agentic-workflow-manager 9.11.4 → 9.11.6

package/dist/src/commands/sensors/compatibility/discovery.js

@@ -202,12 +202,26 @@ function discoverProjectEvidence(cwd, pack, dependencies = {}) {
                 if (variant.command?.resolution === 'path' && variant.command.packageManager === variant.requirements.tool)
                     pathTools.add(variant.requirements.tool);
             }
+    // Un proyecto que todavia no declaro su gestor —sin lockfile y sin campo
+    // `packageManager`— es el caso de un `package.json` recien creado, y era el
+    // unico caso en que un gestor presente en PATH quedaba estructuralmente
+    // invisible: sin lockfile, `packageManager` es null, la rama de PATH no se
+    // toma, y `npm` se buscaba en `node_modules/npm` (donde jamas esta). El
+    // sensor `test` del pack js-ts reportaba `tool-not-found` con `npm test`
+    // perfectamente ejecutable, y en desatendido eso bloquea la admision (#147).
+    //
+    // Cuando el proyecto NO declaro gestor se sondean todos los gestores del
+    // pack presentes en PATH y la prioridad de las variantes elige: no se
+    // adivina un gestor por defecto, se miden los que hay. Cuando SI lo declaro
+    // —lockfile o campo— solo se sondea ese: un proyecto pnpm nunca resuelve por
+    // npm. Un conflicto de lockfiles no habilita nada: sigue sin sondearse.
+    const undeterminedPackageManager = packageManager === null && lockManagers.size === 0;
     const environment = pythonEnvironment(root);
     const sitePackages = environment ? pythonSitePackages(root, environment.rootParts, targetPlatform) : [];
     const toolVersions = {};
     const toolProvenance = {};
     for (const tool of [...tools].sort()) {
-        if (pathTools.has(tool) && packageManager === tool) {
+        if (pathTools.has(tool) && (packageManager === tool || undeterminedPackageManager)) {
             // Discovery/status is read-only. A PATH executable is not inspected or
             // executed here; callers that already possess trusted runtime evidence
             // may inject it explicitly for an execution-time compatibility check.

package/dist/src/commands/sensors/init.js

@@ -139,16 +139,6 @@ function buildManifest(pack, existing, registryRoot, cwd = process.cwd()) {
     }
     return { pack, sensors };
 }
-/** Pack names present as directories under `<registryRoot>/sensor-packs/`, sorted. */
-function availablePacks(registryRoot) {
-    const packsDir = path_1.default.join(registryRoot, 'sensor-packs');
-    if (!fs_1.default.existsSync(packsDir) || !fs_1.default.statSync(packsDir).isDirectory())
-        return [];
-    return fs_1.default.readdirSync(packsDir, { withFileTypes: true })
-        .filter(e => e.isDirectory())
-        .map(e => e.name)
-        .sort();
-}
 async function initSensors(opts = {}) {
     const cwd = opts.cwd ?? process.cwd();
     const detectionCwd = opts.packageRoot ? path_1.default.resolve(cwd, opts.packageRoot) : cwd;

package/dist/src/commands/sensors/prepare.js

@@ -116,8 +116,23 @@ function prepareV2Sensor(input) {
     if (!input || typeof input !== 'object' || !input.sensor || typeof input.name !== 'string' || input.name === '')
         throw new Error('v2 preparation input is invalid');
     const requestedScope = resolveRequestedScope(input.requestedScope);
-    if (!input.liveState || input.liveState.state !== 'certified')
+    // Un sensor se ejecuta cuando la herramienta ESTA y funciona aca: `certified` es
+    // la version exacta que el registry congelo, y `compatible-unverified` es una que
+    // cae dentro del rango operativo declarado por el pack y cuyo probe coincidio
+    // (resolve.ts: 'operational-range-and-probe'). Antes solo corria la primera, asi
+    // que una maquina con npm 10.9.7 frente a un certifiedRange `=10.8.3` no ejecutaba
+    // el sensor: quedaba `inconclusive`, el veredicto global caia a `not_certified` y
+    // la admision desatendida bloqueaba. No se puede pinear el gestor de paquetes que
+    // viene con Node, asi que eso bloqueaba en cualquier maquina sin que nada estuviera
+    // mal — se saltaba la verificacion justamente donde mas hace falta.
+    //
+    // La diferencia no se pierde: viaja en `certification` hasta el resultado, asi que
+    // un veredicto producido por una version no congelada dice que lo fue. Lo que NO
+    // se ejecuta sigue sin ejecutarse: `incompatible` (fuera de rango), `missing-tool`
+    // (no esta), `unverifiable` (el probe no coincidio) y `not-applicable`.
+    if (!input.liveState || (input.liveState.state !== 'certified' && input.liveState.state !== 'compatible-unverified')) {
         return v2Synthetic(input, input.liveState ? `${input.liveState.state}: ${input.liveState.reason}` : 'compatibility could not be revalidated');
+    }
     if (input.liveState.variantId !== input.sensor.variantId)
         return v2Synthetic(input, `variant-drift: manifest ${input.sensor.variantId}, live ${input.liveState.variantId ?? 'none'}; run \`awm sensors init\``);
     const variant = input.liveSensor?.variants.find(candidate => candidate.id === input.sensor.variantId);
@@ -125,6 +140,7 @@ function prepareV2Sensor(input) {
         return v2Synthetic(input, 'variant-drift: selected live variant has no command; run `awm sensors init`');
     const common = {
         name: input.name,
+        certification: input.liveState.state === 'certified' ? 'certified' : 'operational-unverified',
         ...(variant.formatter ? { formatter: variant.formatter } : {}),
         ...timeout(input.projectTimeout ?? input.sensor.timeout, input.packTimeout ?? input.liveSensor?.timeout, input.sensor.fast ?? input.liveSensor?.fast ?? false),
         requestedScope,

package/dist/src/commands/sensors/result.js

@@ -77,6 +77,7 @@ function interpretResult(prepared, raw) {
     const execution = executionEvidence(prepared, raw.elapsedMs);
     const withEvidence = (result) => ({
         ...result,
+        ...(prepared.certification ? { certification: prepared.certification } : {}),
         ...(prepared.effectiveScope === 'changed' ? { scope: 'changed' } : {}),
         execution,
     });

package/dist/src/commands/sensors/run.js

@@ -29,7 +29,6 @@ const project_1 = require("./project");
 // Sensor JSON output can be several MB on large repos (e.g. `eslint --format json`
 // with thousands of findings). A 1MB cap killed the child with SIGTERM when
 // exceeded — which previously surfaced as a false "timeout".
-const MAX_BUFFER = 64 * 1024 * 1024;
 /** Hard ceiling on parallel sensors: past this, they only contend for the same cores. */
 const MAX_CONCURRENCY = 4;
 const READ_ONLY_MAX_ENTRIES = 250_000;

package/dist/src/commands/watch/supervisor.js

@@ -5,6 +5,9 @@ exports.routingFacts = routingFacts;
 exports.defaultDispatchAdmission = defaultDispatchAdmission;
 exports.admissionForConfig = admissionForConfig;
 exports.runSupervisorLoop = runSupervisorLoop;
+// Loop foreground (R4.4/R4.5): tick = apply -> collect/spawn -> stall -> gate.
+// COMPLETE exige gate verde (que exige cero vivos): drenaje ANTES de declarar.
+// Custodia BLOCKED: el loop sigue, el lock NO se libera, nada se mata.
 const store_1 = require("../../core/journal/store");
 const fingerprint_1 = require("../../core/journal/fingerprint");
 const validate_1 = require("../../core/plan/validate");

package/dist/src/core/admission/index.js

@@ -66,18 +66,35 @@ function routingForecast(plan, routing) {
         throw new Error('routing controllerCount must be 0 or 1');
     return { kind: 'routing-v1', slices: plan.manifest.slices.length, implementerProfiles: profiles, roles: { 'specification-reviewer': plan.manifest.slices.length, 'code-quality-reviewer': plan.manifest.slices.length, 'final-reviewer': 1, 'track-a-qa': 1, documentation: 1, retro: 1, finishing: 1 }, trackB: qa === undefined ? { state: 'unavailable', lowerBound: 1 } : { state: 'known', count: qa.length }, controller: routing.controllerCount === undefined ? { state: 'unavailable', lowerBound: 0 } : { state: 'known', count: routing.controllerCount } };
 }
+/**
+ * El gate mide los CONTRATOS CONSUMIDOS: los registries de donde salen las skills
+ * y los packs que el plan va a ejecutar. Uno atrasado sí invalida el ciclo, porque
+ * el plan se validó contra otra versión de ese contrato.
+ *
+ * El CLI propio queda FUERA del bloqueo y se reporta en `cliCurrentness`. Estaba
+ * adentro, y como cada merge a `main` publica, cualquier máquina quedaba bloqueada
+ * minutos después de un release: `ADMISSION_CURRENTNESS_BLOCKED: stale: cli` con
+ * todo lo demás en verde. Eso no protegía nada — el binario que corre es el que
+ * corre, y que npm tenga uno más nuevo no cambia lo que este proceso ya es — y
+ * convertía un aviso ("hay update") en una detención del ciclo. El aviso sigue
+ * existiendo: lo imprime el update-check y ahora viaja también en el reporte.
+ */
 function currentness(report, consumedRegistryComponents) {
-    const consumed = new Set(['cli', ...consumedRegistryComponents]);
-    const present = new Set(report.components.map(component => component.component));
+    const consumed = new Set(consumedRegistryComponents);
+    const present = new Map(report.components.map(component => [component.component, component.status]));
+    const cliStatus = present.get('cli');
+    const cli = cliStatus === 'current' ? 'current'
+        : cliStatus === 'stale' || cliStatus === 'pinned-behind' ? 'stale'
+            : 'unverifiable';
     const missing = [...consumed].filter(component => !present.has(component));
     if (missing.length > 0)
-        return { status: 'unverifiable', diagnostics: [diagnostic('ADMISSION_CURRENTNESS_MISSING_COMPONENT', `Currentness evidence is missing consumed components: ${missing.join(', ')}.`)] };
+        return { status: 'unverifiable', cli, diagnostics: [diagnostic('ADMISSION_CURRENTNESS_MISSING_COMPONENT', `Currentness evidence is missing consumed components: ${missing.join(', ')}.`)] };
     const failed = report.components.filter(component => consumed.has(component.component) && component.status !== 'current');
     if (failed.length === 0)
-        return { status: 'current', diagnostics: [] };
+        return { status: 'current', cli, diagnostics: [] };
     const names = failed.map(component => component.component).join(', ');
     const status = failed.some(component => component.status === 'unverifiable') ? 'unverifiable' : 'stale';
-    return { status, diagnostics: [diagnostic('ADMISSION_CURRENTNESS_BLOCKED', `Consumed contract currentness is ${status}: ${names}.`)] };
+    return { status, cli, diagnostics: [diagnostic('ADMISSION_CURRENTNESS_BLOCKED', `Consumed contract currentness is ${status}: ${names}.`)] };
 }
 function sensorVerdict(report) { return report.overall === 'not_certified' ? 'not-certified' : report.overall === 'pass' ? 'pass' : 'fail'; }
 function journalStatus(input, plan) {
@@ -102,6 +119,7 @@ function journalStatus(input, plan) {
 const PLAN_STATES = new Set(['valid', 'migration-required', 'invalid', 'unsupported']);
 const JOURNALS = new Set(['not-required', 'current', 'missing', 'corrupt', 'stale']);
 const CURRENTNESS = new Set(['current', 'stale', 'unverifiable', 'not-checked']);
+const CLI_CURRENTNESS = new Set(['current', 'stale', 'unverifiable', 'not-checked']);
 const SENSORS = new Set(['pass', 'fail', 'not-certified', 'not-required']);
 const CAPABILITY = new Set(['supported', 'unsupported', 'unverified']);
 function invalidAdmission() { throw new Error('admission returned an invalid report'); }
@@ -146,6 +164,8 @@ function sanitizeAdmissionReport(report) {
     const value = report;
     if ((value.state !== 'admitted' && value.state !== 'blocked') || !PLAN_STATES.has(value.planState) || !JOURNALS.has(value.journal) || !CURRENTNESS.has(value.currentness) || !SENSORS.has(value.sensors) || !validDiagnostics(value.diagnostics))
         invalidAdmission();
+    if (value.cliCurrentness !== undefined && !CLI_CURRENTNESS.has(value.cliCurrentness))
+        invalidAdmission();
     if (value.planDigest !== undefined && (typeof value.planDigest !== 'string' || !/^[a-f0-9]{64}$/.test(value.planDigest)))
         invalidAdmission();
     if (value.executionMode !== undefined && value.executionMode !== 'interactivo' && value.executionMode !== 'desatendido')
@@ -190,28 +210,30 @@ async function admitPlan(input) {
     const mode = input.executionMode ?? (manifestMode === 'desatendido' ? 'desatendido' : 'interactivo');
     if (mode !== 'interactivo' && mode !== 'desatendido')
         return blocked(input, [diagnostic('ADMISSION_EXECUTION_MODE_INVALID', 'Execution mode must be interactivo or desatendido.')], { planDigest: plan.planDigest, provider, executionMode: 'interactivo' });
+    let cliCurrentness = 'not-checked';
     if (input.requireCurrent) {
         if (input.provenance !== 'proven')
             return blocked(input, [diagnostic('ADMISSION_CURRENTNESS_PROVENANCE_REQUIRED', 'Consumed registry contracts cannot be proven from validated plan sources.')], { planDigest: plan.planDigest, provider, executionMode: mode, currentness: 'unverifiable' });
         if (!input.currentness)
             return blocked(input, [diagnostic('ADMISSION_CURRENTNESS_REQUIRED', 'Currentness evidence was required but not supplied.')], { planDigest: plan.planDigest, provider, executionMode: mode });
         const gate = currentness(input.currentness, input.consumedRegistryComponents ?? []);
+        cliCurrentness = gate.cli;
         if (gate.diagnostics.length)
-            return blocked(input, gate.diagnostics, { planDigest: plan.planDigest, provider, executionMode: mode, currentness: gate.status });
+            return blocked(input, gate.diagnostics, { planDigest: plan.planDigest, provider, executionMode: mode, currentness: gate.status, cliCurrentness });
         if (input.compatibilityDiagnostics?.length)
-            return blocked(input, input.compatibilityDiagnostics, { planDigest: plan.planDigest, provider, executionMode: mode, currentness: 'unverifiable' });
+            return blocked(input, input.compatibilityDiagnostics, { planDigest: plan.planDigest, provider, executionMode: mode, currentness: 'unverifiable', cliCurrentness });
     }
     if (input.verifySensors) {
         if (!input.sensors)
-            return blocked(input, [diagnostic('ADMISSION_SENSORS_REQUIRED', 'Sensor evidence was required but not supplied.')], { planDigest: plan.planDigest, provider, executionMode: mode, currentness: input.requireCurrent ? 'current' : 'not-checked' });
+            return blocked(input, [diagnostic('ADMISSION_SENSORS_REQUIRED', 'Sensor evidence was required but not supplied.')], { planDigest: plan.planDigest, provider, executionMode: mode, currentness: input.requireCurrent ? 'current' : 'not-checked', cliCurrentness });
         const sensors = sensorVerdict(input.sensors);
         if (sensors !== 'pass')
-            return blocked(input, [diagnostic('ADMISSION_SENSORS_BLOCKED', `Sensor verdict is ${sensors}.`)], { planDigest: plan.planDigest, provider, executionMode: mode, currentness: input.requireCurrent ? 'current' : 'not-checked', sensors });
+            return blocked(input, [diagnostic('ADMISSION_SENSORS_BLOCKED', `Sensor verdict is ${sensors}.`)], { planDigest: plan.planDigest, provider, executionMode: mode, currentness: input.requireCurrent ? 'current' : 'not-checked', cliCurrentness, sensors });
     }
     if (mode === 'desatendido') {
         const journal = journalStatus(input, plan);
         if (journal !== 'current')
-            return blocked(input, [diagnostic('ADMISSION_JOURNAL_BINDING_REQUIRED', 'Unattended execution requires a healthy schema-2 journal binding for this exact plan; run watch --init --plan.')], { planDigest: plan.planDigest, provider, executionMode: mode, journal, currentness: input.requireCurrent ? 'current' : 'not-checked', sensors: input.verifySensors ? 'pass' : 'not-required' });
+            return blocked(input, [diagnostic('ADMISSION_JOURNAL_BINDING_REQUIRED', 'Unattended execution requires a healthy schema-2 journal binding for this exact plan; run watch --init --plan.')], { planDigest: plan.planDigest, provider, executionMode: mode, journal, currentness: input.requireCurrent ? 'current' : 'not-checked', cliCurrentness, sensors: input.verifySensors ? 'pass' : 'not-required' });
         const capabilities = unattendedCapabilities(provider, input.controllerAutonomy);
         const resolution = { outcome: capabilities.unattendedController === 'supported' ? 'native' : 'blocked', provider, capabilities, evidenceVersion: 'r1-v1', diagnostics: [] };
         if (resolution.outcome === 'blocked') {
@@ -222,38 +244,38 @@ async function admitPlan(input) {
             const reason = exports.PROVIDER_EXECUTION_CAPABILITIES[provider].unattendedController !== 'supported'
                 ? diagnostic('ADMISSION_CAPABILITY_UNVERIFIED', `Provider ${provider} has no verified unattended execution capability.`)
                 : diagnostic('ADMISSION_CONTROLLER_AUTONOMY_REQUIRED', `Unattended dispatch on ${provider} requires an explicit controller autonomy posture; without it the controller blocks on its first tool call.`);
-            return blocked(input, [reason], { planDigest: plan.planDigest, provider, executionMode: mode, journal, currentness: input.requireCurrent ? 'current' : 'not-checked', sensors: input.verifySensors ? 'pass' : 'not-required', capabilityResolution: resolution });
+            return blocked(input, [reason], { planDigest: plan.planDigest, provider, executionMode: mode, journal, currentness: input.requireCurrent ? 'current' : 'not-checked', cliCurrentness, sensors: input.verifySensors ? 'pass' : 'not-required', capabilityResolution: resolution });
         }
-        return completeAdmission(input, plan, provider, mode, journal, input.requireCurrent ? 'current' : 'not-checked', input.verifySensors ? 'pass' : 'not-required', resolution);
+        return completeAdmission(input, plan, provider, mode, journal, input.requireCurrent ? 'current' : 'not-checked', input.verifySensors ? 'pass' : 'not-required', resolution, cliCurrentness);
     }
     const capabilities = exports.PROVIDER_EXECUTION_CAPABILITIES[provider];
     const resolution = { outcome: capabilities.interactiveExecution === 'supported' ? 'native' : 'blocked', provider, capabilities, evidenceVersion: 'r1-v1', diagnostics: [] };
     if (resolution.outcome === 'blocked')
         return blocked(input, [diagnostic('ADMISSION_CAPABILITY_UNVERIFIED', `Provider ${provider} has no verified interactive execution capability.`)], { planDigest: plan.planDigest, provider, executionMode: mode, capabilityResolution: resolution });
-    return completeAdmission(input, plan, provider, mode, 'not-required', input.requireCurrent ? 'current' : 'not-checked', input.verifySensors ? 'pass' : 'not-required', resolution);
+    return completeAdmission(input, plan, provider, mode, 'not-required', input.requireCurrent ? 'current' : 'not-checked', input.verifySensors ? 'pass' : 'not-required', resolution, cliCurrentness);
 }
-function completeAdmission(input, plan, provider, executionMode, journal, currentness, sensors, capabilityResolution) {
+function completeAdmission(input, plan, provider, executionMode, journal, currentness, sensors, capabilityResolution, cliCurrentness = 'not-checked') {
     if (plan.schema === 'compact-slices/v1')
-        return { state: 'admitted', planState: 'valid', planDigest: plan.planDigest, provider, executionMode, journal, currentness, sensors, capabilityResolution, forecast: forecast(plan.manifest.slices.length), diagnostics: [] };
+        return { state: 'admitted', planState: 'valid', planDigest: plan.planDigest, provider, executionMode, journal, currentness, cliCurrentness, sensors, capabilityResolution, forecast: forecast(plan.manifest.slices.length), diagnostics: [] };
     const routing = input.routing ?? input.routingReader?.();
     if (!routing?.runtime || !routing.policy || !routing.capabilities)
-        return blocked(input, [diagnostic('ADMISSION_ROUTING_FACTS_REQUIRED', 'Compact v2 requires an approved policy, current capability receipt, and runtime identity.')], { planDigest: plan.planDigest, provider, executionMode, journal, currentness, sensors, capabilityResolution });
+        return blocked(input, [diagnostic('ADMISSION_ROUTING_FACTS_REQUIRED', 'Compact v2 requires an approved policy, current capability receipt, and runtime identity.')], { planDigest: plan.planDigest, provider, executionMode, journal, currentness, cliCurrentness, sensors, capabilityResolution });
     let runtime;
     try {
         runtime = (0, capabilities_1.validateRuntimeKey)(routing.runtime);
     }
     catch {
-        return blocked(input, [diagnostic('ADMISSION_ROUTING_RUNTIME_INVALID', 'Compact v2 routing runtime identity is invalid.')], { planDigest: plan.planDigest, provider, executionMode, journal, currentness, sensors, capabilityResolution });
+        return blocked(input, [diagnostic('ADMISSION_ROUTING_RUNTIME_INVALID', 'Compact v2 routing runtime identity is invalid.')], { planDigest: plan.planDigest, provider, executionMode, journal, currentness, cliCurrentness, sensors, capabilityResolution });
     }
     if (runtime.target !== provider)
-        return blocked(input, [diagnostic('ADMISSION_ROUTING_PROVIDER_MISMATCH', 'Compact v2 routing runtime target must exactly match the admitted provider.')], { planDigest: plan.planDigest, provider, executionMode, journal, currentness, sensors, capabilityResolution });
+        return blocked(input, [diagnostic('ADMISSION_ROUTING_PROVIDER_MISMATCH', 'Compact v2 routing runtime target must exactly match the admitted provider.')], { planDigest: plan.planDigest, provider, executionMode, journal, currentness, cliCurrentness, sensors, capabilityResolution });
     const now = routing.now ?? new Date();
     for (const slice of plan.manifest.slices) {
         const resolved = (0, resolve_1.resolveSelection)({ role: 'implementer', requestedProfile: slice.implementerProfile, policy: routing.policy, capabilities: routing.capabilities, runtime, now });
         if (resolved.state === 'blocked')
-            return blocked(input, resolved.diagnostics, { planDigest: plan.planDigest, provider, executionMode, journal, currentness, sensors, capabilityResolution });
+            return blocked(input, resolved.diagnostics, { planDigest: plan.planDigest, provider, executionMode, journal, currentness, cliCurrentness, sensors, capabilityResolution });
     }
-    return { state: 'admitted', planState: 'valid', planDigest: plan.planDigest, provider, executionMode, journal, currentness, sensors, capabilityResolution, forecast: forecast(plan.manifest.slices.length), routingForecast: routingForecast(plan, routing), diagnostics: [] };
+    return { state: 'admitted', planState: 'valid', planDigest: plan.planDigest, provider, executionMode, journal, currentness, cliCurrentness, sensors, capabilityResolution, forecast: forecast(plan.manifest.slices.length), routingForecast: routingForecast(plan, routing), diagnostics: [] };
 }
 // Structural exhaustiveness guard: adding an AgentTarget requires an explicit entry above.
 const capabilityTargets = providers_1.AGENT_TARGETS;

package/dist/src/core/artifact-name.js

@@ -50,7 +50,6 @@ function isSafeArtifactName(name) {
     if (/[. ]$/.test(value))
         return false;
     // Bytes de control y NUL: truncan la ruta a nivel syscall en algunos SO.
-    // eslint-disable-next-line no-control-regex
     if (/[\u0000-\u001f\u007f]/.test(value))
         return false;
     // Cualquier separador (de ambas plataformas) convierte esto en una ruta,

package/dist/src/core/cli-version.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CLI_PACKAGE_NAME = void 0;
+exports.packageRoot = packageRoot;
 exports.cliVersion = cliVersion;
 // src/core/cli-version.ts
 //
@@ -12,19 +13,35 @@ exports.cliVersion = cliVersion;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 exports.CLI_PACKAGE_NAME = 'agentic-workflow-manager';
-function cliVersion() {
-    let dir = __dirname;
+/**
+ * Directorio raíz del paquete del CLI — el que contiene SU package.json, no el
+ * del proyecto del usuario. Devuelve null si no aparece en la cadena de padres.
+ */
+function packageRoot(from = __dirname) {
+    let dir = from;
     for (let i = 0; i < 6; i++) {
         const p = path_1.default.join(dir, 'package.json');
         if (fs_1.default.existsSync(p)) {
             try {
                 const pkg = JSON.parse(fs_1.default.readFileSync(p, 'utf-8'));
-                if (pkg.name === exports.CLI_PACKAGE_NAME && typeof pkg.version === 'string')
-                    return pkg.version;
+                if (pkg.name === exports.CLI_PACKAGE_NAME)
+                    return dir;
             }
             catch { /* package.json ajeno o ilegible — seguir subiendo */ }
         }
         dir = path_1.default.dirname(dir);
     }
+    return null;
+}
+function cliVersion() {
+    const root = packageRoot();
+    if (!root)
+        return '0.0.0';
+    try {
+        const pkg = JSON.parse(fs_1.default.readFileSync(path_1.default.join(root, 'package.json'), 'utf-8'));
+        if (typeof pkg.version === 'string')
+            return pkg.version;
+    }
+    catch { /* ilegible entre el walk y la lectura */ }
     return '0.0.0';
 }

package/dist/src/core/dashboard/render-html.js

@@ -14,13 +14,6 @@ function sectionHtml(section, supplement = '') {
     const rows = section.items.length === 0 ? '<p class="empty">No observations reported.</p>' : `<table><thead><tr><th scope="col">Observation</th><th scope="col">State</th><th scope="col">Detail</th><th scope="col">Remediation</th></tr></thead><tbody>${section.items.map((item) => `<tr><td data-label="Observation">${escapeHtml(item.label)}</td><td data-label="State"><span class="state ${item.state}">${STATE_GLYPH[item.state]} ${STATE_TEXT[item.state]}</span></td><td data-label="Detail">${item.detail ? escapeHtml(item.detail) : '—'}</td><td data-label="Remediation">${item.remediation ? `<code>${escapeHtml(item.remediation)}</code>` : '—'}</td></tr>`).join('')}</tbody></table>`;
     return `<section id="${section.id}" aria-label="${title}"><header><h2>${title}</h2><span class="eyebrow">${escapeHtml(section.availability.replace('_', ' '))}</span></header><div class="section-body">${availability}${supplement}${rows}</div></section>`;
 }
-function diagnosticCards(items, attribute) {
-    const labels = ['installation', 'sensors', 'permissions'];
-    const cards = items.slice(0, 3).map((item, index) => `<li data-diagnostic-card="${labels[index] ?? 'diagnostic'}"><span class="state ${item.state}">${STATE_GLYPH[item.state]} ${STATE_TEXT[item.state]}</span><strong>${escapeHtml(item.label)}</strong><span>${item.detail ? escapeHtml(item.detail) : 'No additional detail'}</span></li>`).join('') || '<li><span class="state not_applicable">— Not applicable</span><strong>No machine observations</strong><span>Machine diagnostics are not available.</span></li>';
-    if (attribute === 'data-machine-diagnostics')
-        return `<section data-machine-diagnostics aria-labelledby="machine-diagnostics-heading"><header><h2 id="machine-diagnostics-heading">Machine diagnostics</h2></header><div class="section-body"><ul class="diagnostic-grid">${cards}</ul></div></section>`;
-    return `<div class="machine-preparation-strip" data-machine-preparation role="group" aria-labelledby="machine-preparation-heading"><h3 id="machine-preparation-heading">Preparación de máquina</h3><ul class="diagnostic-grid">${cards}</ul></div>`;
-}
 function machineBento(items) {
     const names = ['Instalación', 'Sensores globales', 'Persistencia'];
     return `<div class="machine-bento" data-machine-bento>${names.map((name, index) => {

package/dist/src/core/ledger/scan.js

@@ -136,7 +136,6 @@ function scanProjectLedgers(projectRoot, overrides = {}) {
             throw new Error('ledger archive directory escapes project root');
         directories.push({ directory: archive, archive: true });
     }
-    let filesSeen = 0;
     let linesSeen = 0;
     let entryLimitReached = false;
     let omittedEvidenceRefs = 0;
@@ -145,7 +144,6 @@ function scanProjectLedgers(projectRoot, overrides = {}) {
     for (const { isArchive, target } of collected.candidates.slice(0, limits.maxFiles)) {
         if (entryLimitReached)
             break;
-        filesSeen += 1;
         const stat = fs_1.default.lstatSync(target);
         if (stat.isSymbolicLink()) {
             skip('symlink-entry');

package/dist/src/core/miro.js

@@ -85,7 +85,6 @@ function computeLayout(storyMap) {
     let groupLeftX = PADDING; // running X from frame left edge
     for (let ai = 0; ai < activities.length; ai++) {
         const activity = activities[ai];
-        const numTaskCols = Math.max(1, activity.tasks.length);
         const groupWidth = activityGroupWidths[ai];
         // Activity card — spans its task columns
         const activityX = frameLeft + groupLeftX + groupWidth / 2;

package/dist/src/core/profile.js

@@ -27,7 +27,6 @@ function findProjectRoot(startDir) {
     catch {
         return null;
     }
-    // eslint-disable-next-line no-constant-condition
     while (true) {
         if (fs_1.default.existsSync(path_1.default.join(dir, '.git')) ||
             fs_1.default.existsSync(path_1.default.join(dir, 'package.json')) ||

package/dist/src/core/text.js

@@ -14,13 +14,13 @@ exports.sanitizeDeclaredField = sanitizeDeclaredField;
  *  `AGENTS.md` documenta bajo `defensive-guard-consistency`: endurecer una copia
  *  y dejar la otra atrás. */
 function stripControlChars(text) {
-    // eslint-disable-next-line no-control-regex -- necesitamos matchear C0 deliberadamente
+    // Necesitamos matchear C0 deliberadamente.
     return text.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '');
 }
 /** Keeps an untrusted diagnostic field on one terminal line, without changing
  * the whitespace policy for multiline public text or composed markdown. */
 function sanitizeDiagnosticText(text) {
-    // eslint-disable-next-line no-control-regex -- remove all C0/C1 controls, including terminal escape bytes
+    // Remove all C0/C1 controls, including terminal escape bytes.
     return text.replace(/\r\n|[\r\n\t\u2028\u2029]/g, ' ').replace(/[\x00-\x1f\x7f-\x9f]/g, '');
 }
 /**

package/dist/src/core/tracks/teardown.js

@@ -2,6 +2,31 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.decideTeardown = void 0;
 exports.worktreeOwnershipProven = worktreeOwnershipProven;
+// Task 13 (R4.2/R4.3/R4.6/R4.10/C2/C9): `decideTeardown` YA vive en
+// `protocol.ts` (autoridad única de decisión) — este módulo NO crea una
+// segunda copia (mismo criterio que `join.ts` con `decideJoinReconciliation`,
+// T11). `teardown.test.ts` prueba la matriz completa IMPORTANDO este
+// re-export, así que cualquier fix que descubra tiene que vivir en
+// `protocol.ts` (y volver a correr la exploración de T1 en el mismo commit)
+// para que el gate siga significando algo.
+//
+// Lo que SÍ aporta este archivo es la única prueba de OWNERSHIP real que
+// `tracks.ts` necesita antes de siquiera considerar `remove-owned-worktree`
+// como decisión segura: cuatro condiciones simultáneas (R4.10) —
+//   1. `teardownIntent.worktreePath` (snapshot durable tomado en
+//      `TEARDOWN_REQUESTED` -> `TEARDOWN_INTENT`) resuelve al MISMO target
+//      canónico que `ref.worktreePath` (el dato vivo del journal).
+//   2. `teardownIntent.branch === ref.branch`.
+//   3. `.awm/track.json` del worktree (`readDescriptor`) coincide en
+//      `planJournalId`/`trackId`/`fencingToken` — la identidad completa que
+//      el propio track escribió al armarse (Task 9), nunca reconstruida a
+//      mano.
+//   4. `git worktree list --porcelain` asocia ESE path exactamente con la
+//      branch determinista del track (`ownedWorktreeExists`, ya construida
+//      en Task 9 sobre el mismo criterio).
+// Cualquier chequeo indemostrable (no existe, no legible, mismatch, fallo de
+// git) es "ownership NO probado" — fail-closed (R4.6): el caller nunca
+// adopta ni borra lo que no pudo probar.
 const descriptor_1 = require("./descriptor");
 const paths_1 = require("../paths");
 const git_1 = require("./git");

package/dist/tests/commands/context.test.js

@@ -66,7 +66,7 @@ describe('awm context orchestrators', () => {
     it('sanea bytes de control antes de escribir a la terminal', () => {
         const hostil = { name: 'x\x1b[31m', appliesWhen: 'w\x07', terminatesTo: 't\x00' };
         const r = (0, context_1.runContextOrchestrators)(collected([hostil]), { json: false });
-        // eslint-disable-next-line no-control-regex -- verificamos la ausencia deliberada de C0
+        // Verificamos la ausencia deliberada de C0.
         expect(r.stdout).not.toMatch(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/);
     });
 });

package/dist/tests/commands/multi-agent-targeting.test.js

@@ -180,7 +180,7 @@ describe('multi-agent targeting (add/remove/sync/update/doctor)', () => {
         fs_1.default.writeFileSync(path_1.default.join(process.env.AWM_HOME, 'registries.json'), JSON.stringify([{ name: 'baseline', remote: 'https://example.com/baseline.git' }], null, 2));
         const { runUpdateCore } = require('../../src/commands/update');
         const syncRegistries = jest.fn(async () => [SYNCED_REGISTRY]);
-        const planReconciliation = jest.fn((o) => ({ operations: [], records: [], reports: [] }));
+        const planReconciliation = jest.fn((_operations) => ({ operations: [], records: [], reports: [] }));
         const applyInstallPlan = jest.fn(() => ({ installed: [], skipped: [], transactionId: 'tx', modifiedFiles: [] }));
         const resyncInstalledHooks = jest.fn(() => []);
         const outcome = await runUpdateCore({}, {

package/dist/tests/commands/plan/index.test.js

@@ -637,7 +637,11 @@ describe('plan admit Commander wiring', () => {
             process.exitCode = undefined;
         }
     });
-    it('does not run sensors after currentness blocks', async () => {
+    // Antes esta prueba afirmaba que un CLI stale bloqueaba y por eso los sensores no
+    // corrian. Eso era el defecto: cada publicacion de npm detenia cualquier maquina.
+    // La propiedad de orden —si el gate de contratos bloquea, los sensores no corren—
+    // sigue cubierta arriba con un registry consumido stale.
+    it('con el CLI stale admite y SI corre los sensores: la version publicada en npm no detiene el ciclo', async () => {
         const output = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
         const sensors = jest.fn();
         const program = new commander_1.Command();
@@ -651,8 +655,8 @@ describe('plan admit Commander wiring', () => {
         });
         try {
             await program.parseAsync(['node', 'awm', 'plan', 'admit', 'plan.md', '--provider', 'codex', '--cwd', repositoryRoot, '--require-current', '--verify-sensors', '--json']);
-            expect(sensors).not.toHaveBeenCalled();
-            expect(JSON.parse(String(output.mock.calls[0][0]))).toMatchObject({ state: 'blocked', currentness: 'stale', sensors: 'not-required' });
+            expect(sensors).toHaveBeenCalled();
+            expect(JSON.parse(String(output.mock.calls[0][0]))).toMatchObject({ currentness: 'current', cliCurrentness: 'stale' });
         }
         finally {
             output.mockRestore();

package/dist/tests/commands/preflight/preflight.test.js

@@ -25,7 +25,6 @@ jest.mock('../../../src/commands/sensors/run', () => ({
 jest.mock('../../../src/core/currentness/check', () => ({
     checkCurrentness: jest.fn(),
 }));
-const mockExecSync = child_process_1.execSync;
 const mockRunSensors = run_1.runSensors;
 const mockCheckCurrentness = check_1.checkCurrentness;
 /** Turn a tmpdir into a real git repo with (optionally) an `origin` remote. */

package/dist/tests/commands/process.test.js

@@ -79,7 +79,7 @@ describe('awm process show (texto)', () => {
         });
         const r = (0, process_1.runProcessShow)({ models: [hostile], diagnostics: [] }, 'mi-proceso', false);
         expect(r.code).toBe(0);
-        // eslint-disable-next-line no-control-regex -- necesitamos verificar la ausencia deliberada de C0
+        // Necesitamos verificar la ausencia deliberada de C0.
         expect(r.stdout).not.toMatch(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/);
         expect(r.stdout).toContain('Objetivo[31mmalicioso[0m.');
         expect(r.stdout).toContain('Uno]0;pwned');

package/dist/tests/commands/sensors/compatibility/discovery.test.js

@@ -31,6 +31,69 @@ describe('discoverProjectEvidence', () => {
             fs_1.default.rmSync(root, { recursive: true, force: true });
         }
     });
+    // #147: el gestor de paquetes en PATH era invisible sin lockfile, asi que el sensor
+    // `test` del pack js-ts reportaba tool-not-found con `npm test` ejecutable, y en
+    // desatendido eso bloquea la admision por sensores.
+    const packageManagerPack = {
+        schemaVersion: 2,
+        name: 'js-ts',
+        detects: ['package.json'],
+        sensors: {
+            test: {
+                applicability: { allFiles: ['package.json'] },
+                variants: [
+                    { id: 'npm-script', requirements: { tool: 'npm', configFiles: [] }, command: { executable: 'npm', resolution: 'path', packageManager: 'npm' } },
+                    { id: 'pnpm-script', requirements: { tool: 'pnpm', configFiles: [] }, command: { executable: 'pnpm', resolution: 'path', packageManager: 'pnpm' } },
+                ],
+            },
+        },
+    };
+    it('probes the package managers on PATH when the project declares none', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-discovery-pm-undeclared-'));
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), JSON.stringify({ scripts: { test: 'node -e ""' } }));
+            const evidence = (0, discovery_1.discoverProjectEvidence)(root, packageManagerPack, { pathToolVersion: tool => (tool === 'npm' ? '10.9.7' : null) });
+            expect(evidence.packageManager).toBeNull();
+            expect(evidence.toolVersions.npm).toBe('10.9.7');
+            expect(evidence.toolProvenance.npm).toBe('path');
+            // pnpm no esta en PATH: se sondeo y no se encontro, que es un hecho medido.
+            expect(evidence.toolVersions.pnpm).toBeNull();
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('probes only the declared package manager, so a pnpm project never resolves through npm', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-discovery-pm-declared-'));
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), JSON.stringify({ scripts: { test: 'node -e ""' } }));
+            fs_1.default.writeFileSync(path_1.default.join(root, 'pnpm-lock.yaml'), 'lockfileVersion: 9');
+            const probed = [];
+            const evidence = (0, discovery_1.discoverProjectEvidence)(root, packageManagerPack, { pathToolVersion: tool => { probed.push(tool); return '10.9.7'; } });
+            expect(evidence.packageManager).toBe('pnpm');
+            expect(probed).toEqual(['pnpm']);
+            expect(evidence.toolVersions.npm).toBeNull();
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('probes nothing when the lockfiles conflict: an undecided project is not an undeclared one', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-discovery-pm-conflict-'));
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), JSON.stringify({ scripts: { test: 'node -e ""' } }));
+            fs_1.default.writeFileSync(path_1.default.join(root, 'package-lock.json'), '{}');
+            fs_1.default.writeFileSync(path_1.default.join(root, 'pnpm-lock.yaml'), 'lockfileVersion: 9');
+            const probed = [];
+            const evidence = (0, discovery_1.discoverProjectEvidence)(root, packageManagerPack, { pathToolVersion: tool => { probed.push(tool); return '10.9.7'; } });
+            expect(evidence.packageManagerConflict).toBe(true);
+            expect(probed).toEqual([]);
+            expect(evidence.toolVersions.npm).toBeNull();
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
     it('includes pack and applicability markers when deciding whether a sensor applies', () => {
         const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-discovery-markers-'));
         try {

package/dist/tests/commands/sensors/exec.test.js

@@ -455,3 +455,29 @@ onPosix('runStructuredCommand — Python environments', () => {
         }
     });
 });
+// Ejecutar con una version que el registry no congelo es correcto — el sensor mide de
+// verdad — pero el resultado no puede presentarse como si la version estuviera
+// certificada. La distincion viaja hasta el veredicto o se pierde en silencio.
+const raw = (overrides = {}) => ({
+    stdout: '', stderr: '', code: 0, signal: null, timedOut: false, overflowed: false, elapsedMs: 5, ...overrides,
+});
+describe('interpretResult: procedencia de la version que produjo el veredicto', () => {
+    it('propaga operational-unverified a un pass', () => {
+        const result = (0, result_1.interpretResult)(sensor({ certification: 'operational-unverified' }), raw({ code: 0, elapsedMs: 12 }));
+        expect(result.status).toBe('pass');
+        expect(result.certification).toBe('operational-unverified');
+    });
+    it('propaga certified cuando corrio la version congelada', () => {
+        const result = (0, result_1.interpretResult)(sensor({ certification: 'certified' }), raw({ code: 0, elapsedMs: 12 }));
+        expect(result.certification).toBe('certified');
+    });
+    it('propaga la procedencia tambien cuando el sensor falla', () => {
+        const result = (0, result_1.interpretResult)(sensor({ certification: 'operational-unverified' }), raw({ code: 1, stdout: 'boom', elapsedMs: 9 }));
+        expect(result.status).not.toBe('pass');
+        expect(result.certification).toBe('operational-unverified');
+    });
+    it('no inventa procedencia cuando la preparacion no la declara', () => {
+        const result = (0, result_1.interpretResult)(sensor(), raw({ code: 0, elapsedMs: 3 }));
+        expect(result.certification).toBeUndefined();
+    });
+});

package/dist/tests/commands/sensors/prepare.test.js

@@ -86,3 +86,37 @@ describe('validateRunOptions', () => {
             .toThrow(/refusing to combine --changed with a baseline capture/);
     });
 });
+// El bloqueo que esto arregla: `compatible-unverified` significa que la herramienta esta,
+// cae en el rango operativo declarado por el pack y su probe coincidio — solo la version
+// exacta no es la que el registry congelo. Saltearla dejaba el veredicto en
+// `not_certified` y la admision desatendida bloqueada en cualquier maquina cuya version
+// no fuera el pin, que para el gestor que viene con Node es siempre.
+describe('prepareV2Sensor: que versiones ejecutan', () => {
+    const unverified = { state: 'compatible-unverified', reason: 'operational-range-and-probe', variantId: 'eslint-live', toolVersion: '10.9.7', runtimeVersion: '22.0.0', certifiedRange: '=10.8.3', evidence: [] };
+    it('ejecuta una version operativa que el registry no congelo, y lo declara', () => {
+        const prepared = (0, prepare_1.prepareV2Sensor)(v2Input({ liveState: unverified, requestedScope: 'full' }));
+        expect(prepared.syntheticStatus).toBeUndefined();
+        expect(prepared.command).toEqual({ kind: 'structured', value: { executable: 'live-eslint', resolution: 'path', args: ['.'] } });
+        expect(prepared.certification).toBe('operational-unverified');
+    });
+    it('marca como certificada la ejecucion con la version congelada', () => {
+        const prepared = (0, prepare_1.prepareV2Sensor)(v2Input({ requestedScope: 'full' }));
+        expect(prepared.syntheticStatus).toBeUndefined();
+        expect(prepared.certification).toBe('certified');
+    });
+    it.each([
+        ['incompatible', 'no-operational-variant'],
+        ['missing-tool', 'tool-not-found'],
+        ['unverifiable', 'probe-not-matched'],
+        ['not-applicable', 'sensor-not-applicable'],
+    ])('no ejecuta un sensor %s: sin herramienta o sin probe no hay nada que medir', (state, reason) => {
+        const prepared = (0, prepare_1.prepareV2Sensor)(v2Input({
+            liveState: { ...unverified, state, reason },
+            requestedScope: 'full',
+        }));
+        expect(prepared.syntheticStatus).toBe('inconclusive');
+        expect(prepared.syntheticReason).toBe(`${state}: ${reason}`);
+        expect(prepared.command).toBeUndefined();
+        expect(prepared.certification).toBeUndefined();
+    });
+});

package/dist/tests/commands/track/supervisor-wrapper-cli.test.js

@@ -25,9 +25,6 @@ class ExitSignal extends Error {
         this.code = code;
     }
 }
-function git(repo, args) {
-    return (0, child_process_1.execFileSync)('git', args, { cwd: repo, encoding: 'utf8' }).trim();
-}
 function gitInit(repo, branch) {
     (0, child_process_1.execFileSync)('git', ['-c', 'user.email=t@t.t', '-c', 'user.name=t', '-c', 'commit.gpgsign=false', 'init', '-q', '-b', branch], { cwd: repo });
     fs_1.default.writeFileSync(path_1.default.join(repo, 'f.txt'), 'x');

package/dist/tests/commands/watch/apply.test.js

@@ -126,7 +126,7 @@ describe('aplicacion transaccional de requests', () => {
         expect(Object.keys((0, store_1.readJournal)(repo, 'rama').state.jobs)).toHaveLength(1); // sin duplicados
     });
     test('register-entity CREA task con VerificationPlan y ReviewObligations; cycle-plan y dispatch (R1.4/R1.4b)', () => {
-        const request = (0, requests_1.emitRequest)(repo, 'rama', {
+        (0, requests_1.emitRequest)(repo, 'rama', {
             kind: 'register-entity', generationToken: 'g1', idempotencyKey: 'e1',
             payload: {
                 entity: 'task', taskId: 'T1', title: 'implementar',

package/dist/tests/core/admission/index.test.js

@@ -170,3 +170,50 @@ describe('admitPlan', () => {
         });
     });
 });
+// Un CLI atrasado detenia el ciclo entero: como cada merge a main publica, cualquier
+// maquina quedaba bloqueada minutos despues de un release con todo lo demas en verde.
+// El gate ahora mide los contratos consumidos (los registries, de donde salen las
+// skills y los packs que el plan ejecuta) y reporta el CLI sin bloquear.
+describe('admitPlan: el CLI atrasado avisa, los contratos consumidos bloquean', () => {
+    const component = (name, status) => ({
+        component: name, installed: '1.0.0', latest: status === 'current' ? '1.0.0' : '2.0.0',
+        channel: 'stable', source: 'npm', checkedAt: 'x', status, detail: 'd', remedy: 'r',
+    });
+    const admit = (components, consumed = ['registry:baseline']) => (0, admission_1.admitPlan)({
+        plan: valid, provider: 'codex', cwd: process.cwd(), enabledAgents: ['codex'],
+        requireCurrent: true, provenance: 'proven', consumedRegistryComponents: consumed,
+        currentness: { checkedAt: 'x', compatibility: { status: 'not-checked' }, components },
+    });
+    it('admite con el CLI stale cuando el registry consumido esta current', async () => {
+        const report = await admit([component('cli', 'stale'), component('registry:baseline', 'current')]);
+        expect(report.state).toBe('admitted');
+        expect(report.currentness).toBe('current');
+        expect(report.cliCurrentness).toBe('stale');
+    });
+    it('admite con el CLI inverificable: no haber podido consultar npm no es un defecto del ciclo', async () => {
+        const report = await admit([component('cli', 'unverifiable'), component('registry:baseline', 'current')]);
+        expect(report.state).toBe('admitted');
+        expect(report.cliCurrentness).toBe('unverifiable');
+    });
+    it('bloquea con un registry consumido stale, y ahi el CLI no lo salva', async () => {
+        const report = await admit([component('cli', 'current'), component('registry:baseline', 'stale')]);
+        expect(report.state).toBe('blocked');
+        expect(report.currentness).toBe('stale');
+        expect(report.diagnostics[0].code).toBe('ADMISSION_CURRENTNESS_BLOCKED');
+        expect(report.cliCurrentness).toBe('current');
+    });
+    it('bloquea cuando falta la evidencia de un registry consumido', async () => {
+        const report = await admit([component('cli', 'current')]);
+        expect(report.state).toBe('blocked');
+        expect(report.diagnostics[0].code).toBe('ADMISSION_CURRENTNESS_MISSING_COMPONENT');
+    });
+    it('reporta el CLI tambien cuando el bloqueo lo produjo otro gate', async () => {
+        const report = await (0, admission_1.admitPlan)({
+            plan: valid, provider: 'codex', cwd: process.cwd(), enabledAgents: ['codex'],
+            requireCurrent: true, provenance: 'proven', consumedRegistryComponents: [],
+            currentness: { checkedAt: 'x', compatibility: { status: 'not-checked' }, components: [component('cli', 'stale')] },
+            verifySensors: true, sensors: { overall: 'fail', sensors: [] },
+        });
+        expect(report).toMatchObject({ state: 'blocked', sensors: 'fail', cliCurrentness: 'stale' });
+    });
+});

package/dist/tests/core/context/provider.test.js

@@ -201,7 +201,7 @@ describe('composedOrchestrators', () => {
             { name: 'a\x1bx', appliesWhen: 'w\x07', terminatesTo: 't\x00' },
         ]);
         expect(out[0].name).toBe('ax');
-        // eslint-disable-next-line no-control-regex -- verificamos la ausencia deliberada de C0
+        // Verificamos la ausencia deliberada de C0.
         const controlCharPattern = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/;
         expect(out[0].name).not.toMatch(controlCharPattern);
         expect(out[0].appliesWhen).not.toMatch(controlCharPattern);
@@ -216,7 +216,7 @@ describe('composedOrchestrators', () => {
                 { name: 'evil\x1b[31m', appliesWhen: 'w', terminatesTo: 't' },
             ],
         });
-        // eslint-disable-next-line no-control-regex -- verificamos la ausencia deliberada de C0
+        // Verificamos la ausencia deliberada de C0.
         expect(ctx.markdown).not.toMatch(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/);
     });
     it('lo que renderiza el payload sale de esta misma funcion', () => {

package/dist/tests/core/context/strategies/config-instructions.test.js

@@ -47,7 +47,7 @@ describe('ConfigInstructionsStrategy.inject', () => {
 });
 describe('ConfigInstructionsStrategy.remove', () => {
     it('removes only the sentinel, preserving user entries', () => {
-        const { configPath, absPath, provider, input } = setup({ instructions: ['docs/rules.md'] });
+        const { configPath, provider, input } = setup({ instructions: ['docs/rules.md'] });
         strat.inject(input, provider);
         strat.remove(input, provider);
         const cfg = JSON.parse(fs_1.default.readFileSync(configPath, 'utf-8'));

package/dist/tests/core/dashboard/render-terminal.test.js

@@ -26,7 +26,7 @@ describe('renderFullTerminal', () => {
     it('renders all lifecycle sections in canonical order with status and remediation', () => {
         const output = (0, render_terminal_1.renderFullTerminal)((0, validate_1.validateDashboardSnapshotV1)(completeSnapshot()));
         const headings = ['Machine / install', 'Project readiness', 'Design / planning', 'Execution', 'QA', 'Docs', 'Retro', 'Final / history', 'Processes'];
-        expect(headings.map((heading) => output.indexOf(heading))).toEqual([...headings.map((_, index) => expect.any(Number))].map((_, index) => expect.any(Number)));
+        expect(headings.map((heading) => output.indexOf(heading))).toEqual(headings.map(() => expect.any(Number)));
         for (let index = 1; index < headings.length; index++)
             expect(output.indexOf(headings[index])).toBeGreaterThan(output.indexOf(headings[index - 1]));
         expect(output).toContain('⚠ Sensors [project.sensors] — 2 stale');

package/dist/tests/core/diagnostics/provider-checks.test.js

@@ -191,7 +191,6 @@ describe('gatherProviderChecks — shared skills.global does not mask broken lin
     });
     it('still reports shared (healthy, non-degrading) when the shared dir has no broken links', () => {
         const { gatherContext } = require('../../../src/core/diagnostics/context');
-        const { computeProviderOverall } = require('../../../src/core/diagnostics/checks');
         const scanSkills = jest.fn(() => ({ valid: ['ok-skill'], repairable: [], dead: [], usurped: [] }));
         const ctx = gatherContext({ cwd: tmpHome, bundles: [], agents: ['opencode', 'codex'], scanSkills });
         for (const provider of ctx.providers) {

package/dist/tests/core/discovery.test.js

@@ -14,7 +14,6 @@ const SKILLS_ROOT = CONTENT_ROOT;
 const WORKFLOWS_ROOT = CONTENT_ROOT;
 // For backward-compat with mock expectations that check SKILLS_DIR-style paths:
 const SKILLS_DIR = path_1.default.join(CONTENT_ROOT, 'skills');
-const WORKFLOWS_DIR = path_1.default.join(CONTENT_ROOT, 'workflows');
 const directoryStat = { dev: 1n, ino: 3n, isDirectory: () => true, isSymbolicLink: () => false };
 const skillStat = { dev: 1n, ino: 2n, size: 0n, isFile: () => true, isSymbolicLink: () => false };
 describe('Artifact Discovery', () => {

package/dist/tests/core/init/orchestrator.test.js

@@ -62,7 +62,7 @@ describe('runInitSteps — orchestrator', () => {
     function buildDeps(cwd) {
         const { gatherContext } = require('../../../src/core/diagnostics/context');
         const { discoverAllBundles } = require('../../../src/core/bundles');
-        const { contentRoots, registriesDir } = require('../../../src/core/registries');
+        const { contentRoots } = require('../../../src/core/registries');
         const { defaultActions } = require('../../../src/core/init/steps');
         // Seed content at ~/.awm/registries/baseline (content root IS the registry root).
         const contentRoot = path_1.default.join(process.env.AWM_HOME, 'registries', 'baseline');

package/dist/tests/core/journal/process.test.js

@@ -222,7 +222,7 @@ describe('process identity', () => {
     });
     test('captureRefFor degrada a unknown si ps falla, nunca crashea al capturar identidad (R2.1)', () => {
         const cp = require('child_process');
-        const spy = jest.spyOn(cp, 'execFileSync').mockImplementation((...args) => {
+        const spy = jest.spyOn(cp, 'execFileSync').mockImplementation((..._args) => {
             const err = new Error('spawn ps ENOENT');
             err.code = 'ENOENT';
             throw err;

package/dist/tests/core/orchestrators.test.js

@@ -197,7 +197,7 @@ describe('readDeclaredOrchestrators', () => {
             stderrBoundary(result.diagnostics);
             expect(stderrBoundary.mock.calls[0][0].join('')).not.toMatch(/[\u2028\u0085]/);
             expect(stderrBoundary.mock.results[0].value).not.toMatch(/[\u2028\u0085]/);
-            // eslint-disable-next-line no-control-regex -- reject all terminal controls and line separators
+            // Reject all terminal controls and line separators.
             expect(result.diagnostics[0]).not.toMatch(/[\x00-\x1f\x7f-\x9f\u2028\u2029]/);
         });
         it.each(['inspection', 'read', 'parse', 'shape', 'fields'])('sanitizes %s diagnostics, including paths and error text', (branch) => {
@@ -224,7 +224,7 @@ describe('readDeclaredOrchestrators', () => {
             expect(result.diagnostics[0]).toContain('awm-registry.json');
             expect(result.diagnostics[0]).toContain('before');
             expect(result.diagnostics[0]).toContain('after');
-            // eslint-disable-next-line no-control-regex -- reject all terminal controls and line separators
+            // Reject all terminal controls and line separators.
             expect(result.diagnostics[0]).not.toMatch(/[\x00-\x1f\x7f-\x9f\u2028\u2029]/);
         });
         it('preserves valid raw fields and structural parsing without skill discovery', () => {
@@ -290,7 +290,7 @@ describe('collectDeclaredOrchestrators', () => {
         writeSkill('first', 'real-skill');
         const { diagnostics } = (0, orchestrators_1.collectDeclaredOrchestrators)();
         expect(diagnostics).toHaveLength(1);
-        // eslint-disable-next-line no-control-regex -- diagnostic must contain no terminal controls or line separators
+        // Diagnostic must contain no terminal controls or line separators.
         expect(diagnostics[0]).not.toMatch(/[\x00-\x1f\x7f-\x9f\u2028\u2029]/);
         expect(diagnostics[0]).toContain('shared');
         expect(diagnostics[0]).toContain('forged');
@@ -304,7 +304,7 @@ describe('collectDeclaredOrchestrators', () => {
         expect(diagnostics).toHaveLength(1);
         expect(diagnostics[0]).toContain('discovery unavailable');
         expect(diagnostics[0]).toContain('forged');
-        // eslint-disable-next-line no-control-regex -- diagnostic must contain no terminal controls or line separators
+        // Diagnostic must contain no terminal controls or line separators.
         expect(diagnostics[0]).not.toMatch(/[\x00-\x1f\x7f-\x9f\u2028\u2029]/);
     });
     it('excludes a later colliding root without losing earlier or subsequent healthy roots', () => {

package/dist/tests/core/secure-fs/native-bridge.test.js

@@ -676,7 +676,6 @@ windowsOnly('native secure-fs Windows handle fixtures', () => {
         const junction = path_1.default.join(root, 'junction');
         fs_1.default.mkdirSync(outside);
         fs_1.default.symlinkSync(outside, junction, 'junction');
-        const target = path_1.default.join(junction, 'sensors.json');
         expect(() => binding.writeProjectTransaction(root, 'junction/sensors.json', Buffer.from('new bytes'), { mode: 'create', createParents: false })).toThrow(/rejected path ancestor/i);
         expect(fs_1.default.existsSync(path_1.default.join(outside, 'sensors.json'))).toBe(false);
     });

package/dist/tests/core/text.test.js

@@ -28,7 +28,7 @@ describe('sanitizeDeclaredField', () => {
         expect((0, text_1.sanitizeDeclaredField)('a\n## Forjado *b* `c` <d>')).toBe('a  Forjado b c d');
     });
     it('no deja ESC ni otros C0 sobrevivir aunque el saneo markdown no los toque', () => {
-        // eslint-disable-next-line no-control-regex -- verificamos la ausencia deliberada de C0
+        // Verificamos la ausencia deliberada de C0.
         expect((0, text_1.sanitizeDeclaredField)('name\x1b[31mred\x07')).not.toMatch(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/);
     });
     it('es idempotente sobre texto ya limpio', () => {

package/dist/tests/structural/directory-fsync-is-single-source.test.js

@@ -86,7 +86,7 @@ describe('directory fsync has exactly one implementation', () => {
         ];
         expect(rejects(regression, 1)).toBe(true);
         // The sanctioned replacement carries no directory open at all.
-        expect(regression.map((_, i) => i).some(i => rejects(['fsyncDirSync(path.dirname(file));'], 0))).toBe(false);
+        expect(rejects(['fsyncDirSync(path.dirname(file));'], 0)).toBe(false);
         // Flushing a FILE descriptor stays legal — that is a real, portable fsync.
         const fileFlush = ["const fd = fs.openSync(temporary, 'wx', 0o600);", 'fs.fsyncSync(fd);'];
         expect(rejects(fileFlush, 0)).toBe(false);

package/dist/tests/structural/lint-covers-typescript.test.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 // #171: the lint gate linted 14 files — all js/mjs — and exited 0 on a
 // TypeScript CLI. `eslint.config.awm.mjs` imports a project config that does
@@ -23,12 +24,37 @@ const CLI_ROOT = path_1.default.resolve(__dirname, '../..');
  *  repo already documents in tests/integration/published-doctor-evidence.e2e.test.ts,
  *  and the one this test hit on both Windows legs of its first CI run. Going
  *  through `process.execPath` needs no shell, so no argument escaping either. */
-function lint() {
-    const raw = (0, child_process_1.execFileSync)(process.execPath, [
+function lint(target = '.') {
+    const args = [
         path_1.default.join(CLI_ROOT, 'node_modules', 'eslint', 'bin', 'eslint.js'),
-        '.', '--config', 'eslint.config.awm.mjs', '--format', 'json',
-    ], { cwd: CLI_ROOT, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
-    return JSON.parse(raw);
+        target, '--config', 'eslint.config.awm.mjs', '--format', 'json',
+    ];
+    try {
+        const raw = (0, child_process_1.execFileSync)(process.execPath, args, { cwd: CLI_ROOT, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+        return JSON.parse(raw);
+    }
+    catch (error) {
+        // eslint exits non-zero when it reports an error, and the JSON report is
+        // still on stdout. A probe that EXPECTS a finding must read it, not die.
+        const stdout = error.stdout;
+        if (typeof stdout !== 'string' || stdout.trim() === '')
+            throw error;
+        return JSON.parse(stdout);
+    }
+}
+/** Lint one throwaway `.ts` file inside the repo, so the real config's `.ts`
+ *  block applies to it, and report what the gate said about it. */
+function probe(body) {
+    const directory = fs_1.default.mkdtempSync(path_1.default.join(CLI_ROOT, 'tests', '.lint-probe-'));
+    const file = path_1.default.join(directory, 'probe.ts');
+    try {
+        fs_1.default.writeFileSync(file, body);
+        const results = lint(path_1.default.relative(CLI_ROOT, file).split(path_1.default.sep).join('/'));
+        return results.flatMap(entry => entry.messages);
+    }
+    finally {
+        fs_1.default.rmSync(directory, { recursive: true, force: true });
+    }
 }
 describe('the lint gate covers TypeScript (#171)', () => {
     jest.setTimeout(10 * 60_000);
@@ -53,4 +79,37 @@ describe('the lint gate covers TypeScript (#171)', () => {
             .map(m => `${entry.filePath}: ${m.message}`));
         expect(unresolved).toEqual([]);
     });
+    // The gate examining TypeScript is worth nothing if it cannot fail on it.
+    // #171 left the rule at 'warn' with a backlog behind it; these assert the
+    // gate now BLOCKS, and that the tree it blocks on is clean.
+    test('the tree it lints is clean, with nothing left to report', () => {
+        const findings = results.flatMap(entry => entry.messages.map(m => `${entry.filePath}: ${m.ruleId ?? 'directive'} ${m.message}`));
+        expect(findings).toEqual([]);
+    });
+    test('an unused variable in TypeScript is an error, not a warning', () => {
+        const messages = probe('const neverUsed = 1;\nexport const used = 2;\n');
+        const unused = messages.filter(m => m.ruleId === '@typescript-eslint/no-unused-vars');
+        expect(unused).toHaveLength(1);
+        expect(unused[0].severity).toBe(2);
+        expect(unused[0].message).toContain('neverUsed');
+    });
+    test('an underscore-prefixed unused binding stays deliberate and unreported', () => {
+        expect(probe('const _deliberatelyUnused = 1;\nexport const used = 2;\n')).toEqual([]);
+    });
+    // The reason the rule had to become the TypeScript-aware one rather than the
+    // base rule: eslint's own `no-unused-vars` does not understand type
+    // annotations, so it flagged every parameter NAME inside a function TYPE.
+    // That was 195 of the 259 findings #171 exposed. Renaming those to `_x` would
+    // have made the types less readable to silence noise.
+    test('parameter names inside a function type are not reported as unused', () => {
+        const messages = probe('export type Fingerprint = (argv: string[], paths: string[], cwd: string) => string | null;\n');
+        expect(messages).toEqual([]);
+    });
+    test('a caught error that is never inspected is reported too', () => {
+        const messages = probe('export function f(value: number): number {\n    try { return value; } catch (error) { return 0; }\n}\n');
+        const unused = messages.filter(m => m.ruleId === '@typescript-eslint/no-unused-vars');
+        expect(unused).toHaveLength(1);
+        expect(unused[0].severity).toBe(2);
+        expect(unused[0].message).toContain('error');
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "9.11.4",
+  "version": "9.11.6",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"
@@ -59,6 +59,7 @@
     "@types/js-yaml": "4.0.9",
     "@types/node": "^25.3.0",
     "@types/semver": "^7.7.1",
+    "@typescript-eslint/eslint-plugin": "^8.70.0",
     "@typescript-eslint/parser": "^8.70.0",
     "dependency-cruiser": "16.10.4",
     "eslint": "10.8.1",