agentic-workflow-manager 9.11.12 → 9.12.1

package/dist/tests/core/model-policy/native-codex.test.js

@@ -0,0 +1,133 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const native_codex_1 = require("../../../src/core/model-policy/native-codex");
+describe('Codex native model discovery', () => {
+    const response = () => ({
+        data: [
+            { id: 'gpt-6-sol', model: 'gpt-6-sol', hidden: false, isDefault: true,
+                defaultReasoningEffort: 'medium', supportedReasoningEfforts: [
+                    { reasoningEffort: 'medium', description: 'balanced' },
+                    { reasoningEffort: 'high', description: 'deep' },
+                ] },
+        ], nextCursor: null,
+    });
+    it('normalizes catalog selections without certifying dispatch or actual model identity', () => {
+        expect((0, native_codex_1.normalizeCodexModelCatalog)(response())).toEqual({
+            provenance: 'native-catalog',
+            selections: [
+                { selector: { kind: 'model', id: 'gpt-6-sol' }, effort: { kind: 'explicit', value: 'medium' } },
+                { selector: { kind: 'model', id: 'gpt-6-sol' }, effort: { kind: 'explicit', value: 'high' } },
+            ],
+            nativeDispatchVerified: false,
+            actualModelVerified: false,
+        });
+    });
+    it('rejects malformed and duplicate native catalog data instead of inventing selections', () => {
+        expect(() => (0, native_codex_1.normalizeCodexModelCatalog)({ data: [{ ...response().data[0], model: '' }] })).toThrow(/model/i);
+        expect(() => (0, native_codex_1.normalizeCodexModelCatalog)({ data: [response().data[0], response().data[0]] })).toThrow(/duplicate/i);
+        expect(() => (0, native_codex_1.normalizeCodexModelCatalog)({ data: [
+                { ...response().data[0], supportedReasoningEfforts: [{ reasoningEffort: 'medium' }] },
+            ] })).toThrow(/effort/i);
+    });
+    it('reads the native model/list protocol without starting a model turn', async () => {
+        const server = `
+const readline = require('readline');
+const input = readline.createInterface({ input: process.stdin });
+input.on('line', line => {
+  const request = JSON.parse(line);
+  if (request.method === 'initialize') process.stdout.write(JSON.stringify({ id: request.id, result: { userAgent: 'fake' } }) + '\\n');
+  if (request.method === 'model/list') process.stdout.write(JSON.stringify({ id: request.id, result: ${JSON.stringify(response())} }) + '\\n');
+});`;
+        const result = await (0, native_codex_1.queryCodexModelCatalog)({ command: process.execPath, args: ['-e', server], timeoutMs: 5000 });
+        expect(result.selections).toHaveLength(2);
+        expect(result.nativeDispatchVerified).toBe(false);
+    });
+    it('fails closed on an invalid native response', async () => {
+        const server = `process.stdin.on('data', () => process.stdout.write('not-json\\n'));`;
+        await expect((0, native_codex_1.queryCodexModelCatalog)({ command: process.execPath, args: ['-e', server], timeoutMs: 5000 })).rejects.toThrow(/protocol|JSON/i);
+    });
+    it('separates real child dispatch from configured selection and backend identity', () => {
+        const child = { thread: { id: 'child-1', parentThreadId: 'parent-1', model: 'gpt-6-sol', reasoningEffort: 'low', turns: [{ id: 'turn-1', status: 'completed', items: [] }] } };
+        expect((0, native_codex_1.normalizeCodexChildThreadObservation)(child, 'parent-1')).toEqual({
+            provenance: 'codex-app-server-thread-read', parentThreadId: 'parent-1', childThreadId: 'child-1', turnId: 'turn-1',
+            nativeDispatchVerified: true, configuredSelection: { selector: { kind: 'model', id: 'gpt-6-sol' }, effort: { kind: 'explicit', value: 'low' } },
+            acceptedSelectionVerified: false, actualModelVerified: false, tokenUsage: 'unknown',
+        });
+    });
+    it('rejects a parent mismatch and refuses to promote a child with no turn', () => {
+        const child = { thread: { id: 'child-1', parentThreadId: 'parent-1', model: 'gpt-6-sol', reasoningEffort: 'low', turns: [{ id: 'turn-1', status: 'completed', items: [] }] } };
+        expect(() => (0, native_codex_1.normalizeCodexChildThreadObservation)(child, 'parent-2')).toThrow(/parent/i);
+        expect(() => (0, native_codex_1.normalizeCodexChildThreadObservation)({ thread: { ...child.thread, turns: [] } }, 'parent-1')).toThrow(/turn/i);
+        expect(() => (0, native_codex_1.normalizeCodexChildThreadObservation)({ thread: { ...child.thread, model: null } }, 'parent-1')).toThrow(/model/i);
+    });
+    it('reads an actual child thread through native thread/read without sending a turn', async () => {
+        const observed = { thread: { id: 'child-1', parentThreadId: 'parent-1', model: 'gpt-6-sol', reasoningEffort: 'low', turns: [{ id: 'turn-1', status: 'completed', items: [] }] } };
+        const server = `
+const readline = require('readline');
+const input = readline.createInterface({ input: process.stdin });
+input.on('line', line => {
+  const request = JSON.parse(line);
+  if (request.method === 'initialize') process.stdout.write(JSON.stringify({ id: request.id, result: { userAgent: 'fake' } }) + '\\n');
+  if (request.method === 'thread/read') {
+    if (request.params.threadId !== 'child-1' || request.params.includeTurns !== true) process.exit(13);
+    process.stdout.write(JSON.stringify({ id: request.id, result: ${JSON.stringify(observed)} }) + '\\n');
+  }
+  if (request.method === 'turn/start' || request.method === 'thread/start') process.exit(14);
+});`;
+        const result = await (0, native_codex_1.queryCodexChildThreadObservation)({ command: process.execPath, args: ['-e', server], timeoutMs: 5000, parentThreadId: 'parent-1', childThreadId: 'child-1' });
+        expect(result).toMatchObject({ nativeDispatchVerified: true, acceptedSelectionVerified: false, actualModelVerified: false, configuredSelection: { selector: { id: 'gpt-6-sol' } } });
+    });
+    it('binds an immutable turn context to the observed child, parent and turn', () => {
+        const events = [
+            { type: 'session_meta', payload: { id: 'child-1', source: { subagent: { thread_spawn: { parent_thread_id: 'parent-1' } } }, cli_version: '0.156.1' } },
+            { timestamp: '2026-09-23T20:00:00.000Z', type: 'turn_context', payload: { turn_id: 'turn-1', model: 'gpt-6-luna', effort: 'high' } },
+        ];
+        expect((0, native_codex_1.normalizeCodexRolloutSelection)(events, { parentThreadId: 'parent-1', childThreadId: 'child-1', turnId: 'turn-1' })).toEqual({
+            provenance: 'codex-rollout-turn-context', cliVersion: '0.156.1', observedAt: '2026-09-23T20:00:00.000Z',
+            configuredSelection: { selector: { kind: 'model', id: 'gpt-6-luna' }, effort: { kind: 'explicit', value: 'high' } },
+            actualModelVerified: false,
+        });
+    });
+    it('rejects unrelated parent, child and turn contexts', () => {
+        const events = [
+            { type: 'session_meta', payload: { id: 'child-1', source: { subagent: { thread_spawn: { parent_thread_id: 'parent-1' } } }, cli_version: '0.156.1' } },
+            { timestamp: '2026-09-23T20:00:00.000Z', type: 'turn_context', payload: { turn_id: 'turn-1', model: 'gpt-6-luna', effort: 'high' } },
+        ];
+        expect(() => (0, native_codex_1.normalizeCodexRolloutSelection)(events, { parentThreadId: 'other', childThreadId: 'child-1', turnId: 'turn-1' })).toThrow(/parent/i);
+        expect(() => (0, native_codex_1.normalizeCodexRolloutSelection)(events, { parentThreadId: 'parent-1', childThreadId: 'other', turnId: 'turn-1' })).toThrow(/child/i);
+        expect(() => (0, native_codex_1.normalizeCodexRolloutSelection)(events, { parentThreadId: 'parent-1', childThreadId: 'child-1', turnId: 'other' })).toThrow(/turn/i);
+        expect(() => (0, native_codex_1.normalizeCodexRolloutSelection)([...events, events[1]], { parentThreadId: 'parent-1', childThreadId: 'child-1', turnId: 'turn-1' })).toThrow(/duplicate/i);
+        expect(() => (0, native_codex_1.normalizeCodexRolloutSelection)([{ ...events[0] }, { ...events[1], timestamp: undefined }], { parentThreadId: 'parent-1', childThreadId: 'child-1', turnId: 'turn-1' })).toThrow(/timestamp/i);
+    });
+    it('attests the configured selection at the completed native turn only with matching rollout provenance', async () => {
+        const home = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-codex-observe-'));
+        const file = path_1.default.join(home, 'sessions', 'rollout.jsonl');
+        fs_1.default.mkdirSync(path_1.default.dirname(file));
+        fs_1.default.writeFileSync(file, [
+            { type: 'session_meta', payload: { id: 'child-1', source: { subagent: { thread_spawn: { parent_thread_id: 'parent-1' } } }, cli_version: '0.156.1' } },
+            { timestamp: '2026-09-23T20:00:00.000Z', type: 'turn_context', payload: { turn_id: 'turn-1', model: 'gpt-6-luna', effort: 'high' } },
+        ].map(value => JSON.stringify(value)).join('\n'));
+        const observed = { thread: { id: 'child-1', parentThreadId: 'parent-1', model: 'gpt-6-luna', reasoningEffort: 'high', path: file, turns: [{ id: 'turn-1', status: 'completed', items: [] }] } };
+        const server = `
+const readline = require('readline');
+const input = readline.createInterface({ input: process.stdin });
+input.on('line', line => {
+  const request = JSON.parse(line);
+  if (request.method === 'initialize') process.stdout.write(JSON.stringify({ id: request.id, result: {} }) + '\\n');
+  if (request.method === 'thread/read') process.stdout.write(JSON.stringify({ id: request.id, result: ${JSON.stringify(observed)} }) + '\\n');
+});`;
+        try {
+            const result = await (0, native_codex_1.queryCodexChildThreadObservation)({ command: process.execPath, args: ['-e', server], timeoutMs: 5000, parentThreadId: 'parent-1', childThreadId: 'child-1', codexHome: home });
+            expect(result).toMatchObject({ acceptedSelectionVerified: true, childRuntimeVersion: '0.156.1', configuredSelection: { selector: { id: 'gpt-6-luna' }, effort: { value: 'high' } }, actualModelVerified: false });
+        }
+        finally {
+            fs_1.default.rmSync(home, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/core/model-policy/native-routing-observe.test.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const native_routing_observe_1 = require("../../../src/core/model-policy/native-routing-observe");
+const local_event_scope_1 = require("../../../src/core/model-policy/local-event-scope");
+const machine_key_1 = require("../../../src/core/model-policy/machine-key");
+const native_codex_1 = require("../../../src/core/model-policy/native-codex");
+const event_store_1 = require("../../../src/core/model-policy/event-store");
+const store_1 = require("../../../src/core/model-policy/store");
+const selection_policy_digest_1 = require("../../../src/core/model-policy/selection-policy-digest");
+const routing_approval_1 = require("../../helpers/routing-approval");
+const native_routing_proof_1 = require("../../../src/core/model-policy/native-routing-proof");
+jest.mock('../../../src/core/model-policy/local-event-scope');
+jest.mock('../../../src/core/model-policy/machine-key');
+jest.mock('../../../src/core/model-policy/native-codex');
+jest.mock('../../../src/core/model-policy/event-store');
+jest.mock('../../../src/core/model-policy/store');
+const key = Buffer.alloc(32, 9);
+const now = new Date('2026-09-23T12:00:03.000Z');
+const reservedAt = '2026-09-23T12:00:00.000Z';
+const observedAt = '2026-09-23T12:00:02.000Z';
+const scope = { runtime: routing_approval_1.routingEnvelope.runtime, binaryDigest: 'b'.repeat(64), configDigest: 'c'.repeat(64) };
+function attempt() {
+    return { schema: 'routing-attempt/v1', id: 'route-1', obligationId: 'o1', lineageId: 'l1', attempt: 1,
+        envelope: routing_approval_1.routingEnvelope, envelopeDigest: 'e'.repeat(64), fingerprint: 'f'.repeat(64), state: 'reserved',
+        nativeEvidenceRequired: true, reservedAt };
+}
+beforeEach(() => {
+    jest.clearAllMocks();
+    const approved = (0, routing_approval_1.routingApproval)();
+    jest.mocked(store_1.readEffectivePolicy).mockReturnValue({ state: 'approved', provenance: 'project', policy: approved.policy });
+    jest.mocked(machine_key_1.readMachineKey).mockReturnValue(key);
+    jest.mocked(local_event_scope_1.queryLocalEventScope).mockResolvedValue({ state: 'current', scope });
+    const receipt = { schema: 'routing-capabilities/v2', ...scope, recordedAt: observedAt,
+        claims: [{ selection: routing_approval_1.routingEnvelope.resolved,
+                mappingDigest: (0, selection_policy_digest_1.selectionPolicyDigest)(approved.policy.content.mappings[0], routing_approval_1.routingEnvelope.resolved),
+                eventDigest: 'a'.repeat(64), source: 'codex-turn-context', observedAt,
+                actualModel: 'unverified', tokenUsage: 'unknown' }] };
+    jest.mocked(event_store_1.readStoredEventReceipt).mockReturnValue({ state: 'present', receipt });
+    jest.mocked(native_codex_1.queryCodexChildThreadObservation).mockResolvedValue({ provenance: 'codex-app-server-thread-read',
+        parentThreadId: 'parent-1', childThreadId: 'child-1', turnId: 'turn-1', nativeDispatchVerified: true,
+        configuredSelection: routing_approval_1.routingEnvelope.resolved, acceptedSelectionVerified: true,
+        childRuntimeVersion: routing_approval_1.routingEnvelope.runtime.version, observedAt,
+        actualModelVerified: false, tokenUsage: 'unknown' });
+});
+describe('normal-work native routing observation', () => {
+    it('reconciles a completed Codex child and renews only its matching claim', async () => {
+        const proof = await (0, native_routing_observe_1.observeNativeRoutingChild)({ attempt: attempt(), nativeAgentId: 'child-1', parentThreadId: 'parent-1',
+            cwd: '/tmp/awm-native-observe-test', now, consumedEventDigests: [] });
+        expect((0, native_routing_proof_1.verifyNativeRoutingProof)(proof, { attemptId: 'route-1', nativeAgentId: 'child-1',
+            reservedAt, selection: routing_approval_1.routingEnvelope.resolved }, key, now)).toBe(true);
+        expect(event_store_1.publishCodexObservation).toHaveBeenCalledWith(expect.objectContaining({ expectedSelection: routing_approval_1.routingEnvelope.resolved }));
+    });
+    it('rejects a setup turn preceding reservation without renewing its claim', async () => {
+        jest.mocked(native_codex_1.queryCodexChildThreadObservation).mockResolvedValueOnce({ ...await (0, native_codex_1.queryCodexChildThreadObservation)({ command: 'codex', args: [], timeoutMs: 1, parentThreadId: 'parent-1', childThreadId: 'child-1' }),
+            observedAt: '2026-09-23T11:59:59.000Z' });
+        await expect((0, native_routing_observe_1.observeNativeRoutingChild)({ attempt: attempt(), nativeAgentId: 'child-1', parentThreadId: 'parent-1',
+            cwd: '/tmp/awm-native-observe-test', now, consumedEventDigests: [] })).rejects.toThrow(/predates reservation/);
+        expect(event_store_1.publishCodexObservation).not.toHaveBeenCalled();
+    });
+});

package/dist/tests/core/model-policy/native-routing-proof.test.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const native_routing_proof_1 = require("../../../src/core/model-policy/native-routing-proof");
+const routing_approval_1 = require("../../helpers/routing-approval");
+const key = Buffer.alloc(32, 7);
+const input = { attemptId: 'route-1', nativeAgentId: 'child-1', source: 'codex-turn-context',
+    eventDigest: 'a'.repeat(64), observedAt: '2026-09-23T12:00:02.000Z', selection: (0, routing_approval_1.routingSelection)('medium') };
+describe('native routing proof', () => {
+    it('binds a native event to one reserved attempt and child', () => {
+        const proof = (0, native_routing_proof_1.signNativeRoutingProof)(input, key);
+        expect((0, native_routing_proof_1.verifyNativeRoutingProof)(proof, { attemptId: 'route-1', nativeAgentId: 'child-1',
+            reservedAt: '2026-09-23T12:00:00.000Z', selection: input.selection }, key, new Date('2026-09-23T12:00:03.000Z'))).toBe(true);
+        expect((0, native_routing_proof_1.verifyNativeRoutingProof)(proof, { attemptId: 'route-2', nativeAgentId: 'child-1',
+            reservedAt: '2026-09-23T12:00:00.000Z', selection: input.selection }, key, new Date('2026-09-23T12:00:03.000Z'))).toBe(false);
+        expect((0, native_routing_proof_1.verifyNativeRoutingProof)({ ...proof, selection: (0, routing_approval_1.routingSelection)('high') }, { attemptId: 'route-1', nativeAgentId: 'child-1',
+            reservedAt: '2026-09-23T12:00:00.000Z', selection: input.selection }, key, new Date('2026-09-23T12:00:03.000Z'))).toBe(false);
+    });
+    it('rejects a setup event replayed as a daily dispatch', () => {
+        const proof = (0, native_routing_proof_1.signNativeRoutingProof)(input, key);
+        expect((0, native_routing_proof_1.verifyNativeRoutingProof)(proof, { attemptId: 'route-1', nativeAgentId: 'child-1',
+            reservedAt: '2026-09-23T12:00:03.000Z', selection: input.selection }, key, new Date('2026-09-23T12:00:04.000Z'))).toBe(false);
+    });
+    it('rejects a proof after its bounded observation window and protects a provider model claim', () => {
+        const proof = (0, native_routing_proof_1.signNativeRoutingProof)({ ...input, source: 'claude-assistant-transcript', actualModel: 'claude-example-model' }, key);
+        const expected = { attemptId: 'route-1', nativeAgentId: 'child-1', reservedAt: '2026-09-23T12:00:00.000Z', selection: input.selection };
+        expect((0, native_routing_proof_1.verifyNativeRoutingProof)(proof, expected, key, new Date('2026-09-23T12:00:03.000Z'))).toBe(true);
+        expect((0, native_routing_proof_1.verifyNativeRoutingProof)({ ...proof, actualModel: 'different' }, expected, key, new Date('2026-09-23T12:00:03.000Z'))).toBe(false);
+        expect((0, native_routing_proof_1.verifyNativeRoutingProof)(proof, expected, key, new Date('2026-09-23T12:16:03.000Z'))).toBe(false);
+    });
+});

package/dist/tests/core/model-policy/native-runtime.test.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const native_runtime_1 = require("../../../src/core/model-policy/native-runtime");
+describe('native runtime fingerprint', () => {
+    it('binds reported version and executable content without launching inference', async () => {
+        const result = await (0, native_runtime_1.queryRuntimeExecutable)({ command: process.execPath, args: ['--version'], timeoutMs: 5000 });
+        expect(result).toMatchObject({ version: expect.stringMatching(/^\d+\.\d+\.\d+$/), binaryDigest: expect.stringMatching(/^[a-f0-9]{64}$/), inferenceDispatched: false });
+        expect(await (0, native_runtime_1.queryRuntimeExecutable)({ command: process.execPath, args: ['--version'], timeoutMs: 5000 })).toEqual(result);
+    });
+    it('rejects an invalid binary or an inference-shaped invocation', async () => {
+        await expect((0, native_runtime_1.queryRuntimeExecutable)({ command: '/definitely/missing/awm-runtime', args: ['--version'], timeoutMs: 1000 })).rejects.toThrow(/runtime|executable/i);
+        await expect((0, native_runtime_1.queryRuntimeExecutable)({ command: process.execPath, args: ['-e', 'console.log(1)'], timeoutMs: 1000 })).rejects.toThrow(/version/i);
+    });
+});

package/dist/tests/core/model-policy/resolve-event.test.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const resolve_1 = require("../../../src/core/model-policy/resolve");
+const selection_policy_digest_1 = require("../../../src/core/model-policy/selection-policy-digest");
+const a = 'a'.repeat(64);
+const b = 'b'.repeat(64);
+const c = 'c'.repeat(64);
+const selected = (id) => ({ selector: { kind: 'model', id }, effort: { kind: 'explicit', value: 'high' } });
+const policy = () => ({ schema: 'approved-model-policy/v1', content: { schema: 'model-policy/v1', mappings: [{ target: 'codex', runtimeKind: 'native',
+                profiles: { mechanical: selected('luna'), integration: selected('sol'), judgment: selected('astra') }, fullCapability: selected('astra'),
+                degradation: { allowMissingModelOverride: false, allowMissingEffortOverride: false, allowMissingObservedIdentity: true } }],
+        implementationBudget: { maxAttempts: 3, escalation: ['mechanical', 'integration', 'judgment'], judgmentEfforts: ['medium', 'high'] } },
+    contentDigest: a, approval: { approvedAt: '2026-09-23T00:00:00.000Z', approvalId: 'owner' }, lineage: { previousDigest: null } });
+const scope = () => ({ runtime: { target: 'codex', kind: 'native', version: '0.156.1', accountScopeDigest: a }, binaryDigest: b, configDigest: c });
+const receipt = () => ({ schema: 'routing-capabilities/v2', ...scope(), recordedAt: '2026-09-23T00:00:00.000Z', claims: ['luna', 'astra'].map(id => ({ selection: selected(id),
+        mappingDigest: (0, selection_policy_digest_1.selectionPolicyDigest)(policy().content.mappings[0], selected(id)), eventDigest: b, source: 'codex-turn-context',
+        observedAt: '2026-09-22T23:59:00.000Z', actualModel: 'unverified', tokenUsage: 'unknown' })) });
+const input = () => ({ role: 'implementer', requestedProfile: 'mechanical', policy: policy(), receipt: receipt(), scope: scope(), now: new Date('2026-09-24T01:00:00.000Z') });
+describe('event-scoped routing resolution', () => {
+    it('routes a proved selection after 25 hours but labels missing backend identity as degraded', () => {
+        expect((0, resolve_1.resolveEventSelection)(input())).toMatchObject({ state: 'resolved', selection: selected('luna'), outcome: 'degraded', unavailableEvidence: ['observedModelEvidence'] });
+    });
+    it('requires the full selection to be separately proved', () => {
+        const value = input();
+        value.receipt.claims = value.receipt.claims.filter(item => item.selection.selector.id !== 'astra');
+        expect((0, resolve_1.resolveEventSelection)({ ...value, role: 'code-quality-reviewer' })).toMatchObject({ state: 'blocked', diagnostics: [{ code: 'ROUTING_SELECTION_UNENROLLED' }] });
+    });
+    it('blocks on account drift and when the owner did not permit missing backend identity', () => {
+        expect((0, resolve_1.resolveEventSelection)({ ...input(), scope: { ...scope(), runtime: { ...scope().runtime, accountScopeDigest: c } } })).toMatchObject({ state: 'blocked', diagnostics: [{ code: 'ROUTING_ACCOUNT_DRIFT' }] });
+        const value = input();
+        value.policy.content.mappings[0].degradation.allowMissingObservedIdentity = false;
+        expect((0, resolve_1.resolveEventSelection)(value)).toMatchObject({ state: 'blocked' });
+    });
+    it('uses independently enrolled full capability when only the optimized selection is absent', () => {
+        const value = input();
+        value.receipt.claims = value.receipt.claims.filter(item => item.selection.selector.id === 'astra');
+        expect((0, resolve_1.resolveEventWithFallback)(value)).toMatchObject({ state: 'resolved', selection: selected('astra'), effectiveProfile: 'full', outcome: 'degraded', fallbackReason: 'ROUTING_SELECTION_UNENROLLED' });
+        const drift = { ...value, scope: { ...scope(), runtime: { ...scope().runtime, accountScopeDigest: c } } };
+        expect((0, resolve_1.resolveEventWithFallback)(drift)).toMatchObject({ state: 'blocked', diagnostics: [expect.objectContaining({ code: 'ROUTING_FALLBACK_UNAVAILABLE' })] });
+    });
+    it('trips a same-run circuit to full when a provider rejects an otherwise current optimized selection', () => {
+        const value = input();
+        expect((0, resolve_1.resolveEventSelection)(value)).toMatchObject({ state: 'resolved', selection: selected('luna') });
+        expect((0, resolve_1.resolveEventWithFallback)({ ...value, circuitReason: 'PROVIDER_REJECTED' })).toMatchObject({ state: 'resolved', selection: selected('astra'), effectiveProfile: 'full', fallbackReason: 'PROVIDER_REJECTED' });
+        value.receipt.claims = value.receipt.claims.filter(item => item.selection.selector.id !== 'astra');
+        expect((0, resolve_1.resolveEventWithFallback)({ ...value, circuitReason: 'PROVIDER_REJECTED' })).toMatchObject({ state: 'blocked', diagnostics: [{ code: 'ROUTING_FALLBACK_UNAVAILABLE' }] });
+    });
+    it('returns the certified Claude agent type and preserves it on full fallback', () => {
+        const value = input();
+        value.policy.content.mappings[0].target = 'claude-code';
+        value.policy.content.mappings[0].profiles.mechanical = { selector: { kind: 'model', id: 'claude-haiku-4-5' }, effort: { kind: 'runtime-default' } };
+        value.policy.content.mappings[0].fullCapability = { selector: { kind: 'model', id: 'claude-opus-4-7' }, effort: { kind: 'runtime-default' } };
+        const claudeScope = { ...scope(), runtime: { ...scope().runtime, target: 'claude-code' } };
+        const mapping = value.policy.content.mappings[0];
+        const claims = [
+            { selection: mapping.profiles.mechanical, nativeAgentType: 'awm-mechanical' },
+            { selection: mapping.fullCapability, nativeAgentType: 'awm-full' },
+        ].map(row => ({ ...row, mappingDigest: (0, selection_policy_digest_1.selectionPolicyDigest)(mapping, row.selection), eventDigest: b,
+            source: 'claude-assistant-transcript', observedAt: '2026-09-22T23:59:00.000Z',
+            actualModel: { id: row.selection.selector.id, evidenceDigest: c }, tokenUsage: 'unknown' }));
+        const routed = { ...value, receipt: { schema: 'routing-capabilities/v2', ...claudeScope, recordedAt: '2026-09-23T00:00:00.000Z', claims }, scope: claudeScope };
+        expect((0, resolve_1.resolveEventSelection)(routed)).toMatchObject({ state: 'resolved', nativeAgentType: 'awm-mechanical' });
+        expect((0, resolve_1.resolveEventWithFallback)({ ...routed, circuitReason: 'PROVIDER_REJECTED' })).toMatchObject({ state: 'resolved', nativeAgentType: 'awm-full', effectiveProfile: 'full' });
+    });
+});

package/dist/tests/core/model-policy/setup-readiness.test.js

@@ -0,0 +1,83 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const setup_readiness_1 = require("../../../src/core/model-policy/setup-readiness");
+const capabilities_1 = require("../../../src/core/model-policy/capabilities");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const selection_policy_digest_1 = require("../../../src/core/model-policy/selection-policy-digest");
+const approved = {
+    state: 'approved', provenance: 'user',
+    policy: { schema: 'approved-model-policy/v1', contentDigest: 'a'.repeat(64), approval: { approvedAt: '2026-09-23T00:00:00.000Z', approvalId: 'test' }, lineage: { previousDigest: null },
+        content: { schema: 'model-policy/v1', implementationBudget: { maxAttempts: 3, escalation: ['mechanical', 'integration', 'judgment'], judgmentEfforts: ['medium', 'high'] }, mappings: [
+                { target: 'codex', runtimeKind: 'native', profiles: {}, fullCapability: {}, degradation: { allowMissingModelOverride: false, allowMissingEffortOverride: false, allowMissingObservedIdentity: false } },
+            ] } },
+};
+describe('routing setup guidance', () => {
+    it('does not demand machine setup when routing policy is absent', () => {
+        expect((0, setup_readiness_1.routingSetupGuidance)({ state: 'absent' })).toEqual([]);
+    });
+    it('names the exact provider and explicit discovery step without certifying the receipt', () => {
+        expect((0, setup_readiness_1.routingSetupGuidance)(approved)).toEqual([
+            { target: 'codex', runtimeKind: 'native', state: 'needs-evidence', command: 'awm model-policy setup --provider codex --json' },
+        ]);
+    });
+    it('reports invalid policy instead of silently falling back to a machine default', () => {
+        expect((0, setup_readiness_1.routingSetupGuidance)({ state: 'invalid', provenance: 'project', reason: 'bad digest' })).toEqual([
+            { state: 'policy-invalid', reason: 'bad digest' },
+        ]);
+    });
+    it('does not keep nudging when a valid local receipt exists; runtime matching remains a separate gate', () => {
+        const previous = process.env.AWM_HOME;
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-routing-setup-'));
+        process.env.AWM_HOME = root;
+        try {
+            const runtime = { target: 'codex', kind: 'native', version: '1.0.0', accountScopeDigest: 'b'.repeat(64) };
+            const destination = (0, capabilities_1.capabilityReceiptPath)(runtime);
+            fs_1.default.mkdirSync(path_1.default.dirname(destination), { recursive: true });
+            const receipt = {
+                schema: 'routing-capabilities/v1', runtime,
+                recordedAt: '2026-09-23T19:00:00.000Z', expiresAt: '2026-09-24T19:00:00.000Z',
+                capabilities: { artifactDelivery: 'unverified', interactiveExecution: 'unverified', unattendedController: 'unverified', nativeSubagents: 'unverified', modelOverride: 'unverified', effortOverride: 'unverified', observedModelEvidence: 'unverified', durableResume: 'unverified' },
+                availableSelections: [{ selector: { kind: 'model', id: 'gpt-6-sol' }, effort: { kind: 'explicit', value: 'medium' } }],
+                evidence: [], approval: { approvalId: 'test', snapshotDigest: 'a'.repeat(64) },
+            };
+            fs_1.default.writeFileSync(destination, JSON.stringify(receipt));
+            expect((0, setup_readiness_1.routingSetupGuidance)(approved, new Date('2026-09-23T19:30:00.000Z'))).toHaveLength(1);
+            receipt.capabilities.nativeSubagents = 'supported';
+            receipt.capabilities.modelOverride = 'supported';
+            receipt.capabilities.effortOverride = 'supported';
+            receipt.capabilities.observedModelEvidence = 'supported';
+            receipt.evidence = ['nativeSubagents', 'modelOverride', 'effortOverride', 'observedModelEvidence'].map(capability => ({ capability, kind: 'native-dispatch', receiptDigest: 'b'.repeat(64) }));
+            fs_1.default.writeFileSync(destination, JSON.stringify(receipt));
+            expect((0, setup_readiness_1.routingSetupGuidance)(approved, new Date('2026-09-23T19:30:00.000Z'))).toEqual([]);
+        }
+        finally {
+            if (previous === undefined)
+                delete process.env.AWM_HOME;
+            else
+                process.env.AWM_HOME = previous;
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('reports sealed v2 coverage without claiming that passive diagnostics checked the current machine', () => {
+        const selection = { selector: { kind: 'model', id: 'gpt-6-sol' }, effort: { kind: 'explicit', value: 'high' } };
+        const policy = structuredClone(approved);
+        if (policy.state !== 'approved')
+            throw new Error('expected policy');
+        const mapping = policy.policy.content.mappings[0];
+        mapping.profiles = { mechanical: selection, integration: selection, judgment: selection };
+        mapping.fullCapability = selection;
+        mapping.degradation.allowMissingObservedIdentity = true;
+        const receipt = { schema: 'routing-capabilities/v2', runtime: { target: 'codex', kind: 'native', version: '0.156.1', accountScopeDigest: 'a'.repeat(64) },
+            binaryDigest: 'b'.repeat(64), configDigest: 'c'.repeat(64), recordedAt: '2026-09-22T00:00:00.000Z', claims: [{ selection,
+                    mappingDigest: (0, selection_policy_digest_1.selectionPolicyDigest)(mapping, selection), eventDigest: 'd'.repeat(64), source: 'codex-turn-context', observedAt: '2026-09-22T00:00:00.000Z', actualModel: 'unverified', tokenUsage: 'unknown' }] };
+        expect((0, setup_readiness_1.routingSetupGuidance)(policy, new Date('2026-09-23T01:00:00.000Z'), { readStoredEventReceipt: (() => ({ state: 'present', receipt })) })).toEqual([
+            { target: 'codex', runtimeKind: 'native', state: 'coverage-only' },
+        ]);
+        expect((0, setup_readiness_1.routingSetupGuidance)(policy, new Date('2026-09-23T01:00:00.000Z'), { readStoredEventReceipt: (() => ({ state: 'invalid', reason: 'bad seal' })) })).toMatchObject([{ state: 'needs-evidence' }]);
+    });
+});

package/dist/tests/providers/index.test.js

@@ -123,7 +123,7 @@ describe('Providers Routing', () => {
         });
         expect(graph['claude-code']).toEqual({
             label: 'Claude Code',
-            configHome: { envVar: null, dir: '.claude', resolved: path_1.default.join(tmpHome, '.claude') },
+            configHome: { envVar: 'CLAUDE_CONFIG_DIR', dir: '.claude', resolved: path_1.default.join(tmpHome, '.claude') },
             skill: {
                 global: path_1.default.join(tmpHome, '.claude/skills'),
                 local: '.claude/skills',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "9.11.12",
+  "version": "9.12.1",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"
@@ -50,6 +50,7 @@
   "dependencies": {
     "@clack/prompts": "^0.11.0",
     "commander": "^14.0.3",
+    "js-yaml": "4.3.2",
     "picocolors": "^1.1.1",
     "semver": "^7.7.4",
     "simple-git": "3.36.0"
@@ -64,7 +65,6 @@
     "dependency-cruiser": "16.10.4",
     "eslint": "10.8.1",
     "jest": "^30.2.0",
-    "js-yaml": "4.3.2",
     "node-gyp": "^11.5.0",
     "ts-jest": "^29.4.6",
     "ts-node": "^10.9.2",