agentic-workflow-manager 9.20.3 → 9.21.0

package/dist/src/commands/preflight/checks.js

@@ -19,6 +19,7 @@ const registries_2 = require("../../core/registries");
 const check_1 = require("../../core/currentness/check");
 const store_1 = require("../../core/model-policy/store");
 const setup_readiness_1 = require("../../core/model-policy/setup-readiness");
+const awm_gitignore_1 = require("../../core/awm-gitignore");
 const MANIFEST = path_1.default.join('.awm', 'sensors.json');
 function checkRoutingSetup(cwd) {
     const guidance = (0, setup_readiness_1.routingSetupGuidance)((0, store_1.readEffectivePolicy)(cwd));
@@ -441,6 +442,12 @@ function extractHost(remote) {
  * a PR/MR at all (merge locally, keep the branch as-is), so gating the whole harness on
  * missing tooling here would be wrong. It is FYI, never a blocker.
  */
+function checkAwmGitignore(cwd) {
+    const result = (0, awm_gitignore_1.evaluateAwmGitignorePolicy)(path_1.default.resolve(cwd));
+    if (result.ok)
+        return { id: 'awm-gitignore', ok: true, detail: result.detail };
+    return { id: 'awm-gitignore', ok: false, detail: result.detail, remedy: result.remedy };
+}
 function checkHost(cwd) {
     let remote;
     try {
@@ -540,6 +547,8 @@ async function preflight(cwd = process.cwd(), opts = {}) {
         // Strict mode is the only path that contacts authoritative npm/Git sources.
         ...(opts.requireCurrent === true ? [checkCompatibility()] : []),
         ...checkRoutingSetup(cwd),
+        // Blocking .awm versioning policy (D-024 / #218).
+        checkAwmGitignore(cwd),
         // Runs unconditionally — orthogonal to sensor configuration entirely, this is
         // about PR/MR tooling, not sensors.
         checkHost(cwd),

package/dist/src/commands/sensors/init.js

@@ -12,6 +12,7 @@ const path_1 = __importDefault(require("path"));
 const pack_source_1 = require("./compatibility/pack-source");
 const bootstrap_1 = require("./bootstrap");
 const unresolved_1 = require("./unresolved");
+const awm_gitignore_1 = require("../../core/awm-gitignore");
 /** Read a pack only through the shared source resolver.  Init is a registry
  * boundary: a pack path that is absent is harmless, but a symlink or escaping
  * claimed source is never silently downgraded to an empty manifest. */
@@ -165,12 +166,17 @@ async function initSensors(opts = {}) {
     }
     if (plan.kind === 'migrate')
         throw new Error('initSensors does not migrate existing v2 manifests; run awm sensors bootstrap');
-    if (plan.kind === 'noop')
+    if (plan.kind === 'noop') {
+        // Repair path: existing project `.awm/` should still get the managed block (GI-1 remedy).
+        if (fs_1.default.existsSync(path_1.default.join(cwd, '.awm')))
+            (0, awm_gitignore_1.upsertAwmGitignore)(cwd);
         return {
             // No manifest is written or synthesized here. The compatibility API only
             // retains its historical result shape for callers that inspect detection.
             manifest: {}, detection: detectStack(detectionCwd), configured: [], status: 'already-configured',
         };
+    }
     (0, bootstrap_1.applySensorBootstrap)(plan);
+    (0, awm_gitignore_1.upsertAwmGitignore)(cwd);
     return { manifest: plan.manifest, detection: detectStack(detectionCwd), configured: [], status: 'created', ...(plan.unresolved && plan.unresolved.length > 0 ? { unresolved: plan.unresolved } : {}) };
 }

package/dist/src/commands/sensors/status.js

@@ -215,7 +215,12 @@ function projectSensorCheck(sensor, cwd) {
 function packBoundOnly(manifest) {
     const sensors = Object.fromEntries(Object.entries(manifest.sensors).filter(([, sensor]) => !(0, manifest_1.isProjectDeclaredSensor)(sensor)));
     const pack = 'pack' in manifest && typeof manifest.pack === 'string' ? manifest.pack : '';
-    return { schemaVersion: 2, pack, sensors };
+    return {
+        schemaVersion: 2,
+        pack,
+        sensors,
+        ...(manifest.packSelection === 'explicit' ? { packSelection: 'explicit' } : {}),
+    };
 }
 /** Live pack sensor ids, or null when the pack cannot be resolved (fail closed). */
 function livePackSensorIds(source) {

package/dist/src/commands/watch/init.js

@@ -18,6 +18,7 @@ const lock_1 = require("./lock");
 const validate_1 = require("../../core/plan/validate");
 const identity_1 = require("../../core/plan/identity");
 const native_bridge_1 = require("../../core/secure-fs/native-bridge");
+const awm_gitignore_1 = require("../../core/awm-gitignore");
 const MAX_VERIFIER_SCAN_DEPTH = 64;
 const MAX_VERIFIER_SCAN_ENTRIES = 10000;
 const MAX_PACKAGE_JSON_BYTES = 256 * 1024;
@@ -81,22 +82,9 @@ function detectRequiredVerifiers(repoRoot) {
     visit(repoRoot, 0);
     return ['test', 'sensors'].filter((kind) => kinds.has(kind));
 }
-/** El journal es gitignoreado (R1.1): sus escrituras jamas alteran fingerprints. */
+/** El journal es gitignoreado (R1.1): bloque gestionado D-024 / #218. */
 function ensureJournalGitignored(repoRoot) {
-    const gi = path_1.default.join(repoRoot, '.gitignore');
-    let current = '';
-    try {
-        if (fs_1.default.lstatSync(gi).isSymbolicLink())
-            throw new Error('.gitignore must not be a symlink');
-        current = fs_1.default.readFileSync(gi, 'utf8');
-    }
-    catch (error) {
-        if (error.code !== 'ENOENT')
-            throw error;
-    }
-    if (!current.split('\n').some((l) => l.trim() === '.awm/' || l.trim() === '.awm')) {
-        fs_1.default.writeFileSync(gi, current.length > 0 && !current.endsWith('\n') ? `${current}\n.awm/\n` : `${current}.awm/\n`);
-    }
+    (0, awm_gitignore_1.upsertAwmGitignore)(repoRoot);
 }
 const TERMINAL_JOB_STATES = new Set(['exited', 'cancelled']);
 function rebindBlocker(state) {

package/dist/src/core/awm-gitignore.js

@@ -0,0 +1,211 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AWM_LOCAL_PATHS = exports.AWM_VERSIONED_PATHS = exports.AWM_GITIGNORE_END = exports.AWM_GITIGNORE_BEGIN = void 0;
+exports.renderManagedBlock = renderManagedBlock;
+exports.upsertAwmGitignore = upsertAwmGitignore;
+exports.evaluateAwmGitignorePolicy = evaluateAwmGitignorePolicy;
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+/** Marker lines for the managed `.gitignore` block (ASCII, exact). */
+exports.AWM_GITIGNORE_BEGIN = '# AWM:GITIGNORE:BEGIN';
+exports.AWM_GITIGNORE_END = '# AWM:GITIGNORE:END';
+/** Project config under `.awm/` that must remain commit-able (D-024). */
+exports.AWM_VERSIONED_PATHS = [
+    '.awm/sensors.json',
+    '.awm/sensors.baseline.json',
+    '.awm/profile.json',
+    '.awm/context-budget.json',
+    '.awm/context/index.json',
+];
+/** Runtime / local state under `.awm/` that must not be tracked (D-024). */
+exports.AWM_LOCAL_PATHS = [
+    '.awm/journal',
+    '.awm/ledger',
+    '.awm/evidence',
+    '.awm/track.json',
+    '.awm/sensors/runs',
+];
+const MANAGED_LINES = [
+    '.awm/*',
+    '!.awm/sensors.json',
+    '!.awm/sensors.baseline.json',
+    '!.awm/profile.json',
+    '!.awm/context-budget.json',
+    '!.awm/context/',
+    '.awm/context/*',
+    '!.awm/context/index.json',
+];
+/** Canonical managed block including begin/end markers and a trailing newline. */
+function renderManagedBlock() {
+    return [exports.AWM_GITIGNORE_BEGIN, ...MANAGED_LINES, exports.AWM_GITIGNORE_END, ''].join('\n');
+}
+function isBlanketAwmIgnore(line) {
+    const t = line.trim();
+    return t === '.awm' || t === '.awm/';
+}
+/**
+ * Upsert the managed AWM `.gitignore` block at the repository root.
+ * Idempotent when the block already matches. Migrates bare `.awm` / `.awm/`
+ * lines outside the block. Refuses a symlink `.gitignore`.
+ */
+function upsertAwmGitignore(repoRoot) {
+    if (typeof repoRoot !== 'string' || repoRoot.length === 0) {
+        throw new Error('upsertAwmGitignore requires a non-empty repository root');
+    }
+    const gi = path_1.default.join(repoRoot, '.gitignore');
+    let current = '';
+    try {
+        if (fs_1.default.lstatSync(gi).isSymbolicLink()) {
+            throw new Error('.gitignore must not be a symlink');
+        }
+        current = fs_1.default.readFileSync(gi, 'utf8');
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    const normalized = current.replace(/\r\n/g, '\n');
+    const block = renderManagedBlock();
+    const begin = normalized.indexOf(exports.AWM_GITIGNORE_BEGIN);
+    const end = normalized.indexOf(exports.AWM_GITIGNORE_END);
+    let withoutManaged;
+    if (begin !== -1 && end !== -1 && end > begin) {
+        const afterEnd = end + exports.AWM_GITIGNORE_END.length;
+        const skipNewline = normalized[afterEnd] === '\n' ? afterEnd + 1 : afterEnd;
+        withoutManaged = normalized.slice(0, begin) + normalized.slice(skipNewline);
+    }
+    else if (begin !== -1 || end !== -1) {
+        // Malformed markers: strip both marker lines and rebuild cleanly.
+        withoutManaged = normalized
+            .split('\n')
+            .filter((line) => line !== exports.AWM_GITIGNORE_BEGIN && line !== exports.AWM_GITIGNORE_END)
+            .join('\n');
+    }
+    else {
+        withoutManaged = normalized;
+    }
+    const preserved = withoutManaged
+        .split('\n')
+        .filter((line) => !isBlanketAwmIgnore(line))
+        .join('\n')
+        .replace(/\n+$/g, '');
+    const next = preserved.length > 0 ? `${preserved}\n${block}` : block;
+    if (next === normalized || next === current.replace(/\r\n/g, '\n')) {
+        // Already equivalent after normalize — avoid touching mtime when identical.
+        if (fs_1.default.existsSync(gi) && fs_1.default.readFileSync(gi, 'utf8').replace(/\r\n/g, '\n') === next)
+            return;
+    }
+    fs_1.default.writeFileSync(gi, next);
+}
+function gitOk(repoRoot, args) {
+    try {
+        const stdout = (0, child_process_1.execFileSync)('git', args, {
+            cwd: repoRoot,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env: process.env,
+        });
+        return { ok: true, stdout };
+    }
+    catch (error) {
+        const err = error;
+        return { ok: false, code: typeof err.status === 'number' ? err.status : 1, stdout: typeof err.stdout === 'string' ? err.stdout : '' };
+    }
+}
+function isGitRepo(repoRoot) {
+    const result = gitOk(repoRoot, ['rev-parse', '--is-inside-work-tree']);
+    return result.ok && result.stdout.trim() === 'true';
+}
+function extractManagedInner(text) {
+    const begin = text.indexOf(exports.AWM_GITIGNORE_BEGIN);
+    const end = text.indexOf(exports.AWM_GITIGNORE_END);
+    if (begin === -1 || end === -1 || end <= begin)
+        return null;
+    return text.slice(begin + exports.AWM_GITIGNORE_BEGIN.length, end).replace(/^\n/, '').replace(/\n$/, '');
+}
+function managedBlockComplete(repoRoot) {
+    const gi = path_1.default.join(repoRoot, '.gitignore');
+    try {
+        const text = fs_1.default.readFileSync(gi, 'utf8').replace(/\r\n/g, '\n');
+        const inner = extractManagedInner(text);
+        if (inner === null)
+            return false;
+        const expected = MANAGED_LINES.join('\n');
+        return inner === expected;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+function pathExistsUnderRoot(repoRoot, rel) {
+    try {
+        fs_1.default.lstatSync(path_1.default.join(repoRoot, rel));
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+function awmTreePresent(repoRoot) {
+    return pathExistsUnderRoot(repoRoot, '.awm') || exports.AWM_VERSIONED_PATHS.some((p) => pathExistsUnderRoot(repoRoot, p));
+}
+/**
+ * Blocking policy check for doctor/preflight (GI-6..GI-8).
+ * Skips cleanly when not inside a git work tree.
+ */
+function evaluateAwmGitignorePolicy(repoRoot) {
+    if (typeof repoRoot !== 'string' || repoRoot.length === 0) {
+        throw new Error('evaluateAwmGitignorePolicy requires a non-empty repository root');
+    }
+    if (!isGitRepo(repoRoot)) {
+        return { ok: true, skipped: true, detail: 'skipped (not a git repository)' };
+    }
+    const trackedLocal = [];
+    for (const local of exports.AWM_LOCAL_PATHS) {
+        const listed = gitOk(repoRoot, ['ls-files', '-z', '--', local]);
+        if (!listed.ok)
+            continue;
+        const paths = listed.stdout.split('\0').filter(Boolean);
+        trackedLocal.push(...paths);
+    }
+    const ignoredVersioned = [];
+    for (const versioned of exports.AWM_VERSIONED_PATHS) {
+        if (!pathExistsUnderRoot(repoRoot, versioned))
+            continue;
+        const ignore = gitOk(repoRoot, ['check-ignore', '-q', '--', versioned]);
+        // exit 0 → ignored; exit 1 → not ignored; other → treat as not ignored (fail-open on check only)
+        if (ignore.ok || ignore.code === 0)
+            ignoredVersioned.push(versioned);
+    }
+    const needsBlock = awmTreePresent(repoRoot) || trackedLocal.length > 0;
+    const missingBlock = needsBlock && !managedBlockComplete(repoRoot);
+    if (trackedLocal.length === 0 && ignoredVersioned.length === 0 && !missingBlock) {
+        return { ok: true, detail: needsBlock ? 'managed .awm gitignore policy satisfied' : 'no .awm project state' };
+    }
+    const parts = [];
+    if (trackedLocal.length > 0) {
+        parts.push(`tracked local runtime: ${trackedLocal.slice(0, 8).join(', ')}${trackedLocal.length > 8 ? '…' : ''}`);
+    }
+    if (ignoredVersioned.length > 0) {
+        parts.push(`versioned config ignored: ${ignoredVersioned.join(', ')}`);
+    }
+    if (missingBlock) {
+        parts.push('managed # AWM:GITIGNORE block missing or incomplete');
+    }
+    const remedyParts = [
+        'run `awm sensors init` or `awm watch init` to upsert the managed .gitignore block',
+    ];
+    if (trackedLocal.length > 0) {
+        const shown = trackedLocal.slice(0, 16).join(' ');
+        remedyParts.push(`then \`git rm --cached -- ${shown}${trackedLocal.length > 16 ? ' …' : ''}\``);
+    }
+    return { ok: false, detail: parts.join('; '), remedy: remedyParts.join('; ') };
+}

package/dist/src/core/diagnostics/checks.js

@@ -7,6 +7,7 @@ exports.computeProviderOverall = computeProviderOverall;
 exports.runChecks = runChecks;
 // src/core/diagnostics/checks.ts
 const path_1 = __importDefault(require("path"));
+const awm_gitignore_1 = require("../awm-gitignore");
 const cmd = (value) => ({ kind: 'command', value });
 const skillRemedy = (value) => ({ kind: 'skill', value });
 const none = { kind: 'none' };
@@ -152,6 +153,16 @@ function projectChecks(p) {
         out.push({ id: 'project.context', level: 'project', label: 'agent context (CLAUDE.md/AGENTS.md) missing', status: 'warn',
             remedy: skillRemedy('project-context-init') });
     }
+    // project.awm-gitignore — D-024 / #218 (blocking via status missing)
+    const gi = (0, awm_gitignore_1.evaluateAwmGitignorePolicy)(p.root);
+    if (gi.ok) {
+        out.push({ id: 'project.awm-gitignore', level: 'project', label: '.awm gitignore policy',
+            status: 'ok', detail: gi.detail, remedy: none });
+    }
+    else {
+        out.push({ id: 'project.awm-gitignore', level: 'project', label: '.awm gitignore policy',
+            status: 'missing', detail: gi.detail, remedy: cmd(gi.remedy) });
+    }
     return out;
 }
 // --- Task 9: overall status for the per-provider diagnostic matrix --------

package/dist/tests/commands/preflight/awm-gitignore.test.js

@@ -0,0 +1,52 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const checks_1 = require("../../../src/commands/preflight/checks");
+const awm_gitignore_1 = require("../../../src/core/awm-gitignore");
+function git(cwd, args) {
+    (0, child_process_1.execFileSync)('git', args, { cwd, stdio: 'pipe' });
+}
+describe('preflight awm-gitignore check (GI-6/GI-7)', () => {
+    let repo;
+    beforeEach(() => {
+        repo = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-gi-pf-'));
+        git(repo, ['init']);
+        git(repo, ['config', 'user.email', 't@t']);
+        git(repo, ['config', 'user.name', 't']);
+    });
+    afterEach(() => {
+        fs_1.default.rmSync(repo, { recursive: true, force: true });
+    });
+    it('degrades when versioned sensors.json is ignored', async () => {
+        fs_1.default.mkdirSync(path_1.default.join(repo, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.awm', 'sensors.json'), JSON.stringify({
+            schemaVersion: 3, mode: 'opt-out', reason: 'test',
+        }));
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.gitignore'), '.awm/\n');
+        const report = await (0, checks_1.preflight)(repo);
+        const check = report.checks.find((c) => c.id === 'awm-gitignore');
+        expect(check).toBeDefined();
+        expect(check.ok).toBe(false);
+        expect(check.advisory).not.toBe(true);
+        expect(check.remedy).toMatch(/awm sensors init|awm watch init/);
+        expect(report.status).not.toBe('ready');
+    });
+    it('includes a passing awm-gitignore check when managed block is present for opt-out manifest', async () => {
+        fs_1.default.mkdirSync(path_1.default.join(repo, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.awm', 'sensors.json'), JSON.stringify({
+            schemaVersion: 3, mode: 'opt-out', reason: 'test',
+        }));
+        (0, awm_gitignore_1.upsertAwmGitignore)(repo);
+        git(repo, ['add', '-A']);
+        git(repo, ['commit', '-m', 'ok']);
+        const report = await (0, checks_1.preflight)(repo);
+        const check = report.checks.find((c) => c.id === 'awm-gitignore');
+        expect(check).toMatchObject({ ok: true });
+    });
+});

package/dist/tests/commands/sensors/init-gitignore.test.js

@@ -0,0 +1,59 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const awm_gitignore_1 = require("../../../src/core/awm-gitignore");
+jest.mock('../../../src/commands/sensors/bootstrap', () => ({
+    planSensorBootstrap: jest.fn(),
+    applySensorBootstrap: jest.fn(),
+}));
+jest.mock('../../../src/commands/sensors/detection', () => ({
+    detectStack: jest.fn(() => ({ pack: 'js-ts', evidence: [] })),
+}));
+const { planSensorBootstrap, applySensorBootstrap } = require('../../../src/commands/sensors/bootstrap');
+const { initSensors } = require('../../../src/commands/sensors/init');
+describe('initSensors managed awm gitignore (GI-1)', () => {
+    let tmp;
+    beforeEach(() => {
+        tmp = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-sensors-gi-'));
+        jest.clearAllMocks();
+    });
+    afterEach(() => {
+        fs_1.default.rmSync(tmp, { recursive: true, force: true });
+    });
+    it('upserts the managed block after a successful create', async () => {
+        planSensorBootstrap.mockResolvedValue({
+            kind: 'create',
+            projectRoot: tmp,
+            manifestPath: path_1.default.join(tmp, '.awm', 'sensors.json'),
+            dryRun: false,
+            changes: [],
+            manifest: { schemaVersion: 3, mode: 'project-sensors', pack: 'js-ts', source: { registry: 'baseline' }, sensors: {} },
+        });
+        applySensorBootstrap.mockImplementation(() => {
+            fs_1.default.mkdirSync(path_1.default.join(tmp, '.awm'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmp, '.awm', 'sensors.json'), '{}');
+            return 'created';
+        });
+        await initSensors({ cwd: tmp });
+        expect(applySensorBootstrap).toHaveBeenCalled();
+        const gi = fs_1.default.readFileSync(path_1.default.join(tmp, '.gitignore'), 'utf8');
+        expect(gi).toContain(awm_gitignore_1.AWM_GITIGNORE_BEGIN);
+        expect(gi).toContain('!.awm/profile.json');
+    });
+    it('repairs the managed block on noop when .awm/ already exists', async () => {
+        fs_1.default.mkdirSync(path_1.default.join(tmp, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(tmp, '.awm', 'sensors.json'), '{}');
+        fs_1.default.writeFileSync(path_1.default.join(tmp, '.gitignore'), '.awm/\n');
+        planSensorBootstrap.mockResolvedValue({ kind: 'noop' });
+        await initSensors({ cwd: tmp });
+        expect(applySensorBootstrap).not.toHaveBeenCalled();
+        const gi = fs_1.default.readFileSync(path_1.default.join(tmp, '.gitignore'), 'utf8');
+        expect(gi).toContain(awm_gitignore_1.AWM_GITIGNORE_BEGIN);
+        expect(gi.split('\n').map((l) => l.trim()).filter((l) => l === '.awm/')).toEqual([]);
+    });
+});

package/dist/tests/commands/sensors/status.test.js

@@ -268,6 +268,68 @@ describe('computeSensorStatus', () => {
             fs_1.default.rmSync(home, { recursive: true, force: true });
         }
     });
+    it('keeps packSelection explicit through status so explicit-opt-in sensors do not false-drift', async () => {
+        // Regression for #231: packBoundOnly used to drop packSelection before
+        // resolveStaticV2Compatibility. Without it, applies() leaves explicit-opt-in
+        // sensors not-applicable and status reports "compatibility drift: initialized
+        // prettier, resolved not-applicable" even though run() (which keeps the field)
+        // would certify the same manifest.
+        const previousHome = process.env.AWM_HOME;
+        const home = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-status-home-'));
+        try {
+            process.env.AWM_HOME = home;
+            const registry = path_1.default.join(home, 'registries', 'baseline');
+            fs_1.default.mkdirSync(path_1.default.join(registry, 'sensor-packs', 'js-ts'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(home, 'registries.json'), JSON.stringify([{ name: 'baseline', remote: 'https://example.test/baseline.git' }]));
+            fs_1.default.writeFileSync(path_1.default.join(registry, 'sensor-packs', 'js-ts', 'pack.json'), JSON.stringify({
+                schemaVersion: 2, name: 'js-ts', description: 'test', detects: ['package.json'],
+                coverage: { schemaVersion: 1, classes: { format: { description: 'format', detectors: [{ sensor: 'format' }], remedy: { summary: 'Fix format', command: 'awm sensors init --pack js-ts' } } } },
+                sensors: { format: {
+                        applicability: { kind: 'explicit-opt-in' },
+                        variants: [{
+                                id: 'prettier', priority: 10, certifiedRange: '>=3.0.0 <4.0.0',
+                                requirements: { tool: 'prettier', toolRange: '>=3.0.0 <4.0.0', runtime: 'node', runtimeRange: '>=0.0.0' },
+                                assets: [], formatter: 'prettier', probe: { kind: 'package-script-present', script: 'format' },
+                                command: { executable: 'prettier', resolution: 'node-modules-bin', args: ['.'] },
+                            }],
+                    } },
+            }));
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), JSON.stringify({
+                devDependencies: { prettier: '^3.0.0' },
+                scripts: { format: 'prettier .' },
+            }));
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'node_modules', 'prettier'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', 'prettier', 'package.json'), JSON.stringify({ version: '3.3.3' }));
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'node_modules', '.bin'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', '.bin', 'prettier'), '#!/bin/sh\nexit 0\n');
+            fs_1.default.chmodSync(path_1.default.join(tmpDir, 'node_modules', '.bin', 'prettier'), 0o755);
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({
+                schemaVersion: 2, pack: 'js-ts', packSelection: 'explicit',
+                sensors: { format: {
+                        enabled: true, variantId: 'prettier',
+                        command: { executable: 'prettier', resolution: 'node-modules-bin', args: ['.'] },
+                        assets: [],
+                        initializedCompatibility: {
+                            state: 'certified', reason: 'range-and-probe', variantId: 'prettier',
+                            toolVersion: '3.3.3', runtimeVersion: process.versions.node,
+                            certifiedRange: '>=3.0.0 <4.0.0', evidence: [],
+                        },
+                    } },
+            }));
+            const result = await (0, status_1.computeSensorStatus)(tmpDir);
+            expect(result.checks.format?.detail ?? '').not.toMatch(/compatibility drift/i);
+            expect(result.checks.format).toMatchObject({ ok: true });
+            expect(result.overall).toBe('READY');
+        }
+        finally {
+            if (previousHome === undefined)
+                delete process.env.AWM_HOME;
+            else
+                process.env.AWM_HOME = previousHome;
+            fs_1.default.rmSync(home, { recursive: true, force: true });
+        }
+    });
     it('marks disabled sensors as ok', async () => {
         fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({

package/dist/tests/commands/watch/init-gitignore.test.js

@@ -0,0 +1,34 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const init_1 = require("../../../src/commands/watch/init");
+const awm_gitignore_1 = require("../../../src/core/awm-gitignore");
+const git_1 = require("../../../src/core/tracks/git");
+describe('initWatch managed awm gitignore (GI-2/GI-10)', () => {
+    let repo;
+    beforeEach(() => {
+        repo = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-watch-gi-'));
+        (0, child_process_1.execFileSync)('git', ['init'], { cwd: repo, stdio: 'pipe' });
+        fs_1.default.writeFileSync(path_1.default.join(repo, 'package.json'), JSON.stringify({ scripts: { test: 'jest' } }));
+    });
+    afterEach(() => {
+        fs_1.default.rmSync(repo, { recursive: true, force: true });
+    });
+    it('writes the managed block instead of a bare .awm/ allow-nothing rule', () => {
+        (0, init_1.initWatch)(repo, 'rama');
+        const gi = fs_1.default.readFileSync(path_1.default.join(repo, '.gitignore'), 'utf8');
+        expect(gi).toContain(awm_gitignore_1.AWM_GITIGNORE_BEGIN);
+        expect(gi).toContain(awm_gitignore_1.AWM_GITIGNORE_END);
+        expect(gi).toContain('!.awm/sensors.json');
+        expect(gi).toContain('!.awm/profile.json');
+        const lines = gi.split('\n').map((l) => l.trim()).filter(Boolean);
+        expect(lines.filter((l) => l === '.awm' || l === '.awm/')).toEqual([]);
+        expect((0, git_1.isAwmGitignored)(repo)).toBe(true);
+    });
+});

package/dist/tests/commands/watch/track-freeze.test.js

@@ -301,13 +301,10 @@ describe('Supervisor.tick() — freeze de un track individual (R5.2/R6.3)', () =
     }
     function setUpGreenTrack() {
         initCompactWatch(repo, BRANCH);
-        // `initWatch` ESCRIBE `.gitignore` (`.awm/`) pero no lo commitea — un
-        // `.gitignore` sin trackear es en sí mismo un path "untracked" para
-        // `git status --porcelain` (R6.4's chequeo de limpieza no distingue
-        // "sucio de verdad" de "el propio bootstrap del journal"). Sin este
-        // commit, `isWorktreeClean` nunca sería `true` y el freeze jamás
-        // convergería — no por un bug del driver, sino por un repo de test
-        // que nunca terminó su propio setup.
+        // `initWatch` upserts the managed `# AWM:GITIGNORE` block but does not
+        // commit it — an untracked/modified `.gitignore` keeps the worktree
+        // dirty for R6.4's clean check. Commit the bootstrap side-effect so
+        // freeze can converge.
         git(repo, 'add', '.gitignore');
         git(repo, 'commit', '-qm', 'gitignore .awm');
         const s = (0, store_1.readJournal)(repo, BRANCH).state;
@@ -526,6 +523,13 @@ describe('loop end-to-end: plan (reconcileTracks) + track (Supervisor.tick) cier
     test('reconcileTracks real (plan) + Supervisor.tick real (track), en loop contra dos worktrees reales, cierran request -> drenaje -> persist -> observación -> FROZEN', async () => {
         // --- lado TRACK: registrar el trabajo y drenarlo con un Supervisor REAL ---
         initCompactWatch(trackWorktree, TRACK_BRANCH);
+        // `initWatch` migrates the seeded `.awm/` ignore into the managed
+        // `.awm/*` allowlist block. That (1) dirties `.gitignore` and (2)
+        // un-ignores `.awm/sensors.json`, which then shows up as untracked.
+        // Both must be committed or R6.4's clean-worktree gate never passes
+        // and this loop times out (same class of fixture bug as setUpGreenTrack).
+        git(trackWorktree, 'add', '.gitignore', '.awm/sensors.json');
+        git(trackWorktree, 'commit', '-qm', 'awm gitignore + sensors');
         const ts0 = (0, store_1.readJournal)(trackWorktree, TRACK_BRANCH).state;
         ts0.trackContext = { trackId: 'a', taskIds: ['T1'], planDigest: '', baseSha, planJournalId: 'j-plan' };
         (0, store_1.writeJournal)(trackWorktree, TRACK_BRANCH, ts0);

package/dist/tests/commands/watch/watch-init.test.js

@@ -154,7 +154,9 @@ describe('watch --init: plan-vs-repo mecanico', () => {
         const out = (0, init_1.initWatch)(repo, 'rama');
         expect(out.requiredVerifiers).toEqual(['test']);
         expect((0, store_1.readJournal)(repo, 'rama').state.requiredVerifiers).toEqual(['test']);
-        expect(fs_1.default.readFileSync(path_1.default.join(repo, '.gitignore'), 'utf8')).toContain('.awm/');
+        const gi = fs_1.default.readFileSync(path_1.default.join(repo, '.gitignore'), 'utf8');
+        expect(gi).toContain('# AWM:GITIGNORE:BEGIN');
+        expect(gi).toContain('.awm/*');
         expect(() => (0, init_1.initWatch)(repo, 'rama')).not.toThrow(); // idempotente
     });
     test('no escribe .gitignore cuando es un symlink', () => {

package/dist/tests/core/awm-gitignore.test.js

@@ -0,0 +1,58 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const awm_gitignore_1 = require("../../src/core/awm-gitignore");
+describe('awm-gitignore managed block', () => {
+    let tmp;
+    beforeEach(() => {
+        tmp = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-gi-'));
+    });
+    afterEach(() => {
+        fs_1.default.rmSync(tmp, { recursive: true, force: true });
+    });
+    it('renders the canonical managed block with versioned allowlist entries', () => {
+        expect((0, awm_gitignore_1.renderManagedBlock)()).toBe([
+            awm_gitignore_1.AWM_GITIGNORE_BEGIN,
+            '.awm/*',
+            '!.awm/sensors.json',
+            '!.awm/sensors.baseline.json',
+            '!.awm/profile.json',
+            '!.awm/context-budget.json',
+            '!.awm/context/',
+            '.awm/context/*',
+            '!.awm/context/index.json',
+            awm_gitignore_1.AWM_GITIGNORE_END,
+            '',
+        ].join('\n'));
+    });
+    it('creates .gitignore with the managed block and is idempotent', () => {
+        (0, awm_gitignore_1.upsertAwmGitignore)(tmp);
+        const first = fs_1.default.readFileSync(path_1.default.join(tmp, '.gitignore'), 'utf8');
+        expect(first).toContain(awm_gitignore_1.AWM_GITIGNORE_BEGIN);
+        expect(first).toContain(awm_gitignore_1.AWM_GITIGNORE_END);
+        (0, awm_gitignore_1.upsertAwmGitignore)(tmp);
+        expect(fs_1.default.readFileSync(path_1.default.join(tmp, '.gitignore'), 'utf8')).toBe(first);
+    });
+    it('migrates bare .awm/ and .awm lines into the managed block without dropping unrelated rules', () => {
+        fs_1.default.writeFileSync(path_1.default.join(tmp, '.gitignore'), 'node_modules\n.awm/\ndist\n');
+        (0, awm_gitignore_1.upsertAwmGitignore)(tmp);
+        const text = fs_1.default.readFileSync(path_1.default.join(tmp, '.gitignore'), 'utf8');
+        expect(text).toContain('node_modules');
+        expect(text).toContain('dist');
+        expect(text).toContain(awm_gitignore_1.AWM_GITIGNORE_BEGIN);
+        const outside = text.slice(0, text.indexOf(awm_gitignore_1.AWM_GITIGNORE_BEGIN));
+        expect(outside.split('\n').map((l) => l.trim()).filter(Boolean)).not.toContain('.awm/');
+        expect(outside.split('\n').map((l) => l.trim()).filter(Boolean)).not.toContain('.awm');
+    });
+    it('refuses a symlink .gitignore', () => {
+        const target = path_1.default.join(tmp, 'ignore-target');
+        fs_1.default.writeFileSync(target, 'x\n');
+        fs_1.default.symlinkSync(target, path_1.default.join(tmp, '.gitignore'));
+        expect(() => (0, awm_gitignore_1.upsertAwmGitignore)(tmp)).toThrow(/symlink/i);
+    });
+});

package/dist/tests/core/diagnostics/awm-gitignore.test.js

@@ -0,0 +1,101 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const awm_gitignore_1 = require("../../../src/core/awm-gitignore");
+const checks_1 = require("../../../src/core/diagnostics/checks");
+function git(cwd, args) {
+    (0, child_process_1.execFileSync)('git', args, { cwd, stdio: 'pipe' });
+}
+const stubMachine = () => ({
+    registryCache: { present: true, gitState: 'clean' },
+    hook: { present: true, applicable: true },
+    devCore: { present: true, brokenLinks: [] },
+    ambient: { wanted: [], installed: [] },
+    contextInjection: [],
+    globalSkills: { valid: [], repairable: [], dead: [], usurped: [] },
+});
+const stubProject = (root) => ({
+    root,
+    profile: { present: false, extensions: [] },
+    activeBundles: { expected: [], linked: [], broken: [] },
+    orphanLinks: { repairable: [], dead: [], usurped: [] },
+    sensors: { present: true },
+    constitution: { present: true },
+    context: { present: true, file: 'AGENTS.md' },
+});
+describe('evaluateAwmGitignorePolicy + doctor project check', () => {
+    let repo;
+    beforeEach(() => {
+        repo = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-gi-doc-'));
+        git(repo, ['init']);
+        git(repo, ['config', 'user.email', 't@t']);
+        git(repo, ['config', 'user.name', 't']);
+    });
+    afterEach(() => {
+        fs_1.default.rmSync(repo, { recursive: true, force: true });
+    });
+    it('fails when local runtime is tracked and proposes git rm --cached', () => {
+        fs_1.default.mkdirSync(path_1.default.join(repo, '.awm', 'journal'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.awm', 'journal', 'x.json'), '{}');
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.gitignore'), 'node_modules\n');
+        git(repo, ['add', '-A']);
+        git(repo, ['commit', '-m', 'track journal']);
+        const result = (0, awm_gitignore_1.evaluateAwmGitignorePolicy)(repo);
+        expect(result.ok).toBe(false);
+        if (result.ok)
+            return;
+        expect(result.detail).toMatch(/tracked local runtime/i);
+        expect(result.remedy).toMatch(/git rm --cached/);
+        expect(result.remedy).toMatch(/awm sensors init|awm watch init/);
+    });
+    it('fails when sensors.json exists but is ignored by bare .awm/', () => {
+        fs_1.default.mkdirSync(path_1.default.join(repo, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.awm', 'sensors.json'), '{}');
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.gitignore'), '.awm/\n');
+        const result = (0, awm_gitignore_1.evaluateAwmGitignorePolicy)(repo);
+        expect(result.ok).toBe(false);
+        if (result.ok)
+            return;
+        expect(result.detail).toMatch(/versioned config ignored/i);
+        expect(result.detail).toMatch(/managed.*block missing/i);
+        expect(result.remedy).toMatch(/awm sensors init|awm watch init/);
+    });
+    it('fails when markers exist but the block body is incomplete', () => {
+        fs_1.default.mkdirSync(path_1.default.join(repo, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.awm', 'sensors.json'), '{}');
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.gitignore'), '# AWM:GITIGNORE:BEGIN\n.awm/*\n# AWM:GITIGNORE:END\n');
+        const result = (0, awm_gitignore_1.evaluateAwmGitignorePolicy)(repo);
+        expect(result.ok).toBe(false);
+        if (result.ok)
+            return;
+        expect(result.detail).toMatch(/managed.*block missing|incomplete/i);
+    });
+    it('passes when the managed block is installed', () => {
+        fs_1.default.mkdirSync(path_1.default.join(repo, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.awm', 'sensors.json'), '{}');
+        (0, awm_gitignore_1.upsertAwmGitignore)(repo);
+        git(repo, ['add', '.gitignore', '.awm/sensors.json']);
+        git(repo, ['commit', '-m', 'ok']);
+        expect((0, awm_gitignore_1.evaluateAwmGitignorePolicy)(repo)).toMatchObject({ ok: true });
+    });
+    it('runChecks emits project.awm-gitignore missing when policy fails', () => {
+        fs_1.default.mkdirSync(path_1.default.join(repo, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.awm', 'sensors.json'), '{}');
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.gitignore'), '.awm/\n');
+        const ctx = {
+            machine: stubMachine(),
+            project: stubProject(repo),
+            providers: [],
+        };
+        const report = (0, checks_1.runChecks)(ctx);
+        const row = report.results.find((r) => r.id === 'project.awm-gitignore');
+        expect(row).toMatchObject({ status: 'missing' });
+        expect(report.overall).toBe('degraded');
+    });
+});

package/dist/tests/core/ledger/gitignore.test.js

@@ -8,6 +8,11 @@ const path_1 = __importDefault(require("path"));
 test('.awm (and therefore .awm/ledger) is gitignored — raw ledger never committed', () => {
     const gitignore = fs_1.default.readFileSync(path_1.default.join(__dirname, '../../../../.gitignore'), 'utf-8');
     const lines = gitignore.split('\n').map(l => l.trim());
-    const coversAwm = lines.includes('.awm') || lines.includes('.awm/') || lines.includes('.awm/ledger') || lines.includes('.awm/ledger/');
+    // D-024: managed block uses `.awm/*` (with allowlist exceptions), not a bare `.awm` / `.awm/`.
+    const coversAwm = lines.includes('.awm/*') ||
+        lines.includes('.awm') ||
+        lines.includes('.awm/') ||
+        lines.includes('.awm/ledger') ||
+        lines.includes('.awm/ledger/');
     expect(coversAwm).toBe(true);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "9.20.3",
+  "version": "9.21.0",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"
@@ -26,6 +26,7 @@
     "lint": "eslint . --config eslint.config.awm.mjs --cache --format json",
     "depcheck": "depcruise --config .dep-cruiser.awm.js src",
     "test": "jest --runInBand",
+    "test:wait-npm-publication": "node --test ../.github/scripts/wait-npm-publication.test.cjs",
     "start": "ts-node src/index.ts",
     "prerelease": "npm run build",
     "release": "node dist/src/release/index.js",