agentic-workflow-manager 9.17.0 → 9.19.0

package/dist/src/commands/registry/index.js

@@ -8,6 +8,7 @@ exports.registerRegistryCommand = registerRegistryCommand;
 const fs_1 = __importDefault(require("fs"));
 const prompts_1 = require("@clack/prompts");
 const picocolors_1 = __importDefault(require("picocolors"));
+const path_1 = __importDefault(require("path"));
 const registries_1 = require("../../core/registries");
 const discovery_1 = require("../../core/discovery");
 const bundles_1 = require("../../core/bundles");
@@ -16,10 +17,22 @@ const regenerate_1 = require("../../core/context/regenerate");
 const add_1 = require("./add");
 const remove_1 = require("./remove");
 const status_1 = require("./status");
+const doctor_1 = require("./doctor");
+const scaffold_1 = require("./scaffold");
 const config_1 = require("../../utils/config");
 const profile_1 = require("../../core/profile");
 const providers_1 = require("../../providers");
 const install_bundles_1 = require("./install-bundles");
+function resolveDoctorTarget(nameOrPath) {
+    if (!nameOrPath) {
+        throw new Error('Specify a registry name or path: awm registry doctor <name|path>');
+    }
+    const asPath = path_1.default.resolve(nameOrPath);
+    if (fs_1.default.existsSync(asPath) && fs_1.default.statSync(asPath).isDirectory()) {
+        return asPath;
+    }
+    return (0, registries_1.registryContentRoot)(nameOrPath);
+}
 function registerRegistryCommand(program) {
     const reg = program.command('registry').description('manage additional content registries (team/personal)');
     reg.command('add <remote>')
@@ -173,4 +186,43 @@ function registerRegistryCommand(program) {
         }
         (0, prompts_1.outro)(`✅ Registry ${picocolors_1.default.cyan(name)} removed.`);
     });
+    reg.command('scaffold <dir>')
+        .description('create a minimal registry layout (handbook + facts) that passes doctor')
+        .action((dir) => {
+        (0, prompts_1.intro)(picocolors_1.default.bgCyan(picocolors_1.default.black(' AWM - Scaffold Registry ')));
+        const result = (0, scaffold_1.scaffoldRegistry)(dir);
+        if (!result.ok) {
+            console.error(picocolors_1.default.red(result.error));
+            process.exit(1);
+            return;
+        }
+        (0, prompts_1.outro)(`✅ Registry scaffolded at ${picocolors_1.default.cyan(result.dir)}. Run ${picocolors_1.default.cyan('awm registry doctor ' + result.dir)} to audit.`);
+    });
+    reg.command('doctor [nameOrPath]')
+        .description('audit a registry tree (structural failures vs advisories)')
+        .action((nameOrPath) => {
+        let root;
+        try {
+            root = resolveDoctorTarget(nameOrPath);
+        }
+        catch (e) {
+            console.error(picocolors_1.default.red(e instanceof Error ? e.message : String(e)));
+            process.exit(1);
+            return;
+        }
+        const report = (0, doctor_1.doctorRegistry)(root);
+        for (const msg of report.structural) {
+            console.error(picocolors_1.default.red(`structural: ${msg}`));
+        }
+        for (const msg of report.advisories) {
+            console.warn(picocolors_1.default.yellow(`advisory: ${msg}`));
+        }
+        if (report.structural.length === 0 && report.advisories.length === 0) {
+            console.log(picocolors_1.default.green(`Registry doctor: ok (${root})`));
+        }
+        else if (report.structural.length === 0) {
+            console.log(picocolors_1.default.green(`Registry doctor: ok with ${report.advisories.length} advisory(ies)`));
+        }
+        process.exit((0, doctor_1.doctorExitCode)(report));
+    });
 }

package/dist/src/commands/registry/scaffold.js

@@ -0,0 +1,140 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scaffoldRegistry = scaffoldRegistry;
+// cli/src/commands/registry/scaffold.ts
+// Logic for `awm registry scaffold`, separated from commander wiring.
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const types_1 = require("../../core/facts/types");
+function writeJson(write, file, value) {
+    write(file, JSON.stringify(value, null, 2) + '\n');
+}
+function handbookFor(name) {
+    return `# ${name}
+
+## Capabilities
+| id | status | notes |
+|----|--------|-------|
+| facts | active | see ## Capability: facts |
+
+## Capability: facts
+
+Declare operator/machine facts in \`facts.json\`. Skills may list \`needs\` in
+frontmatter; values live in the machine-local environment store
+(\`AWM_HOME/environments/\`), never in this registry tree.
+
+- Add fact definitions under \`facts\` in \`facts.json\` (\`schemaVersion: 1\`).
+- Keep \`minCliVersion\` in \`awm-registry.json\` at or above the CLI version that
+  understands facts.
+- Run \`awm registry doctor\` before publishing — structural failures block; advisories do not.
+`;
+}
+function writeScaffoldTree(root, name, write) {
+    writeJson(write, path_1.default.join(root, 'awm-registry.json'), {
+        overrides: [],
+        minCliVersion: types_1.FACTS_MIN_CLI_VERSION,
+    });
+    writeJson(write, path_1.default.join(root, 'catalog.json'), {
+        version: 1,
+        bundles: [],
+    });
+    const skillsDir = path_1.default.join(root, 'skills');
+    fs_1.default.mkdirSync(skillsDir, { recursive: true });
+    // Track skills/ in git — an empty dir is dropped on clone and then
+    // validateRegistryLayout / awm registry add reject the tree (RF-4.1).
+    write(path_1.default.join(skillsDir, '.gitkeep'), '');
+    writeJson(write, path_1.default.join(root, 'facts.json'), {
+        schemaVersion: 1,
+        facts: {},
+    });
+    write(path_1.default.join(root, 'REGISTRY.md'), handbookFor(name));
+}
+/**
+ * Create a minimal registry tree that passes structural `doctorRegistry`.
+ * Atomic (RF-4.3): write into a temp sibling, then rename into place; on
+ * failure remove only the staging dir so an empty preexisting target stays
+ * empty (retryable) and a missing target stays absent.
+ */
+function scaffoldRegistry(dir, opts = {}) {
+    if (typeof dir !== 'string' || dir.trim() === '') {
+        return { ok: false, error: 'scaffold target directory is required' };
+    }
+    const abs = path_1.default.resolve(dir);
+    const write = opts.writeFileSync ?? ((file, data) => fs_1.default.writeFileSync(file, data));
+    let targetExistsEmpty = false;
+    if (fs_1.default.existsSync(abs)) {
+        let stat;
+        try {
+            stat = fs_1.default.lstatSync(abs);
+        }
+        catch (e) {
+            return {
+                ok: false,
+                error: `Cannot inspect target ${abs}: ${e instanceof Error ? e.message : String(e)}`,
+            };
+        }
+        if (!stat.isDirectory() || stat.isSymbolicLink()) {
+            return { ok: false, error: `Target exists and is not a directory: ${abs}` };
+        }
+        if (fs_1.default.readdirSync(abs).length > 0) {
+            return {
+                ok: false,
+                error: `Target directory is not empty — refuse to overwrite: ${abs}`,
+            };
+        }
+        targetExistsEmpty = true;
+    }
+    const parent = path_1.default.dirname(abs);
+    let staging;
+    try {
+        fs_1.default.mkdirSync(parent, { recursive: true });
+        staging = fs_1.default.mkdtempSync(path_1.default.join(parent, '.awm-scaffold-'));
+        const name = path_1.default.basename(abs) || 'registry';
+        // Always stage first so mid-fail never leaves a partial target (RF-4.3).
+        writeScaffoldTree(staging, name, write);
+        if (targetExistsEmpty) {
+            // Never rmdir the empty shell before contents land. Write into abs
+            // directly from the validated staging pattern, then drop staging.
+            try {
+                writeScaffoldTree(abs, name, write);
+            }
+            catch (writeErr) {
+                // Best-effort: remove what we wrote into the preexisting empty
+                // dir without deleting the empty shell itself.
+                try {
+                    for (const entry of fs_1.default.readdirSync(abs)) {
+                        fs_1.default.rmSync(path_1.default.join(abs, entry), { recursive: true, force: true });
+                    }
+                }
+                catch {
+                    // best-effort
+                }
+                throw writeErr;
+            }
+            fs_1.default.rmSync(staging, { recursive: true, force: true });
+            staging = undefined;
+            return { ok: true, dir: abs };
+        }
+        // Target does not exist: atomic rename of staging into place.
+        fs_1.default.renameSync(staging, abs);
+        staging = undefined;
+        return { ok: true, dir: abs };
+    }
+    catch (e) {
+        if (staging) {
+            try {
+                fs_1.default.rmSync(staging, { recursive: true, force: true });
+            }
+            catch {
+                // best-effort cleanup; surface the original write error
+            }
+        }
+        return {
+            ok: false,
+            error: `Scaffold failed: ${e instanceof Error ? e.message : String(e)}`,
+        };
+    }
+}

package/dist/src/commands/sensors/read-only-observation.js

@@ -0,0 +1,305 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_EXCLUSION_NAMES = exports.READ_ONLY_MAX_BYTES = exports.READ_ONLY_MAX_ENTRIES = void 0;
+exports.loadAdmissionConfig = loadAdmissionConfig;
+exports.createExclusionPolicy = createExclusionPolicy;
+exports.gitVerifier = gitVerifier;
+exports.filesystemSnapshot = filesystemSnapshot;
+exports.snapshotUnavailableRemedy = snapshotUnavailableRemedy;
+exports.admissionConfigRemedy = admissionConfigRemedy;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const crypto_1 = __importDefault(require("crypto"));
+const child_process_1 = require("child_process");
+/**
+ * Admission's read-only observation (issue #215). `runSensors({ readOnly })` hashes
+ * the project tree before and after the sensors run; any difference means the
+ * evidence is not read-only. Generated output (node_modules, .next, …) can push that
+ * walk past its limits, so a directory that git ignores and that holds no tracked
+ * file may be skipped. Source files, `.gitignore`, and `.awm/` stay observed.
+ */
+exports.READ_ONLY_MAX_ENTRIES = 250_000;
+exports.READ_ONLY_MAX_BYTES = 1024 * 1024 * 1024;
+exports.DEFAULT_EXCLUSION_NAMES = Object.freeze(['node_modules', '.next', '.turbo', 'dist', 'build', 'coverage', '.venv', 'target']);
+const ADMISSION_CONFIG_LABEL = '.awm/admission.json';
+const GIT_TIMEOUT_MS = 5_000;
+const GIT_MAX_OUTPUT_BYTES = 64 * 1024;
+const MAX_FIELD_LABEL = 64;
+const MAX_CONFIG_BYTES = 65_536;
+// Control characters (C0, DEL, C1), bidi controls (marks, embeddings, isolates) and line/paragraph separators.
+const UNSAFE_LABEL_CHARS = /[\p{Cc}\p{Bidi_Control}\u2028\u2029]/gu;
+// Variables that relocate the repository, index or object store: inherited ones would
+// make git answer for a different repository than `projectRoot` (fail-open).
+const GIT_LOCATION_VARIABLES = new Set([
+    'GIT_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE', 'GIT_OBJECT_DIRECTORY',
+    'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_COMMON_DIR', 'GIT_NAMESPACE', 'GIT_PREFIX',
+]);
+const RESERVED_NAMES = new Set(['.git', '.awm']);
+const DEFAULT_LIMITS = { maxEntries: exports.READ_ONLY_MAX_ENTRIES, maxBytes: exports.READ_ONLY_MAX_BYTES };
+function requireRoot(value, label) {
+    if (typeof value !== 'string' || value.trim() === '')
+        throw new Error(`${label} must be a non-empty string`);
+    return value;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Unknown keys come from the project file: bound them and neutralize control characters. */
+function fieldLabel(key) {
+    const clean = key.replace(UNSAFE_LABEL_CHARS, '?');
+    return clean.length <= MAX_FIELD_LABEL ? clean : `${clean.slice(0, MAX_FIELD_LABEL - 1)}…`;
+}
+function defaultRules() {
+    return exports.DEFAULT_EXCLUSION_NAMES.map(name => ({ kind: 'name', name }));
+}
+/** Exact, case-insensitive match: `my.awm` and `.gitignore-dir` are not reserved. */
+function isReservedSegment(segment) {
+    return RESERVED_NAMES.has(segment.toLowerCase());
+}
+function entryProblem(entry) {
+    if (entry === '')
+        return 'must not be empty';
+    if (/[\0\r\n\\*?[]/.test(entry))
+        return 'must not contain a backslash, wildcard, NUL or line break';
+    if (entry.startsWith('/') || /^[A-Za-z]:/.test(entry))
+        return 'must be relative to the project root';
+    if (entry.endsWith('/'))
+        return 'must not end with "/"';
+    const segments = entry.split('/');
+    if (segments.some(segment => segment === '' || segment === '.' || segment === '..'))
+        return 'must not contain an empty, "." or ".." segment';
+    if (segments.some(isReservedSegment))
+        return 'must not exclude .git or .awm';
+    return null;
+}
+/** Strict parser for the optional `.awm/admission.json`; absent means AWM defaults. */
+function loadAdmissionConfig(projectRoot) {
+    const root = requireRoot(projectRoot, 'admission config projectRoot');
+    const invalid = (field, message) => ({ ok: false, field, message });
+    const file = path_1.default.join(root, '.awm', 'admission.json');
+    // The file is repo-controlled: inspect it before reading so a link, device or huge
+    // file can never be followed or slurped into memory.
+    let stat;
+    try {
+        stat = fs_1.default.lstatSync(file);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { ok: true, config: { defaults: true, rules: defaultRules() } };
+        return invalid('(file)', 'could not be read');
+    }
+    if (!stat.isFile())
+        return invalid('(file)', 'must be a regular file, not a link or device');
+    if (stat.size > MAX_CONFIG_BYTES)
+        return invalid('(file)', `is larger than ${MAX_CONFIG_BYTES} bytes`);
+    let raw;
+    try {
+        raw = fs_1.default.readFileSync(file, 'utf8');
+    }
+    catch {
+        return invalid('(file)', 'could not be read');
+    }
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        return invalid('(file)', 'is not valid JSON');
+    }
+    if (!isRecord(value))
+        return invalid('(root)', 'must be a JSON object');
+    const unknownRoot = Object.keys(value).find(key => key !== 'schemaVersion' && key !== 'readOnlyObservation');
+    if (unknownRoot !== undefined)
+        return invalid(fieldLabel(unknownRoot), 'is not a known field');
+    if (value.schemaVersion !== 1)
+        return invalid('schemaVersion', 'must be 1');
+    const observation = 'readOnlyObservation' in value ? value.readOnlyObservation : {};
+    if (!isRecord(observation))
+        return invalid('readOnlyObservation', 'must be an object');
+    const unknownObservation = Object.keys(observation).find(key => key !== 'defaults' && key !== 'exclude');
+    if (unknownObservation !== undefined)
+        return invalid(`readOnlyObservation.${fieldLabel(unknownObservation)}`, 'is not a known field');
+    const defaults = 'defaults' in observation ? observation.defaults : true;
+    if (typeof defaults !== 'boolean')
+        return invalid('readOnlyObservation.defaults', 'must be a boolean');
+    const exclude = 'exclude' in observation ? observation.exclude : [];
+    if (!Array.isArray(exclude))
+        return invalid('readOnlyObservation.exclude', 'must be an array of strings');
+    const rules = defaults ? defaultRules() : [];
+    for (const [index, entry] of exclude.entries()) {
+        const field = `readOnlyObservation.exclude[${index}]`;
+        if (typeof entry !== 'string')
+            return invalid(field, 'must be a string');
+        const problem = entryProblem(entry);
+        if (problem)
+            return invalid(field, problem);
+        rules.push(entry.includes('/') ? { kind: 'path', path: entry } : { kind: 'name', name: entry });
+    }
+    return { ok: true, config: { defaults, rules } };
+}
+/**
+ * Rule matching plus cached verdicts. The same policy instance serves the before and
+ * after snapshots, so a candidate is verified once and both passes agree.
+ */
+function createExclusionPolicy(config, verifier) {
+    if (!config || !Array.isArray(config.rules) || typeof config.defaults !== 'boolean')
+        throw new Error('exclusion policy requires a validated admission config');
+    if (typeof verifier !== 'function')
+        throw new Error('exclusion policy requires a candidate verifier');
+    const names = new Set(config.rules.flatMap(rule => (rule.kind === 'name' ? [rule.name] : [])));
+    const paths = new Set(config.rules.flatMap(rule => (rule.kind === 'path' ? [rule.path] : [])));
+    const verdicts = new Map();
+    return {
+        isExcluded(relativePath, name) {
+            // .git and .awm are never excluded, at any depth, nor anything inside them (B-R5).
+            if (relativePath.split('/').some(isReservedSegment))
+                return false;
+            if (!names.has(name) && !paths.has(relativePath))
+                return false;
+            let verdict = verdicts.get(relativePath);
+            if (verdict === undefined) {
+                verdict = verifier(relativePath);
+                verdicts.set(relativePath, verdict);
+            }
+            return verdict === 'excluded';
+        },
+        evidence() {
+            const excluded = [];
+            const rejected = [];
+            const sorted = [...verdicts.entries()].sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0));
+            for (const [candidate, verdict] of sorted) {
+                if (verdict === 'excluded')
+                    excluded.push(candidate);
+                else
+                    rejected.push({ path: candidate, reason: verdict });
+            }
+            return { defaults: config.defaults, excluded, rejected };
+        },
+    };
+}
+/** A copy of `env` without repository-location variables (case-insensitive: Windows). */
+function scrubGitLocation(env) {
+    const scrubbed = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (!GIT_LOCATION_VARIABLES.has(key.toUpperCase()))
+            scrubbed[key] = value;
+    }
+    return scrubbed;
+}
+/** Git decides: no tracked file inside (checked first) and ignored. Any doubt observes. */
+function gitVerifier(projectRoot, env = process.env, spawn = child_process_1.spawnSync) {
+    const cwd = requireRoot(projectRoot, 'git verifier projectRoot');
+    const childEnv = scrubGitLocation(env);
+    const git = (args) => spawn('git', args, {
+        cwd,
+        env: childEnv,
+        encoding: 'utf8',
+        timeout: GIT_TIMEOUT_MS,
+        maxBuffer: GIT_MAX_OUTPUT_BYTES,
+        windowsHide: true,
+        stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    return relativePath => {
+        // Git reads magic prefixes (":(top)", ":/") even after "--"; a leading "./"
+        // makes the candidate an ordinary relative pathspec, so a directory that is
+        // literally named like magic is never mistaken for a different path.
+        const pathspec = `./${relativePath}`;
+        // Tracked first: git already reports a directory holding a force-added file
+        // as not ignored, which would hide the more precise reason.
+        const tracked = git(['ls-files', '-z', '--', pathspec]);
+        if (tracked.error?.code === 'ENOBUFS')
+            return 'contains-tracked';
+        if (tracked.error || tracked.status !== 0)
+            return 'git-unavailable';
+        if (tracked.stdout !== '')
+            return 'contains-tracked';
+        const ignored = git(['check-ignore', '-q', '--', pathspec]);
+        if (ignored.error)
+            return 'git-unavailable';
+        if (ignored.status === 0)
+            return 'excluded';
+        return ignored.status === 1 ? 'not-ignored' : 'git-unavailable';
+    };
+}
+class SnapshotLimitError extends Error {
+    failure;
+    constructor(failure) {
+        super(failure);
+        this.failure = failure;
+    }
+}
+/**
+ * A git status only sees tracked and non-ignored paths, while a sensor can mutate
+ * ignored runtime files (notably `.awm/`) just as easily, so the actual tree is
+ * hashed. The walk is bounded: inability to observe the whole declared project means
+ * no admission certificate. Excluded directories contribute nothing; observed
+ * directories are hashed without their size, which changes as entries come and go
+ * and is already covered by their children.
+ */
+function filesystemSnapshot(root, policy, limits = DEFAULT_LIMITS) {
+    requireRoot(root, 'snapshot root');
+    if (!Number.isSafeInteger(limits.maxEntries) || limits.maxEntries < 1 || !Number.isSafeInteger(limits.maxBytes) || limits.maxBytes < 1) {
+        throw new Error('snapshot limits must be positive integers');
+    }
+    try {
+        const digest = crypto_1.default.createHash('sha256');
+        let entriesSeen = 0;
+        let bytesSeen = 0;
+        const visit = (directory, relative) => {
+            const entries = fs_1.default.readdirSync(directory, { withFileTypes: true })
+                .sort((left, right) => left.name.localeCompare(right.name));
+            for (const entry of entries) {
+                // Git's internal bookkeeping changes as a consequence of normal
+                // observation, not project sensor execution.
+                if (relative === '' && entry.name === '.git')
+                    continue;
+                const child = path_1.default.join(directory, entry.name);
+                const childRelative = relative === '' ? entry.name : `${relative}/${entry.name}`;
+                const stat = fs_1.default.lstatSync(child);
+                if (stat.isDirectory() && policy?.isExcluded(childRelative, entry.name))
+                    continue;
+                if (++entriesSeen > limits.maxEntries)
+                    throw new SnapshotLimitError('limit-entries');
+                if (stat.isDirectory()) {
+                    digest.update(`${childRelative}\0${stat.mode}\0directory\0`);
+                    visit(child, childRelative);
+                    continue;
+                }
+                digest.update(`${childRelative}\0${stat.mode}\0${stat.size}\0`);
+                if (stat.isFile()) {
+                    if ((bytesSeen += stat.size) > limits.maxBytes)
+                        throw new SnapshotLimitError('limit-bytes');
+                    digest.update('file\0');
+                    digest.update(fs_1.default.readFileSync(child));
+                }
+                else if (stat.isSymbolicLink()) {
+                    digest.update(`symlink\0${fs_1.default.readlinkSync(child)}\0`);
+                }
+                else {
+                    digest.update(`special\0${stat.rdev}\0`);
+                }
+            }
+        };
+        visit(root, '');
+        return { ok: true, digest: digest.digest('hex') };
+    }
+    catch (error) {
+        // Every unexpected error (unreadable entry, vanished file, a throwing injected
+        // policy) is deliberately reported as 'unreadable': a tree that cannot be fully
+        // observed must fail closed instead of yielding a digest.
+        return { ok: false, failure: error instanceof SnapshotLimitError ? error.failure : 'unreadable' };
+    }
+}
+function snapshotUnavailableRemedy(failure) {
+    if (failure === 'unreadable')
+        return 'run admission from a readable git worktree';
+    const limit = failure === 'limit-bytes' ? `${exports.READ_ONLY_MAX_BYTES / 1024 ** 3} GiB of observed file content` : `${exports.READ_ONLY_MAX_ENTRIES} observed entries`;
+    return `the project tree exceeds the read-only observation limit of ${limit}; git-ignore heavy generated directories `
+        + `(ignored ${exports.DEFAULT_EXCLUSION_NAMES.join(', ')} are skipped by default) or declare them in ${ADMISSION_CONFIG_LABEL} readOnlyObservation.exclude`;
+}
+function admissionConfigRemedy(problem) {
+    return `repair ${ADMISSION_CONFIG_LABEL}: ${problem.field} ${problem.message}`;
+}

package/dist/src/commands/sensors/run.js

@@ -8,10 +8,8 @@ exports.findManifestDir = findManifestDir;
 exports.detectPackDrift = detectPackDrift;
 exports.resolveConcurrency = resolveConcurrency;
 exports.runSensors = runSensors;
-const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
-const crypto_1 = __importDefault(require("crypto"));
 const baseline_1 = require("./baseline");
 const result_1 = require("./result");
 Object.defineProperty(exports, "applyBaseline", { enumerable: true, get: function () { return result_1.applyBaseline; } });
@@ -28,64 +26,12 @@ const registries_1 = require("../../core/registries");
 const prepare_1 = require("./prepare");
 const verdict_1 = require("./verdict");
 const project_1 = require("./project");
+const read_only_observation_1 = require("./read-only-observation");
 // Sensor JSON output can be several MB on large repos (e.g. `eslint --format json`
 // with thousands of findings). A 1MB cap killed the child with SIGTERM when
 // exceeded — which previously surfaced as a false "timeout".
 /** Hard ceiling on parallel sensors: past this, they only contend for the same cores. */
 const MAX_CONCURRENCY = 4;
-const READ_ONLY_MAX_ENTRIES = 250_000;
-const READ_ONLY_MAX_BYTES = 1024 * 1024 * 1024;
-/**
- * A git status only sees tracked and non-ignored paths, while a sensor can
- * mutate ignored runtime files (notably `.awm/`) just as easily. Hash the
- * actual project tree instead. The scan is deliberately bounded: inability to
- * observe the whole declared project means no admission certificate.
- */
-function filesystemSnapshot(root) {
-    try {
-        const digest = crypto_1.default.createHash('sha256');
-        let entriesSeen = 0;
-        let bytesSeen = 0;
-        const visit = (directory, relative) => {
-            const entries = fs_1.default.readdirSync(directory, { withFileTypes: true })
-                .sort((left, right) => left.name.localeCompare(right.name));
-            for (const entry of entries) {
-                // Git's internal bookkeeping changes as a consequence of normal
-                // observation, not project sensor execution. Everything else,
-                // including ignored/untracked `.awm`, is evidence-relevant.
-                if (relative === '' && entry.name === '.git')
-                    continue;
-                if (++entriesSeen > READ_ONLY_MAX_ENTRIES)
-                    throw new Error('snapshot-entry-limit');
-                const child = path_1.default.join(directory, entry.name);
-                const childRelative = relative === '' ? entry.name : `${relative}/${entry.name}`;
-                const stat = fs_1.default.lstatSync(child);
-                digest.update(`${childRelative}\0${stat.mode}\0${stat.size}\0`);
-                if (stat.isDirectory()) {
-                    digest.update('directory\0');
-                    visit(child, childRelative);
-                }
-                else if (stat.isFile()) {
-                    if ((bytesSeen += stat.size) > READ_ONLY_MAX_BYTES)
-                        throw new Error('snapshot-byte-limit');
-                    digest.update('file\0');
-                    digest.update(fs_1.default.readFileSync(child));
-                }
-                else if (stat.isSymbolicLink()) {
-                    digest.update(`symlink\0${fs_1.default.readlinkSync(child)}\0`);
-                }
-                else {
-                    digest.update(`special\0${stat.rdev}\0`);
-                }
-            }
-        };
-        visit(root, '');
-        return digest.digest('hex');
-    }
-    catch {
-        return null;
-    }
-}
 async function resolveLiveFromSource(cwd, source, packSelection) {
     try {
         const parsed = (0, contract_1.parseSensorPack)(JSON.parse(source.content), source.path);
@@ -213,9 +159,20 @@ async function runSensors(opts = {}) {
         configured = project;
     }
     const manifestDir = configured.projectRoot;
-    const beforeReadOnly = opts.readOnly ? filesystemSnapshot(manifestDir) : undefined;
-    if (opts.readOnly && beforeReadOnly === null) {
-        return { sensors: [], overall: 'not_certified', projectRoot: configured.projectRoot, manifestPath: configured.manifestPath, mode: 'invalid', reason: 'read-only-observation-unavailable', remedy: 'run admission from a readable git worktree' };
+    // Admission-only: `.awm/admission.json` is never read for ordinary runs.
+    let readOnlyPolicy;
+    let beforeReadOnly;
+    if (opts.readOnly) {
+        const admissionConfig = (0, read_only_observation_1.loadAdmissionConfig)(manifestDir);
+        if (!admissionConfig.ok) {
+            return { sensors: [], overall: 'not_certified', projectRoot: configured.projectRoot, manifestPath: configured.manifestPath, mode: 'invalid', reason: 'admission-config-invalid', remedy: (0, read_only_observation_1.admissionConfigRemedy)(admissionConfig) };
+        }
+        readOnlyPolicy = (0, read_only_observation_1.createExclusionPolicy)(admissionConfig.config, (0, read_only_observation_1.gitVerifier)(manifestDir));
+        const before = (0, read_only_observation_1.filesystemSnapshot)(manifestDir, readOnlyPolicy);
+        if (!before.ok) {
+            return { sensors: [], overall: 'not_certified', projectRoot: configured.projectRoot, manifestPath: configured.manifestPath, mode: 'invalid', reason: 'read-only-observation-unavailable', remedy: (0, read_only_observation_1.snapshotUnavailableRemedy)(before.failure), readOnlyObservation: readOnlyPolicy.evidence() };
+        }
+        beforeReadOnly = before.digest;
     }
     const parsed = configured.manifest;
     const authority = { projectRoot: configured.projectRoot, manifestPath: configured.manifestPath };
@@ -382,8 +339,14 @@ async function runSensors(opts = {}) {
         ...(drift?.drift ? { packDrift: drift.drift } : {}),
         ...(changed ? { changedScope: { files: changed.files.length, ...(changed.error ? { error: changed.error } : {}) } } : {}),
     };
-    if (opts.readOnly && filesystemSnapshot(manifestDir) !== beforeReadOnly) {
-        return { ...output, overall: 'not_certified', reason: 'read-only-mutation-detected', remedy: 'sensor execution changed the worktree; repair it before using this evidence for admission' };
+    if (readOnlyPolicy) {
+        // Same policy instance: cached verdicts keep both passes consistent.
+        const after = (0, read_only_observation_1.filesystemSnapshot)(manifestDir, readOnlyPolicy);
+        const readOnlyObservation = readOnlyPolicy.evidence();
+        if (!after.ok || after.digest !== beforeReadOnly) {
+            return { ...output, overall: 'not_certified', reason: 'read-only-mutation-detected', remedy: 'sensor execution changed the worktree; repair it before using this evidence for admission', readOnlyObservation };
+        }
+        return { ...output, readOnlyObservation };
     }
     return output;
 }

package/dist/src/commands/watch/index.js

@@ -160,6 +160,9 @@ function registerWatchCommand(program) {
         }
         else {
             process.stdout.write(`awm watch: ${outcome === 'stopped' ? 'detenido' : 'track congelado'}; ciclo ${final.cycleState ?? final.state} — sin certificacion de cierre\n`);
+            // exitCode only — never process.exit here: in-process tests call parseAsync
+            // inside Jest; a hard exit kills the worker (CI exit 130 on every OS).
+            // exitCode=130 is intentional Darwin CI flake harden (reopened-196), not operator-environments scope.
             if (outcome === 'stopped')
                 process.exitCode = 130;
             else if (outcome === 'complete' || final.state !== 'present')