agentic-workflow-manager 9.20.4 → 9.22.0

package/dist/tests/core/changes/receipt.test.js

@@ -141,7 +141,7 @@ describe('receipt', () => {
     test('R2.3 the receipt carries schema, commit, ranAt, cliVersion and overall from the run', () => {
         const head = g('rev-parse', 'HEAD');
         const r = (0, receipt_1.buildReceipt)({ commit: head, ranAt: '2026-10-17T10:00:00.000Z', cliVersion: '9.20.0', output: { overall: 'fail', sensors: [{ name: 'lint', status: 'fail', errors: [] }] } });
-        expect(r).toMatchObject({ schema: 1, commit: head, ranAt: '2026-10-17T10:00:00.000Z', cliVersion: '9.20.0', overall: 'fail', sensors: { lint: 'fail' } });
+        expect(r).toMatchObject({ schema: 2, commit: head, ranAt: '2026-10-17T10:00:00.000Z', cliVersion: '9.20.0', overall: 'fail', sensors: { lint: 'fail' } });
     });
     (0, helpers_1.posixOnly)('R2.1 a receipt replacing an existing 0666 file ends with mode 0600', () => {
         const head = g('rev-parse', 'HEAD');
@@ -646,7 +646,7 @@ describe('receipt', () => {
         ['unknown sensor status', (r) => { r.sensors.lint = 'ok'; }],
         ['array sensors', (r) => { r.sensors = []; }],
         ['null sensors', (r) => { r.sensors = null; }],
-        ['schema 2', (r) => { r.schema = 2; }],
+        ['schema 3', (r) => { r.schema = 3; }],
         ['non-string cliVersion', (r) => { r.cliVersion = 1; }],
         ['multi-line cliVersion', (r) => { r.cliVersion = '1.0\n2.0'; }],
         ['multi-line sensor name', (r) => { r.sensors['bad\nname'] = 'pass'; }],
@@ -944,4 +944,263 @@ describe('sensors run wiring (R2.2, R2.4)', () => {
             expect(fs_1.default.existsSync(receiptsDir())).toBe(false);
         });
     });
+    test('RF-4.2/4.4: all-cached clean full gate still writes a HEAD receipt (digest is authority)', async () => {
+        run_1.runSensors.mockResolvedValue({
+            overall: 'pass',
+            sensors: [
+                {
+                    name: 'lint',
+                    status: 'pass',
+                    errors: [],
+                    cached: true,
+                    cacheProvenance: {
+                        originCommit: 'c'.repeat(40),
+                        originDirty: false,
+                        inputDigest: `sha256:${'d'.repeat(64)}`,
+                        sensorFingerprint: `sha256:${'e'.repeat(64)}`,
+                    },
+                    measurement: {
+                        inputs: ['src/**/*.ts'],
+                        packageRootRel: '',
+                        inputDigest: `sha256:${'d'.repeat(64)}`,
+                        sensorFingerprint: `sha256:${'e'.repeat(64)}`,
+                        measuredPaths: ['a.txt', '.awm/sensors.json'],
+                    },
+                },
+                {
+                    name: 'a-typecheck',
+                    status: 'pass',
+                    errors: [],
+                    cached: true,
+                    cacheProvenance: {
+                        inputDigest: `sha256:${'f'.repeat(64)}`,
+                        sensorFingerprint: `sha256:${'e'.repeat(64)}`,
+                    },
+                    measurement: {
+                        inputs: ['src/**/*.ts'],
+                        packageRootRel: '',
+                        inputDigest: `sha256:${'f'.repeat(64)}`,
+                        sensorFingerprint: `sha256:${'e'.repeat(64)}`,
+                        measuredPaths: ['a.txt', '.awm/sensors.json'],
+                    },
+                },
+            ],
+            manifestPath: rootManifest(),
+        });
+        await runCli();
+        expect(written(stderr)).toBe('');
+        expect(process.exitCode).toBe(0);
+        const head = g('rev-parse', 'HEAD');
+        const read = (0, receipt_1.readReceipt)(root, head);
+        expect(read.ok).toBe(true);
+        if (!read.ok)
+            return;
+        expect(read.receipt.schema).toBe(2);
+        expect(read.receipt.sensors).toEqual({ 'a-typecheck': 'pass', lint: 'pass' });
+    });
+});
+describe('RF-4.3 receipt schema 2', () => {
+    test('buildReceipt writes schema 2 with measurements and alwaysMeasuredPaths including baseline', () => {
+        const head = g('rev-parse', 'HEAD');
+        const r = (0, receipt_1.buildReceipt)({
+            commit: head,
+            ranAt: '2026-10-17T10:00:00.000Z',
+            cliVersion: '9.21.0',
+            output: {
+                overall: 'pass',
+                sensors: [{
+                        name: 'lint',
+                        status: 'pass',
+                        errors: [],
+                        measurement: {
+                            inputs: ['src/**/*.ts'],
+                            packageRootRel: '',
+                            inputDigest: `sha256:${'1'.repeat(64)}`,
+                            sensorFingerprint: `sha256:${'2'.repeat(64)}`,
+                            measuredPaths: ['src/a.ts', '.awm/sensors.json', 'package-lock.json'],
+                        },
+                    }],
+            },
+            alwaysMeasuredPaths: ['.awm/sensors.json', '.awm/sensors.baseline.json', 'package-lock.json'],
+        });
+        expect(r.schema).toBe(2);
+        expect(r.sensors).toEqual({ lint: 'pass' });
+        const v2 = r;
+        expect(v2.measurements).toEqual({
+            lint: {
+                inputs: ['src/**/*.ts'],
+                packageRootRel: '',
+                inputDigest: `sha256:${'1'.repeat(64)}`,
+                sensorFingerprint: `sha256:${'2'.repeat(64)}`,
+                measuredPaths: ['.awm/sensors.json', 'package-lock.json', 'src/a.ts'],
+            },
+        });
+        expect(v2.alwaysMeasuredPaths).toEqual(['.awm/sensors.baseline.json', '.awm/sensors.json', 'package-lock.json']);
+        expect(v2.digest).toMatch(/^sha256:[0-9a-f]{64}$/);
+        expect((0, receipt_1.readReceipt)(root, (() => { (0, receipt_1.writeReceipt)(root, r); return head; })()).ok).toBe(true);
+    });
+    test('schema 1 receipts remain readable', () => {
+        const head = g('rev-parse', 'HEAD');
+        const body = {
+            schema: 1,
+            commit: head,
+            ranAt: '2026-10-17T10:00:00.000Z',
+            cliVersion: '9.20.0',
+            overall: 'pass',
+            sensors: { lint: 'pass' },
+        };
+        const receipt = { ...body, digest: (0, receipt_1.computeReceiptDigest)(body) };
+        (0, receipt_1.writeReceipt)(root, receipt);
+        const read = (0, receipt_1.readReceipt)(root, head);
+        expect(read).toEqual({ ok: true, receipt });
+    });
+    test('schema 2 digest covers measurements and alwaysMeasuredPaths', () => {
+        const base = {
+            schema: 2,
+            commit: 'a'.repeat(40),
+            ranAt: '2026-10-17T10:00:00.000Z',
+            cliVersion: '1.0.0',
+            overall: 'pass',
+            sensors: { lint: 'pass' },
+            measurements: {
+                lint: {
+                    inputs: ['src/**'],
+                    packageRootRel: '',
+                    inputDigest: `sha256:${'1'.repeat(64)}`,
+                    sensorFingerprint: `sha256:${'2'.repeat(64)}`,
+                    measuredPaths: ['src/a.ts'],
+                },
+            },
+            alwaysMeasuredPaths: ['.awm/sensors.baseline.json'],
+        };
+        const d = (0, receipt_1.computeReceiptDigest)(base);
+        const measuredChanged = {
+            ...base,
+            measurements: {
+                lint: { ...base.measurements.lint, measuredPaths: ['src/b.ts'] },
+            },
+        };
+        const alwaysChanged = {
+            ...base,
+            alwaysMeasuredPaths: ['.awm/sensors.json'],
+        };
+        expect((0, receipt_1.computeReceiptDigest)(measuredChanged)).not.toBe(d);
+        expect((0, receipt_1.computeReceiptDigest)(alwaysChanged)).not.toBe(d);
+    });
+    test('RF-4.6 helper: relaxation only when every recorded sensor has authored inputs', () => {
+        expect((0, receipt_1.allowsUnmeasuredRelaxation)({
+            schema: 2,
+            commit: 'a'.repeat(40),
+            ranAt: '2026-10-17T10:00:00.000Z',
+            cliVersion: '1',
+            overall: 'pass',
+            sensors: { lint: 'pass', test: 'pass' },
+            measurements: {
+                lint: {
+                    inputs: ['src/**'],
+                    packageRootRel: '',
+                    inputDigest: `sha256:${'1'.repeat(64)}`,
+                    sensorFingerprint: `sha256:${'2'.repeat(64)}`,
+                    measuredPaths: ['src/a.ts'],
+                },
+            },
+            alwaysMeasuredPaths: [],
+            digest: 'sha256:' + '0'.repeat(64),
+        })).toBe(false);
+        expect((0, receipt_1.allowsUnmeasuredRelaxation)({
+            schema: 2,
+            commit: 'a'.repeat(40),
+            ranAt: '2026-10-17T10:00:00.000Z',
+            cliVersion: '1',
+            overall: 'pass',
+            sensors: { lint: 'pass' },
+            measurements: {
+                lint: {
+                    inputs: ['src/**'],
+                    packageRootRel: '',
+                    inputDigest: `sha256:${'1'.repeat(64)}`,
+                    sensorFingerprint: `sha256:${'2'.repeat(64)}`,
+                    measuredPaths: ['src/a.ts'],
+                },
+            },
+            alwaysMeasuredPaths: ['.awm/sensors.baseline.json'],
+            digest: 'sha256:' + '0'.repeat(64),
+        })).toBe(true);
+        expect((0, receipt_1.allowsUnmeasuredRelaxation)({
+            schema: 1,
+            commit: 'a'.repeat(40),
+            ranAt: '2026-10-17T10:00:00.000Z',
+            cliVersion: '1',
+            overall: 'pass',
+            sensors: { lint: 'pass' },
+            digest: 'sha256:' + '0'.repeat(64),
+        })).toBe(false);
+    });
+    test('readReceipt rejects schema-2 measurements with unsorted measuredPaths or malformed measurement shapes', () => {
+        const head = g('rev-parse', 'HEAD');
+        const baseMeasurement = {
+            inputs: ['src/**/*.ts'],
+            packageRootRel: '',
+            inputDigest: `sha256:${'1'.repeat(64)}`,
+            sensorFingerprint: `sha256:${'2'.repeat(64)}`,
+            measuredPaths: ['a.ts', 'b.ts'],
+        };
+        const writeV2 = (measurements, alwaysMeasuredPaths = ['.awm/sensors.baseline.json']) => {
+            const body = {
+                schema: 2,
+                commit: head,
+                ranAt: '2026-10-17T10:00:00.000Z',
+                cliVersion: '9.21.0',
+                overall: 'pass',
+                sensors: { lint: 'pass' },
+                measurements,
+                alwaysMeasuredPaths,
+            };
+            const receipt = { ...body, digest: (0, receipt_1.computeReceiptDigest)(body) };
+            const dir = path_1.default.join(root, '.awm', 'sensors', 'runs');
+            fs_1.default.mkdirSync(dir, { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(dir, `${head}.json`), JSON.stringify(receipt) + '\n');
+        };
+        writeV2({ lint: { ...baseMeasurement, measuredPaths: ['b.ts', 'a.ts'] } });
+        expect((0, receipt_1.readReceipt)(root, head)).toEqual({ ok: false, code: 'receipt-invalid' });
+        writeV2({ lint: { ...baseMeasurement, measuredPaths: 'a.ts' } });
+        expect((0, receipt_1.readReceipt)(root, head)).toEqual({ ok: false, code: 'receipt-invalid' });
+        writeV2({ lint: { ...baseMeasurement, inputs: [] } });
+        expect((0, receipt_1.readReceipt)(root, head)).toEqual({ ok: false, code: 'receipt-invalid' });
+        writeV2({ lint: { ...baseMeasurement, packageRootRel: '../escape' } });
+        expect((0, receipt_1.readReceipt)(root, head)).toEqual({ ok: false, code: 'receipt-invalid' });
+    });
+    test('measurement.inputs on schema-2 parse reuse RF-1.5 glob rules (reject .., !, braces, extglobs)', () => {
+        const head = g('rev-parse', 'HEAD');
+        const mk = (inputs) => {
+            const body = {
+                schema: 2,
+                commit: head,
+                ranAt: '2026-10-17T10:00:00.000Z',
+                cliVersion: '9.21.0',
+                overall: 'pass',
+                sensors: { lint: 'pass' },
+                measurements: {
+                    lint: {
+                        inputs,
+                        packageRootRel: '',
+                        inputDigest: `sha256:${'1'.repeat(64)}`,
+                        sensorFingerprint: `sha256:${'2'.repeat(64)}`,
+                        measuredPaths: ['src/a.ts'],
+                    },
+                },
+                alwaysMeasuredPaths: ['.awm/sensors.baseline.json'],
+            };
+            const receipt = { ...body, digest: (0, receipt_1.computeReceiptDigest)(body) };
+            const dir = path_1.default.join(root, '.awm', 'sensors', 'runs');
+            fs_1.default.mkdirSync(dir, { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(dir, `${head}.json`), JSON.stringify(receipt) + '\n');
+            return (0, receipt_1.readReceipt)(root, head);
+        };
+        expect(mk(['src/**/*.ts'])).toMatchObject({ ok: true });
+        expect(mk(['../secret/**'])).toEqual({ ok: false, code: 'receipt-invalid' });
+        expect(mk(['!src/**'])).toEqual({ ok: false, code: 'receipt-invalid' });
+        expect(mk(['src/{a,b}.ts'])).toEqual({ ok: false, code: 'receipt-invalid' });
+        expect(mk(['src/@(a|b).ts'])).toEqual({ ok: false, code: 'receipt-invalid' });
+    });
 });

package/dist/tests/core/diagnostics/awm-gitignore.test.js

@@ -0,0 +1,101 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const awm_gitignore_1 = require("../../../src/core/awm-gitignore");
+const checks_1 = require("../../../src/core/diagnostics/checks");
+function git(cwd, args) {
+    (0, child_process_1.execFileSync)('git', args, { cwd, stdio: 'pipe' });
+}
+const stubMachine = () => ({
+    registryCache: { present: true, gitState: 'clean' },
+    hook: { present: true, applicable: true },
+    devCore: { present: true, brokenLinks: [] },
+    ambient: { wanted: [], installed: [] },
+    contextInjection: [],
+    globalSkills: { valid: [], repairable: [], dead: [], usurped: [] },
+});
+const stubProject = (root) => ({
+    root,
+    profile: { present: false, extensions: [] },
+    activeBundles: { expected: [], linked: [], broken: [] },
+    orphanLinks: { repairable: [], dead: [], usurped: [] },
+    sensors: { present: true },
+    constitution: { present: true },
+    context: { present: true, file: 'AGENTS.md' },
+});
+describe('evaluateAwmGitignorePolicy + doctor project check', () => {
+    let repo;
+    beforeEach(() => {
+        repo = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-gi-doc-'));
+        git(repo, ['init']);
+        git(repo, ['config', 'user.email', 't@t']);
+        git(repo, ['config', 'user.name', 't']);
+    });
+    afterEach(() => {
+        fs_1.default.rmSync(repo, { recursive: true, force: true });
+    });
+    it('fails when local runtime is tracked and proposes git rm --cached', () => {
+        fs_1.default.mkdirSync(path_1.default.join(repo, '.awm', 'journal'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.awm', 'journal', 'x.json'), '{}');
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.gitignore'), 'node_modules\n');
+        git(repo, ['add', '-A']);
+        git(repo, ['commit', '-m', 'track journal']);
+        const result = (0, awm_gitignore_1.evaluateAwmGitignorePolicy)(repo);
+        expect(result.ok).toBe(false);
+        if (result.ok)
+            return;
+        expect(result.detail).toMatch(/tracked local runtime/i);
+        expect(result.remedy).toMatch(/git rm --cached/);
+        expect(result.remedy).toMatch(/awm sensors init|awm watch init/);
+    });
+    it('fails when sensors.json exists but is ignored by bare .awm/', () => {
+        fs_1.default.mkdirSync(path_1.default.join(repo, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.awm', 'sensors.json'), '{}');
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.gitignore'), '.awm/\n');
+        const result = (0, awm_gitignore_1.evaluateAwmGitignorePolicy)(repo);
+        expect(result.ok).toBe(false);
+        if (result.ok)
+            return;
+        expect(result.detail).toMatch(/versioned config ignored/i);
+        expect(result.detail).toMatch(/managed.*block missing/i);
+        expect(result.remedy).toMatch(/awm sensors init|awm watch init/);
+    });
+    it('fails when markers exist but the block body is incomplete', () => {
+        fs_1.default.mkdirSync(path_1.default.join(repo, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.awm', 'sensors.json'), '{}');
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.gitignore'), '# AWM:GITIGNORE:BEGIN\n.awm/*\n# AWM:GITIGNORE:END\n');
+        const result = (0, awm_gitignore_1.evaluateAwmGitignorePolicy)(repo);
+        expect(result.ok).toBe(false);
+        if (result.ok)
+            return;
+        expect(result.detail).toMatch(/managed.*block missing|incomplete/i);
+    });
+    it('passes when the managed block is installed', () => {
+        fs_1.default.mkdirSync(path_1.default.join(repo, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.awm', 'sensors.json'), '{}');
+        (0, awm_gitignore_1.upsertAwmGitignore)(repo);
+        git(repo, ['add', '.gitignore', '.awm/sensors.json']);
+        git(repo, ['commit', '-m', 'ok']);
+        expect((0, awm_gitignore_1.evaluateAwmGitignorePolicy)(repo)).toMatchObject({ ok: true });
+    });
+    it('runChecks emits project.awm-gitignore missing when policy fails', () => {
+        fs_1.default.mkdirSync(path_1.default.join(repo, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.awm', 'sensors.json'), '{}');
+        fs_1.default.writeFileSync(path_1.default.join(repo, '.gitignore'), '.awm/\n');
+        const ctx = {
+            machine: stubMachine(),
+            project: stubProject(repo),
+            providers: [],
+        };
+        const report = (0, checks_1.runChecks)(ctx);
+        const row = report.results.find((r) => r.id === 'project.awm-gitignore');
+        expect(row).toMatchObject({ status: 'missing' });
+        expect(report.overall).toBe('degraded');
+    });
+});

package/dist/tests/core/ledger/gitignore.test.js

@@ -8,6 +8,11 @@ const path_1 = __importDefault(require("path"));
 test('.awm (and therefore .awm/ledger) is gitignored — raw ledger never committed', () => {
     const gitignore = fs_1.default.readFileSync(path_1.default.join(__dirname, '../../../../.gitignore'), 'utf-8');
     const lines = gitignore.split('\n').map(l => l.trim());
-    const coversAwm = lines.includes('.awm') || lines.includes('.awm/') || lines.includes('.awm/ledger') || lines.includes('.awm/ledger/');
+    // D-024: managed block uses `.awm/*` (with allowlist exceptions), not a bare `.awm` / `.awm/`.
+    const coversAwm = lines.includes('.awm/*') ||
+        lines.includes('.awm') ||
+        lines.includes('.awm/') ||
+        lines.includes('.awm/ledger') ||
+        lines.includes('.awm/ledger/');
     expect(coversAwm).toBe(true);
 });

package/dist/tests/structural/sensor-execution-optimization-docs-contract.test.js

@@ -0,0 +1,102 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+/**
+ * CMD-CLI-DOCS — RF-3.3 sensor execution optimization CLI reference.
+ *
+ * Section-scoped asserts only: a whole-file keyword must not satisfy these.
+ * No registry file reads (CLI plan S5).
+ */
+const repoRoot = path_1.default.resolve(__dirname, '../../..');
+const cliReferencePath = path_1.default.join(repoRoot, 'docs', 'cli-reference.md');
+function readCliReference() {
+    return fs_1.default.readFileSync(cliReferencePath, 'utf8');
+}
+/** H2 Sensors block through the next H2. */
+function sensorsSection(text) {
+    const start = text.indexOf('## Sensors (per-project computational checks)');
+    expect(start).toBeGreaterThanOrEqual(0);
+    const rest = text.slice(start);
+    const nextH2 = rest.search(/\n## (?!Sensors)/);
+    return nextH2 === -1 ? rest : rest.slice(0, nextH2);
+}
+/** Named H3 inside a parent section; fails if the heading is absent. */
+function h3Section(parent, heading) {
+    const start = parent.indexOf(heading);
+    expect(start).toBeGreaterThanOrEqual(0);
+    const rest = parent.slice(start);
+    const next = rest.search(/\n### /);
+    return next === -1 ? rest : rest.slice(0, next);
+}
+/** Named H4 inside a parent section; fails if the heading is absent. */
+function h4Section(parent, heading) {
+    const start = parent.indexOf(heading);
+    expect(start).toBeGreaterThanOrEqual(0);
+    const rest = parent.slice(start);
+    const next = rest.search(/\n#### /);
+    return next === -1 ? rest : rest.slice(0, next);
+}
+describe('sensor execution optimization docs contract (CMD-CLI-DOCS / RF-3.3)', () => {
+    it('documents authored inputs and sensor-level closureOnly under Sensors', () => {
+        const sensors = sensorsSection(readCliReference());
+        const section = h3Section(sensors, '### Inputs and closureOnly');
+        expect(section).toMatch(/`inputs`/);
+        expect(section).toMatch(/variant|project override|pack/i);
+        expect(section).toMatch(/no effective `inputs`[\s\S]{0,160}always execute|always execute[\s\S]{0,160}no effective `inputs`/i);
+        expect(section).toMatch(/`closureOnly`/);
+        expect(section).toMatch(/sensor-level|sensor object/i);
+        expect(section).toMatch(/mutation[\s\S]{0,120}closureOnly|closureOnly[\s\S]{0,120}mutation/i);
+    });
+    it('documents --slice and --no-cache on awm sensors run', () => {
+        const sensors = sensorsSection(readCliReference());
+        const run = h3Section(sensors, '### `awm sensors run`');
+        expect(run).toMatch(/--slice/);
+        expect(run).toMatch(/closureOnly/);
+        expect(run).toMatch(/--slice[\s\S]{0,200}(?:reject|refuse|not combine|cannot(?:\s+be)?\s+combin)[\s\S]{0,80}--(?:all|slow)|(?:--all|--slow)[\s\S]{0,120}(?:reject|refuse|not combine|cannot(?:\s+be)?\s+combin)[\s\S]{0,80}--slice/i);
+        expect(run).toMatch(/--no-cache/);
+        expect(run).toMatch(/isFullSelection|full[- ]gate|Change Record receipt/i);
+        expect(run).toMatch(/--slice[\s\S]{0,200}(?:not|never|no)[\s\S]{0,80}receipt|receipt[\s\S]{0,120}--slice/i);
+    });
+    it('documents cache hit semantics, provenance, fingerprint, and failureKind', () => {
+        const sensors = sensorsSection(readCliReference());
+        const cache = h4Section(h3Section(sensors, '### `awm sensors run`'), '#### Result cache');
+        expect(cache).toMatch(/cache hit|cached:\s*`?true`?/i);
+        expect(cache).toMatch(/originDirty/);
+        expect(cache).toMatch(/fingerprint|sensorFingerprint/i);
+        expect(cache).toMatch(/always-measured|alwaysMeasured/i);
+        expect(cache).toMatch(/live[\s\S]{0,80}version|liveState/i);
+        expect(cache).toMatch(/failureKind/);
+        expect(cache).toMatch(/findings/);
+        expect(cache).toMatch(/missing-binary|exit-code/);
+        expect(cache).toMatch(/\.awm\/sensors\/runs\//);
+        expect(cache).toMatch(/pre-baseline|before baseline|raw[\s\S]{0,40}baseline/i);
+        expect(cache).toMatch(/--changed[\s\S]{0,160}(?:not|never|must not)[\s\S]{0,80}(?:write|cache)|(?:write|cache)[\s\S]{0,120}(?:not|never)[\s\S]{0,80}--changed/i);
+    });
+    it('documents receipt schema 2 and RF-4.6 Change Record honesty', () => {
+        const sensors = sensorsSection(readCliReference());
+        const receipt = h4Section(h3Section(sensors, '### `awm sensors run`'), '#### Sensor receipt');
+        expect(receipt).toMatch(/"schema"\s*:\s*2|schema\s*`?2`?/);
+        expect(receipt).toMatch(/measurements/);
+        expect(receipt).toMatch(/alwaysMeasuredPaths|always-measured/i);
+        // RF-4.6 honesty only — "legacy late-path rules" elsewhere must not satisfy this.
+        expect(receipt).toMatch(/RF-4\.6[\s\S]{0,80}honesty[\s\S]{0,400}schema-1 late-path|schema-1 late-path[\s\S]{0,400}RF-4\.6[\s\S]{0,80}honesty/i);
+        expect(receipt).toMatch(/(?:any|every)[\s\S]{0,80}(?:without|no|lacks)[\s\S]{0,60}inputs[\s\S]{0,160}schema[\s\S]{0,40}1|schema[\s\S]{0,40}1[\s\S]{0,160}(?:without|no|lacks)[\s\S]{0,60}inputs/i);
+        expect(receipt).toMatch(/docs-only|documentation-only|docs only/i);
+        expect(receipt).toMatch(/project override/i);
+    });
+    it('documents RF-4.7 change new remedy honesty (full-gate + cache reuse)', () => {
+        const text = readCliReference();
+        const start = text.indexOf('### `awm change new <slug>`');
+        expect(start).toBeGreaterThanOrEqual(0);
+        const rest = text.slice(start);
+        const nextH3 = rest.search(/\n### /);
+        const section = nextH3 === -1 ? rest : rest.slice(0, nextH3);
+        // Must match REMEDY_RECEIPT honesty — not a bare `awm sensors run` that implies every binary re-execs.
+        expect(section).toMatch(/receipt-missing[\s\S]{0,200}full-gate[\s\S]{0,80}awm sensors run[\s\S]{0,120}cache may reuse/i);
+        expect(section.toLowerCase()).not.toMatch(/every tool|must re-exec|reexecute every/);
+    });
+});

package/dist/tests/structural/sensor-slice-decision-contract.test.js

@@ -0,0 +1,63 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+/**
+ * CMD-DECISION — RF-D.1 `--slice` / `closureOnly` cycle policy in docs/decisions.md.
+ *
+ * Section-scoped: index-table mentions alone must not satisfy the body asserts.
+ */
+const repoRoot = path_1.default.resolve(__dirname, '../../..');
+const decisionsPath = path_1.default.join(repoRoot, 'docs', 'decisions.md');
+const DECISION_ID = 'D-025';
+const DECISION_HEADING = `## ${DECISION_ID}`;
+const COMPANION_PLAN = 'docs/plans/2026-10-27-sensor-execution-optimization-registry-plan.md';
+function readDecisions() {
+    return fs_1.default.readFileSync(decisionsPath, 'utf8');
+}
+/** Body of ## D-025 through the next ## D- or EOF. */
+function decisionBody(text) {
+    const start = text.indexOf(DECISION_HEADING);
+    expect(start).toBeGreaterThanOrEqual(0);
+    const rest = text.slice(start);
+    const next = rest.search(/\n## D-\d+/);
+    return next === -1 ? rest : rest.slice(0, next);
+}
+describe('sensor slice decision contract (CMD-DECISION / RF-D.1)', () => {
+    it('indexes D-025 in the decisions table', () => {
+        const text = readDecisions();
+        const tableEnd = text.indexOf('\n---\n');
+        expect(tableEnd).toBeGreaterThan(0);
+        const table = text.slice(0, tableEnd);
+        expect(table).toMatch(new RegExp(`\\[D-025\\]\\(#d-025\\)[^\n]*--slice[^\n]*closureOnly|\\[D-025\\]\\(#d-025\\)[^\n]*closureOnly[^\n]*--slice`, 'i'));
+        expect(table).toMatch(/\| \[D-025\]\(#d-025\) \| 2026-10-27 \|/);
+    });
+    it('records --slice + closureOnly cycle policy and forbids partial selection as closure evidence', () => {
+        const body = decisionBody(readDecisions());
+        expect(body).toMatch(/--slice/);
+        expect(body).toMatch(/closureOnly/);
+        // DONE of a slice requires `awm sensors run --slice` + overall pass — not a loose
+        // "slice…DONE" / "DONE…--slice" alternation that surviving prose elsewhere could satisfy.
+        expect(body).toMatch(/(?:Task\s*\/\s*slice|slice)\s+DONE:\s*`awm sensors run --slice`[\s\S]{0,80}overall:\s*`?pass`?/i);
+        expect(body).toMatch(/(?:full[- ]gate|full run|no --slice)[\s\S]{0,200}(?:QA|docs|finish|Change Record)|(?:QA|docs|finish|Change Record)[\s\S]{0,200}(?:full[- ]gate|full run)/i);
+        // Partial flags are never closure evidence — all four must sit in that rule
+        // (section-scoped to D-025 body; deleting the bullet fails).
+        expect(body).toMatch(/`--slice`[\s\S]{0,100}`--fast`[\s\S]{0,100}`--slow`[\s\S]{0,100}`--changed`[\s\S]{0,160}(?:nunca|never)[\s\S]{0,100}closure/i);
+    });
+    it('points to the registry companion plan for skill wording', () => {
+        const body = decisionBody(readDecisions());
+        expect(body).toContain(COMPANION_PLAN);
+        expect(body).toMatch(/awm-baseline-registry/);
+        expect(body).toMatch(/skill/i);
+    });
+    it('avoids incomplete-prose sentinels in the decision body', () => {
+        const body = decisionBody(readDecisions());
+        expect(body).not.toMatch(/\bTODO\b/);
+        expect(body).not.toMatch(/\bTBD\b/);
+        expect(body).not.toMatch(/\bplaceholder\b/i);
+        expect(body).not.toMatch(/\bdraft\b/i);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "9.20.4",
+  "version": "9.22.0",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"
@@ -53,6 +53,7 @@
     "commander": "^14.0.3",
     "js-yaml": "4.3.2",
     "picocolors": "^1.1.1",
+    "picomatch": "4.0.7",
     "semver": "^7.7.4",
     "simple-git": "3.36.0"
   },