agentic-workflow-manager 9.7.1 → 9.9.0

package/dist/src/commands/watch/init.js

@@ -6,40 +6,78 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectRequiredVerifiers = detectRequiredVerifiers;
 exports.ensureJournalGitignored = ensureJournalGitignored;
 exports.initWatch = initWatch;
+exports.rebindWatchPlan = rebindWatchPlan;
 // Bootstrap unico writer (R4.1) + validacion MECANICA plan-vs-repo (R1.4b,
 // bloqueador 5): la config real del repo determina los verificadores exigidos.
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const store_1 = require("../../core/journal/store");
+const paths_1 = require("../../core/journal/paths");
+const lock_1 = require("./lock");
+const validate_1 = require("../../core/plan/validate");
+const identity_1 = require("../../core/plan/identity");
+const native_bridge_1 = require("../../core/secure-fs/native-bridge");
+const MAX_VERIFIER_SCAN_DEPTH = 64;
+const MAX_VERIFIER_SCAN_ENTRIES = 10000;
+const MAX_PACKAGE_JSON_BYTES = 256 * 1024;
+const MAX_SENSORS_JSON_BYTES = 256 * 1024;
 function detectRequiredVerifiers(repoRoot) {
     const kinds = new Set();
-    const visit = (dir) => {
+    let visitedEntries = 0;
+    const visit = (dir, depth) => {
+        if (depth > MAX_VERIFIER_SCAN_DEPTH)
+            throw new Error('verifier scan depth limit exceeded');
         const sensors = path_1.default.join(dir, '.awm', 'sensors.json');
-        if (fs_1.default.existsSync(sensors))
-            kinds.add('sensors');
+        let sensorsPresent = false;
+        try {
+            fs_1.default.lstatSync(sensors);
+            sensorsPresent = true;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw new Error('verifier scan rejected sensors.json: unreadable path');
+        }
+        if (sensorsPresent) {
+            try {
+                const bytes = native_bridge_1.secureFs.readRegularFile(path_1.default.resolve(sensors), MAX_SENSORS_JSON_BYTES).bytes;
+                const config = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+                if (!config || typeof config !== 'object' || Array.isArray(config))
+                    throw new Error('sensors config must be a JSON object');
+                kinds.add('sensors');
+            }
+            catch (error) {
+                throw new Error(`verifier scan rejected sensors.json: ${error.message}`);
+            }
+        }
         let entries;
         try {
             entries = fs_1.default.readdirSync(dir, { withFileTypes: true });
         }
-        catch {
-            return;
+        catch (error) {
+            throw new Error(`verifier scan cannot read ${dir}: ${error.message}`);
         }
         for (const entry of entries) {
-            if (entry.isSymbolicLink())
-                continue;
-            if (entry.isFile() && entry.name === 'package.json') {
+            if (++visitedEntries > MAX_VERIFIER_SCAN_ENTRIES)
+                throw new Error('verifier scan entry limit exceeded');
+            if (entry.name === 'package.json') {
                 try {
-                    const pkg = JSON.parse(fs_1.default.readFileSync(path_1.default.join(dir, entry.name), 'utf8'));
+                    const packagePath = path_1.default.join(dir, entry.name);
+                    const bytes = native_bridge_1.secureFs.readRegularFile(path_1.default.resolve(packagePath), MAX_PACKAGE_JSON_BYTES).bytes;
+                    const pkg = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
                     if (typeof pkg === 'object' && pkg !== null && typeof pkg.scripts === 'object' && pkg.scripts !== null && typeof pkg.scripts.test === 'string')
                         kinds.add('test');
                 }
-                catch { /* package ilegible: no prueba disponibilidad */ }
+                catch (error) {
+                    throw new Error(`verifier scan rejected package.json: ${error.message}`);
+                }
             }
+            if (entry.isSymbolicLink())
+                continue;
             if (entry.isDirectory() && !['node_modules', '.git', '.awm'].includes(entry.name))
-                visit(path_1.default.join(dir, entry.name));
+                visit(path_1.default.join(dir, entry.name), depth + 1);
         }
     };
-    visit(repoRoot);
+    visit(repoRoot, 0);
     return ['test', 'sensors'].filter((kind) => kinds.has(kind));
 }
 /** El journal es gitignoreado (R1.1): sus escrituras jamas alteran fingerprints. */
@@ -47,19 +85,65 @@ function ensureJournalGitignored(repoRoot) {
     const gi = path_1.default.join(repoRoot, '.gitignore');
     let current = '';
     try {
+        if (fs_1.default.lstatSync(gi).isSymbolicLink())
+            throw new Error('.gitignore must not be a symlink');
         current = fs_1.default.readFileSync(gi, 'utf8');
     }
-    catch {
-        current = '';
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
     }
     if (!current.split('\n').some((l) => l.trim() === '.awm/' || l.trim() === '.awm')) {
         fs_1.default.writeFileSync(gi, current.length > 0 && !current.endsWith('\n') ? `${current}\n.awm/\n` : `${current}.awm/\n`);
     }
 }
-function initWatch(repoRoot, branch) {
-    ensureJournalGitignored(repoRoot);
-    (0, store_1.initJournal)(repoRoot, branch);
+const TERMINAL_JOB_STATES = new Set(['exited', 'cancelled']);
+function rebindBlocker(state) {
+    if (state === null)
+        return 'journal inexistente o corrupto';
+    const nonterminal = Object.values(state.jobs).filter(job => !TERMINAL_JOB_STATES.has(job.executionState));
+    if (nonterminal.length > 0)
+        return `hay jobs no terminales: ${nonterminal.map(job => job.id).join(', ')}`;
+    if (state.requestProblems.length > 0)
+        return 'hay conflictos durables de requests';
+    if (state.verdicts.some(verdict => verdict.result !== 'pass'))
+        return 'hay evidencia adversa durable';
+    if (state.fixes.some(fix => !fix.closed))
+        return 'hay fixes abiertos';
+    if (state.cycle.status === 'BLOCKED')
+        return 'el ciclo está bloqueado';
+    if (state.tracks?.some(track => track.phase !== 'REMOVED'))
+        return 'hay tracks no terminales';
+    return undefined;
+}
+function initWatch(repoRoot, branch, plan) {
+    if (plan) {
+        if (plan.report.state !== 'valid')
+            throw new Error('watch --init --plan requiere un plan compacto válido');
+        if (plan.report.executionMode !== 'desatendido')
+            throw new Error('watch --init --plan requiere un plan compacto desatendido');
+        if (plan.report.executionDigest)
+            (0, validate_1.verifiedPlanSnapshot)(plan.report);
+    }
+    if (plan && fs_1.default.existsSync((0, paths_1.statePath)(repoRoot, branch))) {
+        throw new Error('refusing to overwrite existing journal');
+    }
+    let planBinding;
+    if (plan) {
+        const report = plan.report;
+        planBinding = {
+            path: (0, paths_1.bindingPlanPath)(plan.path), digest: report.planDigest, schema: report.schema,
+            ...(report.executionDigest ? { executionDigest: report.executionDigest, executionIdentitySchema: identity_1.EXECUTION_IDENTITY_SCHEMA } : {}),
+            executionMode: 'desatendido', boundAt: new Date().toISOString(),
+        };
+    }
     const required = detectRequiredVerifiers(repoRoot);
+    (0, store_1.assertJournalInitPaths)(repoRoot, branch);
+    ensureJournalGitignored(repoRoot);
+    if (planBinding)
+        (0, store_1.initBoundJournal)(repoRoot, branch, planBinding, plan.report);
+    else
+        (0, store_1.initJournal)(repoRoot, branch);
     const r = (0, store_1.readJournal)(repoRoot, branch);
     if (r.corrupt || r.state === null)
         throw new Error('journal corrupto tras init: no se continua (R1.6)');
@@ -68,5 +152,52 @@ function initWatch(repoRoot, branch) {
         s.requiredVerifiers = required;
         (0, store_1.writeJournal)(repoRoot, branch, s);
     }
-    return { requiredVerifiers: required };
+    return { requiredVerifiers: required, ...(planBinding ? { planBinding } : {}) };
+}
+/**
+ * Intentional recovery route for a valid compact plan whose lifecycle update
+ * changed its digest.  It cannot initialize or overwrite a journal: only an
+ * existing schema-2 unattended binding for the exact canonical plan path is
+ * eligible, and all outstanding work/evidence conflicts fail closed.
+ */
+function rebindWatchPlan(repoRoot, branch, plan) {
+    if (plan.report.state !== 'valid')
+        throw new Error('watch rebind --plan requiere un plan compacto válido');
+    // The same exclusive lock used by the supervisor closes the interval
+    // between observing quiescence and publishing the recovered binding.
+    const lock = (0, lock_1.acquireLock)(repoRoot);
+    try {
+        const current = (0, store_1.readJournal)(repoRoot, branch);
+        if (current.corrupt || current.state === null || current.state.schema !== 2 || !current.state.planBinding) {
+            throw new Error('no existe un journal schema-2 desatendido para reconciliar');
+        }
+        const existing = current.state.planBinding;
+        const canonicalPath = (0, paths_1.bindingPlanPath)(plan.path);
+        if (existing.executionMode !== 'desatendido')
+            throw new Error('solo se reconcilia un binding desatendido');
+        if (existing.path !== canonicalPath)
+            throw new Error('rebind requiere la misma ruta canónica del plan');
+        if (existing.digest === plan.report.planDigest && existing.schema === plan.report.schema)
+            throw new Error('el binding ya está vigente');
+        const blocker = rebindBlocker(current.state);
+        if (blocker)
+            throw new Error(`rebind rechazado: ${blocker}`);
+        const report = plan.report;
+        if (!existing.executionDigest || existing.executionIdentitySchema !== identity_1.EXECUTION_IDENTITY_SCHEMA || !report.executionDigest)
+            throw new Error('rebind rechazado: ciclo en curso o histórico sin prueba de identidad de ejecución');
+        (0, validate_1.verifiedPlanSnapshot)(report);
+        if (report.executionDigest !== existing.executionDigest || report.executionMode !== existing.executionMode || report.schema !== existing.schema)
+            throw new Error('rebind rechazado: cambiaron requisitos o contenido de ejecución; la evidencia anterior no se conserva');
+        const binding = {
+            path: canonicalPath, digest: report.planDigest, schema: report.schema,
+            executionDigest: report.executionDigest,
+            executionIdentitySchema: identity_1.EXECUTION_IDENTITY_SCHEMA,
+            executionMode: 'desatendido', boundAt: new Date().toISOString(),
+        };
+        (0, store_1.rebindJournalPlan)(repoRoot, branch, binding, report);
+        return binding;
+    }
+    finally {
+        (0, lock_1.releaseLock)(repoRoot, lock);
+    }
 }

package/dist/src/commands/watch/supervisor.js

@@ -2,11 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Supervisor = exports.DEFAULT_SUPERVISOR_CONFIG = void 0;
 exports.runSupervisorLoop = runSupervisorLoop;
-// Loop foreground (R4.4/R4.5): tick = apply -> collect/spawn -> stall -> gate.
-// COMPLETE exige gate verde (que exige cero vivos): drenaje ANTES de declarar.
-// Custodia BLOCKED: el loop sigue, el lock NO se libera, nada se mata.
 const store_1 = require("../../core/journal/store");
 const fingerprint_1 = require("../../core/journal/fingerprint");
+const validate_1 = require("../../core/plan/validate");
+const registry_contracts_1 = require("../../core/admission/registry-contracts");
+const config_1 = require("../../utils/config");
 const adapter_1 = require("../../core/journal/adapter");
 const process_1 = require("../../core/journal/process");
 const gate_1 = require("../job/gate");
@@ -16,6 +16,20 @@ const apply_1 = require("./apply");
 const runner_1 = require("./runner");
 const tracks_1 = require("./tracks");
 const generations_1 = require("./generations");
+function defaultDispatchAdmission(repoRoot, branch, provider) {
+    return async () => {
+        const observed = (0, store_1.readJournal)(repoRoot, branch);
+        const binding = observed.state?.schema === 2 ? observed.state.planBinding : undefined;
+        if (!binding || binding.executionMode !== 'desatendido') {
+            return { state: 'blocked', planState: 'invalid', journal: observed.corrupt ? 'corrupt' : 'missing', currentness: 'not-checked', sensors: 'not-required', diagnostics: [{ code: 'ADMISSION_JOURNAL_BINDING_REQUIRED', message: 'Unattended dispatch requires an exact compact plan binding.' }] };
+        }
+        const plan = (0, validate_1.validatePlanFile)(binding.path, repoRoot);
+        const preferences = (0, config_1.readPreferences)();
+        return (0, registry_contracts_1.admitRegistryPlan)({ plan, provider, cwd: repoRoot, enabledAgents: preferences.enabledAgents,
+            executionMode: 'desatendido', requireCurrent: true, verifySensors: true,
+            journalState: observed.state, journalCorrupt: observed.corrupt, planPath: binding.path });
+    };
+}
 /** R7/C3/C4 (Task 12) + fix post-review #2 (re-derivado desde cero tras
  *  encontrar que la justificación original no probaba lo que decía — ver
  *  finding 1 del segundo round de re-review): fases de `CohortPhase` en las
@@ -107,21 +121,43 @@ exports.DEFAULT_SUPERVISOR_CONFIG = {
     maxParallelTracks: 1, // overridden en tiempo de ejecución con loadDefaultParallelism() (watch/index.ts)
 };
 const LIVE = ['received', 'spawn-intent', 'claimed', 'running', 'cancel-requested'];
+function recoveryWhitelistBlocker(state) {
+    if (state.cycle.status === 'BLOCKED')
+        return 'el ciclo está bloqueado';
+    if (state.requestProblems.length > 0)
+        return 'hay conflictos durables de requests';
+    // Pending work is the normal reason to launch (or retry launching) the
+    // controller.  It is not recovery evidence and therefore cannot turn a
+    // transient launch failure into permanent custody.  Conversely, once a
+    // non-empty task set claims completion, missing required evidence is an
+    // unsafe recovery fact and must remain fail-closed.
+    if (state.tasks.length === 0 || state.tasks.some(task => task.status !== 'done'))
+        return undefined;
+    const verificationItems = [...state.cycleVerificationPlan, ...state.tasks.flatMap(task => task.verificationPlan)];
+    for (const required of state.requiredVerifiers) {
+        const requiredItems = verificationItems.filter(item => item.kind === required);
+        if (requiredItems.length === 0 || requiredItems.some(item => item.satisfiedBy === undefined))
+            return `falta evidencia del verificador requerido: ${required}`;
+    }
+    return undefined;
+}
 class Supervisor {
     repoRoot;
     branch;
     cfg;
     spawner;
+    dispatchAdmission;
     backoff = new generations_1.Backoff();
     relaunchNotBefore = 0;
     lastActivity = null;
     lastGenerationToken = null;
     trackRuntime;
-    constructor(repoRoot, branch, cfg, spawner, trackRuntime) {
+    constructor(repoRoot, branch, cfg, spawner, trackRuntime, dispatchAdmission = defaultDispatchAdmission(repoRoot, branch, cfg.provider)) {
         this.repoRoot = repoRoot;
         this.branch = branch;
         this.cfg = cfg;
         this.spawner = spawner;
+        this.dispatchAdmission = dispatchAdmission;
         this.trackRuntime = trackRuntime ?? (0, tracks_1.defaultTrackRuntime)(repoRoot, branch, { termGraceMs: cfg.termGraceMs, killGraceMs: cfg.killGraceMs });
     }
     fingerprintNow = (argv, paths, cwd) => {
@@ -132,7 +168,7 @@ class Supervisor {
             return null;
         } // no recomputable => el gate NO certifica (fail-closed)
     };
-    ensureController(resumePrompt) {
+    ensureController(action) {
         if (Date.now() < this.relaunchNotBefore)
             return 'deferred';
         if (this.backoff.exhausted()) {
@@ -140,7 +176,7 @@ class Supervisor {
             return 'custody';
         }
         try {
-            (0, generations_1.ensureControllerGeneration)(this.repoRoot, this.branch, this.cfg.provider, resumePrompt, this.spawner, this.cfg.reconcileGraceMs);
+            (0, generations_1.ensureControllerGeneration)(this.repoRoot, this.branch, this.cfg.provider, action, this.spawner, this.cfg.reconcileGraceMs);
             return 'ok';
         }
         catch (error) {
@@ -161,6 +197,121 @@ class Supervisor {
         const before0 = (0, store_1.readJournal)(this.repoRoot, this.branch);
         if (before0.corrupt || before0.state === null)
             throw new Error('journal corrupto: el supervisor no opera sobre corrupcion (R1.6)');
+        // Historical/schema-1 journals are intentionally readable by migration
+        // commands, never executable.  Do this before controller recovery,
+        // request consumption, tracks, or runner reconciliation: each can cause
+        // a dispatch directly or indirectly.
+        if (before0.state.schema !== 2 || !before0.state.planBinding)
+            return 'custody';
+        // COMPLETE is terminal, not a recovery attempt. It cannot dispatch and
+        // must retain its normal no-op result even if old work evidence is no
+        // longer reconstructible.
+        if (before0.state.cycle.status === 'COMPLETE')
+            return 'complete';
+        // A controller can create jobs and runnerTick can start them. Both are
+        // downstream of the same full compact unattended admission, so it must
+        // complete before any reconciliation path that could dispatch either.
+        if (before0.state.schema === 2 && before0.state.planBinding) {
+            let admission;
+            try {
+                admission = await this.dispatchAdmission();
+            }
+            catch (error) {
+                (0, generations_1.enterCustody)(this.repoRoot, this.branch, `admisión desatendida no verificable: ${error.message}`);
+                return 'custody';
+            }
+            if (admission.state !== 'admitted' || admission.executionMode !== 'desatendido'
+                || admission.currentness !== 'current' || admission.sensors !== 'pass' || admission.journal !== 'current') {
+                // A first empirical sensor observation can be inconclusive while
+                // the already-started controller is still settling. It never
+                // authorizes dispatch; retry the read-only admission next tick
+                // instead of permanently custodying a healthy cycle.
+                if (admission.planState === 'valid' && admission.currentness === 'current'
+                    && admission.sensors === 'not-certified' && admission.journal === 'not-required')
+                    return 'continue';
+                (0, generations_1.enterCustody)(this.repoRoot, this.branch, `admisión compacta desatendida bloqueada antes de dispatch: ${admission.diagnostics.map(diagnostic => `${diagnostic.code}: ${diagnostic.message}`).join('; ')}`);
+                return 'custody';
+            }
+        }
+        let recoveryResumeAction;
+        // Schema-2 custody is reconciled before any controller launch.  This is
+        // read-only: existing active jobs are reused, never re-requested.
+        if (before0.state.schema === 2 && before0.state.planBinding) {
+            const whitelistBlocker = recoveryWhitelistBlocker(before0.state);
+            if (whitelistBlocker) {
+                (0, generations_1.enterCustody)(this.repoRoot, this.branch, `recovery no autorizado: ${whitelistBlocker}`);
+                return 'custody';
+            }
+            const activeJobIds = Object.values(before0.state.jobs)
+                .filter(job => LIVE.includes(job.executionState) || job.executionState === 'orphaned').map(job => job.id);
+            const staleJob = Object.values(before0.state.jobs).filter(job => LIVE.includes(job.executionState) || job.executionState === 'orphaned').some(job => {
+                try {
+                    return (0, fingerprint_1.computeFingerprint)(this.repoRoot, job.argv, job.paths, job.cwd).fingerprint !== job.fingerprint;
+                }
+                catch {
+                    return true;
+                }
+            });
+            const boundPlan = (0, validate_1.validatePlanFile)(before0.state.planBinding.path, this.repoRoot);
+            const planChanged = boundPlan.state !== 'valid' || boundPlan.planDigest !== before0.state.planBinding.digest || boundPlan.schema !== before0.state.planBinding.schema;
+            const passed = (id) => {
+                if (!id)
+                    return false;
+                const job = before0.state.jobs[id];
+                return job !== undefined && job.verdict === 'pass' && !staleJob;
+            };
+            const verificationItems = [...before0.state.cycleVerificationPlan, ...before0.state.tasks.flatMap(task => task.verificationPlan)];
+            const tests = verificationItems.filter(item => item.kind === 'test');
+            const sensorItems = verificationItems.filter(item => item.kind === 'sensors');
+            // `computeGate` is the single authority for every verification
+            // kind (review, QA and interlock included). Reuse its evidence
+            // semantics instead of maintaining a weaker recovery subset.
+            const evidenceGate = (0, gate_1.computeGate)(before0.state, false, this.fingerprintNow);
+            const terminalTaskClaims = before0.state.tasks.length > 0 && before0.state.tasks.every(task => task.status === 'done');
+            const unresolvedVerification = terminalTaskClaims && evidenceGate.reasons.some(reason => [
+                'dangling-reference', 'unsatisfied-plan', 'adverse-verdict',
+                'stale-fingerprint', 'open-obligation', 'open-fix',
+            ].includes(reason.category));
+            const hasStaleReview = before0.state.verdicts.some(verdict => verdict.fingerprint === '' || (verdict.argv.length > 0 && (() => {
+                try {
+                    return (0, fingerprint_1.computeFingerprint)(this.repoRoot, verdict.argv, verdict.paths, verdict.cwd).fingerprint !== verdict.fingerprint;
+                }
+                catch {
+                    return true;
+                }
+            })()));
+            // Keep the same fail-closed review/fix semantics as job/gate.ts:
+            // missing required kinds, dangling verdict references, adverse
+            // verdicts, and an adverse verdict without a closed fix all stop
+            // recovery before a controller can create more work.
+            const verdictById = new Map(before0.state.verdicts.map(verdict => [verdict.id, verdict]));
+            const openReviewOrFix = before0.state.tasks.some(task => {
+                const obligations = task.reviewObligations;
+                return !['spec', 'quality'].every(kind => obligations.some(obligation => obligation.kind === kind))
+                    || obligations.some(obligation => {
+                        const verdict = obligation.verdictId === undefined ? undefined : verdictById.get(obligation.verdictId);
+                        return verdict === undefined || verdict.result !== 'pass';
+                    });
+            }) || before0.state.verdicts.some(verdict => verdict.result !== 'pass'
+                && !before0.state.fixes.some(fix => fix.verdictId === verdict.id && fix.closed));
+            const recovery = (0, fingerprint_1.reconcileUnattendedRecovery)({
+                journal: before0.state, journalCorrupt: false, plan: before0.state.planBinding,
+                git: staleJob || planChanged ? 'changed' : 'current', activeJobIds,
+                tests: !terminalTaskClaims || tests.length === 0 || tests.every(item => passed(item.satisfiedBy)) ? 'pass' : 'missing',
+                sensors: !terminalTaskClaims || sensorItems.length === 0 || sensorItems.every(item => passed(item.satisfiedBy)) ? 'pass' : 'missing',
+                verdicts: hasStaleReview ? 'stale' : (openReviewOrFix || unresolvedVerification) ? 'missing' : 'current',
+            });
+            (0, store_1.appendEvent)(this.repoRoot, this.branch, { kind: 'unattended-recovery', nextAction: recovery.nextAction, activeJobIds: recovery.activeJobIds, diagnostics: recovery.diagnostics });
+            if (recovery.state !== 'ready') {
+                const staleReasons = terminalTaskClaims ? evidenceGate.reasons.filter(reason => reason.category === 'stale-fingerprint') : [];
+                const remedy = staleReasons.length > 0
+                    ? `; stale-fingerprint: ${staleReasons.map(reason => reason.detail).join('; ')}. Re-ejecutar verificaciones mediante awm job request con generation, paths y satisfies originales, y repetir reviews independientes cuando corresponda; no repetir watch/rebind ni actualizar fingerprints de PASS históricos`
+                    : '';
+                (0, generations_1.enterCustody)(this.repoRoot, this.branch, `recovery no autorizado: ${recovery.diagnostics.join(', ')}${remedy}`);
+                return 'custody';
+            }
+            recoveryResumeAction = { schema: 'controller-recovery/v1', kind: recovery.nextAction === 'reconcile-active-jobs' ? 'reconcile-active-jobs' : 'resume-next-action' };
+        }
         // R6.2/R6.8/C7 (Task 11): reconciliar un `MERGE_HEAD` abierto por un
         // crash a mitad de un merge ANTES de cualquier guard general — hoy
         // ningún guard existente (`verifyBranchInvariant` incluido) rechaza
@@ -181,8 +332,8 @@ class Supervisor {
         if (before.frozen !== undefined)
             return 'frozen';
         const pending = before.cycle.nextAction;
-        const resumePrompt = pending !== undefined ? `el next_action ${pending.actionId} del journal` : 'el plan del ciclo desde el journal';
-        if (this.ensureController(resumePrompt) === 'custody')
+        const resumeAction = recoveryResumeAction ?? { schema: 'controller-recovery/v1', kind: pending !== undefined ? 'resume-next-action' : 'resume-cycle' };
+        if (this.ensureController(resumeAction) === 'custody')
             return 'custody';
         const r0 = (0, store_1.readJournal)(this.repoRoot, this.branch);
         if (r0.corrupt || r0.state === null)
@@ -221,7 +372,7 @@ class Supervisor {
         if (!finalizing && afterRequests.state !== null && (0, generations_1.activeGeneration)(afterRequests.state) === undefined
             && afterRequests.state.generations.length > 0 && afterRequests.state.cycle.status === 'IN_PROGRESS') {
             (0, generations_1.beginGeneration)(this.repoRoot, this.branch);
-            if (this.ensureController(resumePrompt) === 'custody')
+            if (this.ensureController(resumeAction) === 'custody')
                 return 'custody';
         }
         // R5.2/R6.3 (Task 10): recién leído tras `consumePendingRequests` —
@@ -400,8 +551,8 @@ class Supervisor {
             return false; // esperando backoff, auditando
         (0, generations_1.beginGeneration)(this.repoRoot, this.branch);
         const nextAction = (0, store_1.readJournal)(this.repoRoot, this.branch).state.cycle.nextAction;
-        const prompt = nextAction !== undefined ? `el next_action ${nextAction.actionId} del journal` : 'el plan del ciclo desde el journal';
-        const launched = this.ensureController(prompt);
+        const action = { schema: 'controller-recovery/v1', kind: nextAction !== undefined ? 'resume-next-action' : 'resume-cycle' };
+        const launched = this.ensureController(action);
         if (launched === 'custody')
             return true;
         if (launched === 'ok') {
@@ -415,10 +566,13 @@ exports.Supervisor = Supervisor;
 /** Foreground, visible, terminable (R2.4): sin daemons. SIGINT/SIGTERM libera
  *  el lock y sale; COMPLETE => auto-exit liberando lock y terminando la
  *  generacion propia (cero huerfanos). */
-async function runSupervisorLoop(repoRoot, branch, cfg, spawner = (0, runner_1.defaultWrapperSpawner)(), trackRuntime) {
+async function runSupervisorLoop(repoRoot, branch, cfg, spawner = (0, runner_1.defaultWrapperSpawner)(), trackRuntime, dispatchAdmission) {
     const r = (0, store_1.readJournal)(repoRoot, branch);
     if (r.corrupt || r.state === null)
         throw new Error('journal ausente o corrupto: corre `awm watch --init` primero');
+    if (r.state.schema !== 2 || !r.state.planBinding) {
+        throw new Error('journal legacy o sin binding compacto: `awm watch` no puede ejecutar ni despachar trabajo');
+    }
     (0, lock_1.verifyBranchInvariant)(repoRoot, r.state.branch);
     if (r.state.cycle.status === 'COMPLETE')
         return;
@@ -429,7 +583,7 @@ async function runSupervisorLoop(repoRoot, branch, cfg, spawner = (0, runner_1.d
     const onSignal = () => { shutdownRequested = true; wakeSleep?.(); };
     process.on('SIGINT', onSignal);
     process.on('SIGTERM', onSignal);
-    const sup = new Supervisor(repoRoot, branch, cfg, spawner, trackRuntime);
+    const sup = new Supervisor(repoRoot, branch, cfg, spawner, trackRuntime, dispatchAdmission);
     try {
         const s0 = (0, store_1.readJournal)(repoRoot, branch).state;
         if ((0, generations_1.activeGeneration)(s0) === undefined) {

package/dist/src/commands/watch/teardown-driver.js

@@ -21,7 +21,7 @@ const protocol_1 = require("../../core/tracks/protocol");
 const git_1 = require("../../core/tracks/git");
 const teardown_1 = require("../../core/tracks/teardown");
 const store_1 = require("../../core/journal/store");
-const tracks_1 = require("./tracks");
+const track_state_1 = require("./track-state");
 /** Task 13 (R4.2/R4.3/R4.6/R4.10/C2/C9): gathering READ-ONLY del estado real
  *  de UN track en teardown — jamás cuenta como el side effect del tick
  *  (mismo criterio que `ownedWorktreeExists`/`foreignPathExists` en
@@ -94,7 +94,7 @@ function gatherTeardownObservation(planRoot, s, ref) {
  *  haya funcionado, la relectura es la única fuente de verdad). */
 async function runBeginTeardown(planRoot, branch, s, protocol, effect, runtime) {
     const trackId = effect.trackId;
-    const ref = (0, tracks_1.refOf)(s, trackId);
+    const ref = (0, track_state_1.refOf)(s, trackId);
     const observed = gatherTeardownObservation(planRoot, s, ref);
     const decision = (0, protocol_1.decideTeardown)(protocol.tracks[trackId], observed);
     if (decision === 'persist-intent') {
@@ -104,16 +104,16 @@ async function runBeginTeardown(planRoot, branch, s, protocol, effect, runtime)
         // dato del journal, no del protocolo puro, así que se aplica con
         // `withRef` en la MISMA persistencia (una sola frontera, no dos).
         const applied = (0, protocol_1.observeProtocolEffect)(protocol, effect, { kind: 'effect-applied', effect });
-        const withIntent = (0, tracks_1.withRef)((0, tracks_1.applyProtocolToState)(s, applied), trackId, {
+        const withIntent = (0, track_state_1.withRef)((0, track_state_1.applyProtocolToState)(s, applied), trackId, {
             teardownIntent: { worktreePath: ref.worktreePath, branch: ref.branch, supervisorNonce: ref.supervisorProcessRef?.spawnNonce },
         });
-        const next = (0, tracks_1.persist)(planRoot, branch, withIntent);
+        const next = (0, track_state_1.persist)(planRoot, branch, withIntent);
         (0, store_1.appendEvent)(planRoot, branch, { kind: 'track-teardown-step', trackId, step: 'TEARDOWN_INTENT' });
         return { state: next, stop: true, executed: effect.kind };
     }
     if (decision === 'block-foreign') {
         const blocked = (0, protocol_1.observeProtocolEffect)(protocol, effect, { kind: 'teardown-observation', trackId, ...observed });
-        const next = (0, tracks_1.persist)(planRoot, branch, (0, tracks_1.applyProtocolToState)(s, blocked));
+        const next = (0, track_state_1.persist)(planRoot, branch, (0, track_state_1.applyProtocolToState)(s, blocked));
         (0, store_1.appendEvent)(planRoot, branch, {
             kind: 'track-blocked', trackId,
             reason: observed.foreignSupervisor ? 'identidad de supervisor ajena' : 'worktree preexistente ajeno',
@@ -125,8 +125,8 @@ async function runBeginTeardown(planRoot, branch, s, protocol, effect, runtime)
         // `runtime` este tick (mismo criterio que 'accept-worktree' en
         // `runCreateWorktree`).
         const applied = (0, protocol_1.observeProtocolEffect)(protocol, effect, { kind: 'teardown-observation', trackId, ...observed });
-        const next = (0, tracks_1.persist)(planRoot, branch, (0, tracks_1.applyProtocolToState)(s, applied));
-        (0, store_1.appendEvent)(planRoot, branch, { kind: 'track-teardown-step', trackId, step: (0, tracks_1.refOf)(next, trackId).phase });
+        const next = (0, track_state_1.persist)(planRoot, branch, (0, track_state_1.applyProtocolToState)(s, applied));
+        (0, store_1.appendEvent)(planRoot, branch, { kind: 'track-teardown-step', trackId, step: (0, track_state_1.refOf)(next, trackId).phase });
         return { state: next, stop: true, executed: effect.kind };
     }
     if (decision === 'stop-own-supervisor') {
@@ -135,7 +135,7 @@ async function runBeginTeardown(planRoot, branch, s, protocol, effect, runtime)
         const confirmed = await runtime.stopOwnSupervisor(ref);
         const after = { ownSupervisorAlive: !confirmed };
         const applied = (0, protocol_1.observeProtocolEffect)(protocol, effect, { kind: 'teardown-observation', trackId, ...after });
-        const next = (0, tracks_1.persist)(planRoot, branch, (0, tracks_1.applyProtocolToState)(s, applied));
+        const next = (0, track_state_1.persist)(planRoot, branch, (0, track_state_1.applyProtocolToState)(s, applied));
         (0, store_1.appendEvent)(planRoot, branch, { kind: 'track-teardown-step', trackId, step: confirmed ? 'SUPERVISOR_STOPPED' : 'TEARDOWN_INTENT' });
         return { state: next, stop: true, executed: effect.kind };
     }
@@ -149,12 +149,12 @@ async function runBeginTeardown(planRoot, branch, s, protocol, effect, runtime)
         }
         catch (error) {
             const failed = (0, protocol_1.observeProtocolEffect)(protocol, effect, { kind: 'effect-failed', trackId, effect: effect.kind, detail: error.message });
-            const next = (0, tracks_1.persist)(planRoot, branch, (0, tracks_1.applyProtocolToState)(s, failed));
+            const next = (0, track_state_1.persist)(planRoot, branch, (0, track_state_1.applyProtocolToState)(s, failed));
             (0, store_1.appendEvent)(planRoot, branch, { kind: 'track-effect-failed', trackId, effect: effect.kind, detail: error.message });
             return { state: next, stop: true, executed: effect.kind };
         }
         const applied = (0, protocol_1.observeProtocolEffect)(protocol, effect, { kind: 'teardown-observation', trackId, ownedWorktreeExists: false });
-        const next = (0, tracks_1.persist)(planRoot, branch, (0, tracks_1.applyProtocolToState)(s, applied));
+        const next = (0, track_state_1.persist)(planRoot, branch, (0, track_state_1.applyProtocolToState)(s, applied));
         (0, store_1.appendEvent)(planRoot, branch, { kind: 'track-teardown-step', trackId, step: 'WORKTREE_REMOVED' });
         return { state: next, stop: true, executed: effect.kind };
     }
@@ -168,7 +168,7 @@ async function runBeginTeardown(planRoot, branch, s, protocol, effect, runtime)
         // próximo tick, ya en esa fase, decide la branch de nuevo con una
         // observación fresca.
         const applied = (0, protocol_1.observeProtocolEffect)(protocol, effect, { kind: 'teardown-observation', trackId, ownedWorktreeExists: false });
-        const next = (0, tracks_1.persist)(planRoot, branch, (0, tracks_1.applyProtocolToState)(s, applied));
+        const next = (0, track_state_1.persist)(planRoot, branch, (0, track_state_1.applyProtocolToState)(s, applied));
         (0, store_1.appendEvent)(planRoot, branch, { kind: 'track-teardown-step', trackId, step: 'WORKTREE_REMOVED' });
         return { state: next, stop: true, executed: effect.kind };
     }
@@ -178,12 +178,12 @@ async function runBeginTeardown(planRoot, branch, s, protocol, effect, runtime)
     }
     catch (error) {
         const failed = (0, protocol_1.observeProtocolEffect)(protocol, effect, { kind: 'effect-failed', trackId, effect: effect.kind, detail: error.message });
-        const next = (0, tracks_1.persist)(planRoot, branch, (0, tracks_1.applyProtocolToState)(s, failed));
+        const next = (0, track_state_1.persist)(planRoot, branch, (0, track_state_1.applyProtocolToState)(s, failed));
         (0, store_1.appendEvent)(planRoot, branch, { kind: 'track-effect-failed', trackId, effect: effect.kind, detail: error.message });
         return { state: next, stop: true, executed: effect.kind };
     }
     const applied = (0, protocol_1.observeProtocolEffect)(protocol, effect, { kind: 'teardown-observation', trackId, ownedBranchExists: false });
-    const next = (0, tracks_1.persist)(planRoot, branch, (0, tracks_1.applyProtocolToState)(s, applied));
+    const next = (0, track_state_1.persist)(planRoot, branch, (0, track_state_1.applyProtocolToState)(s, applied));
     (0, store_1.appendEvent)(planRoot, branch, { kind: 'track-teardown-step', trackId, step: 'BRANCH_REMOVED' });
     return { state: next, stop: true, executed: effect.kind };
 }

package/dist/src/commands/watch/track-state.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyProtocolToState = applyProtocolToState;
+exports.persist = persist;
+exports.refOf = refOf;
+exports.withRef = withRef;
+const store_1 = require("../../core/journal/store");
+const types_1 = require("../../core/tracks/types");
+function applyProtocolToState(state, protocol) {
+    const next = structuredClone(state);
+    next.cohortPhase = protocol.cohortPhase;
+    if (protocol.planHeadSha !== undefined)
+        next.cohortPlanHeadSha = protocol.planHeadSha;
+    if (protocol.cohortPhase === 'FALLBACK_PENDING') {
+        next.globalQaHeadSha = undefined;
+        next.finalIntegrationJobId = undefined;
+        next.qaFinalizeRequested = undefined;
+    }
+    else {
+        if (protocol.globalQaHeadSha !== undefined)
+            next.globalQaHeadSha = protocol.globalQaHeadSha;
+        if (protocol.finalIntegrationJobId !== undefined)
+            next.finalIntegrationJobId = protocol.finalIntegrationJobId;
+    }
+    if (protocol.fallbackReason !== undefined)
+        next.cohortFallbackReason = protocol.fallbackReason;
+    next.tracks = (next.tracks ?? []).map((ref) => {
+        const track = protocol.tracks[ref.trackId];
+        if (track === undefined)
+            return ref;
+        return {
+            ...ref,
+            phase: track.phase,
+            frozenHeadSha: track.frozenHeadSha,
+            blockedReason: track.blockedReason,
+            joinedCommitSha: track.joinedCommitSha,
+            joinIntent: track.expectedPlanHeadSha !== undefined && track.expectedTrackHeadSha !== undefined
+                ? { expectedPlanHeadSha: track.expectedPlanHeadSha, expectedTrackHeadSha: track.expectedTrackHeadSha, strategy: types_1.JOIN_STRATEGY_NO_FF }
+                : ref.joinIntent,
+        };
+    });
+    return next;
+}
+function persist(planRoot, branch, state) {
+    (0, store_1.writeJournal)(planRoot, branch, state);
+    const result = (0, store_1.readJournal)(planRoot, branch);
+    if (result.corrupt || result.state === null)
+        throw new Error('journal corrupto tras persistir tracks (R1.6)');
+    return result.state;
+}
+function refOf(state, trackId) {
+    const ref = state.tracks?.find((track) => track.trackId === trackId);
+    if (ref === undefined)
+        throw new Error(`invariante rota: TrackRef ausente para ${trackId}`);
+    return ref;
+}
+function withRef(state, trackId, patch) {
+    return { ...state, tracks: (state.tracks ?? []).map((track) => (track.trackId === trackId ? { ...track, ...patch } : track)) };
+}