agentic-workflow-manager 9.2.1 → 9.3.0

package/dist/src/commands/preflight/checks.js

@@ -13,6 +13,8 @@ const init_1 = require("../sensors/init");
 const baseline_1 = require("../sensors/baseline");
 const run_1 = require("../sensors/run");
 const paths_1 = require("../../core/paths");
+const registries_1 = require("../../core/registries");
+const inspect_1 = require("../../core/context-kernel/inspect");
 const MANIFEST = path_1.default.join('.awm', 'sensors.json');
 /**
  * The agent needs project context delivered every session. A repo with neither file
@@ -31,6 +33,44 @@ function checkContext(cwd) {
     }
     return { id: 'context', ok: true, detail: present.join(', ') };
 }
+function checkContextKernel(cwd) {
+    const resolution = (0, registries_1.resolveProjectContextSchema)();
+    if (resolution.diagnostics.length > 0) {
+        return {
+            id: 'context-kernel',
+            ok: false,
+            advisory: false,
+            detail: `Context Kernel registry declaration is invalid: ${resolution.diagnostics.join('; ')}`,
+            remedy: 'repair the registry manifest or use the safe full-context project files until the registry is valid',
+        };
+    }
+    if (!resolution.declaration)
+        return null;
+    const inspection = (0, inspect_1.inspectContextKernel)(cwd);
+    if (inspection.state === 'legacy') {
+        return {
+            id: 'context-kernel',
+            ok: false,
+            advisory: true,
+            detail: 'legacy full context — Context Kernel v1 migration available',
+            remedy: 'run project-context-init and review the generated rule trace; awm update never rewrites project files',
+        };
+    }
+    if (inspection.state === 'valid') {
+        return {
+            id: 'context-kernel',
+            ok: true,
+            detail: `Context Kernel v${inspection.schema} valid (${inspection.fixedBytes} fixed bytes)`,
+        };
+    }
+    return {
+        id: 'context-kernel',
+        ok: false,
+        advisory: false,
+        detail: inspection.detail,
+        remedy: inspection.remedy,
+    };
+}
 function readManifest(cwd) {
     try {
         return JSON.parse(fs_1.default.readFileSync(path_1.default.join(cwd, MANIFEST), 'utf-8'));
@@ -345,8 +385,10 @@ async function preflight(cwd = process.cwd(), opts = {}) {
     }
     const manifest = readManifest(cwd);
     const manifestExists = fs_1.default.existsSync(path_1.default.join(cwd, MANIFEST));
+    const contextKernel = checkContextKernel(cwd);
     const checks = [
         checkContext(cwd),
+        ...(contextKernel ? [contextKernel] : []),
         checkManifest(cwd, manifest),
         // Skipped when there is no manifest: reporting "tools broken" (or nudging toward
         // a baseline that has nothing to snapshot) on a repo that was never set up
@@ -359,8 +401,11 @@ async function preflight(cwd = process.cwd(), opts = {}) {
         // about PR/MR tooling, not sensors.
         checkHost(cwd),
     ];
-    const status = !manifestExists ? 'not_configured'
-        : checks.every(c => c.ok) ? 'ready'
-            : 'degraded';
+    const blockingFailure = (check) => !check.ok && check.advisory !== true;
+    const invalidContextKernel = contextKernel !== null && blockingFailure(contextKernel);
+    const status = invalidContextKernel ? 'degraded'
+        : !manifestExists ? 'not_configured'
+            : checks.some(blockingFailure) ? 'degraded'
+                : 'ready';
     return { status, checks };
 }

package/dist/src/commands/preflight/index.js

@@ -25,19 +25,18 @@ function formatReport(report) {
     // longer `PreflightCheck['id']` is added (confirmed: 'sensors-baseline', at 16
     // chars, broke a hardcoded 9-char pad).
     const idWidth = Math.max(0, ...report.checks.map(c => c.id.length));
-    const lines = report.checks.map(c => `  ${c.ok ? picocolors_1.default.green('✔') : picocolors_1.default.red('✘')}  ${c.id.padEnd(idWidth)} ${c.detail}`
+    const lines = report.checks.map(c => `  ${c.advisory === true ? picocolors_1.default.yellow('⚠') : c.ok ? picocolors_1.default.green('✔') : picocolors_1.default.red('✘')}  ${c.id.padEnd(idWidth)} ${c.detail}`
         + (c.remedy ? `\n       ${picocolors_1.default.dim('→ ' + c.remedy)}` : ''));
     if (report.status === 'ready') {
         return `${picocolors_1.default.green('✔')}  Harness ready — this project can be gated.\n${lines.join('\n')}\n`;
     }
     const headline = report.status === 'not_configured'
         ? `${picocolors_1.default.red('✘')}  AWM is not configured in this project.`
-        : `${picocolors_1.default.red('✘')}  Harness degraded — it declares sensors it cannot run.`;
+        : `${picocolors_1.default.red('✘')}  Harness degraded — it has blocking preflight failures.`;
     return `${headline}\n${lines.join('\n')}\n\n`
         + `   ${picocolors_1.default.bold('Do not hand this off to an unattended run.')} Every quality phase downstream\n`
-        + `   (implementer, reviewers, post-qa) consumes \`awm sensors run\`. With the harness in\n`
-        + `   this state the gate reports on checks that never ran, and nobody finds out until a\n`
-        + `   bad change is already merged.\n`;
+        + `   (implementer, reviewers, post-qa) consumes these gates. Resolve every blocking\n`
+        + `   check before handoff, so a bad change is not merged.\n`;
 }
 function registerPreflightCommand(program) {
     program

package/dist/src/core/context-kernel/inspect.js

@@ -0,0 +1,221 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectContextKernel = inspectContextKernel;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const INDEX_PATH = ['.awm', 'context', 'index.json'];
+const ROOT_CONTEXT_FILES = ['AGENTS.md', 'CONSTITUTION.md', 'CLAUDE.md'];
+const START_MARKER = '<!-- AWM:CONTEXT-KERNEL:START v1 -->';
+const END_MARKER = '<!-- AWM:CONTEXT-KERNEL:END v1 -->';
+const ANCHOR_MARKER_PREFIX = '<!-- awm-context:';
+const TOP_LEVEL_FIELDS = ['schema', 'kernelFiles', 'maxFixedBytes', 'entries'];
+const ENTRY_FIELDS = ['id', 'tier', 'path', 'anchor', 'when'];
+const REMEDY = 'run project-context-init and review the Context Kernel v1 artifacts';
+function invalid(detail) {
+    return { state: 'invalid', detail, remedy: REMEDY };
+}
+function within(root, candidate) {
+    const relative = path_1.default.relative(root, candidate);
+    return relative === '' || (!relative.startsWith(`..${path_1.default.sep}`) && relative !== '..' && !path_1.default.isAbsolute(relative));
+}
+function count(text, needle) {
+    return text.split(needle).length - 1;
+}
+function exactFields(raw, fields) {
+    const keys = Object.keys(raw);
+    return keys.length === fields.length && fields.every((field) => Object.prototype.hasOwnProperty.call(raw, field));
+}
+function isNormalizedRelative(value) {
+    if (typeof value !== 'string' || value.length === 0 || path_1.default.isAbsolute(value) || path_1.default.win32.isAbsolute(value))
+        return false;
+    if (value.includes('\\') || value.split('/').some((part) => part === '.' || part === '..' || part === ''))
+        return false;
+    return path_1.default.posix.normalize(value) === value;
+}
+function resolveRegularInside(root, relative) {
+    if (!isNormalizedRelative(relative))
+        return { detail: `invalid repository-relative path ${JSON.stringify(relative)}` };
+    const candidate = path_1.default.join(root, relative);
+    try {
+        const stat = fs_1.default.statSync(candidate);
+        if (!stat.isFile())
+            return { detail: `${relative} must resolve to a regular file` };
+        const real = fs_1.default.realpathSync(candidate);
+        if (!within(root, real))
+            return { detail: `${relative} resolves outside the project root` };
+        return { file: real };
+    }
+    catch (error) {
+        return { detail: `${relative} cannot be read: ${error instanceof Error ? error.message : String(error)}` };
+    }
+}
+function parseEntry(raw) {
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw) || !exactFields(raw, ENTRY_FIELDS)) {
+        return { detail: 'each index entry must contain exactly id, tier, path, anchor, when' };
+    }
+    const value = raw;
+    if (typeof value.id !== 'string' || !/^CTX-[A-Z0-9]+(?:-[A-Z0-9]+)*$/.test(value.id) || Buffer.byteLength(value.id, 'utf8') > 80) {
+        return { detail: 'entry id must match CTX-[A-Z0-9-]+ and be at most 80 bytes' };
+    }
+    if (value.tier !== 'kernel' && value.tier !== 'selective')
+        return { detail: 'entry tier must be kernel or selective' };
+    if (!isNormalizedRelative(value.path))
+        return { detail: `invalid repository-relative path ${JSON.stringify(value.path)}` };
+    for (const field of ['anchor', 'when']) {
+        if (typeof value[field] !== 'string' || value[field].length === 0 || Buffer.byteLength(value[field], 'utf8') > 500) {
+            return { detail: `entry ${field} must be a non-empty string of at most 500 bytes` };
+        }
+    }
+    return { entry: { id: value.id, tier: value.tier, path: value.path, anchor: value.anchor, when: value.when } };
+}
+function parseIndex(contents) {
+    let raw;
+    try {
+        raw = JSON.parse(contents);
+    }
+    catch (error) {
+        return { detail: `index is not valid JSON: ${error instanceof Error ? error.message : String(error)}` };
+    }
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw) || !exactFields(raw, TOP_LEVEL_FIELDS)) {
+        return { detail: 'index must contain exactly schema, kernelFiles, maxFixedBytes, entries' };
+    }
+    const value = raw;
+    if (value.schema !== 1 || !Number.isSafeInteger(value.schema))
+        return { detail: 'index schema must be exactly 1' };
+    if (!Array.isArray(value.kernelFiles) || value.kernelFiles.length === 0 || value.kernelFiles.some((file) => !isNormalizedRelative(file)) || new Set(value.kernelFiles).size !== value.kernelFiles.length) {
+        return { detail: 'kernelFiles must be a non-empty unique normalized path array' };
+    }
+    if (value.kernelFiles.some((file) => file.includes('/')))
+        return { detail: 'kernelFiles must name root context files' };
+    if (!Number.isSafeInteger(value.maxFixedBytes) || value.maxFixedBytes < 1)
+        return { detail: 'maxFixedBytes must be a positive integer' };
+    if (!Array.isArray(value.entries) || value.entries.length === 0)
+        return { detail: 'entries must be a non-empty array' };
+    const entries = [];
+    for (const rawEntry of value.entries) {
+        const parsed = parseEntry(rawEntry);
+        if (!parsed.entry)
+            return { detail: parsed.detail };
+        entries.push(parsed.entry);
+    }
+    if (new Set(entries.map((entry) => entry.id)).size !== entries.length)
+        return { detail: 'entry ids must be unique' };
+    if (new Set(entries.map((entry) => entry.anchor)).size !== entries.length)
+        return { detail: 'entry anchors must be unique' };
+    return { index: { schema: 1, kernelFiles: value.kernelFiles, maxFixedBytes: value.maxFixedBytes, entries } };
+}
+function markerBounds(contents) {
+    if (count(contents, START_MARKER) !== 1 || count(contents, END_MARKER) !== 1)
+        return null;
+    const start = contents.indexOf(START_MARKER) + START_MARKER.length;
+    const end = contents.indexOf(END_MARKER);
+    return start < end ? { start, end } : null;
+}
+/** Inspects project-owned Context Kernel v1 artifacts. Invalid project artifacts are
+ * classified explicitly; only invalid public input throws. */
+function inspectContextKernel(cwd) {
+    if (typeof cwd !== 'string' || cwd.length === 0)
+        throw new Error('cwd must be a non-empty directory path');
+    let root;
+    try {
+        root = fs_1.default.realpathSync(cwd);
+        if (!fs_1.default.statSync(root).isDirectory())
+            throw new Error('not a directory');
+    }
+    catch (error) {
+        throw new Error(`cwd must resolve to an existing directory: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const indexFile = path_1.default.join(root, ...INDEX_PATH);
+    let indexExists;
+    try {
+        fs_1.default.lstatSync(indexFile);
+        indexExists = true;
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            return invalid(`${indexFile} cannot be inspected`);
+        indexExists = false;
+    }
+    if (!indexExists) {
+        for (const name of ROOT_CONTEXT_FILES) {
+            const candidate = path_1.default.join(root, name);
+            try {
+                if (fs_1.default.existsSync(candidate) && fs_1.default.statSync(candidate).isFile()) {
+                    const contents = fs_1.default.readFileSync(candidate, 'utf8');
+                    if (!contents.includes('AWM:CONTEXT-KERNEL:') && !contents.includes(ANCHOR_MARKER_PREFIX))
+                        continue;
+                    return invalid(`${name} contains Context Kernel markers but ${INDEX_PATH.join('/')} is missing`);
+                }
+            }
+            catch (error) {
+                return invalid(`${name} cannot be inspected: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        return { state: 'legacy' };
+    }
+    const indexTarget = resolveRegularInside(root, INDEX_PATH.join('/'));
+    if (!indexTarget.file)
+        return invalid(`${INDEX_PATH.join('/')}: ${indexTarget.detail}`);
+    let parsed;
+    try {
+        parsed = parseIndex(fs_1.default.readFileSync(indexTarget.file, 'utf8'));
+    }
+    catch (error) {
+        return invalid(`${INDEX_PATH.join('/')}: cannot be read: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!parsed.index)
+        return invalid(`${INDEX_PATH.join('/')}: ${parsed.detail}`);
+    const index = parsed.index;
+    const files = new Map();
+    for (const kernelFile of index.kernelFiles) {
+        const target = resolveRegularInside(root, kernelFile);
+        if (!target.file)
+            return invalid(`${kernelFile}: ${target.detail}`);
+        const contents = fs_1.default.readFileSync(target.file, 'utf8');
+        if (!markerBounds(contents))
+            return invalid(`${kernelFile}: requires exactly one ordered Context Kernel v1 marker pair`);
+        files.set(kernelFile, contents);
+    }
+    for (const entry of index.entries) {
+        const target = resolveRegularInside(root, entry.path);
+        if (!target.file)
+            return invalid(`${entry.path}: ${target.detail}`);
+        let contents;
+        try {
+            contents = files.get(entry.path) ?? fs_1.default.readFileSync(target.file, 'utf8');
+        }
+        catch (error) {
+            return invalid(`${entry.path}: cannot be read: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const marker = `<!-- ${entry.anchor} -->`;
+        if (count(contents, marker) !== 1)
+            return invalid(`${entry.path}: anchor ${entry.anchor} must appear exactly once`);
+        const anchor = contents.indexOf(marker);
+        const bounds = files.has(entry.path) ? markerBounds(contents) : null;
+        if (entry.tier === 'kernel') {
+            if (!files.has(entry.path))
+                return invalid(`${entry.path}: kernel entry must point to a kernel file`);
+            if (!bounds || anchor < bounds.start || anchor >= bounds.end)
+                return invalid(`${entry.path}: kernel anchor ${entry.anchor} must be inside the protected region`);
+        }
+        else if (bounds && anchor >= bounds.start && anchor < bounds.end) {
+            return invalid(`${entry.path}: selective anchor ${entry.anchor} must be outside the protected region`);
+        }
+    }
+    let fixedBytes = 0;
+    for (const name of ROOT_CONTEXT_FILES) {
+        const candidate = path_1.default.join(root, name);
+        if (!fs_1.default.existsSync(candidate))
+            continue;
+        const target = resolveRegularInside(root, name);
+        if (!target.file)
+            return invalid(`${name}: ${target.detail}`);
+        fixedBytes += fs_1.default.statSync(target.file).size;
+    }
+    if (fixedBytes > index.maxFixedBytes)
+        return invalid(`fixed context bytes ${fixedBytes} exceed maxFixedBytes ${index.maxFixedBytes}`);
+    return { state: 'valid', schema: 1, index, fixedBytes };
+}

package/dist/src/core/context-kernel/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/core/registries.js

@@ -23,6 +23,7 @@ exports.describeRegistrySyncErrors = describeRegistrySyncErrors;
 exports.unusableSyncedRegistries = unusableSyncedRegistries;
 exports.assertSyncedRegistriesUsable = assertSyncedRegistriesUsable;
 exports.readRegistryManifest = readRegistryManifest;
+exports.resolveProjectContextSchema = resolveProjectContextSchema;
 exports.registryNameForPath = registryNameForPath;
 exports.verifyMinCliVersions = verifyMinCliVersions;
 exports.assertRegistryGates = assertRegistryGates;
@@ -363,7 +364,35 @@ function readRegistryManifest(root) {
         }
         minCliVersion = rawMin.replace(/^v/, '');
     }
-    return { overrides: new Set(overrides), minCliVersion };
+    const rawSchema = raw?.projectContextSchema;
+    let projectContextSchema;
+    if (rawSchema !== undefined) {
+        if (rawSchema !== 1) {
+            throw new Error(`Invalid registry manifest at ${file}: "projectContextSchema" must be exactly 1, got ${JSON.stringify(rawSchema)}`);
+        }
+        projectContextSchema = 1;
+    }
+    return { overrides: new Set(overrides), minCliVersion, projectContextSchema };
+}
+/** Finds the first usable registry that declares Context Kernel v1. Every active
+ * registry is inspected even after a declaration is found, so a malformed manifest
+ * cannot be masked by a later valid declaration. */
+function resolveProjectContextSchema() {
+    const diagnostics = [];
+    let declaration;
+    for (const registry of listRegistries()) {
+        if (!validateRegistryLayout(registry.contentRoot))
+            continue;
+        try {
+            if (!declaration && readRegistryManifest(registry.contentRoot).projectContextSchema === 1) {
+                declaration = { registry, schema: 1 };
+            }
+        }
+        catch (error) {
+            diagnostics.push(`Registry "${registry.name}" manifest is invalid: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return declaration ? { declaration, diagnostics } : { diagnostics };
 }
 /** Nombre del registry dueño de un path: el nombre del clone bajo registriesDir(),
  *  o null si no pertenece a ninguno. */

package/dist/tests/commands/preflight/preflight.test.js

@@ -51,9 +51,154 @@ function project(opts = {}) {
 const dirs = [];
 const make = (o) => { const d = project(o); dirs.push(d); return d; };
 afterAll(() => dirs.forEach(d => fs_1.default.rmSync(d, { recursive: true, force: true })));
+let previousAwmHome;
+const awmHomes = [];
+beforeEach(() => {
+    previousAwmHome = process.env.AWM_HOME;
+    const awmHome = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-preflight-home-'));
+    awmHomes.push(awmHome);
+    process.env.AWM_HOME = awmHome;
+});
+afterEach(() => {
+    if (previousAwmHome === undefined)
+        delete process.env.AWM_HOME;
+    else
+        process.env.AWM_HOME = previousAwmHome;
+});
+afterAll(() => awmHomes.forEach(dir => fs_1.default.rmSync(dir, { recursive: true, force: true })));
+function installRegistry(manifest, name = 'test-registry') {
+    const awmHome = process.env.AWM_HOME;
+    const root = path_1.default.join(awmHome, 'registries', name);
+    fs_1.default.mkdirSync(path_1.default.join(root, 'skills'), { recursive: true });
+    const config = fs_1.default.existsSync(path_1.default.join(awmHome, 'registries.json'))
+        ? JSON.parse(fs_1.default.readFileSync(path_1.default.join(awmHome, 'registries.json'), 'utf8'))
+        : [];
+    config.push({ name, remote: `https://example.invalid/${name}.git` });
+    fs_1.default.writeFileSync(path_1.default.join(awmHome, 'registries.json'), JSON.stringify(config));
+    fs_1.default.writeFileSync(path_1.default.join(root, 'awm-registry.json'), JSON.stringify(manifest));
+}
+function writeValidKernel(dir) {
+    fs_1.default.writeFileSync(path_1.default.join(dir, 'AGENTS.md'), '<!-- AWM:CONTEXT-KERNEL:START v1 -->\nagent rules\n<!-- AWM:CONTEXT-KERNEL:END v1 -->\n');
+    fs_1.default.writeFileSync(path_1.default.join(dir, 'CONSTITUTION.md'), '<!-- AWM:CONTEXT-KERNEL:START v1 -->\n<!-- awm-context:CTX-PROCESS-001 -->\nprocess rules\n<!-- AWM:CONTEXT-KERNEL:END v1 -->\n');
+    const card = path_1.default.join(dir, 'docs', 'awm', 'context', 'releases.md');
+    fs_1.default.mkdirSync(path_1.default.dirname(card), { recursive: true });
+    fs_1.default.writeFileSync(card, '<!-- awm-context:CTX-RELEASE-001 -->\nrelease rules\n');
+    fs_1.default.mkdirSync(path_1.default.join(dir, '.awm', 'context'), { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(dir, '.awm', 'context', 'index.json'), JSON.stringify({
+        schema: 1,
+        kernelFiles: ['AGENTS.md', 'CONSTITUTION.md'],
+        maxFixedBytes: 33_740,
+        entries: [
+            { id: 'CTX-PROCESS-001', tier: 'kernel', path: 'CONSTITUTION.md', anchor: 'awm-context:CTX-PROCESS-001', when: 'always' },
+            { id: 'CTX-RELEASE-001', tier: 'selective', path: 'docs/awm/context/releases.md', anchor: 'awm-context:CTX-RELEASE-001', when: 'release automation' },
+        ],
+    }));
+}
+function writePartialKernel(dir) {
+    fs_1.default.writeFileSync(path_1.default.join(dir, 'AGENTS.md'), '<!-- AWM:CONTEXT-KERNEL:START v1 -->\nagent rules\n');
+}
 const check = (r, id) => r.checks.find(c => c.id === id);
 describe('preflight', () => {
     afterEach(() => mockRunSensors.mockReset());
+    it('does not add a row when no registry declares the schema', async () => {
+        installRegistry({ minCliVersion: '9.2.1' });
+        const report = await (0, checks_1.preflight)(make({
+            manifest: { pack: 'generic', sensors: { security: { enabled: false } } },
+        }));
+        expect(report.checks.map(c => c.id)).not.toContain('context-kernel');
+    });
+    it('blocks preflight when an active registry declares an invalid context kernel schema', async () => {
+        installRegistry({ projectContextSchema: 2 });
+        const report = await (0, checks_1.preflight)(make({
+            manifest: { pack: 'generic', sensors: { security: { enabled: false } } },
+        }));
+        expect(report.status).toBe('degraded');
+        expect((0, preflight_1.exitCodeFor)(report)).toBe(1);
+        expect(check(report, 'context-kernel')).toMatchObject({
+            ok: false,
+            advisory: false,
+            detail: expect.stringMatching(/projectContextSchema.*exactly 1.*2/),
+        });
+    });
+    it('fails closed when an earlier active registry manifest is malformed before a valid declaration', async () => {
+        installRegistry({ projectContextSchema: 2 }, 'malformed');
+        installRegistry({ projectContextSchema: 1 }, 'valid');
+        const report = await (0, checks_1.preflight)(make({
+            manifest: { pack: 'generic', sensors: { security: { enabled: false } } },
+        }));
+        expect(report.status).toBe('degraded');
+        expect((0, preflight_1.exitCodeFor)(report)).toBe(1);
+        expect(check(report, 'context-kernel')).toMatchObject({
+            ok: false,
+            advisory: false,
+            detail: expect.stringMatching(/malformed.*awm-registry\.json.*projectContextSchema.*exactly 1/i),
+        });
+    });
+    it('keeps legacy ready but renders a persistent warning and remedy', async () => {
+        installRegistry({ projectContextSchema: 1 });
+        const report = await (0, checks_1.preflight)(make({
+            manifest: { pack: 'generic', sensors: { security: { enabled: false } } },
+        }));
+        expect(report.status).toBe('ready');
+        expect(report.checks).toContainEqual(expect.objectContaining({
+            id: 'context-kernel', ok: false, advisory: true,
+            detail: expect.stringMatching(/legacy full context/),
+            remedy: expect.stringMatching(/project-context-init/),
+        }));
+        expect((0, preflight_1.formatReport)(report)).toMatch(/⚠.*context-kernel.*legacy full context/s);
+        expect((0, preflight_1.exitCodeFor)(report)).toBe(0);
+        expect(JSON.parse(JSON.stringify(report))).toEqual(expect.objectContaining({
+            status: 'ready',
+            checks: expect.arrayContaining([expect.objectContaining({
+                    id: 'context-kernel', ok: false, advisory: true,
+                    detail: expect.any(String), remedy: expect.any(String),
+                })]),
+        }));
+    });
+    it('keeps an unconfigured legacy project not_configured while the context kernel remains advisory', async () => {
+        installRegistry({ projectContextSchema: 1 });
+        const report = await (0, checks_1.preflight)(make());
+        expect(report.status).toBe('not_configured');
+        expect(check(report, 'manifest')).toMatchObject({ ok: false, detail: 'no .awm/sensors.json' });
+        expect(check(report, 'context-kernel')).toMatchObject({
+            ok: false,
+            advisory: true,
+            detail: expect.stringMatching(/legacy full context/),
+        });
+        expect((0, preflight_1.exitCodeFor)(report)).toBe(1);
+    });
+    it('passes a valid kernel', async () => {
+        installRegistry({ projectContextSchema: 1 });
+        const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+        writeValidKernel(dir);
+        const report = await (0, checks_1.preflight)(dir);
+        expect(report).toEqual(expect.objectContaining({ status: 'ready' }));
+        expect(check(report, 'context-kernel')).toMatchObject({ ok: true });
+        expect(check(report, 'context-kernel')).not.toHaveProperty('advisory');
+    });
+    it('degrades partial or invalid migration', async () => {
+        installRegistry({ projectContextSchema: 1 });
+        const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+        writePartialKernel(dir);
+        const report = await (0, checks_1.preflight)(dir);
+        expect(report.status).toBe('degraded');
+        expect((0, preflight_1.exitCodeFor)(report)).toBe(1);
+        expect(report.checks).toContainEqual(expect.objectContaining({
+            id: 'context-kernel', advisory: false, ok: false,
+        }));
+        expect((0, preflight_1.formatReport)(report)).toMatch(/Harness degraded — it has blocking preflight failures\./);
+        expect((0, preflight_1.formatReport)(report)).not.toMatch(/declares sensors it cannot run/);
+    });
+    it('degrades an invalid kernel even when no sensor manifest exists', async () => {
+        installRegistry({ projectContextSchema: 1 });
+        const dir = make();
+        writePartialKernel(dir);
+        const report = await (0, checks_1.preflight)(dir);
+        expect(report.status).toBe('degraded');
+        expect(check(report, 'manifest')).toMatchObject({ ok: false, detail: 'no .awm/sensors.json' });
+        expect(check(report, 'context-kernel')).toMatchObject({ ok: false, advisory: false });
+        expect((0, preflight_1.exitCodeFor)(report)).toBe(1);
+    });
     it('keeps default preflight static and does not dispatch sensors', async () => {
         const dir = make({
             manifest: { pack: 'generic', sensors: { security: { enabled: false } } },

package/dist/tests/core/context-kernel/inspect.test.js

@@ -0,0 +1,144 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+describe('Context Kernel v1 inspection', () => {
+    let root;
+    let previousAwmHome;
+    beforeEach(() => {
+        jest.resetModules();
+        previousAwmHome = process.env.AWM_HOME;
+        root = fs_1.default.realpathSync(fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-context-kernel-')));
+        process.env.AWM_HOME = path_1.default.join(root, 'awm-home');
+        fs_1.default.mkdirSync(process.env.AWM_HOME, { recursive: true });
+    });
+    afterEach(() => {
+        if (previousAwmHome === undefined)
+            delete process.env.AWM_HOME;
+        else
+            process.env.AWM_HOME = previousAwmHome;
+        fs_1.default.rmSync(root, { recursive: true, force: true });
+    });
+    function inspect() {
+        return require('../../../src/core/context-kernel/inspect').inspectContextKernel;
+    }
+    function indexPath() {
+        return path_1.default.join(root, '.awm', 'context', 'index.json');
+    }
+    function writeIndex(index) {
+        fs_1.default.mkdirSync(path_1.default.dirname(indexPath()), { recursive: true });
+        fs_1.default.writeFileSync(indexPath(), JSON.stringify(index, null, 2));
+    }
+    function writeValidKernel() {
+        const index = {
+            schema: 1,
+            kernelFiles: ['AGENTS.md', 'CONSTITUTION.md'],
+            maxFixedBytes: 33_740,
+            entries: [
+                { id: 'CTX-PROCESS-001', tier: 'kernel', path: 'CONSTITUTION.md', anchor: 'awm-context:CTX-PROCESS-001', when: 'always' },
+                { id: 'CTX-RELEASE-001', tier: 'selective', path: 'docs/awm/context/releases.md', anchor: 'awm-context:CTX-RELEASE-001', when: 'release automation' },
+            ],
+        };
+        fs_1.default.writeFileSync(path_1.default.join(root, 'AGENTS.md'), '<!-- AWM:CONTEXT-KERNEL:START v1 -->\nagent rules\n<!-- AWM:CONTEXT-KERNEL:END v1 -->\n');
+        fs_1.default.writeFileSync(path_1.default.join(root, 'CONSTITUTION.md'), '<!-- AWM:CONTEXT-KERNEL:START v1 -->\n<!-- awm-context:CTX-PROCESS-001 -->\nprocess rules\n<!-- AWM:CONTEXT-KERNEL:END v1 -->\n');
+        const card = path_1.default.join(root, 'docs', 'awm', 'context', 'releases.md');
+        fs_1.default.mkdirSync(path_1.default.dirname(card), { recursive: true });
+        fs_1.default.writeFileSync(card, '<!-- awm-context:CTX-RELEASE-001 -->\nrelease rules\n');
+        writeIndex(index);
+        return index;
+    }
+    function mutateFixture(mutation) {
+        const constitution = path_1.default.join(root, 'CONSTITUTION.md');
+        if (mutation === 'start marker missing') {
+            fs_1.default.writeFileSync(constitution, fs_1.default.readFileSync(constitution, 'utf8').replace('<!-- AWM:CONTEXT-KERNEL:START v1 -->\n', ''));
+        }
+        else if (mutation === 'end marker duplicated') {
+            fs_1.default.appendFileSync(constitution, '<!-- AWM:CONTEXT-KERNEL:END v1 -->\n');
+        }
+        else if (mutation === 'anchor outside region') {
+            fs_1.default.writeFileSync(constitution, '<!-- awm-context:CTX-PROCESS-001 -->\n' + fs_1.default.readFileSync(constitution, 'utf8'));
+        }
+        else {
+            fs_1.default.writeFileSync(constitution, fs_1.default.readFileSync(constitution, 'utf8').replace('process rules', '<!-- awm-context:CTX-PROCESS-001 -->\nprocess rules'));
+        }
+    }
+    it('classifies no R3 artifacts as legacy', () => {
+        expect(inspect()(root)).toEqual({ state: 'legacy' });
+    });
+    it('rejects a root context marker when the Context Kernel index is missing', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, 'AGENTS.md'), '<!-- AWM:CONTEXT-KERNEL:START v1 -->\nagent rules\n');
+        expect(inspect()(root)).toEqual(expect.objectContaining({
+            state: 'invalid',
+            detail: expect.stringContaining('.awm/context/index.json is missing'),
+        }));
+    });
+    it('rejects an orphaned context anchor when the Context Kernel index is missing', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, 'AGENTS.md'), '<!-- awm-context:CTX-PROCESS-001 -->\nagent rules\n');
+        expect(inspect()(root)).toEqual(expect.objectContaining({
+            state: 'invalid',
+            detail: expect.stringContaining('.awm/context/index.json is missing'),
+        }));
+    });
+    it('accepts the canonical fixture', () => {
+        writeValidKernel();
+        expect(inspect()(root)).toEqual(expect.objectContaining({ state: 'valid', schema: 1 }));
+    });
+    it.each([
+        ['unknown top-level field', (x) => { x.extra = true; }],
+        ['future schema', (x) => { x.schema = 2; }],
+        ['duplicate id', (x) => { x.entries[1].id = x.entries[0].id; }],
+        ['duplicate anchor', (x) => { x.entries[1].anchor = x.entries[0].anchor; }],
+        ['absolute path', (x) => { x.entries[1].path = '/tmp/outside.md'; }],
+        ['traversal', (x) => { x.entries[1].path = '../outside.md'; }],
+        ['empty when', (x) => { x.entries[1].when = ''; }],
+        ['fixed byte cap', (x) => { x.maxFixedBytes = 1; }],
+    ])('rejects %s', (_name, mutate) => {
+        const index = writeValidKernel();
+        mutate(index);
+        writeIndex(index);
+        expect(inspect()(root)).toEqual(expect.objectContaining({ state: 'invalid' }));
+    });
+    it('rejects a project path that resolves through a symlink to an external regular file', () => {
+        const index = writeValidKernel();
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-outside-'));
+        try {
+            const card = path_1.default.join(root, index.entries[1].path);
+            const externalCard = path_1.default.join(outside, 'card.md');
+            fs_1.default.writeFileSync(externalCard, '<!-- awm-context:CTX-RELEASE-001 -->\nexternal release rules\n');
+            fs_1.default.rmSync(card);
+            fs_1.default.symlinkSync(externalCard, card);
+            expect(fs_1.default.statSync(card).isFile()).toBe(true);
+            expect(fs_1.default.realpathSync(card)).toBe(externalCard);
+            expect(inspect()(root)).toEqual(expect.objectContaining({
+                state: 'invalid',
+                detail: expect.stringContaining('resolves outside the project root'),
+            }));
+        }
+        finally {
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    it('rejects a dangling index symlink instead of treating it as legacy', () => {
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-outside-'));
+        try {
+            fs_1.default.mkdirSync(path_1.default.dirname(indexPath()), { recursive: true });
+            fs_1.default.symlinkSync(path_1.default.join(outside, 'index.json'), indexPath());
+            expect(inspect()(root)).toEqual(expect.objectContaining({ state: 'invalid' }));
+        }
+        finally {
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    it.each(['start marker missing', 'end marker duplicated', 'anchor outside region', 'anchor duplicated'])('rejects %s', (mutation) => {
+        writeValidKernel();
+        mutateFixture(mutation);
+        expect(inspect()(root)).toEqual(expect.objectContaining({ state: 'invalid' }));
+    });
+    it('throws for an invalid public cwd', () => {
+        expect(() => inspect()(path_1.default.join(root, 'missing'))).toThrow(/cwd.*directory/);
+    });
+});

package/dist/tests/core/registry-manifest.test.js

@@ -99,4 +99,32 @@ describe('registry manifest (awm-registry.json)', () => {
         const { readRegistryManifest } = load();
         expect(() => readRegistryManifest(tmpWork)).toThrow(/minCliVersion/);
     });
+    it('reads projectContextSchema 1 without changing legacy manifests', () => {
+        writeManifest({ minCliVersion: '9.2.1', projectContextSchema: 1 });
+        const { readRegistryManifest } = load();
+        expect(readRegistryManifest(tmpWork)).toEqual({
+            overrides: new Set(), minCliVersion: '9.2.1', projectContextSchema: 1,
+        });
+        writeManifest({ minCliVersion: '9.2.1' });
+        expect(readRegistryManifest(tmpWork).projectContextSchema).toBeUndefined();
+    });
+    it.each([0, 2, -1, 1.5, '1', null])('rejects unsupported project context schema %p', (value) => {
+        writeManifest({ projectContextSchema: value });
+        const { readRegistryManifest } = load();
+        expect(() => readRegistryManifest(tmpWork)).toThrow(/projectContextSchema.*exactly 1/);
+    });
+    it('resolves the first usable Context Kernel declaration and retains malformed manifest diagnostics', () => {
+        const { registriesDir, writeRegistriesConfig, resolveProjectContextSchema } = load();
+        writeRegistriesConfig([
+            { name: 'broken', remote: 'https://example.invalid/broken.git' },
+            { name: 'active', remote: 'https://example.invalid/active.git' },
+        ]);
+        for (const name of ['broken', 'active'])
+            fs_1.default.mkdirSync(path_1.default.join(registriesDir(), name, 'skills'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(registriesDir(), 'broken', 'awm-registry.json'), JSON.stringify({ projectContextSchema: 2 }));
+        fs_1.default.writeFileSync(path_1.default.join(registriesDir(), 'active', 'awm-registry.json'), JSON.stringify({ projectContextSchema: 1 }));
+        const result = resolveProjectContextSchema();
+        expect(result.declaration).toEqual(expect.objectContaining({ registry: expect.objectContaining({ name: 'active' }), schema: 1 }));
+        expect(result.diagnostics).toEqual([expect.stringMatching(/broken.*projectContextSchema.*exactly 1/)]);
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "9.2.1",
+  "version": "9.3.0",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"
@@ -55,7 +55,7 @@
     "@types/js-yaml": "4.0.9",
     "@types/node": "^25.3.0",
     "@types/semver": "^7.7.1",
-    "dependency-cruiser": "^17.4.3",
+    "dependency-cruiser": "16.10.4",
     "eslint": "10.8.1",
     "jest": "^30.2.0",
     "js-yaml": "4.1.0",