agentic-workflow-manager 9.7.1 → 9.9.0

package/dist/tests/core/journal/fingerprint.test.js

@@ -8,6 +8,7 @@ const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const child_process_1 = require("child_process");
 const fingerprint_1 = require("../../../src/core/journal/fingerprint");
+const types_1 = require("../../../src/core/journal/types");
 function git(cwd, ...args) {
     (0, child_process_1.execFileSync)('git', ['-c', 'user.email=t@t.t', '-c', 'user.name=t', '-c', 'commit.gpgsign=false', ...args], { cwd });
 }
@@ -96,6 +97,27 @@ describe('computeFingerprint', () => {
         expect(() => (0, fingerprint_1.computeFingerprint)(repo, ['npm', 'test'], [], '.')).not.toThrow();
     });
 });
+describe('reconcileUnattendedRecovery', () => {
+    test.each([
+        ['journal', { journal: null, journalCorrupt: true }, 'repair-journal'],
+        ['binding', { plan: { path: 'other.md' } }, 'rebind-plan'],
+        ['git', { git: 'changed' }, 'reconcile-git'],
+        ['verdicts', { verdicts: 'missing' }, 'repair-verdicts'],
+        ['tests', { tests: 'fail' }, 'run-tests'],
+        ['sensors', { sensors: 'missing' }, 'run-sensors'],
+        ['ready', {}, 'select-work'],
+    ])('covers recovery action %s', (_name, overrides, nextAction) => {
+        const journal = { ...(0, types_1.emptyState)('main'), schema: 2, planBinding: { path: 'docs/plan.md', digest: 'a'.repeat(64), schema: 'compact-slices/v1', executionMode: 'desatendido', boundAt: '2026-09-15T00:00:00.000Z' } };
+        const input = { journal, journalCorrupt: false, plan: journal.planBinding, git: 'current', activeJobIds: [], tests: 'pass', sensors: 'pass', verdicts: 'current', ...overrides };
+        expect((0, fingerprint_1.reconcileUnattendedRecovery)(input).nextAction).toBe(nextAction);
+    });
+    test('reuses active obligations before later verdict repair', () => {
+        const journal = { ...(0, types_1.emptyState)('main'), schema: 2, planBinding: { path: 'docs/plan.md', digest: 'a'.repeat(64), schema: 'compact-slices/v1', executionMode: 'desatendido', boundAt: '2026-09-15T00:00:00.000Z' } };
+        const input = { journal, journalCorrupt: false, plan: journal.planBinding, git: 'current', activeJobIds: ['job-b', 'job-a', 'job-a'], tests: 'pass', sensors: 'pass', verdicts: 'current' };
+        expect((0, fingerprint_1.reconcileUnattendedRecovery)(input)).toEqual({ state: 'ready', nextAction: 'reconcile-active-jobs', activeJobIds: ['job-a', 'job-b'], diagnostics: [] });
+        expect((0, fingerprint_1.reconcileUnattendedRecovery)({ ...input, verdicts: 'missing' })).toEqual({ state: 'ready', nextAction: 'reconcile-active-jobs', activeJobIds: ['job-a', 'job-b'], diagnostics: [] });
+    });
+});
 /** Defense-in-depth (post-implementation-qa, follow-up a Task 20): el `git()`
  *  interno de este archivo backea `computeFingerprint`, invocado en CADA tick
  *  del supervisor via `FingerprintNow`/`computeGate` (job/gate.ts). Sin stdio

package/dist/tests/core/journal/store.test.js

@@ -27,6 +27,11 @@ describe('journal store', () => {
         expect(r.corrupt).toBe(false);
         expect(r.state.revision).toBe(0);
     });
+    test('initJournal es idempotente cuando el arbol de journal ya existe', () => {
+        (0, store_1.initJournal)(repo, 'rama');
+        expect(() => (0, store_1.initJournal)(repo, 'rama')).not.toThrow();
+        expect((0, store_1.readJournal)(repo, 'rama')).toMatchObject({ corrupt: false, state: { revision: 0 } });
+    });
     test('writeJournal incrementa revision y rechaza revision vieja (R1.2)', () => {
         (0, store_1.initJournal)(repo, 'rama');
         const s1 = (0, store_1.readJournal)(repo, 'rama').state;
@@ -51,6 +56,46 @@ describe('journal store', () => {
         fs_1.default.writeFileSync((0, paths_1.statePath)(repo, 'rama'), '{roto'); // sintaxis invalida
         expect((0, store_1.readJournal)(repo, 'rama').corrupt).toBe(true);
     });
+    test('rechaza un state.json symlink sin leer el destino externo', () => {
+        (0, store_1.initJournal)(repo, 'rama');
+        const outside = path_1.default.join(repo, 'outside.json');
+        fs_1.default.writeFileSync(outside, fs_1.default.readFileSync((0, paths_1.statePath)(repo, 'rama')));
+        fs_1.default.rmSync((0, paths_1.statePath)(repo, 'rama'));
+        fs_1.default.symlinkSync(outside, (0, paths_1.statePath)(repo, 'rama'));
+        expect((0, store_1.readJournal)(repo, 'rama')).toMatchObject({ state: null, corrupt: true });
+    });
+    test('initJournal rechaza un padre .awm symlink sin crear journal fuera del repo', () => {
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-store-outside-'));
+        try {
+            fs_1.default.symlinkSync(outside, path_1.default.join(repo, '.awm'));
+            expect(() => (0, store_1.initJournal)(repo, 'rama')).toThrow(/symlink/i);
+            expect(fs_1.default.existsSync(path_1.default.join(outside, 'journal'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    test.each([
+        ['.awm', (root) => path_1.default.join(root, '.awm')],
+        ['journal', (root) => path_1.default.join(root, '.awm', 'journal')],
+        ['branch', (root) => (0, paths_1.journalDir)(root, 'rama')],
+        ['requests', (root) => (0, paths_1.requestsDir)(root, 'rama')],
+        ['acks', (root) => (0, paths_1.acksDir)(root, 'rama')],
+        ['logs', (root) => (0, paths_1.logsDir)(root, 'rama')],
+        ['export', (root) => (0, paths_1.exportDir)(root, 'rama')],
+    ])('initJournal rechaza el segmento symlink %s', (_name, segment) => {
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-store-outside-'));
+        const target = segment(repo);
+        try {
+            fs_1.default.mkdirSync(path_1.default.dirname(target), { recursive: true });
+            fs_1.default.symlinkSync(outside, target);
+            expect(() => (0, store_1.initJournal)(repo, 'rama')).toThrow(/symlink/i);
+            expect(fs_1.default.readdirSync(outside)).toEqual([]);
+        }
+        finally {
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
     test('normaliza campos aditivos de snapshots schema 1 sin certificar evidencia legacy', () => {
         (0, store_1.initJournal)(repo, 'rama');
         const legacy = (0, store_1.readJournal)(repo, 'rama').state;
@@ -74,6 +119,14 @@ describe('journal store', () => {
         expect(JSON.parse(lines[0]).kind).toBe('generation-launched');
         expect(typeof JSON.parse(lines[0]).at).toBe('string');
     });
+    test('appendEvent no sigue un events.jsonl symlink externo', () => {
+        (0, store_1.initJournal)(repo, 'rama');
+        const outside = path_1.default.join(repo, 'outside-events.jsonl');
+        fs_1.default.writeFileSync(outside, 'outside\n');
+        fs_1.default.symlinkSync(outside, (0, paths_1.eventsPath)(repo, 'rama'));
+        (0, store_1.appendEvent)(repo, 'rama', { kind: 'must-not-escape' });
+        expect(fs_1.default.readFileSync(outside, 'utf8')).toBe('outside\n');
+    });
     test('writeJournal rechaza un estado propuesto con forma invalida, nunca lo persiste (R1.6)', () => {
         (0, store_1.initJournal)(repo, 'rama');
         const s = (0, store_1.readJournal)(repo, 'rama').state;

package/dist/tests/core/journal/types.test.js

@@ -22,6 +22,13 @@ describe('journal types', () => {
         expect(s.requiredVerifiers).toEqual([]);
         expect(s.dispatches).toEqual([]);
     });
+    test('binding metadata rejects persisted plan bodies and unversioned execution commitments', () => {
+        const state = { ...(0, types_1.emptyState)('main'), schema: 2, planBinding: { path: 'docs/plan.md', digest: 'a'.repeat(64), schema: 'compact-slices/v1', executionMode: 'desatendido', boundAt: '2026-09-16' } };
+        expect((0, types_1.isWellFormedState)(state)).toBe(true);
+        expect((0, types_1.isWellFormedState)({ ...state, planBinding: { ...state.planBinding, snapshot: 'private source body' } })).toBe(false);
+        expect((0, types_1.isWellFormedState)({ ...state, planBinding: { ...state.planBinding, executionDigest: 'b'.repeat(64) } })).toBe(false);
+        expect((0, types_1.isWellFormedState)({ ...state, planBinding: { ...state.planBinding, executionDigest: 'b'.repeat(64), executionIdentitySchema: 'awm-plan-execution/v1' } })).toBe(true);
+    });
     test('isWellFormedState rechaza no-objetos y shapes rotos (R1.6)', () => {
         expect((0, types_1.isWellFormedState)(null)).toBe(false);
         expect((0, types_1.isWellFormedState)(42)).toBe(false);

package/dist/tests/core/migration/facts.test.js

@@ -0,0 +1,289 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const migration_1 = require("../../../src/core/migration");
+const store_1 = require("../../../src/core/journal/store");
+const fingerprint_1 = require("../../../src/core/journal/fingerprint");
+describe('collectMigrationFacts', () => {
+    it.each([
+        ['https://sentinel-user:sentinel-password@github.com/Kodria/agentic-workflow/issues/126'],
+        ['https://github.com:443/Kodria/agentic-workflow/issues/126'],
+        ['https://github.com/Kodria/agentic-workflow/issues/126?secret=sentinel'],
+        ['https://github.com/Kodria/agentic-workflow/issues/126#sentinel'],
+        ['https://github.com/Kodria/agentic-workflow/issues/126\n'],
+        ['https://github.com/Kodria/agentic-workflow/issues/126', `https://github.com/Kodria/agentic-workflow/issues/${'1'.repeat(4096)}`],
+        Array(129).fill('https://github.com/Kodria/agentic-workflow/issues/126'),
+        ['https://github.com/Kodria/agentic-workflow/issues/126', 'https://github.com/Kodria/agentic-workflow/issues/148', 'https://sentinel:secret@github.com/Kodria/agentic-workflow/issues/149'],
+    ])('rejects unsafe or unbounded issue links before reading either collector root (%#)', (...links) => {
+        expect(() => (0, migration_1.collectMigrationFacts)('x.md', '/nonexistent-migration-root', links)).toThrow(/issue #126/);
+        expect(() => (0, migration_1.collectIssue148HistoricalFacts)('/nonexistent-migration-root', links)).toThrow(/issue #126/);
+    });
+    test('does not export a record-injection completion API', () => {
+        // The only public entrypoint derives evidence from the local journal.
+        expect(require('../../../src/core/migration').reconcileTaskEvidence).toBeUndefined();
+    });
+    it('does not certify a task from a Git commit without durable test and review evidence', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-migration-'));
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(root, 'docs', 'plans'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(root, 'docs', 'plans', 'old.md'), '### Task 1: historical\n');
+            (0, child_process_1.execFileSync)('git', ['init'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['config', 'user.email', 'test@example.invalid'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['config', 'user.name', 'Test'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['add', '.'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['commit', '-m', 'historical task'], { cwd: root });
+            const report = (0, migration_1.collectMigrationFacts)('docs/plans/old.md', root, ['https://github.com/Kodria/agentic-workflow/issues/126']);
+            expect(report.state).toBe('planning-required');
+            expect(report.tasks).toEqual([{ id: '1', state: 'unstarted', missing: [] }]);
+            expect(report.facts.every(fact => /\/issues\/126$/.test(fact.issue126))).toBe(true);
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('rejects a task commit that omits a declared Files entry', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-migration-files-'));
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(root, 'docs', 'plans'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(root, 'first.txt'), 'first');
+            fs_1.default.writeFileSync(path_1.default.join(root, 'second.txt'), 'second');
+            (0, child_process_1.execFileSync)('git', ['init', '-q', '-b', 'master'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['config', 'user.email', 't@e.invalid'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['config', 'user.name', 'T'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['add', '.'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['commit', '-qm', 'first'], { cwd: root });
+            fs_1.default.writeFileSync(path_1.default.join(root, 'second.txt'), 'second changed');
+            (0, child_process_1.execFileSync)('git', ['add', 'second.txt'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['commit', '-qm', 'second'], { cwd: root });
+            const sha = (0, child_process_1.execFileSync)('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' }).trim();
+            fs_1.default.writeFileSync(path_1.default.join(root, 'docs', 'plans', 'old.md'), `### Task 1: historical\nCommit: ${sha}\n**Files:**\n- Modify: \`first.txt\`\n- Modify: \`second.txt\`\n\n### Task 2: later\n`);
+            const planPath = 'docs/plans/old.md';
+            const digest = require('crypto').createHash('sha256').update(fs_1.default.readFileSync(path_1.default.join(root, planPath), 'utf8')).digest('hex');
+            (0, store_1.initBoundJournal)(root, 'master', { path: planPath, digest, schema: 'compact-slices/v1', executionMode: 'desatendido', boundAt: '2026-09-15T00:00:00.000Z' });
+            const state = (0, store_1.readJournal)(root, 'master').state;
+            state.tasks = [{ id: '1', title: 't', status: 'done', attempts: 1, verificationPlan: [{ id: 'test:1', kind: 'test' }, { id: 'sensor:1', kind: 'sensors' }], reviewObligations: [{ id: 'spec:1', taskId: '1', kind: 'spec', verdictId: 'v1' }, { id: 'quality:1', taskId: '1', kind: 'quality', verdictId: 'v2' }] }];
+            const job = (id) => ({ id, fingerprint: 'f', commandDigest: 'd', argv: ['node'], cwd: '.', paths: ['second.txt'], expandedPaths: ['second.txt'], executionState: 'exited', observationState: 'progressing', verdict: 'pass', phaseTimestamps: {}, satisfies: [id] });
+            state.jobs = { test: job('test:1'), sensor: job('sensor:1') };
+            state.verdicts = [{ id: 'v1', obligationId: 'spec:1', result: 'pass', detail: 'ok', receivedAt: '2026-09-15T01:00:00.000Z', fingerprint: 'f', argv: [], paths: [], cwd: '.' }, { id: 'v2', obligationId: 'quality:1', result: 'pass', detail: 'ok', receivedAt: '2026-09-15T01:00:00.000Z', fingerprint: 'f', argv: [], paths: [], cwd: '.' }];
+            (0, store_1.writeJournal)(root, 'master', state);
+            expect((0, migration_1.collectMigrationFacts)(planPath, root, ['https://github.com/Kodria/agentic-workflow/issues/126']).tasks[0]).toMatchObject({ state: 'pending', missing: expect.arrayContaining(['commit']) });
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('rejects material facts without the durable #126 link', () => {
+        expect(() => (0, migration_1.collectMigrationFacts)('x.md', process.cwd(), ['https://github.com/Kodria/agentic-workflow/issues/148'])).toThrow('issue #126');
+    });
+    it('rejects a plan reached through a parent symlink', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-migration-link-'));
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-migration-outside-'));
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(outside, 'plan.md'), '### Task 1: x\n');
+            fs_1.default.symlinkSync(outside, path_1.default.join(root, 'docs'));
+            expect(() => (0, migration_1.collectMigrationFacts)('docs/plan.md', root, ['https://github.com/Kodria/agentic-workflow/issues/126'])).toThrow(/contained bounded regular file/);
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    it.each(['current', 'combined-job', 'semantic-kind', 'spoofed-kind', 'content', 'deleted', 'index', 'head', 'argv', 'cwd', 'paths', 'binding', 'review-argv', 'empty-expansion', 'live-job'])('requires current schema-2 evidence (%s)', (change) => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-migration-journal-'));
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(root, 'docs', 'plans'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(root, 'docs', 'plans', 'old.md'), `### Task 1: historical\nCommit: ${'a'.repeat(40)}\n`);
+            fs_1.default.writeFileSync(path_1.default.join(root, 'task.txt'), 'verified source');
+            (0, child_process_1.execFileSync)('git', ['init', '-q', '-b', 'master'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['config', 'user.email', 't@e.invalid'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['config', 'user.name', 'T'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['add', '.'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['commit', '-m', 't'], { cwd: root });
+            const sha = (0, child_process_1.execFileSync)('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' }).trim();
+            fs_1.default.writeFileSync(path_1.default.join(root, 'docs', 'plans', 'old.md'), `### Task 1: historical\nCommit: ${sha}\nFiles:\n- task.txt\n`);
+            (0, store_1.initBoundJournal)(root, 'master', { path: 'docs/plans/old.md', digest: require('crypto').createHash('sha256').update(fs_1.default.readFileSync(path_1.default.join(root, 'docs/plans/old.md'), 'utf8')).digest('hex'), schema: 'compact-slices/v1', executionMode: 'desatendido', boundAt: '2026-09-15T00:00:00.000Z' });
+            const state = (0, store_1.readJournal)(root, 'master').state;
+            state.tasks = [{ id: '1', title: 't', status: 'done', attempts: 1, verificationPlan: [{ id: 'test:1', kind: 'test' }, { id: 'sensor:1', kind: 'sensors' }], reviewObligations: [{ id: 'spec:1', taskId: '1', kind: 'spec', verdictId: 'v1' }, { id: 'quality:1', taskId: '1', kind: 'quality', verdictId: 'v2' }] }];
+            const argv = [process.execPath, '-e', 'process.exit(0)'];
+            const paths = ['task.txt'];
+            const observed = (0, fingerprint_1.computeFingerprint)(root, argv, paths, '.');
+            const job = (id, satisfies) => ({ id, ...observed, argv: [...argv], cwd: '.', paths: [...paths], executionState: 'exited', observationState: 'progressing', verdict: 'pass', phaseTimestamps: {}, satisfies });
+            state.jobs = { t: job('t', ['test:1']), s: job('s', ['sensor:1']) };
+            if (change === 'combined-job')
+                state.jobs = { t: job('t', ['test:1', 'sensor:1']) };
+            if (change === 'semantic-kind') {
+                state.tasks[0].verificationPlan[0].id = 'unit';
+                state.tasks[0].verificationPlan[1].id = 'quality-gate';
+                state.jobs.t.satisfies = ['unit'];
+                state.jobs.s.satisfies = ['quality-gate'];
+            }
+            if (change === 'spoofed-kind')
+                for (const item of state.tasks[0].verificationPlan)
+                    item.kind = 'lint';
+            state.verdicts = ['v1', 'v2'].map((id, index) => ({ id, obligationId: index === 0 ? 'spec:1' : 'quality:1', result: 'pass', detail: 'ok', receivedAt: '2026-09-15T01:00:00.000Z', fingerprint: observed.fingerprint, argv: [...argv], paths: [...paths], cwd: '.' }));
+            if (change === 'content')
+                fs_1.default.writeFileSync(path_1.default.join(root, 'task.txt'), 'changed source');
+            if (change === 'deleted')
+                fs_1.default.unlinkSync(path_1.default.join(root, 'task.txt'));
+            if (change === 'index') {
+                fs_1.default.writeFileSync(path_1.default.join(root, 'task.txt'), 'staged change');
+                (0, child_process_1.execFileSync)('git', ['add', 'task.txt'], { cwd: root });
+                fs_1.default.writeFileSync(path_1.default.join(root, 'task.txt'), 'verified source');
+            }
+            if (change === 'head')
+                (0, child_process_1.execFileSync)('git', ['commit', '--allow-empty', '-qm', 'unrelated HEAD'], { cwd: root });
+            if (change === 'argv')
+                state.jobs.t.argv.push('--changed');
+            if (change === 'cwd') {
+                fs_1.default.mkdirSync(path_1.default.join(root, 'subdir'));
+                state.jobs.t.cwd = 'subdir';
+            }
+            if (change === 'paths')
+                state.jobs.t.paths = ['missing.txt'];
+            if (change === 'binding')
+                state.planBinding.digest = '0'.repeat(64);
+            if (change === 'review-argv')
+                state.verdicts[1].argv.push('--changed');
+            if (change === 'empty-expansion') {
+                const empty = (0, fingerprint_1.computeFingerprint)(root, argv, ['missing.txt'], '.');
+                for (const entry of Object.values(state.jobs))
+                    Object.assign(entry, empty, { paths: ['missing.txt'] });
+                for (const entry of state.verdicts)
+                    Object.assign(entry, { fingerprint: empty.fingerprint, paths: ['missing.txt'] });
+            }
+            if (change === 'live-job')
+                state.jobs.t.executionState = 'running';
+            (0, store_1.writeJournal)(root, 'master', state);
+            const report = (0, migration_1.collectMigrationFacts)('docs/plans/old.md', root, ['https://github.com/Kodria/agentic-workflow/issues/126']);
+            if (['current', 'combined-job', 'semantic-kind'].includes(change)) {
+                expect(report).toMatchObject({ state: 'supported-completion' });
+                expect(report.tasks[0]).toMatchObject({ state: 'completed' });
+            }
+            else {
+                expect(report.state).not.toBe('supported-completion');
+                expect(report.tasks[0]?.state).not.toBe('completed');
+            }
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('does not let Task 2 borrow a shared verifier identifier from Task 1', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-migration-foreign-task-'));
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(root, 'docs', 'plans'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(root, 'docs', 'plans', 'old.md'), '### Task 1: first\nFiles:\n- docs/plans/old.md\n\n### Task 2: second\nFiles:\n- task-2.txt\n');
+            (0, child_process_1.execFileSync)('git', ['init'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['config', 'user.email', 't@e.invalid'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['config', 'user.name', 'T'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['add', '.'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['commit', '-m', 'task 1'], { cwd: root });
+            const taskOneCommit = (0, child_process_1.execFileSync)('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' }).trim();
+            fs_1.default.writeFileSync(path_1.default.join(root, 'task-2.txt'), 'task 2');
+            (0, child_process_1.execFileSync)('git', ['add', '.'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['commit', '-m', 'task 2'], { cwd: root });
+            const taskTwoCommit = (0, child_process_1.execFileSync)('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' }).trim();
+            fs_1.default.writeFileSync(path_1.default.join(root, 'docs', 'plans', 'old.md'), `### Task 1: first\nCommit: ${taskOneCommit}\nFiles:\n- docs/plans/old.md\n\n### Task 2: second\nCommit: ${taskTwoCommit}\nFiles:\n- task-2.txt\n`);
+            (0, child_process_1.execFileSync)('git', ['add', '.'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['commit', '-m', 'record obligations'], { cwd: root });
+            const planPath = 'docs/plans/old.md';
+            const digest = require('crypto').createHash('sha256').update(fs_1.default.readFileSync(path_1.default.join(root, planPath), 'utf8')).digest('hex');
+            (0, store_1.initBoundJournal)(root, 'master', { path: planPath, digest, schema: 'compact-slices/v1', executionMode: 'desatendido', boundAt: '2026-09-15T00:00:00.000Z' });
+            const state = (0, store_1.readJournal)(root, 'master').state;
+            const task = (id) => ({ id, title: id, status: 'done', attempts: 1, verificationPlan: [{ id: 'test:shared', kind: 'test' }, { id: 'sensor:shared', kind: 'sensors' }], reviewObligations: [{ id: `spec:${id}`, taskId: id, kind: 'spec', verdictId: `v-spec-${id}` }, { id: `quality:${id}`, taskId: id, kind: 'quality', verdictId: `v-quality-${id}` }] });
+            state.tasks = [task('1'), task('2')];
+            const argv = ['node'];
+            const paths = ['docs/plans/old.md', 'task-2.txt'];
+            const observed = (0, fingerprint_1.computeFingerprint)(root, argv, paths, '.');
+            const job = (id, satisfies) => ({ id, ...observed, argv: [...argv], cwd: '.', paths: [...paths], executionState: 'exited', observationState: 'progressing', verdict: 'pass', phaseTimestamps: {}, satisfies });
+            state.jobs = { test: job('test', ['test:shared']), sensor: job('sensor', ['sensor:shared']) };
+            state.verdicts = state.tasks.flatMap(taskState => taskState.reviewObligations.map(obligation => ({ id: obligation.verdictId, obligationId: obligation.id, result: 'pass', detail: 'ok', receivedAt: '2026-09-15T01:00:00.000Z', fingerprint: observed.fingerprint, argv: [...argv], paths: [...paths], cwd: '.' })));
+            (0, store_1.writeJournal)(root, 'master', state);
+            const report = (0, migration_1.collectMigrationFacts)(planPath, root, ['https://github.com/Kodria/agentic-workflow/issues/126']);
+            expect(report.tasks.find(taskState => taskState.id === '1')).toMatchObject({ state: 'pending' });
+            expect(report.tasks.find(taskState => taskState.id === '2')).toMatchObject({ state: 'pending' });
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('rejects a job that satisfies otherwise exclusive verifiers from two tasks', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-migration-multi-satisfies-'));
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(root, 'docs', 'plans'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(root, 'docs', 'plans', 'old.md'), '### Task 1: first\nFiles:\n- docs/plans/old.md\n\n### Task 2: second\nFiles:\n- task-2.txt\n');
+            (0, child_process_1.execFileSync)('git', ['init'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['config', 'user.email', 't@e.invalid'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['config', 'user.name', 'T'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['add', '.'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['commit', '-m', 'task 1'], { cwd: root });
+            const taskOneCommit = (0, child_process_1.execFileSync)('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' }).trim();
+            fs_1.default.writeFileSync(path_1.default.join(root, 'task-2.txt'), 'task 2');
+            (0, child_process_1.execFileSync)('git', ['add', '.'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['commit', '-m', 'task 2'], { cwd: root });
+            const taskTwoCommit = (0, child_process_1.execFileSync)('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' }).trim();
+            fs_1.default.writeFileSync(path_1.default.join(root, 'docs', 'plans', 'old.md'), `### Task 1: first\nCommit: ${taskOneCommit}\nFiles:\n- docs/plans/old.md\n\n### Task 2: second\nCommit: ${taskTwoCommit}\nFiles:\n- task-2.txt\n`);
+            (0, child_process_1.execFileSync)('git', ['add', '.'], { cwd: root });
+            (0, child_process_1.execFileSync)('git', ['commit', '-m', 'record obligations'], { cwd: root });
+            const planPath = 'docs/plans/old.md';
+            const digest = require('crypto').createHash('sha256').update(fs_1.default.readFileSync(path_1.default.join(root, planPath), 'utf8')).digest('hex');
+            (0, store_1.initBoundJournal)(root, 'master', { path: planPath, digest, schema: 'compact-slices/v1', executionMode: 'desatendido', boundAt: '2026-09-15T00:00:00.000Z' });
+            const state = (0, store_1.readJournal)(root, 'master').state;
+            const task = (id) => ({ id, title: id, status: 'done', attempts: 1, verificationPlan: [{ id: `test:${id}`, kind: 'test' }, { id: `sensor:${id}`, kind: 'sensors' }], reviewObligations: [{ id: `spec:${id}`, taskId: id, kind: 'spec', verdictId: `v-spec-${id}` }, { id: `quality:${id}`, taskId: id, kind: 'quality', verdictId: `v-quality-${id}` }] });
+            state.tasks = [task('1'), task('2')];
+            const argv = ['node'];
+            const paths = ['docs/plans/old.md', 'task-2.txt'];
+            const observed = (0, fingerprint_1.computeFingerprint)(root, argv, paths, '.');
+            const job = (id, satisfies) => ({ id, ...observed, argv: [...argv], cwd: '.', paths: [...paths], executionState: 'exited', observationState: 'progressing', verdict: 'pass', phaseTimestamps: {}, satisfies });
+            state.jobs = { multi: job('multi', ['test:1', 'test:2']), sensorOne: job('sensorOne', ['sensor:1']), sensorTwo: job('sensorTwo', ['sensor:2']) };
+            state.verdicts = state.tasks.flatMap(taskState => taskState.reviewObligations.map(obligation => ({ id: obligation.verdictId, obligationId: obligation.id, result: 'pass', detail: 'ok', receivedAt: '2026-09-15T01:00:00.000Z', fingerprint: observed.fingerprint, argv: [...argv], paths: [...paths], cwd: '.' })));
+            (0, store_1.writeJournal)(root, 'master', state);
+            const report = (0, migration_1.collectMigrationFacts)(planPath, root, ['https://github.com/Kodria/agentic-workflow/issues/126']);
+            expect(report.tasks).toEqual([
+                { id: '1', state: 'pending', missing: ['tests'] },
+                { id: '2', state: 'pending', missing: ['tests'] },
+            ]);
+            expect(report.facts.filter(fact => fact.jobId === 'multi')).toEqual([]);
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+});
+describe('collectIssue148HistoricalFacts', () => {
+    it('requires the admitted sibling, canonical branch, and rejects incomplete digest/ledger provenance', () => {
+        const parent = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-historical-parent-'));
+        const current = path_1.default.join(parent, 'codex-issue-126-compact-only');
+        const historical = path_1.default.join(parent, 'codex-issue-148-awm-facts');
+        const cwd = jest.spyOn(process, 'cwd').mockReturnValue(current);
+        try {
+            fs_1.default.mkdirSync(current);
+            fs_1.default.mkdirSync(path_1.default.join(historical, 'docs', 'plans'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(historical, 'docs', 'plans', '2026-09-14-awm-facts-plan.md'), `### Task 1: facts\n- [x] reviewed\n\n### Task 2: quality\n${Array.from({ length: 12 }, (_, index) => `\n### Task ${index + 3}: unstarted\n`).join('')}`);
+            (0, child_process_1.execFileSync)('git', ['init', '-q', '-b', 'codex/issue-148-awm-facts'], { cwd: historical });
+            (0, child_process_1.execFileSync)('git', ['-c', 'user.email=t@e.invalid', '-c', 'user.name=T', 'add', '.'], { cwd: historical });
+            (0, child_process_1.execFileSync)('git', ['-c', 'user.email=t@e.invalid', '-c', 'user.name=T', 'commit', '-qm', 'fixture'], { cwd: historical });
+            expect(() => (0, migration_1.collectIssue148HistoricalFacts)(current, ['https://github.com/Kodria/agentic-workflow/issues/126', 'https://github.com/Kodria/agentic-workflow/issues/148'])).toThrow(/admitted issue-148 sibling/);
+            const report = (0, migration_1.collectIssue148HistoricalFacts)(historical, ['https://github.com/Kodria/agentic-workflow/issues/126', 'https://github.com/Kodria/agentic-workflow/issues/148']);
+            expect(report).toMatchObject({ state: 'blocked', diagnostics: ['issue-148 historical provenance is incomplete or inconsistent'] });
+            expect(report.tasks).toEqual([
+                { id: '1', state: 'pending', missing: ['historical-completion-provenance'] },
+                { id: '2', state: 'pending', missing: ['quality-review'] },
+                ...Array.from({ length: 12 }, (_, index) => ({ id: String(index + 3), state: 'unstarted', missing: [] })),
+            ]);
+            fs_1.default.writeFileSync(path_1.default.join(historical, 'docs', 'plans', '2026-09-14-awm-facts-plan.md'), '### Task 1: unchecked\n\n### Task 2: later\n- [x] unrelated check\n');
+            expect((0, migration_1.collectIssue148HistoricalFacts)(historical, ['https://github.com/Kodria/agentic-workflow/issues/126', 'https://github.com/Kodria/agentic-workflow/issues/148']).tasks[0])
+                .toEqual({ id: '1', state: 'unstarted', missing: [] });
+        }
+        finally {
+            cwd.mockRestore();
+            fs_1.default.rmSync(parent, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/core/migration/historical-provenance.test.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const historical_provenance_1 = require("../../../src/core/migration/historical-provenance");
+const spec = { ts: '2026-09-14T21:53:36.988Z', branch: 'codex/issue-148-awm-facts', phase: 'review', source_skill: 'requesting-code-review', polarity: 'win', signature: 'facts-command-placeholder-traversal', ref: 'cli/src/core/facts/contract.ts:75' };
+const quality = { ...spec, ts: '2026-09-14T22:02:34.749Z', signature: 'facts-contract-json-and-literal-validation', ref: 'cli/src/core/facts/contract.ts:37' };
+describe('audited issue148 native review provenance', () => {
+    test('recovers only the exact already-existing audited events, not a new verdict', () => {
+        expect((0, historical_provenance_1.hasIssue148ReviewProvenance)([spec, quality])).toBe(true);
+    });
+    test.each(['ts', 'branch', 'phase', 'source_skill', 'polarity', 'signature', 'ref'])('does not borrow a different specification event (%s)', field => {
+        expect((0, historical_provenance_1.hasIssue148ReviewProvenance)([{ ...spec, [field]: 'different' }, quality])).toBe(false);
+    });
+    test.each(['ts', 'branch', 'phase', 'source_skill', 'polarity', 'signature', 'ref'])('does not borrow a different quality event (%s)', field => {
+        expect((0, historical_provenance_1.hasIssue148ReviewProvenance)([spec, { ...quality, [field]: 'different' }])).toBe(false);
+    });
+    test('requires both distinct events and rejects later task-owned adverse evidence', () => {
+        expect((0, historical_provenance_1.hasIssue148ReviewProvenance)([quality])).toBe(false);
+        expect((0, historical_provenance_1.hasIssue148ReviewProvenance)([spec])).toBe(false);
+        expect((0, historical_provenance_1.hasIssue148ReviewProvenance)([spec, quality, { ...quality, ts: '2026-09-15T00:00:00.000Z', polarity: 'finding' }])).toBe(false);
+    });
+    test('validates the public input shape', () => {
+        expect(() => (0, historical_provenance_1.hasIssue148ReviewProvenance)(null)).toThrow(/array/);
+        expect(() => (0, historical_provenance_1.hasIssue148ReviewProvenance)([null])).toThrow(/record/);
+    });
+});