
+    const runtime = (0, capabilities_1.validateRuntimeKey)(item.runtime);
+    if (runtime.target !== 'codex' && runtime.target !== 'claude-code')
+        throw new Error('event receipt provider target is unsupported');
+    const binaryDigest = digest(item.binaryDigest, 'binaryDigest');
+    const configDigest = digest(item.configDigest, 'configDigest');
+    const recordedAt = (0, validate_1.canonicalUtcTimestamp)(item.recordedAt, 'recordedAt');
+    if (!Array.isArray(item.claims) || item.claims.length === 0 || item.claims.length > 64)
+        throw new Error('event receipt claims are invalid');
+    const claims = item.claims.map((raw, index) => {
+        const claim = record(raw, `claims[${index}]`);
+        exact(claim, claim.source === 'claude-assistant-transcript'
+            ? ['selection', 'mappingDigest', 'eventDigest', 'source', 'nativeAgentType', ...(claim.nativeAgentIdDigest === undefined ? [] : ['nativeAgentIdDigest']), ...(claim.nativeEvents === undefined ? [] : ['nativeEvents']), 'observedAt', 'actualModel', 'tokenUsage']
+            : ['selection', 'mappingDigest', 'eventDigest', 'source', 'observedAt', 'actualModel', 'tokenUsage'], `claims[${index}]`);
+        const selected = selection(claim.selection);
+        const mappingDigest = digest(claim.mappingDigest, `claims[${index}].mappingDigest`);
+        const eventDigest = digest(claim.eventDigest, `claims[${index}].eventDigest`);
+        if (claim.source !== 'codex-turn-context' && claim.source !== 'claude-assistant-transcript')
+            throw new Error(`claims[${index}].source is invalid`);
+        if ((runtime.target === 'codex') !== (claim.source === 'codex-turn-context'))
+            throw new Error(`claims[${index}].source does not match provider`);
+        if (claim.source === 'claude-assistant-transcript' && (typeof claim.nativeAgentType !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(claim.nativeAgentType)))
+            throw new Error(`claims[${index}].nativeAgentType is invalid`);
+        if (claim.nativeAgentIdDigest !== undefined) {
+            if (claim.source !== 'claude-assistant-transcript')
+                throw new Error(`claims[${index}].nativeAgentIdDigest is invalid`);
+            digest(claim.nativeAgentIdDigest, `claims[${index}].nativeAgentIdDigest`);
+        }
+        let nativeEvents;
+        if (claim.nativeEvents !== undefined) {
+            if (claim.source !== 'claude-assistant-transcript' || !Array.isArray(claim.nativeEvents)
+                || claim.nativeEvents.length === 0 || claim.nativeEvents.length > 64)
+                throw new Error(`claims[${index}].nativeEvents is invalid`);
+            nativeEvents = claim.nativeEvents.map((raw, eventIndex) => {
+                const event = record(raw, `claims[${index}].nativeEvents[${eventIndex}]`);
+                exact(event, ['nativeAgentIdDigest', 'eventDigest', 'observedAt'], `claims[${index}].nativeEvents[${eventIndex}]`);
+                const observedAt = (0, validate_1.canonicalUtcTimestamp)(event.observedAt, `claims[${index}].nativeEvents[${eventIndex}].observedAt`);
+                if (Date.parse(observedAt) > Date.parse(recordedAt))
+                    throw new Error('Claude native event is newer than receipt');
+                return { nativeAgentIdDigest: digest(event.nativeAgentIdDigest, 'nativeAgentIdDigest'),
+                    eventDigest: digest(event.eventDigest, 'eventDigest'), observedAt };
+            });
+            if (new Set(nativeEvents.map(event => event.nativeAgentIdDigest)).size !== nativeEvents.length
+                || new Set(nativeEvents.map(event => event.eventDigest)).size !== nativeEvents.length)
+                throw new Error('Claude native events are duplicated');
+        }
+        const observedAt = (0, validate_1.canonicalUtcTimestamp)(claim.observedAt, `claims[${index}].observedAt`);
+        if (Date.parse(observedAt) > Date.parse(recordedAt))
+            throw new Error(`claims[${index}] is newer than receipt`);
+        let actualModel;
+        if (claim.actualModel === 'unverified')
+            actualModel = 'unverified';
+        else {
+            const actual = record(claim.actualModel, `claims[${index}].actualModel`);
+            exact(actual, ['id', 'evidenceDigest'], `claims[${index}].actualModel`);
+            if (claim.source !== 'claude-assistant-transcript' || typeof actual.id !== 'string' || actual.id.length === 0 || actual.id.length > 128)
+                throw new Error(`claims[${index}].actualModel is invalid`);
+            actualModel = { id: actual.id, evidenceDigest: digest(actual.evidenceDigest, `claims[${index}].actualModel.evidenceDigest`) };
+        }
+        let tokenUsage;
+        if (claim.tokenUsage === 'unknown')
+            tokenUsage = 'unknown';
+        else {
+            const usage = record(claim.tokenUsage, `claims[${index}].tokenUsage`);
+            exact(usage, ['input', 'output'], `claims[${index}].tokenUsage`);
+            tokenUsage = { input: finiteTokens(usage.input, 'input tokens'), output: finiteTokens(usage.output, 'output tokens') };
+        }
+        return { selection: selected, mappingDigest, eventDigest, source: claim.source,
+            ...(claim.source === 'claude-assistant-transcript' ? { nativeAgentType: claim.nativeAgentType,
+                ...(claim.nativeAgentIdDigest === undefined ? {} : { nativeAgentIdDigest: claim.nativeAgentIdDigest }),
+                ...(nativeEvents === undefined ? {} : { nativeEvents }) } : {}), observedAt, actualModel, tokenUsage };
+    });
+    if (new Set(claims.map(claim => key(claim.selection))).size !== claims.length)
+        throw new Error('event receipt has duplicate selections');
+    return { schema: 'routing-capabilities/v2', runtime, binaryDigest, configDigest, recordedAt, claims };
+}
+/** Local, read-only comparison: no TTL, network call, rewrite or paid probe. */
+function evaluateEventReceipt(value, scopeValue, selectedValue, mappingDigestValue, now) {
+    const receipt = validateEventReceipt(value);
+    const scope = record(scopeValue, 'event scope');
+    exact(scope, ['runtime', 'binaryDigest', 'configDigest'], 'event scope');
+    const runtime = (0, capabilities_1.validateRuntimeKey)(scope.runtime);
+    const binaryDigest = digest(scope.binaryDigest, 'binaryDigest');
+    const configDigest = digest(scope.configDigest, 'configDigest');
+    const selected = selection(selectedValue);
+    const mappingDigest = digest(mappingDigestValue, 'mappingDigest');
+    if (!(now instanceof Date) || !Number.isFinite(now.getTime()))
+        throw new Error('event currentness clock is invalid');
+    if (Date.parse(receipt.recordedAt) > now.getTime())
+        return { state: 'drift', reason: 'FUTURE_EVIDENCE' };
+    if (receipt.runtime.target !== runtime.target || receipt.runtime.kind !== runtime.kind || receipt.runtime.version !== runtime.version || receipt.binaryDigest !== binaryDigest)
+        return { state: 'drift', reason: 'RUNTIME_DRIFT' };
+    if (receipt.runtime.accountScopeDigest !== runtime.accountScopeDigest)
+        return { state: 'drift', reason: 'ACCOUNT_DRIFT' };
+    if (receipt.configDigest !== configDigest)
+        return { state: 'drift', reason: 'CONFIG_DRIFT' };
+    const claim = receipt.claims.find(item => key(item.selection) === key(selected));
+    if (!claim)
+        return { state: 'drift', reason: 'SELECTION_UNENROLLED' };
+    if (claim.mappingDigest !== mappingDigest)
+        return { state: 'drift', reason: 'POLICY_DRIFT' };
+    return { state: 'current' };
+}

package/dist/src/core/model-policy/capabilities.js

@@ -8,6 +8,7 @@ exports.capabilityReceiptDigest = capabilityReceiptDigest;
 exports.validateCapabilityReceipt = validateCapabilityReceipt;
 exports.receiptIsCurrent = receiptIsCurrent;
 exports.routingDiagnostic = routingDiagnostic;
+exports.storedCapabilityPath = storedCapabilityPath;
 exports.capabilityReceiptPath = capabilityReceiptPath;
 exports.readCapabilities = readCapabilities;
 exports.approveCapabilities = approveCapabilities;
@@ -107,7 +108,12 @@ function validateCapabilityReceipt(value) {
 }
 function receiptIsCurrent(receipt, runtime, now) { return receipt.runtime.target === runtime.target && receipt.runtime.kind === runtime.kind && receipt.runtime.version === runtime.version && receipt.runtime.accountScopeDigest === runtime.accountScopeDigest && Number.isFinite(now.getTime()) && Date.parse(receipt.recordedAt) <= now.getTime() && now.getTime() <= Date.parse(receipt.expiresAt); }
 function routingDiagnostic(code, message) { return { code, message }; }
-function capabilityReceiptPath(runtime) { const valid = validateRuntimeKey(runtime); return path_1.default.join((0, paths_1.awmHome)(), 'routing-capabilities', valid.target, `${valid.kind}.json`); }
+function storedCapabilityPath(target, kind) {
+    if (typeof target !== 'string' || !providers_1.AGENT_TARGETS.includes(target) || typeof kind !== 'string' || !RUNTIME_KIND.test(kind))
+        throw new Error('stored capability target or kind is invalid');
+    return path_1.default.join((0, paths_1.awmHome)(), 'routing-capabilities', target, `${kind}.json`);
+}
+function capabilityReceiptPath(runtime) { const valid = validateRuntimeKey(runtime); return storedCapabilityPath(valid.target, valid.kind); }
 function safeParents(file) { for (let dir = path_1.default.dirname(path_1.default.resolve(file));; dir = path_1.default.dirname(dir)) {
     try {
         const stat = fs_1.default.lstatSync(dir);

package/dist/src/core/model-policy/claude-hook-events.js

@@ -0,0 +1,120 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recordClaudeHookStart = recordClaudeHookStart;
+exports.readClaudeHookPair = readClaudeHookPair;
+const crypto_1 = require("crypto");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const paths_1 = require("../paths");
+const json_1 = require("../plan/json");
+const native_bridge_1 = require("../secure-fs/native-bridge");
+const machine_key_1 = require("./machine-key");
+const native_claude_1 = require("./native-claude");
+const DOMAIN = 'AWM Claude hook start/v1\0';
+const MAX_BYTES = 8192;
+function id(value, label) {
+    if (typeof value !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(value))
+        throw new Error(`${label} is invalid`);
+    return value;
+}
+function event(value, kind) {
+    if (!value || typeof value !== 'object' || Array.isArray(value) || value.hook_event_name !== kind)
+        throw new Error(`Claude ${kind} hook is invalid`);
+    const row = value;
+    id(row.session_id, 'Claude session id');
+    id(row.agent_id, 'Claude agent id');
+    if (typeof row.agent_type !== 'string' || row.agent_type.length === 0 || row.agent_type.length > 128
+        || /[\u0000-\u001f\u007f-\u009f]/.test(row.agent_type))
+        throw new Error('Claude agent type is invalid');
+    return row;
+}
+function fileFor(sessionId, agentId) {
+    const digest = (0, crypto_1.createHash)('sha256').update(`${sessionId}\0${agentId}`).digest('hex');
+    return path_1.default.join((0, paths_1.awmHome)(), 'claude-hook-starts', `${digest}.json`);
+}
+function mac(value, key) { return (0, crypto_1.createHmac)('sha256', key).update(DOMAIN).update(JSON.stringify(value)).digest('hex'); }
+function safeDirectory(dir, create) {
+    const chain = [];
+    for (let current = dir;; current = path_1.default.dirname(current)) {
+        chain.unshift(current);
+        if (current === path_1.default.dirname(current))
+            break;
+    }
+    for (const item of chain) {
+        try {
+            const stat = fs_1.default.lstatSync(item);
+            if (!stat.isDirectory() || stat.isSymbolicLink())
+                throw new Error('Claude hook event has unsafe ancestor');
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT' || !create)
+                throw error;
+            fs_1.default.mkdirSync(item, { mode: 0o700 });
+        }
+    }
+}
+/** Persist bounded hook identity only; never a prompt, transcript or account ID. */
+function recordClaudeHookStart(value, now) {
+    const row = event(value, 'SubagentStart');
+    if (!(now instanceof Date) || !Number.isFinite(now.getTime()))
+        throw new Error('Claude hook clock is invalid');
+    const root = (0, paths_1.awmHome)();
+    const key = (0, machine_key_1.readMachineKey)(root);
+    if (!key)
+        throw new Error('Claude hook enrollment requires explicit machine setup');
+    const start = { hook_event_name: 'SubagentStart', session_id: row.session_id, agent_id: row.agent_id,
+        agent_type: row.agent_type, recorded_at: now.toISOString() };
+    const file = fileFor(start.session_id, start.agent_id);
+    native_bridge_1.secureFs.withProjectLease(root, () => {
+        safeDirectory(path_1.default.dirname(file), true);
+        const content = Buffer.from(`${JSON.stringify({ start, mac: mac(start, key) })}\n`);
+        let observed = null;
+        try {
+            const stat = fs_1.default.lstatSync(file);
+            if (!stat.isFile() || stat.isSymbolicLink())
+                throw new Error('Claude hook start is unsafe');
+            observed = native_bridge_1.secureFs.readRegularFile(file, MAX_BYTES);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        native_bridge_1.secureFs.writeProjectTransaction(root, path_1.default.relative(root, file).split(path_1.default.sep).join('/'), content, observed ? { mode: 'replace', createParents: false, expected: observed.bytes, expectedIdentity: observed.identity } : { mode: 'create', createParents: false });
+    });
+}
+/** Link Stop to a sealed Start event on this machine. Pending events expire
+ * after one day; this is not the capability receipt lifetime. */
+function readClaudeHookPair(stopValue, now) {
+    const stop = event(stopValue, 'SubagentStop');
+    if (!(now instanceof Date) || !Number.isFinite(now.getTime()))
+        throw new Error('Claude hook clock is invalid');
+    const key = (0, machine_key_1.readMachineKey)((0, paths_1.awmHome)());
+    if (!key)
+        throw new Error('Claude hook machine key is missing');
+    const file = fileFor(stop.session_id, stop.agent_id);
+    safeDirectory(path_1.default.dirname(file), false);
+    const stat = fs_1.default.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error('Claude hook start is unsafe');
+    const parsed = (0, json_1.parseJsonNoDuplicate)(new TextDecoder('utf-8', { fatal: true }).decode(native_bridge_1.secureFs.readRegularFile(file, MAX_BYTES).bytes));
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        throw new Error('Claude hook start envelope is invalid');
+    const envelope = parsed;
+    if (Object.keys(envelope).length !== 2 || typeof envelope.mac !== 'string' || !/^[a-f0-9]{64}$/.test(envelope.mac)
+        || !envelope.start || typeof envelope.start !== 'object' || Array.isArray(envelope.start))
+        throw new Error('Claude hook start seal is invalid');
+    const start = envelope.start;
+    if (Object.keys(start).length !== 5 || start.hook_event_name !== 'SubagentStart' || typeof start.recorded_at !== 'string'
+        || !Number.isFinite(Date.parse(start.recorded_at)) || start.session_id !== stop.session_id || start.agent_id !== stop.agent_id)
+        throw new Error('Claude hook start identity is invalid');
+    if (!(0, crypto_1.timingSafeEqual)(Buffer.from(envelope.mac, 'hex'), Buffer.from(mac(start, key), 'hex')))
+        throw new Error('Claude hook start seal does not match');
+    const ageMs = now.getTime() - Date.parse(start.recorded_at);
+    if (ageMs < 0 || ageMs > 24 * 60 * 60 * 1000)
+        throw new Error('Claude hook start is stale');
+    const lifecycle = (0, native_claude_1.normalizeClaudeSubagentLifecycle)(start, stop);
+    return { lifecycle, transcriptPath: stop.agent_transcript_path };
+}

package/dist/src/core/model-policy/event-store.js

@@ -0,0 +1,221 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.claudeAgentIdDigest = claudeAgentIdDigest;
+exports.readStoredEventReceipt = readStoredEventReceipt;
+exports.publishCodexObservation = publishCodexObservation;
+exports.publishClaudeObservation = publishClaudeObservation;
+const crypto_1 = require("crypto");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const paths_1 = require("../paths");
+const json_1 = require("../plan/json");
+const native_bridge_1 = require("../secure-fs/native-bridge");
+const capabilities_1 = require("./capabilities");
+const capabilities_v2_1 = require("./capabilities-v2");
+const native_codex_1 = require("./native-codex");
+const native_claude_1 = require("./native-claude");
+const native_claude_transcript_1 = require("./native-claude-transcript");
+const native_claude_agent_definition_1 = require("./native-claude-agent-definition");
+const machine_key_1 = require("./machine-key");
+const validate_1 = require("./validate");
+const MAX_RECEIPT_BYTES = 256 * 1024;
+const SEAL_DOMAIN = 'AWM routing-capabilities/v2 local receipt\0';
+const CLAUDE_AGENT_DOMAIN = 'AWM Claude native agent ID/v1\0';
+function claudeAgentIdDigest(agentId, key) {
+    if (typeof agentId !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(agentId) || !Buffer.isBuffer(key) || key.length !== 32)
+        throw new Error('Claude native agent identity is invalid');
+    return (0, crypto_1.createHmac)('sha256', key).update(CLAUDE_AGENT_DOMAIN).update(agentId).digest('hex');
+}
+function receiptPath(runtime) {
+    const valid = (0, capabilities_1.validateRuntimeKey)(runtime);
+    return path_1.default.join((0, paths_1.awmHome)(), 'routing-capabilities-v2', valid.target, `${valid.kind}.json`);
+}
+function safeParents(file, create) {
+    const chain = [];
+    for (let dir = path_1.default.dirname(file);; dir = path_1.default.dirname(dir)) {
+        chain.unshift(dir);
+        if (dir === path_1.default.dirname(dir))
+            break;
+    }
+    for (const dir of chain) {
+        try {
+            const stat = fs_1.default.lstatSync(dir);
+            if (!stat.isDirectory() || stat.isSymbolicLink())
+                throw new Error('event receipt has unsafe or symlinked ancestor');
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT' || !create)
+                throw error;
+            fs_1.default.mkdirSync(dir, { mode: 0o700 });
+        }
+    }
+}
+function readFile(file) {
+    try {
+        safeParents(file, false);
+        const stat = fs_1.default.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            throw new Error('event receipt is unsafe or symlinked');
+        const bytes = native_bridge_1.secureFs.readRegularFile(file, MAX_RECEIPT_BYTES).bytes;
+        const parsed = (0, json_1.parseJsonNoDuplicate)(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            throw new Error('event receipt envelope is invalid');
+        const envelope = parsed;
+        if (Object.keys(envelope).length !== 2 || !Object.keys(envelope).every(key => ['receipt', 'mac'].includes(key))
+            || typeof envelope.mac !== 'string' || !/^[a-f0-9]{64}$/.test(envelope.mac))
+            throw new Error('event receipt seal is invalid');
+        const receipt = (0, capabilities_v2_1.validateEventReceipt)(envelope.receipt);
+        const key = (0, machine_key_1.readMachineKey)((0, paths_1.awmHome)());
+        if (!key)
+            throw new Error('event receipt machine key is missing');
+        const expected = seal(receipt, key);
+        if (!(0, crypto_1.timingSafeEqual)(Buffer.from(envelope.mac, 'hex'), Buffer.from(expected, 'hex')))
+            throw new Error('event receipt seal does not match this machine');
+        return receipt;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+function seal(receipt, key) {
+    return (0, crypto_1.createHmac)('sha256', key).update(SEAL_DOMAIN).update(JSON.stringify(receipt)).digest('hex');
+}
+function readStoredEventReceipt(runtime) {
+    try {
+        const value = readFile(receiptPath(runtime));
+        return value === null ? { state: 'absent' } : { state: 'present', receipt: value };
+    }
+    catch (error) {
+        return { state: 'invalid', reason: error.message.slice(0, 4096) };
+    }
+}
+function sameSelection(left, right) {
+    return left.selector.kind === right.selector.kind && left.selector.id === right.selector.id && left.effort.kind === right.effort.kind
+        && (left.effort.kind !== 'explicit' || left.effort.value === right.effort.value);
+}
+function sameScope(left, right) {
+    return left.runtime.target === right.runtime.target && left.runtime.kind === right.runtime.kind && left.runtime.version === right.runtime.version
+        && left.runtime.accountScopeDigest === right.runtime.accountScopeDigest && left.binaryDigest === right.binaryDigest && left.configDigest === right.configDigest;
+}
+/** The only Codex v2 writer takes a native observation, never a candidate JSON.
+ * The CLI must call the native adapter and derive scope from this machine. */
+function publishCodexObservation(input) {
+    if (!input || typeof input !== 'object' || !(0, native_codex_1.isNativeCodexChildObservation)(input.observation))
+        throw new Error('Codex native provenance is required');
+    if (input.observation.provenance !== 'codex-app-server-thread-read'
+        || input.observation.nativeDispatchVerified !== true || input.observation.acceptedSelectionVerified !== true
+        || input.observation.actualModelVerified !== false || input.observation.tokenUsage !== 'unknown')
+        throw new Error('Codex native selection is unverified');
+    const scope = input.scope;
+    if (!scope || scope.runtime?.target !== 'codex' || input.observation.childRuntimeVersion !== scope.runtime.version)
+        throw new Error('Codex native runtime version mismatch');
+    if (!sameSelection(input.observation.configuredSelection, input.expectedSelection))
+        throw new Error('Codex observed selection does not match approved selection');
+    (0, validate_1.assertDigest)(input.mappingDigest, 'mappingDigest');
+    if (!(input.now instanceof Date) || !Number.isFinite(input.now.getTime()))
+        throw new Error('event receipt clock is invalid');
+    const recordedAt = input.now.toISOString();
+    if (typeof input.observation.observedAt !== 'string' || !Number.isFinite(Date.parse(input.observation.observedAt)))
+        throw new Error('Codex native turn timestamp is unavailable');
+    const eventDigest = (0, crypto_1.createHash)('sha256').update(JSON.stringify({ parent: input.observation.parentThreadId, child: input.observation.childThreadId,
+        turn: input.observation.turnId, selection: input.observation.configuredSelection, runtimeVersion: input.observation.childRuntimeVersion,
+        accountScopeDigest: scope.runtime.accountScopeDigest })).digest('hex');
+    const claim = { selection: input.expectedSelection, mappingDigest: input.mappingDigest, eventDigest,
+        source: 'codex-turn-context', observedAt: input.observation.observedAt, actualModel: 'unverified', tokenUsage: 'unknown' };
+    const initial = (0, capabilities_v2_1.validateEventReceipt)({ schema: 'routing-capabilities/v2', ...scope, recordedAt, claims: [claim] });
+    const file = receiptPath(initial.runtime);
+    const root = (0, paths_1.awmHome)();
+    return native_bridge_1.secureFs.withProjectLease(root, () => {
+        const key = (0, machine_key_1.readMachineKey)(root);
+        if (!key)
+            throw new Error('event receipt machine key is missing; run explicit setup');
+        safeParents(file, true);
+        const current = readFile(file);
+        if (current && sameScope(current, scope)) {
+            const prior = current.claims.find(item => sameSelection(item.selection, claim.selection));
+            if (prior && prior.mappingDigest === claim.mappingDigest && prior.eventDigest === claim.eventDigest)
+                return current;
+        }
+        const ageMs = input.now.getTime() - Date.parse(input.observation.observedAt);
+        if (ageMs < 0 || ageMs > 15 * 60 * 1000)
+            throw new Error('Codex native turn is not fresh for enrollment');
+        const claims = current && sameScope(current, scope) ? current.claims.filter(item => !sameSelection(item.selection, claim.selection)).concat(claim) : [claim];
+        const next = (0, capabilities_v2_1.validateEventReceipt)({ ...initial, claims });
+        const destination = path_1.default.relative(root, file).split(path_1.default.sep).join('/');
+        const bytes = Buffer.from(`${JSON.stringify({ receipt: next, mac: seal(next, key) }, null, 2)}\n`);
+        if (current) {
+            const observed = native_bridge_1.secureFs.readRegularFile(file, MAX_RECEIPT_BYTES);
+            native_bridge_1.secureFs.writeProjectTransaction(root, destination, bytes, { mode: 'replace', createParents: false, expected: observed.bytes, expectedIdentity: observed.identity });
+        }
+        else
+            native_bridge_1.secureFs.writeProjectTransaction(root, destination, bytes, { mode: 'create', createParents: false });
+        return next;
+    });
+}
+/** Bind a native hook pair to the provider's assistant transcript. The transcript
+ * reports a model, not effective effort or paid usage, so only runtime-default
+ * effort may be enrolled and usage remains unknown. */
+function publishClaudeObservation(input) {
+    if (!input || typeof input !== 'object' || !(0, native_claude_1.isNativeClaudeSubagentLifecycle)(input.lifecycle)
+        || !(0, native_claude_transcript_1.isNativeClaudeTranscriptObservation)(input.transcript))
+        throw new Error('Claude native hook and transcript provenance are required');
+    if (!(0, native_claude_agent_definition_1.isNativeClaudeAgentDeclaration)(input.declaredAgent) || input.declaredAgent.agentType !== input.lifecycle.agentType
+        || input.declaredAgent.modelId !== input.transcript.actualModel)
+        throw new Error('Claude declared agent model provenance is required');
+    if (input.scope?.runtime?.target !== 'claude-code' || input.lifecycle.agentId !== input.transcript.agentId
+        || input.expectedSelection?.selector?.kind !== 'model' || input.expectedSelection.selector.id !== input.transcript.actualModel
+        || input.expectedSelection.effort.kind !== 'runtime-default')
+        throw new Error('Claude native selection does not match approved model or effort');
+    (0, validate_1.assertDigest)(input.mappingDigest, 'mappingDigest');
+    if (!(input.now instanceof Date) || !Number.isFinite(input.now.getTime()))
+        throw new Error('event receipt clock is invalid');
+    const eventDigest = (0, crypto_1.createHash)('sha256').update(JSON.stringify({ session: input.lifecycle.sessionId, agent: input.lifecycle.agentId,
+        transcriptDigest: input.transcript.evidenceDigest, accountScopeDigest: input.scope.runtime.accountScopeDigest })).digest('hex');
+    const nativeAgentIdDigest = claudeAgentIdDigest(input.lifecycle.agentId, (0, machine_key_1.readMachineKey)((0, paths_1.awmHome)()));
+    const nativeEvent = { nativeAgentIdDigest, eventDigest, observedAt: input.transcript.observedAt };
+    const claim = { selection: input.expectedSelection, mappingDigest: input.mappingDigest, eventDigest,
+        nativeAgentType: input.lifecycle.agentType,
+        nativeAgentIdDigest, nativeEvents: [nativeEvent],
+        source: 'claude-assistant-transcript', observedAt: input.transcript.observedAt,
+        actualModel: { id: input.transcript.actualModel, evidenceDigest: input.transcript.evidenceDigest }, tokenUsage: 'unknown' };
+    const initial = (0, capabilities_v2_1.validateEventReceipt)({ schema: 'routing-capabilities/v2', ...input.scope, recordedAt: input.now.toISOString(), claims: [claim] });
+    const file = receiptPath(initial.runtime);
+    const root = (0, paths_1.awmHome)();
+    return native_bridge_1.secureFs.withProjectLease(root, () => {
+        const key = (0, machine_key_1.readMachineKey)(root);
+        if (!key)
+            throw new Error('event receipt machine key is missing; run explicit setup');
+        safeParents(file, true);
+        const current = readFile(file);
+        if (current && sameScope(current, input.scope)) {
+            const prior = current.claims.find(item => sameSelection(item.selection, claim.selection));
+            if (prior && prior.mappingDigest === claim.mappingDigest && prior.eventDigest === claim.eventDigest)
+                return current;
+        }
+        const ageMs = input.now.getTime() - Date.parse(input.transcript.observedAt);
+        if (!Number.isFinite(ageMs) || ageMs < 0 || ageMs > 15 * 60 * 1000)
+            throw new Error('Claude native transcript is not fresh for enrollment');
+        const prior = current && sameScope(current, input.scope) ? current.claims.find(item => sameSelection(item.selection, claim.selection)) : undefined;
+        const previousEvents = prior?.nativeEvents ?? (prior?.nativeAgentIdDigest ? [{ nativeAgentIdDigest: prior.nativeAgentIdDigest,
+                eventDigest: prior.eventDigest, observedAt: prior.observedAt }] : []);
+        const recentEvents = previousEvents.filter(item => input.now.getTime() - Date.parse(item.observedAt) <= 15 * 60_000
+            && item.nativeAgentIdDigest !== nativeAgentIdDigest && item.eventDigest !== eventDigest);
+        const mergedClaim = { ...claim, nativeEvents: recentEvents.concat(nativeEvent).slice(-64) };
+        const claims = current && sameScope(current, input.scope) ? current.claims.filter(item => !sameSelection(item.selection, claim.selection)).concat(mergedClaim) : [mergedClaim];
+        const next = (0, capabilities_v2_1.validateEventReceipt)({ ...initial, claims });
+        const destination = path_1.default.relative(root, file).split(path_1.default.sep).join('/');
+        const bytes = Buffer.from(`${JSON.stringify({ receipt: next, mac: seal(next, key) }, null, 2)}\n`);
+        if (current) {
+            const observed = native_bridge_1.secureFs.readRegularFile(file, MAX_RECEIPT_BYTES);
+            native_bridge_1.secureFs.writeProjectTransaction(root, destination, bytes, { mode: 'replace', createParents: false, expected: observed.bytes, expectedIdentity: observed.identity });
+        }
+        else
+            native_bridge_1.secureFs.writeProjectTransaction(root, destination, bytes, { mode: 'create', createParents: false });
+        return next;
+    });
+}

package/dist/src/core/model-policy/hook-diagnostics.js

@@ -0,0 +1,94 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recordRoutingHookStatus = recordRoutingHookStatus;
+exports.readRoutingHookStatus = readRoutingHookStatus;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const paths_1 = require("../paths");
+const json_1 = require("../plan/json");
+const native_bridge_1 = require("../secure-fs/native-bridge");
+const fresh = () => ({ schema: 'routing-hook-status/v1', start: { count: 0 }, stop: { count: 0 } });
+function target() { return path_1.default.join((0, paths_1.awmHome)(), 'routing-hook-status.json'); }
+function safeParents(file) {
+    const chain = [];
+    for (let dir = path_1.default.dirname(file);; dir = path_1.default.dirname(dir)) {
+        chain.unshift(dir);
+        if (dir === path_1.default.dirname(dir))
+            break;
+    }
+    for (const dir of chain) {
+        const stat = fs_1.default.lstatSync(dir);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            throw new Error('routing hook status has an unsafe ancestor');
+    }
+}
+function read() {
+    const file = target();
+    safeParents(file);
+    let stat;
+    try {
+        stat = fs_1.default.lstatSync(file);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { status: fresh(), observed: null };
+        throw error;
+    }
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error('routing hook status is unsafe');
+    const observed = native_bridge_1.secureFs.readRegularFile(file, 8192);
+    const value = (0, json_1.parseJsonNoDuplicate)(new TextDecoder('utf-8', { fatal: true }).decode(observed.bytes));
+    if (!value || value.schema !== 'routing-hook-status/v1' || !value.start || !value.stop
+        || !Number.isSafeInteger(value.start.count) || !Number.isSafeInteger(value.stop.count)
+        || value.start.count < 0 || value.stop.count < 0)
+        throw new Error('routing hook status is corrupt');
+    return { status: value, observed };
+}
+/** Failure is a redacted code, never provider payload or an exception string.
+ * Returns true only for a newly alertable failure episode. */
+function recordRoutingHookStatus(phase, result, now = new Date()) {
+    if (phase !== 'start' && phase !== 'stop')
+        throw new Error('routing hook phase is invalid');
+    if (result !== 'success' && !/^[A-Z0-9_]{3,64}$/.test(result))
+        throw new Error('routing hook reason code is invalid');
+    if (!(now instanceof Date) || !Number.isFinite(now.getTime()))
+        throw new Error('routing hook clock is invalid');
+    const root = (0, paths_1.awmHome)();
+    return native_bridge_1.secureFs.withProjectLease(root, () => {
+        const { status, observed } = read();
+        const item = status[phase];
+        const pending = item.lastFailureAt !== undefined && (item.lastSuccessAt === undefined || item.lastFailureAt > item.lastSuccessAt);
+        const alert = result !== 'success' && (!pending || item.reasonCode !== result);
+        if (result === 'success')
+            item.lastSuccessAt = now.toISOString();
+        else {
+            item.lastFailureAt = now.toISOString();
+            item.reasonCode = result;
+            item.count += 1;
+        }
+        const bytes = Buffer.from(`${JSON.stringify(status)}\n`);
+        native_bridge_1.secureFs.writeProjectTransaction(root, path_1.default.basename(target()), bytes, observed
+            ? { mode: 'replace', createParents: false, expected: observed.bytes, expectedIdentity: observed.identity }
+            : { mode: 'create', createParents: false });
+        return alert;
+    });
+}
+function readRoutingHookStatus() {
+    try {
+        const { status, observed } = read();
+        if (!observed)
+            return { state: 'absent' };
+        const failures = ['start', 'stop'].flatMap(phase => {
+            const item = status[phase];
+            return item.lastFailureAt && item.reasonCode && (!item.lastSuccessAt || item.lastFailureAt > item.lastSuccessAt)
+                ? [{ phase, reasonCode: item.reasonCode, count: item.count }] : [];
+        });
+        return failures.length ? { state: 'failed', failures } : { state: 'healthy' };
+    }
+    catch {
+        return { state: 'invalid' };
+    }
+}