agentic-workflow-manager 9.7.1 → 9.9.0

package/dist/src/core/admission/registry-contracts.js

@@ -0,0 +1,290 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.consumedRegistryContracts = consumedRegistryContracts;
+exports.registryCompatibility = registryCompatibility;
+exports.admitRegistryPlan = admitRegistryPlan;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const crypto_1 = __importDefault(require("crypto"));
+const providers_1 = require("../../providers");
+const registry_1 = require("../renderers/registry");
+const registries_1 = require("../registries");
+const native_bridge_1 = require("../secure-fs/native-bridge");
+const json_1 = require("../plan/json");
+const cli_version_1 = require("../cli-version");
+const versioning_1 = require("../versioning");
+const check_1 = require("../currentness/check");
+const run_1 = require("../../commands/sensors/run");
+const index_1 = require("./index");
+const FRAMEWORK_CONTRACTS = ['using-awm', 'writing-plans', 'development-process', 'subagent-driven-development', 'executing-plans', 'post-implementation-qa', 'post-implementation-docs', 'harness-retro', 'finishing-a-development-branch'];
+const MAX_CONTRACT_BYTES = 1024 * 1024;
+const MAX_MANIFEST_BYTES = 256 * 1024;
+const MAX_DIRECTORY_ENTRIES = 10000;
+function unknown(message) {
+    return { provenance: 'unknown', consumedRegistryComponents: [], provenanceDiagnostic: { code: 'ADMISSION_CURRENTNESS_PROVENANCE_REQUIRED', message: `${message} Repair the installed runtime artifact or registry provenance before dispatch.` } };
+}
+function within(root, candidate) {
+    const relative = path_1.default.relative(root, candidate);
+    return relative === '' || (!relative.startsWith(`..${path_1.default.sep}`) && relative !== '..' && !path_1.default.isAbsolute(relative));
+}
+function physicalDirectory(directory) {
+    const physical = fs_1.default.realpathSync.native(directory);
+    if (!fs_1.default.lstatSync(physical).isDirectory())
+        throw new Error('path is not a directory');
+    const handle = fs_1.default.opendirSync(physical);
+    try {
+        let entries = 0;
+        while (handle.readSync() !== null)
+            if (++entries > MAX_DIRECTORY_ENTRIES)
+                throw new Error('directory entry limit exceeded');
+    }
+    finally {
+        handle.closeSync();
+    }
+    return physical;
+}
+function filesystemIdentity(file) {
+    const stat = fs_1.default.lstatSync(file, { bigint: true });
+    if (stat.isSymbolicLink() || stat.ino === 0n)
+        throw new Error('filesystem identity is unavailable');
+    return `${stat.dev.toString()}:${stat.ino.toString()}`;
+}
+/** Native descriptor bytes plus exact bigint leaf identity are observed only
+ * in memory. No source body or new journal snapshot is persisted. */
+function contractFileIdentity(file) {
+    const before = fs_1.default.lstatSync(file, { bigint: true });
+    if (!before.isFile() || before.isSymbolicLink() || before.ino === 0n)
+        throw new Error('contract identity is unavailable');
+    const bytes = native_bridge_1.secureFs.readRegularFile(file, MAX_CONTRACT_BYTES).bytes;
+    const after = fs_1.default.lstatSync(file, { bigint: true });
+    if (!after.isFile() || after.isSymbolicLink() || before.dev !== after.dev || before.ino !== after.ino
+        || before.size !== after.size || before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs)
+        throw new Error('contract identity changed during inspection');
+    return crypto_1.default.createHash('sha256').update(`${before.dev.toString()}:${before.ino.toString()}\0`).update(bytes).digest('hex');
+}
+/** ENOENT proves absence only when the nearest existing parent is readable.
+ * A dangling/replaced ancestor never certifies an empty provider install. */
+function directoryExists(directory) {
+    let current = directory;
+    while (true) {
+        try {
+            fs_1.default.lstatSync(current);
+            physicalDirectory(current);
+            return current === directory;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            const parent = path_1.default.dirname(current);
+            if (parent === current)
+                throw error;
+            // An existing dangling symlink causes realpath ENOENT; do not
+            // continue above it as though the requested install were absent.
+            try {
+                if (fs_1.default.lstatSync(current).isSymbolicLink())
+                    throw new Error('dangling directory ancestor');
+            }
+            catch (inspection) {
+                if (inspection.code !== 'ENOENT')
+                    throw inspection;
+            }
+            current = parent;
+        }
+    }
+}
+/** Physical sources AND actual provider artifacts define consumption. Copied
+ * rendered artifacts have no owner proof; a basename is never provenance. */
+function consumedRegistryContracts(report, cwd, registries, target) {
+    if (report.state !== 'valid')
+        return unknown('A validated compact plan is required.');
+    if (!Array.isArray(registries) || registries.length > 256)
+        return unknown('Registry inventory is invalid or unbounded.');
+    let root;
+    try {
+        root = physicalDirectory(path_1.default.resolve(cwd));
+    }
+    catch {
+        return unknown('Project root provenance is unavailable.');
+    }
+    const physicalRegistries = [];
+    for (const registry of registries) {
+        try {
+            if (!registry || typeof registry.name !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}$/.test(registry.name)
+                || typeof registry.contentRoot !== 'string' || registry.contentRoot.length > 4096
+                || typeof registry.remote !== 'string' || registry.remote.length > 4096)
+                throw new Error('invalid registry identity');
+            const physicalRoot = physicalDirectory(registry.contentRoot);
+            physicalRegistries.push({ name: registry.name, root: physicalRoot, identity: filesystemIdentity(physicalRoot), remote: registry.remote });
+        }
+        catch {
+            const name = typeof registry?.name === 'string' && /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}$/.test(registry.name) ? registry.name : 'unknown';
+            return unknown(`Registry ${name} root cannot be inspected.`);
+        }
+    }
+    const consumed = new Set();
+    const identities = [];
+    for (const source of report.manifest.sources) {
+        try {
+            const file = fs_1.default.realpathSync.native(path_1.default.resolve(root, source.path));
+            if (!within(root, file))
+                return unknown(`Plan source ${source.path} escapes its physical project root.`);
+            identities.push(JSON.stringify(['source', source.id, contractFileIdentity(file)]));
+            for (const registry of physicalRegistries)
+                if (within(registry.root, file))
+                    consumed.add(`registry:${registry.name}`);
+        }
+        catch {
+            return unknown(`Plan source ${source.path} cannot be inspected as a bounded regular file.`);
+        }
+    }
+    const provider = (0, providers_1.providerFor)(target);
+    const directories = [provider.skill.global, path_1.default.resolve(root, provider.skill.local)].filter((directory) => directory !== null);
+    for (const directory of directories) {
+        try {
+            if (!directoryExists(directory))
+                continue;
+        }
+        catch {
+            return unknown(`Provider ${target} install directory ${directory} is unsafe or unreadable.`);
+        }
+        for (const contract of FRAMEWORK_CONTRACTS) {
+            const artifact = path_1.default.join(directory, (0, registry_1.renderedFilename)(contract, provider.skill.renderer));
+            try {
+                fs_1.default.lstatSync(artifact);
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    continue;
+                return unknown(`Runtime artifact ${artifact} cannot be inspected.`);
+            }
+            const declaredFile = provider.skill.renderer === 'link' ? path_1.default.join(artifact, 'SKILL.md') : artifact;
+            try {
+                const file = fs_1.default.realpathSync.native(declaredFile);
+                const identity = contractFileIdentity(file);
+                const owners = physicalRegistries.filter(registry => within(registry.root, file));
+                if (owners.length !== 1)
+                    return unknown(`Runtime artifact ${artifact} has no unique physical registry owner (copied/rendered content is not ownership proof).`);
+                consumed.add(`registry:${owners[0].name}`);
+                identities.push(JSON.stringify(['artifact', target, contract, provider.skill.renderer, identity]));
+            }
+            catch {
+                return unknown(`Runtime artifact ${artifact} is dangling, nonregular, unreadable or unbounded.`);
+            }
+        }
+    }
+    for (const registry of physicalRegistries)
+        if (consumed.has(`registry:${registry.name}`))
+            identities.push(JSON.stringify(['registry', registry.name, registry.identity, registry.remote]));
+    return { provenance: 'proven', consumedRegistryComponents: [...consumed].sort(), identityDigest: crypto_1.default.createHash('sha256').update(identities.sort().join('\0')).digest('hex') };
+}
+/** Only the declared CLI floor is consumed here, not a new registry catalog.
+ * The native bounded/no-follow read prevents stat/read races and body leaks. */
+function registryCompatibility(registries, consumed) {
+    const diagnostics = [];
+    const current = (0, cli_version_1.cliVersion)();
+    for (const registry of registries) {
+        const component = `registry:${registry.name}`;
+        if (!consumed.includes(component))
+            continue;
+        try {
+            const physicalRoot = physicalDirectory(registry.contentRoot);
+            const manifest = path_1.default.join(physicalRoot, registries_1.REGISTRY_MANIFEST_NAME);
+            try {
+                fs_1.default.lstatSync(manifest);
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    continue;
+                throw error;
+            }
+            const bytes = native_bridge_1.secureFs.readRegularFile(manifest, MAX_MANIFEST_BYTES).bytes;
+            const raw = (0, json_1.parseJsonNoDuplicate)(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+            if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+                throw new Error('manifest must be a JSON object');
+            const min = raw.minCliVersion;
+            if (min !== undefined && (typeof min !== 'string' || !/^v?\d+\.\d+\.\d+$/.test(min)
+                || min.replace(/^v/, '').split('.').some(part => !Number.isSafeInteger(Number(part)))))
+                throw new Error('invalid CLI floor');
+            if (typeof min === 'string' && (0, versioning_1.compareSemver)(current, min) < 0)
+                diagnostics.push({ code: 'ADMISSION_REGISTRY_CLI_INCOMPATIBLE', message: `${component} requires CLI >= ${min}; installed CLI is ${current}. Update the CLI before dispatch.` });
+        }
+        catch {
+            diagnostics.push({ code: 'ADMISSION_REGISTRY_COMPATIBILITY_UNVERIFIABLE', message: `${component} manifest compatibility could not be verified as bounded regular JSON. Repair the registry before dispatch.` });
+        }
+    }
+    return diagnostics;
+}
+/** One admission authority for the public command AND actual watch dispatch.
+ * No empirical execution occurs before provenance/currentness/CLI-floor gates. */
+async function admitRegistryPlan(input, dependencies = {}) {
+    const admission = dependencies.admitPlan ?? index_1.admitPlan;
+    if (input.plan.state !== 'valid' || !(0, providers_1.isAgentTarget)(input.provider) || (input.enabledAgents && !input.enabledAgents.includes(input.provider))
+        || (input.executionMode !== undefined && input.executionMode !== 'interactivo' && input.executionMode !== 'desatendido'))
+        return admission(input);
+    let registries = [];
+    let scope;
+    const inventory = dependencies.listRegistries ?? registries_1.listRegistries;
+    const target = input.provider;
+    try {
+        registries = inventory();
+        scope = consumedRegistryContracts(input.plan, input.cwd, registries, target);
+    }
+    catch {
+        scope = unknown('Registry inventory cannot be read.');
+    }
+    const refresh = () => {
+        try {
+            const refreshedRegistries = inventory();
+            const refreshed = consumedRegistryContracts(input.plan, input.cwd, refreshedRegistries, target);
+            const previousComponents = scope.consumedRegistryComponents.join('\0');
+            const previousIdentity = scope.identityDigest;
+            registries = refreshedRegistries;
+            scope = refreshed.provenance === 'unknown' ? refreshed
+                : refreshed.consumedRegistryComponents.join('\0') !== previousComponents || refreshed.identityDigest !== previousIdentity
+                    ? unknown('Consumed registry ownership changed during an asynchronous admission observation. Re-run actual currentness and read-only plan admission.') : refreshed;
+            if (scope.provenanceDiagnostic)
+                scope = { ...scope, provenanceDiagnostic: { ...scope.provenanceDiagnostic, message: `${scope.provenanceDiagnostic.message} Re-run actual currentness after repair.` } };
+        }
+        catch {
+            scope = unknown('Registry inventory changed or cannot be read after asynchronous admission. Re-run actual currentness.');
+        }
+        return scope.provenance === 'proven';
+    };
+    const compose = async (fields) => {
+        const report = await admission({ ...input, provenance: scope.provenance, consumedRegistryComponents: scope.consumedRegistryComponents, ...fields });
+        if (scope.provenanceDiagnostic && report.diagnostics.some(diagnostic => diagnostic.code === 'ADMISSION_CURRENTNESS_PROVENANCE_REQUIRED')) {
+            return { ...report, diagnostics: report.diagnostics.map(diagnostic => diagnostic.code === 'ADMISSION_CURRENTNESS_PROVENANCE_REQUIRED' ? scope.provenanceDiagnostic : diagnostic) };
+        }
+        return report;
+    };
+    let currentness = input.currentness;
+    let compatibilityDiagnostics;
+    if (input.requireCurrent) {
+        if (scope.provenance !== 'proven')
+            return compose({});
+        currentness = currentness ?? await (dependencies.checkCurrentness ?? check_1.checkCurrentness)(input.cwd);
+        if (!refresh())
+            return compose({ currentness });
+        // A missing sensor input stages composition before capability resolution.
+        const currentnessGate = await compose({ currentness, verifySensors: true, sensors: undefined });
+        if (currentnessGate.currentness !== 'current')
+            return currentnessGate;
+        compatibilityDiagnostics = registryCompatibility(registries, scope.consumedRegistryComponents);
+        const compatibilityGate = await compose({ currentness, compatibilityDiagnostics, verifySensors: true, sensors: undefined });
+        if (compatibilityGate.currentness !== 'current')
+            return compatibilityGate;
+    }
+    const sensors = input.verifySensors ? input.sensors ?? await (dependencies.runSensors ?? run_1.runSensors)({ cwd: input.cwd, all: true, readOnly: true }) : undefined;
+    if (input.requireCurrent && input.verifySensors) {
+        if (!refresh())
+            return compose({ currentness, sensors });
+        const currentnessGate = await compose({ currentness, verifySensors: true, sensors: undefined });
+        if (currentnessGate.currentness !== 'current')
+            return currentnessGate;
+        compatibilityDiagnostics = registryCompatibility(registries, scope.consumedRegistryComponents);
+    }
+    return compose({ currentness, compatibilityDiagnostics, sensors, ...(dependencies.readRouting ? { routingReader: dependencies.readRouting } : {}) });
+}

package/dist/src/core/journal/fingerprint.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.reconcileUnattendedRecovery = reconcileUnattendedRecovery;
 exports.resolveWorkingDirectory = resolveWorkingDirectory;
 exports.computeFingerprint = computeFingerprint;
 const crypto_1 = __importDefault(require("crypto"));
@@ -19,8 +20,41 @@ function sha(parts) {
 // el stderr de git hacia el stderr DEL SUPERVISOR — si ese fd es un pipe roto, el
 // relay dispara un EPIPE no catcheable que crashea el proceso ENTERO (este helper
 // backea computeFingerprint, invocado en CADA tick via FingerprintNow/computeGate).
+/** Git's textual plumbing is hashed, never streamed to a terminal. Keep its
+ * memory bounded even for hostile repositories; an incomplete listing must
+ * fail recovery rather than certify a partial fingerprint. */
+const MAX_GIT_OUTPUT_BYTES = 16 * 1024 * 1024;
 function git(cwd, args) {
-    return (0, child_process_1.execFileSync)('git', args, { cwd, encoding: 'utf8', maxBuffer: Infinity, stdio: process_1.EXEC_STDIO });
+    try {
+        return (0, child_process_1.execFileSync)('git', args, { cwd, encoding: 'utf8', maxBuffer: MAX_GIT_OUTPUT_BYTES, stdio: process_1.EXEC_STDIO });
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === 'ENOBUFS' || error.message.includes('maxBuffer')) {
+            throw new Error(`git fingerprint output exceeded ${MAX_GIT_OUTPUT_BYTES} bytes`);
+        }
+        throw error;
+    }
+}
+function reconcileUnattendedRecovery(input) {
+    const activeJobIds = [...new Set(input.activeJobIds)].sort();
+    const result = (state, nextAction, diagnostics) => ({ state, nextAction, activeJobIds, diagnostics });
+    if (input.journalCorrupt || input.journal === null)
+        return result('blocked', 'repair-journal', ['journal-corrupt-or-missing']);
+    const binding = input.journal.schema === 2 ? input.journal.planBinding : undefined;
+    if (!binding || binding.path !== input.plan.path || binding.digest !== input.plan.digest || binding.schema !== input.plan.schema || binding.executionMode !== 'desatendido')
+        return result('blocked', 'rebind-plan', ['journal-plan-binding-stale']);
+    if (input.git !== 'current')
+        return result('blocked', 'reconcile-git', ['git-fingerprint-changed']);
+    if (activeJobIds.length > 0)
+        return result('ready', 'reconcile-active-jobs', []);
+    if (input.verdicts !== 'current')
+        return result('blocked', 'repair-verdicts', [`verdicts-${input.verdicts}`]);
+    if (input.tests !== 'pass')
+        return result('blocked', 'run-tests', [`tests-${input.tests}`]);
+    if (input.sensors !== 'pass')
+        return result('blocked', 'run-sensors', [`sensors-${input.sensors}`]);
+    return result('ready', 'select-work', []);
 }
 function resolveWorkingDirectory(repoRoot, cwdRel) {
     if (typeof cwdRel !== 'string' || cwdRel.length === 0)

package/dist/src/core/journal/paths.js

@@ -13,6 +13,7 @@ exports.acksDir = acksDir;
 exports.logsDir = logsDir;
 exports.eventsPath = eventsPath;
 exports.exportDir = exportDir;
+exports.bindingPlanPath = bindingPlanPath;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 function branchSlug(branch) {
@@ -63,3 +64,13 @@ function eventsPath(repoRoot, branch) {
 function exportDir(repoRoot, branch) {
     return path_1.default.join(journalDir(repoRoot, branch), 'export');
 }
+/** A persisted binding path is always a normalized repository-relative POSIX path. */
+function bindingPlanPath(planPath) {
+    if (typeof planPath !== 'string' || planPath.length === 0 || planPath.length > 4096 || /[\u0000-\u001F\u007F-\u009F]/.test(planPath))
+        throw new Error('plan path inválido para binding');
+    const normalized = path_1.default.posix.normalize(planPath.replace(/\\/g, '/'));
+    if (path_1.default.posix.isAbsolute(normalized) || path_1.default.win32.isAbsolute(planPath) || normalized === '..' || normalized.startsWith('../') || normalized === '.') {
+        throw new Error('plan path fuera del repositorio para binding');
+    }
+    return normalized;
+}

package/dist/src/core/journal/requests.js

@@ -68,7 +68,7 @@ function emitRequest(repoRoot, branch, env) {
 const KNOWN_KINDS = [
     'job-request', 'register-entity', 'controller-heartbeat', 'verdict',
     'track-prepare-request', 'track-freeze-request', 'track-join-request',
-    'track-teardown-request', 'track-finalize-request',
+    'track-teardown-request', 'track-finalize-request', 'routing-reserve', 'routing-observe',
 ];
 function isRecord(x) {
     return typeof x === 'object' && x !== null && !Array.isArray(x);

package/dist/src/core/journal/store.js

@@ -3,15 +3,21 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertJournalInitPaths = assertJournalInitPaths;
 exports.initJournal = initJournal;
+exports.initBoundJournal = initBoundJournal;
 exports.readJournal = readJournal;
 exports.writeJournal = writeJournal;
+exports.rebindJournalPlan = rebindJournalPlan;
 exports.appendEvent = appendEvent;
 const fs_1 = __importDefault(require("fs"));
 const crypto_1 = __importDefault(require("crypto"));
+const path_1 = __importDefault(require("path"));
 const atomic_file_1 = require("../atomic-file");
 const types_1 = require("./types");
 const paths_1 = require("./paths");
+const identity_1 = require("../plan/identity");
+const validate_1 = require("../plan/validate");
 /** Schema 1 evoluciono de forma aditiva durante R1/R5. Normalizamos solamente
  * campos que antes no existian; evidencia legacy queda deliberadamente con
  * fingerprint vacio para que el gate la considere stale, nunca certificada.
@@ -79,22 +85,116 @@ function normalizeSchemaOne(value) {
     }
     return parsed;
 }
-function initJournal(repoRoot, branch) {
-    for (const d of [(0, paths_1.journalDir)(repoRoot, branch), (0, paths_1.requestsDir)(repoRoot, branch), (0, paths_1.acksDir)(repoRoot, branch), (0, paths_1.logsDir)(repoRoot, branch), (0, paths_1.exportDir)(repoRoot, branch)]) {
-        fs_1.default.mkdirSync(d, { recursive: true, mode: 0o700 });
+function initializeDirectories(repoRoot, branch) {
+    for (const d of journalDirectories(repoRoot, branch)) {
+        assertControlledDirectory(d);
+        if (!fs_1.default.existsSync(d))
+            fs_1.default.mkdirSync(d, { recursive: false, mode: 0o700 });
+        assertControlledDirectory(d);
         fs_1.default.chmodSync(d, 0o700); // mkdirSync mode es umask-dependiente: fijar explicito (R1.2)
     }
+}
+/** Every journal segment is owned state.  Validate it centrally before any
+ * directory operation or journal file I/O so a hostile `.awm`/`journal`/branch
+ * link cannot redirect writes or reads outside the repository. */
+function journalDirectories(repoRoot, branch) {
+    const root = path_1.default.join(repoRoot, '.awm');
+    const journal = path_1.default.join(root, 'journal');
+    return [root, journal, (0, paths_1.journalDir)(repoRoot, branch), (0, paths_1.requestsDir)(repoRoot, branch), (0, paths_1.acksDir)(repoRoot, branch), (0, paths_1.logsDir)(repoRoot, branch), (0, paths_1.exportDir)(repoRoot, branch)];
+}
+function assertControlledDirectory(directory) {
+    try {
+        const stat = fs_1.default.lstatSync(directory);
+        if (stat.isSymbolicLink())
+            throw new Error(`journal path rejects symlink: ${directory}`);
+        if (!stat.isDirectory())
+            throw new Error(`journal path is not a directory: ${directory}`);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+}
+function assertJournalTree(repoRoot, branch) {
+    for (const directory of journalDirectories(repoRoot, branch).slice(0, 3))
+        assertControlledDirectory(directory);
+}
+/** Inspect every existing bootstrap segment before the caller writes anything. */
+function assertJournalInitPaths(repoRoot, branch) {
+    for (const directory of journalDirectories(repoRoot, branch))
+        assertControlledDirectory(directory);
+    assertJournalFileNotSymlink((0, paths_1.statePath)(repoRoot, branch));
+}
+function assertJournalFileNotSymlink(file) {
+    try {
+        if (fs_1.default.lstatSync(file).isSymbolicLink())
+            throw new Error(`journal file rejects symlink: ${file}`);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+}
+function initJournal(repoRoot, branch) {
+    initializeDirectories(repoRoot, branch);
     const sp = (0, paths_1.statePath)(repoRoot, branch);
+    assertJournalFileNotSymlink(sp);
     if (!fs_1.default.existsSync(sp)) {
         (0, atomic_file_1.writeFileAtomicDurable)(sp, JSON.stringify((0, types_1.emptyState)(branch), null, 2) + '\n', 0o600);
     }
 }
+/** Create, never replace, the schema-2 state.  The final hard-link is an
+ * exclusive atomic publication: another initializer wins cleanly and the
+ * completed prior journal is left untouched. */
+function initBoundJournal(repoRoot, branch, binding, report) {
+    if (binding.executionDigest !== undefined)
+        assertBindingReport(binding, report);
+    initializeDirectories(repoRoot, branch);
+    const sp = (0, paths_1.statePath)(repoRoot, branch);
+    assertJournalFileNotSymlink(sp);
+    const initial = { ...(0, types_1.emptyState)(branch), schema: 2, planBinding: binding };
+    if (!(0, types_1.isWellFormedState)(initial))
+        throw new Error('binding de plan invalido');
+    const temporary = path_1.default.join((0, paths_1.journalDir)(repoRoot, branch), `.state.${process.pid}.${crypto_1.default.randomUUID()}.tmp`);
+    let fd;
+    try {
+        fd = fs_1.default.openSync(temporary, 'wx', 0o600);
+        fs_1.default.writeFileSync(fd, JSON.stringify(initial, null, 2) + '\n', 'utf8');
+        fs_1.default.fsyncSync(fd);
+        fs_1.default.closeSync(fd);
+        fd = undefined;
+        try {
+            fs_1.default.linkSync(temporary, sp);
+            (0, atomic_file_1.fsyncDirSync)(path_1.default.dirname(sp));
+        }
+        catch (error) {
+            if (error.code === 'EEXIST')
+                throw new Error('refusing to overwrite existing journal');
+            throw error;
+        }
+    }
+    finally {
+        if (fd !== undefined)
+            try {
+                fs_1.default.closeSync(fd);
+            }
+            catch { /* preserve primary error */ }
+        try {
+            fs_1.default.rmSync(temporary, { force: true });
+        }
+        catch { /* preserve primary error */ }
+    }
+}
 /** Lectura corrupt-aware (R1.6): sintaxis invalida O shape invalido => corrupt:true.
  *  Los CONSUMIDORES deciden: consultas muestran 'corrupt'; gate/reconcile bloquean. */
 function readJournal(repoRoot, branch) {
     const sp = (0, paths_1.statePath)(repoRoot, branch);
     let raw;
     try {
+        assertJournalTree(repoRoot, branch);
+        assertJournalFileNotSymlink(sp);
         raw = fs_1.default.readFileSync(sp, 'utf8');
     }
     catch {
@@ -125,13 +225,55 @@ function writeJournal(repoRoot, branch, state) {
     const next = { ...state, revision: state.revision + 1 };
     if (!(0, types_1.isWellFormedState)(next))
         throw new Error('writeJournal: estado propuesto con forma invalida, no se persiste (R1.6)');
+    assertJournalTree(repoRoot, branch);
+    assertJournalFileNotSymlink((0, paths_1.statePath)(repoRoot, branch));
     (0, atomic_file_1.writeFileAtomicDurable)((0, paths_1.statePath)(repoRoot, branch), JSON.stringify(next, null, 2) + '\n', 0o600);
 }
+/** Explicit, guarded schema-2 binding transition.  It intentionally uses the
+ * normal journal write path: state and its audit history are published in one
+ * atomic durable replacement, while initBoundJournal remains create-only. */
+function rebindJournalPlan(repoRoot, branch, binding, report) {
+    const current = readJournal(repoRoot, branch);
+    if (current.corrupt || current.state === null)
+        throw new Error('journal inexistente o corrupto: no se puede reconciliar binding');
+    if (current.state.schema !== 2 || !current.state.planBinding)
+        throw new Error('journal no tiene un binding desatendido reconciliable');
+    const previous = current.state.planBinding;
+    if (!previous.executionDigest || previous.executionDigest !== binding.executionDigest
+        || previous.executionIdentitySchema !== identity_1.EXECUTION_IDENTITY_SCHEMA || binding.executionIdentitySchema !== identity_1.EXECUTION_IDENTITY_SCHEMA
+        || previous.path !== binding.path || previous.schema !== binding.schema || previous.executionMode !== binding.executionMode) {
+        throw new Error('rebind requires proved unchanged execution identity');
+    }
+    assertBindingReport(binding, report);
+    const next = {
+        ...current.state,
+        planBinding: binding,
+        planBindingHistory: [...(current.state.planBindingHistory ?? []), current.state.planBinding],
+    };
+    writeJournal(repoRoot, branch, next);
+    return { ...next, revision: next.revision + 1 };
+}
+/** The old commitment was emitted at initialization/rebind from trusted core
+ * validation. Only a new immutable report can demonstrate the same execution
+ * identity. Snapshot bytes stay process-private and are never written/exported. */
+function assertBindingReport(binding, report) {
+    if (!report || report.state !== 'valid')
+        throw new Error('binding execution identity requires a verified plan report');
+    const snapshot = (0, validate_1.verifiedPlanSnapshot)(report);
+    if (binding.executionIdentitySchema !== identity_1.EXECUTION_IDENTITY_SCHEMA || report.planDigest !== binding.digest
+        || report.executionDigest !== binding.executionDigest || report.schema !== binding.schema
+        || report.executionMode !== binding.executionMode || (0, identity_1.fullPlanDigest)(snapshot) !== binding.digest
+        || (0, identity_1.executionPlanDigest)(snapshot) !== binding.executionDigest)
+        throw new Error('verified plan snapshot mismatches binding commitment');
+}
 /** Auditoria derivada best-effort (R4.6): la escribe SOLO el supervisor, un
  *  fallo aqui jamas invalida el estado — state.json es la unica autoridad. */
 function appendEvent(repoRoot, branch, event) {
     try {
-        fs_1.default.appendFileSync((0, paths_1.eventsPath)(repoRoot, branch), JSON.stringify({ at: new Date().toISOString(), ...event }) + '\n', { mode: 0o600 });
+        assertJournalTree(repoRoot, branch);
+        const ep = (0, paths_1.eventsPath)(repoRoot, branch);
+        assertJournalFileNotSymlink(ep);
+        fs_1.default.appendFileSync(ep, JSON.stringify({ at: new Date().toISOString(), ...event }) + '\n', { mode: 0o600 });
     }
     catch {
         // best-effort: un evento perdido no se reconstruye ni bloquea (R4.6)