agentic-workflow-manager 9.7.1 → 9.9.0

package/dist/src/core/journal/types.js

@@ -6,12 +6,16 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GENERATION_STATES = exports.EXECUTION_STATES = void 0;
+exports.isControllerRecoveryAction = isControllerRecoveryAction;
 exports.emptyState = emptyState;
 exports.isWellFormedState = isWellFormedState;
+exports.isRoutingSelection = isRoutingSelection;
+exports.isRoutingEnvelope = isRoutingEnvelope;
 exports.isWellFormedProcessRef = isWellFormedProcessRef;
 exports.isWellFormedJob = isWellFormedJob;
 const crypto_1 = __importDefault(require("crypto"));
 const types_1 = require("../tracks/types");
+const paths_1 = require("./paths");
 exports.EXECUTION_STATES = [
     'received', 'spawn-intent', 'claimed', 'running',
     'exited', 'cancel-requested', 'cancelled', 'orphaned',
@@ -31,6 +35,14 @@ const COHORT_PHASES = [
 ];
 const _cohortPhasesComplete = true;
 const VERIFICATION_KINDS = ['test', 'lint', 'sensors', 'review', 'qa', 'interlock', 'track-integration'];
+function isControllerRecoveryAction(x) {
+    return isObj(x) && Object.keys(x).length === 2
+        && x.schema === 'controller-recovery/v1'
+        && typeof x.kind === 'string'
+        && ['resume-cycle', 'resume-next-action', 'reconcile-active-jobs'].includes(x.kind);
+}
+const ROUTING_ROLES = ['implementer', 'specification-reviewer', 'code-quality-reviewer', 'final-reviewer', 'architecture', 'track-a-qa', 'track-b-qa', 'controller', 'documentation', 'retro', 'finishing'];
+const UNAVAILABLE_EVIDENCE = ['modelOverride', 'effortOverride', 'observedModelEvidence'];
 function emptyState(branch) {
     return {
         schema: 1, revision: 0, journalId: `j-${crypto_1.default.randomUUID()}`, branch,
@@ -48,7 +60,13 @@ function isObj(x) {
 function isWellFormedState(x) {
     if (!isObj(x))
         return false;
-    if (x.schema !== 1)
+    if (x.schema !== 1 && x.schema !== 2)
+        return false;
+    if (x.schema === 2 && !isWellFormedPlanBinding(x.planBinding))
+        return false;
+    if (x.schema === 1 && (x.planBinding !== undefined || x.planBindingHistory !== undefined))
+        return false;
+    if (x.planBindingHistory !== undefined && (!Array.isArray(x.planBindingHistory) || !x.planBindingHistory.every(isWellFormedPlanBinding)))
         return false;
     if (typeof x.revision !== 'number')
         return false;
@@ -74,6 +92,10 @@ function isWellFormedState(x) {
         return false;
     if (!isObj(x.appliedRequests) || !Object.values(x.appliedRequests).every(isWellFormedAppliedRequest))
         return false;
+    if (x.routingAttempts !== undefined && (!Array.isArray(x.routingAttempts) || x.routingAttempts.length > 4096 || !x.routingAttempts.every(isWellFormedRoutingAttempt)))
+        return false;
+    if (x.implementationLineages !== undefined && (!Array.isArray(x.implementationLineages) || x.implementationLineages.length > 4096 || !x.implementationLineages.every(isWellFormedImplementationLineage)))
+        return false;
     if (!Array.isArray(x.requestProblems) || !x.requestProblems.every(isWellFormedRequestProblem))
         return false;
     if (x.custodyDecisions !== undefined && (!Array.isArray(x.custodyDecisions) || !x.custodyDecisions.every(isWellFormedCustodyDecision)))
@@ -113,6 +135,24 @@ function isWellFormedState(x) {
         return false;
     return true;
 }
+function isWellFormedPlanBinding(x) {
+    if (!(isObj(x)
+        && Object.keys(x).every(key => ['path', 'digest', 'schema', 'executionMode', 'boundAt', 'executionDigest', 'executionIdentitySchema'].includes(key))
+        && typeof x.path === 'string' && x.path.length > 0 && x.path.length <= 4096
+        && typeof x.digest === 'string' && /^[a-f0-9]{64}$/.test(x.digest)
+        && (x.executionDigest === undefined || (typeof x.executionDigest === 'string' && /^[a-f0-9]{64}$/.test(x.executionDigest)))
+        && (x.executionDigest === undefined ? x.executionIdentitySchema === undefined : x.executionIdentitySchema === 'awm-plan-execution/v1')
+        && (x.schema === 'compact-slices/v1' || x.schema === 'compact-slices/v2')
+        && x.executionMode === 'desatendido'
+        && typeof x.boundAt === 'string' && x.boundAt.length > 0))
+        return false;
+    try {
+        return (0, paths_1.bindingPlanPath)(x.path) === x.path;
+    }
+    catch {
+        return false;
+    }
+}
 function isWellFormedNextAction(x) {
     return isObj(x) && typeof x.actionId === 'string' && typeof x.type === 'string' && typeof x.target === 'string'
         && strings(x.preconditions) && typeof x.attempt === 'number'
@@ -149,6 +189,8 @@ function isWellFormedGeneration(x) {
         && (x.spawnNonce === undefined || typeof x.spawnNonce === 'string')
         && (x.provider === undefined || typeof x.provider === 'string')
         && (x.resumePrompt === undefined || typeof x.resumePrompt === 'string')
+        && (x.resumeAction === undefined || isControllerRecoveryAction(x.resumeAction))
+        && (x.launchArgvDigest === undefined || (typeof x.launchArgvDigest === 'string' && /^[a-f0-9]{16}$/.test(x.launchArgvDigest)))
         && (x.processRef === undefined || isWellFormedProcessRef(x.processRef))
         && (x.wrapperRef === undefined || isWellFormedProcessRef(x.wrapperRef));
 }
@@ -156,7 +198,8 @@ function isWellFormedVerdict(x) {
     return isObj(x) && typeof x.id === 'string' && typeof x.obligationId === 'string'
         && ['pass', 'fail', 'inconclusive'].includes(String(x.result))
         && typeof x.detail === 'string' && typeof x.receivedAt === 'string'
-        && typeof x.fingerprint === 'string' && strings(x.argv) && strings(x.paths) && typeof x.cwd === 'string';
+        && typeof x.fingerprint === 'string' && strings(x.argv) && strings(x.paths) && typeof x.cwd === 'string'
+        && (x.routingAttemptId === undefined || typeof x.routingAttemptId === 'string');
 }
 function isWellFormedFix(x) {
     return isObj(x) && typeof x.id === 'string' && typeof x.verdictId === 'string' && typeof x.closed === 'boolean';
@@ -167,6 +210,18 @@ function isWellFormedAppliedRequest(x) {
         && ['applied', 'rejected-stale-generation', 'rejected-digest-mismatch', 'rejected-secret'].includes(String(x.outcome))
         && (x.resultRef === undefined || typeof x.resultRef === 'string');
 }
+function isWellFormedRoutingAttempt(x) {
+    return isObj(x) && Object.keys(x).every(key => ['schema', 'id', 'obligationId', 'lineageId', 'attempt', 'envelope', 'envelopeDigest', 'fingerprint', 'state', 'nativeAgentId', 'observed', 'verdict', 'reasonCode', 'administrativeRepair'].includes(key))
+        && x.schema === 'routing-attempt/v1'
+        && typeof x.id === 'string' && typeof x.obligationId === 'string' && typeof x.lineageId === 'string' && Number.isSafeInteger(x.attempt) && x.attempt > 0
+        && typeof x.envelopeDigest === 'string' && /^[a-f0-9]{64}$/.test(x.envelopeDigest) && typeof x.fingerprint === 'string' && /^[a-f0-9]{64}$/.test(x.fingerprint)
+        && ['reserved', 'active', 'complete', 'blocked', 'unknown'].includes(String(x.state)) && (x.nativeAgentId === undefined || typeof x.nativeAgentId === 'string') && (x.observed === undefined || isRoutingSelection(x.observed)) && (x.verdict === undefined || ['pass', 'fail', 'inconclusive'].includes(String(x.verdict))) && (x.reasonCode === undefined || typeof x.reasonCode === 'string') && (x.administrativeRepair === undefined || x.administrativeRepair === true) && isRoutingEnvelope(x.envelope);
+}
+function isDigest(value) { return typeof value === 'string' && /^[a-f0-9]{64}$/.test(value); }
+function isRoutingSelection(x) { return isObj(x) && Object.keys(x).every(key => key === 'selector' || key === 'effort') && isObj(x.selector) && Object.keys(x.selector).every(key => key === 'kind' || key === 'id') && ['model', 'tier'].includes(String(x.selector.kind)) && typeof x.selector.id === 'string' && x.selector.id.length > 0 && x.selector.id.length <= 128 && isObj(x.effort) && ((x.effort.kind === 'runtime-default' && Object.keys(x.effort).length === 1) || (x.effort.kind === 'explicit' && Object.keys(x.effort).length === 2 && typeof x.effort.value === 'string' && x.effort.value.length > 0 && x.effort.value.length <= 128)); }
+function isRoutingEnvelope(x) { if (!isObj(x) || !Object.keys(x).every(key => ['schema', 'runtime', 'role', 'planDigest', 'executionDigest', 'sliceId', 'requestedProfile', 'effectiveProfile', 'resolved', 'policyDigest', 'capabilityDigest', 'outcome', 'unavailableEvidence'].includes(key)))
+    return false; const runtime = x.runtime; return x.schema === 'routing-envelope/v1' && isObj(runtime) && Object.keys(runtime).every(key => ['target', 'kind', 'version', 'accountScopeDigest'].includes(key)) && ['codex', 'claude-code', 'cursor', 'copilot', 'opencode', 'antigravity'].includes(String(runtime.target)) && typeof runtime.kind === 'string' && runtime.kind.length > 0 && runtime.kind.length <= 128 && typeof runtime.version === 'string' && runtime.version.length > 0 && runtime.version.length <= 128 && isDigest(runtime.accountScopeDigest) && typeof x.role === 'string' && ROUTING_ROLES.includes(x.role) && isDigest(x.planDigest) && isDigest(x.executionDigest) && (x.sliceId === undefined || (typeof x.sliceId === 'string' && x.sliceId.length > 0 && x.sliceId.length <= 128)) && ['mechanical', 'integration', 'judgment', 'full'].includes(String(x.requestedProfile)) && ['mechanical', 'integration', 'judgment', 'full'].includes(String(x.effectiveProfile)) && isRoutingSelection(x.resolved) && isDigest(x.policyDigest) && isDigest(x.capabilityDigest) && ['native', 'degraded'].includes(String(x.outcome)) && Array.isArray(x.unavailableEvidence) && x.unavailableEvidence.length <= UNAVAILABLE_EVIDENCE.length && x.unavailableEvidence.every(value => typeof value === 'string' && UNAVAILABLE_EVIDENCE.includes(value)); }
+function isWellFormedImplementationLineage(x) { return isObj(x) && Object.keys(x).every(key => ['id', 'obligationId', 'sliceId', 'planDigest', 'executionDigest', 'initialProfile', 'initialEffort', 'attempts'].includes(key)) && typeof x.id === 'string' && x.id.length > 0 && typeof x.obligationId === 'string' && x.obligationId.length > 0 && typeof x.sliceId === 'string' && x.sliceId.length > 0 && isDigest(x.planDigest) && isDigest(x.executionDigest) && ['mechanical', 'integration', 'judgment'].includes(String(x.initialProfile)) && ['medium', 'high'].includes(String(x.initialEffort)) && Number.isSafeInteger(x.attempts) && x.attempts >= 0 && x.attempts <= 3; }
 function isWellFormedRequestProblem(x) {
     return isObj(x) && typeof x.file === 'string' && (x.kind === 'corrupt' || x.kind === 'rejected')
         && typeof x.detail === 'string' && typeof x.at === 'string';

package/dist/src/core/migration/historical-provenance.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasIssue148ReviewProvenance = hasIssue148ReviewProvenance;
+function hasIssue148ReviewProvenance(entries) {
+    if (!Array.isArray(entries))
+        throw new Error('historical review records must be an array');
+    const fields = ['ts', 'branch', 'phase', 'source_skill', 'polarity', 'signature', 'ref'];
+    for (const entry of entries) {
+        if (!entry || typeof entry !== 'object' || fields.some(field => field !== 'ts' && typeof entry[field] !== 'string') || (entry.ts !== undefined && typeof entry.ts !== 'string'))
+            throw new Error('historical review record is invalid');
+    }
+    const shared = { branch: 'codex/issue-148-awm-facts', phase: 'review', source_skill: 'requesting-code-review', polarity: 'win' };
+    const spec = { ...shared, ts: '2026-09-14T21:53:36.988Z', signature: 'facts-command-placeholder-traversal', ref: 'cli/src/core/facts/contract.ts:75' };
+    const quality = { ...shared, ts: '2026-09-14T22:02:34.749Z', signature: 'facts-contract-json-and-literal-validation', ref: 'cli/src/core/facts/contract.ts:37' };
+    const exact = (expected) => entries.some(entry => fields.every(field => entry[field] === expected[field]));
+    const laterAdverse = entries.some(entry => entry.branch === shared.branch && entry.polarity === 'finding' && typeof entry.ts === 'string' && entry.ts > quality.ts && /^cli\/(?:src\/core\/(?:facts\/(?:types|contract)\.ts|registries\.ts)|tests\/core\/(?:facts\/contract\.test\.ts|registry-manifest\.test\.ts))(?::\d+(?::\d+)?)?$/.test(entry.ref));
+    return exact(spec) && exact(quality) && !laterAdverse;
+}

package/dist/src/core/migration/index.js

@@ -0,0 +1,322 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectMigrationFacts = collectMigrationFacts;
+exports.collectIssue148HistoricalFacts = collectIssue148HistoricalFacts;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const validate_1 = require("../plan/validate");
+const store_1 = require("../ledger/store");
+const store_2 = require("../journal/store");
+const fingerprint_1 = require("../journal/fingerprint");
+const native_bridge_1 = require("../secure-fs/native-bridge");
+const historical_provenance_1 = require("./historical-provenance");
+const ISSUE_126 = /\/issues\/126\/?$/;
+const ISSUE_148 = /\/issues\/148\/?$/;
+const TASK = /^### Task ([1-9][0-9]{0,3}):/gm;
+const MAX = 128;
+const MAX_ISSUE_LINK_BYTES = 2048;
+/** Pure task-scoped gate. Callers cannot combine a test from one task with a
+ * review from another: every required record carries the same task identity. */
+/** Local-only reconciliation. Evidence is admitted exclusively by
+ * collectMigrationFacts from the schema-2 journal; callers cannot fabricate
+ * records through the public migration API. */
+function reconcileTaskEvidence(taskId, records) {
+    const own = records.filter(record => record.taskId === taskId);
+    if (own.some(record => !safeIssue(record.issue126) || !ISSUE_126.test(record.issue126)))
+        return { id: taskId, state: 'pending', missing: ['issue126-provenance'] };
+    if (own.some(record => record.result === 'fail' || record.result === 'inconclusive'))
+        return { id: taskId, state: 'pending', missing: ['adverse-evidence'] };
+    const commit = own.some(record => typeof record.commitSha === 'string' && /^[a-f0-9]{40}$/i.test(record.commitSha));
+    const test = own.some(record => record.verificationKind === 'test' && record.result === 'pass' && !!record.fingerprint && (record.paths?.length ?? 0) > 0);
+    const sensor = own.some(record => record.verificationKind === 'sensors' && record.result === 'pass' && !!record.fingerprint && (record.paths?.length ?? 0) > 0);
+    const spec = own.some(record => record.role === 'spec' && record.result === 'pass' && !!record.verdictId && !!record.obligationId && !!record.at);
+    const quality = own.some(record => record.role === 'quality' && record.result === 'pass' && !!record.verdictId && !!record.obligationId && !!record.at);
+    const missing = [...(commit ? [] : ['commit']), ...(test ? [] : ['tests']), ...(sensor ? [] : ['sensors']), ...(spec ? [] : ['specification-review']), ...(quality ? [] : ['quality-review'])];
+    return { id: taskId, state: missing.length === 0 ? 'completed' : 'pending', missing };
+}
+function safeIssue(link) {
+    // A canonical public issue URL cannot contain credentials, custom ports,
+    // queries, fragments, encoded delimiters or controls. Never echo rejected
+    // input: even a diagnostic could otherwise disclose URL credentials.
+    return typeof link === 'string' && Buffer.byteLength(link, 'utf8') <= MAX_ISSUE_LINK_BYTES
+        && /^https:\/\/github\.com\/Kodria\/agentic-workflow\/issues\/[1-9][0-9]*\/?$/.test(link)
+        && !/[\u0000-\u001F\u007F-\u009F]/.test(link);
+}
+function validateIssueLinks(issueLinks) {
+    if (!Array.isArray(issueLinks) || issueLinks.length === 0 || issueLinks.length > MAX
+        || issueLinks.some(link => !safeIssue(link)) || !issueLinks.some(link => ISSUE_126.test(link))) {
+        throw new Error('migration material facts require bounded canonical durable issue #126 links');
+    }
+}
+function ids(text) { const value = [...text.matchAll(TASK)].map(m => m[1]); if (value.length > MAX || new Set(value).size !== value.length)
+    throw new Error('migration task ownership is ambiguous'); return value; }
+function taskFiles(text, taskId) {
+    const start = text.search(new RegExp(`^### Task ${taskId}:`, 'm'));
+    if (start < 0)
+        return [];
+    const end = text.indexOf('\n### Task ', start + 1);
+    const section = text.slice(start, end < 0 ? text.length : end);
+    const lines = section.split(/\r?\n/);
+    const heading = lines.findIndex(line => /^\s*(?:\*\*)?Files:?(?:\*\*)?\s*$/i.test(line));
+    if (heading < 0)
+        return [];
+    const files = [];
+    for (const line of lines.slice(heading + 1)) {
+        if (!line.trim() || /^\s*(?:#{1,6}\s|\*\*[^*]+\*\*)/.test(line))
+            break;
+        const match = /^\s*[-*]\s*(?:(?:Create|Modify):\s*)?`?([^`\r\n]+?)`?\s*$/.exec(line);
+        if (match)
+            files.push(match[1].trim());
+    }
+    return files.filter(file => file && !file.includes('..') && !path_1.default.isAbsolute(file));
+}
+function declaredCommit(text, taskId, cwd) {
+    const start = text.search(new RegExp(`^### Task ${taskId}:`, 'm'));
+    if (start < 0)
+        return undefined;
+    const end = text.indexOf('\n### Task ', start + 1);
+    const section = text.slice(start, end < 0 ? text.length : end);
+    const sha = /^Commit:\s*([a-f0-9]{7,40})\s*$/mi.exec(section)?.[1];
+    if (!sha)
+        return undefined;
+    const files = taskFiles(text, taskId);
+    try {
+        const full = (0, child_process_1.execFileSync)('git', ['rev-parse', '--verify', `${sha}^{commit}`], { cwd, encoding: 'utf8', stdio: 'pipe', timeout: 2000 }).trim();
+        (0, child_process_1.execFileSync)('git', ['merge-base', '--is-ancestor', full, 'HEAD'], { cwd, stdio: 'pipe', timeout: 2000 });
+        const changed = (0, child_process_1.execFileSync)('git', ['diff-tree', '--root', '--no-commit-id', '--name-only', '-r', full], { cwd, encoding: 'utf8', stdio: 'pipe', timeout: 2000 }).split(/\r?\n/).filter(Boolean);
+        return files.length > 0 && changed.length > 0 && files.every(file => changed.includes(file)) ? full : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function readContainedRegularFile(root, relative, maximum, label) {
+    if (path_1.default.isAbsolute(relative) || path_1.default.win32.isAbsolute(relative))
+        throw new Error(`${label} must be relative`);
+    const file = path_1.default.resolve(root, relative);
+    if (!file.startsWith(`${root}${path_1.default.sep}`))
+        throw new Error(`${label} escapes root`);
+    // The native primitive walks parents through directory descriptors/handles,
+    // refuses every reparse point, and reads the leaf through that anchor. Do
+    // not emulate it with lstat/open: a parent can otherwise change in between.
+    try {
+        return native_bridge_1.secureFs.readRegularFile(file, maximum).bytes;
+    }
+    catch {
+        throw new Error(`${label} must be a contained bounded regular file`);
+    }
+}
+function readPlan(root, relative) { return new TextDecoder('utf-8', { fatal: true }).decode(readContainedRegularFile(root, relative, 1024 * 1024, 'migration plan')); }
+/** Public collector accepts no completion claims. All facts are derived locally and
+ * every material record carries the initiative's durable #126 reference. */
+function collectMigrationFacts(planPath, cwd, issueLinks) {
+    validateIssueLinks(issueLinks);
+    const root = fs_1.default.realpathSync(cwd);
+    const text = readPlan(root, planPath);
+    const taskIds = ids(text);
+    // Validate the descriptor-anchored bytes above; never reopen planPath.
+    const plan = (0, validate_1.validatePlanSnapshot)(planPath, root, text);
+    if (plan.state !== 'migration-required' && plan.state !== 'valid')
+        return { state: 'blocked', issueLinks: [...issueLinks], tasks: [], diagnostics: ['plan-not-migratable'], facts: [] };
+    const issue126 = issueLinks.find(link => ISSUE_126.test(link));
+    const facts = [];
+    // Git can prove ancestry for a SHA only when the durable task obligation
+    // names that SHA. The current journal schema has no task commit field, so
+    // history is deliberately not borrowed across tasks.
+    try {
+        (0, child_process_1.execFileSync)('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8', stdio: 'pipe', timeout: 2000 });
+    }
+    catch { /* no Git fact */ }
+    let journal;
+    try {
+        journal = (0, store_2.readJournal)(root, (0, store_1.detectBranch)(root));
+    }
+    catch {
+        journal = { state: null, corrupt: true };
+    }
+    const diagnostics = [];
+    if (!journal.state || journal.corrupt)
+        diagnostics.push('journal-missing-or-corrupt');
+    const binding = journal.state?.schema === 2 ? journal.state.planBinding : undefined;
+    const digest = plan.state === 'valid' ? plan.planDigest : crypto_1.default.createHash('sha256').update(text.replace(/\r\n?/g, '\n'), 'utf8').digest('hex');
+    const bindingCurrent = !!binding && binding.path === planPath && binding.digest === digest && binding.executionMode === 'desatendido';
+    if (!bindingCurrent)
+        diagnostics.push('journal-plan-binding-stale');
+    const jobs = journal.state ? Object.values(journal.state.jobs) : [];
+    const observed = new Map();
+    const currentFingerprint = (record) => {
+        if (!bindingCurrent || !record.argv.length || !record.paths.length)
+            return null;
+        const key = JSON.stringify([record.argv, record.paths, record.cwd]);
+        if (!observed.has(key)) {
+            try {
+                observed.set(key, (0, fingerprint_1.computeFingerprint)(root, record.argv, record.paths, record.cwd));
+            }
+            catch {
+                observed.set(key, null);
+            }
+        }
+        const current = observed.get(key);
+        return current && current.expandedPaths.length > 0 && current.fingerprint === record.fingerprint ? current : null;
+    };
+    const currentJobs = jobs.filter(job => {
+        const current = currentFingerprint(job);
+        return job.executionState === 'exited' && job.verdict === 'pass' && current !== null
+            && current.commandDigest === job.commandDigest
+            && JSON.stringify(current.expandedPaths) === JSON.stringify(job.expandedPaths);
+    });
+    if (currentJobs.length !== jobs.length)
+        diagnostics.push('stale-or-nonterminal-durable-job-evidence');
+    const declared = new Map((journal.state?.tasks ?? []).map(task => [task.id, declaredCommit(text, task.id, root)]));
+    // A verifier identifier is an ownership boundary. A job must resolve to
+    // exactly one task; otherwise it could lend the same execution evidence
+    // to multiple task completions.
+    const verificationOwners = new Map();
+    for (const task of journal.state?.tasks ?? [])
+        for (const item of task.verificationPlan) {
+            verificationOwners.set(item.id, [...(verificationOwners.get(item.id) ?? []), task.id]);
+        }
+    const claimedCommits = new Set();
+    const duplicateCommits = new Set();
+    for (const sha of declared.values())
+        if (sha) {
+            if (claimedCommits.has(sha))
+                duplicateCommits.add(sha);
+            else
+                claimedCommits.add(sha);
+        }
+    for (const task of journal.state?.tasks ?? []) {
+        const commitSha = declared.get(task.id);
+        if (commitSha && !duplicateCommits.has(commitSha))
+            facts.push({ taskId: task.id, commitSha, issue126 });
+        const verificationIds = new Set(task.verificationPlan.map(item => item.id).filter(id => verificationOwners.get(id)?.length === 1));
+        const belongsToTask = (job) => {
+            const jobOwners = new Set((job.satisfies ?? []).flatMap(id => verificationOwners.get(id) ?? []));
+            return jobOwners.size === 1 && jobOwners.has(task.id);
+        };
+        for (const job of currentJobs) {
+            if (!belongsToTask(job))
+                continue;
+            for (const item of task.verificationPlan) {
+                if (verificationIds.has(item.id) && job.satisfies?.includes(item.id))
+                    facts.push({ taskId: task.id, verificationItemId: item.id, verificationKind: item.kind, jobId: job.id, argv: job.argv, fingerprint: job.fingerprint, paths: job.paths, result: job.verdict, issue126 });
+            }
+        }
+        for (const obligation of task.reviewObligations) {
+            const verdict = obligation.verdictId ? journal.state?.verdicts.find(item => item.id === obligation.verdictId) : undefined;
+            const fingerprintBound = verdict && currentFingerprint(verdict) !== null && currentJobs.some(job => belongsToTask(job) && job.fingerprint === verdict.fingerprint && job.satisfies?.some(id => verificationIds.has(id)));
+            if (verdict && verdict.obligationId === obligation.id && obligation.taskId === task.id && fingerprintBound)
+                facts.push({ taskId: task.id, verdictId: verdict.id, obligationId: obligation.id, role: obligation.kind, result: verdict.result, fingerprint: verdict.fingerprint, paths: verdict.paths, at: verdict.receivedAt, issue126 });
+        }
+    }
+    if (jobs.some(job => job.verdict === 'fail') || journal.state?.verdicts.some(verdict => verdict.result === 'fail'))
+        diagnostics.push('adverse-durable-verdict');
+    const canonical148 = ISSUE_148.test(issueLinks.join('\n')) && planPath === 'docs/plans/2026-09-14-awm-facts-plan.md' && (0, store_1.detectBranch)(root) === 'codex/issue-148-awm-facts' && !!binding?.boundAt;
+    const tasks = taskIds.map(id => {
+        const task = journal.state?.tasks.find(candidate => candidate.id === id);
+        // A binding alone is not task evidence. #148 only changes once a record
+        // linked to this task is newer than binding.boundAt; this journal schema
+        // lacks per-task commit provenance, so retain the conservative state.
+        if (canonical148 && (id === '1' || id === '2'))
+            return { id, state: 'pending', missing: ['task-provenance-after-binding'] };
+        if (!task)
+            return { id, state: 'unstarted', missing: [] };
+        const reconciled = reconcileTaskEvidence(id, facts);
+        return task.status === 'done' && reconciled.state === 'completed'
+            ? reconciled : { ...reconciled, state: 'pending' };
+    });
+    if (canonical148 && !binding)
+        diagnostics.push('issue-148-checkpoint-not-durably-bound');
+    if (tasks.some(task => task.state === 'pending'))
+        diagnostics.push('missing-durable-task-evidence');
+    const state = diagnostics.some(d => d.startsWith('adverse')) ? 'blocked' : diagnostics.length ? 'planning-required' : tasks.some(task => task.state === 'completed') ? 'supported-completion' : 'planning-required';
+    return { state, ...(plan.state === 'valid' ? { planDigest: digest } : {}), issueLinks: [...issueLinks], tasks, diagnostics, facts };
+}
+/** Bounded #148 dry-run source. Historical roots are deliberately limited to a
+ * sibling worktree of this repository; arbitrary external directories are never
+ * treated as durable migration evidence. */
+function collectIssue148HistoricalFacts(historicalRoot, issueLinks) {
+    validateIssueLinks(issueLinks);
+    if (!issueLinks.some(link => ISSUE_148.test(link)))
+        throw new Error('issue-148 migration requires durable #126 and #148 links');
+    const root = fs_1.default.realpathSync(historicalRoot);
+    const expected = path_1.default.join(path_1.default.dirname(fs_1.default.realpathSync(process.cwd())), 'codex-issue-148-awm-facts');
+    if (root !== expected)
+        throw new Error('historical root is not the admitted issue-148 sibling worktree');
+    const branch = (0, child_process_1.execFileSync)('git', ['branch', '--show-current'], { cwd: root, encoding: 'utf8', stdio: 'pipe', timeout: 2000 }).trim();
+    if (branch !== 'codex/issue-148-awm-facts')
+        throw new Error('historical root is not the admitted issue-148 branch');
+    const issue126 = issueLinks.find(link => ISSUE_126.test(link));
+    if (!issue126 || !safeIssue(issue126) || !issueLinks.some(link => safeIssue(link) && ISSUE_148.test(link)))
+        throw new Error('issue-148 migration requires durable #126 and #148 links');
+    const planPath = 'docs/plans/2026-09-14-awm-facts-plan.md';
+    const text = readPlan(root, planPath);
+    const digest = crypto_1.default.createHash('sha256').update(text, 'utf8').digest('hex');
+    const ledgerPath = '.awm/ledger/codex__issue-148-awm-facts.jsonl';
+    let ledgerEntries = [];
+    try {
+        ledgerEntries = readContainedRegularFile(root, ledgerPath, 256 * 1024, 'issue-148 ledger').toString('utf8').trim().split('\n').filter(Boolean).map(line => {
+            const value = JSON.parse(line);
+            if (!value || typeof value !== 'object')
+                throw new Error();
+            const item = value;
+            if (typeof item.branch !== 'string' || typeof item.phase !== 'string' || typeof item.source_skill !== 'string' || typeof item.polarity !== 'string' || typeof item.signature !== 'string' || typeof item.ref !== 'string')
+                throw new Error();
+            if (item.ts !== undefined && typeof item.ts !== 'string')
+                throw new Error();
+            return { branch: item.branch, phase: item.phase, source_skill: item.source_skill, polarity: item.polarity, signature: item.signature, ref: item.ref, ...(typeof item.ts === 'string' ? { ts: item.ts } : {}) };
+        });
+    }
+    catch {
+        ledgerEntries = [];
+    }
+    const checkpoint = '81c008c5f681e6ecfe30a3fc73bf7b79d094c094';
+    const ancestor = (() => {
+        try {
+            for (const commit of ['91047f5041a447b85243ea25b91652aef41151bd', '1207e61c5b206ad8693f5c5d6b9ab5ab19cd8a6f', checkpoint])
+                (0, child_process_1.execFileSync)('git', ['merge-base', '--is-ancestor', commit, 'HEAD'], { cwd: root, stdio: 'pipe', timeout: 2000 });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    })();
+    const taskOneStart = text.search(/^### Task 1:/m);
+    const taskOneEnd = text.indexOf('\n### Task ', taskOneStart + 1);
+    const taskOneSection = taskOneStart < 0 ? '' : text.slice(taskOneStart, taskOneEnd < 0 ? text.length : taskOneEnd);
+    const taskOneChecked = /^- \[x\]/m.test(taskOneSection);
+    const taskOneFiles = new Set(taskFiles(text, '1'));
+    const currentTaskOneFiles = (() => {
+        if (taskOneFiles.size === 0)
+            return false;
+        try {
+            const checkpointFiles = (0, child_process_1.execFileSync)('git', ['ls-tree', '--name-only', '-r', checkpoint, '--', ...taskOneFiles], { cwd: root, encoding: 'utf8', stdio: 'pipe', timeout: 2000 }).trim().split('\n');
+            if ([...taskOneFiles].some(file => !checkpointFiles.includes(file)))
+                return false;
+            (0, child_process_1.execFileSync)('git', ['diff', '--quiet', checkpoint, '--', ...taskOneFiles], { cwd: root, stdio: 'pipe', timeout: 2000 });
+            (0, child_process_1.execFileSync)('git', ['diff', '--cached', '--quiet', checkpoint, '--', ...taskOneFiles], { cwd: root, stdio: 'pipe', timeout: 2000 });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    })();
+    const ledgerReviews = (() => { try {
+        return (0, historical_provenance_1.hasIssue148ReviewProvenance)(ledgerEntries);
+    }
+    catch {
+        return false;
+    } })();
+    const taskIds = ids(text);
+    const proven = digest === 'c11477dd59cb19094983c671cc0b760f1d1e51b9679e13dba90f1b0c2cba48e7' && ancestor && currentTaskOneFiles && taskOneChecked && ledgerReviews;
+    // A checked historical antecedent without sufficient provenance is not
+    // unstarted. Preserve it for reconciliation; never imply permission to
+    // replay its implementation or borrow another task's review.
+    const tasks = taskIds.map(id => id === '1' && proven ? { id, state: 'completed', missing: [] } : id === '1' && taskOneChecked ? { id, state: 'pending', missing: ['historical-completion-provenance'] } : id === '2' ? { id, state: 'pending', missing: ['quality-review'] } : { id, state: 'unstarted', missing: [] });
+    return { state: proven ? 'planning-required' : 'blocked', planDigest: digest, issueLinks: [...issueLinks], tasks, diagnostics: proven ? ['Task 2 quality re-review remains'] : ['issue-148 historical provenance is incomplete or inconsistent'], facts: [{ taskId: '1', issue126 }] };
+}

package/dist/src/core/model-policy/canonical.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalPolicyDigest = canonicalPolicyDigest;
+const node_crypto_1 = require("node:crypto");
+const validate_1 = require("./validate");
+function canonical(value) {
+    if (value === null || typeof value !== 'object') {
+        const serialized = JSON.stringify(value);
+        if (serialized === undefined)
+            throw new Error('Invalid canonical value');
+        return serialized;
+    }
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    const object = value;
+    return `{${Object.keys(object).sort().map(key => `${JSON.stringify(key)}:${canonical(object[key])}`).join(',')}}`;
+}
+function canonicalPolicyDigest(content) { const validated = (0, validate_1.validatePolicyContent)(content); return (0, node_crypto_1.createHash)('sha256').update(canonical(validated), 'utf8').digest('hex'); }