agentic-workflow-manager 9.12.0 → 9.12.2

package/dist/src/commands/watch/supervisor.js

@@ -1,9 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Supervisor = exports.MAX_SENSOR_DEFERRALS = exports.DEFAULT_SUPERVISOR_CONFIG = void 0;
+exports.Supervisor = exports.ADMISSION_RETRY_DELAY_MS = exports.MAX_SENSOR_DEFERRALS = exports.DEFAULT_SUPERVISOR_CONFIG = void 0;
 exports.routingFacts = routingFacts;
 exports.defaultDispatchAdmission = defaultDispatchAdmission;
 exports.admissionForConfig = admissionForConfig;
+exports.recoveryWhitelistBlocker = recoveryWhitelistBlocker;
 exports.runSupervisorLoop = runSupervisorLoop;
 // Loop foreground (R4.4/R4.5): tick = apply -> collect/spawn -> stall -> gate.
 // COMPLETE exige gate verde (que exige cero vivos): drenaje ANTES de declarar.
@@ -27,6 +28,7 @@ const apply_1 = require("./apply");
 const runner_1 = require("./runner");
 const tracks_1 = require("./tracks");
 const generations_1 = require("./generations");
+const types_1 = require("../../core/journal/types");
 /** #166: compact v2 admission requires the runtime identity, and the supervisor
  *  never supplied it — so `awm watch` blocked on every tick with
  *  ADMISSION_ROUTING_FACTS_REQUIRED even with every other gate green.
@@ -190,6 +192,21 @@ exports.DEFAULT_SUPERVISOR_CONFIG = {
 function admissionForConfig(repoRoot, branch, cfg, deps = {}) {
     return defaultDispatchAdmission(repoRoot, branch, cfg.provider, cfg.routingIdentity, deps, cfg.controllerAutonomy);
 }
+function admissionContextForConfig(cfg) {
+    if (!(0, adapter_1.isWatchProvider)(cfg.provider))
+        throw new Error('provider de supervisor invalido');
+    if (cfg.controllerAutonomy !== undefined && !(0, adapter_1.isControllerAutonomy)(cfg.controllerAutonomy))
+        throw new Error('postura del controller invalida');
+    const runtime = cfg.routingIdentity === undefined ? undefined : (0, capabilities_1.validateRuntimeKey)({ target: cfg.provider, ...cfg.routingIdentity });
+    return { provider: cfg.provider,
+        ...(runtime ? { runtime: { kind: runtime.kind, version: runtime.version, accountScopeDigest: runtime.accountScopeDigest } } : {}),
+        ...(cfg.controllerAutonomy ? { controllerAutonomy: cfg.controllerAutonomy } : {}) };
+}
+function sameAdmissionContext(left, right) {
+    return left.provider === right.provider && left.controllerAutonomy === right.controllerAutonomy
+        && left.runtime?.kind === right.runtime?.kind && left.runtime?.version === right.runtime?.version
+        && left.runtime?.accountScopeDigest === right.runtime?.accountScopeDigest;
+}
 // 'frozen' (R5.2/R6.3, Task 10): SOLO puede ocurrir en el journal de un
 // TRACK individual (nunca en el del plan) — el track terminó, con las 6
 // observaciones demostrables (cero jobs vivos, gate local verde, worktree
@@ -198,12 +215,31 @@ function admissionForConfig(repoRoot, branch, cfg, deps = {}) {
 /** How many consecutive ticks an inconclusive sensor verdict may defer dispatch
  *  before the supervisor says so out loud. Small: the deferral covers a verdict
  *  still settling, not one that never will. */
-exports.MAX_SENSOR_DEFERRALS = 3;
+exports.MAX_SENSOR_DEFERRALS = types_1.MAX_ADMISSION_DEFERRALS;
+exports.ADMISSION_RETRY_DELAY_MS = 5000;
+function transientAdmission(report) {
+    // Currentness and sensors are evaluated before journalStatus, so their
+    // blocked reports legitimately carry journal=not-required. The caller
+    // verifies the bound journal identity independently before deferring.
+    if (report.state !== 'blocked' || report.executionMode !== 'desatendido'
+        || report.planState !== 'valid' || !['not-required', 'current'].includes(report.journal)
+        || report.diagnostics.length !== 1)
+        return undefined;
+    if (report.currentness === 'unverifiable' && report.sensors === 'not-required'
+        && report.diagnostics[0].code === 'ADMISSION_CURRENTNESS_BLOCKED')
+        return 'currentness';
+    if (report.currentness === 'current' && report.sensors === 'not-certified'
+        && report.diagnostics[0].code === 'ADMISSION_SENSORS_BLOCKED')
+        return 'sensors';
+    return undefined;
+}
 const LIVE = ['received', 'spawn-intent', 'claimed', 'running', 'cancel-requested'];
 function recoveryWhitelistBlocker(state) {
-    if (state.cycle.status === 'BLOCKED')
-        return 'el ciclo está bloqueado';
-    if (state.requestProblems.length > 0)
+    if (state.cycle.status === 'BLOCKED') {
+        return state.cycle.blockedReason === 'recovery no autorizado: hay conflictos durables de requests'
+            ? 'hay conflictos durables de requests' : 'el ciclo está bloqueado';
+    }
+    if ((0, types_1.activeRequestProblems)(state).length > 0)
         return 'hay conflictos durables de requests';
     // Pending work is the normal reason to launch (or retry launching) the
     // controller.  It is not recovery evidence and therefore cannot turn a
@@ -226,21 +262,19 @@ class Supervisor {
     cfg;
     spawner;
     dispatchAdmission;
+    autoBeginGeneration;
     backoff = new generations_1.Backoff();
     relaunchNotBefore = 0;
-    /** Consecutive ticks deferred on an inconclusive sensor verdict. Bounded:
-     *  the deferral exists for a verdict that is still settling, and a verdict
-     *  that never settles must become visible rather than loop forever. */
-    sensorDeferrals = 0;
     lastActivity = null;
     lastGenerationToken = null;
     trackRuntime;
-    constructor(repoRoot, branch, cfg, spawner, trackRuntime, dispatchAdmission = admissionForConfig(repoRoot, branch, cfg)) {
+    constructor(repoRoot, branch, cfg, spawner, trackRuntime, dispatchAdmission = admissionForConfig(repoRoot, branch, cfg), autoBeginGeneration = false) {
         this.repoRoot = repoRoot;
         this.branch = branch;
         this.cfg = cfg;
         this.spawner = spawner;
         this.dispatchAdmission = dispatchAdmission;
+        this.autoBeginGeneration = autoBeginGeneration;
         this.trackRuntime = trackRuntime ?? (0, tracks_1.defaultTrackRuntime)(repoRoot, branch, { termGraceMs: cfg.termGraceMs, killGraceMs: cfg.killGraceMs });
     }
     fingerprintNow = (argv, paths, cwd) => {
@@ -277,7 +311,7 @@ class Supervisor {
         }
     }
     async tick() {
-        const before0 = (0, store_1.readJournal)(this.repoRoot, this.branch);
+        let before0 = (0, store_1.readJournal)(this.repoRoot, this.branch);
         if (before0.corrupt || before0.state === null)
             throw new Error('journal corrupto: el supervisor no opera sobre corrupcion (R1.6)');
         // Historical/schema-1 journals are intentionally readable by migration
@@ -291,6 +325,24 @@ class Supervisor {
         // longer reconstructible.
         if (before0.state.cycle.status === 'COMPLETE')
             return 'complete';
+        // A historical custody cannot be silently converted into another
+        // cause on a later tick. Only the locked offline recovery may resume.
+        if (before0.state.cycle.status === 'BLOCKED')
+            return 'custody';
+        const assertedContext = admissionContextForConfig(this.cfg);
+        if (before0.state.admissionContext && !sameAdmissionContext(before0.state.admissionContext, assertedContext)) {
+            (0, generations_1.enterCustody)(this.repoRoot, this.branch, 'identidad de admisión cambió al reiniciar: provider/runtime/postura');
+            return 'custody';
+        }
+        if (!before0.state.admissionContext && assertedContext.runtime && assertedContext.controllerAutonomy) {
+            before0.state.admissionContext = assertedContext;
+            (0, store_1.writeJournal)(this.repoRoot, this.branch, before0.state);
+            before0 = (0, store_1.readJournal)(this.repoRoot, this.branch);
+            if (before0.corrupt || !before0.state)
+                throw new Error('journal no verificable tras vincular identidad de admisión');
+        }
+        if (before0.state.admissionRetry && Date.now() < Date.parse(before0.state.admissionRetry.nextRetryAt))
+            return 'continue';
         // A controller can create jobs and runnerTick can start them. Both are
         // downstream of the same full compact unattended admission, so it must
         // complete before any reconciliation path that could dispatch either.
@@ -305,40 +357,49 @@ class Supervisor {
             }
             if (admission.state !== 'admitted' || admission.executionMode !== 'desatendido'
                 || admission.currentness !== 'current' || admission.sensors !== 'pass' || admission.journal !== 'current') {
-                // A first empirical sensor observation can be inconclusive while
-                // the already-started controller is still settling. It never
-                // authorizes dispatch; retry the read-only admission next tick
-                // instead of permanently custodying a healthy cycle.
-                //
-                // Bounded, because the verdict is not always transient: a
-                // registry whose sensors are all disabled reports
-                // `not-certified` forever. Unbounded, this returned before
-                // `consumePendingRequests` below, so the supervisor ticked
-                // indefinitely applying nothing and writing nothing — no event,
-                // no state change, no exit. Refusing to progress is correct
-                // here; refusing invisibly is not. Consuming requests cannot be
-                // hoisted above this gate to compensate: applying a job-request
-                // creates a Job that runnerTick can start, which is the dispatch
-                // this admission exists to authorize.
-                if (admission.planState === 'valid' && admission.currentness === 'current'
-                    && admission.sensors === 'not-certified' && admission.journal === 'not-required') {
-                    this.sensorDeferrals += 1;
-                    if (this.sensorDeferrals <= exports.MAX_SENSOR_DEFERRALS)
+                const kind = transientAdmission(admission);
+                if (kind) {
+                    const binding = before0.state.planBinding;
+                    const plan = (0, validate_1.validatePlanFile)(binding.path, this.repoRoot);
+                    if (plan.state !== 'valid' || plan.planDigest !== binding.digest || plan.schema !== binding.schema
+                        || (binding.executionDigest !== undefined && plan.executionDigest !== binding.executionDigest)
+                        || (admission.planDigest !== undefined && admission.planDigest !== binding.digest)) {
+                        (0, generations_1.enterCustody)(this.repoRoot, this.branch, 'binding del plan alterado durante admisión transitoria');
+                        return 'custody';
+                    }
+                    const prior = before0.state.admissionRetry;
+                    const attempts = (prior?.attempts ?? 0) + 1;
+                    if (attempts <= types_1.MAX_ADMISSION_DEFERRALS) {
+                        const now = Date.now();
+                        before0.state.admissionRetry = { kind, attempts, firstAt: prior?.firstAt ?? new Date(now).toISOString(), nextRetryAt: new Date(now + exports.ADMISSION_RETRY_DELAY_MS).toISOString() };
+                        (0, store_1.writeJournal)(this.repoRoot, this.branch, before0.state);
+                        (0, store_1.appendEvent)(this.repoRoot, this.branch, { kind: 'admission-retry', cause: kind, attempts, retryAfterMs: exports.ADMISSION_RETRY_DELAY_MS });
                         return 'continue';
-                    // The reason must not carry the running counter. enterCustody is
-                    // idempotent on (status, reason), so a message that changes every
-                    // tick defeats that guard and rewrites the journal plus appends a
-                    // custody-blocked event every tickMs, without bound. Naming the
-                    // bound instead of the count keeps the reason stable, so custody
-                    // is entered once and stays entered.
-                    (0, generations_1.enterCustody)(this.repoRoot, this.branch, `veredicto de sensores no concluyente tras ${exports.MAX_SENSOR_DEFERRALS} ticks: ${admission.diagnostics.map(diagnostic => `${diagnostic.code}: ${diagnostic.message}`).join('; ')}`);
+                    }
+                    (0, generations_1.enterCustody)(this.repoRoot, this.branch, `admisión ${kind} no verificable tras ${types_1.MAX_ADMISSION_DEFERRALS} reintentos: ${admission.diagnostics.map(diagnostic => `${diagnostic.code}: ${diagnostic.message}`).join('; ')}`);
                     return 'custody';
                 }
                 (0, generations_1.enterCustody)(this.repoRoot, this.branch, `admisión compacta desatendida bloqueada antes de dispatch: ${admission.diagnostics.map(diagnostic => `${diagnostic.code}: ${diagnostic.message}`).join('; ')}`);
                 return 'custody';
             }
-            // The verdict settled, which is exactly what the deferral waited for.
-            this.sensorDeferrals = 0;
+            // An incomplete assertion can be repaired while the cycle is
+            // still waiting. Bind it only after an admitted observation, never
+            // on an early currentness/sensor response that has not reached the
+            // provider, runtime and autonomy gates yet.
+            if (!before0.state.admissionContext) {
+                before0.state.admissionContext = assertedContext;
+                (0, store_1.writeJournal)(this.repoRoot, this.branch, before0.state);
+                before0 = (0, store_1.readJournal)(this.repoRoot, this.branch);
+                if (before0.corrupt || !before0.state)
+                    throw new Error('journal no verificable tras vincular admisión completa');
+            }
+            if (before0.state.admissionRetry) {
+                before0.state.admissionRetry = undefined;
+                (0, store_1.writeJournal)(this.repoRoot, this.branch, before0.state);
+                before0 = (0, store_1.readJournal)(this.repoRoot, this.branch);
+                if (before0.corrupt || !before0.state)
+                    throw new Error('journal no verificable tras resolver reintento de admisión');
+            }
         }
         let recoveryResumeAction;
         // Schema-2 custody is reconciled before any controller launch.  This is
@@ -392,14 +453,14 @@ class Supervisor {
             // verdicts, and an adverse verdict without a closed fix all stop
             // recovery before a controller can create more work.
             const verdictById = new Map(before0.state.verdicts.map(verdict => [verdict.id, verdict]));
-            const openReviewOrFix = before0.state.tasks.some(task => {
+            const openReviewOrFix = (terminalTaskClaims && before0.state.tasks.some(task => {
                 const obligations = task.reviewObligations;
                 return !['spec', 'quality'].every(kind => obligations.some(obligation => obligation.kind === kind))
                     || obligations.some(obligation => {
                         const verdict = obligation.verdictId === undefined ? undefined : verdictById.get(obligation.verdictId);
                         return verdict === undefined || verdict.result !== 'pass';
                     });
-            }) || before0.state.verdicts.some(verdict => verdict.result !== 'pass'
+            })) || before0.state.verdicts.some(verdict => verdict.result !== 'pass'
                 && !before0.state.fixes.some(fix => fix.verdictId === verdict.id && fix.closed));
             const recovery = (0, fingerprint_1.reconcileUnattendedRecovery)({
                 journal: before0.state, journalCorrupt: false, plan: before0.state.planBinding,
@@ -438,6 +499,8 @@ class Supervisor {
         // mismo resultado terminal.
         if (before.frozen !== undefined)
             return 'frozen';
+        if (this.autoBeginGeneration && (0, generations_1.activeGeneration)(before) === undefined)
+            (0, generations_1.beginGeneration)(this.repoRoot, this.branch);
         const pending = before.cycle.nextAction;
         const resumeAction = recoveryResumeAction ?? { schema: 'controller-recovery/v1', kind: pending !== undefined ? 'resume-next-action' : 'resume-cycle' };
         if (this.ensureController(resumeAction) === 'custody')
@@ -717,12 +780,8 @@ async function runSupervisorLoop(repoRoot, branch, cfg, spawner = (0, runner_1.d
     const onSignal = () => { shutdownRequested = true; wakeSleep?.(); };
     process.on('SIGINT', onSignal);
     process.on('SIGTERM', onSignal);
-    const sup = new Supervisor(repoRoot, branch, cfg, spawner, trackRuntime, dispatchAdmission);
+    const sup = new Supervisor(repoRoot, branch, cfg, spawner, trackRuntime, dispatchAdmission, true);
     try {
-        const s0 = (0, store_1.readJournal)(repoRoot, branch).state;
-        if ((0, generations_1.activeGeneration)(s0) === undefined) {
-            (0, generations_1.beginGeneration)(repoRoot, branch);
-        }
         for (;;) {
             if (shutdownRequested)
                 break;

package/dist/src/core/journal/requests.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.digestOf = digestOf;
 exports.emitRequest = emitRequest;
+exports.isWellFormedEnvelope = isWellFormedEnvelope;
 exports.listPendingRequests = listPendingRequests;
 exports.applyOutcome = applyOutcome;
 exports.ackFor = ackFor;

package/dist/src/core/journal/types.js

@@ -5,7 +5,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GENERATION_STATES = exports.EXECUTION_STATES = void 0;
+exports.MAX_ADMISSION_DEFERRALS = exports.GENERATION_STATES = exports.EXECUTION_STATES = void 0;
+exports.activeRequestProblems = activeRequestProblems;
 exports.isControllerRecoveryAction = isControllerRecoveryAction;
 exports.emptyState = emptyState;
 exports.isWellFormedState = isWellFormedState;
@@ -14,6 +15,7 @@ exports.isRoutingEnvelope = isRoutingEnvelope;
 exports.isWellFormedProcessRef = isWellFormedProcessRef;
 exports.isWellFormedJob = isWellFormedJob;
 const crypto_1 = __importDefault(require("crypto"));
+const path_1 = __importDefault(require("path"));
 const types_1 = require("../tracks/types");
 const paths_1 = require("./paths");
 exports.EXECUTION_STATES = [
@@ -35,6 +37,20 @@ const COHORT_PHASES = [
 ];
 const _cohortPhasesComplete = true;
 const VERIFICATION_KINDS = ['test', 'lint', 'sensors', 'review', 'qa', 'interlock', 'track-integration'];
+function activeRequestProblems(state) {
+    return state.requestProblems.filter(problem => {
+        const resolution = problem.resolution;
+        if (!resolution || !problem.requestId || !problem.taskId || !problem.generationToken
+            || path_1.default.basename(problem.file) !== `${problem.requestId}.json`
+            || resolution.generationToken !== problem.generationToken)
+            return true;
+        const applied = state.appliedRequests[resolution.replacementRequestId];
+        return applied?.outcome !== 'applied' || applied.resultRef !== problem.taskId
+            || applied.payloadDigest !== resolution.replacementPayloadDigest
+            || !state.tasks.some(task => task.id === problem.taskId);
+    });
+}
+exports.MAX_ADMISSION_DEFERRALS = 3;
 function isControllerRecoveryAction(x) {
     return isObj(x) && Object.keys(x).length === 2
         && x.schema === 'controller-recovery/v1'
@@ -102,6 +118,12 @@ function isWellFormedState(x) {
         return false;
     if (x.custodyDecisions !== undefined && (!Array.isArray(x.custodyDecisions) || !x.custodyDecisions.every(isWellFormedCustodyDecision)))
         return false;
+    if (x.admissionRetry !== undefined && !isWellFormedAdmissionRetry(x.admissionRetry))
+        return false;
+    if (x.admissionContext !== undefined && !isWellFormedAdmissionContext(x.admissionContext))
+        return false;
+    if (x.admissionRecoveries !== undefined && (!Array.isArray(x.admissionRecoveries) || !x.admissionRecoveries.every(isWellFormedAdmissionRecovery)))
+        return false;
     if (!x.generations.every(isWellFormedGeneration) || !x.tasks.every(isWellFormedTask))
         return false;
     if (!x.cycleVerificationPlan.every(isWellFormedVerificationItem))
@@ -240,12 +262,55 @@ function isRoutingEnvelope(x) { if (!isObj(x) || !Object.keys(x).every(key => ['
 function isWellFormedImplementationLineage(x) { return isObj(x) && Object.keys(x).every(key => ['id', 'obligationId', 'sliceId', 'planDigest', 'executionDigest', 'initialProfile', 'initialEffort', 'attempts'].includes(key)) && typeof x.id === 'string' && x.id.length > 0 && typeof x.obligationId === 'string' && x.obligationId.length > 0 && typeof x.sliceId === 'string' && x.sliceId.length > 0 && isDigest(x.planDigest) && isDigest(x.executionDigest) && ['mechanical', 'integration', 'judgment'].includes(String(x.initialProfile)) && ['medium', 'high', 'runtime-default'].includes(String(x.initialEffort)) && Number.isSafeInteger(x.attempts) && x.attempts >= 0 && x.attempts <= 3; }
 function isWellFormedRequestProblem(x) {
     return isObj(x) && typeof x.file === 'string' && (x.kind === 'corrupt' || x.kind === 'rejected')
-        && typeof x.detail === 'string' && typeof x.at === 'string';
+        && typeof x.detail === 'string' && typeof x.at === 'string'
+        && (x.requestId === undefined || typeof x.requestId === 'string')
+        && (x.taskId === undefined || typeof x.taskId === 'string')
+        && (x.generationToken === undefined || typeof x.generationToken === 'string')
+        && (x.resolution === undefined || (x.kind === 'rejected' && isObj(x.resolution)
+            && Object.keys(x.resolution).every(key => ['replacementRequestId', 'replacementPayloadDigest', 'reason', 'generationToken', 'at'].includes(key))
+            && typeof x.requestId === 'string' && x.requestId.length > 0
+            && typeof x.taskId === 'string' && x.taskId.length > 0
+            && typeof x.generationToken === 'string' && x.generationToken.length > 0
+            && typeof x.resolution.replacementRequestId === 'string' && x.resolution.replacementRequestId.length > 0
+            && typeof x.resolution.replacementPayloadDigest === 'string' && /^[a-f0-9]{64}$/.test(x.resolution.replacementPayloadDigest)
+            && typeof x.resolution.reason === 'string' && x.resolution.reason.trim().length > 0
+            && typeof x.resolution.generationToken === 'string' && x.resolution.generationToken.length > 0
+            && typeof x.resolution.at === 'string' && Number.isFinite(Date.parse(x.resolution.at))));
 }
 function isWellFormedCustodyDecision(x) {
     return isObj(x) && typeof x.at === 'string' && x.decision === 'resume'
         && typeof x.reason === 'string' && typeof x.generationToken === 'string';
 }
+function isWellFormedAdmissionRetry(x) {
+    return isObj(x) && Object.keys(x).length === 4
+        && (x.kind === 'currentness' || x.kind === 'sensors')
+        && Number.isInteger(x.attempts) && Number(x.attempts) >= 1 && Number(x.attempts) <= exports.MAX_ADMISSION_DEFERRALS
+        && typeof x.firstAt === 'string' && Number.isFinite(Date.parse(x.firstAt))
+        && typeof x.nextRetryAt === 'string' && Number.isFinite(Date.parse(x.nextRetryAt))
+        && Date.parse(x.nextRetryAt) >= Date.parse(x.firstAt);
+}
+function isWellFormedAdmissionContext(x) {
+    if (!isObj(x) || !Object.keys(x).every(key => ['provider', 'runtime', 'controllerAutonomy'].includes(key))
+        || (x.provider !== 'codex' && x.provider !== 'claude-code')
+        || (x.controllerAutonomy !== undefined && x.controllerAutonomy !== 'approval-free'))
+        return false;
+    if (x.runtime === undefined)
+        return true;
+    return isObj(x.runtime) && Object.keys(x.runtime).length === 3
+        && typeof x.runtime.kind === 'string' && x.runtime.kind.length > 0
+        && typeof x.runtime.version === 'string' && x.runtime.version.length > 0
+        && typeof x.runtime.accountScopeDigest === 'string' && /^[a-f0-9]{64}$/.test(x.runtime.accountScopeDigest);
+}
+function isWellFormedAdmissionRecovery(x) {
+    return isObj(x) && Object.keys(x).every(key => ['at', 'reason', 'blockedReason', 'generationToken', 'context', 'planDigest', 'assertion'].includes(key))
+        && typeof x.at === 'string' && Number.isFinite(Date.parse(x.at))
+        && typeof x.reason === 'string' && x.reason.trim().length > 0 && x.reason.length <= 1024
+        && typeof x.blockedReason === 'string' && x.blockedReason.length > 0
+        && (x.generationToken === undefined || (typeof x.generationToken === 'string' && x.generationToken.length > 0))
+        && isWellFormedAdmissionContext(x.context)
+        && typeof x.planDigest === 'string' && /^[a-f0-9]{64}$/.test(x.planDigest)
+        && (x.assertion === 'recorded' || x.assertion === 'legacy-operator-asserted');
+}
 function isWellFormedProcessRef(x) {
     if (!isObj(x))
         return false;