agentic-workflow-manager 9.12.2 → 9.12.4

package/dist/src/core/admission/registry-contracts.js

@@ -19,6 +19,10 @@ const versioning_1 = require("../versioning");
 const check_1 = require("../currentness/check");
 const run_1 = require("../../commands/sensors/run");
 const index_1 = require("./index");
+const store_1 = require("../journal/store");
+const paths_1 = require("../journal/paths");
+const generations_1 = require("../../commands/watch/generations");
+const process_1 = require("../journal/process");
 const FRAMEWORK_CONTRACTS = ['using-awm', 'writing-plans', 'development-process', 'subagent-driven-development', 'executing-plans', 'post-implementation-qa', 'post-implementation-docs', 'harness-retro', 'finishing-a-development-branch'];
 const MAX_CONTRACT_BYTES = 1024 * 1024;
 const MAX_MANIFEST_BYTES = 256 * 1024;
@@ -217,6 +221,56 @@ function registryCompatibility(registries, consumed) {
     }
     return diagnostics;
 }
+/** A controller may ask for admission while its supervisor is writing journal
+ * events. The already-launched generation passed sensors before launch; its
+ * durable intent plus verified live process identity is the evidence, not a
+ * second tree snapshot. A claim alone never certifies process ownership. */
+function hasOwnedGenerationAdmission(input) {
+    if (!input.verifySensors || input.freshSensorsRequired || input.executionMode !== 'desatendido' || input.plan.state !== 'valid'
+        || input.journalCorrupt || !input.journalState || input.journalState.schema !== 2
+        || input.journalState.cycle.status !== 'IN_PROGRESS'
+        || input.journalState.admissionContext?.provider !== input.provider
+        || input.journalState.admissionContext.controllerAutonomy !== input.controllerAutonomy)
+        return false;
+    const observed = input.journalState;
+    const binding = observed.planBinding;
+    if (!binding)
+        return false;
+    if (input.plan.schema === 'compact-slices/v2' && !observed.admissionContext?.runtime)
+        return false;
+    let expectedPath;
+    try {
+        expectedPath = (0, paths_1.bindingPlanPath)(input.planPath ?? '');
+    }
+    catch {
+        return false;
+    }
+    if (binding.path !== expectedPath || binding.digest !== input.plan.planDigest || binding.schema !== input.plan.schema
+        || (binding.executionDigest !== undefined && binding.executionDigest !== input.plan.executionDigest))
+        return false;
+    let fresh;
+    try {
+        fresh = (0, store_1.readJournal)(input.cwd, observed.branch);
+    }
+    catch {
+        return false;
+    }
+    if (fresh.corrupt || !fresh.state || fresh.state.cycle.status !== 'IN_PROGRESS'
+        || fresh.state.revision < observed.revision || JSON.stringify(fresh.state.planBinding) !== JSON.stringify(binding)
+        || JSON.stringify(fresh.state.admissionContext) !== JSON.stringify(observed.admissionContext))
+        return false;
+    const generation = (0, generations_1.activeGeneration)(fresh.state);
+    if (!generation || generation !== fresh.state.generations.at(-1)
+        || generation.provider !== input.provider || !generation.controllerJobId || !generation.launchArgvDigest)
+        return false;
+    const prior = observed.generations.find(item => item.token === generation.token);
+    if (!prior || prior.controllerJobId !== generation.controllerJobId || prior.launchArgvDigest !== generation.launchArgvDigest)
+        return false;
+    return (generation.processRef !== undefined && generation.processRef.spawnNonce === generation.spawnNonce
+        && generation.processRef.argvDigest === generation.launchArgvDigest && (0, process_1.refIsAlive)(generation.processRef))
+        || (generation.wrapperRef !== undefined && generation.wrapperRef.spawnNonce === generation.spawnNonce
+            && (0, process_1.refIsAlive)(generation.wrapperRef));
+}
 /** One admission authority for the public command AND actual watch dispatch.
  * No empirical execution occurs before provenance/currentness/CLI-floor gates. */
 async function admitRegistryPlan(input, dependencies = {}) {
@@ -253,12 +307,14 @@ async function admitRegistryPlan(input, dependencies = {}) {
         }
         return scope.provenance === 'proven';
     };
+    let generationBound = false;
     const compose = async (fields) => {
         const report = await admission({ ...input, provenance: scope.provenance, consumedRegistryComponents: scope.consumedRegistryComponents, ...fields });
+        const withEvidence = generationBound && report.sensors === 'pass' ? { ...report, sensorEvidence: 'generation-bound' } : report;
         if (scope.provenanceDiagnostic && report.diagnostics.some(diagnostic => diagnostic.code === 'ADMISSION_CURRENTNESS_PROVENANCE_REQUIRED')) {
-            return { ...report, diagnostics: report.diagnostics.map(diagnostic => diagnostic.code === 'ADMISSION_CURRENTNESS_PROVENANCE_REQUIRED' ? scope.provenanceDiagnostic : diagnostic) };
+            return { ...withEvidence, diagnostics: report.diagnostics.map(diagnostic => diagnostic.code === 'ADMISSION_CURRENTNESS_PROVENANCE_REQUIRED' ? scope.provenanceDiagnostic : diagnostic) };
         }
-        return report;
+        return withEvidence;
     };
     let currentness = input.currentness;
     let compatibilityDiagnostics;
@@ -277,7 +333,10 @@ async function admitRegistryPlan(input, dependencies = {}) {
         if (compatibilityGate.currentness !== 'current')
             return compatibilityGate;
     }
-    const sensors = input.verifySensors ? input.sensors ?? await (dependencies.runSensors ?? run_1.runSensors)({ cwd: input.cwd, all: true, readOnly: true }) : undefined;
+    generationBound = input.sensors === undefined && hasOwnedGenerationAdmission(input);
+    const sensors = input.verifySensors ? input.sensors ?? (generationBound
+        ? { sensors: [], overall: 'pass', reason: 'generation-bound-admission' }
+        : await (dependencies.runSensors ?? run_1.runSensors)({ cwd: input.cwd, all: true, readOnly: true })) : undefined;
     if (input.requireCurrent && input.verifySensors) {
         if (!refresh())
             return compose({ currentness, sensors });
@@ -286,5 +345,17 @@ async function admitRegistryPlan(input, dependencies = {}) {
             return currentnessGate;
         compatibilityDiagnostics = registryCompatibility(registries, scope.consumedRegistryComponents);
     }
+    if (generationBound && input.plan.schema === 'compact-slices/v2') {
+        const routing = input.routing ?? await dependencies.readRouting?.();
+        const expected = input.journalState?.admissionContext?.runtime;
+        if (!expected || !routing?.runtime || routing.runtime.target !== input.provider
+            || routing.runtime.kind !== expected.kind || routing.runtime.version !== expected.version
+            || routing.runtime.accountScopeDigest !== expected.accountScopeDigest) {
+            return compose({ currentness, compatibilityDiagnostics, sensors,
+                routing: { ...routing, eventIssue: { code: 'ADMISSION_GENERATION_RUNTIME_MISMATCH',
+                        message: 'Live runtime identity differs from the admitted controller generation; stop and recover with a fresh admission.' } } });
+        }
+        return compose({ currentness, compatibilityDiagnostics, sensors, routing });
+    }
     return compose({ currentness, compatibilityDiagnostics, sensors, ...(dependencies.readRouting ? { routingReader: dependencies.readRouting } : {}) });
 }

package/dist/src/core/journal/requests.js

@@ -85,9 +85,15 @@ function isWellFormedEnvelope(x) {
 }
 function listPendingRequests(repoRoot, branch) {
     const dir = (0, paths_1.requestsDir)(repoRoot, branch);
+    const directory = fs_1.default.lstatSync(dir);
+    if (directory.isSymbolicLink() || !directory.isDirectory())
+        throw new Error('request directory is not a controlled directory');
     return fs_1.default.readdirSync(dir).filter((f) => f.endsWith('.json')).sort().map((f) => {
         const file = path_1.default.join(dir, f);
         try {
+            const stat = fs_1.default.lstatSync(file);
+            if (stat.isSymbolicLink() || !stat.isFile())
+                return { requestId: f, envelope: null, file, corrupt: true };
             const parsed = JSON.parse(fs_1.default.readFileSync(file, 'utf8'));
             // Shape completa antes de cualquier uso downstream. JSON valido no
             // implica envelope valido: payload/generation/idempotency ausentes

package/dist/src/core/journal/types.js

@@ -99,6 +99,8 @@ function isWellFormedState(x) {
         return false;
     if (!Array.isArray(x.generations) || !Array.isArray(x.tasks))
         return false;
+    if (!x.tasks.every(isWellFormedTask))
+        return false;
     if (!Array.isArray(x.cycleVerificationPlan) || !Array.isArray(x.verdicts) || !Array.isArray(x.fixes))
         return false;
     if (!Array.isArray(x.requiredVerifiers) || !x.requiredVerifiers.every((kind) => VERIFICATION_KINDS.includes(kind))
@@ -108,8 +110,40 @@ function isWellFormedState(x) {
         return false;
     if (!isObj(x.appliedRequests) || !Object.values(x.appliedRequests).every(isWellFormedAppliedRequest))
         return false;
+    if (!Object.entries(x.appliedRequests).every(([requestId, ack]) => requestId === ack.requestId))
+        return false;
     if (x.routingAttempts !== undefined && (!Array.isArray(x.routingAttempts) || x.routingAttempts.length > 4096 || !x.routingAttempts.every(isWellFormedRoutingAttempt)))
         return false;
+    // A linked v2 dispatch is evidence of a native handoff. Reject a broken
+    // link or a second dispatch for one reservation on journal read as well as
+    // at request-application time. Historical unlinked records remain readable
+    // but cannot masquerade as this new acknowledged handoff.
+    if (x.planBinding?.schema === 'compact-slices/v2') {
+        const binding = x.planBinding;
+        const attempts = (x.routingAttempts ?? []);
+        const dispatches = x.dispatches;
+        const linked = new Set();
+        for (const dispatch of dispatches) {
+            if (!dispatch.routingAttemptId)
+                continue;
+            if (linked.has(dispatch.routingAttemptId))
+                return false;
+            linked.add(dispatch.routingAttemptId);
+            const attempt = attempts.find(candidate => candidate.id === dispatch.routingAttemptId);
+            if (!attempt || !(x.tasks.some(task => task.id === dispatch.taskId))
+                || attempt.envelope.role !== 'implementer' || attempt.envelope.sliceId !== dispatch.taskId
+                || attempt.envelope.planDigest !== binding.digest || attempt.envelope.executionDigest !== binding.executionDigest
+                || !attempt.reservationRequestId || !dispatch.dispatchRequestId)
+                return false;
+            const acknowledgements = x.appliedRequests;
+            const reservationAck = acknowledgements[attempt.reservationRequestId];
+            const dispatchAck = acknowledgements[dispatch.dispatchRequestId];
+            if (reservationAck?.outcome !== 'applied' || reservationAck.requestId !== attempt.reservationRequestId
+                || reservationAck.resultRef !== attempt.id || dispatchAck?.outcome !== 'applied'
+                || dispatchAck.requestId !== dispatch.dispatchRequestId || dispatchAck.resultRef !== dispatch.id)
+                return false;
+        }
+    }
     if (x.routingIncidents !== undefined && (!Array.isArray(x.routingIncidents) || x.routingIncidents.length > 4096 || !x.routingIncidents.every(isWellFormedRoutingIncident)))
         return false;
     if (x.implementationLineages !== undefined && (!Array.isArray(x.implementationLineages) || x.implementationLineages.length > 4096 || !x.implementationLineages.every(isWellFormedImplementationLineage)))
@@ -183,7 +217,10 @@ function isWellFormedNextAction(x) {
         && (x.state === 'pending' || x.state === 'in-progress');
 }
 function isWellFormedDispatch(x) {
-    return isObj(x) && typeof x.id === 'string' && typeof x.taskId === 'string' && typeof x.at === 'string';
+    return isObj(x) && Object.keys(x).every(key => ['id', 'taskId', 'at', 'routingAttemptId', 'dispatchRequestId'].includes(key))
+        && typeof x.id === 'string' && x.id.length > 0 && typeof x.taskId === 'string' && x.taskId.length > 0
+        && typeof x.at === 'string' && (x.routingAttemptId === undefined || (typeof x.routingAttemptId === 'string' && x.routingAttemptId.length > 0))
+        && (x.dispatchRequestId === undefined || (typeof x.dispatchRequestId === 'string' && x.dispatchRequestId.length > 0));
 }
 function strings(x) {
     return Array.isArray(x) && x.every((item) => typeof item === 'string');
@@ -235,11 +272,11 @@ function isWellFormedAppliedRequest(x) {
         && (x.resultRef === undefined || typeof x.resultRef === 'string');
 }
 function isWellFormedRoutingAttempt(x) {
-    return isObj(x) && Object.keys(x).every(key => ['schema', 'id', 'obligationId', 'lineageId', 'attempt', 'envelope', 'envelopeDigest', 'fingerprint', 'state', 'reservedAt', 'nativeEvidenceRequired', 'nativeEventDigest', 'nativeAgentId', 'observed', 'observedBackendModel', 'verdict', 'reasonCode', 'administrativeRepair'].includes(key))
+    return isObj(x) && Object.keys(x).every(key => ['schema', 'id', 'obligationId', 'lineageId', 'attempt', 'envelope', 'envelopeDigest', 'fingerprint', 'state', 'reservedAt', 'reservationRequestId', 'nativeEvidenceRequired', 'nativeEventDigest', 'nativeAgentId', 'observed', 'observedBackendModel', 'verdict', 'reasonCode', 'administrativeRepair'].includes(key))
         && x.schema === 'routing-attempt/v1'
         && typeof x.id === 'string' && typeof x.obligationId === 'string' && typeof x.lineageId === 'string' && Number.isSafeInteger(x.attempt) && x.attempt > 0
         && typeof x.envelopeDigest === 'string' && /^[a-f0-9]{64}$/.test(x.envelopeDigest) && typeof x.fingerprint === 'string' && /^[a-f0-9]{64}$/.test(x.fingerprint)
-        && ['reserved', 'active', 'complete', 'blocked', 'unknown'].includes(String(x.state)) && (x.reservedAt === undefined || (typeof x.reservedAt === 'string' && Number.isFinite(Date.parse(x.reservedAt)))) && (x.nativeEvidenceRequired === undefined || x.nativeEvidenceRequired === true) && (x.nativeEventDigest === undefined || isDigest(x.nativeEventDigest)) && (x.nativeAgentId === undefined || typeof x.nativeAgentId === 'string') && (x.observed === undefined || isRoutingSelection(x.observed)) && (x.observedBackendModel === undefined || (typeof x.observedBackendModel === 'string' && x.observedBackendModel.length > 0 && x.observedBackendModel.length <= 128)) && (x.verdict === undefined || ['pass', 'fail', 'inconclusive'].includes(String(x.verdict))) && (x.reasonCode === undefined || typeof x.reasonCode === 'string') && (x.administrativeRepair === undefined || x.administrativeRepair === true) && isRoutingEnvelope(x.envelope);
+        && ['reserved', 'active', 'complete', 'blocked', 'unknown'].includes(String(x.state)) && (x.reservedAt === undefined || (typeof x.reservedAt === 'string' && Number.isFinite(Date.parse(x.reservedAt)))) && (x.reservationRequestId === undefined || (typeof x.reservationRequestId === 'string' && x.reservationRequestId.length > 0 && x.reservationRequestId.length <= 128)) && (x.nativeEvidenceRequired === undefined || x.nativeEvidenceRequired === true) && (x.nativeEventDigest === undefined || isDigest(x.nativeEventDigest)) && (x.nativeAgentId === undefined || typeof x.nativeAgentId === 'string') && (x.observed === undefined || isRoutingSelection(x.observed)) && (x.observedBackendModel === undefined || (typeof x.observedBackendModel === 'string' && x.observedBackendModel.length > 0 && x.observedBackendModel.length <= 128)) && (x.verdict === undefined || ['pass', 'fail', 'inconclusive'].includes(String(x.verdict))) && (x.reasonCode === undefined || typeof x.reasonCode === 'string') && (x.administrativeRepair === undefined || x.administrativeRepair === true) && isRoutingEnvelope(x.envelope);
 }
 function isWellFormedRoutingIncident(x) {
     if (!isObj(x) || Object.keys(x).length !== 12 || !Object.keys(x).every(key => ['schema', 'id', 'runStartedAt', 'target', 'selection', 'reasonCode', 'firstAt', 'lastAt', 'affectedObligations', 'fallbackCount', 'blockedCount', 'alertState'].includes(key)))

package/dist/tests/commands/watch/admission-recovery.test.js

@@ -51,6 +51,7 @@ const supervisor_1 = require("../../../src/commands/watch/supervisor");
 const admission_recovery_1 = require("../../../src/commands/watch/admission-recovery");
 const watch_1 = require("../../../src/commands/watch");
 const supervisorModule = __importStar(require("../../../src/commands/watch/supervisor"));
+const routing_approval_1 = require("../../helpers/routing-approval");
 const DIGEST = 'a'.repeat(64);
 const identity = { kind: 'native', version: '1.0.0', accountScopeDigest: DIGEST };
 const input = { provider: 'codex', routingIdentity: identity, controllerAutonomy: 'approval-free',
@@ -157,6 +158,29 @@ describe('issue #196: admission custody recovery', () => {
         expect((0, store_1.readJournal)(repo, 'main').state.cycle.status).toBe('BLOCKED');
         expect(await (0, admission_recovery_1.recoverAdmissionCustody)(repo, 'main', input, admitted)).toBe('recovered');
     });
+    test.each([
+        'runtime local no verificable: NATIVE_QUERY_FAILED',
+        'runtime local cambió durante generacion admitida',
+    ])('runtime custody %s recovers only after strict offline revalidation', async (reason) => {
+        fs_1.default.writeFileSync(path_1.default.join(repo, 'plans', 'cycle.md'), fs_1.default.readFileSync(path_1.default.join(__dirname, '../../core/plan/fixtures/compact-slices-v2/valid.md'), 'utf8'));
+        const v2Plan = (0, validate_1.validatePlanFile)('plans/cycle.md', repo);
+        if (v2Plan.state !== 'valid' || !v2Plan.executionDigest)
+            throw new Error('invalid v2 recovery fixture');
+        const state = (0, store_1.readJournal)(repo, 'main').state;
+        state.planBinding = { ...state.planBinding, schema: v2Plan.schema, digest: v2Plan.planDigest,
+            executionDigest: v2Plan.executionDigest, executionIdentitySchema: 'awm-plan-execution/v1' };
+        state.cycle.blockedReason = reason;
+        (0, store_1.writeJournal)(repo, 'main', state);
+        const revision = (0, store_1.readJournal)(repo, 'main').state.revision;
+        await expect((0, admission_recovery_1.recoverAdmissionCustody)(repo, 'main', input, blocked('ADMISSION_SENSORS_BLOCKED', 'current', 'not-certified'))).rejects.toThrow();
+        expect((0, store_1.readJournal)(repo, 'main').state.revision).toBe(revision);
+        expect(await (0, admission_recovery_1.recoverAdmissionCustody)(repo, 'main', input, admitted)).toBe('recovered');
+        const recovered = (0, store_1.readJournal)(repo, 'main').state;
+        expect(recovered.cycle.status).toBe('IN_PROGRESS');
+        expect(recovered.planBinding?.schema).toBe('compact-slices/v2');
+        expect(recovered.admissionRecoveries?.at(-1)?.blockedReason).toBe(reason);
+        expect(recovered.generations).toEqual(state.generations);
+    });
     test('changed binding, active request problem, pending job and identity mismatch all fail closed', async () => {
         const check = async (mutate, pattern) => {
             const state = (0, store_1.readJournal)(repo, 'main').state;
@@ -181,6 +205,26 @@ describe('issue #196: admission custody recovery', () => {
         const sJob = (0, store_1.readJournal)(repo, 'main').state;
         sJob.jobs = {};
         (0, store_1.writeJournal)(repo, 'main', sJob);
+        await check(state => {
+            state.routingAttempts = [{ schema: 'routing-attempt/v1', id: 'route-1',
+                    obligationId: 'S1-implementer', lineageId: 'S1', attempt: 1, envelope: routing_approval_1.routingEnvelope,
+                    envelopeDigest: 'e'.repeat(64), fingerprint: 'f'.repeat(64), state: 'active',
+                    nativeAgentId: 'native-child' }];
+        }, /nativ|routing|attempt|intento/i);
+        const sRouting = (0, store_1.readJournal)(repo, 'main').state;
+        sRouting.routingAttempts = [];
+        (0, store_1.writeJournal)(repo, 'main', sRouting);
+        await check(state => {
+            state.routingAttempts = [{ schema: 'routing-attempt/v1', id: 'route-1',
+                    obligationId: 'S1-implementer', lineageId: 'S1', attempt: 1, envelope: routing_approval_1.routingEnvelope,
+                    envelopeDigest: 'e'.repeat(64), fingerprint: 'f'.repeat(64), state: 'reserved' }];
+            state.dispatches.push({ id: 'linked', taskId: 'S1', at: new Date().toISOString(),
+                routingAttemptId: 'route-1', dispatchRequestId: 'linked-ack' });
+        }, /nativ|routing|attempt|intento|dispatch/i);
+        const sPendingChild = (0, store_1.readJournal)(repo, 'main').state;
+        sPendingChild.routingAttempts = [];
+        sPendingChild.dispatches = [];
+        (0, store_1.writeJournal)(repo, 'main', sPendingChild);
         await check(state => { state.generations[0].processRef = (0, process_1.captureSelfRef)('recovery-test'); }, /controller/i);
         const sController = (0, store_1.readJournal)(repo, 'main').state;
         sController.generations[0].processRef = undefined;

package/dist/tests/commands/watch/plan-lifecycle.test.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -19,6 +52,7 @@ const supervisor_1 = require("../../../src/commands/watch/supervisor");
 const exec_wrapper_1 = require("../../../src/commands/job/exec-wrapper");
 const lock_1 = require("../../../src/commands/watch/lock");
 const archive_unused_1 = require("../../../src/commands/watch/archive-unused");
+const adapterModule = __importStar(require("../../../src/core/journal/adapter"));
 jest.setTimeout(30000);
 function valid(repo) {
     const report = (0, validate_1.validatePlanFile)('docs/plan.md', repo);
@@ -43,7 +77,7 @@ describe('compact lifecycle proof and unused bootstrap archival', () => {
         fs_1.default.writeFileSync(path_1.default.join(repo, 'docs/plan.md'), `${fs_1.default.readFileSync(path_1.default.join(__dirname, '../../core/plan/fixtures/compact-slices-v1/valid.md'), 'utf8')}\n- [ ] Reviewed task.\n`);
         (0, init_1.initWatch)(repo, 'main', { path: 'docs/plan.md', report: valid(repo) });
     });
-    afterEach(() => { fs_1.default.rmSync(repo, { recursive: true, force: true }); });
+    afterEach(() => { jest.restoreAllMocks(); fs_1.default.rmSync(repo, { recursive: true, force: true }); });
     test('durable journal retains hash commitments only, never the validated plan source body', () => {
         const contents = (directory) => fs_1.default.readdirSync(directory, { withFileTypes: true }).map(entry => entry.isDirectory() ? contents(path_1.default.join(directory, entry.name)) : fs_1.default.readFileSync(path_1.default.join(directory, entry.name), 'utf8')).join('\n');
         expect(contents((0, paths_1.journalDir)(repo, 'main'))).not.toContain('Reviewed task.');
@@ -138,6 +172,18 @@ describe('compact lifecycle proof and unused bootstrap archival', () => {
                     fingerprint: (0, fingerprint_1.computeFingerprint)(repo, argv, ['source.md'], '.').fingerprint, argv, paths: ['source.md'], cwd: '.',
                 } });
         }
+        // This fixture acts as the external controller. Give it an adopted
+        // identity before expecting the supervisor to dispatch verification
+        // jobs; launch intent alone is deliberately insufficient.
+        expect(await supervisor.tick()).toBe('continue');
+        const launched = (0, store_1.readJournal)(repo, 'main').state;
+        const gen = launched.generations.find(entry => entry.token === generation.token);
+        gen.processRef = { pid: process.pid, processGroup: process.pid, startTime: 'fixture',
+            spawnNonce: gen.spawnNonce, argvDigest: gen.launchArgvDigest, psArgsDigest: 'b'.repeat(64) };
+        (0, store_1.writeJournal)(repo, 'main', launched);
+        const adapter = adapterModule.adapterFor('codex');
+        jest.spyOn(adapterModule, 'adapterFor').mockReturnValue({ ...adapter,
+            activity: () => ({ cpuTime: '0', groupSize: 1 }), safeToReplace: () => 'indeterminate' });
         for (let i = 0; i < 100; i++) {
             expect(await supervisor.tick()).toBe('continue');
             if (Object.values((0, store_1.readJournal)(repo, 'main').state.jobs).some(job => job.verdict === 'pass'))