agentic-workflow-manager 9.11.12 → 9.12.1

package/dist/src/core/model-policy/event-store.js

@@ -0,0 +1,221 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.claudeAgentIdDigest = claudeAgentIdDigest;
+exports.readStoredEventReceipt = readStoredEventReceipt;
+exports.publishCodexObservation = publishCodexObservation;
+exports.publishClaudeObservation = publishClaudeObservation;
+const crypto_1 = require("crypto");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const paths_1 = require("../paths");
+const json_1 = require("../plan/json");
+const native_bridge_1 = require("../secure-fs/native-bridge");
+const capabilities_1 = require("./capabilities");
+const capabilities_v2_1 = require("./capabilities-v2");
+const native_codex_1 = require("./native-codex");
+const native_claude_1 = require("./native-claude");
+const native_claude_transcript_1 = require("./native-claude-transcript");
+const native_claude_agent_definition_1 = require("./native-claude-agent-definition");
+const machine_key_1 = require("./machine-key");
+const validate_1 = require("./validate");
+const MAX_RECEIPT_BYTES = 256 * 1024;
+const SEAL_DOMAIN = 'AWM routing-capabilities/v2 local receipt\0';
+const CLAUDE_AGENT_DOMAIN = 'AWM Claude native agent ID/v1\0';
+function claudeAgentIdDigest(agentId, key) {
+    if (typeof agentId !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(agentId) || !Buffer.isBuffer(key) || key.length !== 32)
+        throw new Error('Claude native agent identity is invalid');
+    return (0, crypto_1.createHmac)('sha256', key).update(CLAUDE_AGENT_DOMAIN).update(agentId).digest('hex');
+}
+function receiptPath(runtime) {
+    const valid = (0, capabilities_1.validateRuntimeKey)(runtime);
+    return path_1.default.join((0, paths_1.awmHome)(), 'routing-capabilities-v2', valid.target, `${valid.kind}.json`);
+}
+function safeParents(file, create) {
+    const chain = [];
+    for (let dir = path_1.default.dirname(file);; dir = path_1.default.dirname(dir)) {
+        chain.unshift(dir);
+        if (dir === path_1.default.dirname(dir))
+            break;
+    }
+    for (const dir of chain) {
+        try {
+            const stat = fs_1.default.lstatSync(dir);
+            if (!stat.isDirectory() || stat.isSymbolicLink())
+                throw new Error('event receipt has unsafe or symlinked ancestor');
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT' || !create)
+                throw error;
+            fs_1.default.mkdirSync(dir, { mode: 0o700 });
+        }
+    }
+}
+function readFile(file) {
+    try {
+        safeParents(file, false);
+        const stat = fs_1.default.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            throw new Error('event receipt is unsafe or symlinked');
+        const bytes = native_bridge_1.secureFs.readRegularFile(file, MAX_RECEIPT_BYTES).bytes;
+        const parsed = (0, json_1.parseJsonNoDuplicate)(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            throw new Error('event receipt envelope is invalid');
+        const envelope = parsed;
+        if (Object.keys(envelope).length !== 2 || !Object.keys(envelope).every(key => ['receipt', 'mac'].includes(key))
+            || typeof envelope.mac !== 'string' || !/^[a-f0-9]{64}$/.test(envelope.mac))
+            throw new Error('event receipt seal is invalid');
+        const receipt = (0, capabilities_v2_1.validateEventReceipt)(envelope.receipt);
+        const key = (0, machine_key_1.readMachineKey)((0, paths_1.awmHome)());
+        if (!key)
+            throw new Error('event receipt machine key is missing');
+        const expected = seal(receipt, key);
+        if (!(0, crypto_1.timingSafeEqual)(Buffer.from(envelope.mac, 'hex'), Buffer.from(expected, 'hex')))
+            throw new Error('event receipt seal does not match this machine');
+        return receipt;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+function seal(receipt, key) {
+    return (0, crypto_1.createHmac)('sha256', key).update(SEAL_DOMAIN).update(JSON.stringify(receipt)).digest('hex');
+}
+function readStoredEventReceipt(runtime) {
+    try {
+        const value = readFile(receiptPath(runtime));
+        return value === null ? { state: 'absent' } : { state: 'present', receipt: value };
+    }
+    catch (error) {
+        return { state: 'invalid', reason: error.message.slice(0, 4096) };
+    }
+}
+function sameSelection(left, right) {
+    return left.selector.kind === right.selector.kind && left.selector.id === right.selector.id && left.effort.kind === right.effort.kind
+        && (left.effort.kind !== 'explicit' || left.effort.value === right.effort.value);
+}
+function sameScope(left, right) {
+    return left.runtime.target === right.runtime.target && left.runtime.kind === right.runtime.kind && left.runtime.version === right.runtime.version
+        && left.runtime.accountScopeDigest === right.runtime.accountScopeDigest && left.binaryDigest === right.binaryDigest && left.configDigest === right.configDigest;
+}
+/** The only Codex v2 writer takes a native observation, never a candidate JSON.
+ * The CLI must call the native adapter and derive scope from this machine. */
+function publishCodexObservation(input) {
+    if (!input || typeof input !== 'object' || !(0, native_codex_1.isNativeCodexChildObservation)(input.observation))
+        throw new Error('Codex native provenance is required');
+    if (input.observation.provenance !== 'codex-app-server-thread-read'
+        || input.observation.nativeDispatchVerified !== true || input.observation.acceptedSelectionVerified !== true
+        || input.observation.actualModelVerified !== false || input.observation.tokenUsage !== 'unknown')
+        throw new Error('Codex native selection is unverified');
+    const scope = input.scope;
+    if (!scope || scope.runtime?.target !== 'codex' || input.observation.childRuntimeVersion !== scope.runtime.version)
+        throw new Error('Codex native runtime version mismatch');
+    if (!sameSelection(input.observation.configuredSelection, input.expectedSelection))
+        throw new Error('Codex observed selection does not match approved selection');
+    (0, validate_1.assertDigest)(input.mappingDigest, 'mappingDigest');
+    if (!(input.now instanceof Date) || !Number.isFinite(input.now.getTime()))
+        throw new Error('event receipt clock is invalid');
+    const recordedAt = input.now.toISOString();
+    if (typeof input.observation.observedAt !== 'string' || !Number.isFinite(Date.parse(input.observation.observedAt)))
+        throw new Error('Codex native turn timestamp is unavailable');
+    const eventDigest = (0, crypto_1.createHash)('sha256').update(JSON.stringify({ parent: input.observation.parentThreadId, child: input.observation.childThreadId,
+        turn: input.observation.turnId, selection: input.observation.configuredSelection, runtimeVersion: input.observation.childRuntimeVersion,
+        accountScopeDigest: scope.runtime.accountScopeDigest })).digest('hex');
+    const claim = { selection: input.expectedSelection, mappingDigest: input.mappingDigest, eventDigest,
+        source: 'codex-turn-context', observedAt: input.observation.observedAt, actualModel: 'unverified', tokenUsage: 'unknown' };
+    const initial = (0, capabilities_v2_1.validateEventReceipt)({ schema: 'routing-capabilities/v2', ...scope, recordedAt, claims: [claim] });
+    const file = receiptPath(initial.runtime);
+    const root = (0, paths_1.awmHome)();
+    return native_bridge_1.secureFs.withProjectLease(root, () => {
+        const key = (0, machine_key_1.readMachineKey)(root);
+        if (!key)
+            throw new Error('event receipt machine key is missing; run explicit setup');
+        safeParents(file, true);
+        const current = readFile(file);
+        if (current && sameScope(current, scope)) {
+            const prior = current.claims.find(item => sameSelection(item.selection, claim.selection));
+            if (prior && prior.mappingDigest === claim.mappingDigest && prior.eventDigest === claim.eventDigest)
+                return current;
+        }
+        const ageMs = input.now.getTime() - Date.parse(input.observation.observedAt);
+        if (ageMs < 0 || ageMs > 15 * 60 * 1000)
+            throw new Error('Codex native turn is not fresh for enrollment');
+        const claims = current && sameScope(current, scope) ? current.claims.filter(item => !sameSelection(item.selection, claim.selection)).concat(claim) : [claim];
+        const next = (0, capabilities_v2_1.validateEventReceipt)({ ...initial, claims });
+        const destination = path_1.default.relative(root, file).split(path_1.default.sep).join('/');
+        const bytes = Buffer.from(`${JSON.stringify({ receipt: next, mac: seal(next, key) }, null, 2)}\n`);
+        if (current) {
+            const observed = native_bridge_1.secureFs.readRegularFile(file, MAX_RECEIPT_BYTES);
+            native_bridge_1.secureFs.writeProjectTransaction(root, destination, bytes, { mode: 'replace', createParents: false, expected: observed.bytes, expectedIdentity: observed.identity });
+        }
+        else
+            native_bridge_1.secureFs.writeProjectTransaction(root, destination, bytes, { mode: 'create', createParents: false });
+        return next;
+    });
+}
+/** Bind a native hook pair to the provider's assistant transcript. The transcript
+ * reports a model, not effective effort or paid usage, so only runtime-default
+ * effort may be enrolled and usage remains unknown. */
+function publishClaudeObservation(input) {
+    if (!input || typeof input !== 'object' || !(0, native_claude_1.isNativeClaudeSubagentLifecycle)(input.lifecycle)
+        || !(0, native_claude_transcript_1.isNativeClaudeTranscriptObservation)(input.transcript))
+        throw new Error('Claude native hook and transcript provenance are required');
+    if (!(0, native_claude_agent_definition_1.isNativeClaudeAgentDeclaration)(input.declaredAgent) || input.declaredAgent.agentType !== input.lifecycle.agentType
+        || input.declaredAgent.modelId !== input.transcript.actualModel)
+        throw new Error('Claude declared agent model provenance is required');
+    if (input.scope?.runtime?.target !== 'claude-code' || input.lifecycle.agentId !== input.transcript.agentId
+        || input.expectedSelection?.selector?.kind !== 'model' || input.expectedSelection.selector.id !== input.transcript.actualModel
+        || input.expectedSelection.effort.kind !== 'runtime-default')
+        throw new Error('Claude native selection does not match approved model or effort');
+    (0, validate_1.assertDigest)(input.mappingDigest, 'mappingDigest');
+    if (!(input.now instanceof Date) || !Number.isFinite(input.now.getTime()))
+        throw new Error('event receipt clock is invalid');
+    const eventDigest = (0, crypto_1.createHash)('sha256').update(JSON.stringify({ session: input.lifecycle.sessionId, agent: input.lifecycle.agentId,
+        transcriptDigest: input.transcript.evidenceDigest, accountScopeDigest: input.scope.runtime.accountScopeDigest })).digest('hex');
+    const nativeAgentIdDigest = claudeAgentIdDigest(input.lifecycle.agentId, (0, machine_key_1.readMachineKey)((0, paths_1.awmHome)()));
+    const nativeEvent = { nativeAgentIdDigest, eventDigest, observedAt: input.transcript.observedAt };
+    const claim = { selection: input.expectedSelection, mappingDigest: input.mappingDigest, eventDigest,
+        nativeAgentType: input.lifecycle.agentType,
+        nativeAgentIdDigest, nativeEvents: [nativeEvent],
+        source: 'claude-assistant-transcript', observedAt: input.transcript.observedAt,
+        actualModel: { id: input.transcript.actualModel, evidenceDigest: input.transcript.evidenceDigest }, tokenUsage: 'unknown' };
+    const initial = (0, capabilities_v2_1.validateEventReceipt)({ schema: 'routing-capabilities/v2', ...input.scope, recordedAt: input.now.toISOString(), claims: [claim] });
+    const file = receiptPath(initial.runtime);
+    const root = (0, paths_1.awmHome)();
+    return native_bridge_1.secureFs.withProjectLease(root, () => {
+        const key = (0, machine_key_1.readMachineKey)(root);
+        if (!key)
+            throw new Error('event receipt machine key is missing; run explicit setup');
+        safeParents(file, true);
+        const current = readFile(file);
+        if (current && sameScope(current, input.scope)) {
+            const prior = current.claims.find(item => sameSelection(item.selection, claim.selection));
+            if (prior && prior.mappingDigest === claim.mappingDigest && prior.eventDigest === claim.eventDigest)
+                return current;
+        }
+        const ageMs = input.now.getTime() - Date.parse(input.transcript.observedAt);
+        if (!Number.isFinite(ageMs) || ageMs < 0 || ageMs > 15 * 60 * 1000)
+            throw new Error('Claude native transcript is not fresh for enrollment');
+        const prior = current && sameScope(current, input.scope) ? current.claims.find(item => sameSelection(item.selection, claim.selection)) : undefined;
+        const previousEvents = prior?.nativeEvents ?? (prior?.nativeAgentIdDigest ? [{ nativeAgentIdDigest: prior.nativeAgentIdDigest,
+                eventDigest: prior.eventDigest, observedAt: prior.observedAt }] : []);
+        const recentEvents = previousEvents.filter(item => input.now.getTime() - Date.parse(item.observedAt) <= 15 * 60_000
+            && item.nativeAgentIdDigest !== nativeAgentIdDigest && item.eventDigest !== eventDigest);
+        const mergedClaim = { ...claim, nativeEvents: recentEvents.concat(nativeEvent).slice(-64) };
+        const claims = current && sameScope(current, input.scope) ? current.claims.filter(item => !sameSelection(item.selection, claim.selection)).concat(mergedClaim) : [mergedClaim];
+        const next = (0, capabilities_v2_1.validateEventReceipt)({ ...initial, claims });
+        const destination = path_1.default.relative(root, file).split(path_1.default.sep).join('/');
+        const bytes = Buffer.from(`${JSON.stringify({ receipt: next, mac: seal(next, key) }, null, 2)}\n`);
+        if (current) {
+            const observed = native_bridge_1.secureFs.readRegularFile(file, MAX_RECEIPT_BYTES);
+            native_bridge_1.secureFs.writeProjectTransaction(root, destination, bytes, { mode: 'replace', createParents: false, expected: observed.bytes, expectedIdentity: observed.identity });
+        }
+        else
+            native_bridge_1.secureFs.writeProjectTransaction(root, destination, bytes, { mode: 'create', createParents: false });
+        return next;
+    });
+}

package/dist/src/core/model-policy/hook-diagnostics.js

@@ -0,0 +1,94 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recordRoutingHookStatus = recordRoutingHookStatus;
+exports.readRoutingHookStatus = readRoutingHookStatus;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const paths_1 = require("../paths");
+const json_1 = require("../plan/json");
+const native_bridge_1 = require("../secure-fs/native-bridge");
+const fresh = () => ({ schema: 'routing-hook-status/v1', start: { count: 0 }, stop: { count: 0 } });
+function target() { return path_1.default.join((0, paths_1.awmHome)(), 'routing-hook-status.json'); }
+function safeParents(file) {
+    const chain = [];
+    for (let dir = path_1.default.dirname(file);; dir = path_1.default.dirname(dir)) {
+        chain.unshift(dir);
+        if (dir === path_1.default.dirname(dir))
+            break;
+    }
+    for (const dir of chain) {
+        const stat = fs_1.default.lstatSync(dir);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            throw new Error('routing hook status has an unsafe ancestor');
+    }
+}
+function read() {
+    const file = target();
+    safeParents(file);
+    let stat;
+    try {
+        stat = fs_1.default.lstatSync(file);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { status: fresh(), observed: null };
+        throw error;
+    }
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error('routing hook status is unsafe');
+    const observed = native_bridge_1.secureFs.readRegularFile(file, 8192);
+    const value = (0, json_1.parseJsonNoDuplicate)(new TextDecoder('utf-8', { fatal: true }).decode(observed.bytes));
+    if (!value || value.schema !== 'routing-hook-status/v1' || !value.start || !value.stop
+        || !Number.isSafeInteger(value.start.count) || !Number.isSafeInteger(value.stop.count)
+        || value.start.count < 0 || value.stop.count < 0)
+        throw new Error('routing hook status is corrupt');
+    return { status: value, observed };
+}
+/** Failure is a redacted code, never provider payload or an exception string.
+ * Returns true only for a newly alertable failure episode. */
+function recordRoutingHookStatus(phase, result, now = new Date()) {
+    if (phase !== 'start' && phase !== 'stop')
+        throw new Error('routing hook phase is invalid');
+    if (result !== 'success' && !/^[A-Z0-9_]{3,64}$/.test(result))
+        throw new Error('routing hook reason code is invalid');
+    if (!(now instanceof Date) || !Number.isFinite(now.getTime()))
+        throw new Error('routing hook clock is invalid');
+    const root = (0, paths_1.awmHome)();
+    return native_bridge_1.secureFs.withProjectLease(root, () => {
+        const { status, observed } = read();
+        const item = status[phase];
+        const pending = item.lastFailureAt !== undefined && (item.lastSuccessAt === undefined || item.lastFailureAt > item.lastSuccessAt);
+        const alert = result !== 'success' && (!pending || item.reasonCode !== result);
+        if (result === 'success')
+            item.lastSuccessAt = now.toISOString();
+        else {
+            item.lastFailureAt = now.toISOString();
+            item.reasonCode = result;
+            item.count += 1;
+        }
+        const bytes = Buffer.from(`${JSON.stringify(status)}\n`);
+        native_bridge_1.secureFs.writeProjectTransaction(root, path_1.default.basename(target()), bytes, observed
+            ? { mode: 'replace', createParents: false, expected: observed.bytes, expectedIdentity: observed.identity }
+            : { mode: 'create', createParents: false });
+        return alert;
+    });
+}
+function readRoutingHookStatus() {
+    try {
+        const { status, observed } = read();
+        if (!observed)
+            return { state: 'absent' };
+        const failures = ['start', 'stop'].flatMap(phase => {
+            const item = status[phase];
+            return item.lastFailureAt && item.reasonCode && (!item.lastSuccessAt || item.lastFailureAt > item.lastSuccessAt)
+                ? [{ phase, reasonCode: item.reasonCode, count: item.count }] : [];
+        });
+        return failures.length ? { state: 'failed', failures } : { state: 'healthy' };
+    }
+    catch {
+        return { state: 'invalid' };
+    }
+}

package/dist/src/core/model-policy/journal.js

@@ -21,6 +21,26 @@ function canonical(value) { if (Array.isArray(value))
 function digest(value) { return crypto_1.default.createHash('sha256').update(canonical(value)).digest('hex'); }
 function clone(state) { const next = structuredClone(state); if (!Array.isArray(next.routingAttempts))
     next.routingAttempts = []; return next; }
+function noteRoutingIncident(state, target, selection, reasonCode, at, fallback, sameObligationAlreadyCounted = false) {
+    if (!/^[A-Z0-9_]{3,64}$/.test(reasonCode))
+        throw new Error('routing incident reason is invalid');
+    state.routingIncidents ??= [];
+    // One incident/alert per selected route in a run even if later failures
+    // refine the cause; retain the first actionable reason.
+    const id = crypto_1.default.createHash('sha256').update(`${state.journalId}\0${state.cycle.startedAt}\0${target}\0${canonical(selection)}`).digest('hex').slice(0, 24);
+    const prior = state.routingIncidents.find(item => item.id === id);
+    if (prior) {
+        prior.affectedObligations += Number(!sameObligationAlreadyCounted);
+        prior.fallbackCount += Number(fallback);
+        prior.blockedCount += Number(!fallback);
+        prior.lastAt = at;
+        return;
+    }
+    if (state.routingIncidents.length >= 4096)
+        throw new Error('routing incident limit exhausted');
+    state.routingIncidents.push({ schema: 'routing-incident/v1', id, runStartedAt: state.cycle.startedAt, target, selection: structuredClone(selection), reasonCode,
+        firstAt: at, lastAt: at, affectedObligations: 1, fallbackCount: Number(fallback), blockedCount: Number(!fallback), alertState: 'pending' });
+}
 function reserveRoutingAttempt(state, input, now) {
     assertTimestamp(now);
     if (!(0, types_1.isWellFormedState)(state) || !input || typeof input.obligationId !== 'string' || input.obligationId.length === 0 || input.obligationId.length > 128 || typeof input.lineageId !== 'string' || input.lineageId.length === 0 || input.lineageId.length > 128 || !(0, types_1.isRoutingEnvelope)(input.envelope) || !/^[a-f0-9]{64}$/.test(input.fingerprint))
@@ -35,34 +55,62 @@ function reserveRoutingAttempt(state, input, now) {
     next.implementationLineages ??= [];
     const priorLineage = next.implementationLineages.find(lineage => lineage.id === input.lineageId);
     if (input.envelope.role === 'implementer' && priorLineage === undefined)
-        next.implementationLineages.push({ id: input.lineageId, obligationId: input.obligationId, sliceId: input.envelope.sliceId, planDigest: input.envelope.planDigest, executionDigest: input.envelope.executionDigest, initialProfile: input.envelope.requestedProfile, initialEffort: input.envelope.resolved.effort.kind === 'explicit' && input.envelope.resolved.effort.value === 'high' ? 'high' : 'medium', attempts: 0 });
+        next.implementationLineages.push({ id: input.lineageId, obligationId: input.obligationId, sliceId: input.envelope.sliceId, planDigest: input.envelope.planDigest, executionDigest: input.envelope.executionDigest, initialProfile: input.envelope.requestedProfile, initialEffort: input.envelope.resolved.effort.kind === 'runtime-default' ? 'runtime-default' : input.envelope.resolved.effort.value === 'high' ? 'high' : 'medium', attempts: 0 });
     if (priorLineage !== undefined && (priorLineage.obligationId !== input.obligationId || priorLineage.planDigest !== input.envelope.planDigest || priorLineage.executionDigest !== input.envelope.executionDigest || priorLineage.sliceId !== input.envelope.sliceId || priorLineage.initialProfile !== input.envelope.requestedProfile))
         throw new Error('routing lineage binding mismatch');
     const attempts = next.routingAttempts.filter(item => item.lineageId === input.lineageId && item.envelope.role === 'implementer');
     if (input.envelope.role === 'implementer' && attempts.length >= 3)
         throw new Error('routing implementation budget exhausted');
+    const fullFallback = input.envelope.role === 'implementer' && input.envelope.effectiveProfile === 'full';
+    if (fullFallback && attempts.some(item => item.envelope.effectiveProfile === 'full'))
+        throw new Error('routing full fallback cannot recursively retry a lineage');
+    if (fullFallback && attempts.length > 0) {
+        const previous = attempts[attempts.length - 1];
+        if (previous.state !== 'blocked' || previous.verdict !== 'inconclusive'
+            || !['PROVIDER_REJECTED', 'SELECTION_MISMATCH', 'PROVENANCE_MISSING'].includes(previous.reasonCode ?? ''))
+            throw new Error('routing full fallback requires a terminal native routing failure');
+    }
     if (input.envelope.role === 'implementer') {
         const initial = input.envelope.requestedProfile;
         if (initial === 'full')
             throw new Error('routing implementer profile is invalid');
-        const expected = resolveLineageEscalation(next, input.lineageId, initial);
-        const actualEffort = input.envelope.resolved.effort.kind === 'explicit' ? input.envelope.resolved.effort.value : 'runtime-default';
-        const judgmentHighAfterIntegration = expected.profile === 'judgment' && expected.effort === 'medium' && actualEffort === 'high' && attempts.length > 0 && attempts[attempts.length - 1].envelope.effectiveProfile === 'integration';
-        if (input.envelope.effectiveProfile !== expected.profile || (actualEffort !== expected.effort && !judgmentHighAfterIntegration))
-            throw new Error('routing effective escalation mismatch');
+        if (!fullFallback) {
+            const expected = resolveLineageEscalation(next, input.lineageId, initial);
+            const actualEffort = input.envelope.resolved.effort.kind === 'explicit' ? input.envelope.resolved.effort.value : 'runtime-default';
+            const judgmentHighAfterIntegration = expected.profile === 'judgment' && expected.effort === 'medium' && actualEffort === 'high' && attempts.length > 0 && attempts[attempts.length - 1].envelope.effectiveProfile === 'integration';
+            if (input.envelope.effectiveProfile !== expected.profile || (actualEffort !== expected.effort && !judgmentHighAfterIntegration))
+                throw new Error('routing effective escalation mismatch');
+        }
     }
     const approval = input.approval?.();
     if (!approval)
         throw new Error('routing reservation requires current approval');
-    const selectionInput = { role: input.envelope.role, requestedProfile: input.envelope.role === 'implementer' ? input.envelope.effectiveProfile : 'full', runtime: (0, capabilities_1.validateRuntimeKey)(input.envelope.runtime), policy: approval.policy, capabilities: approval.capabilities, now: approval.checkedAt };
+    if ((approval.eventReceipt || approval.eventScope) && (!approval.eventReceipt || !approval.eventScope || canonical(approval.eventScope.runtime) !== canonical(input.envelope.runtime)))
+        throw new Error('routing reservation event scope mismatch');
+    const selectionInput = { role: input.envelope.role, requestedProfile: input.envelope.role === 'implementer' ? input.envelope.effectiveProfile : 'full', runtime: (0, capabilities_1.validateRuntimeKey)(input.envelope.runtime), policy: approval.policy, capabilities: approval.capabilities, eventReceipt: approval.eventReceipt, eventScope: approval.eventScope, circuitIncidents: next.routingIncidents, now: approval.checkedAt };
+    const mapping = approval.policy?.content.mappings.find(item => item.target === input.envelope.runtime.target && item.runtimeKind === input.envelope.runtime.kind);
+    const optimizedSelection = mapping && input.envelope.role === 'implementer' && input.envelope.requestedProfile !== 'full' ? mapping.profiles[input.envelope.requestedProfile] : undefined;
+    const circuitReason = optimizedSelection && next.routingIncidents?.find(item => item.target === input.envelope.runtime.target && canonical(item.selection) === canonical(optimizedSelection)
+        && ['PROVIDER_REJECTED', 'SELECTION_MISMATCH', 'PROVENANCE_MISSING'].includes(item.reasonCode))?.reasonCode;
     const resolved = input.envelope.role === 'implementer' && input.envelope.effectiveProfile === 'judgment' && input.envelope.resolved.effort.kind === 'explicit' && input.envelope.resolved.effort.value === 'high'
         ? (0, resolve_1.resolveEscalatedSelection)({ ...selectionInput, role: 'implementer', requestedProfile: 'judgment', expectedEffort: 'high' })
-        : (0, resolve_1.resolveSelection)(selectionInput);
-    if (resolved.state !== 'resolved' || resolved.effectiveProfile !== input.envelope.effectiveProfile || canonical(resolved.selection) !== canonical(input.envelope.resolved) || resolved.policyDigest !== input.envelope.policyDigest || resolved.capabilityDigest !== input.envelope.capabilityDigest || resolved.outcome !== input.envelope.outcome || canonical(resolved.unavailableEvidence) !== canonical(input.envelope.unavailableEvidence))
+        : approval.eventReceipt && approval.eventScope
+            ? (0, resolve_1.resolveEventWithFallback)({ role: selectionInput.role, requestedProfile: input.envelope.role === 'implementer' ? fullFallback ? input.envelope.requestedProfile : input.envelope.effectiveProfile : 'full', policy: approval.policy, receipt: approval.eventReceipt, scope: approval.eventScope, now: approval.checkedAt, circuitReason })
+            : (0, resolve_1.resolveSelection)(selectionInput);
+    if (fullFallback && (resolved.state !== 'resolved' || !resolved.fallbackReason))
+        throw new Error('routing full fallback requires a current optimized-route failure');
+    if (resolved.state !== 'resolved' || resolved.effectiveProfile !== input.envelope.effectiveProfile || canonical(resolved.selection) !== canonical(input.envelope.resolved) || resolved.policyDigest !== input.envelope.policyDigest || resolved.capabilityDigest !== input.envelope.capabilityDigest || resolved.outcome !== input.envelope.outcome || canonical(resolved.unavailableEvidence) !== canonical(input.envelope.unavailableEvidence) || resolved.nativeAgentType !== input.envelope.nativeAgentType)
         throw new Error('routing reservation approval mismatch');
     const attempt = attempts.length + 1;
     const id = `route-${crypto_1.default.createHash('sha256').update(`${input.lineageId}\0${attempt}\0${envelopeDigest}\0${input.fingerprint}`).digest('hex').slice(0, 24)}`;
-    next.routingAttempts.push({ schema: 'routing-attempt/v1', id, obligationId: input.obligationId, lineageId: input.lineageId, attempt, envelope: structuredClone(input.envelope), envelopeDigest, fingerprint: input.fingerprint, state: 'reserved' });
+    next.routingAttempts.push({ schema: 'routing-attempt/v1', id, obligationId: input.obligationId, lineageId: input.lineageId, attempt, envelope: structuredClone(input.envelope), envelopeDigest, fingerprint: input.fingerprint, state: 'reserved', reservedAt: now, ...(approval.eventReceipt ? { nativeEvidenceRequired: true } : {}), ...(resolved.state === 'resolved' && resolved.fallbackReason ? { reasonCode: resolved.fallbackReason } : {}) });
+    if (resolved.state === 'resolved' && resolved.fallbackReason) {
+        const mapping = approval.policy?.content.mappings.find(item => item.target === input.envelope.runtime.target && item.runtimeKind === input.envelope.runtime.kind);
+        if (!mapping || input.envelope.role !== 'implementer' || input.envelope.requestedProfile === 'full')
+            throw new Error('routing fallback lacks approved optimized selection');
+        const sameObligationAlreadyCounted = attempts.some(item => item.obligationId === input.obligationId && item.state === 'blocked' && item.reasonCode === resolved.fallbackReason);
+        noteRoutingIncident(next, input.envelope.runtime.target, mapping.profiles[input.envelope.requestedProfile], resolved.fallbackReason, now, true, sameObligationAlreadyCounted);
+    }
     const lineage = next.implementationLineages.find(candidate => candidate.id === input.lineageId);
     if (lineage !== undefined)
         lineage.attempts = attempt;
@@ -70,25 +118,53 @@ function reserveRoutingAttempt(state, input, now) {
 }
 function observeRoutingAttempt(state, input, now) {
     assertTimestamp(now);
-    if (!(0, types_1.isWellFormedState)(state) || !input || typeof input.attemptId !== 'string' || input.attemptId.length === 0 || typeof input.nativeAgentId !== 'string' || input.nativeAgentId.length === 0 || input.nativeAgentId.length > 128 || (input.observed !== undefined && !(0, types_1.isRoutingSelection)(input.observed)) || (input.unavailableReason !== undefined && (typeof input.unavailableReason !== 'string' || input.unavailableReason.length === 0 || input.unavailableReason.length > 128)))
+    if (!(0, types_1.isWellFormedState)(state) || !input || typeof input.attemptId !== 'string' || input.attemptId.length === 0 || typeof input.nativeAgentId !== 'string' || input.nativeAgentId.length === 0 || input.nativeAgentId.length > 128 || (input.observed !== undefined && !(0, types_1.isRoutingSelection)(input.observed)) || (input.observedBackendModel !== undefined && (typeof input.observedBackendModel !== 'string' || input.observedBackendModel.length === 0 || input.observedBackendModel.length > 128 || input.nativeEventDigest === undefined)) || (input.unavailableReason !== undefined && (typeof input.unavailableReason !== 'string' || input.unavailableReason.length === 0 || input.unavailableReason.length > 128)))
         throw new Error('routing observation is invalid');
     const next = clone(state);
     const attempt = next.routingAttempts.find(item => item.id === input.attemptId);
     if (!attempt)
         throw new Error('routing attempt is unknown');
     if (attempt.state === 'active') {
-        if (attempt.nativeAgentId === input.nativeAgentId && canonical(attempt.observed) === canonical(input.observed))
+        if (attempt.nativeAgentId === input.nativeAgentId && canonical(attempt.observed) === canonical(input.observed) && attempt.observedBackendModel === input.observedBackendModel)
+            return next;
+        throw new Error('routing observation is immutable');
+    }
+    if (attempt.state === 'blocked') {
+        const mismatch = input.observed !== undefined && canonical(input.observed) !== canonical(attempt.envelope.resolved);
+        const reason = mismatch ? 'SELECTION_MISMATCH' : ['PROVIDER_REJECTED', 'PROVENANCE_MISSING'].includes(input.unavailableReason ?? '') ? input.unavailableReason : undefined;
+        if (attempt.nativeAgentId === input.nativeAgentId && canonical(attempt.observed) === canonical(input.observed) && reason === attempt.reasonCode)
             return next;
         throw new Error('routing observation is immutable');
     }
     if (attempt.state !== 'reserved')
         throw new Error('routing attempt cannot be observed');
-    attempt.state = 'active';
+    if (input.nativeEventDigest !== undefined) {
+        if (!/^[a-f0-9]{64}$/.test(input.nativeEventDigest) || next.routingAttempts.some(item => item.id !== attempt.id
+            && (item.nativeEventDigest === input.nativeEventDigest || (item.nativeEvidenceRequired && item.nativeAgentId === input.nativeAgentId))))
+            throw new Error('native routing event was already consumed');
+        attempt.nativeEventDigest = input.nativeEventDigest;
+    }
     attempt.nativeAgentId = input.nativeAgentId;
     if (input.observed)
         attempt.observed = structuredClone(input.observed);
-    if (input.unavailableReason)
-        attempt.reasonCode = input.unavailableReason;
+    if (input.observedBackendModel)
+        attempt.observedBackendModel = input.observedBackendModel;
+    const mismatch = input.observed !== undefined && canonical(input.observed) !== canonical(attempt.envelope.resolved);
+    const unavailable = input.unavailableReason === 'PROVIDER_REJECTED' || input.unavailableReason === 'PROVENANCE_MISSING';
+    if (mismatch || unavailable) {
+        const reason = mismatch ? 'SELECTION_MISMATCH' : input.unavailableReason;
+        attempt.state = 'blocked';
+        attempt.verdict = 'inconclusive';
+        attempt.reasonCode = reason;
+        // Agent-supplied negative evidence may conservatively trip a breaker,
+        // but never mints or renews native capability evidence.
+        noteRoutingIncident(next, attempt.envelope.runtime.target, attempt.envelope.resolved, reason, now, false);
+    }
+    else {
+        attempt.state = 'active';
+        if (input.unavailableReason)
+            attempt.reasonCode = input.unavailableReason;
+    }
     return next;
 }
 /** Computes, but never persists, the only permitted implementation retry.
@@ -105,12 +181,19 @@ function resolveLineageEscalation(state, lineageId, initial) {
         return { profile: initial, effort: lineage?.initialEffort ?? 'medium' };
     }
     const last = attempts[attempts.length - 1];
+    if (last.envelope.effectiveProfile === 'full')
+        throw new Error('routing full fallback is exhausted');
+    if (last.verdict === 'inconclusive' && ['PROVIDER_REJECTED', 'SELECTION_MISMATCH', 'PROVENANCE_MISSING'].includes(last.reasonCode ?? '')) {
+        const lineage = state.implementationLineages?.find(candidate => candidate.id === lineageId);
+        return { profile: initial, effort: lineage?.initialEffort ?? 'medium' };
+    }
     if (last.verdict !== 'fail')
         throw new Error('routing lineage advances only after a terminal failed verdict');
+    const routeEffort = last.envelope.resolved.effort.kind === 'runtime-default' ? 'runtime-default' : 'medium';
     if (last.envelope.effectiveProfile === 'mechanical')
-        return { profile: 'integration', effort: 'medium' };
+        return { profile: 'integration', effort: routeEffort };
     if (last.envelope.effectiveProfile === 'integration')
-        return { profile: 'judgment', effort: 'medium' };
+        return { profile: 'judgment', effort: routeEffort };
     if (last.envelope.effectiveProfile === 'judgment' && last.envelope.resolved.effort.kind === 'explicit' && last.envelope.resolved.effort.value === 'medium')
         return { profile: 'judgment', effort: 'high' };
     throw new Error('routing lineage escalation exhausted');
@@ -121,6 +204,7 @@ function routingReport(state) {
     const attempts = state.routingAttempts ?? [];
     const plannedByRole = {};
     const actualByRole = {};
+    const nativeReconciledByRole = {};
     const byState = {};
     const unavailable = {};
     const verdicts = {};
@@ -128,11 +212,22 @@ function routingReport(state) {
         plannedByRole[attempt.envelope.role] = (plannedByRole[attempt.envelope.role] ?? 0) + 1;
         if (attempt.nativeAgentId !== undefined)
             actualByRole[attempt.envelope.role] = (actualByRole[attempt.envelope.role] ?? 0) + 1;
+        if (attempt.nativeEventDigest !== undefined && ['active', 'complete'].includes(attempt.state))
+            nativeReconciledByRole[attempt.envelope.role] = (nativeReconciledByRole[attempt.envelope.role] ?? 0) + 1;
         byState[attempt.state] = (byState[attempt.state] ?? 0) + 1;
         for (const reason of attempt.envelope.unavailableEvidence)
             unavailable[reason] = (unavailable[reason] ?? 0) + 1;
+        if (attempt.envelope.role === 'implementer' && attempt.envelope.effectiveProfile === 'full' && attempt.reasonCode)
+            unavailable[attempt.reasonCode] = (unavailable[attempt.reasonCode] ?? 0) + 1;
         if (attempt.verdict !== undefined)
             verdicts[attempt.verdict] = (verdicts[attempt.verdict] ?? 0) + 1;
     }
-    return { schema: 'routing-report/v1', attempts: attempts.length, plannedByRole, actualByRole, byState, retries: attempts.filter((attempt) => attempt.attempt > 1).length, fallbacks: attempts.filter((attempt) => attempt.envelope.outcome === 'degraded').length, unavailable, verdicts, administrativeRepairs: attempts.filter((attempt) => attempt.administrativeRepair === true).length };
+    const incidents = (state.routingIncidents ?? []).map(({ reasonCode, selection, affectedObligations, fallbackCount, blockedCount, alertState }) => ({ reasonCode, selection, affectedObligations, fallbackCount, blockedCount, alertState }));
+    const reconciled = Object.values(nativeReconciledByRole).reduce((total, count) => total + count, 0);
+    const selections = attempts.map(attempt => ({ role: attempt.envelope.role, configured: attempt.envelope.resolved,
+        accepted: attempt.nativeEventDigest && ['active', 'complete'].includes(attempt.state) ? attempt.observed ?? 'unknown' : 'unknown',
+        backendModel: attempt.nativeEventDigest && ['active', 'complete'].includes(attempt.state) ? attempt.observedBackendModel ?? 'unknown' : 'unknown' }));
+    return { schema: 'routing-report/v1', attempts: attempts.length, plannedByRole, actualByRole, selections,
+        ...(reconciled ? { nativeReconciledByRole } : {}), byState, retries: attempts.filter((attempt) => attempt.attempt > 1).length, fallbacks: attempts.filter((attempt) => attempt.envelope.role === 'implementer' && attempt.envelope.effectiveProfile === 'full' && attempt.envelope.requestedProfile !== 'full').length, unavailable, verdicts, administrativeRepairs: attempts.filter((attempt) => attempt.administrativeRepair === true).length,
+        measurement: { configuredSelection: 'envelope-recorded', acceptedSelection: reconciled === 0 ? 'not-natively-reconciled' : reconciled === attempts.length ? 'natively-reconciled' : 'partially-reconciled', backendModel: selections.some(item => item.backendModel !== 'unknown') ? 'provider-reported' : 'unknown', tokenUsage: 'unknown', savings: 'unverified' }, ...(incidents.length ? { incidents } : {}) };
 }

package/dist/src/core/model-policy/local-claude-scope.js

@@ -0,0 +1,41 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queryLocalClaudeScope = queryLocalClaudeScope;
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const paths_1 = require("../paths");
+const machine_key_1 = require("./machine-key");
+const native_claude_machine_1 = require("./native-claude-machine");
+const native_claude_config_1 = require("./native-claude-config");
+const native_runtime_1 = require("./native-runtime");
+const hook_diagnostics_1 = require("./hook-diagnostics");
+/** Read-only local facts; no model inference or machine-key creation. */
+async function queryLocalClaudeScope(cwd, runtimeKind, deps = {}) {
+    if (typeof cwd !== 'string' || !path_1.default.isAbsolute(cwd) || cwd.includes('\0') || typeof runtimeKind !== 'string'
+        || !/^[a-z0-9][a-z0-9_-]{0,127}$/.test(runtimeKind))
+        throw new Error('local Claude scope input is invalid');
+    const hooks = (deps.readRoutingHookStatus ?? hook_diagnostics_1.readRoutingHookStatus)();
+    if (deps.requireHookHealthy !== false && (hooks.state === 'failed' || hooks.state === 'invalid'))
+        return { state: 'unverified', reason: 'HOOK_CAPTURE_FAILED' };
+    const key = (deps.readMachineKey ?? machine_key_1.readMachineKey)((0, paths_1.awmHome)());
+    if (!key)
+        return { state: 'unverified', reason: 'MACHINE_KEY_MISSING' };
+    try {
+        const [auth, runtime] = await Promise.all([
+            (deps.queryClaudeAuthStatus ?? native_claude_machine_1.queryClaudeAuthStatus)({ command: 'claude', args: ['auth', 'status'], timeoutMs: 10000, key }),
+            (deps.queryRuntimeExecutable ?? native_runtime_1.queryRuntimeExecutable)({ command: 'claude', args: ['--version'], timeoutMs: 10000 }),
+        ]);
+        if (auth.accountState !== 'identified' || !auth.accountScopeDigest)
+            return { state: 'unverified', reason: 'ACCOUNT_UNVERIFIED' };
+        const configDigest = (deps.readClaudeModelConfigDigest ?? native_claude_config_1.readClaudeModelConfigDigest)({ cwd, configDir: path_1.default.resolve(process.env.CLAUDE_CONFIG_DIR ?? path_1.default.join(os_1.default.homedir(), '.claude')),
+            key, environment: process.env });
+        return { state: 'current', scope: { runtime: { target: 'claude-code', kind: runtimeKind, version: runtime.version,
+                    accountScopeDigest: auth.accountScopeDigest }, binaryDigest: runtime.binaryDigest, configDigest } };
+    }
+    catch {
+        return { state: 'unverified', reason: 'NATIVE_QUERY_FAILED' };
+    }
+}

package/dist/src/core/model-policy/local-codex-scope.js

@@ -0,0 +1,33 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queryLocalCodexScope = queryLocalCodexScope;
+const path_1 = __importDefault(require("path"));
+const paths_1 = require("../paths");
+const machine_key_1 = require("./machine-key");
+const native_codex_machine_1 = require("./native-codex-machine");
+const native_runtime_1 = require("./native-runtime");
+/** Read-only, no-token local facts for the same cwd as the routed work. */
+async function queryLocalCodexScope(cwd, runtimeKind, deps = {}) {
+    if (typeof cwd !== 'string' || !path_1.default.isAbsolute(cwd) || cwd.includes('\0') || typeof runtimeKind !== 'string'
+        || !/^[a-z0-9][a-z0-9_-]{0,127}$/.test(runtimeKind))
+        throw new Error('local Codex scope input is invalid');
+    const key = (deps.readMachineKey ?? machine_key_1.readMachineKey)((0, paths_1.awmHome)());
+    if (!key)
+        return { state: 'unverified', reason: 'MACHINE_KEY_MISSING' };
+    try {
+        const [machine, executable] = await Promise.all([
+            (deps.queryCodexMachineFacts ?? native_codex_machine_1.queryCodexMachineFacts)({ command: 'codex', args: ['app-server', '--stdio'], timeoutMs: 10000, cwd, key }),
+            (deps.queryRuntimeExecutable ?? native_runtime_1.queryRuntimeExecutable)({ command: 'codex', args: ['--version'], timeoutMs: 10000 }),
+        ]);
+        if (machine.accountState !== 'identified' || !machine.accountScopeDigest)
+            return { state: 'unverified', reason: 'ACCOUNT_UNVERIFIED' };
+        return { state: 'current', scope: { runtime: { target: 'codex', kind: runtimeKind, version: executable.version,
+                    accountScopeDigest: machine.accountScopeDigest }, binaryDigest: executable.binaryDigest, configDigest: machine.configDigest } };
+    }
+    catch {
+        return { state: 'unverified', reason: 'NATIVE_QUERY_FAILED' };
+    }
+}

package/dist/src/core/model-policy/local-event-scope.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queryLocalEventScope = queryLocalEventScope;
+const local_claude_scope_1 = require("./local-claude-scope");
+const local_codex_scope_1 = require("./local-codex-scope");
+/** Provider-specific, read-only scope discovery for dispatch-time drift checks. */
+async function queryLocalEventScope(cwd, target, runtimeKind) {
+    if (target === 'codex')
+        return (0, local_codex_scope_1.queryLocalCodexScope)(cwd, runtimeKind);
+    if (target === 'claude-code')
+        return (0, local_claude_scope_1.queryLocalClaudeScope)(cwd, runtimeKind);
+    return { state: 'unverified', reason: 'PROVIDER_UNSUPPORTED' };
+}