agentic-workflow-manager 9.20.4 → 9.22.0

package/dist/src/core/awm-gitignore.js

@@ -0,0 +1,211 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AWM_LOCAL_PATHS = exports.AWM_VERSIONED_PATHS = exports.AWM_GITIGNORE_END = exports.AWM_GITIGNORE_BEGIN = void 0;
+exports.renderManagedBlock = renderManagedBlock;
+exports.upsertAwmGitignore = upsertAwmGitignore;
+exports.evaluateAwmGitignorePolicy = evaluateAwmGitignorePolicy;
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+/** Marker lines for the managed `.gitignore` block (ASCII, exact). */
+exports.AWM_GITIGNORE_BEGIN = '# AWM:GITIGNORE:BEGIN';
+exports.AWM_GITIGNORE_END = '# AWM:GITIGNORE:END';
+/** Project config under `.awm/` that must remain commit-able (D-024). */
+exports.AWM_VERSIONED_PATHS = [
+    '.awm/sensors.json',
+    '.awm/sensors.baseline.json',
+    '.awm/profile.json',
+    '.awm/context-budget.json',
+    '.awm/context/index.json',
+];
+/** Runtime / local state under `.awm/` that must not be tracked (D-024). */
+exports.AWM_LOCAL_PATHS = [
+    '.awm/journal',
+    '.awm/ledger',
+    '.awm/evidence',
+    '.awm/track.json',
+    '.awm/sensors/runs',
+];
+const MANAGED_LINES = [
+    '.awm/*',
+    '!.awm/sensors.json',
+    '!.awm/sensors.baseline.json',
+    '!.awm/profile.json',
+    '!.awm/context-budget.json',
+    '!.awm/context/',
+    '.awm/context/*',
+    '!.awm/context/index.json',
+];
+/** Canonical managed block including begin/end markers and a trailing newline. */
+function renderManagedBlock() {
+    return [exports.AWM_GITIGNORE_BEGIN, ...MANAGED_LINES, exports.AWM_GITIGNORE_END, ''].join('\n');
+}
+function isBlanketAwmIgnore(line) {
+    const t = line.trim();
+    return t === '.awm' || t === '.awm/';
+}
+/**
+ * Upsert the managed AWM `.gitignore` block at the repository root.
+ * Idempotent when the block already matches. Migrates bare `.awm` / `.awm/`
+ * lines outside the block. Refuses a symlink `.gitignore`.
+ */
+function upsertAwmGitignore(repoRoot) {
+    if (typeof repoRoot !== 'string' || repoRoot.length === 0) {
+        throw new Error('upsertAwmGitignore requires a non-empty repository root');
+    }
+    const gi = path_1.default.join(repoRoot, '.gitignore');
+    let current = '';
+    try {
+        if (fs_1.default.lstatSync(gi).isSymbolicLink()) {
+            throw new Error('.gitignore must not be a symlink');
+        }
+        current = fs_1.default.readFileSync(gi, 'utf8');
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    const normalized = current.replace(/\r\n/g, '\n');
+    const block = renderManagedBlock();
+    const begin = normalized.indexOf(exports.AWM_GITIGNORE_BEGIN);
+    const end = normalized.indexOf(exports.AWM_GITIGNORE_END);
+    let withoutManaged;
+    if (begin !== -1 && end !== -1 && end > begin) {
+        const afterEnd = end + exports.AWM_GITIGNORE_END.length;
+        const skipNewline = normalized[afterEnd] === '\n' ? afterEnd + 1 : afterEnd;
+        withoutManaged = normalized.slice(0, begin) + normalized.slice(skipNewline);
+    }
+    else if (begin !== -1 || end !== -1) {
+        // Malformed markers: strip both marker lines and rebuild cleanly.
+        withoutManaged = normalized
+            .split('\n')
+            .filter((line) => line !== exports.AWM_GITIGNORE_BEGIN && line !== exports.AWM_GITIGNORE_END)
+            .join('\n');
+    }
+    else {
+        withoutManaged = normalized;
+    }
+    const preserved = withoutManaged
+        .split('\n')
+        .filter((line) => !isBlanketAwmIgnore(line))
+        .join('\n')
+        .replace(/\n+$/g, '');
+    const next = preserved.length > 0 ? `${preserved}\n${block}` : block;
+    if (next === normalized || next === current.replace(/\r\n/g, '\n')) {
+        // Already equivalent after normalize — avoid touching mtime when identical.
+        if (fs_1.default.existsSync(gi) && fs_1.default.readFileSync(gi, 'utf8').replace(/\r\n/g, '\n') === next)
+            return;
+    }
+    fs_1.default.writeFileSync(gi, next);
+}
+function gitOk(repoRoot, args) {
+    try {
+        const stdout = (0, child_process_1.execFileSync)('git', args, {
+            cwd: repoRoot,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env: process.env,
+        });
+        return { ok: true, stdout };
+    }
+    catch (error) {
+        const err = error;
+        return { ok: false, code: typeof err.status === 'number' ? err.status : 1, stdout: typeof err.stdout === 'string' ? err.stdout : '' };
+    }
+}
+function isGitRepo(repoRoot) {
+    const result = gitOk(repoRoot, ['rev-parse', '--is-inside-work-tree']);
+    return result.ok && result.stdout.trim() === 'true';
+}
+function extractManagedInner(text) {
+    const begin = text.indexOf(exports.AWM_GITIGNORE_BEGIN);
+    const end = text.indexOf(exports.AWM_GITIGNORE_END);
+    if (begin === -1 || end === -1 || end <= begin)
+        return null;
+    return text.slice(begin + exports.AWM_GITIGNORE_BEGIN.length, end).replace(/^\n/, '').replace(/\n$/, '');
+}
+function managedBlockComplete(repoRoot) {
+    const gi = path_1.default.join(repoRoot, '.gitignore');
+    try {
+        const text = fs_1.default.readFileSync(gi, 'utf8').replace(/\r\n/g, '\n');
+        const inner = extractManagedInner(text);
+        if (inner === null)
+            return false;
+        const expected = MANAGED_LINES.join('\n');
+        return inner === expected;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+function pathExistsUnderRoot(repoRoot, rel) {
+    try {
+        fs_1.default.lstatSync(path_1.default.join(repoRoot, rel));
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+function awmTreePresent(repoRoot) {
+    return pathExistsUnderRoot(repoRoot, '.awm') || exports.AWM_VERSIONED_PATHS.some((p) => pathExistsUnderRoot(repoRoot, p));
+}
+/**
+ * Blocking policy check for doctor/preflight (GI-6..GI-8).
+ * Skips cleanly when not inside a git work tree.
+ */
+function evaluateAwmGitignorePolicy(repoRoot) {
+    if (typeof repoRoot !== 'string' || repoRoot.length === 0) {
+        throw new Error('evaluateAwmGitignorePolicy requires a non-empty repository root');
+    }
+    if (!isGitRepo(repoRoot)) {
+        return { ok: true, skipped: true, detail: 'skipped (not a git repository)' };
+    }
+    const trackedLocal = [];
+    for (const local of exports.AWM_LOCAL_PATHS) {
+        const listed = gitOk(repoRoot, ['ls-files', '-z', '--', local]);
+        if (!listed.ok)
+            continue;
+        const paths = listed.stdout.split('\0').filter(Boolean);
+        trackedLocal.push(...paths);
+    }
+    const ignoredVersioned = [];
+    for (const versioned of exports.AWM_VERSIONED_PATHS) {
+        if (!pathExistsUnderRoot(repoRoot, versioned))
+            continue;
+        const ignore = gitOk(repoRoot, ['check-ignore', '-q', '--', versioned]);
+        // exit 0 → ignored; exit 1 → not ignored; other → treat as not ignored (fail-open on check only)
+        if (ignore.ok || ignore.code === 0)
+            ignoredVersioned.push(versioned);
+    }
+    const needsBlock = awmTreePresent(repoRoot) || trackedLocal.length > 0;
+    const missingBlock = needsBlock && !managedBlockComplete(repoRoot);
+    if (trackedLocal.length === 0 && ignoredVersioned.length === 0 && !missingBlock) {
+        return { ok: true, detail: needsBlock ? 'managed .awm gitignore policy satisfied' : 'no .awm project state' };
+    }
+    const parts = [];
+    if (trackedLocal.length > 0) {
+        parts.push(`tracked local runtime: ${trackedLocal.slice(0, 8).join(', ')}${trackedLocal.length > 8 ? '…' : ''}`);
+    }
+    if (ignoredVersioned.length > 0) {
+        parts.push(`versioned config ignored: ${ignoredVersioned.join(', ')}`);
+    }
+    if (missingBlock) {
+        parts.push('managed # AWM:GITIGNORE block missing or incomplete');
+    }
+    const remedyParts = [
+        'run `awm sensors init` or `awm watch init` to upsert the managed .gitignore block',
+    ];
+    if (trackedLocal.length > 0) {
+        const shown = trackedLocal.slice(0, 16).join(' ');
+        remedyParts.push(`then \`git rm --cached -- ${shown}${trackedLocal.length > 16 ? ' …' : ''}\``);
+    }
+    return { ok: false, detail: parts.join('; '), remedy: remedyParts.join('; ') };
+}

package/dist/src/core/changes/receipt.js

@@ -5,6 +5,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isFullSelection = isFullSelection;
 exports.sensorPairs = sensorPairs;
+exports.allowsUnmeasuredRelaxation = allowsUnmeasuredRelaxation;
+exports.measuredPathSet = measuredPathSet;
+exports.filterLateFilesForReceipt = filterLateFilesForReceipt;
 exports.computeReceiptDigest = computeReceiptDigest;
 exports.buildReceipt = buildReceipt;
 exports.writeReceipt = writeReceipt;
@@ -22,14 +25,20 @@ const paths_1 = require("../paths");
 const types_1 = require("./types");
 const text_safety_1 = require("./text-safety");
 const worktree_1 = require("./worktree");
-const RECEIPT_KEYS = ['schema', 'commit', 'ranAt', 'cliVersion', 'overall', 'sensors', 'digest'];
+const inputs_digest_1 = require("../../commands/sensors/inputs-digest");
+const contract_1 = require("../../commands/sensors/compatibility/contract");
+const RECEIPT_KEYS_V1 = ['schema', 'commit', 'ranAt', 'cliVersion', 'overall', 'sensors', 'digest'];
+const RECEIPT_KEYS_V2 = [...RECEIPT_KEYS_V1, 'measurements', 'alwaysMeasuredPaths'];
 const MAX_RECEIPT_BYTES = 1024 * 1024;
-/** True when the run covers every sensor: `--changed` never does, `--all` always does, `--fast` xor `--slow` is partial. */
+const MAX_MEASURED_PATHS = 50_000;
+/** True when the run covers every sensor: `--changed`/`--slice` never do, `--all` always does, `--fast` xor `--slow` is partial. */
 function isFullSelection(opts) {
     if (opts === null || typeof opts !== 'object')
         return false;
     if (opts.changed)
         return false;
+    if (opts.slice)
+        return false;
     if (opts.all)
         return true;
     return Boolean(opts.fast) === Boolean(opts.slow);
@@ -46,6 +55,108 @@ function sensorPairs(sensors) {
 function sortedSensors(sensors) {
     return Object.fromEntries(sensorPairs(sensors));
 }
+function sortedStrings(values) {
+    return [...values].sort(byName);
+}
+function isSha256Digest(v) {
+    return typeof v === 'string' && /^sha256:[0-9a-f]{64}$/.test(v);
+}
+function isPackageRootRel(v) {
+    return typeof v === 'string' && (v === '' || (0, inputs_digest_1.isSafeRepoRel)(v));
+}
+function measurementProblem(name, value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return `measurement for ${name} must be an object`;
+    const m = value;
+    const keys = Object.keys(m);
+    if (keys.length !== 5 || !['inputs', 'packageRootRel', 'inputDigest', 'sensorFingerprint', 'measuredPaths'].every((k) => k in m)) {
+        return `measurement for ${name} must have exactly inputs, packageRootRel, inputDigest, sensorFingerprint, measuredPaths`;
+    }
+    if (!Array.isArray(m.inputs) || m.inputs.length === 0) {
+        return `measurement inputs for ${name} must be a nonempty array of single-line strings`;
+    }
+    try {
+        // RF-1.5: reuse the same glob grammar as authored sensor inputs (reject .., !, braces, extglobs).
+        (0, contract_1.parseSensorInputs)(m.inputs, 'receipt', `measurement[${name}].inputs`);
+    }
+    catch {
+        return `measurement inputs for ${name} must obey RF-1.5 sensor input glob rules`;
+    }
+    if (!isPackageRootRel(m.packageRootRel))
+        return `measurement packageRootRel for ${name} must be '' or a safe repo-root POSIX path`;
+    if (!isSha256Digest(m.inputDigest))
+        return `measurement inputDigest for ${name} must be sha256:<hex>`;
+    if (!isSha256Digest(m.sensorFingerprint))
+        return `measurement sensorFingerprint for ${name} must be sha256:<hex>`;
+    if (!Array.isArray(m.measuredPaths) || m.measuredPaths.length > MAX_MEASURED_PATHS) {
+        return `measurement measuredPaths for ${name} must be an array within bounds`;
+    }
+    if (m.measuredPaths.some((p) => typeof p !== 'string' || !(0, inputs_digest_1.isSafeRepoRel)(p))) {
+        return `measurement measuredPaths for ${name} must be safe repo-root POSIX paths`;
+    }
+    const sorted = sortedStrings(m.measuredPaths);
+    if (JSON.stringify(m.measuredPaths) !== JSON.stringify(sorted)) {
+        return `measurement measuredPaths for ${name} must be sorted`;
+    }
+    return null;
+}
+/**
+ * RF-4.6: schema-2 unmeasured-path relaxation applies only when every sensor on the
+ * receipt had effective authored inputs (a nonempty measurement.inputs entry).
+ */
+function allowsUnmeasuredRelaxation(receipt) {
+    if (receipt === null || typeof receipt !== 'object')
+        return false;
+    if (receipt.schema !== 2)
+        return false;
+    const names = Object.keys(receipt.sensors);
+    if (names.length === 0)
+        return false;
+    for (const name of names) {
+        const m = receipt.measurements[name];
+        if (!m || !Array.isArray(m.inputs) || m.inputs.length === 0)
+            return false;
+    }
+    return true;
+}
+/** Repo-root POSIX paths that count as measured for RF-4.5 late-path checks. */
+function measuredPathSet(receipt) {
+    const out = new Set();
+    for (const p of receipt.alwaysMeasuredPaths)
+        out.add(p);
+    for (const m of Object.values(receipt.measurements)) {
+        for (const p of m.measuredPaths)
+            out.add(p);
+    }
+    return out;
+}
+function isRuntimeStatePath(rel) {
+    return worktree_1.RUNTIME_STATE_EXCLUDES.some((ex) => rel === ex || rel.startsWith(`${ex}/`));
+}
+/** True when a late path is measured: frozen set OR rematch against any measurement's inputs (RF-4.5). */
+function latePathIsMeasured(repoRel, receipt, frozen) {
+    if (frozen.has(repoRel))
+        return true;
+    for (const m of Object.values(receipt.measurements)) {
+        if ((0, inputs_digest_1.repoPathMatchesInputGlobs)(repoRel, m.packageRootRel, m.inputs))
+            return true;
+    }
+    return false;
+}
+/**
+ * Filter late files for Change Record validate (RF-4.5/4.6). Schema 1 and incomplete
+ * schema 2 keep today's strict rule (only `docs/changes/` carved out). Complete schema 2
+ * keeps paths in the frozen measured ∪ always-measured union OR matching authored inputs
+ * globs (so new matching sources after verify are not a false green). Runtime-state never counts.
+ */
+function filterLateFilesForReceipt(files, receipt, recordDirPrefix) {
+    const outsideRecords = files.filter((f) => !f.startsWith(`${recordDirPrefix}/`));
+    if (receipt === null || receipt.schema !== 2 || !allowsUnmeasuredRelaxation(receipt)) {
+        return outsideRecords;
+    }
+    const measured = measuredPathSet(receipt);
+    return outsideRecords.filter((f) => !isRuntimeStatePath(f) && latePathIsMeasured(f, receipt, measured));
+}
 /**
  * sha256 over the canonical JSON of the receipt without its digest, `sensors` being the name-sorted pairs of sensorPairs (R2.2c).
  * The digest is local (receipts are not versioned and are rewritten by every full run), so changing its canonical form only
@@ -56,9 +167,33 @@ function computeReceiptDigest(body) {
         throw new Error((0, text_safety_1.esc)('invalid receipt: digest body must be an object'));
     if (body.sensors === null || typeof body.sensors !== 'object' || Array.isArray(body.sensors))
         throw new Error((0, text_safety_1.esc)('invalid receipt: digest body sensors must be an object'));
+    if (body.schema === 1) {
+        const canonical = JSON.stringify({
+            schema: body.schema, commit: body.commit, ranAt: body.ranAt, cliVersion: body.cliVersion,
+            overall: body.overall, sensors: sensorPairs(body.sensors),
+        });
+        return 'sha256:' + crypto_1.default.createHash('sha256').update(canonical).digest('hex');
+    }
+    if (body.schema !== 2)
+        throw new Error((0, text_safety_1.esc)('invalid receipt: digest body schema must be 1 or 2'));
+    const v2 = body;
+    if (v2.measurements === null || typeof v2.measurements !== 'object' || Array.isArray(v2.measurements)) {
+        throw new Error((0, text_safety_1.esc)('invalid receipt: digest body measurements must be an object'));
+    }
+    if (!Array.isArray(v2.alwaysMeasuredPaths))
+        throw new Error((0, text_safety_1.esc)('invalid receipt: digest body alwaysMeasuredPaths must be an array'));
+    const measurements = Object.fromEntries(Object.entries(v2.measurements).sort(([a], [b]) => byName(a, b)).map(([name, m]) => [name, {
+            inputs: m.inputs,
+            packageRootRel: m.packageRootRel,
+            inputDigest: m.inputDigest,
+            sensorFingerprint: m.sensorFingerprint,
+            measuredPaths: m.measuredPaths,
+        }]));
     const canonical = JSON.stringify({
-        schema: body.schema, commit: body.commit, ranAt: body.ranAt, cliVersion: body.cliVersion,
-        overall: body.overall, sensors: sensorPairs(body.sensors),
+        schema: v2.schema, commit: v2.commit, ranAt: v2.ranAt, cliVersion: v2.cliVersion,
+        overall: v2.overall, sensors: sensorPairs(v2.sensors),
+        measurements,
+        alwaysMeasuredPaths: v2.alwaysMeasuredPaths,
     });
     return 'sha256:' + crypto_1.default.createHash('sha256').update(canonical).digest('hex');
 }
@@ -70,11 +205,12 @@ function receiptProblem(x) {
     if (x === null || typeof x !== 'object' || Array.isArray(x))
         return 'receipt must be an object';
     const r = x;
+    if (r.schema !== 1 && r.schema !== 2)
+        return 'schema must be 1 or 2';
+    const expectedKeys = r.schema === 1 ? RECEIPT_KEYS_V1 : RECEIPT_KEYS_V2;
     const keys = Object.keys(r);
-    if (keys.length !== RECEIPT_KEYS.length || !RECEIPT_KEYS.every((k) => k in r))
+    if (keys.length !== expectedKeys.length || !expectedKeys.every((k) => k in r))
         return 'receipt must have exactly the schema keys';
-    if (r.schema !== 1)
-        return 'schema must be 1';
     if (!(0, types_1.isCommitId)(r.commit))
         return 'commit must be 40 or 64 lowercase hex characters';
     if (!(0, text_safety_1.isCanonicalIso)(r.ranAt))
@@ -92,6 +228,28 @@ function receiptProblem(x) {
         if (!(0, types_1.isSensorStatus)(status))
             return 'a sensor status is not a known status';
     }
+    if (r.schema === 2) {
+        const measurements = r.measurements;
+        if (measurements === null || typeof measurements !== 'object' || Array.isArray(measurements))
+            return 'measurements must be an object';
+        for (const [name, value] of Object.entries(measurements)) {
+            if (!(0, types_1.isSensorName)(name))
+                return `measurement sensor names must be a single line of 1 to ${types_1.MAX_SENSOR_NAME} characters`;
+            const problem = measurementProblem(name, value);
+            if (problem !== null)
+                return problem;
+        }
+        if (!Array.isArray(r.alwaysMeasuredPaths) || r.alwaysMeasuredPaths.length > MAX_MEASURED_PATHS) {
+            return 'alwaysMeasuredPaths must be an array within bounds';
+        }
+        if (r.alwaysMeasuredPaths.some((p) => typeof p !== 'string' || !(0, inputs_digest_1.isSafeRepoRel)(p))) {
+            return 'alwaysMeasuredPaths must be safe repo-root POSIX paths';
+        }
+        const sortedAlways = sortedStrings(r.alwaysMeasuredPaths);
+        if (JSON.stringify(r.alwaysMeasuredPaths) !== JSON.stringify(sortedAlways)) {
+            return 'alwaysMeasuredPaths must be sorted';
+        }
+    }
     if (typeof r.digest !== 'string')
         return 'digest must be a string';
     const { digest, ...body } = r;
@@ -99,14 +257,66 @@ function receiptProblem(x) {
         return 'digest does not match the content';
     return null;
 }
-/** Builds a receipt and fails closed: throws an Error naming the problem when the result is not one `readReceipt` would accept. */
+function extractMeasurements(sensors) {
+    const out = {};
+    for (const sensor of sensors) {
+        const m = sensor.measurement;
+        if (!m || typeof m !== 'object')
+            continue;
+        if (!Array.isArray(m.inputs) || m.inputs.length === 0)
+            continue;
+        if (!isPackageRootRel(m.packageRootRel))
+            continue;
+        if (!isSha256Digest(m.inputDigest) || !isSha256Digest(m.sensorFingerprint))
+            continue;
+        if (!Array.isArray(m.measuredPaths) || m.measuredPaths.some((p) => typeof p !== 'string' || !(0, inputs_digest_1.isSafeRepoRel)(p)))
+            continue;
+        out[sensor.name] = {
+            inputs: [...m.inputs],
+            packageRootRel: m.packageRootRel,
+            inputDigest: m.inputDigest,
+            sensorFingerprint: m.sensorFingerprint,
+            measuredPaths: sortedStrings(m.measuredPaths),
+        };
+    }
+    return Object.fromEntries(Object.entries(out).sort(([a], [b]) => byName(a, b)));
+}
+/** Builds a schema-2 receipt (RF-4.3). Schema 1 remains readable via `readReceipt` / `writeReceipt`. */
 function buildReceipt(input) {
     const out = input === null || typeof input !== 'object' ? undefined : input.output;
     if (out === null || typeof out !== 'object' || !Array.isArray(out.sensors) || out.sensors.some((s) => s === null || typeof s !== 'object')) {
         throw new Error('invalid receipt: run output must carry a sensors array');
     }
     const sensors = sortedSensors(Object.fromEntries(out.sensors.map((s) => [s.name, s.status])));
-    const body = { schema: 1, commit: input.commit, ranAt: input.ranAt, cliVersion: input.cliVersion, overall: out.overall, sensors };
+    const measurements = extractMeasurements(out.sensors);
+    const alwaysFromSensors = new Set();
+    for (const sensor of out.sensors) {
+        const extras = sensor.measurement?.alwaysMeasuredPaths;
+        if (!Array.isArray(extras))
+            continue;
+        for (const p of extras) {
+            if (typeof p === 'string' && (0, inputs_digest_1.isSafeRepoRel)(p))
+                alwaysFromSensors.add(p);
+        }
+    }
+    const provided = Array.isArray(input.alwaysMeasuredPaths) ? input.alwaysMeasuredPaths : [];
+    for (const p of provided) {
+        if (typeof p === 'string' && (0, inputs_digest_1.isSafeRepoRel)(p))
+            alwaysFromSensors.add(p);
+    }
+    // Validate always-measured always includes baseline (RF-2.12 / RF-4.5), even when empty.
+    alwaysFromSensors.add(inputs_digest_1.CACHE_DIGEST_BASELINE_REL);
+    const alwaysMeasuredPaths = sortedStrings([...alwaysFromSensors]);
+    const body = {
+        schema: 2,
+        commit: input.commit,
+        ranAt: input.ranAt,
+        cliVersion: input.cliVersion,
+        overall: out.overall,
+        sensors,
+        measurements,
+        alwaysMeasuredPaths,
+    };
     const receipt = { ...body, digest: computeReceiptDigest(body) };
     const problem = receiptProblem(receipt);
     if (problem !== null)

package/dist/src/core/diagnostics/checks.js

@@ -7,6 +7,7 @@ exports.computeProviderOverall = computeProviderOverall;
 exports.runChecks = runChecks;
 // src/core/diagnostics/checks.ts
 const path_1 = __importDefault(require("path"));
+const awm_gitignore_1 = require("../awm-gitignore");
 const cmd = (value) => ({ kind: 'command', value });
 const skillRemedy = (value) => ({ kind: 'skill', value });
 const none = { kind: 'none' };
@@ -152,6 +153,16 @@ function projectChecks(p) {
         out.push({ id: 'project.context', level: 'project', label: 'agent context (CLAUDE.md/AGENTS.md) missing', status: 'warn',
             remedy: skillRemedy('project-context-init') });
     }
+    // project.awm-gitignore — D-024 / #218 (blocking via status missing)
+    const gi = (0, awm_gitignore_1.evaluateAwmGitignorePolicy)(p.root);
+    if (gi.ok) {
+        out.push({ id: 'project.awm-gitignore', level: 'project', label: '.awm gitignore policy',
+            status: 'ok', detail: gi.detail, remedy: none });
+    }
+    else {
+        out.push({ id: 'project.awm-gitignore', level: 'project', label: '.awm gitignore policy',
+            status: 'missing', detail: gi.detail, remedy: cmd(gi.remedy) });
+    }
     return out;
 }
 // --- Task 9: overall status for the per-provider diagnostic matrix --------

package/dist/tests/commands/change/new.test.js

@@ -62,7 +62,7 @@ let repo;
 const now = () => new Date('2026-10-17T12:00:00.000Z');
 const pass = { overall: 'pass', sensors: [{ name: 'lint', status: 'pass', errors: [] }] };
 const RECEIPT_TIME = '2026-10-17T11:00:00.000Z';
-const REMEDY = 'commit your work, then run awm sensors run';
+const REMEDY = 'commit your work, then run full-gate awm sensors run (cache may reuse unchanged sensors)';
 const REMEDY_SPLIT = 'split the change into smaller ones';
 const REMEDY_SENSORS = 'reduce the sensors listed in .awm/sensors.json (the sensor receipt makes the record too large)';
 function receiptForHead() {