agentic-workflow-manager 9.11.12 → 9.12.0

package/dist/src/core/model-policy/journal.js

@@ -21,6 +21,26 @@ function canonical(value) { if (Array.isArray(value))
 function digest(value) { return crypto_1.default.createHash('sha256').update(canonical(value)).digest('hex'); }
 function clone(state) { const next = structuredClone(state); if (!Array.isArray(next.routingAttempts))
     next.routingAttempts = []; return next; }
+function noteRoutingIncident(state, target, selection, reasonCode, at, fallback, sameObligationAlreadyCounted = false) {
+    if (!/^[A-Z0-9_]{3,64}$/.test(reasonCode))
+        throw new Error('routing incident reason is invalid');
+    state.routingIncidents ??= [];
+    // One incident/alert per selected route in a run even if later failures
+    // refine the cause; retain the first actionable reason.
+    const id = crypto_1.default.createHash('sha256').update(`${state.journalId}\0${state.cycle.startedAt}\0${target}\0${canonical(selection)}`).digest('hex').slice(0, 24);
+    const prior = state.routingIncidents.find(item => item.id === id);
+    if (prior) {
+        prior.affectedObligations += Number(!sameObligationAlreadyCounted);
+        prior.fallbackCount += Number(fallback);
+        prior.blockedCount += Number(!fallback);
+        prior.lastAt = at;
+        return;
+    }
+    if (state.routingIncidents.length >= 4096)
+        throw new Error('routing incident limit exhausted');
+    state.routingIncidents.push({ schema: 'routing-incident/v1', id, runStartedAt: state.cycle.startedAt, target, selection: structuredClone(selection), reasonCode,
+        firstAt: at, lastAt: at, affectedObligations: 1, fallbackCount: Number(fallback), blockedCount: Number(!fallback), alertState: 'pending' });
+}
 function reserveRoutingAttempt(state, input, now) {
     assertTimestamp(now);
     if (!(0, types_1.isWellFormedState)(state) || !input || typeof input.obligationId !== 'string' || input.obligationId.length === 0 || input.obligationId.length > 128 || typeof input.lineageId !== 'string' || input.lineageId.length === 0 || input.lineageId.length > 128 || !(0, types_1.isRoutingEnvelope)(input.envelope) || !/^[a-f0-9]{64}$/.test(input.fingerprint))
@@ -35,34 +55,62 @@ function reserveRoutingAttempt(state, input, now) {
     next.implementationLineages ??= [];
     const priorLineage = next.implementationLineages.find(lineage => lineage.id === input.lineageId);
     if (input.envelope.role === 'implementer' && priorLineage === undefined)
-        next.implementationLineages.push({ id: input.lineageId, obligationId: input.obligationId, sliceId: input.envelope.sliceId, planDigest: input.envelope.planDigest, executionDigest: input.envelope.executionDigest, initialProfile: input.envelope.requestedProfile, initialEffort: input.envelope.resolved.effort.kind === 'explicit' && input.envelope.resolved.effort.value === 'high' ? 'high' : 'medium', attempts: 0 });
+        next.implementationLineages.push({ id: input.lineageId, obligationId: input.obligationId, sliceId: input.envelope.sliceId, planDigest: input.envelope.planDigest, executionDigest: input.envelope.executionDigest, initialProfile: input.envelope.requestedProfile, initialEffort: input.envelope.resolved.effort.kind === 'runtime-default' ? 'runtime-default' : input.envelope.resolved.effort.value === 'high' ? 'high' : 'medium', attempts: 0 });
     if (priorLineage !== undefined && (priorLineage.obligationId !== input.obligationId || priorLineage.planDigest !== input.envelope.planDigest || priorLineage.executionDigest !== input.envelope.executionDigest || priorLineage.sliceId !== input.envelope.sliceId || priorLineage.initialProfile !== input.envelope.requestedProfile))
         throw new Error('routing lineage binding mismatch');
     const attempts = next.routingAttempts.filter(item => item.lineageId === input.lineageId && item.envelope.role === 'implementer');
     if (input.envelope.role === 'implementer' && attempts.length >= 3)
         throw new Error('routing implementation budget exhausted');
+    const fullFallback = input.envelope.role === 'implementer' && input.envelope.effectiveProfile === 'full';
+    if (fullFallback && attempts.some(item => item.envelope.effectiveProfile === 'full'))
+        throw new Error('routing full fallback cannot recursively retry a lineage');
+    if (fullFallback && attempts.length > 0) {
+        const previous = attempts[attempts.length - 1];
+        if (previous.state !== 'blocked' || previous.verdict !== 'inconclusive'
+            || !['PROVIDER_REJECTED', 'SELECTION_MISMATCH', 'PROVENANCE_MISSING'].includes(previous.reasonCode ?? ''))
+            throw new Error('routing full fallback requires a terminal native routing failure');
+    }
     if (input.envelope.role === 'implementer') {
         const initial = input.envelope.requestedProfile;
         if (initial === 'full')
             throw new Error('routing implementer profile is invalid');
-        const expected = resolveLineageEscalation(next, input.lineageId, initial);
-        const actualEffort = input.envelope.resolved.effort.kind === 'explicit' ? input.envelope.resolved.effort.value : 'runtime-default';
-        const judgmentHighAfterIntegration = expected.profile === 'judgment' && expected.effort === 'medium' && actualEffort === 'high' && attempts.length > 0 && attempts[attempts.length - 1].envelope.effectiveProfile === 'integration';
-        if (input.envelope.effectiveProfile !== expected.profile || (actualEffort !== expected.effort && !judgmentHighAfterIntegration))
-            throw new Error('routing effective escalation mismatch');
+        if (!fullFallback) {
+            const expected = resolveLineageEscalation(next, input.lineageId, initial);
+            const actualEffort = input.envelope.resolved.effort.kind === 'explicit' ? input.envelope.resolved.effort.value : 'runtime-default';
+            const judgmentHighAfterIntegration = expected.profile === 'judgment' && expected.effort === 'medium' && actualEffort === 'high' && attempts.length > 0 && attempts[attempts.length - 1].envelope.effectiveProfile === 'integration';
+            if (input.envelope.effectiveProfile !== expected.profile || (actualEffort !== expected.effort && !judgmentHighAfterIntegration))
+                throw new Error('routing effective escalation mismatch');
+        }
     }
     const approval = input.approval?.();
     if (!approval)
         throw new Error('routing reservation requires current approval');
-    const selectionInput = { role: input.envelope.role, requestedProfile: input.envelope.role === 'implementer' ? input.envelope.effectiveProfile : 'full', runtime: (0, capabilities_1.validateRuntimeKey)(input.envelope.runtime), policy: approval.policy, capabilities: approval.capabilities, now: approval.checkedAt };
+    if ((approval.eventReceipt || approval.eventScope) && (!approval.eventReceipt || !approval.eventScope || canonical(approval.eventScope.runtime) !== canonical(input.envelope.runtime)))
+        throw new Error('routing reservation event scope mismatch');
+    const selectionInput = { role: input.envelope.role, requestedProfile: input.envelope.role === 'implementer' ? input.envelope.effectiveProfile : 'full', runtime: (0, capabilities_1.validateRuntimeKey)(input.envelope.runtime), policy: approval.policy, capabilities: approval.capabilities, eventReceipt: approval.eventReceipt, eventScope: approval.eventScope, circuitIncidents: next.routingIncidents, now: approval.checkedAt };
+    const mapping = approval.policy?.content.mappings.find(item => item.target === input.envelope.runtime.target && item.runtimeKind === input.envelope.runtime.kind);
+    const optimizedSelection = mapping && input.envelope.role === 'implementer' && input.envelope.requestedProfile !== 'full' ? mapping.profiles[input.envelope.requestedProfile] : undefined;
+    const circuitReason = optimizedSelection && next.routingIncidents?.find(item => item.target === input.envelope.runtime.target && canonical(item.selection) === canonical(optimizedSelection)
+        && ['PROVIDER_REJECTED', 'SELECTION_MISMATCH', 'PROVENANCE_MISSING'].includes(item.reasonCode))?.reasonCode;
     const resolved = input.envelope.role === 'implementer' && input.envelope.effectiveProfile === 'judgment' && input.envelope.resolved.effort.kind === 'explicit' && input.envelope.resolved.effort.value === 'high'
         ? (0, resolve_1.resolveEscalatedSelection)({ ...selectionInput, role: 'implementer', requestedProfile: 'judgment', expectedEffort: 'high' })
-        : (0, resolve_1.resolveSelection)(selectionInput);
-    if (resolved.state !== 'resolved' || resolved.effectiveProfile !== input.envelope.effectiveProfile || canonical(resolved.selection) !== canonical(input.envelope.resolved) || resolved.policyDigest !== input.envelope.policyDigest || resolved.capabilityDigest !== input.envelope.capabilityDigest || resolved.outcome !== input.envelope.outcome || canonical(resolved.unavailableEvidence) !== canonical(input.envelope.unavailableEvidence))
+        : approval.eventReceipt && approval.eventScope
+            ? (0, resolve_1.resolveEventWithFallback)({ role: selectionInput.role, requestedProfile: input.envelope.role === 'implementer' ? fullFallback ? input.envelope.requestedProfile : input.envelope.effectiveProfile : 'full', policy: approval.policy, receipt: approval.eventReceipt, scope: approval.eventScope, now: approval.checkedAt, circuitReason })
+            : (0, resolve_1.resolveSelection)(selectionInput);
+    if (fullFallback && (resolved.state !== 'resolved' || !resolved.fallbackReason))
+        throw new Error('routing full fallback requires a current optimized-route failure');
+    if (resolved.state !== 'resolved' || resolved.effectiveProfile !== input.envelope.effectiveProfile || canonical(resolved.selection) !== canonical(input.envelope.resolved) || resolved.policyDigest !== input.envelope.policyDigest || resolved.capabilityDigest !== input.envelope.capabilityDigest || resolved.outcome !== input.envelope.outcome || canonical(resolved.unavailableEvidence) !== canonical(input.envelope.unavailableEvidence) || resolved.nativeAgentType !== input.envelope.nativeAgentType)
         throw new Error('routing reservation approval mismatch');
     const attempt = attempts.length + 1;
     const id = `route-${crypto_1.default.createHash('sha256').update(`${input.lineageId}\0${attempt}\0${envelopeDigest}\0${input.fingerprint}`).digest('hex').slice(0, 24)}`;
-    next.routingAttempts.push({ schema: 'routing-attempt/v1', id, obligationId: input.obligationId, lineageId: input.lineageId, attempt, envelope: structuredClone(input.envelope), envelopeDigest, fingerprint: input.fingerprint, state: 'reserved' });
+    next.routingAttempts.push({ schema: 'routing-attempt/v1', id, obligationId: input.obligationId, lineageId: input.lineageId, attempt, envelope: structuredClone(input.envelope), envelopeDigest, fingerprint: input.fingerprint, state: 'reserved', reservedAt: now, ...(approval.eventReceipt ? { nativeEvidenceRequired: true } : {}), ...(resolved.state === 'resolved' && resolved.fallbackReason ? { reasonCode: resolved.fallbackReason } : {}) });
+    if (resolved.state === 'resolved' && resolved.fallbackReason) {
+        const mapping = approval.policy?.content.mappings.find(item => item.target === input.envelope.runtime.target && item.runtimeKind === input.envelope.runtime.kind);
+        if (!mapping || input.envelope.role !== 'implementer' || input.envelope.requestedProfile === 'full')
+            throw new Error('routing fallback lacks approved optimized selection');
+        const sameObligationAlreadyCounted = attempts.some(item => item.obligationId === input.obligationId && item.state === 'blocked' && item.reasonCode === resolved.fallbackReason);
+        noteRoutingIncident(next, input.envelope.runtime.target, mapping.profiles[input.envelope.requestedProfile], resolved.fallbackReason, now, true, sameObligationAlreadyCounted);
+    }
     const lineage = next.implementationLineages.find(candidate => candidate.id === input.lineageId);
     if (lineage !== undefined)
         lineage.attempts = attempt;
@@ -70,25 +118,53 @@ function reserveRoutingAttempt(state, input, now) {
 }
 function observeRoutingAttempt(state, input, now) {
     assertTimestamp(now);
-    if (!(0, types_1.isWellFormedState)(state) || !input || typeof input.attemptId !== 'string' || input.attemptId.length === 0 || typeof input.nativeAgentId !== 'string' || input.nativeAgentId.length === 0 || input.nativeAgentId.length > 128 || (input.observed !== undefined && !(0, types_1.isRoutingSelection)(input.observed)) || (input.unavailableReason !== undefined && (typeof input.unavailableReason !== 'string' || input.unavailableReason.length === 0 || input.unavailableReason.length > 128)))
+    if (!(0, types_1.isWellFormedState)(state) || !input || typeof input.attemptId !== 'string' || input.attemptId.length === 0 || typeof input.nativeAgentId !== 'string' || input.nativeAgentId.length === 0 || input.nativeAgentId.length > 128 || (input.observed !== undefined && !(0, types_1.isRoutingSelection)(input.observed)) || (input.observedBackendModel !== undefined && (typeof input.observedBackendModel !== 'string' || input.observedBackendModel.length === 0 || input.observedBackendModel.length > 128 || input.nativeEventDigest === undefined)) || (input.unavailableReason !== undefined && (typeof input.unavailableReason !== 'string' || input.unavailableReason.length === 0 || input.unavailableReason.length > 128)))
         throw new Error('routing observation is invalid');
     const next = clone(state);
     const attempt = next.routingAttempts.find(item => item.id === input.attemptId);
     if (!attempt)
         throw new Error('routing attempt is unknown');
     if (attempt.state === 'active') {
-        if (attempt.nativeAgentId === input.nativeAgentId && canonical(attempt.observed) === canonical(input.observed))
+        if (attempt.nativeAgentId === input.nativeAgentId && canonical(attempt.observed) === canonical(input.observed) && attempt.observedBackendModel === input.observedBackendModel)
+            return next;
+        throw new Error('routing observation is immutable');
+    }
+    if (attempt.state === 'blocked') {
+        const mismatch = input.observed !== undefined && canonical(input.observed) !== canonical(attempt.envelope.resolved);
+        const reason = mismatch ? 'SELECTION_MISMATCH' : ['PROVIDER_REJECTED', 'PROVENANCE_MISSING'].includes(input.unavailableReason ?? '') ? input.unavailableReason : undefined;
+        if (attempt.nativeAgentId === input.nativeAgentId && canonical(attempt.observed) === canonical(input.observed) && reason === attempt.reasonCode)
             return next;
         throw new Error('routing observation is immutable');
     }
     if (attempt.state !== 'reserved')
         throw new Error('routing attempt cannot be observed');
-    attempt.state = 'active';
+    if (input.nativeEventDigest !== undefined) {
+        if (!/^[a-f0-9]{64}$/.test(input.nativeEventDigest) || next.routingAttempts.some(item => item.id !== attempt.id
+            && (item.nativeEventDigest === input.nativeEventDigest || (item.nativeEvidenceRequired && item.nativeAgentId === input.nativeAgentId))))
+            throw new Error('native routing event was already consumed');
+        attempt.nativeEventDigest = input.nativeEventDigest;
+    }
     attempt.nativeAgentId = input.nativeAgentId;
     if (input.observed)
         attempt.observed = structuredClone(input.observed);
-    if (input.unavailableReason)
-        attempt.reasonCode = input.unavailableReason;
+    if (input.observedBackendModel)
+        attempt.observedBackendModel = input.observedBackendModel;
+    const mismatch = input.observed !== undefined && canonical(input.observed) !== canonical(attempt.envelope.resolved);
+    const unavailable = input.unavailableReason === 'PROVIDER_REJECTED' || input.unavailableReason === 'PROVENANCE_MISSING';
+    if (mismatch || unavailable) {
+        const reason = mismatch ? 'SELECTION_MISMATCH' : input.unavailableReason;
+        attempt.state = 'blocked';
+        attempt.verdict = 'inconclusive';
+        attempt.reasonCode = reason;
+        // Agent-supplied negative evidence may conservatively trip a breaker,
+        // but never mints or renews native capability evidence.
+        noteRoutingIncident(next, attempt.envelope.runtime.target, attempt.envelope.resolved, reason, now, false);
+    }
+    else {
+        attempt.state = 'active';
+        if (input.unavailableReason)
+            attempt.reasonCode = input.unavailableReason;
+    }
     return next;
 }
 /** Computes, but never persists, the only permitted implementation retry.
@@ -105,12 +181,19 @@ function resolveLineageEscalation(state, lineageId, initial) {
         return { profile: initial, effort: lineage?.initialEffort ?? 'medium' };
     }
     const last = attempts[attempts.length - 1];
+    if (last.envelope.effectiveProfile === 'full')
+        throw new Error('routing full fallback is exhausted');
+    if (last.verdict === 'inconclusive' && ['PROVIDER_REJECTED', 'SELECTION_MISMATCH', 'PROVENANCE_MISSING'].includes(last.reasonCode ?? '')) {
+        const lineage = state.implementationLineages?.find(candidate => candidate.id === lineageId);
+        return { profile: initial, effort: lineage?.initialEffort ?? 'medium' };
+    }
     if (last.verdict !== 'fail')
         throw new Error('routing lineage advances only after a terminal failed verdict');
+    const routeEffort = last.envelope.resolved.effort.kind === 'runtime-default' ? 'runtime-default' : 'medium';
     if (last.envelope.effectiveProfile === 'mechanical')
-        return { profile: 'integration', effort: 'medium' };
+        return { profile: 'integration', effort: routeEffort };
     if (last.envelope.effectiveProfile === 'integration')
-        return { profile: 'judgment', effort: 'medium' };
+        return { profile: 'judgment', effort: routeEffort };
     if (last.envelope.effectiveProfile === 'judgment' && last.envelope.resolved.effort.kind === 'explicit' && last.envelope.resolved.effort.value === 'medium')
         return { profile: 'judgment', effort: 'high' };
     throw new Error('routing lineage escalation exhausted');
@@ -121,6 +204,7 @@ function routingReport(state) {
     const attempts = state.routingAttempts ?? [];
     const plannedByRole = {};
     const actualByRole = {};
+    const nativeReconciledByRole = {};
     const byState = {};
     const unavailable = {};
     const verdicts = {};
@@ -128,11 +212,22 @@ function routingReport(state) {
         plannedByRole[attempt.envelope.role] = (plannedByRole[attempt.envelope.role] ?? 0) + 1;
         if (attempt.nativeAgentId !== undefined)
             actualByRole[attempt.envelope.role] = (actualByRole[attempt.envelope.role] ?? 0) + 1;
+        if (attempt.nativeEventDigest !== undefined && ['active', 'complete'].includes(attempt.state))
+            nativeReconciledByRole[attempt.envelope.role] = (nativeReconciledByRole[attempt.envelope.role] ?? 0) + 1;
         byState[attempt.state] = (byState[attempt.state] ?? 0) + 1;
         for (const reason of attempt.envelope.unavailableEvidence)
             unavailable[reason] = (unavailable[reason] ?? 0) + 1;
+        if (attempt.envelope.role === 'implementer' && attempt.envelope.effectiveProfile === 'full' && attempt.reasonCode)
+            unavailable[attempt.reasonCode] = (unavailable[attempt.reasonCode] ?? 0) + 1;
         if (attempt.verdict !== undefined)
             verdicts[attempt.verdict] = (verdicts[attempt.verdict] ?? 0) + 1;
     }
-    return { schema: 'routing-report/v1', attempts: attempts.length, plannedByRole, actualByRole, byState, retries: attempts.filter((attempt) => attempt.attempt > 1).length, fallbacks: attempts.filter((attempt) => attempt.envelope.outcome === 'degraded').length, unavailable, verdicts, administrativeRepairs: attempts.filter((attempt) => attempt.administrativeRepair === true).length };
+    const incidents = (state.routingIncidents ?? []).map(({ reasonCode, selection, affectedObligations, fallbackCount, blockedCount, alertState }) => ({ reasonCode, selection, affectedObligations, fallbackCount, blockedCount, alertState }));
+    const reconciled = Object.values(nativeReconciledByRole).reduce((total, count) => total + count, 0);
+    const selections = attempts.map(attempt => ({ role: attempt.envelope.role, configured: attempt.envelope.resolved,
+        accepted: attempt.nativeEventDigest && ['active', 'complete'].includes(attempt.state) ? attempt.observed ?? 'unknown' : 'unknown',
+        backendModel: attempt.nativeEventDigest && ['active', 'complete'].includes(attempt.state) ? attempt.observedBackendModel ?? 'unknown' : 'unknown' }));
+    return { schema: 'routing-report/v1', attempts: attempts.length, plannedByRole, actualByRole, selections,
+        ...(reconciled ? { nativeReconciledByRole } : {}), byState, retries: attempts.filter((attempt) => attempt.attempt > 1).length, fallbacks: attempts.filter((attempt) => attempt.envelope.role === 'implementer' && attempt.envelope.effectiveProfile === 'full' && attempt.envelope.requestedProfile !== 'full').length, unavailable, verdicts, administrativeRepairs: attempts.filter((attempt) => attempt.administrativeRepair === true).length,
+        measurement: { configuredSelection: 'envelope-recorded', acceptedSelection: reconciled === 0 ? 'not-natively-reconciled' : reconciled === attempts.length ? 'natively-reconciled' : 'partially-reconciled', backendModel: selections.some(item => item.backendModel !== 'unknown') ? 'provider-reported' : 'unknown', tokenUsage: 'unknown', savings: 'unverified' }, ...(incidents.length ? { incidents } : {}) };
 }

package/dist/src/core/model-policy/local-claude-scope.js

@@ -0,0 +1,41 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queryLocalClaudeScope = queryLocalClaudeScope;
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const paths_1 = require("../paths");
+const machine_key_1 = require("./machine-key");
+const native_claude_machine_1 = require("./native-claude-machine");
+const native_claude_config_1 = require("./native-claude-config");
+const native_runtime_1 = require("./native-runtime");
+const hook_diagnostics_1 = require("./hook-diagnostics");
+/** Read-only local facts; no model inference or machine-key creation. */
+async function queryLocalClaudeScope(cwd, runtimeKind, deps = {}) {
+    if (typeof cwd !== 'string' || !path_1.default.isAbsolute(cwd) || cwd.includes('\0') || typeof runtimeKind !== 'string'
+        || !/^[a-z0-9][a-z0-9_-]{0,127}$/.test(runtimeKind))
+        throw new Error('local Claude scope input is invalid');
+    const hooks = (deps.readRoutingHookStatus ?? hook_diagnostics_1.readRoutingHookStatus)();
+    if (deps.requireHookHealthy !== false && (hooks.state === 'failed' || hooks.state === 'invalid'))
+        return { state: 'unverified', reason: 'HOOK_CAPTURE_FAILED' };
+    const key = (deps.readMachineKey ?? machine_key_1.readMachineKey)((0, paths_1.awmHome)());
+    if (!key)
+        return { state: 'unverified', reason: 'MACHINE_KEY_MISSING' };
+    try {
+        const [auth, runtime] = await Promise.all([
+            (deps.queryClaudeAuthStatus ?? native_claude_machine_1.queryClaudeAuthStatus)({ command: 'claude', args: ['auth', 'status'], timeoutMs: 10000, key }),
+            (deps.queryRuntimeExecutable ?? native_runtime_1.queryRuntimeExecutable)({ command: 'claude', args: ['--version'], timeoutMs: 10000 }),
+        ]);
+        if (auth.accountState !== 'identified' || !auth.accountScopeDigest)
+            return { state: 'unverified', reason: 'ACCOUNT_UNVERIFIED' };
+        const configDigest = (deps.readClaudeModelConfigDigest ?? native_claude_config_1.readClaudeModelConfigDigest)({ cwd, configDir: path_1.default.resolve(process.env.CLAUDE_CONFIG_DIR ?? path_1.default.join(os_1.default.homedir(), '.claude')),
+            key, environment: process.env });
+        return { state: 'current', scope: { runtime: { target: 'claude-code', kind: runtimeKind, version: runtime.version,
+                    accountScopeDigest: auth.accountScopeDigest }, binaryDigest: runtime.binaryDigest, configDigest } };
+    }
+    catch {
+        return { state: 'unverified', reason: 'NATIVE_QUERY_FAILED' };
+    }
+}

package/dist/src/core/model-policy/local-codex-scope.js

@@ -0,0 +1,33 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queryLocalCodexScope = queryLocalCodexScope;
+const path_1 = __importDefault(require("path"));
+const paths_1 = require("../paths");
+const machine_key_1 = require("./machine-key");
+const native_codex_machine_1 = require("./native-codex-machine");
+const native_runtime_1 = require("./native-runtime");
+/** Read-only, no-token local facts for the same cwd as the routed work. */
+async function queryLocalCodexScope(cwd, runtimeKind, deps = {}) {
+    if (typeof cwd !== 'string' || !path_1.default.isAbsolute(cwd) || cwd.includes('\0') || typeof runtimeKind !== 'string'
+        || !/^[a-z0-9][a-z0-9_-]{0,127}$/.test(runtimeKind))
+        throw new Error('local Codex scope input is invalid');
+    const key = (deps.readMachineKey ?? machine_key_1.readMachineKey)((0, paths_1.awmHome)());
+    if (!key)
+        return { state: 'unverified', reason: 'MACHINE_KEY_MISSING' };
+    try {
+        const [machine, executable] = await Promise.all([
+            (deps.queryCodexMachineFacts ?? native_codex_machine_1.queryCodexMachineFacts)({ command: 'codex', args: ['app-server', '--stdio'], timeoutMs: 10000, cwd, key }),
+            (deps.queryRuntimeExecutable ?? native_runtime_1.queryRuntimeExecutable)({ command: 'codex', args: ['--version'], timeoutMs: 10000 }),
+        ]);
+        if (machine.accountState !== 'identified' || !machine.accountScopeDigest)
+            return { state: 'unverified', reason: 'ACCOUNT_UNVERIFIED' };
+        return { state: 'current', scope: { runtime: { target: 'codex', kind: runtimeKind, version: executable.version,
+                    accountScopeDigest: machine.accountScopeDigest }, binaryDigest: executable.binaryDigest, configDigest: machine.configDigest } };
+    }
+    catch {
+        return { state: 'unverified', reason: 'NATIVE_QUERY_FAILED' };
+    }
+}

package/dist/src/core/model-policy/local-event-scope.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queryLocalEventScope = queryLocalEventScope;
+const local_claude_scope_1 = require("./local-claude-scope");
+const local_codex_scope_1 = require("./local-codex-scope");
+/** Provider-specific, read-only scope discovery for dispatch-time drift checks. */
+async function queryLocalEventScope(cwd, target, runtimeKind) {
+    if (target === 'codex')
+        return (0, local_codex_scope_1.queryLocalCodexScope)(cwd, runtimeKind);
+    if (target === 'claude-code')
+        return (0, local_claude_scope_1.queryLocalClaudeScope)(cwd, runtimeKind);
+    return { state: 'unverified', reason: 'PROVIDER_UNSUPPORTED' };
+}

package/dist/src/core/model-policy/machine-key.js

@@ -0,0 +1,56 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readMachineKey = readMachineKey;
+exports.ensureMachineKey = ensureMachineKey;
+const crypto_1 = require("crypto");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const native_bridge_1 = require("../secure-fs/native-bridge");
+const KEY_NAME = 'routing-machine.key';
+function keyPath(root) {
+    if (typeof root !== 'string' || !path_1.default.isAbsolute(root) || path_1.default.normalize(root) !== root || root.includes('\0'))
+        throw new Error('routing machine root must be an absolute normalized path');
+    for (let dir = root;; dir = path_1.default.dirname(dir)) {
+        const stat = fs_1.default.lstatSync(dir);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            throw new Error('routing machine root has unsafe or symlinked ancestor');
+        if (dir === path_1.default.dirname(dir))
+            break;
+    }
+    return path_1.default.join(root, KEY_NAME);
+}
+/** Read-only status path; never initializes machine state during diagnostics. */
+function readMachineKey(root) {
+    const file = keyPath(root);
+    try {
+        const stat = fs_1.default.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            throw new Error('routing machine key is unsafe or symlinked');
+        if (process.platform !== 'win32' && (stat.mode & 0o077) !== 0)
+            throw new Error('routing machine key permissions are unsafe');
+        const bytes = native_bridge_1.secureFs.readRegularFile(file, 32).bytes;
+        if (bytes.length !== 32)
+            throw new Error('routing machine key length is invalid');
+        return Buffer.from(bytes);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+/** Only explicit setup may call this producer. No secret bytes are reported. */
+function ensureMachineKey(root) {
+    keyPath(root);
+    return native_bridge_1.secureFs.withProjectLease(root, () => {
+        const existing = readMachineKey(root);
+        if (existing)
+            return existing;
+        const bytes = (0, crypto_1.randomBytes)(32);
+        native_bridge_1.secureFs.writeProjectTransaction(root, KEY_NAME, bytes, { mode: 'create', createParents: false });
+        return bytes;
+    });
+}

package/dist/src/core/model-policy/native-claude-agent-definition.js

@@ -0,0 +1,82 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isNativeClaudeAgentDeclaration = isNativeClaudeAgentDeclaration;
+exports.readClaudeAgentDeclaredModel = readClaudeAgentDeclaredModel;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const js_yaml_1 = __importDefault(require("js-yaml"));
+const native_bridge_1 = require("../secure-fs/native-bridge");
+const observedDeclarations = new WeakMap();
+function isNativeClaudeAgentDeclaration(value) {
+    return !!value && typeof value === 'object' && observedDeclarations.get(value) === JSON.stringify(value);
+}
+function safeDirectory(dir) {
+    for (let current = dir;; current = path_1.default.dirname(current)) {
+        const stat = fs_1.default.lstatSync(current);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            throw new Error('Claude agent definition has an unsafe ancestor');
+        if (current === path_1.default.dirname(current))
+            break;
+    }
+}
+/** An explicit custom-agent model is necessary, but the effective model must
+ * still be independently observed in the native child transcript. Built-in
+ * agents, aliases and an inherited/default model cannot enroll a selection. */
+function readClaudeAgentDeclaredModel(input) {
+    if (!input || typeof input !== 'object' || !path_1.default.isAbsolute(input.cwd) || !path_1.default.isAbsolute(input.configDir)
+        || path_1.default.normalize(input.cwd) !== input.cwd || path_1.default.normalize(input.configDir) !== input.configDir
+        || input.cwd.includes('\0') || input.configDir.includes('\0')
+        || typeof input.agentType !== 'string' || !/^awm-[A-Za-z0-9][A-Za-z0-9_-]{0,123}$/.test(input.agentType))
+        throw new Error('Claude agent definition identity is invalid');
+    const dirs = [path_1.default.join(input.configDir, 'agents'), path_1.default.join(input.cwd, '.claude', 'agents')];
+    const declared = [];
+    for (const dir of dirs) {
+        try {
+            safeDirectory(dir);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                continue;
+            throw error;
+        }
+        const names = fs_1.default.readdirSync(dir).filter(name => name.endsWith('.md'));
+        if (names.length > 256)
+            throw new Error('Claude agent definitions exceed limit');
+        for (const name of names) {
+            const file = path_1.default.join(dir, name);
+            const stat = fs_1.default.lstatSync(file);
+            if (!stat.isFile() || stat.isSymbolicLink())
+                throw new Error('Claude agent definition is unsafe');
+            const bytes = native_bridge_1.secureFs.readRegularFile(file, 1024 * 1024).bytes;
+            const content = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+            const match = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(content);
+            if (!match)
+                continue;
+            let frontmatter;
+            try {
+                frontmatter = js_yaml_1.default.load(match[1]);
+            }
+            catch {
+                throw new Error('Claude agent frontmatter is invalid');
+            }
+            if (!frontmatter || typeof frontmatter !== 'object' || Array.isArray(frontmatter))
+                continue;
+            const row = frontmatter;
+            if (row.name !== input.agentType)
+                continue;
+            if (typeof row.description !== 'string' || !row.description.trim())
+                throw new Error('Claude agent description is missing');
+            if (typeof row.model !== 'string' || !/^claude-[a-z0-9][a-z0-9.-]{1,126}$/.test(row.model))
+                throw new Error('Claude agent requires an explicit full model ID; aliases and inherit are unverified');
+            declared.push(row.model);
+        }
+    }
+    if (declared.length !== 1)
+        throw new Error(declared.length ? 'Claude agent definition is ambiguous' : 'Claude agent has no explicit custom definition');
+    const result = { agentType: input.agentType, modelId: declared[0] };
+    observedDeclarations.set(result, JSON.stringify(result));
+    return result;
+}

package/dist/src/core/model-policy/native-claude-config.js

@@ -0,0 +1,107 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readClaudeModelConfigDigest = readClaudeModelConfigDigest;
+const crypto_1 = require("crypto");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const native_bridge_1 = require("../secure-fs/native-bridge");
+const json_1 = require("../plan/json");
+const MODEL_KEYS = ['model', 'effortLevel', 'availableModels', 'enforceAvailableModels', 'modelOverrides'];
+const ENV_KEYS = ['ANTHROPIC_MODEL', 'ANTHROPIC_DEFAULT_OPUS_MODEL', 'ANTHROPIC_DEFAULT_SONNET_MODEL', 'ANTHROPIC_DEFAULT_HAIKU_MODEL', 'CLAUDE_CODE_SUBAGENT_MODEL', 'CLAUDE_CODE_SUBAGENT_MODEL_FORCE'];
+function safeDirectory(dir) {
+    for (let current = dir;; current = path_1.default.dirname(current)) {
+        const stat = fs_1.default.lstatSync(current);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            throw new Error('Claude settings have an unsafe or symlinked ancestor');
+        if (current === path_1.default.dirname(current))
+            break;
+    }
+}
+function settings(file) {
+    let stat;
+    try {
+        stat = fs_1.default.lstatSync(file);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+    safeDirectory(path_1.default.dirname(file));
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error('Claude settings file is unsafe or symlinked');
+    const bytes = native_bridge_1.secureFs.readRegularFile(file, 1024 * 1024).bytes;
+    const value = (0, json_1.parseJsonNoDuplicate)(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Claude settings must be an object');
+    return value;
+}
+function agentDefinitions(dir) {
+    let stat;
+    try {
+        stat = fs_1.default.lstatSync(dir);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+    safeDirectory(path_1.default.dirname(dir));
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new Error('Claude agents directory is unsafe or symlinked');
+    const names = fs_1.default.readdirSync(dir).filter(name => name.endsWith('.md')).sort();
+    if (names.length > 256)
+        throw new Error('Claude agent definitions exceed limit');
+    return names.map(name => {
+        const file = path_1.default.join(dir, name);
+        const entry = fs_1.default.lstatSync(file);
+        if (!entry.isFile() || entry.isSymbolicLink())
+            throw new Error('Claude agent definition is unsafe or symlinked');
+        const bytes = native_bridge_1.secureFs.readRegularFile(file, 1024 * 1024).bytes;
+        return [name, (0, crypto_1.createHash)('sha256').update(bytes).digest('hex')];
+    });
+}
+/** Fingerprints only locally visible model controls. Managed/server-side policy
+ * is not represented here; a native child observation remains mandatory. */
+function readClaudeModelConfigDigest(input) {
+    if (!input || typeof input !== 'object' || !path_1.default.isAbsolute(input.cwd) || !path_1.default.isAbsolute(input.configDir)
+        || path_1.default.normalize(input.cwd) !== input.cwd || path_1.default.normalize(input.configDir) !== input.configDir
+        || input.cwd.includes('\0') || input.configDir.includes('\0') || !Buffer.isBuffer(input.key) || input.key.length !== 32
+        || !input.environment || typeof input.environment !== 'object' || Array.isArray(input.environment))
+        throw new Error('Claude model config input is invalid');
+    safeDirectory(input.cwd);
+    safeDirectory(input.configDir);
+    const files = [path_1.default.join(input.configDir, 'settings.json'), path_1.default.join(input.cwd, '.claude', 'settings.json'), path_1.default.join(input.cwd, '.claude', 'settings.local.json')];
+    const projection = files.map(file => {
+        const value = settings(file);
+        if (!value)
+            return null;
+        const model = {};
+        for (const key of MODEL_KEYS)
+            if (Object.prototype.hasOwnProperty.call(value, key))
+                model[key] = value[key];
+        if (value.env && typeof value.env === 'object' && !Array.isArray(value.env)) {
+            const env = {};
+            for (const key of ENV_KEYS)
+                if (Object.prototype.hasOwnProperty.call(value.env, key))
+                    env[key] = value.env[key];
+            if (Object.keys(env).length)
+                model.env = env;
+        }
+        return model;
+    });
+    const environment = {};
+    for (const key of ENV_KEYS) {
+        const value = input.environment[key];
+        if (value !== undefined) {
+            if (typeof value !== 'string' || value.length > 4096)
+                throw new Error('Claude model environment is invalid');
+            environment[key] = value;
+        }
+    }
+    const agents = [agentDefinitions(path_1.default.join(input.configDir, 'agents')), agentDefinitions(path_1.default.join(input.cwd, '.claude', 'agents'))];
+    return (0, crypto_1.createHmac)('sha256', input.key).update(JSON.stringify({ projection, agents, environment })).digest('hex');
+}

package/dist/src/core/model-policy/native-claude-machine.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queryClaudeAuthStatus = queryClaudeAuthStatus;
+const crypto_1 = require("crypto");
+const child_process_1 = require("child_process");
+/** `claude auth status` is documented as a JSON, no-inference command. The
+ * account shape varies by auth method; incomplete identity stays unverified. */
+function queryClaudeAuthStatus(input) {
+    if (!input || typeof input !== 'object' || typeof input.command !== 'string' || input.command.length === 0 || input.command.length > 4096
+        || !Array.isArray(input.args) || input.args.length > 16 || input.args.some(value => typeof value !== 'string' || value.length > 65536)
+        || !Number.isInteger(input.timeoutMs) || input.timeoutMs < 1 || input.timeoutMs > 30000
+        || !Buffer.isBuffer(input.key) || input.key.length !== 32)
+        throw new Error('Claude auth query is invalid');
+    return new Promise((resolve, reject) => {
+        const child = (0, child_process_1.spawn)(input.command, input.args, { stdio: ['ignore', 'pipe', 'pipe'], shell: false });
+        let settled = false;
+        let buffer = '';
+        const finish = (error, facts) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (error) {
+                child.kill();
+                reject(error);
+            }
+            else
+                resolve(facts);
+        };
+        const timer = setTimeout(() => finish(new Error('Claude auth status timed out')), input.timeoutMs);
+        child.on('error', () => finish(new Error('Claude CLI could not be started')));
+        child.stdout.setEncoding('utf8');
+        child.stdout.on('data', (chunk) => { buffer += chunk; if (buffer.length > 64 * 1024)
+            finish(new Error('Claude auth status exceeds 64 KiB')); });
+        child.on('exit', code => {
+            if (code !== 0)
+                return finish(new Error('Claude auth status failed or is logged out'));
+            try {
+                const parsed = JSON.parse(buffer);
+                if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+                    throw new Error('shape');
+                const value = parsed;
+                if (value.loggedIn !== true)
+                    throw new Error('login');
+                const fields = ['authMethod', 'apiProvider', 'email', 'orgId'];
+                const identified = fields.every(field => typeof value[field] === 'string' && value[field].length > 0 && value[field].length <= 320);
+                const subscriptionType = value.subscriptionType;
+                if (subscriptionType !== null && subscriptionType !== undefined && (typeof subscriptionType !== 'string' || subscriptionType.length > 128))
+                    throw new Error('subscription');
+                const accountScopeDigest = identified ? (0, crypto_1.createHmac)('sha256', input.key).update(JSON.stringify(fields.map(field => value[field]).concat([subscriptionType ?? null]))).digest('hex') : null;
+                finish(undefined, { provenance: 'claude-auth-status', accountState: accountScopeDigest ? 'identified' : 'unverified', accountScopeDigest, inferenceDispatched: false });
+            }
+            catch {
+                finish(new Error('Claude auth status response is invalid'));
+            }
+        });
+    });
+}