agentic-workflow-manager 9.11.12 → 9.12.1

package/dist/src/commands/plan/index.js

@@ -23,6 +23,8 @@ const store_2 = require("../../core/model-policy/store");
 const capabilities_1 = require("../../core/model-policy/capabilities");
 const resolve_1 = require("../../core/model-policy/resolve");
 const journal_1 = require("../../core/model-policy/journal");
+const event_store_1 = require("../../core/model-policy/event-store");
+const local_event_scope_1 = require("../../core/model-policy/local-event-scope");
 const SUPPORTED_SCHEMA = 'compact-slices/v1, compact-slices/v2';
 const MAX_PATH_LENGTH = 4096;
 const MAX_DIAGNOSTICS = 20;
@@ -145,7 +147,7 @@ function registerPlanCommand(program, deps = { validatePlanFile: validate_1.vali
         throw new Error('program must be a Commander command');
     assertDependencies(deps);
     const plan = program.command('plan').description('inspect plan contracts');
-    plan.command('resolve <plan-path>').requiredOption('--provider <target>').requiredOption('--runtime-kind <kind>').requiredOption('--runtime-version <version>').requiredOption('--account-scope-digest <sha>').requiredOption('--role <role>').option('--opt-in-v1').option('--slice <id>').option('--lineage <id>').option('--cwd <path>').option('--json').action((planPath, options) => {
+    plan.command('resolve <plan-path>').requiredOption('--provider <target>').requiredOption('--runtime-kind <kind>').requiredOption('--runtime-version <version>').requiredOption('--account-scope-digest <sha>').requiredOption('--role <role>').option('--opt-in-v1').option('--slice <id>').option('--lineage <id>').option('--cwd <path>').option('--json').action(async (planPath, options) => {
         assertText(planPath, 'plan path');
         for (const [value, label] of [[options.provider, '--provider'], [options.runtimeKind, '--runtime-kind'], [options.runtimeVersion, '--runtime-version'], [options.accountScopeDigest, '--account-scope-digest'], [options.role, '--role']])
             assertText(value, label);
@@ -184,11 +186,31 @@ function registerPlanCommand(program, deps = { validatePlanFile: validate_1.vali
         if (!roles.includes(options.role))
             throw new Error('--role is invalid');
         const runtime = (0, capabilities_1.validateRuntimeKey)({ target: options.provider, kind: options.runtimeKind, version: options.runtimeVersion, accountScopeDigest: options.accountScopeDigest });
+        let eventFacts;
+        if (report.schema === 'compact-slices/v2' && (runtime.target === 'codex' || runtime.target === 'claude-code')) {
+            const stored = (deps.readStoredEventReceipt ?? event_store_1.readStoredEventReceipt)(runtime);
+            if (stored.state === 'invalid') {
+                process.stdout.write(`${JSON.stringify({ state: 'blocked', diagnostics: [{ code: 'ROUTING_CAPABILITY_INVALID', message: 'Native event receipt is invalid.' }] })}\n`);
+                process.exitCode = 2;
+                return;
+            }
+            if (stored.state === 'present') {
+                const local = await (runtime.target === 'codex' && deps.queryLocalCodexScope ? deps.queryLocalCodexScope(path_1.default.resolve(cwd), runtime.kind) : (0, local_event_scope_1.queryLocalEventScope)(path_1.default.resolve(cwd), runtime.target, runtime.kind));
+                if (local.state !== 'current' || JSON.stringify(local.scope.runtime) !== JSON.stringify(runtime)) {
+                    const reason = local.state === 'unverified' ? local.reason : 'RUNTIME_IDENTITY_MISMATCH';
+                    process.stdout.write(`${JSON.stringify({ state: 'blocked', diagnostics: [{ code: `ROUTING_${reason}`, message: `Current local ${runtime.target} scope cannot be verified (${reason}); run awm model-policy setup --provider ${runtime.target} --json.` }] })}\n`);
+                    process.exitCode = 2;
+                    return;
+                }
+                eventFacts = { eventReceipt: stored.receipt, eventScope: local.scope };
+            }
+        }
+        const circuitIncidents = report.schema === 'compact-slices/v2' ? journalObservation(cwd).journalState?.routingIncidents : undefined;
         const result = report.schema === 'compact-slices/v1' && !options.optInV1 ? (0, resolve_1.resolveDispatch)({ plan: report, role: options.role, policy: undefined, capabilities: undefined, runtime, now: new Date(), optInV1: false }) : (() => {
             const policy = (deps.readEffectivePolicy ?? store_2.readEffectivePolicy)(cwd);
-            const capabilities = (deps.readCapabilities ?? capabilities_1.readCapabilities)(runtime, new Date());
+            const capabilities = eventFacts ? { state: 'absent' } : (deps.readCapabilities ?? capabilities_1.readCapabilities)(runtime, new Date());
             if (!options.lineage) {
-                const first = (0, resolve_1.resolveDispatch)({ plan: report, role: options.role, sliceId: options.slice, policy: policy.state === 'approved' ? policy.policy : undefined, capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined, runtime, now: new Date(), optInV1: options.optInV1 === true });
+                const first = (0, resolve_1.resolveDispatch)({ plan: report, role: options.role, sliceId: options.slice, policy: policy.state === 'approved' ? policy.policy : undefined, capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined, ...eventFacts, circuitIncidents, runtime, now: new Date(), optInV1: options.optInV1 === true });
                 // The consumer forwards THIS envelope to `job routing-reserve`, which
                 // is what creates the lineage the --lineage escalation path below
                 // then reads. Emitting it only there made the first attempt of any
@@ -204,15 +226,15 @@ function registerPlanCommand(program, deps = { validatePlanFile: validate_1.vali
                 const requestedProfile = options.role === 'implementer' ? slice?.implementerProfile : 'full';
                 if (requestedProfile === undefined)
                     return first;
-                return { ...first, envelope: { schema: 'routing-envelope/v1', runtime, role: options.role, planDigest: report.planDigest, executionDigest: report.executionDigest, ...(options.slice === undefined ? {} : { sliceId: options.slice }), requestedProfile, effectiveProfile: first.effectiveProfile, resolved: first.selection, policyDigest: first.policyDigest, capabilityDigest: first.capabilityDigest, outcome: first.outcome, unavailableEvidence: first.unavailableEvidence } };
+                return { ...first, envelope: { schema: 'routing-envelope/v1', runtime, role: options.role, planDigest: report.planDigest, executionDigest: report.executionDigest, ...(options.slice === undefined ? {} : { sliceId: options.slice }), requestedProfile, effectiveProfile: first.effectiveProfile, resolved: first.selection, policyDigest: first.policyDigest, capabilityDigest: first.capabilityDigest, outcome: first.outcome, unavailableEvidence: first.unavailableEvidence, ...(first.nativeAgentType ? { nativeAgentType: first.nativeAgentType } : {}) } };
             }
             const state = journalObservation(cwd).journalState;
             const lineage = state.implementationLineages.find(candidate => candidate.id === options.lineage);
             const next = (0, journal_1.resolveLineageEscalation)(state, options.lineage, lineage.initialProfile);
-            const resolved = (0, resolve_1.resolveEscalatedSelection)({ role: 'implementer', requestedProfile: next.profile, expectedEffort: next.effort, policy: policy.state === 'approved' ? policy.policy : undefined, capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined, runtime, now: new Date() });
+            const resolved = (0, resolve_1.resolveEscalatedSelection)({ role: 'implementer', requestedProfile: next.profile, expectedEffort: next.effort, policy: policy.state === 'approved' ? policy.policy : undefined, capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined, ...eventFacts, circuitIncidents, runtime, now: new Date() });
             if (resolved.state === 'blocked')
                 return resolved;
-            return { ...resolved, envelope: { schema: 'routing-envelope/v1', runtime, role: 'implementer', planDigest: report.planDigest, executionDigest: report.executionDigest, sliceId: lineage.sliceId, requestedProfile: lineage.initialProfile, effectiveProfile: next.profile, resolved: resolved.selection, policyDigest: resolved.policyDigest, capabilityDigest: resolved.capabilityDigest, outcome: resolved.outcome, unavailableEvidence: resolved.unavailableEvidence }, custodyHandoff: { kind: 'routing-reserve', obligationId: lineage.obligationId, lineageId: lineage.id } };
+            return { ...resolved, envelope: { schema: 'routing-envelope/v1', runtime, role: 'implementer', planDigest: report.planDigest, executionDigest: report.executionDigest, sliceId: lineage.sliceId, requestedProfile: lineage.initialProfile, effectiveProfile: resolved.effectiveProfile, resolved: resolved.selection, policyDigest: resolved.policyDigest, capabilityDigest: resolved.capabilityDigest, outcome: resolved.outcome, unavailableEvidence: resolved.unavailableEvidence, ...(resolved.nativeAgentType ? { nativeAgentType: resolved.nativeAgentType } : {}) }, custodyHandoff: { kind: 'routing-reserve', obligationId: lineage.obligationId, lineageId: lineage.id } };
         })();
         process.stdout.write(options.json ? `${JSON.stringify(result)}\n` : `Plan routing: ${result.state}\n`);
         if (result.state === 'blocked')
@@ -290,9 +312,31 @@ function registerPlanCommand(program, deps = { validatePlanFile: validate_1.vali
             process.exitCode = 2;
             return;
         }
-        const readRouting = () => { if (!options.runtimeKind || !options.runtimeVersion || !options.accountScopeDigest)
-            return undefined; const runtime = (0, capabilities_1.validateRuntimeKey)({ target: options.provider, kind: options.runtimeKind, version: options.runtimeVersion, accountScopeDigest: options.accountScopeDigest }); const policy = (deps.readEffectivePolicy ?? store_2.readEffectivePolicy)(options.cwd); const at = deps.routingNow?.() ?? new Date(); if (!(at instanceof Date) || !Number.isFinite(at.getTime()))
-            throw new Error('routingNow must return a finite Date'); const capabilities = (deps.readCapabilities ?? capabilities_1.readCapabilities)(runtime, at); return { runtime, policy: policy.state === 'approved' ? policy.policy : undefined, capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined, now: at }; };
+        const readRouting = async () => {
+            if (!options.runtimeKind || !options.runtimeVersion || !options.accountScopeDigest)
+                return undefined;
+            const runtime = (0, capabilities_1.validateRuntimeKey)({ target: options.provider, kind: options.runtimeKind, version: options.runtimeVersion, accountScopeDigest: options.accountScopeDigest });
+            const policy = (deps.readEffectivePolicy ?? store_2.readEffectivePolicy)(options.cwd);
+            const at = deps.routingNow?.() ?? new Date();
+            if (!(at instanceof Date) || !Number.isFinite(at.getTime()))
+                throw new Error('routingNow must return a finite Date');
+            const base = { runtime, policy: policy.state === 'approved' ? policy.policy : undefined, now: at };
+            if (runtime.target === 'codex' || runtime.target === 'claude-code') {
+                const stored = (deps.readStoredEventReceipt ?? event_store_1.readStoredEventReceipt)(runtime);
+                if (stored.state === 'invalid')
+                    return { ...base, eventIssue: { code: 'ROUTING_CAPABILITY_INVALID', message: 'Sealed native event receipt is invalid.' } };
+                if (stored.state === 'present') {
+                    const local = await (runtime.target === 'codex' && deps.queryLocalCodexScope ? deps.queryLocalCodexScope(path_1.default.resolve(options.cwd), runtime.kind) : (0, local_event_scope_1.queryLocalEventScope)(path_1.default.resolve(options.cwd), runtime.target, runtime.kind));
+                    if (local.state !== 'current' || JSON.stringify(local.scope.runtime) !== JSON.stringify(runtime)) {
+                        const reason = local.state === 'unverified' ? local.reason : 'RUNTIME_IDENTITY_MISMATCH';
+                        return { ...base, eventIssue: { code: `ROUTING_${reason}`, message: `Local ${runtime.target} scope cannot be verified (${reason}); run awm model-policy setup --provider ${runtime.target} --json.` } };
+                    }
+                    return { ...base, eventReceipt: stored.receipt, eventScope: local.scope };
+                }
+            }
+            const capabilities = (deps.readCapabilities ?? capabilities_1.readCapabilities)(runtime, at);
+            return { ...base, capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined };
+        };
         if (options.controllerAutonomy !== undefined && !(0, adapter_1.isControllerAutonomy)(options.controllerAutonomy))
             throw new Error(`--controller-autonomy is invalid: ${options.controllerAutonomy} (valid: ${adapter_1.CONTROLLER_AUTONOMIES.join(', ')})`);
         const report = await (0, registry_contracts_1.admitRegistryPlan)({ plan: planReport, provider: options.provider, cwd: options.cwd, enabledAgents, executionMode, planPath: normalizedPlanPath, ...journal, requireCurrent: options.requireCurrent === true, verifySensors: options.verifySensors === true, ...(options.controllerAutonomy === undefined ? {} : { controllerAutonomy: options.controllerAutonomy }) }, { admitPlan: admission, listRegistries: registryInventory, checkCurrentness: currentnessCheck, runSensors: sensorRun, readRouting });

package/dist/src/commands/preflight/checks.js

@@ -17,7 +17,24 @@ const registries_1 = require("../../core/registries");
 const inspect_1 = require("../../core/context-kernel/inspect");
 const registries_2 = require("../../core/registries");
 const check_1 = require("../../core/currentness/check");
+const store_1 = require("../../core/model-policy/store");
+const setup_readiness_1 = require("../../core/model-policy/setup-readiness");
 const MANIFEST = path_1.default.join('.awm', 'sensors.json');
+function checkRoutingSetup(cwd) {
+    const guidance = (0, setup_readiness_1.routingSetupGuidance)((0, store_1.readEffectivePolicy)(cwd));
+    if (guidance.length === 0)
+        return [];
+    const invalid = guidance.find(item => item.state === 'policy-invalid');
+    if (invalid?.state === 'policy-invalid')
+        return [{ id: 'routing-setup', ok: false, advisory: true, detail: 'approved routing policy is invalid', remedy: 'repair the model policy before using routed subagents' }];
+    const targets = guidance.filter((item) => item.state === 'needs-evidence');
+    if (targets.length === 0)
+        return [{ id: 'routing-setup', ok: true, advisory: true,
+                detail: 'sealed routing selections are covered locally; doctor/preflight do not verify current runtime/account/config scope (checked at routed dispatch)' }];
+    return [{ id: 'routing-setup', ok: false, advisory: true,
+            detail: `routing machine evidence needs a native check for ${targets.map(item => `${item.target}/${item.runtimeKind}`).join(', ')}`,
+            remedy: targets[0].command }];
+}
 /**
  * The agent needs project context delivered every session. A repo with neither file
  * hands every agent — and every teammate's agent — a blank slate.
@@ -472,6 +489,7 @@ async function preflight(cwd = process.cwd(), opts = {}) {
         ...(opts.verifySensors === true ? [await checkSensorExecution(cwd)] : []),
         // Strict mode is the only path that contacts authoritative npm/Git sources.
         ...(opts.requireCurrent === true ? [checkCompatibility()] : []),
+        ...checkRoutingSetup(cwd),
         // Runs unconditionally — orthogonal to sensor configuration entirely, this is
         // about PR/MR tooling, not sensors.
         checkHost(cwd),

package/dist/src/commands/watch/apply.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.applyCyclePlanAppend = applyCyclePlanAppend;
 exports.registerTrackIntegrationItems = registerTrackIntegrationItems;
+exports.applyRequestToState = applyRequestToState;
 exports.consumePendingRequests = consumePendingRequests;
 // Consumo transaccional de requests (bloqueador 4): mutar estado ->
 // writeJournal -> RECIEN AHI borrar archivos. El replay es seguro por
@@ -22,7 +23,28 @@ const types_1 = require("../../core/journal/types");
 const journal_1 = require("../../core/model-policy/journal");
 const store_2 = require("../../core/model-policy/store");
 const capabilities_1 = require("../../core/model-policy/capabilities");
+const event_store_1 = require("../../core/model-policy/event-store");
+const capabilities_v2_1 = require("../../core/model-policy/capabilities-v2");
+const machine_key_1 = require("../../core/model-policy/machine-key");
+const paths_2 = require("../../core/paths");
+const native_routing_proof_1 = require("../../core/model-policy/native-routing-proof");
+const selection_policy_digest_1 = require("../../core/model-policy/selection-policy-digest");
 function now() { return new Date().toISOString(); }
+function currentNativeAttempt(repoRoot, envelope, eventScope, at) {
+    if (!eventScope || JSON.stringify(eventScope.runtime) !== JSON.stringify(envelope.runtime))
+        return false;
+    try {
+        const stored = (0, event_store_1.readStoredEventReceipt)((0, capabilities_1.validateRuntimeKey)(envelope.runtime));
+        const approved = (0, store_2.readEffectivePolicy)(repoRoot);
+        if (stored.state !== 'present' || approved.state !== 'approved' || approved.policy.contentDigest !== envelope.policyDigest)
+            return false;
+        const mapping = approved.policy.content.mappings.find(row => row.target === envelope.runtime.target && row.runtimeKind === envelope.runtime.kind);
+        return !!mapping && (0, capabilities_v2_1.evaluateEventReceipt)(stored.receipt, eventScope, envelope.resolved, (0, selection_policy_digest_1.selectionPolicyDigest)(mapping, envelope.resolved), at).state === 'current';
+    }
+    catch {
+        return false;
+    }
+}
 const VERIFICATION_KINDS = ['test', 'lint', 'sensors', 'review', 'qa', 'interlock', 'track-integration'];
 function verificationItems(value, field) {
     if (!Array.isArray(value) || !value.every((item) => typeof item === 'object' && item !== null
@@ -107,7 +129,7 @@ function registerTrackIntegrationItems(state) {
 function trackWorktreePath(repoRoot, trackId) {
     return path_1.default.join(path_1.default.dirname(repoRoot), `${path_1.default.basename(repoRoot)}.track-${trackId}`);
 }
-function applyRequestToState(s, env, digest, repoRoot) {
+function applyRequestToState(s, env, digest, repoRoot, eventScope) {
     const base = { requestId: env.requestId, idempotencyKey: env.idempotencyKey, payloadDigest: digest };
     if (env.kind === 'controller-heartbeat') {
         s.controllerHeartbeatAt = now();
@@ -122,6 +144,14 @@ function applyRequestToState(s, env, digest, repoRoot) {
         const reserved = (0, journal_1.reserveRoutingAttempt)(s, { obligationId: p.obligationId, lineageId: p.lineageId, envelope, fingerprint: p.fingerprint, approval: () => {
                 const checkedAt = new Date();
                 const policy = (0, store_2.readEffectivePolicy)(repoRoot);
+                const event = (0, event_store_1.readStoredEventReceipt)((0, capabilities_1.validateRuntimeKey)(envelope.runtime));
+                if (event.state === 'invalid')
+                    throw new Error('routing native event receipt is invalid');
+                if (event.state === 'present') {
+                    if (!eventScope)
+                        throw new Error('routing native event scope is unverified');
+                    return { checkedAt, policy: policy.state === 'approved' ? policy.policy : undefined, eventReceipt: event.receipt, eventScope };
+                }
                 const capabilities = (0, capabilities_1.readCapabilities)((0, capabilities_1.validateRuntimeKey)(envelope.runtime), checkedAt);
                 return { checkedAt, policy: policy.state === 'approved' ? policy.policy : undefined, capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined };
             } }, p.at ?? now());
@@ -133,7 +163,36 @@ function applyRequestToState(s, env, digest, repoRoot) {
         const p = env.payload;
         if (typeof p.attemptId !== 'string' || typeof p.nativeAgentId !== 'string' || (p.observed !== undefined && !(0, types_1.isRoutingSelection)(p.observed)) || (p.unavailableReason !== undefined && typeof p.unavailableReason !== 'string') || (p.at !== undefined && typeof p.at !== 'string'))
             throw new Error('routing-observe requiere payload estricto');
-        const observed = (0, journal_1.observeRoutingAttempt)(s, { attemptId: p.attemptId, nativeAgentId: p.nativeAgentId, ...(p.observed === undefined ? {} : { observed: p.observed }), ...(p.unavailableReason === undefined ? {} : { unavailableReason: p.unavailableReason }) }, p.at ?? now());
+        const attempt = s.routingAttempts?.find(item => item.id === p.attemptId);
+        if (!attempt)
+            throw new Error('routing-observe attempt is unknown');
+        let key = null;
+        if (attempt.nativeEvidenceRequired) {
+            try {
+                key = (0, machine_key_1.readMachineKey)((0, paths_2.awmHome)());
+            }
+            catch { /* missing/unsafe machine key is recorded as PROVENANCE_MISSING */ }
+        }
+        const proof = p.nativeProof;
+        const nativeProof = proof;
+        const checkedAt = new Date();
+        const validProof = attempt.nativeEvidenceRequired && key && attempt.reservedAt
+            ? (0, native_routing_proof_1.verifyNativeRoutingProof)(proof, { attemptId: p.attemptId, nativeAgentId: p.nativeAgentId,
+                reservedAt: attempt.reservedAt, selection: attempt.envelope.resolved }, key, checkedAt)
+                && checkedAt.getTime() - Date.parse(nativeProof.observedAt) <= 15 * 60_000
+                && currentNativeAttempt(repoRoot, attempt.envelope, eventScope, checkedAt)
+                && (attempt.envelope.runtime.target === 'codex' ? nativeProof?.source === 'codex-turn-context' : nativeProof?.source === 'claude-assistant-transcript')
+                && p.observed !== undefined && JSON.stringify(p.observed) === JSON.stringify(nativeProof?.selection)
+                && !s.routingAttempts?.some(item => item.id !== attempt.id && item.nativeEvidenceRequired
+                    && (item.nativeAgentId === p.nativeAgentId || item.nativeEventDigest === nativeProof?.eventDigest))
+            : false;
+        const observed = (0, journal_1.observeRoutingAttempt)(s, { attemptId: p.attemptId, nativeAgentId: p.nativeAgentId,
+            ...(validProof ? { observed: nativeProof.selection, nativeEventDigest: nativeProof.eventDigest,
+                ...(nativeProof.actualModel === undefined ? {} : { observedBackendModel: nativeProof.actualModel }) }
+                : attempt.nativeEvidenceRequired ? {} : p.observed === undefined ? {} : { observed: p.observed }),
+            ...(attempt.nativeEvidenceRequired
+                ? validProof ? {} : { unavailableReason: p.unavailableReason === 'PROVIDER_REJECTED' ? 'PROVIDER_REJECTED' : 'PROVENANCE_MISSING' }
+                : p.unavailableReason === undefined ? {} : { unavailableReason: p.unavailableReason }) }, p.at ?? now());
         Object.assign(s, observed);
         (0, requests_1.applyOutcome)(s, { ...base, outcome: 'applied', resultRef: p.attemptId });
         return;
@@ -444,6 +503,8 @@ function applyRequestToState(s, env, digest, repoRoot) {
             }
             if (s.cycle.status !== 'BLOCKED')
                 throw new Error('custody-decision solo aplica a un ciclo BLOCKED');
+            if ((0, types_1.activeRequestProblems)(s).length > 0)
+                throw new Error('custody-decision no resuelve requests rechazadas pendientes');
             s.custodyDecisions ??= [];
             s.custodyDecisions.push({ at: now(), decision: 'resume', reason: p.reason, generationToken: env.generationToken });
             for (const generation of s.generations) {
@@ -541,7 +602,7 @@ function applyRequestToState(s, env, digest, repoRoot) {
 /** Consume TODAS las requests pendientes en orden. ORDEN CRITICO (R1.3,
  *  bloqueador 4): (1) mutar estado, (2) writeJournal, (3) borrar archivos,
  *  (4) fsync del directorio. Solo el supervisor llama esto (single-writer). */
-function consumePendingRequests(repoRoot, branch, activeToken) {
+function consumePendingRequests(repoRoot, branch, activeToken, eventScope) {
     const r = (0, store_1.readJournal)(repoRoot, branch);
     if (r.corrupt || r.state === null)
         throw new Error('journal corrupto: el supervisor no opera sobre corrupcion (R1.6)');
@@ -599,7 +660,7 @@ function consumePendingRequests(repoRoot, branch, activeToken) {
                 // nunca deja un estado parcialmente contaminado que luego no se
                 // pueda serializar o reintentar.
                 const candidate = structuredClone(s);
-                applyRequestToState(candidate, env, digest, repoRoot);
+                applyRequestToState(candidate, env, digest, repoRoot, eventScope);
                 s = candidate;
                 applied++;
                 stateTouched = true;
@@ -608,7 +669,10 @@ function consumePendingRequests(repoRoot, branch, activeToken) {
                 rejectedInvalid++;
                 deferredRenames.push({ from: p.file, to: `${p.file}.rejected` });
                 if (!s.requestProblems.some((problem) => problem.file === p.file && problem.kind === 'rejected')) {
-                    s.requestProblems.push({ file: p.file, kind: 'rejected', detail: (0, redact_1.redactText)(e.message), at: now() });
+                    s.requestProblems.push({ file: p.file, kind: 'rejected', detail: (0, redact_1.redactText)(e.message), at: now(),
+                        requestId: env.requestId, generationToken: env.generationToken,
+                        ...(env.kind === 'register-entity' && env.payload.entity === 'task' && typeof env.payload.taskId === 'string'
+                            ? { taskId: env.payload.taskId } : {}) });
                 }
                 (0, store_1.appendEvent)(repoRoot, branch, { kind: 'request-rejected-invalid', requestId: env.requestId, detail: e.message });
                 dirChanged = true;

package/dist/src/commands/watch/archive-unused.js

@@ -50,8 +50,10 @@ function watchJournalStatus(repoRoot, branch) {
     }
     catch { /* recognized present journal, but never eligible by absence alone */ }
     const binding = current.state.planBinding;
+    const latest = current.state.generations.reduce((prev, generation) => prev === undefined || generation.n > prev.n ? generation : prev, undefined);
     return {
         state: 'present', cycleState: current.state.cycle.status, bootstrapUnused,
+        ...(latest ? { latestGeneration: { n: latest.n, token: latest.token, state: latest.state } } : {}),
         ...(binding ? { binding: { path: binding.path, digest: binding.digest, ...(binding.executionDigest ? { executionDigest: binding.executionDigest, executionIdentitySchema: binding.executionIdentitySchema } : {}), schema: binding.schema, executionMode: binding.executionMode, boundAt: binding.boundAt } } : {}),
     };
 }

package/dist/src/commands/watch/index.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerWatchCommand = registerWatchCommand;
 const child_process_1 = require("child_process");
 const init_1 = require("./init");
+const request_recovery_1 = require("./request-recovery");
 const supervisor_1 = require("./supervisor");
 const capabilities_1 = require("../../core/model-policy/capabilities");
 const adapter_1 = require("../../core/journal/adapter");
@@ -144,6 +145,29 @@ function registerWatchCommand(program) {
         await (0, supervisor_1.runSupervisorLoop)(repo, branch, cfg);
         process.stdout.write('gate verde: ciclo COMPLETE — drenado, lock liberado, apagando\n');
     });
+    watch.command('recover-request')
+        .description('reconcilia una task rechazada con una request correctiva aplicada bajo lock exclusivo')
+        .requiredOption('--rejected <requestId>', 'request rechazada archivada')
+        .requiredOption('--replacement <requestId>', 'request correctiva pendiente')
+        .requiredOption('--generation <token>', 'generacion vigente')
+        .requiredOption('--reason <text>', 'motivo auditado de la recuperacion')
+        .option('--resume', 'reanuda explicitamente custodia si el unico bloqueo era la request')
+        .action((opts) => {
+        const repo = process.cwd();
+        const branch = currentBranch(repo);
+        try {
+            (0, context_1.resolveCommandContext)(repo, branch);
+            (0, request_recovery_1.recoverRejectedTask)(repo, branch, {
+                rejectedRequestId: opts.rejected, replacementRequestId: opts.replacement,
+                generationToken: opts.generation, reason: opts.reason, resume: opts.resume === true,
+            });
+            process.stdout.write(JSON.stringify({ recovered: true, rejectedRequestId: opts.rejected, replacementRequestId: opts.replacement, resumed: opts.resume === true }) + '\n');
+        }
+        catch (error) {
+            process.stderr.write(`${error.message}\n`);
+            process.exitCode = 1;
+        }
+    });
     watch
         .command('rebind')
         .description('reconcilia intencionalmente el binding desatendido tras un cambio válido del ciclo del plan')

package/dist/src/commands/watch/init.js

@@ -13,6 +13,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const store_1 = require("../../core/journal/store");
 const paths_1 = require("../../core/journal/paths");
+const types_1 = require("../../core/journal/types");
 const lock_1 = require("./lock");
 const validate_1 = require("../../core/plan/validate");
 const identity_1 = require("../../core/plan/identity");
@@ -104,7 +105,7 @@ function rebindBlocker(state) {
     const nonterminal = Object.values(state.jobs).filter(job => !TERMINAL_JOB_STATES.has(job.executionState));
     if (nonterminal.length > 0)
         return `hay jobs no terminales: ${nonterminal.map(job => job.id).join(', ')}`;
-    if (state.requestProblems.length > 0)
+    if ((0, types_1.activeRequestProblems)(state).length > 0)
         return 'hay conflictos durables de requests';
     if (state.verdicts.some(verdict => verdict.result !== 'pass'))
         return 'hay evidencia adversa durable';

package/dist/src/commands/watch/request-recovery.js

@@ -0,0 +1,153 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recoverRejectedTask = recoverRejectedTask;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const json_1 = require("../../core/plan/json");
+const atomic_file_1 = require("../../core/atomic-file");
+const types_1 = require("../../core/journal/types");
+const requests_1 = require("../../core/journal/requests");
+const paths_1 = require("../../core/journal/paths");
+const store_1 = require("../../core/journal/store");
+const process_1 = require("../../core/journal/process");
+const apply_1 = require("./apply");
+const lock_1 = require("./lock");
+const REQUEST_ID = /^req-[0-9]+-[0-9]{10}-[a-f0-9]{8}$/;
+const MAX_REQUEST_BYTES = 256 * 1024;
+function validatedId(value, label) {
+    if (typeof value !== 'string' || !REQUEST_ID.test(value))
+        throw new Error(`${label} requiere un requestId valido`);
+    return value;
+}
+/** Reads only one canonical, bounded request file. The inode check closes a
+ * swap between lstat and open, including platforms without O_NOFOLLOW. */
+function requestEnvelope(file, requestId) {
+    const before = fs_1.default.lstatSync(file);
+    if (!before.isFile() || before.isSymbolicLink() || before.size < 1 || before.size > MAX_REQUEST_BYTES) {
+        throw new Error('request de recovery no es un archivo regular acotado');
+    }
+    const descriptor = fs_1.default.openSync(file, fs_1.default.constants.O_RDONLY | (fs_1.default.constants.O_NOFOLLOW ?? 0));
+    let body;
+    try {
+        const opened = fs_1.default.fstatSync(descriptor);
+        if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino || opened.size !== before.size) {
+            throw new Error('request de recovery cambio de identidad');
+        }
+        body = fs_1.default.readFileSync(descriptor, { encoding: 'utf8' });
+    }
+    finally {
+        fs_1.default.closeSync(descriptor);
+    }
+    const parsed = (0, json_1.parseJsonNoDuplicate)(body);
+    if (!(0, requests_1.isWellFormedEnvelope)(parsed) || parsed.requestId !== requestId)
+        throw new Error('request de recovery tiene envelope invalido');
+    return parsed;
+}
+function taskId(envelope) {
+    if (envelope.kind !== 'register-entity' || envelope.payload.entity !== 'task'
+        || typeof envelope.payload.taskId !== 'string' || envelope.payload.taskId.length === 0) {
+        throw new Error('recovery solo admite register-entity task con taskId');
+    }
+    return envelope.payload.taskId;
+}
+function mayResume(state) {
+    if (state.cycle.status !== 'BLOCKED' || state.cycle.blockedReason !== 'recovery no autorizado: hay conflictos durables de requests') {
+        throw new Error('resume requiere custodia BLOCKED por requests');
+    }
+    if ((0, types_1.activeRequestProblems)(state).length > 0)
+        throw new Error('resume requiere resolver todas las requests activas');
+}
+/** Offline recovery lane: no supervisor or controller may own this journal.
+ * The correction and its audit link are published in one state transaction. */
+function recoverRejectedTask(repoRoot, branch, input) {
+    if (typeof repoRoot !== 'string' || !path_1.default.isAbsolute(repoRoot) || typeof branch !== 'string' || branch.length === 0
+        || !input || typeof input !== 'object' || typeof input.generationToken !== 'string' || input.generationToken.length === 0
+        || typeof input.reason !== 'string' || input.reason.trim().length === 0 || input.reason.length > 1024 || typeof input.resume !== 'boolean') {
+        throw new Error('parametros de recovery invalidos');
+    }
+    const rejectedId = validatedId(input.rejectedRequestId, '--rejected');
+    const replacementId = validatedId(input.replacementRequestId, '--replacement');
+    if (rejectedId === replacementId)
+        throw new Error('la request correctiva debe ser distinta');
+    const lock = (0, lock_1.acquireLock)(repoRoot);
+    try {
+        const read = (0, store_1.readJournal)(repoRoot, branch);
+        if (read.corrupt || !read.state || read.state.schema !== 2 || !read.state.planBinding)
+            throw new Error('recovery requiere journal schema-2 vigente');
+        const state = read.state;
+        const latest = [...state.generations].sort((a, b) => b.n - a.n)[0];
+        if (!latest || latest.token !== input.generationToken)
+            throw new Error('generation de recovery no es la vigente');
+        for (const generation of state.generations) {
+            for (const ref of [generation.processRef, generation.wrapperRef]) {
+                if (ref && (0, process_1.refIsAlive)(ref))
+                    throw new Error('controller vivo: recovery requiere custodia exclusiva');
+            }
+        }
+        const dir = (0, paths_1.requestsDir)(repoRoot, branch);
+        const originalFile = path_1.default.join(dir, `${rejectedId}.json`);
+        const problem = state.requestProblems.find(item => item.kind === 'rejected' && item.file === originalFile);
+        if (!problem)
+            throw new Error('rechazo durable no encontrado');
+        if (problem.resolution) {
+            if (problem.resolution.replacementRequestId !== replacementId || problem.resolution.generationToken !== input.generationToken || problem.resolution.reason !== input.reason
+                || (0, types_1.activeRequestProblems)(state).includes(problem))
+                throw new Error('recovery previo incompatible');
+            if (input.resume && state.cycle.status === 'BLOCKED') {
+                const candidate = structuredClone(state);
+                mayResume(candidate);
+                candidate.custodyDecisions ??= [];
+                candidate.custodyDecisions.push({ at: new Date().toISOString(), decision: 'resume', reason: input.reason, generationToken: input.generationToken });
+                candidate.cycle.status = 'IN_PROGRESS';
+                candidate.cycle.blockedReason = undefined;
+                for (const generation of candidate.generations)
+                    if (generation.state === 'active' || generation.state === 'controller-suspected-stall')
+                        generation.state = 'superseded';
+                (0, store_1.writeJournal)(repoRoot, branch, candidate);
+            }
+            return;
+        }
+        const original = requestEnvelope(`${originalFile}.rejected`, rejectedId);
+        const replacementFile = path_1.default.join(dir, `${replacementId}.json`);
+        const replacement = requestEnvelope(replacementFile, replacementId);
+        if (original.generationToken !== input.generationToken || replacement.generationToken !== input.generationToken || taskId(original) !== taskId(replacement)) {
+            throw new Error('request correctiva no enlaza el mismo taskId o generation');
+        }
+        if (state.tasks.some(task => task.id === taskId(original)))
+            throw new Error('task ya existente: recovery requiere un registro rechazado sin aplicar');
+        if (state.appliedRequests[replacementId] !== undefined || Object.values(state.appliedRequests).some(item => item.idempotencyKey === replacement.idempotencyKey && item.payloadDigest !== (0, requests_1.digestOf)(replacement.payload))) {
+            throw new Error('request correctiva ya tiene outcome o idempotencyKey conflictiva');
+        }
+        const candidate = structuredClone(state);
+        (0, apply_1.applyRequestToState)(candidate, replacement, (0, requests_1.digestOf)(replacement.payload), repoRoot);
+        if (candidate.appliedRequests[replacementId]?.outcome !== 'applied' || !candidate.tasks.some(task => task.id === taskId(replacement))) {
+            throw new Error('request correctiva no fue aplicada');
+        }
+        const target = candidate.requestProblems.find(item => item.kind === 'rejected' && item.file === originalFile);
+        target.requestId = rejectedId;
+        target.taskId = taskId(original);
+        target.generationToken = original.generationToken;
+        target.resolution = { replacementRequestId: replacementId, replacementPayloadDigest: (0, requests_1.digestOf)(replacement.payload), reason: input.reason,
+            generationToken: input.generationToken, at: new Date().toISOString() };
+        if (input.resume) {
+            mayResume(candidate);
+            candidate.custodyDecisions ??= [];
+            candidate.custodyDecisions.push({ at: new Date().toISOString(), decision: 'resume', reason: input.reason, generationToken: input.generationToken });
+            candidate.cycle.status = 'IN_PROGRESS';
+            candidate.cycle.blockedReason = undefined;
+            for (const generation of candidate.generations)
+                if (generation.state === 'active' || generation.state === 'controller-suspected-stall')
+                    generation.state = 'superseded';
+        }
+        (0, store_1.writeJournal)(repoRoot, branch, candidate);
+        fs_1.default.rmSync(replacementFile);
+        (0, atomic_file_1.fsyncDirSync)(dir);
+        (0, store_1.appendEvent)(repoRoot, branch, { kind: 'request-recovered', rejectedRequestId: rejectedId, replacementRequestId: replacementId, generationToken: input.generationToken, resumed: input.resume });
+    }
+    finally {
+        (0, lock_1.releaseLock)(repoRoot, lock);
+    }
+}