agentic-workflow-manager 9.7.1 → 9.8.0

package/dist/src/core/admission/index.js

@@ -0,0 +1,181 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROVIDER_EXECUTION_CAPABILITIES = void 0;
+exports.sanitizeAdmissionReport = sanitizeAdmissionReport;
+exports.admitPlan = admitPlan;
+const providers_1 = require("../../providers");
+const paths_1 = require("../journal/paths");
+const UNKNOWN = {
+    artifactDelivery: 'unverified', interactiveExecution: 'unverified', unattendedController: 'unverified', nativeSubagents: 'unverified',
+    modelOverride: 'unverified', effortOverride: 'unverified', observedModelEvidence: 'unverified', durableResume: 'unverified',
+};
+/** Deliberate R1 evidence table. Artifact delivery is never used as execution evidence. */
+exports.PROVIDER_EXECUTION_CAPABILITIES = {
+    antigravity: { ...UNKNOWN },
+    opencode: { ...UNKNOWN },
+    'claude-code': { ...UNKNOWN, interactiveExecution: 'supported', unattendedController: 'supported', durableResume: 'supported' },
+    codex: { ...UNKNOWN, interactiveExecution: 'supported', unattendedController: 'supported', durableResume: 'supported' },
+    cursor: { ...UNKNOWN },
+    copilot: { ...UNKNOWN },
+};
+const MAX_DIAGNOSTICS = 20;
+const MAX_DIAGNOSTIC_LENGTH = 4096;
+function safe(value) { return value.replace(/[\u0000-\u001F\u007F-\u009F]/g, character => `\\u${character.codePointAt(0).toString(16).padStart(4, '0')}`).slice(0, MAX_DIAGNOSTIC_LENGTH); }
+function sanitizeDiagnostics(diagnostics) { return diagnostics.slice(0, MAX_DIAGNOSTICS).map(item => ({ code: safe(String(item.code)), message: safe(String(item.message)), ...(typeof item.field === 'string' ? { field: safe(item.field) } : {}) })); }
+function diagnostic(code, message) { return { code: safe(code), message: safe(message) }; }
+function blocked(input, diagnostics, extras = {}) {
+    const { journal = 'not-required', currentness = 'not-checked', sensors = 'not-required', ...rest } = extras;
+    return { state: 'blocked', planState: input.plan.state, journal, currentness, sensors, ...rest, diagnostics: sanitizeDiagnostics(diagnostics) };
+}
+function forecast(slices) {
+    const roles = { implementer: slices, 'specification-reviewer': slices, 'code-quality-reviewer': slices, 'final-reviewer': 1, 'track-a-qa': 1, 'track-b-qa': 1, documentation: 1, retro: 1, finishing: 1 };
+    return { kind: 'topology', slices, roles, total: Object.values(roles).reduce((sum, count) => sum + count, 0) };
+}
+function currentness(report, consumedRegistryComponents) {
+    const consumed = new Set(['cli', ...consumedRegistryComponents]);
+    const present = new Set(report.components.map(component => component.component));
+    const missing = [...consumed].filter(component => !present.has(component));
+    if (missing.length > 0)
+        return { status: 'unverifiable', diagnostics: [diagnostic('ADMISSION_CURRENTNESS_MISSING_COMPONENT', `Currentness evidence is missing consumed components: ${missing.join(', ')}.`)] };
+    const failed = report.components.filter(component => consumed.has(component.component) && component.status !== 'current');
+    if (failed.length === 0)
+        return { status: 'current', diagnostics: [] };
+    const names = failed.map(component => component.component).join(', ');
+    const status = failed.some(component => component.status === 'unverifiable') ? 'unverifiable' : 'stale';
+    return { status, diagnostics: [diagnostic('ADMISSION_CURRENTNESS_BLOCKED', `Consumed contract currentness is ${status}: ${names}.`)] };
+}
+function sensorVerdict(report) { return report.overall === 'not_certified' ? 'not-certified' : report.overall === 'pass' ? 'pass' : 'fail'; }
+function journalStatus(input, plan) {
+    if (input.journalCorrupt)
+        return 'corrupt';
+    const journal = input.journalState;
+    if (!journal)
+        return 'missing';
+    if (journal.schema !== 2 || !journal.planBinding)
+        return 'stale';
+    let planPath;
+    try {
+        planPath = (0, paths_1.bindingPlanPath)(input.planPath ?? '');
+    }
+    catch {
+        return 'stale';
+    }
+    const binding = journal.planBinding;
+    return binding.path === planPath && binding.digest === plan.planDigest && binding.schema === plan.schema && binding.executionMode === 'desatendido'
+        ? 'current' : 'stale';
+}
+const PLAN_STATES = new Set(['valid', 'migration-required', 'invalid', 'unsupported']);
+const JOURNALS = new Set(['not-required', 'current', 'missing', 'corrupt', 'stale']);
+const CURRENTNESS = new Set(['current', 'stale', 'unverifiable', 'not-checked']);
+const SENSORS = new Set(['pass', 'fail', 'not-certified', 'not-required']);
+const CAPABILITY = new Set(['supported', 'unsupported', 'unverified']);
+function invalidAdmission() { throw new Error('admission returned an invalid report'); }
+function validCapabilities(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const record = value;
+    const keys = ['artifactDelivery', 'interactiveExecution', 'unattendedController', 'nativeSubagents', 'modelOverride', 'effortOverride', 'observedModelEvidence', 'durableResume'];
+    return Object.keys(record).length === keys.length && keys.every(key => CAPABILITY.has(record[key]));
+}
+function validForecast(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const record = value;
+    const roles = ['implementer', 'specification-reviewer', 'code-quality-reviewer', 'final-reviewer', 'track-a-qa', 'track-b-qa', 'documentation', 'retro', 'finishing'];
+    const slices = record.slices;
+    const topology = { implementer: slices, 'specification-reviewer': slices, 'code-quality-reviewer': slices, 'final-reviewer': 1, 'track-a-qa': 1, 'track-b-qa': 1, documentation: 1, retro: 1, finishing: 1 };
+    return record.kind === 'topology' && Number.isSafeInteger(slices) && slices >= 0 && Number.isSafeInteger(record.total) && record.total >= 0
+        && !!record.roles && typeof record.roles === 'object' && !Array.isArray(record.roles) && Object.keys(record.roles).length === roles.length
+        && roles.every(role => record.roles[role] === topology[role])
+        && record.total === Object.values(topology).reduce((sum, count) => sum + count, 0);
+}
+function validDiagnostics(value) {
+    return Array.isArray(value) && value.every(item => item && typeof item === 'object' && typeof item.code === 'string' && typeof item.message === 'string' && (item.field === undefined || typeof item.field === 'string'));
+}
+/** Defensive public-output boundary for injected dependencies as well as core reports. */
+function sanitizeAdmissionReport(report) {
+    if (!report || typeof report !== 'object' || Array.isArray(report))
+        invalidAdmission();
+    const value = report;
+    if ((value.state !== 'admitted' && value.state !== 'blocked') || !PLAN_STATES.has(value.planState) || !JOURNALS.has(value.journal) || !CURRENTNESS.has(value.currentness) || !SENSORS.has(value.sensors) || !validDiagnostics(value.diagnostics))
+        invalidAdmission();
+    if (value.planDigest !== undefined && (typeof value.planDigest !== 'string' || !/^[a-f0-9]{64}$/.test(value.planDigest)))
+        invalidAdmission();
+    if (value.executionMode !== undefined && value.executionMode !== 'interactivo' && value.executionMode !== 'desatendido')
+        invalidAdmission();
+    if (value.provider !== undefined && !(0, providers_1.isAgentTarget)(value.provider))
+        invalidAdmission();
+    if (value.capabilityResolution !== undefined) {
+        const resolution = value.capabilityResolution;
+        if (!resolution || typeof resolution !== 'object' || !['native', 'degraded', 'blocked'].includes(resolution.outcome) || !(0, providers_1.isAgentTarget)(resolution.provider) || !validCapabilities(resolution.capabilities) || resolution.evidenceVersion !== 'r1-v1' || !validDiagnostics(resolution.diagnostics))
+            invalidAdmission();
+    }
+    if (value.forecast !== undefined && !validForecast(value.forecast))
+        invalidAdmission();
+    const capabilityResolution = value.capabilityResolution === undefined ? undefined : { ...value.capabilityResolution, diagnostics: sanitizeDiagnostics(value.capabilityResolution.diagnostics) };
+    return { ...value, ...(capabilityResolution ? { capabilityResolution } : {}), diagnostics: sanitizeDiagnostics(value.diagnostics) };
+}
+/** Pure, read-only composition. Callers own every I/O dependency and no dispatch API is exposed here. */
+async function admitPlan(input) {
+    if (!input || typeof input !== 'object' || typeof input.cwd !== 'string' || input.cwd.length === 0)
+        throw new Error('admission requires a cwd');
+    const plan = input.plan;
+    if (!plan || typeof plan !== 'object')
+        throw new Error('admission requires a plan report');
+    if (plan.state !== 'valid') {
+        if (plan.state === 'unsupported')
+            return blocked(input, [diagnostic('ADMISSION_PLAN_UNSUPPORTED', 'This compact plan schema is not supported for admission.'), ...plan.diagnostics]);
+        const code = plan.state === 'migration-required' ? 'ADMISSION_PLAN_MIGRATION_REQUIRED' : 'ADMISSION_PLAN_INVALID';
+        return blocked(input, [diagnostic(code, 'Compact plan validation must succeed before admission.'), ...(plan.state === 'invalid' ? plan.diagnostics : [])]);
+    }
+    if (!(0, providers_1.isAgentTarget)(input.provider))
+        return blocked(input, [diagnostic('ADMISSION_PROVIDER_INVALID', `Unknown provider: ${String(input.provider)}.`)], { planDigest: plan.planDigest });
+    const provider = input.provider;
+    if (input.enabledAgents && !input.enabledAgents.includes(provider)) {
+        return blocked(input, [diagnostic('ADMISSION_PROVIDER_DISABLED', `Provider ${provider} is not enabled.`)], { planDigest: plan.planDigest, provider });
+    }
+    // v1 manifests do not yet carry executionMode in their typed schema. Accept only
+    // the exact future field when an already-validated caller supplies it; otherwise
+    // preserve the safe interactive default until S3 owns durable unattended binding.
+    const manifestMode = plan.manifest.executionMode;
+    const mode = input.executionMode ?? (manifestMode === 'desatendido' ? 'desatendido' : 'interactivo');
+    if (mode !== 'interactivo' && mode !== 'desatendido')
+        return blocked(input, [diagnostic('ADMISSION_EXECUTION_MODE_INVALID', 'Execution mode must be interactivo or desatendido.')], { planDigest: plan.planDigest, provider, executionMode: 'interactivo' });
+    if (input.requireCurrent) {
+        if (input.provenance !== 'proven')
+            return blocked(input, [diagnostic('ADMISSION_CURRENTNESS_PROVENANCE_REQUIRED', 'Consumed registry contracts cannot be proven from validated plan sources.')], { planDigest: plan.planDigest, provider, executionMode: mode, currentness: 'unverifiable' });
+        if (!input.currentness)
+            return blocked(input, [diagnostic('ADMISSION_CURRENTNESS_REQUIRED', 'Currentness evidence was required but not supplied.')], { planDigest: plan.planDigest, provider, executionMode: mode });
+        const gate = currentness(input.currentness, input.consumedRegistryComponents ?? []);
+        if (gate.diagnostics.length)
+            return blocked(input, gate.diagnostics, { planDigest: plan.planDigest, provider, executionMode: mode, currentness: gate.status });
+        if (input.compatibilityDiagnostics?.length)
+            return blocked(input, input.compatibilityDiagnostics, { planDigest: plan.planDigest, provider, executionMode: mode, currentness: 'unverifiable' });
+    }
+    if (input.verifySensors) {
+        if (!input.sensors)
+            return blocked(input, [diagnostic('ADMISSION_SENSORS_REQUIRED', 'Sensor evidence was required but not supplied.')], { planDigest: plan.planDigest, provider, executionMode: mode, currentness: input.requireCurrent ? 'current' : 'not-checked' });
+        const sensors = sensorVerdict(input.sensors);
+        if (sensors !== 'pass')
+            return blocked(input, [diagnostic('ADMISSION_SENSORS_BLOCKED', `Sensor verdict is ${sensors}.`)], { planDigest: plan.planDigest, provider, executionMode: mode, currentness: input.requireCurrent ? 'current' : 'not-checked', sensors });
+    }
+    if (mode === 'desatendido') {
+        const journal = journalStatus(input, plan);
+        if (journal !== 'current')
+            return blocked(input, [diagnostic('ADMISSION_JOURNAL_BINDING_REQUIRED', 'Unattended execution requires a healthy schema-2 journal binding for this exact plan; run watch --init --plan.')], { planDigest: plan.planDigest, provider, executionMode: mode, journal, currentness: input.requireCurrent ? 'current' : 'not-checked', sensors: input.verifySensors ? 'pass' : 'not-required' });
+        const capabilities = exports.PROVIDER_EXECUTION_CAPABILITIES[provider];
+        const resolution = { outcome: capabilities.unattendedController === 'supported' ? 'native' : 'blocked', provider, capabilities, evidenceVersion: 'r1-v1', diagnostics: [] };
+        if (resolution.outcome === 'blocked')
+            return blocked(input, [diagnostic('ADMISSION_CAPABILITY_UNVERIFIED', `Provider ${provider} has no verified unattended execution capability.`)], { planDigest: plan.planDigest, provider, executionMode: mode, journal, currentness: input.requireCurrent ? 'current' : 'not-checked', sensors: input.verifySensors ? 'pass' : 'not-required', capabilityResolution: resolution });
+        return { state: 'admitted', planState: 'valid', planDigest: plan.planDigest, provider, executionMode: mode, journal, currentness: input.requireCurrent ? 'current' : 'not-checked', sensors: input.verifySensors ? 'pass' : 'not-required', capabilityResolution: resolution, forecast: forecast(plan.manifest.slices.length), diagnostics: [] };
+    }
+    const capabilities = exports.PROVIDER_EXECUTION_CAPABILITIES[provider];
+    const resolution = { outcome: capabilities.interactiveExecution === 'supported' ? 'native' : 'blocked', provider, capabilities, evidenceVersion: 'r1-v1', diagnostics: [] };
+    if (resolution.outcome === 'blocked')
+        return blocked(input, [diagnostic('ADMISSION_CAPABILITY_UNVERIFIED', `Provider ${provider} has no verified interactive execution capability.`)], { planDigest: plan.planDigest, provider, executionMode: mode, capabilityResolution: resolution });
+    return { state: 'admitted', planState: 'valid', planDigest: plan.planDigest, provider, executionMode: mode, journal: 'not-required', currentness: input.requireCurrent ? 'current' : 'not-checked', sensors: input.verifySensors ? 'pass' : 'not-required', capabilityResolution: resolution, forecast: forecast(plan.manifest.slices.length), diagnostics: [] };
+}
+// Structural exhaustiveness guard: adding an AgentTarget requires an explicit entry above.
+const capabilityTargets = providers_1.AGENT_TARGETS;
+if (Object.keys(exports.PROVIDER_EXECUTION_CAPABILITIES).length !== capabilityTargets.length || !capabilityTargets.every(target => target in exports.PROVIDER_EXECUTION_CAPABILITIES))
+    throw new Error('provider capability table must be exhaustive');

package/dist/src/core/admission/registry-contracts.js

@@ -0,0 +1,290 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.consumedRegistryContracts = consumedRegistryContracts;
+exports.registryCompatibility = registryCompatibility;
+exports.admitRegistryPlan = admitRegistryPlan;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const crypto_1 = __importDefault(require("crypto"));
+const providers_1 = require("../../providers");
+const registry_1 = require("../renderers/registry");
+const registries_1 = require("../registries");
+const native_bridge_1 = require("../secure-fs/native-bridge");
+const json_1 = require("../plan/json");
+const cli_version_1 = require("../cli-version");
+const versioning_1 = require("../versioning");
+const check_1 = require("../currentness/check");
+const run_1 = require("../../commands/sensors/run");
+const index_1 = require("./index");
+const FRAMEWORK_CONTRACTS = ['using-awm', 'writing-plans', 'development-process', 'subagent-driven-development', 'executing-plans', 'post-implementation-qa', 'post-implementation-docs', 'harness-retro', 'finishing-a-development-branch'];
+const MAX_CONTRACT_BYTES = 1024 * 1024;
+const MAX_MANIFEST_BYTES = 256 * 1024;
+const MAX_DIRECTORY_ENTRIES = 10000;
+function unknown(message) {
+    return { provenance: 'unknown', consumedRegistryComponents: [], provenanceDiagnostic: { code: 'ADMISSION_CURRENTNESS_PROVENANCE_REQUIRED', message: `${message} Repair the installed runtime artifact or registry provenance before dispatch.` } };
+}
+function within(root, candidate) {
+    const relative = path_1.default.relative(root, candidate);
+    return relative === '' || (!relative.startsWith(`..${path_1.default.sep}`) && relative !== '..' && !path_1.default.isAbsolute(relative));
+}
+function physicalDirectory(directory) {
+    const physical = fs_1.default.realpathSync.native(directory);
+    if (!fs_1.default.lstatSync(physical).isDirectory())
+        throw new Error('path is not a directory');
+    const handle = fs_1.default.opendirSync(physical);
+    try {
+        let entries = 0;
+        while (handle.readSync() !== null)
+            if (++entries > MAX_DIRECTORY_ENTRIES)
+                throw new Error('directory entry limit exceeded');
+    }
+    finally {
+        handle.closeSync();
+    }
+    return physical;
+}
+function filesystemIdentity(file) {
+    const stat = fs_1.default.lstatSync(file, { bigint: true });
+    if (stat.isSymbolicLink() || stat.ino === 0n)
+        throw new Error('filesystem identity is unavailable');
+    return `${stat.dev.toString()}:${stat.ino.toString()}`;
+}
+/** Native descriptor bytes plus exact bigint leaf identity are observed only
+ * in memory. No source body or new journal snapshot is persisted. */
+function contractFileIdentity(file) {
+    const before = fs_1.default.lstatSync(file, { bigint: true });
+    if (!before.isFile() || before.isSymbolicLink() || before.ino === 0n)
+        throw new Error('contract identity is unavailable');
+    const bytes = native_bridge_1.secureFs.readRegularFile(file, MAX_CONTRACT_BYTES).bytes;
+    const after = fs_1.default.lstatSync(file, { bigint: true });
+    if (!after.isFile() || after.isSymbolicLink() || before.dev !== after.dev || before.ino !== after.ino
+        || before.size !== after.size || before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs)
+        throw new Error('contract identity changed during inspection');
+    return crypto_1.default.createHash('sha256').update(`${before.dev.toString()}:${before.ino.toString()}\0`).update(bytes).digest('hex');
+}
+/** ENOENT proves absence only when the nearest existing parent is readable.
+ * A dangling/replaced ancestor never certifies an empty provider install. */
+function directoryExists(directory) {
+    let current = directory;
+    while (true) {
+        try {
+            fs_1.default.lstatSync(current);
+            physicalDirectory(current);
+            return current === directory;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            const parent = path_1.default.dirname(current);
+            if (parent === current)
+                throw error;
+            // An existing dangling symlink causes realpath ENOENT; do not
+            // continue above it as though the requested install were absent.
+            try {
+                if (fs_1.default.lstatSync(current).isSymbolicLink())
+                    throw new Error('dangling directory ancestor');
+            }
+            catch (inspection) {
+                if (inspection.code !== 'ENOENT')
+                    throw inspection;
+            }
+            current = parent;
+        }
+    }
+}
+/** Physical sources AND actual provider artifacts define consumption. Copied
+ * rendered artifacts have no owner proof; a basename is never provenance. */
+function consumedRegistryContracts(report, cwd, registries, target) {
+    if (report.state !== 'valid')
+        return unknown('A validated compact plan is required.');
+    if (!Array.isArray(registries) || registries.length > 256)
+        return unknown('Registry inventory is invalid or unbounded.');
+    let root;
+    try {
+        root = physicalDirectory(path_1.default.resolve(cwd));
+    }
+    catch {
+        return unknown('Project root provenance is unavailable.');
+    }
+    const physicalRegistries = [];
+    for (const registry of registries) {
+        try {
+            if (!registry || typeof registry.name !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}$/.test(registry.name)
+                || typeof registry.contentRoot !== 'string' || registry.contentRoot.length > 4096
+                || typeof registry.remote !== 'string' || registry.remote.length > 4096)
+                throw new Error('invalid registry identity');
+            const physicalRoot = physicalDirectory(registry.contentRoot);
+            physicalRegistries.push({ name: registry.name, root: physicalRoot, identity: filesystemIdentity(physicalRoot), remote: registry.remote });
+        }
+        catch {
+            const name = typeof registry?.name === 'string' && /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}$/.test(registry.name) ? registry.name : 'unknown';
+            return unknown(`Registry ${name} root cannot be inspected.`);
+        }
+    }
+    const consumed = new Set();
+    const identities = [];
+    for (const source of report.manifest.sources) {
+        try {
+            const file = fs_1.default.realpathSync.native(path_1.default.resolve(root, source.path));
+            if (!within(root, file))
+                return unknown(`Plan source ${source.path} escapes its physical project root.`);
+            identities.push(JSON.stringify(['source', source.id, contractFileIdentity(file)]));
+            for (const registry of physicalRegistries)
+                if (within(registry.root, file))
+                    consumed.add(`registry:${registry.name}`);
+        }
+        catch {
+            return unknown(`Plan source ${source.path} cannot be inspected as a bounded regular file.`);
+        }
+    }
+    const provider = (0, providers_1.providerFor)(target);
+    const directories = [provider.skill.global, path_1.default.resolve(root, provider.skill.local)].filter((directory) => directory !== null);
+    for (const directory of directories) {
+        try {
+            if (!directoryExists(directory))
+                continue;
+        }
+        catch {
+            return unknown(`Provider ${target} install directory ${directory} is unsafe or unreadable.`);
+        }
+        for (const contract of FRAMEWORK_CONTRACTS) {
+            const artifact = path_1.default.join(directory, (0, registry_1.renderedFilename)(contract, provider.skill.renderer));
+            try {
+                fs_1.default.lstatSync(artifact);
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    continue;
+                return unknown(`Runtime artifact ${artifact} cannot be inspected.`);
+            }
+            const declaredFile = provider.skill.renderer === 'link' ? path_1.default.join(artifact, 'SKILL.md') : artifact;
+            try {
+                const file = fs_1.default.realpathSync.native(declaredFile);
+                const identity = contractFileIdentity(file);
+                const owners = physicalRegistries.filter(registry => within(registry.root, file));
+                if (owners.length !== 1)
+                    return unknown(`Runtime artifact ${artifact} has no unique physical registry owner (copied/rendered content is not ownership proof).`);
+                consumed.add(`registry:${owners[0].name}`);
+                identities.push(JSON.stringify(['artifact', target, contract, provider.skill.renderer, identity]));
+            }
+            catch {
+                return unknown(`Runtime artifact ${artifact} is dangling, nonregular, unreadable or unbounded.`);
+            }
+        }
+    }
+    for (const registry of physicalRegistries)
+        if (consumed.has(`registry:${registry.name}`))
+            identities.push(JSON.stringify(['registry', registry.name, registry.identity, registry.remote]));
+    return { provenance: 'proven', consumedRegistryComponents: [...consumed].sort(), identityDigest: crypto_1.default.createHash('sha256').update(identities.sort().join('\0')).digest('hex') };
+}
+/** Only the declared CLI floor is consumed here, not a new registry catalog.
+ * The native bounded/no-follow read prevents stat/read races and body leaks. */
+function registryCompatibility(registries, consumed) {
+    const diagnostics = [];
+    const current = (0, cli_version_1.cliVersion)();
+    for (const registry of registries) {
+        const component = `registry:${registry.name}`;
+        if (!consumed.includes(component))
+            continue;
+        try {
+            const physicalRoot = physicalDirectory(registry.contentRoot);
+            const manifest = path_1.default.join(physicalRoot, registries_1.REGISTRY_MANIFEST_NAME);
+            try {
+                fs_1.default.lstatSync(manifest);
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    continue;
+                throw error;
+            }
+            const bytes = native_bridge_1.secureFs.readRegularFile(manifest, MAX_MANIFEST_BYTES).bytes;
+            const raw = (0, json_1.parseJsonNoDuplicate)(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+            if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+                throw new Error('manifest must be a JSON object');
+            const min = raw.minCliVersion;
+            if (min !== undefined && (typeof min !== 'string' || !/^v?\d+\.\d+\.\d+$/.test(min)
+                || min.replace(/^v/, '').split('.').some(part => !Number.isSafeInteger(Number(part)))))
+                throw new Error('invalid CLI floor');
+            if (typeof min === 'string' && (0, versioning_1.compareSemver)(current, min) < 0)
+                diagnostics.push({ code: 'ADMISSION_REGISTRY_CLI_INCOMPATIBLE', message: `${component} requires CLI >= ${min}; installed CLI is ${current}. Update the CLI before dispatch.` });
+        }
+        catch {
+            diagnostics.push({ code: 'ADMISSION_REGISTRY_COMPATIBILITY_UNVERIFIABLE', message: `${component} manifest compatibility could not be verified as bounded regular JSON. Repair the registry before dispatch.` });
+        }
+    }
+    return diagnostics;
+}
+/** One admission authority for the public command AND actual watch dispatch.
+ * No empirical execution occurs before provenance/currentness/CLI-floor gates. */
+async function admitRegistryPlan(input, dependencies = {}) {
+    const admission = dependencies.admitPlan ?? index_1.admitPlan;
+    if (input.plan.state !== 'valid' || !(0, providers_1.isAgentTarget)(input.provider) || (input.enabledAgents && !input.enabledAgents.includes(input.provider))
+        || (input.executionMode !== undefined && input.executionMode !== 'interactivo' && input.executionMode !== 'desatendido'))
+        return admission(input);
+    let registries = [];
+    let scope;
+    const inventory = dependencies.listRegistries ?? registries_1.listRegistries;
+    const target = input.provider;
+    try {
+        registries = inventory();
+        scope = consumedRegistryContracts(input.plan, input.cwd, registries, target);
+    }
+    catch {
+        scope = unknown('Registry inventory cannot be read.');
+    }
+    const refresh = () => {
+        try {
+            const refreshedRegistries = inventory();
+            const refreshed = consumedRegistryContracts(input.plan, input.cwd, refreshedRegistries, target);
+            const previousComponents = scope.consumedRegistryComponents.join('\0');
+            const previousIdentity = scope.identityDigest;
+            registries = refreshedRegistries;
+            scope = refreshed.provenance === 'unknown' ? refreshed
+                : refreshed.consumedRegistryComponents.join('\0') !== previousComponents || refreshed.identityDigest !== previousIdentity
+                    ? unknown('Consumed registry ownership changed during an asynchronous admission observation. Re-run actual currentness and read-only plan admission.') : refreshed;
+            if (scope.provenanceDiagnostic)
+                scope = { ...scope, provenanceDiagnostic: { ...scope.provenanceDiagnostic, message: `${scope.provenanceDiagnostic.message} Re-run actual currentness after repair.` } };
+        }
+        catch {
+            scope = unknown('Registry inventory changed or cannot be read after asynchronous admission. Re-run actual currentness.');
+        }
+        return scope.provenance === 'proven';
+    };
+    const compose = async (fields) => {
+        const report = await admission({ ...input, provenance: scope.provenance, consumedRegistryComponents: scope.consumedRegistryComponents, ...fields });
+        if (scope.provenanceDiagnostic && report.diagnostics.some(diagnostic => diagnostic.code === 'ADMISSION_CURRENTNESS_PROVENANCE_REQUIRED')) {
+            return { ...report, diagnostics: report.diagnostics.map(diagnostic => diagnostic.code === 'ADMISSION_CURRENTNESS_PROVENANCE_REQUIRED' ? scope.provenanceDiagnostic : diagnostic) };
+        }
+        return report;
+    };
+    let currentness = input.currentness;
+    let compatibilityDiagnostics;
+    if (input.requireCurrent) {
+        if (scope.provenance !== 'proven')
+            return compose({});
+        currentness = currentness ?? await (dependencies.checkCurrentness ?? check_1.checkCurrentness)(input.cwd);
+        if (!refresh())
+            return compose({ currentness });
+        // A missing sensor input stages composition before capability resolution.
+        const currentnessGate = await compose({ currentness, verifySensors: true, sensors: undefined });
+        if (currentnessGate.currentness !== 'current')
+            return currentnessGate;
+        compatibilityDiagnostics = registryCompatibility(registries, scope.consumedRegistryComponents);
+        const compatibilityGate = await compose({ currentness, compatibilityDiagnostics, verifySensors: true, sensors: undefined });
+        if (compatibilityGate.currentness !== 'current')
+            return compatibilityGate;
+    }
+    const sensors = input.verifySensors ? input.sensors ?? await (dependencies.runSensors ?? run_1.runSensors)({ cwd: input.cwd, all: true, readOnly: true }) : undefined;
+    if (input.requireCurrent && input.verifySensors) {
+        if (!refresh())
+            return compose({ currentness, sensors });
+        const currentnessGate = await compose({ currentness, verifySensors: true, sensors: undefined });
+        if (currentnessGate.currentness !== 'current')
+            return currentnessGate;
+        compatibilityDiagnostics = registryCompatibility(registries, scope.consumedRegistryComponents);
+    }
+    return compose({ currentness, compatibilityDiagnostics, sensors });
+}

package/dist/src/core/journal/fingerprint.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.reconcileUnattendedRecovery = reconcileUnattendedRecovery;
 exports.resolveWorkingDirectory = resolveWorkingDirectory;
 exports.computeFingerprint = computeFingerprint;
 const crypto_1 = __importDefault(require("crypto"));
@@ -19,8 +20,41 @@ function sha(parts) {
 // el stderr de git hacia el stderr DEL SUPERVISOR — si ese fd es un pipe roto, el
 // relay dispara un EPIPE no catcheable que crashea el proceso ENTERO (este helper
 // backea computeFingerprint, invocado en CADA tick via FingerprintNow/computeGate).
+/** Git's textual plumbing is hashed, never streamed to a terminal. Keep its
+ * memory bounded even for hostile repositories; an incomplete listing must
+ * fail recovery rather than certify a partial fingerprint. */
+const MAX_GIT_OUTPUT_BYTES = 16 * 1024 * 1024;
 function git(cwd, args) {
-    return (0, child_process_1.execFileSync)('git', args, { cwd, encoding: 'utf8', maxBuffer: Infinity, stdio: process_1.EXEC_STDIO });
+    try {
+        return (0, child_process_1.execFileSync)('git', args, { cwd, encoding: 'utf8', maxBuffer: MAX_GIT_OUTPUT_BYTES, stdio: process_1.EXEC_STDIO });
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === 'ENOBUFS' || error.message.includes('maxBuffer')) {
+            throw new Error(`git fingerprint output exceeded ${MAX_GIT_OUTPUT_BYTES} bytes`);
+        }
+        throw error;
+    }
+}
+function reconcileUnattendedRecovery(input) {
+    const activeJobIds = [...new Set(input.activeJobIds)].sort();
+    const result = (state, nextAction, diagnostics) => ({ state, nextAction, activeJobIds, diagnostics });
+    if (input.journalCorrupt || input.journal === null)
+        return result('blocked', 'repair-journal', ['journal-corrupt-or-missing']);
+    const binding = input.journal.schema === 2 ? input.journal.planBinding : undefined;
+    if (!binding || binding.path !== input.plan.path || binding.digest !== input.plan.digest || binding.schema !== input.plan.schema || binding.executionMode !== 'desatendido')
+        return result('blocked', 'rebind-plan', ['journal-plan-binding-stale']);
+    if (input.git !== 'current')
+        return result('blocked', 'reconcile-git', ['git-fingerprint-changed']);
+    if (activeJobIds.length > 0)
+        return result('ready', 'reconcile-active-jobs', []);
+    if (input.verdicts !== 'current')
+        return result('blocked', 'repair-verdicts', [`verdicts-${input.verdicts}`]);
+    if (input.tests !== 'pass')
+        return result('blocked', 'run-tests', [`tests-${input.tests}`]);
+    if (input.sensors !== 'pass')
+        return result('blocked', 'run-sensors', [`sensors-${input.sensors}`]);
+    return result('ready', 'select-work', []);
 }
 function resolveWorkingDirectory(repoRoot, cwdRel) {
     if (typeof cwdRel !== 'string' || cwdRel.length === 0)

package/dist/src/core/journal/paths.js

@@ -13,6 +13,7 @@ exports.acksDir = acksDir;
 exports.logsDir = logsDir;
 exports.eventsPath = eventsPath;
 exports.exportDir = exportDir;
+exports.bindingPlanPath = bindingPlanPath;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 function branchSlug(branch) {
@@ -63,3 +64,13 @@ function eventsPath(repoRoot, branch) {
 function exportDir(repoRoot, branch) {
     return path_1.default.join(journalDir(repoRoot, branch), 'export');
 }
+/** A persisted binding path is always a normalized repository-relative POSIX path. */
+function bindingPlanPath(planPath) {
+    if (typeof planPath !== 'string' || planPath.length === 0 || planPath.length > 4096 || /[\u0000-\u001F\u007F-\u009F]/.test(planPath))
+        throw new Error('plan path inválido para binding');
+    const normalized = path_1.default.posix.normalize(planPath.replace(/\\/g, '/'));
+    if (path_1.default.posix.isAbsolute(normalized) || path_1.default.win32.isAbsolute(planPath) || normalized === '..' || normalized.startsWith('../') || normalized === '.') {
+        throw new Error('plan path fuera del repositorio para binding');
+    }
+    return normalized;
+}