agentic-workflow-manager 9.7.1 → 9.9.0

package/dist/tests/commands/job/gate-reconcile.test.js

@@ -13,6 +13,8 @@ const reconcile_1 = require("../../../src/commands/job/reconcile");
 const reap_1 = require("../../../src/commands/job/reap");
 const job_1 = require("../../../src/commands/job");
 const watch_1 = require("../../../src/commands/watch");
+const init_1 = require("../../../src/commands/watch/init");
+const validate_1 = require("../../../src/core/plan/validate");
 const types_1 = require("../../../src/core/journal/types");
 const store_1 = require("../../../src/core/journal/store");
 const descriptor_1 = require("../../../src/core/tracks/descriptor");
@@ -53,6 +55,22 @@ function passingState() {
     return s;
 }
 describe('gate', () => {
+    test('un verdict routed exige intento observado, identidad y fingerprint coincidentes', () => {
+        const s = passingState();
+        s.verdicts[0] = { ...s.verdicts[0], routingAttemptId: 'route-1' };
+        let gate = (0, gate_1.computeGate)(s, false, fpCurrent);
+        expect(gate.reasons.some((reason) => reason.category === 'routing-evidence')).toBe(true);
+        s.routingAttempts = [{
+                schema: 'routing-attempt/v1', id: 'route-1', obligationId: 'o-spec', lineageId: 'lineage-1', attempt: 1,
+                envelope: { schema: 'routing-envelope/v1', runtime: { target: 'codex', kind: 'native', version: '1', accountScopeDigest: '0'.repeat(64) }, role: 'specification-reviewer', requestedProfile: 'full', effectiveProfile: 'full', resolved: { selector: { kind: 'model', id: 'm' }, effort: { kind: 'explicit', value: 'high' } }, outcome: 'native', unavailableEvidence: [], policyDigest: 'a'.repeat(64), capabilityDigest: 'b'.repeat(64), planDigest: 'c'.repeat(64), executionDigest: 'd'.repeat(64) },
+                envelopeDigest: 'a'.repeat(64), fingerprint: 'fp', state: 'active', nativeAgentId: 'native-1', observed: { selector: { kind: 'model', id: 'm' }, effort: { kind: 'explicit', value: 'high' } },
+            }];
+        s.planBinding = { path: 'plan.md', digest: 'c'.repeat(64), executionDigest: 'd'.repeat(64), executionIdentitySchema: 'awm-plan-execution/v1', schema: 'compact-slices/v2', executionMode: 'desatendido', boundAt: 'now' };
+        expect((0, gate_1.computeGate)(s, false, fpCurrent).pass).toBe(true);
+        s.routingAttempts[0].fingerprint = 'different';
+        gate = (0, gate_1.computeGate)(s, false, fpCurrent);
+        expect(gate.reasons.some((reason) => reason.category === 'routing-evidence')).toBe(true);
+    });
     test('el estado de referencia pasa; la corrupcion bloquea (R3.2)', () => {
         expect((0, gate_1.computeGate)(passingState(), false, fpCurrent).pass).toBe(true);
         const g = (0, gate_1.computeGate)(null, true, fpCurrent);
@@ -501,6 +519,16 @@ function trackRefFixture(overrides, worktreePath) {
 function descriptorFixture(overrides, planRoot) {
     return { schema: 1, planRoot, planBranch: 'main', trackId: 'cli', planJournalId: 'j-1', fencingToken: 'f'.repeat(32), ...overrides };
 }
+function initCompactJournal(repo, branch) {
+    const planPath = path_1.default.join(repo, 'plans', 'fixture.md');
+    fs_1.default.mkdirSync(path_1.default.dirname(planPath), { recursive: true });
+    fs_1.default.writeFileSync(planPath, fs_1.default.readFileSync(path_1.default.join(__dirname, '../../core/plan/fixtures/compact-slices-v1/valid.md'), 'utf8'));
+    fs_1.default.writeFileSync(path_1.default.join(repo, 'source.md'), '## Canonical source\nfixture source\n');
+    const report = (0, validate_1.validatePlanFile)('plans/fixture.md', repo);
+    if (report.state !== 'valid')
+        throw new Error(`compact fixture must validate: ${JSON.stringify(report)}`);
+    (0, init_1.initWatch)(repo, branch, { path: 'plans/fixture.md', report });
+}
 async function runCommand(register, argv, cwd) {
     const prog = new commander_1.Command();
     prog.exitOverride();
@@ -543,12 +571,12 @@ describe('guard de contexto en awm job / awm watch (R9.4)', () => {
         gitInitAt(planRoot, 'main');
         gitInitAt(trackRoot, 'track/cli');
         gitInitAt(otherRoot, 'track/cli');
-        (0, store_1.initJournal)(planRoot, 'main');
+        initCompactJournal(planRoot, 'main');
         const planState = (0, store_1.readJournal)(planRoot, 'main').state;
         planState.journalId = 'j-1';
         planState.tracks = [trackRefFixture({ fencingToken: 'f'.repeat(32) }, trackRoot)];
         (0, store_1.writeJournal)(planRoot, 'main', planState);
-        (0, store_1.initJournal)(trackRoot, 'track/cli');
+        initCompactJournal(trackRoot, 'track/cli');
         const trackState = (0, store_1.readJournal)(trackRoot, 'track/cli').state;
         trackState.trackContext = { trackId: 'cli', taskIds: [], planDigest: 'x', baseSha: 'y', planJournalId: 'j-1' };
         (0, store_1.writeJournal)(trackRoot, 'track/cli', trackState);
@@ -556,7 +584,7 @@ describe('guard de contexto en awm job / awm watch (R9.4)', () => {
         // otherRoot: mismo descriptor (mismo plan/trackId/fencing) pero NO es
         // el worktree que el TrackRef del plan declara — su realpath jamas
         // puede autenticar (R9.4), aunque el resto del descriptor "calce".
-        (0, store_1.initJournal)(otherRoot, 'track/cli');
+        initCompactJournal(otherRoot, 'track/cli');
         const otherState = (0, store_1.readJournal)(otherRoot, 'track/cli').state;
         otherState.trackContext = { trackId: 'cli', taskIds: [], planDigest: 'x', baseSha: 'y', planJournalId: 'j-1' };
         (0, store_1.writeJournal)(otherRoot, 'track/cli', otherState);
@@ -580,24 +608,26 @@ describe('guard de contexto en awm job / awm watch (R9.4)', () => {
         expect(exitCode).toBe(1);
         expect(JSON.parse(out).pass).toBe(false);
     });
-    test('`watch --init` desde un cwd SIN descriptor (repo comun, sin tracks) procede exactamente como antes de esta task', async () => {
+    test('`watch --init --plan` desde un cwd SIN descriptor crea un binding compacto', async () => {
         const plainRepo = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-guard-plain-'));
         try {
             gitInitAt(plainRepo, 'main');
-            const { out, err, exitCode } = await runWatch(['--init'], plainRepo);
+            const planPath = path_1.default.join(plainRepo, 'plans', 'fixture.md');
+            fs_1.default.mkdirSync(path_1.default.dirname(planPath), { recursive: true });
+            fs_1.default.writeFileSync(planPath, fs_1.default.readFileSync(path_1.default.join(__dirname, '../../core/plan/fixtures/compact-slices-v1/valid.md'), 'utf8'));
+            fs_1.default.writeFileSync(path_1.default.join(plainRepo, 'source.md'), '## Canonical source\nfixture source\n');
+            const { out, err, exitCode } = await runWatch(['--init', '--plan', 'plans/fixture.md'], plainRepo);
             expect(exitCode).toBeNull();
             expect(err).toBe('');
             expect(out).toContain('journal inicializado');
+            expect((0, store_1.readJournal)(plainRepo, 'main').state).toMatchObject({ schema: 2, planBinding: { path: 'plans/fixture.md', executionMode: 'desatendido' } });
         }
         finally {
             fs_1.default.rmSync(plainRepo, { recursive: true, force: true });
         }
     });
-    test('`watch --init` desde el cwd autenticado (trackRoot) procede con normalidad', async () => {
-        const { out, err, exitCode } = await runWatch(['--init'], trackRoot);
-        expect(err).not.toContain('cwd no autenticado');
-        expect(exitCode).toBeNull();
-        expect(out).toContain('journal inicializado');
+    test('`watch --init --plan` desde el cwd autenticado alcanza la guarda de lifecycle y rechaza sobrescribir el binding', async () => {
+        await expect(runWatch(['--init', '--plan', 'plans/fixture.md'], trackRoot)).rejects.toThrow(/overwrite|sobrescribir/i);
     });
     test('`watch --init` desde un cwd cuyo descriptor no autentica rechaza con "cwd no autenticado"', async () => {
         const { err, exitCode } = await runWatch(['--init'], otherRoot);

package/dist/tests/commands/job/gate.test.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const gate_1 = require("../../../src/commands/job/gate");
+const types_1 = require("../../../src/core/journal/types");
+test('routed evidence cannot certify against a legacy journal without its attempt', () => {
+    const state = (0, types_1.emptyState)('main');
+    state.verdicts.push({ id: 'v1', obligationId: 'o1', result: 'pass', detail: '', receivedAt: 'now', fingerprint: 'fp', argv: [], paths: [], cwd: '.', routingAttemptId: 'missing' });
+    expect((0, gate_1.computeGate)(state, false, () => 'fp').reasons).toContainEqual(expect.objectContaining({ category: 'routing-evidence' }));
+});

package/dist/tests/commands/job/routing-report-cli.test.js

@@ -0,0 +1,46 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const commander_1 = require("commander");
+const job_1 = require("../../../src/commands/job");
+const store_1 = require("../../../src/core/journal/store");
+const journal_1 = require("../../../src/core/model-policy/journal");
+const envelope = { schema: 'routing-envelope/v1', runtime: { target: 'codex', kind: 'native', version: '1', accountScopeDigest: '0'.repeat(64) }, role: 'implementer', sliceId: 'S1', requestedProfile: 'mechanical', effectiveProfile: 'mechanical', resolved: { selector: { kind: 'model', id: 'model-private' }, effort: { kind: 'explicit', value: 'medium' } }, outcome: 'native', unavailableEvidence: [], policyDigest: 'a'.repeat(64), capabilityDigest: 'b'.repeat(64), planDigest: 'c'.repeat(64), executionDigest: 'd'.repeat(64) };
+function gitInit(repo) {
+    (0, child_process_1.execFileSync)('git', ['-c', 'user.email=t@t.t', '-c', 'user.name=t', 'init', '-q', '-b', 'main'], { cwd: repo });
+    fs_1.default.writeFileSync(path_1.default.join(repo, 'fixture'), 'x');
+    (0, child_process_1.execFileSync)('git', ['add', '.'], { cwd: repo });
+    (0, child_process_1.execFileSync)('git', ['-c', 'user.email=t@t.t', '-c', 'user.name=t', 'commit', '-qm', 'fixture'], { cwd: repo });
+}
+test('`job routing-report --json` emits only aggregate routing evidence', async () => {
+    const repo = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-routing-report-'));
+    try {
+        gitInit(repo);
+        (0, store_1.initJournal)(repo, 'main');
+        const state = (0, store_1.readJournal)(repo, 'main').state;
+        const reserved = (0, journal_1.reserveRoutingAttempt)(state, { obligationId: 'obligation', lineageId: 'lineage', envelope, fingerprint: 'e'.repeat(64) }, '2026-09-17T00:00:00.000Z');
+        (0, store_1.writeJournal)(repo, 'main', (0, journal_1.observeRoutingAttempt)(reserved.state, { attemptId: reserved.attemptId, nativeAgentId: 'native-private' }, '2026-09-17T00:01:00.000Z'));
+        const program = new commander_1.Command();
+        program.exitOverride();
+        (0, job_1.registerJobCommand)(program);
+        const out = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        const cwd = jest.spyOn(process, 'cwd').mockReturnValue(repo);
+        await program.parseAsync(['node', 'awm', 'job', 'routing-report', '--json']);
+        const rendered = String(out.mock.calls[0][0]);
+        const report = JSON.parse(rendered);
+        expect(report).toMatchObject({ schema: 'routing-report/v1', attempts: 1, plannedByRole: { implementer: 1 }, actualByRole: { implementer: 1 }, byState: { active: 1 } });
+        expect(rendered).not.toContain('native-private');
+        expect(rendered).not.toContain('model-private');
+        cwd.mockRestore();
+        out.mockRestore();
+    }
+    finally {
+        fs_1.default.rmSync(repo, { recursive: true, force: true });
+    }
+});

package/dist/tests/commands/job/routing.test.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const types_1 = require("../../../src/core/journal/types");
+const journal_1 = require("../../../src/core/model-policy/journal");
+const envelope = { schema: 'routing-envelope/v1', runtime: { target: 'codex', kind: 'native', version: '1', accountScopeDigest: '0'.repeat(64) }, role: 'implementer', sliceId: 'S1', requestedProfile: 'mechanical', effectiveProfile: 'mechanical', resolved: { selector: { kind: 'model', id: 'm' }, effort: { kind: 'explicit', value: 'medium' } }, outcome: 'native', unavailableEvidence: [], policyDigest: 'a'.repeat(64), capabilityDigest: 'b'.repeat(64), planDigest: 'c'.repeat(64), executionDigest: 'd'.repeat(64) };
+test('routing report remains read-only across an observed attempt', () => {
+    const reserved = (0, journal_1.reserveRoutingAttempt)((0, types_1.emptyState)('main'), { obligationId: 'o1', lineageId: 'l1', envelope, fingerprint: 'e'.repeat(64) }, '2026-09-17T00:00:00.000Z');
+    const observed = (0, journal_1.observeRoutingAttempt)(reserved.state, { attemptId: reserved.attemptId, nativeAgentId: 'native-id' }, '2026-09-17T00:01:00.000Z');
+    expect((0, journal_1.routingReport)(observed)).toMatchObject({ attempts: 1, byState: { active: 1 } });
+    expect(observed.routingAttempts[0].nativeAgentId).toBe('native-id');
+});

package/dist/tests/commands/model-policy/index.test.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const commander_1 = require("commander");
+const model_policy_1 = require("../../../src/commands/model-policy");
+const out = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+describe('model-policy command', () => {
+    beforeEach(() => { jest.clearAllMocks(); process.exitCode = undefined; });
+    afterAll(() => out.mockRestore());
+    it('emits a read-only protocol contract as JSON', async () => {
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, model_policy_1.registerModelPolicyCommand)(program);
+        await program.parseAsync(['node', 'awm', 'model-policy', 'contract', '--json']);
+        expect(JSON.parse(String(out.mock.calls[0][0]))).toMatchObject({
+            schema: 'routing-protocol/v1',
+            supportedPlanSchemas: ['compact-slices/v1', 'compact-slices/v2'],
+            implementerProfiles: ['mechanical', 'integration', 'judgment'],
+            limits: { maxFileBytes: 262144 },
+        });
+    });
+    it('rejects missing values instead of silently accepting an incomplete approval', async () => {
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, model_policy_1.registerModelPolicyCommand)(program);
+        await expect(program.parseAsync(['node', 'awm', 'model-policy', 'approve', '--file', '--scope', 'user', '--expected-digest', 'a'.repeat(64)])).rejects.toThrow();
+    });
+    it('accepts and validates --cwd on contract, and resolves status through it', async () => {
+        const readEffectivePolicy = jest.fn(() => ({ state: 'absent' }));
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, model_policy_1.registerModelPolicyCommand)(program, { readEffectivePolicy });
+        await program.parseAsync(['node', 'awm', 'model-policy', 'contract', '--cwd', 'fixture-root', '--json']);
+        await program.parseAsync(['node', 'awm', 'model-policy', 'status', '--provider', 'codex', '--runtime-kind', 'native', '--runtime-version', '1.0.0', '--account-scope-digest', 'a'.repeat(64), '--cwd', 'fixture-root', '--json']);
+        expect(readEffectivePolicy).toHaveBeenCalledWith('fixture-root');
+        await expect(program.parseAsync(['node', 'awm', 'model-policy', 'contract', '--cwd', '--json'])).rejects.toThrow();
+    });
+    it('reports receipt provenance in status and rejects stale receipt state', async () => {
+        const readCapabilities = jest.fn(() => ({ state: 'stale', reason: 'expired' }));
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, model_policy_1.registerModelPolicyCommand)(program, { readEffectivePolicy: () => ({ state: 'absent' }), readCapabilities });
+        await program.parseAsync(['node', 'awm', 'model-policy', 'status', '--provider', 'codex', '--runtime-kind', 'native', '--runtime-version', '1.0.0', '--account-scope-digest', 'a'.repeat(64), '--json']);
+        expect(JSON.parse(String(out.mock.calls[0][0]))).toMatchObject({ policy: { state: 'absent' }, capability: { state: 'stale' } });
+        expect(process.exitCode).toBe(2);
+    });
+    it('rejects an empty replacement digest for capability approval at the command boundary', async () => {
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, model_policy_1.registerModelPolicyCommand)(program, { approveCapabilities: jest.fn() });
+        await expect(program.parseAsync(['node', 'awm', 'model-policy', 'capabilities', 'approve', '--file', 'receipt.json', '--expected-digest', 'a'.repeat(64), '--replace-digest', ''])).rejects.toThrow(/requires a non-empty value/);
+    });
+});

package/dist/tests/commands/pin.test.js

@@ -7,30 +7,30 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
+let tmpHome;
+let originalHome;
+let originalAwmHome;
+beforeEach(() => {
+    tmpHome = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pin-home-'));
+    originalHome = process.env.HOME;
+    originalAwmHome = process.env.AWM_HOME;
+    process.env.HOME = tmpHome;
+    process.env.AWM_HOME = path_1.default.join(tmpHome, '.awm');
+    jest.resetModules();
+});
+afterEach(() => {
+    fs_1.default.rmSync(tmpHome, { recursive: true, force: true });
+    if (originalHome === undefined)
+        delete process.env.HOME;
+    else
+        process.env.HOME = originalHome;
+    if (originalAwmHome === undefined)
+        delete process.env.AWM_HOME;
+    else
+        process.env.AWM_HOME = originalAwmHome;
+});
+const readPrefs = () => JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpHome, '.awm/preferences.json'), 'utf-8'));
 describe('pin/unpin (editores de preferences)', () => {
-    let tmpHome;
-    let originalHome;
-    let originalAwmHome;
-    beforeEach(() => {
-        tmpHome = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pin-home-'));
-        originalHome = process.env.HOME;
-        originalAwmHome = process.env.AWM_HOME;
-        process.env.HOME = tmpHome;
-        process.env.AWM_HOME = path_1.default.join(tmpHome, '.awm');
-        jest.resetModules();
-    });
-    afterEach(() => {
-        fs_1.default.rmSync(tmpHome, { recursive: true, force: true });
-        if (originalHome === undefined)
-            delete process.env.HOME;
-        else
-            process.env.HOME = originalHome;
-        if (originalAwmHome === undefined)
-            delete process.env.AWM_HOME;
-        else
-            process.env.AWM_HOME = originalAwmHome;
-    });
-    const readPrefs = () => JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpHome, '.awm/preferences.json'), 'utf-8'));
     it('setPin escribe pins.base normalizado (acepta prefijo v)', () => {
         const { setPin } = require('../../src/commands/pin');
         setPin('base', 'v1.2.0');