agentic-workflow-manager 9.7.1 → 9.8.0

package/dist/src/core/plan/identity.js

@@ -0,0 +1,75 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXECUTION_IDENTITY_SCHEMA = exports.MAX_PLAN_SNAPSHOT_BYTES = void 0;
+exports.normalizedPlanSnapshot = normalizedPlanSnapshot;
+exports.fullPlanDigest = fullPlanDigest;
+exports.executionPlanDigest = executionPlanDigest;
+const crypto_1 = __importDefault(require("crypto"));
+exports.MAX_PLAN_SNAPSHOT_BYTES = 1024 * 1024;
+exports.EXECUTION_IDENTITY_SCHEMA = 'awm-plan-execution/v1';
+const START = '<!-- AWM:COMPACT-SLICES:START v1 -->';
+const END = '<!-- AWM:COMPACT-SLICES:END v1 -->';
+/** Only lifecycle syntax actually emitted by the skills is non-executable.
+ * Unknown metadata, prose, inline comments and code remain identity-bearing. */
+function lifecycleMarker(line) {
+    const match = /^ {0,3}<!-- (awm-(?:qa|docs|retro)-complete)(?:: (\d{4}-\d{2}-\d{2}|Release [A-Za-z0-9][A-Za-z0-9_-]*))? -->$/.exec(line);
+    if (!match)
+        return undefined;
+    const metadata = match[2];
+    if (metadata && !metadata.startsWith('Release ')) {
+        const parsed = new Date(`${metadata}T00:00:00.000Z`);
+        if (!Number.isFinite(parsed.getTime()) || parsed.toISOString().slice(0, 10) !== metadata)
+            return undefined;
+    }
+    return `${match[1]}:${metadata?.startsWith('Release ') ? metadata : ''}`;
+}
+function normalizedPlanSnapshot(text) {
+    if (typeof text !== 'string' || text.length === 0 || Buffer.byteLength(text, 'utf8') > exports.MAX_PLAN_SNAPSHOT_BYTES || text.includes('\0')) {
+        throw new Error('plan snapshot must be nonempty bounded text without NUL');
+    }
+    return text.replace(/\r\n?/g, '\n');
+}
+function fullPlanDigest(text) {
+    return crypto_1.default.createHash('sha256').update(normalizedPlanSnapshot(text), 'utf8').digest('hex');
+}
+/** This versioned identity preserves ALL plan bytes except recognized progress
+ * status bytes and unique standalone lifecycle marker lines outside code/JSON.
+ * It is never a replacement for the full validated-plan digest. */
+function executionPlanDigest(text) {
+    const lines = normalizedPlanSnapshot(text).split('\n');
+    let fence;
+    let manifest = false;
+    const candidates = lines.map(line => {
+        const matched = /^(?: {0,3})(`{3,}|~{3,})(.*)$/.exec(line);
+        const marker = matched?.[1];
+        if (marker && (fence
+            ? marker[0] === fence.character && marker.length >= fence.length && /^[ \t]*$/.test(matched[2])
+            : marker[0] !== '`' || !matched[2].includes('`'))) {
+            fence = fence ? undefined : { character: marker[0], length: marker.length };
+            return { line };
+        }
+        if (fence)
+            return { line };
+        if (line === START) {
+            manifest = true;
+            return { line };
+        }
+        if (line === END) {
+            manifest = false;
+            return { line };
+        }
+        if (manifest)
+            return { line };
+        const lifecycle = lifecycleMarker(line);
+        return { line: line.replace(/^( {0,3}[-*+] +)\[[ xX]\]( +\S.*)$/, '$1[ ]$2'), lifecycle };
+    });
+    const counts = new Map();
+    for (const { lifecycle } of candidates)
+        if (lifecycle)
+            counts.set(lifecycle, (counts.get(lifecycle) ?? 0) + 1);
+    const canonical = candidates.filter(({ lifecycle }) => !lifecycle || counts.get(lifecycle) !== 1).map(({ line }) => line).join('\n');
+    return crypto_1.default.createHash('sha256').update(`${exports.EXECUTION_IDENTITY_SCHEMA}\0`).update(canonical, 'utf8').digest('hex');
+}

package/dist/src/core/plan/validate.js

@@ -3,22 +3,51 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertVerifiedValidPlanReport = assertVerifiedValidPlanReport;
+exports.verifiedPlanSnapshot = verifiedPlanSnapshot;
 exports.validatePlanFile = validatePlanFile;
+exports.validatePlanSnapshot = validatePlanSnapshot;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
+const crypto_1 = __importDefault(require("crypto"));
 const json_1 = require("./json");
+const identity_1 = require("./identity");
 const START = '<!-- AWM:COMPACT-SLICES:START v1 -->';
 const END = '<!-- AWM:COMPACT-SLICES:END v1 -->';
 const MAX_PLAN = 1024 * 1024;
 const MAX_MANIFEST = 256 * 1024;
 const MAX_SOURCE = 1024 * 1024;
 const MAX_STRING = 4096;
-const ID = /^[A-Z][A-Z0-9-]{0,63}$/;
+const ENTITY_ID = /^[A-Z][A-Z0-9-]{0,63}$/;
+const REQUIREMENT_ID = /^[A-Z][A-Z0-9]*(?:-[A-Z0-9]+)*(?:\.[A-Z0-9]+(?:-[A-Z0-9]+)*)*$/;
 const PLAN_ID = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 const SHELL = new Set([
     'sh', 'bash', 'zsh', 'dash', 'ksh', 'fish', 'cmd', 'powershell', 'pwsh',
     'env', 'busybox', 'node', 'nodejs', 'deno', 'bun', 'python', 'python3', 'ruby', 'perl', 'php', 'lua',
 ]);
+const verifiedValidReports = new WeakSet();
+const verifiedSnapshots = new WeakMap();
+function freezeJson(value) {
+    if (value === null || typeof value !== 'object')
+        return;
+    for (const child of Object.values(value))
+        freezeJson(child);
+    Object.freeze(value);
+}
+/** Require a process-local, immutable report issued by successful core validation. */
+function assertVerifiedValidPlanReport(report) {
+    if (!report || typeof report !== 'object' || report.state !== 'valid' || !verifiedValidReports.has(report)) {
+        throw new Error('plan validator returned an invalid valid report');
+    }
+}
+/** The exact immutable validator snapshot, never a later reopen of the path. */
+function verifiedPlanSnapshot(report) {
+    assertVerifiedValidPlanReport(report);
+    const snapshot = verifiedSnapshots.get(report);
+    if (snapshot === undefined)
+        throw new Error('verified plan snapshot unavailable');
+    return snapshot;
+}
 function isLauncher(program) {
     const base = path_1.default.posix.basename(program).toLowerCase();
     return SHELL.has(base.replace(/\.exe$/, '')) || /^(?:node(?:js)?|py(?:thon(?:w)?\d*(?:\.\d+)?)?|deno|bun|ruby(?:\d+(?:\.\d+)*)?|perl(?:\d+(?:\.\d+)*)?|(?:a|ba|c|tc|z|da|k)?sh|busybox|cmd|powershell|pwsh|wscript|cscript)(?:\.exe)?(?:[-.][a-z0-9][a-z0-9.-]*)?$/i.test(base);
@@ -37,39 +66,49 @@ function schemaClassification(candidate) {
     return diagnostic('PLAN_MARKERS', 'compact markers must occur once in order');
 }
 function embeddedJsonObjects(text) {
-    const objects = [];
-    for (let start = 0; start < text.length && objects.length < 64; start += 1) {
-        if (text[start] !== '{')
-            continue;
-        let depth = 0;
-        let quoted = false;
-        let escaped = false;
-        let end = start;
-        for (; end < text.length && end - start <= MAX_MANIFEST; end += 1) {
-            const character = text[end];
-            if (quoted) {
-                if (escaped)
-                    escaped = false;
-                else if (character === '\\')
-                    escaped = true;
-                else if (character === '"')
-                    quoted = false;
-                continue;
-            }
-            if (character === '"') {
-                quoted = true;
-                continue;
-            }
+    const outer = [];
+    const nested = [];
+    const starts = [];
+    let quoted = false;
+    let escaped = false;
+    for (let index = 0; index < text.length; index += 1) {
+        const character = text[index];
+        if (starts.length === 0) {
             if (character === '{')
-                depth += 1;
-            if (character === '}' && --depth === 0) {
-                objects.push(text.slice(start, end + 1));
-                start = end;
-                break;
+                starts.push(index);
+            continue;
+        }
+        if (quoted) {
+            if (character === '\n') {
+                quoted = false;
+                escaped = false;
             }
+            else if (escaped)
+                escaped = false;
+            else if (character === '\\')
+                escaped = true;
+            else if (character === '"')
+                quoted = false;
+            continue;
+        }
+        if (character === '"') {
+            quoted = true;
+            continue;
+        }
+        if (character === '{') {
+            starts.push(index);
+            continue;
         }
+        if (character !== '}')
+            continue;
+        const start = starts.pop();
+        if (start === undefined || index - start > MAX_MANIFEST)
+            continue;
+        const found = starts.length === 0 ? outer : nested;
+        if (found.length < 64)
+            found.push(text.slice(start, index + 1));
     }
-    return objects;
+    return [...outer, ...nested].slice(0, 64);
 }
 function markerlessSchemaClassification(text) {
     const candidates = [text.trim(), ...embeddedJsonObjects(text)];
@@ -123,11 +162,18 @@ function compactSchemaSignal(text) {
     }
     return false;
 }
+function executionModeFromValidatedText(text) {
+    const raw = /^\s*\*\*Modo de ejecución:\*\*\s*([^\r\n]+)\s*$/mi.exec(text)?.[1]?.trim().replace(/^`|`$/g, '');
+    return raw === 'desatendido' ? 'desatendido' : 'interactivo';
+}
 function exact(value, fields) {
     return object(value) && Object.keys(value).length === fields.length && fields.every((field) => Object.prototype.hasOwnProperty.call(value, field));
 }
 function allStrings(value, max = MAX_STRING) { return Array.isArray(value) && value.every((item) => typeof item === 'string' && Buffer.byteLength(item, 'utf8') <= max); }
-function validId(value) { return typeof value === 'string' && ID.test(value); }
+function validId(value) { return typeof value === 'string' && ENTITY_ID.test(value); }
+function validRequirementId(value) {
+    return typeof value === 'string' && Buffer.byteLength(value, 'utf8') <= 64 && REQUIREMENT_ID.test(value);
+}
 function inside(root, candidate) { const relative = path_1.default.relative(root, candidate); return relative === '' || (!relative.startsWith(`..${path_1.default.sep}`) && relative !== '..' && !path_1.default.isAbsolute(relative)); }
 function validRelative(value) {
     return typeof value === 'string' && value.length > 0 && Buffer.byteLength(value, 'utf8') <= MAX_STRING && !path_1.default.isAbsolute(value) && !path_1.default.win32.isAbsolute(value) && !value.includes('\\') && value.split('/').every((part) => part !== '' && part !== '.' && part !== '..') && path_1.default.posix.normalize(value) === value;
@@ -140,30 +186,74 @@ function regularInside(root, relative) {
         return undefined;
     const parts = relative.split('/');
     let current = root;
+    let stat;
     try {
         for (const part of parts) {
             current = path_1.default.join(current, part);
-            if (fs_1.default.lstatSync(current).isSymbolicLink())
+            stat = fs_1.default.lstatSync(current, { bigint: true });
+            if (stat.isSymbolicLink())
                 return undefined;
         }
-        if (!fs_1.default.lstatSync(candidate).isFile())
+        if (!stat?.isFile())
             return undefined;
         const real = fs_1.default.realpathSync(candidate);
-        return inside(root, real) ? real : undefined;
+        return inside(root, real) ? { path: real, stat } : undefined;
     }
     catch {
         return undefined;
     }
 }
-function executableInside(root, relative) {
-    const file = regularInside(root, relative);
+function sameIdentity(inspected, opened) {
+    return typeof inspected.dev === 'bigint' && typeof inspected.ino === 'bigint' && inspected.ino !== 0n
+        && opened.isFile() && inspected.dev === opened.dev && inspected.ino === opened.ino;
+}
+function readInspected(file, max) {
+    if (file.stat.size > BigInt(max))
+        return { state: 'limit' };
+    let descriptor;
     try {
-        return file && (process.platform === 'win32' ? /\.(?:exe|cmd|bat)$/i.test(file) : (fs_1.default.statSync(file).mode & 0o111) !== 0) ? file : undefined;
+        descriptor = fs_1.default.openSync(file.path, fs_1.default.constants.O_RDONLY | (fs_1.default.constants.O_NOFOLLOW ?? 0));
+        const opened = fs_1.default.fstatSync(descriptor, { bigint: true });
+        if (!sameIdentity(file.stat, opened))
+            return { state: 'unsafe' };
+        if (opened.size > BigInt(max))
+            return { state: 'limit' };
+        if (opened.size !== file.stat.size)
+            return { state: 'unsafe' };
+        const bytes = Buffer.alloc(Number(opened.size));
+        let offset = 0;
+        while (offset < bytes.length) {
+            const read = fs_1.default.readSync(descriptor, bytes, offset, bytes.length - offset, offset);
+            if (read <= 0)
+                return { state: 'read' };
+            offset += read;
+        }
+        const after = fs_1.default.fstatSync(descriptor, { bigint: true });
+        if (!sameIdentity(file.stat, after))
+            return { state: 'unsafe' };
+        if (after.size > BigInt(max) || bytes.length > max)
+            return { state: 'limit' };
+        if (after.size !== opened.size)
+            return { state: 'unsafe' };
+        return { state: 'ok', bytes };
     }
-    catch {
-        return undefined;
+    catch (error) {
+        const code = error.code;
+        return { state: code === 'ELOOP' || code === 'ENOENT' || code === 'ENOTDIR' ? 'unsafe' : 'read' };
+    }
+    finally {
+        if (descriptor !== undefined) {
+            try {
+                fs_1.default.closeSync(descriptor);
+            }
+            catch { /* best-effort close after a failed inspected read */ }
+        }
     }
 }
+function executableInside(root, relative) {
+    const file = regularInside(root, relative);
+    return file && (process.platform === 'win32' ? /\.(?:exe|cmd|bat)$/i.test(file.path) : (file.stat.mode & 73n) !== 0n) ? file.path : undefined;
+}
 function refs(value, known) { return allStrings(value) && value.every((id) => known.has(id)); }
 function uniqueRefs(value, known) { return refs(value, known) && new Set(value).size === value.length; }
 function unsafeCommand(value) { return /[\0\r\n]|[`$]|\$\(|\$\{|[;&|<>*?\[\]{}()]/.test(value); }
@@ -219,8 +309,8 @@ function checkMarkdown(text, slices) {
     }
     return undefined;
 }
-/** Read-only validator for a bounded compact-slices/v1 Markdown plan. */
-function validatePlanFile(planPath, cwd = process.cwd()) {
+/** Shared parser. A supplied snapshot is already descriptor-anchored by its caller. */
+function validatePlan(planPath, cwd, snapshot) {
     if (typeof planPath !== 'string' || planPath.length === 0)
         throw new Error('planPath must be a non-empty path');
     if (typeof cwd !== 'string' || cwd.length === 0)
@@ -238,21 +328,28 @@ function validatePlanFile(planPath, cwd = process.cwd()) {
     if (!inside(root, candidate))
         return diagnostic('PLAN_PATH_UNSAFE', 'plan path must be inside cwd');
     const relativePlan = path_1.default.relative(root, candidate).replace(/\\/g, '/');
-    const planFile = regularInside(root, relativePlan);
-    if (!planFile)
-        return diagnostic('PLAN_PATH_UNSAFE', 'plan path must be a contained regular non-symlink file');
     let bytes;
-    try {
-        if (fs_1.default.statSync(planFile).size > MAX_PLAN)
+    if (snapshot) {
+        if (snapshot.length > MAX_PLAN)
             return diagnostic('PLAN_LIMIT', 'plan exceeds maximum size');
-        bytes = fs_1.default.readFileSync(planFile);
+        bytes = Buffer.from(snapshot);
     }
-    catch {
-        return diagnostic('PLAN_READ', 'plan cannot be read');
+    else {
+        const planFile = regularInside(root, relativePlan);
+        if (!planFile)
+            return diagnostic('PLAN_PATH_UNSAFE', 'plan path must be a contained regular non-symlink file');
+        const planRead = readInspected(planFile, MAX_PLAN);
+        if (planRead.state === 'unsafe')
+            return diagnostic('PLAN_PATH_UNSAFE', 'plan path changed after inspection');
+        if (planRead.state === 'limit')
+            return diagnostic('PLAN_LIMIT', 'plan exceeds maximum size');
+        if (planRead.state === 'read')
+            return diagnostic('PLAN_READ', 'plan cannot be read');
+        bytes = planRead.bytes;
     }
     let text;
     try {
-        text = normalizeLineEndings(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        text = normalizeLineEndings(new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes));
     }
     catch {
         return diagnostic('PLAN_ENCODING', 'plan must be valid UTF-8');
@@ -261,7 +358,7 @@ function validatePlanFile(planPath, cwd = process.cwd()) {
     const ends = count(text, END);
     const signaled = starts > 0 || ends > 0 || compactSchemaSignal(text);
     if (!signaled)
-        return markerlessSchemaClassification(text) ?? { state: 'legacy' };
+        return markerlessSchemaClassification(text) ?? { state: 'migration-required', reason: 'unmarked-plan' };
     if (starts === 0 && ends === 0)
         return markerlessSchemaClassification(text) ?? diagnostic('PLAN_MARKERS', 'compact markers must occur once in order');
     if (starts !== 1 || ends !== 1 || text.indexOf(START) > text.indexOf(END)) {
@@ -300,7 +397,7 @@ function validatePlanFile(planPath, cwd = process.cwd()) {
         return diagnostic('PLAN_LIMIT', 'plan id exceeds maximum string size');
     if (raw.schema !== 'compact-slices/v1' || typeof raw.planId !== 'string' || !PLAN_ID.test(raw.planId) || !allStrings(raw.requirements) || new Set(raw.requirements).size !== raw.requirements.length)
         return diagnostic('PLAN_SHAPE', 'manifest scalar fields are invalid');
-    if (raw.requirements.some((id) => !ID.test(id)) || !allStrings(raw.closureCommands) || new Set(raw.closureCommands).size !== raw.closureCommands.length)
+    if (raw.requirements.some((id) => !validRequirementId(id)) || !allStrings(raw.closureCommands) || new Set(raw.closureCommands).size !== raw.closureCommands.length)
         return diagnostic('PLAN_SHAPE', 'manifest arrays or identifiers are invalid');
     const sourceIds = new Set();
     for (const source of raw.sources) {
@@ -310,18 +407,16 @@ function validatePlanFile(planPath, cwd = process.cwd()) {
         const file = regularInside(root, source.path);
         if (!file)
             return diagnostic('PLAN_SOURCE_UNSAFE', 'source path must be a contained regular non-symlink file');
-        let bytes;
-        try {
-            if (fs_1.default.statSync(file).size > MAX_SOURCE)
-                return diagnostic('PLAN_SOURCE_LIMIT', 'source exceeds maximum size');
-            bytes = fs_1.default.readFileSync(file);
-        }
-        catch {
+        const sourceRead = readInspected(file, MAX_SOURCE);
+        if (sourceRead.state === 'unsafe')
+            return diagnostic('PLAN_SOURCE_UNSAFE', 'source path changed after inspection');
+        if (sourceRead.state === 'limit')
+            return diagnostic('PLAN_SOURCE_LIMIT', 'source exceeds maximum size');
+        if (sourceRead.state === 'read')
             return diagnostic('PLAN_SOURCE_UNSAFE', 'source cannot be read');
-        }
         let contents;
         try {
-            contents = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+            contents = new TextDecoder('utf-8', { fatal: true }).decode(sourceRead.bytes);
         }
         catch {
             return diagnostic('PLAN_SOURCE_ENCODING', 'source must be valid UTF-8');
@@ -332,7 +427,7 @@ function validatePlanFile(planPath, cwd = process.cwd()) {
     const commandIds = new Set();
     const closureIds = new Set(raw.closureCommands);
     for (const command of raw.commands) {
-        if (!exact(command, ['id', 'program', 'args', 'covers']) || !validId(command.id) || commandIds.has(command.id) || typeof command.program !== 'string' || command.program.length === 0 || Buffer.byteLength(command.program, 'utf8') > MAX_STRING || !allStrings(command.args) || command.args.length > 128 || !allStrings(command.covers) || new Set(command.covers).size !== command.covers.length || (command.covers.length === 0 && !closureIds.has(command.id)) || command.covers.some((id) => !raw.requirements.includes(id)))
+        if (!exact(command, ['id', 'program', 'args', 'covers']) || !validId(command.id) || commandIds.has(command.id) || typeof command.program !== 'string' || command.program.length === 0 || Buffer.byteLength(command.program, 'utf8') > MAX_STRING || !allStrings(command.args) || command.args.length > 128 || !allStrings(command.covers) || new Set(command.covers).size !== command.covers.length || (command.covers.length === 0 && !closureIds.has(command.id)) || command.covers.some((id) => !validRequirementId(id) || !raw.requirements.includes(id)))
             return diagnostic('PLAN_COMMAND_SHAPE', 'command fields are invalid');
         commandIds.add(command.id);
         const program = command.program;
@@ -344,7 +439,7 @@ function validatePlanFile(planPath, cwd = process.cwd()) {
     const sliceIds = new Set();
     const owners = new Map();
     for (const slice of raw.slices) {
-        if (!exact(slice, ['id', 'title', 'requirements', 'dependsOn', 'sectionAnchor', 'sources', 'redCommands', 'greenCommands', 'reviewEvidence', 'risk', 'fallback']) || !validId(slice.id) || sliceIds.has(slice.id) || typeof slice.title !== 'string' || slice.title.length === 0 || Buffer.byteLength(slice.title, 'utf8') > MAX_STRING || !allStrings(slice.requirements) || slice.requirements.length === 0 || slice.requirements.some((id) => !raw.requirements.includes(id)) || !allStrings(slice.dependsOn) || typeof slice.sectionAnchor !== 'string' || slice.sectionAnchor.length === 0 || Buffer.byteLength(slice.sectionAnchor, 'utf8') > MAX_STRING || !uniqueRefs(slice.sources, sourceIds) || !uniqueRefs(slice.redCommands, commandIds) || slice.redCommands.length === 0 || !uniqueRefs(slice.greenCommands, commandIds) || slice.greenCommands.length === 0 || !allStrings(slice.fallback) || slice.fallback.length === 0 || slice.fallback.some((item) => item.trim().length === 0) || slice.risk !== 'bounded' && slice.risk !== 'full-context')
+        if (!exact(slice, ['id', 'title', 'requirements', 'dependsOn', 'sectionAnchor', 'sources', 'redCommands', 'greenCommands', 'reviewEvidence', 'risk', 'fallback']) || !validId(slice.id) || sliceIds.has(slice.id) || typeof slice.title !== 'string' || slice.title.length === 0 || Buffer.byteLength(slice.title, 'utf8') > MAX_STRING || !allStrings(slice.requirements) || slice.requirements.length === 0 || slice.requirements.some((id) => !validRequirementId(id) || !raw.requirements.includes(id)) || !allStrings(slice.dependsOn) || typeof slice.sectionAnchor !== 'string' || slice.sectionAnchor.length === 0 || Buffer.byteLength(slice.sectionAnchor, 'utf8') > MAX_STRING || !uniqueRefs(slice.sources, sourceIds) || !uniqueRefs(slice.redCommands, commandIds) || slice.redCommands.length === 0 || !uniqueRefs(slice.greenCommands, commandIds) || slice.greenCommands.length === 0 || !allStrings(slice.fallback) || slice.fallback.length === 0 || slice.fallback.some((item) => item.trim().length === 0) || slice.risk !== 'bounded' && slice.risk !== 'full-context')
             return diagnostic('PLAN_SLICE_SHAPE', 'slice fields are invalid');
         sliceIds.add(slice.id);
         if (!Array.isArray(slice.reviewEvidence) || slice.reviewEvidence.length !== 2 || new Set(slice.reviewEvidence).size !== 2 || !slice.reviewEvidence.includes('specification') || !slice.reviewEvidence.includes('code-quality'))
@@ -389,5 +484,24 @@ function validatePlanFile(planPath, cwd = process.cwd()) {
     const markdown = checkMarkdown(text, slices);
     if (markdown)
         return markdown;
-    return { state: 'valid', schema: 'compact-slices/v1', manifest: raw };
+    const report = {
+        state: 'valid', schema: 'compact-slices/v1',
+        planDigest: crypto_1.default.createHash('sha256').update(text, 'utf8').digest('hex'),
+        executionDigest: (0, identity_1.executionPlanDigest)(text),
+        manifest: raw, executionMode: executionModeFromValidatedText(text),
+    };
+    freezeJson(report);
+    verifiedValidReports.add(report);
+    verifiedSnapshots.set(report, text);
+    return report;
+}
+/** Read-only validator for a bounded compact-slices/v1 Markdown plan. */
+function validatePlanFile(planPath, cwd = process.cwd()) {
+    return validatePlan(planPath, cwd);
+}
+/** Validate an already-authenticated plan snapshot without reopening planPath. */
+function validatePlanSnapshot(planPath, cwd, text) {
+    if (typeof text !== 'string')
+        throw new Error('plan snapshot must be text');
+    return validatePlan(planPath, cwd, Buffer.from(text, 'utf8'));
 }

package/dist/tests/commands/job/exec-wrapper.test.js

@@ -17,6 +17,22 @@ describe('exec-wrapper', () => {
     let dir;
     beforeEach(() => { dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-wrap-')); });
     afterEach(() => { fs_1.default.rmSync(dir, { recursive: true, force: true }); });
+    test.each(['../escape', '..\\escape', '/escape', 'C:\\escape', '', '.', '..', 'sentinel\n', 'x'.repeat(129)])('rejects unsafe sidecar components before writes (%#)', async (value) => {
+        for (const helper of [exec_wrapper_1.claimPath, exec_wrapper_1.identityPath, exec_wrapper_1.resultPath, exec_wrapper_1.logPath, exec_wrapper_1.replayVerdict]) {
+            expect(() => helper(dir, value, 'nonce')).toThrow(/sidecar/);
+            expect(() => helper(dir, 'job', value)).toThrow(/sidecar/);
+        }
+        await expect((0, exec_wrapper_1.runExecWrapper)({ logsRoot: path_1.default.join(dir, 'unused'), jobId: value, nonce: 'nonce', argv: ['node', '-e', 'process.exit(0)'], cwd: '.' })).rejects.toThrow(/sidecar/);
+        expect(fs_1.default.readdirSync(dir)).toEqual([]);
+    });
+    test.each([
+        { argv: ['node'], cwd: '../escape' },
+        { argv: [undefined], cwd: '.' },
+        { argv: ['node', 'sentinel\u0000'], cwd: '.' },
+    ])('rejects invalid execution inputs before sidecar writes (%#)', async (inputs) => {
+        await expect((0, exec_wrapper_1.runExecWrapper)({ logsRoot: path_1.default.join(dir, 'unused'), jobId: 'job', nonce: 'nonce', repoRoot: dir, ...inputs })).rejects.toThrow();
+        expect(fs_1.default.readdirSync(dir)).toEqual([]);
+    });
     test('claim + identity sidecar + resultado terminal atomico (R1.8)', async () => {
         const out = await (0, exec_wrapper_1.runExecWrapper)({ logsRoot: dir, jobId: 'job1', nonce: 'nonceA', argv: ['node', '-e', 'setTimeout(()=>process.exit(0), 300)'], cwd: '.' });
         expect(out.exitCode).toBe(0);

package/dist/tests/commands/job/gate-reconcile.test.js

@@ -13,6 +13,8 @@ const reconcile_1 = require("../../../src/commands/job/reconcile");
 const reap_1 = require("../../../src/commands/job/reap");
 const job_1 = require("../../../src/commands/job");
 const watch_1 = require("../../../src/commands/watch");
+const init_1 = require("../../../src/commands/watch/init");
+const validate_1 = require("../../../src/core/plan/validate");
 const types_1 = require("../../../src/core/journal/types");
 const store_1 = require("../../../src/core/journal/store");
 const descriptor_1 = require("../../../src/core/tracks/descriptor");
@@ -501,6 +503,16 @@ function trackRefFixture(overrides, worktreePath) {
 function descriptorFixture(overrides, planRoot) {
     return { schema: 1, planRoot, planBranch: 'main', trackId: 'cli', planJournalId: 'j-1', fencingToken: 'f'.repeat(32), ...overrides };
 }
+function initCompactJournal(repo, branch) {
+    const planPath = path_1.default.join(repo, 'plans', 'fixture.md');
+    fs_1.default.mkdirSync(path_1.default.dirname(planPath), { recursive: true });
+    fs_1.default.writeFileSync(planPath, fs_1.default.readFileSync(path_1.default.join(__dirname, '../../core/plan/fixtures/compact-slices-v1/valid.md'), 'utf8'));
+    fs_1.default.writeFileSync(path_1.default.join(repo, 'source.md'), '## Canonical source\nfixture source\n');
+    const report = (0, validate_1.validatePlanFile)('plans/fixture.md', repo);
+    if (report.state !== 'valid')
+        throw new Error(`compact fixture must validate: ${JSON.stringify(report)}`);
+    (0, init_1.initWatch)(repo, branch, { path: 'plans/fixture.md', report });
+}
 async function runCommand(register, argv, cwd) {
     const prog = new commander_1.Command();
     prog.exitOverride();
@@ -543,12 +555,12 @@ describe('guard de contexto en awm job / awm watch (R9.4)', () => {
         gitInitAt(planRoot, 'main');
         gitInitAt(trackRoot, 'track/cli');
         gitInitAt(otherRoot, 'track/cli');
-        (0, store_1.initJournal)(planRoot, 'main');
+        initCompactJournal(planRoot, 'main');
         const planState = (0, store_1.readJournal)(planRoot, 'main').state;
         planState.journalId = 'j-1';
         planState.tracks = [trackRefFixture({ fencingToken: 'f'.repeat(32) }, trackRoot)];
         (0, store_1.writeJournal)(planRoot, 'main', planState);
-        (0, store_1.initJournal)(trackRoot, 'track/cli');
+        initCompactJournal(trackRoot, 'track/cli');
         const trackState = (0, store_1.readJournal)(trackRoot, 'track/cli').state;
         trackState.trackContext = { trackId: 'cli', taskIds: [], planDigest: 'x', baseSha: 'y', planJournalId: 'j-1' };
         (0, store_1.writeJournal)(trackRoot, 'track/cli', trackState);
@@ -556,7 +568,7 @@ describe('guard de contexto en awm job / awm watch (R9.4)', () => {
         // otherRoot: mismo descriptor (mismo plan/trackId/fencing) pero NO es
         // el worktree que el TrackRef del plan declara — su realpath jamas
         // puede autenticar (R9.4), aunque el resto del descriptor "calce".
-        (0, store_1.initJournal)(otherRoot, 'track/cli');
+        initCompactJournal(otherRoot, 'track/cli');
         const otherState = (0, store_1.readJournal)(otherRoot, 'track/cli').state;
         otherState.trackContext = { trackId: 'cli', taskIds: [], planDigest: 'x', baseSha: 'y', planJournalId: 'j-1' };
         (0, store_1.writeJournal)(otherRoot, 'track/cli', otherState);
@@ -580,24 +592,26 @@ describe('guard de contexto en awm job / awm watch (R9.4)', () => {
         expect(exitCode).toBe(1);
         expect(JSON.parse(out).pass).toBe(false);
     });
-    test('`watch --init` desde un cwd SIN descriptor (repo comun, sin tracks) procede exactamente como antes de esta task', async () => {
+    test('`watch --init --plan` desde un cwd SIN descriptor crea un binding compacto', async () => {
         const plainRepo = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-guard-plain-'));
         try {
             gitInitAt(plainRepo, 'main');
-            const { out, err, exitCode } = await runWatch(['--init'], plainRepo);
+            const planPath = path_1.default.join(plainRepo, 'plans', 'fixture.md');
+            fs_1.default.mkdirSync(path_1.default.dirname(planPath), { recursive: true });
+            fs_1.default.writeFileSync(planPath, fs_1.default.readFileSync(path_1.default.join(__dirname, '../../core/plan/fixtures/compact-slices-v1/valid.md'), 'utf8'));
+            fs_1.default.writeFileSync(path_1.default.join(plainRepo, 'source.md'), '## Canonical source\nfixture source\n');
+            const { out, err, exitCode } = await runWatch(['--init', '--plan', 'plans/fixture.md'], plainRepo);
             expect(exitCode).toBeNull();
             expect(err).toBe('');
             expect(out).toContain('journal inicializado');
+            expect((0, store_1.readJournal)(plainRepo, 'main').state).toMatchObject({ schema: 2, planBinding: { path: 'plans/fixture.md', executionMode: 'desatendido' } });
         }
         finally {
             fs_1.default.rmSync(plainRepo, { recursive: true, force: true });
         }
     });
-    test('`watch --init` desde el cwd autenticado (trackRoot) procede con normalidad', async () => {
-        const { out, err, exitCode } = await runWatch(['--init'], trackRoot);
-        expect(err).not.toContain('cwd no autenticado');
-        expect(exitCode).toBeNull();
-        expect(out).toContain('journal inicializado');
+    test('`watch --init --plan` desde el cwd autenticado alcanza la guarda de lifecycle y rechaza sobrescribir el binding', async () => {
+        await expect(runWatch(['--init', '--plan', 'plans/fixture.md'], trackRoot)).rejects.toThrow(/overwrite|sobrescribir/i);
     });
     test('`watch --init` desde un cwd cuyo descriptor no autentica rechaza con "cwd no autenticado"', async () => {
         const { err, exitCode } = await runWatch(['--init'], otherRoot);

package/dist/tests/commands/pin.test.js

@@ -7,30 +7,30 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
+let tmpHome;
+let originalHome;
+let originalAwmHome;
+beforeEach(() => {
+    tmpHome = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pin-home-'));
+    originalHome = process.env.HOME;
+    originalAwmHome = process.env.AWM_HOME;
+    process.env.HOME = tmpHome;
+    process.env.AWM_HOME = path_1.default.join(tmpHome, '.awm');
+    jest.resetModules();
+});
+afterEach(() => {
+    fs_1.default.rmSync(tmpHome, { recursive: true, force: true });
+    if (originalHome === undefined)
+        delete process.env.HOME;
+    else
+        process.env.HOME = originalHome;
+    if (originalAwmHome === undefined)
+        delete process.env.AWM_HOME;
+    else
+        process.env.AWM_HOME = originalAwmHome;
+});
+const readPrefs = () => JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpHome, '.awm/preferences.json'), 'utf-8'));
 describe('pin/unpin (editores de preferences)', () => {
-    let tmpHome;
-    let originalHome;
-    let originalAwmHome;
-    beforeEach(() => {
-        tmpHome = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pin-home-'));
-        originalHome = process.env.HOME;
-        originalAwmHome = process.env.AWM_HOME;
-        process.env.HOME = tmpHome;
-        process.env.AWM_HOME = path_1.default.join(tmpHome, '.awm');
-        jest.resetModules();
-    });
-    afterEach(() => {
-        fs_1.default.rmSync(tmpHome, { recursive: true, force: true });
-        if (originalHome === undefined)
-            delete process.env.HOME;
-        else
-            process.env.HOME = originalHome;
-        if (originalAwmHome === undefined)
-            delete process.env.AWM_HOME;
-        else
-            process.env.AWM_HOME = originalAwmHome;
-    });
-    const readPrefs = () => JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpHome, '.awm/preferences.json'), 'utf-8'));
     it('setPin escribe pins.base normalizado (acepta prefijo v)', () => {
         const { setPin } = require('../../src/commands/pin');
         setPin('base', 'v1.2.0');