agentic-workflow-manager 9.8.0 → 9.10.0

package/dist/src/commands/job/gate.js

@@ -3,6 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.computeGate = computeGate;
 exports.computeTrackGate = computeTrackGate;
 const LIVE = ['received', 'spawn-intent', 'claimed', 'running', 'cancel-requested'];
+function sameSelection(left, right) {
+    return left.selector.kind === right.selector.kind && left.selector.id === right.selector.id && left.effort.kind === right.effort.kind && left.effort.value === right.effort.value;
+}
 function evaluateEvidence(state, fingerprintNow, scope) {
     const reasons = [];
     if (state.cycle.status === 'BLOCKED') {
@@ -123,6 +126,21 @@ function evaluateEvidence(state, fingerprintNow, scope) {
         }
     }
     for (const v of state.verdicts) {
+        if (v.routingAttemptId !== undefined) {
+            const attempt = state.routingAttempts?.find((candidate) => candidate.id === v.routingAttemptId);
+            const binding = state.planBinding;
+            const bound = binding !== undefined && binding.digest === attempt?.envelope.planDigest && binding.executionDigest === attempt?.envelope.executionDigest;
+            const observed = attempt?.observed;
+            const selectionMatches = attempt !== undefined && observed !== undefined && sameSelection(observed, attempt.envelope.resolved);
+            // A reported actual selection is authoritative: degradation may
+            // explain absent observability, never excuse an observed mismatch.
+            const nativeObservationValid = observed !== undefined
+                ? selectionMatches
+                : attempt?.envelope.outcome === 'degraded' && (attempt.envelope.unavailableEvidence.length ?? 0) > 0 && Boolean(attempt.reasonCode);
+            if (attempt === undefined || !['active', 'complete'].includes(attempt.state) || !attempt.nativeAgentId || attempt.obligationId !== v.obligationId || attempt.fingerprint !== v.fingerprint || !bound || !nativeObservationValid) {
+                reasons.push({ category: 'routing-evidence', detail: `verdict routed ${v.id} no tiene evidencia de intento observado, vigente y ligado` });
+            }
+        }
         if (v.result !== 'pass') {
             const fix = state.fixes.find((f) => f.verdictId === v.id);
             if (fix === undefined || !fix.closed)

package/dist/src/commands/job/index.js

@@ -23,6 +23,9 @@ const paths_1 = require("../../core/journal/paths");
 const lock_1 = require("../watch/lock");
 const atomic_file_1 = require("../../core/atomic-file");
 const context_1 = require("../../core/tracks/context");
+const journal_1 = require("../../core/model-policy/journal");
+const types_1 = require("../../core/journal/types");
+const json_1 = require("../../core/plan/json");
 const fs_1 = __importDefault(require("fs"));
 function branchOf(cwd) {
     // stdio explicito (ver EXEC_STDIO en journal/process.ts): evita el relay
@@ -43,6 +46,19 @@ function realFingerprintNow(repo) {
         }
     };
 }
+function readBoundedJson(file) {
+    if (typeof file !== 'string' || file.length === 0 || file.length > 4096)
+        throw new Error('routing file path is invalid');
+    const stat = fs_1.default.lstatSync(file);
+    if (stat.isSymbolicLink() || !stat.isFile() || stat.size > 256 * 1024)
+        throw new Error('routing file must be a bounded non-symlink regular file');
+    try {
+        return (0, json_1.parseJsonNoDuplicate)(fs_1.default.readFileSync(file, 'utf8'));
+    }
+    catch {
+        throw new Error('routing file must contain JSON without duplicate keys');
+    }
+}
 /** Guard de entrada (R9.4): sin descriptor de track, es un no-op — el caso
  *  comun de siempre no paga costo ni riesgo nuevo. Con descriptor presente
  *  que no autentica (fencing/realpath/journalId no coinciden), rechaza ANTES
@@ -143,6 +159,36 @@ function registerJobCommand(program) {
         assertAuthenticatedCwd(repo, branch);
         (0, heartbeat_1.emitHeartbeat)(repo, branch, opts.generation);
     });
+    job.command('routing-reserve')
+        .requiredOption('--generation <token>').requiredOption('--obligation <id>').requiredOption('--lineage <id>')
+        .requiredOption('--envelope-file <file>').requiredOption('--fingerprint <sha>').option('--cwd <root>', 'repository root', '.').option('--json')
+        .action((opts) => {
+        const envelope = readBoundedJson(opts.envelopeFile);
+        if (!(0, types_1.isRoutingEnvelope)(envelope) || !/^[a-f0-9]{64}$/.test(opts.fingerprint))
+            throw new Error('routing-reserve requires a valid envelope and fingerprint');
+        const repo = path_1.default.resolve(opts.cwd);
+        const branch = branchOf(repo);
+        assertAuthenticatedCwd(repo, branch);
+        const emitted = (0, requests_1.emitRequest)(repo, branch, { kind: 'routing-reserve', generationToken: opts.generation, idempotencyKey: crypto_1.default.createHash('sha256').update(`routing-reserve:${opts.generation}:${opts.obligation}:${opts.lineage}:${opts.fingerprint}:${JSON.stringify(envelope)}`).digest('hex'), payload: { obligationId: opts.obligation, lineageId: opts.lineage, envelope, fingerprint: opts.fingerprint } });
+        process.stdout.write(JSON.stringify({ requestId: emitted.requestId }) + '\n');
+    });
+    job.command('routing-observe')
+        .requiredOption('--generation <token>').requiredOption('--attempt <id>').requiredOption('--native-agent-id <id>')
+        .requiredOption('--observation-file <file>').option('--cwd <root>', 'repository root', '.').option('--json')
+        .action((opts) => {
+        const observation = readBoundedJson(opts.observationFile);
+        if (typeof observation !== 'object' || observation === null || Array.isArray(observation))
+            throw new Error('routing-observe requires an observation object');
+        const observed = observation.observed;
+        const unavailableReason = observation.unavailableReason;
+        if ((observed !== undefined && !(0, types_1.isRoutingSelection)(observed)) || (unavailableReason !== undefined && typeof unavailableReason !== 'string'))
+            throw new Error('routing-observe requires a valid observation');
+        const repo = path_1.default.resolve(opts.cwd);
+        const branch = branchOf(repo);
+        assertAuthenticatedCwd(repo, branch);
+        const emitted = (0, requests_1.emitRequest)(repo, branch, { kind: 'routing-observe', generationToken: opts.generation, idempotencyKey: crypto_1.default.createHash('sha256').update(`routing-observe:${opts.generation}:${opts.attempt}:${opts.nativeAgentId}:${JSON.stringify(observation)}`).digest('hex'), payload: { attemptId: opts.attempt, nativeAgentId: opts.nativeAgentId, ...(observed === undefined ? {} : { observed }), ...(unavailableReason === undefined ? {} : { unavailableReason }) } });
+        process.stdout.write(JSON.stringify({ requestId: emitted.requestId }) + '\n');
+    });
     job.command('ps').action(() => {
         const repo = process.cwd();
         const branch = branchOf(repo);
@@ -216,6 +262,21 @@ function registerJobCommand(program) {
         if (!g.pass)
             process.exit(1); // falla cerrado (R3.2)
     });
+    job.command('routing-report')
+        .description('informe de routing read-only; nunca expone envelopes ni identidad nativa')
+        .option('--json', 'emit the routing report as JSON')
+        .action(() => {
+        const repo = process.cwd();
+        const branch = branchOf(repo);
+        assertAuthenticatedCwd(repo, branch);
+        const r = (0, store_1.readJournal)(repo, branch);
+        if (r.corrupt || r.state === null) {
+            process.stdout.write(JSON.stringify({ corruptState: true }) + '\n');
+            process.exit(1);
+            return;
+        }
+        process.stdout.write(JSON.stringify((0, journal_1.routingReport)(r.state), null, 2) + '\n');
+    });
     job.command('reap')
         .description('lista procesos de jobs (identidad completa); --execute --jobs <ids...> para terminar confirmando')
         .option('--execute', 'ejecutar la terminacion de los jobs listados en --jobs')

package/dist/src/commands/model-policy/index.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerModelPolicyCommand = registerModelPolicyCommand;
+const crypto_1 = require("crypto");
+const providers_1 = require("../../providers");
+const store_1 = require("../../core/model-policy/store");
+const validate_1 = require("../../core/model-policy/validate");
+const capabilities_1 = require("../../core/model-policy/capabilities");
+const digest_1 = require("../../core/model-policy/digest");
+const roles = ['implementer', 'specification-reviewer', 'code-quality-reviewer', 'final-reviewer', 'architecture', 'track-a-qa', 'track-b-qa', 'controller', 'documentation', 'retro', 'finishing'];
+const implementerProfiles = ['mechanical', 'integration', 'judgment'];
+const contract = { schema: 'routing-protocol/v1', supportedPlanSchemas: ['compact-slices/v1', 'compact-slices/v2'], roles, implementerProfiles, limits: { maxFileBytes: validate_1.MAX_POLICY_BYTES, maxMappings: validate_1.MAX_MAPPINGS, maxIdentifierChars: 128, maxDiagnostics: 20, maxDiagnosticChars: 4096 } };
+const protocolDigest = (0, crypto_1.createHash)('sha256').update(JSON.stringify(contract), 'utf8').digest('hex');
+function text(value, label) { if (typeof value !== 'string' || value.length === 0 || value.startsWith('--') || value.length > 4096 || /[\u0000-\u001f\u007f-\u009f]/.test(value))
+    throw new Error(`${label} requires a non-empty value without control characters`); }
+function output(value, json) { process.stdout.write(json ? `${JSON.stringify(value)}\n` : `${JSON.stringify(value, null, 2)}\n`); }
+function registerModelPolicyCommand(program, deps = {}) {
+    if (!program || typeof program.command !== 'function')
+        throw new Error('program must be a Commander command');
+    const approve = deps.approvePolicy ?? store_1.approvePolicy;
+    const read = deps.readEffectivePolicy ?? store_1.readEffectivePolicy;
+    const approveReceipt = deps.approveCapabilities ?? capabilities_1.approveCapabilities;
+    const readReceipt = deps.readCapabilities ?? capabilities_1.readCapabilities;
+    const digest = deps.candidateDigest ?? digest_1.candidateDigest;
+    const command = program.command('model-policy').description('inspect and explicitly approve portable routing policy');
+    command.command('contract').option('--cwd <path>').option('--json').action((options) => { if (options.cwd !== undefined)
+        text(options.cwd, '--cwd'); output({ ...contract, protocolDigest }, options.json === true); });
+    // Approval demands --expected-digest so that it stays an explicit operator
+    // act. Without a way to observe the digest first, that safeguard blocked the
+    // legitimate path instead of gating it, and the only way through was to
+    // reimplement canonicalisation outside the CLI — the second parser the
+    // admission contract forbids. This discloses the digest and approves nothing.
+    command.command('digest').description('compute the canonical digest of a candidate policy or capability receipt without approving it').requiredOption('--file <path>').option('--cwd <path>').option('--json').action((options) => {
+        text(options.file, '--file');
+        if (options.cwd !== undefined)
+            text(options.cwd, '--cwd');
+        output(digest({ file: options.file, cwd: options.cwd ?? process.cwd() }), options.json === true);
+    });
+    command.command('approve').requiredOption('--file <path>').requiredOption('--scope <scope>').requiredOption('--expected-digest <sha>').option('--replace-digest <sha>').option('--cwd <path>').option('--json').action((options) => {
+        text(options.file, '--file');
+        text(options.scope, '--scope');
+        text(options.expectedDigest, '--expected-digest');
+        if (options.cwd !== undefined)
+            text(options.cwd, '--cwd');
+        if (options.replaceDigest !== undefined)
+            text(options.replaceDigest, '--replace-digest');
+        (0, validate_1.assertDigest)(options.expectedDigest, 'expectedDigest');
+        if (options.replaceDigest !== undefined)
+            (0, validate_1.assertDigest)(options.replaceDigest, 'replaceDigest');
+        const policy = approve({ file: options.file, scope: options.scope, cwd: options.cwd ?? process.cwd(), expectedDigest: options.expectedDigest, replaceDigest: options.replaceDigest });
+        output({ state: 'approved', policy }, options.json === true);
+    });
+    // `command('capabilities approve')` registered ONE command named
+    // `capabilities` with a required positional `<approve>`, so Commander called
+    // the action as (positional, options, command) and the handler's first
+    // parameter — read as `options` — was the string 'approve'. Every invocation
+    // therefore died on `--file requires a non-empty value`, and the path could
+    // never approve anything. A real subcommand group keeps the invocation
+    // spelling identical and gives the action the options object it expects.
+    const capabilities = command.command('capabilities').description('inspect and explicitly approve runtime capability attestations');
+    capabilities.command('approve').requiredOption('--file <path>').requiredOption('--expected-digest <sha>').option('--replace-digest <sha>').option('--cwd <path>').option('--json').action((options) => {
+        text(options.file, '--file');
+        text(options.expectedDigest, '--expected-digest');
+        if (options.replaceDigest !== undefined)
+            text(options.replaceDigest, '--replace-digest');
+        if (options.cwd !== undefined)
+            text(options.cwd, '--cwd');
+        (0, validate_1.assertDigest)(options.expectedDigest, 'expectedDigest');
+        if (options.replaceDigest)
+            (0, validate_1.assertDigest)(options.replaceDigest, 'replaceDigest');
+        output({ state: 'approved', receipt: approveReceipt({ file: options.file, cwd: options.cwd ?? process.cwd(), expectedDigest: options.expectedDigest, replaceDigest: options.replaceDigest }) }, options.json === true);
+    });
+    command.command('status').requiredOption('--provider <target>').requiredOption('--runtime-kind <kind>').requiredOption('--runtime-version <version>').requiredOption('--account-scope-digest <sha>').option('--cwd <path>').option('--json').action((options) => {
+        text(options.provider, '--provider');
+        text(options.runtimeKind, '--runtime-kind');
+        text(options.runtimeVersion, '--runtime-version');
+        text(options.accountScopeDigest, '--account-scope-digest');
+        if (options.cwd !== undefined)
+            text(options.cwd, '--cwd');
+        if (!providers_1.AGENT_TARGETS.includes(options.provider))
+            throw new Error('--provider is invalid');
+        if (!/^[a-z0-9][a-z0-9_-]{0,127}$/.test(options.runtimeKind))
+            throw new Error('--runtime-kind is invalid');
+        if (!/^\d+\.\d+\.\d+$/.test(options.runtimeVersion))
+            throw new Error('--runtime-version must be numeric semver');
+        (0, validate_1.assertDigest)(options.accountScopeDigest, 'accountScopeDigest');
+        const cwd = options.cwd ?? process.cwd();
+        const effective = read(cwd);
+        const capability = readReceipt({ target: options.provider, kind: options.runtimeKind, version: options.runtimeVersion, accountScopeDigest: options.accountScopeDigest }, new Date());
+        output({ policy: effective, capability }, options.json === true);
+        if (effective.state !== 'approved' || capability.state !== 'current')
+            process.exitCode = 2;
+    });
+}

package/dist/src/commands/plan/index.js

@@ -18,7 +18,11 @@ const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const store_1 = require("../../core/journal/store");
 const migration_1 = require("../../core/migration");
-const SUPPORTED_SCHEMA = 'compact-slices/v1';
+const store_2 = require("../../core/model-policy/store");
+const capabilities_1 = require("../../core/model-policy/capabilities");
+const resolve_1 = require("../../core/model-policy/resolve");
+const journal_1 = require("../../core/model-policy/journal");
+const SUPPORTED_SCHEMA = 'compact-slices/v1, compact-slices/v2';
 const MAX_PATH_LENGTH = 4096;
 const MAX_DIAGNOSTICS = 20;
 const MAX_DIAGNOSTIC_LENGTH = 4096;
@@ -140,6 +144,53 @@ function registerPlanCommand(program, deps = { validatePlanFile: validate_1.vali
         throw new Error('program must be a Commander command');
     assertDependencies(deps);
     const plan = program.command('plan').description('inspect plan contracts');
+    plan.command('resolve <plan-path>').requiredOption('--provider <target>').requiredOption('--runtime-kind <kind>').requiredOption('--runtime-version <version>').requiredOption('--account-scope-digest <sha>').requiredOption('--role <role>').option('--opt-in-v1').option('--slice <id>').option('--lineage <id>').option('--cwd <path>').option('--json').action((planPath, options) => {
+        assertText(planPath, 'plan path');
+        for (const [value, label] of [[options.provider, '--provider'], [options.runtimeKind, '--runtime-kind'], [options.runtimeVersion, '--runtime-version'], [options.accountScopeDigest, '--account-scope-digest'], [options.role, '--role']])
+            assertText(value, label);
+        if (options.slice)
+            assertText(options.slice, '--slice');
+        if (options.lineage)
+            assertText(options.lineage, '--lineage');
+        const cwd = options.cwd ?? process.cwd();
+        assertText(cwd, '--cwd');
+        const report = deps.validatePlanFile(planPath, cwd);
+        assertReport(report);
+        if (report.state !== 'valid') {
+            process.stdout.write(options.json ? `${JSON.stringify({ state: 'blocked', diagnostics: report.state === 'invalid' ? report.diagnostics : [{ code: 'ROUTING_PLAN_INVALID', message: 'Plan must validate before resolution.' }] })}\n` : 'Plan routing: blocked\n');
+            process.exitCode = 2;
+            return;
+        }
+        if (options.lineage) {
+            if (report.schema !== 'compact-slices/v2') {
+                process.stdout.write(options.json ? `${JSON.stringify({ state: 'blocked', diagnostics: [{ code: 'ROUTING_LINEAGE_V1', message: 'Lineage routing is only available for compact v2 plans.' }] })}\n` : 'Plan routing: blocked\n');
+                process.exitCode = 2;
+                return;
+            }
+            const observed = journalObservation(cwd);
+            const binding = observed.journalState?.planBinding;
+            const attempts = observed.journalState?.routingAttempts?.filter((attempt) => attempt.lineageId === options.lineage) ?? [];
+            const lineage = observed.journalState?.implementationLineages?.find((candidate) => candidate.id === options.lineage);
+            const bound = !observed.journalCorrupt && binding?.digest === report.planDigest && binding.executionDigest === report.executionDigest;
+            const lineageMatches = lineage !== undefined && lineage.sliceId === options.slice && lineage.planDigest === report.planDigest && lineage.executionDigest === report.executionDigest && attempts.every((attempt) => attempt.obligationId === lineage.obligationId && attempt.envelope.sliceId === options.slice);
+            if (!bound || !lineageMatches || attempts.length > 3 || attempts.some((attempt) => attempt.envelope.planDigest !== report.planDigest || attempt.envelope.executionDigest !== report.executionDigest || ['unknown', 'reserved', 'active'].includes(attempt.state))) {
+                process.stdout.write(options.json ? `${JSON.stringify({ state: 'blocked', diagnostics: [{ code: 'ROUTING_LINEAGE_UNBOUND', message: 'Lineage routing requires a current journal binding and non-unknown matching attempts.' }] })}\n` : 'Plan routing: blocked\n');
+                process.exitCode = 2;
+                return;
+            }
+        }
+        const roles = ['implementer', 'specification-reviewer', 'code-quality-reviewer', 'final-reviewer', 'architecture', 'track-a-qa', 'track-b-qa', 'controller', 'documentation', 'retro', 'finishing'];
+        if (!roles.includes(options.role))
+            throw new Error('--role is invalid');
+        const runtime = (0, capabilities_1.validateRuntimeKey)({ target: options.provider, kind: options.runtimeKind, version: options.runtimeVersion, accountScopeDigest: options.accountScopeDigest });
+        const result = report.schema === 'compact-slices/v1' && !options.optInV1 ? (0, resolve_1.resolveDispatch)({ plan: report, role: options.role, policy: undefined, capabilities: undefined, runtime, now: new Date(), optInV1: false }) : (() => { const policy = (deps.readEffectivePolicy ?? store_2.readEffectivePolicy)(cwd); const capabilities = (deps.readCapabilities ?? capabilities_1.readCapabilities)(runtime, new Date()); if (!options.lineage)
+            return (0, resolve_1.resolveDispatch)({ plan: report, role: options.role, sliceId: options.slice, policy: policy.state === 'approved' ? policy.policy : undefined, capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined, runtime, now: new Date(), optInV1: options.optInV1 === true }); const state = journalObservation(cwd).journalState; const lineage = state.implementationLineages.find(candidate => candidate.id === options.lineage); const next = (0, journal_1.resolveLineageEscalation)(state, options.lineage, lineage.initialProfile); const resolved = (0, resolve_1.resolveSelection)({ role: 'implementer', requestedProfile: next.profile, policy: policy.state === 'approved' ? policy.policy : undefined, capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined, runtime, now: new Date() }); if (resolved.state === 'blocked')
+            return resolved; const highRequiresFull = next.effort !== 'high' || (policy.state === 'approved' && (() => { const full = policy.policy.content.mappings.find(row => row.target === runtime.target && row.runtimeKind === runtime.kind)?.fullCapability; return full?.selector.kind === resolved.selection.selector.kind && full.selector.id === resolved.selection.selector.id && full.effort.kind === 'explicit' && full.effort.value === 'high'; })()); if (resolved.selection.effort.kind !== 'explicit' || resolved.selection.effort.value !== next.effort || !highRequiresFull)
+            return { state: 'blocked', diagnostics: [{ code: 'ROUTING_ESCALATION_EFFORT_UNAVAILABLE', message: 'The approved selected effort does not match the next lineage escalation.' }] }; return { ...resolved, envelope: { schema: 'routing-envelope/v1', runtime, role: 'implementer', planDigest: report.planDigest, executionDigest: report.executionDigest, sliceId: lineage.sliceId, requestedProfile: lineage.initialProfile, effectiveProfile: next.profile, resolved: resolved.selection, policyDigest: resolved.policyDigest, capabilityDigest: resolved.capabilityDigest, outcome: resolved.outcome, unavailableEvidence: resolved.unavailableEvidence }, custodyHandoff: { kind: 'routing-reserve', obligationId: lineage.obligationId, lineageId: lineage.id } }; })();
+        process.stdout.write(options.json ? `${JSON.stringify(result)}\n` : `Plan routing: ${result.state}\n`);
+        if (result.state === 'blocked')
+            process.exitCode = 2;
+    });
     plan.command('migration-facts <plan-path>')
         .description('collect read-only durable migration facts')
         .option('--cwd <path>')
@@ -179,6 +230,9 @@ function registerPlanCommand(program, deps = { validatePlanFile: validate_1.vali
         .option('--execution-mode <mode>', 'explicit override: interactivo or desatendido')
         .option('--require-current', 'require authoritative consumed-contract currentness')
         .option('--verify-sensors', 'require an empirical sensor pass')
+        .option('--runtime-kind <kind>', 'routing runtime kind for compact v2')
+        .option('--runtime-version <version>', 'routing runtime version for compact v2')
+        .option('--account-scope-digest <sha>', 'routing account scope digest for compact v2')
         .option('--json', 'emit one stable JSON report')
         .action(async (planPath, options) => {
         assertText(planPath, 'plan path');
@@ -208,7 +262,10 @@ function registerPlanCommand(program, deps = { validatePlanFile: validate_1.vali
             process.exitCode = 2;
             return;
         }
-        const report = await (0, registry_contracts_1.admitRegistryPlan)({ plan: planReport, provider: options.provider, cwd: options.cwd, enabledAgents, executionMode, planPath: normalizedPlanPath, ...journal, requireCurrent: options.requireCurrent === true, verifySensors: options.verifySensors === true }, { admitPlan: admission, listRegistries: registryInventory, checkCurrentness: currentnessCheck, runSensors: sensorRun });
+        const readRouting = () => { if (!options.runtimeKind || !options.runtimeVersion || !options.accountScopeDigest)
+            return undefined; const runtime = (0, capabilities_1.validateRuntimeKey)({ target: options.provider, kind: options.runtimeKind, version: options.runtimeVersion, accountScopeDigest: options.accountScopeDigest }); const policy = (deps.readEffectivePolicy ?? store_2.readEffectivePolicy)(options.cwd); const at = deps.routingNow?.() ?? new Date(); if (!(at instanceof Date) || !Number.isFinite(at.getTime()))
+            throw new Error('routingNow must return a finite Date'); const capabilities = (deps.readCapabilities ?? capabilities_1.readCapabilities)(runtime, at); return { runtime, policy: policy.state === 'approved' ? policy.policy : undefined, capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined, now: at }; };
+        const report = await (0, registry_contracts_1.admitRegistryPlan)({ plan: planReport, provider: options.provider, cwd: options.cwd, enabledAgents, executionMode, planPath: normalizedPlanPath, ...journal, requireCurrent: options.requireCurrent === true, verifySensors: options.verifySensors === true }, { admitPlan: admission, listRegistries: registryInventory, checkCurrentness: currentnessCheck, runSensors: sensorRun, readRouting });
         process.stdout.write(admissionOutput(report, options.json === true));
         if (report.state !== 'admitted')
             process.exitCode = 2;

package/dist/src/commands/watch/apply.js

@@ -18,6 +18,8 @@ const paths_1 = require("../../core/journal/paths");
 const atomic_file_1 = require("../../core/atomic-file");
 const redact_1 = require("../../core/journal/redact");
 const git_1 = require("../../core/tracks/git");
+const types_1 = require("../../core/journal/types");
+const journal_1 = require("../../core/model-policy/journal");
 function now() { return new Date().toISOString(); }
 const VERIFICATION_KINDS = ['test', 'lint', 'sensors', 'review', 'qa', 'interlock', 'track-integration'];
 function verificationItems(value, field) {
@@ -110,6 +112,24 @@ function applyRequestToState(s, env, digest, repoRoot) {
         (0, requests_1.applyOutcome)(s, { ...base, outcome: 'applied' });
         return;
     }
+    if (env.kind === 'routing-reserve') {
+        const p = env.payload;
+        if (typeof p.obligationId !== 'string' || typeof p.lineageId !== 'string' || !(0, types_1.isRoutingEnvelope)(p.envelope) || typeof p.fingerprint !== 'string' || (p.at !== undefined && typeof p.at !== 'string'))
+            throw new Error('routing-reserve requiere payload estricto');
+        const reserved = (0, journal_1.reserveRoutingAttempt)(s, { obligationId: p.obligationId, lineageId: p.lineageId, envelope: p.envelope, fingerprint: p.fingerprint }, p.at ?? now());
+        Object.assign(s, reserved.state);
+        (0, requests_1.applyOutcome)(s, { ...base, outcome: 'applied', resultRef: reserved.attemptId });
+        return;
+    }
+    if (env.kind === 'routing-observe') {
+        const p = env.payload;
+        if (typeof p.attemptId !== 'string' || typeof p.nativeAgentId !== 'string' || (p.observed !== undefined && !(0, types_1.isRoutingSelection)(p.observed)) || (p.unavailableReason !== undefined && typeof p.unavailableReason !== 'string') || (p.at !== undefined && typeof p.at !== 'string'))
+            throw new Error('routing-observe requiere payload estricto');
+        const observed = (0, journal_1.observeRoutingAttempt)(s, { attemptId: p.attemptId, nativeAgentId: p.nativeAgentId, ...(p.observed === undefined ? {} : { observed: p.observed }), ...(p.unavailableReason === undefined ? {} : { unavailableReason: p.unavailableReason }) }, p.at ?? now());
+        Object.assign(s, observed);
+        (0, requests_1.applyOutcome)(s, { ...base, outcome: 'applied', resultRef: p.attemptId });
+        return;
+    }
     if (env.kind === 'job-request') {
         // get-or-create por idempotencyKey (RNF-T.7); duplicado => applyOutcome
         // registra el ALIAS con el mismo resultRef (Task 8).
@@ -449,11 +469,23 @@ function applyRequestToState(s, env, digest, repoRoot) {
         }
         if (!s.verdicts.some((v) => v.id === verdictId)) {
             const result = p.result;
+            if (p.routingAttemptId !== undefined) {
+                if (typeof p.routingAttemptId !== 'string')
+                    throw new Error('verdict routed requiere routingAttemptId valido');
+                const attempt = s.routingAttempts?.find(candidate => candidate.id === p.routingAttemptId);
+                if (!attempt || attempt.obligationId !== obligationId || attempt.state !== 'active')
+                    throw new Error('verdict routed requiere intento activo ligado a la obligacion');
+                attempt.state = result === 'pass' ? 'complete' : 'blocked';
+                attempt.verdict = result;
+                if (typeof p.reasonCode === 'string' && p.reasonCode.length > 0 && p.reasonCode.length <= 128)
+                    attempt.reasonCode = p.reasonCode;
+            }
             // R2.3: redaccion tambien en el `detail` de texto libre humano, no
             // solo en argv — antes de cualquier escritura durable.
             s.verdicts.push({
                 id: verdictId, obligationId, result, detail: (0, redact_1.redactText)(String(p.detail ?? '')), receivedAt: now(),
                 fingerprint: p.fingerprint, argv: verdictArgv, paths: verdictPaths, cwd: p.cwd,
+                ...(typeof p.routingAttemptId === 'string' ? { routingAttemptId: p.routingAttemptId } : {}),
             });
             for (const t of s.tasks) {
                 const o = t.reviewObligations.find((x) => x.id === obligationId);

package/dist/src/core/admission/index.js

@@ -5,6 +5,8 @@ exports.sanitizeAdmissionReport = sanitizeAdmissionReport;
 exports.admitPlan = admitPlan;
 const providers_1 = require("../../providers");
 const paths_1 = require("../journal/paths");
+const resolve_1 = require("../model-policy/resolve");
+const capabilities_1 = require("../model-policy/capabilities");
 const UNKNOWN = {
     artifactDelivery: 'unverified', interactiveExecution: 'unverified', unattendedController: 'unverified', nativeSubagents: 'unverified',
     modelOverride: 'unverified', effortOverride: 'unverified', observedModelEvidence: 'unverified', durableResume: 'unverified',
@@ -31,6 +33,17 @@ function forecast(slices) {
     const roles = { implementer: slices, 'specification-reviewer': slices, 'code-quality-reviewer': slices, 'final-reviewer': 1, 'track-a-qa': 1, 'track-b-qa': 1, documentation: 1, retro: 1, finishing: 1 };
     return { kind: 'topology', slices, roles, total: Object.values(roles).reduce((sum, count) => sum + count, 0) };
 }
+function routingForecast(plan, routing) {
+    const profiles = { mechanical: 0, integration: 0, judgment: 0 };
+    for (const slice of plan.manifest.slices)
+        profiles[slice.implementerProfile] += 1;
+    const qa = routing.qaLens;
+    if (qa !== undefined && (!Array.isArray(qa) || qa.length > 64 || new Set(qa).size !== qa.length || qa.some(id => typeof id !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/.test(id))))
+        throw new Error('routing qaLens must be unique validated lens ids');
+    if (routing.controllerCount !== undefined && (!Number.isSafeInteger(routing.controllerCount) || routing.controllerCount < 0 || routing.controllerCount > 1))
+        throw new Error('routing controllerCount must be 0 or 1');
+    return { kind: 'routing-v1', slices: plan.manifest.slices.length, implementerProfiles: profiles, roles: { 'specification-reviewer': plan.manifest.slices.length, 'code-quality-reviewer': plan.manifest.slices.length, 'final-reviewer': 1, 'track-a-qa': 1, documentation: 1, retro: 1, finishing: 1 }, trackB: qa === undefined ? { state: 'unavailable', lowerBound: 1 } : { state: 'known', count: qa.length }, controller: routing.controllerCount === undefined ? { state: 'unavailable', lowerBound: 0 } : { state: 'known', count: routing.controllerCount } };
+}
 function currentness(report, consumedRegistryComponents) {
     const consumed = new Set(['cli', ...consumedRegistryComponents]);
     const present = new Set(report.components.map(component => component.component));
@@ -89,6 +102,18 @@ function validForecast(value) {
         && roles.every(role => record.roles[role] === topology[role])
         && record.total === Object.values(topology).reduce((sum, count) => sum + count, 0);
 }
+function validRoutingForecast(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const record = value;
+    const profiles = record.implementerProfiles;
+    const roles = record.roles;
+    const count = (item) => Number.isSafeInteger(item) && item >= 0;
+    const roleKeys = ['specification-reviewer', 'code-quality-reviewer', 'final-reviewer', 'track-a-qa', 'documentation', 'retro', 'finishing'];
+    return record.kind === 'routing-v1' && Object.keys(record).length === 6 && count(record.slices) && !!profiles && Object.keys(profiles).length === 3 && ['mechanical', 'integration', 'judgment'].every(key => count(profiles[key])) && Object.values(profiles).reduce((sum, profile) => sum + profile, 0) === record.slices && !!roles && typeof roles === 'object' && Object.keys(roles).length === roleKeys.length && roleKeys.every(key => key in roles) && roles['specification-reviewer'] === record.slices && roles['code-quality-reviewer'] === record.slices && ['final-reviewer', 'track-a-qa', 'documentation', 'retro', 'finishing'].every(key => roles[key] === 1)
+        && !!record.trackB && typeof record.trackB === 'object' && ((record.trackB.state === 'known' && count(record.trackB.count)) || (record.trackB.state === 'unavailable' && record.trackB.lowerBound === 1))
+        && !!record.controller && typeof record.controller === 'object' && ((record.controller.state === 'known' && count(record.controller.count)) || (record.controller.state === 'unavailable' && record.controller.lowerBound === 0));
+}
 function validDiagnostics(value) {
     return Array.isArray(value) && value.every(item => item && typeof item === 'object' && typeof item.code === 'string' && typeof item.message === 'string' && (item.field === undefined || typeof item.field === 'string'));
 }
@@ -112,6 +137,8 @@ function sanitizeAdmissionReport(report) {
     }
     if (value.forecast !== undefined && !validForecast(value.forecast))
         invalidAdmission();
+    if (value.routingForecast !== undefined && !validRoutingForecast(value.routingForecast))
+        invalidAdmission();
     const capabilityResolution = value.capabilityResolution === undefined ? undefined : { ...value.capabilityResolution, diagnostics: sanitizeDiagnostics(value.capabilityResolution.diagnostics) };
     return { ...value, ...(capabilityResolution ? { capabilityResolution } : {}), diagnostics: sanitizeDiagnostics(value.diagnostics) };
 }
@@ -167,13 +194,36 @@ async function admitPlan(input) {
         const resolution = { outcome: capabilities.unattendedController === 'supported' ? 'native' : 'blocked', provider, capabilities, evidenceVersion: 'r1-v1', diagnostics: [] };
         if (resolution.outcome === 'blocked')
             return blocked(input, [diagnostic('ADMISSION_CAPABILITY_UNVERIFIED', `Provider ${provider} has no verified unattended execution capability.`)], { planDigest: plan.planDigest, provider, executionMode: mode, journal, currentness: input.requireCurrent ? 'current' : 'not-checked', sensors: input.verifySensors ? 'pass' : 'not-required', capabilityResolution: resolution });
-        return { state: 'admitted', planState: 'valid', planDigest: plan.planDigest, provider, executionMode: mode, journal, currentness: input.requireCurrent ? 'current' : 'not-checked', sensors: input.verifySensors ? 'pass' : 'not-required', capabilityResolution: resolution, forecast: forecast(plan.manifest.slices.length), diagnostics: [] };
+        return completeAdmission(input, plan, provider, mode, journal, input.requireCurrent ? 'current' : 'not-checked', input.verifySensors ? 'pass' : 'not-required', resolution);
     }
     const capabilities = exports.PROVIDER_EXECUTION_CAPABILITIES[provider];
     const resolution = { outcome: capabilities.interactiveExecution === 'supported' ? 'native' : 'blocked', provider, capabilities, evidenceVersion: 'r1-v1', diagnostics: [] };
     if (resolution.outcome === 'blocked')
         return blocked(input, [diagnostic('ADMISSION_CAPABILITY_UNVERIFIED', `Provider ${provider} has no verified interactive execution capability.`)], { planDigest: plan.planDigest, provider, executionMode: mode, capabilityResolution: resolution });
-    return { state: 'admitted', planState: 'valid', planDigest: plan.planDigest, provider, executionMode: mode, journal: 'not-required', currentness: input.requireCurrent ? 'current' : 'not-checked', sensors: input.verifySensors ? 'pass' : 'not-required', capabilityResolution: resolution, forecast: forecast(plan.manifest.slices.length), diagnostics: [] };
+    return completeAdmission(input, plan, provider, mode, 'not-required', input.requireCurrent ? 'current' : 'not-checked', input.verifySensors ? 'pass' : 'not-required', resolution);
+}
+function completeAdmission(input, plan, provider, executionMode, journal, currentness, sensors, capabilityResolution) {
+    if (plan.schema === 'compact-slices/v1')
+        return { state: 'admitted', planState: 'valid', planDigest: plan.planDigest, provider, executionMode, journal, currentness, sensors, capabilityResolution, forecast: forecast(plan.manifest.slices.length), diagnostics: [] };
+    const routing = input.routing ?? input.routingReader?.();
+    if (!routing?.runtime || !routing.policy || !routing.capabilities)
+        return blocked(input, [diagnostic('ADMISSION_ROUTING_FACTS_REQUIRED', 'Compact v2 requires an approved policy, current capability receipt, and runtime identity.')], { planDigest: plan.planDigest, provider, executionMode, journal, currentness, sensors, capabilityResolution });
+    let runtime;
+    try {
+        runtime = (0, capabilities_1.validateRuntimeKey)(routing.runtime);
+    }
+    catch {
+        return blocked(input, [diagnostic('ADMISSION_ROUTING_RUNTIME_INVALID', 'Compact v2 routing runtime identity is invalid.')], { planDigest: plan.planDigest, provider, executionMode, journal, currentness, sensors, capabilityResolution });
+    }
+    if (runtime.target !== provider)
+        return blocked(input, [diagnostic('ADMISSION_ROUTING_PROVIDER_MISMATCH', 'Compact v2 routing runtime target must exactly match the admitted provider.')], { planDigest: plan.planDigest, provider, executionMode, journal, currentness, sensors, capabilityResolution });
+    const now = routing.now ?? new Date();
+    for (const slice of plan.manifest.slices) {
+        const resolved = (0, resolve_1.resolveSelection)({ role: 'implementer', requestedProfile: slice.implementerProfile, policy: routing.policy, capabilities: routing.capabilities, runtime, now });
+        if (resolved.state === 'blocked')
+            return blocked(input, resolved.diagnostics, { planDigest: plan.planDigest, provider, executionMode, journal, currentness, sensors, capabilityResolution });
+    }
+    return { state: 'admitted', planState: 'valid', planDigest: plan.planDigest, provider, executionMode, journal, currentness, sensors, capabilityResolution, forecast: forecast(plan.manifest.slices.length), routingForecast: routingForecast(plan, routing), diagnostics: [] };
 }
 // Structural exhaustiveness guard: adding an AgentTarget requires an explicit entry above.
 const capabilityTargets = providers_1.AGENT_TARGETS;

package/dist/src/core/admission/registry-contracts.js

@@ -286,5 +286,5 @@ async function admitRegistryPlan(input, dependencies = {}) {
             return currentnessGate;
         compatibilityDiagnostics = registryCompatibility(registries, scope.consumedRegistryComponents);
     }
-    return compose({ currentness, compatibilityDiagnostics, sensors });
+    return compose({ currentness, compatibilityDiagnostics, sensors, ...(dependencies.readRouting ? { routingReader: dependencies.readRouting } : {}) });
 }

package/dist/src/core/journal/requests.js

@@ -68,7 +68,7 @@ function emitRequest(repoRoot, branch, env) {
 const KNOWN_KINDS = [
     'job-request', 'register-entity', 'controller-heartbeat', 'verdict',
     'track-prepare-request', 'track-freeze-request', 'track-join-request',
-    'track-teardown-request', 'track-finalize-request',
+    'track-teardown-request', 'track-finalize-request', 'routing-reserve', 'routing-observe',
 ];
 function isRecord(x) {
     return typeof x === 'object' && x !== null && !Array.isArray(x);

package/dist/src/core/journal/types.js

@@ -9,6 +9,8 @@ exports.GENERATION_STATES = exports.EXECUTION_STATES = void 0;
 exports.isControllerRecoveryAction = isControllerRecoveryAction;
 exports.emptyState = emptyState;
 exports.isWellFormedState = isWellFormedState;
+exports.isRoutingSelection = isRoutingSelection;
+exports.isRoutingEnvelope = isRoutingEnvelope;
 exports.isWellFormedProcessRef = isWellFormedProcessRef;
 exports.isWellFormedJob = isWellFormedJob;
 const crypto_1 = __importDefault(require("crypto"));
@@ -39,6 +41,8 @@ function isControllerRecoveryAction(x) {
         && typeof x.kind === 'string'
         && ['resume-cycle', 'resume-next-action', 'reconcile-active-jobs'].includes(x.kind);
 }
+const ROUTING_ROLES = ['implementer', 'specification-reviewer', 'code-quality-reviewer', 'final-reviewer', 'architecture', 'track-a-qa', 'track-b-qa', 'controller', 'documentation', 'retro', 'finishing'];
+const UNAVAILABLE_EVIDENCE = ['modelOverride', 'effortOverride', 'observedModelEvidence'];
 function emptyState(branch) {
     return {
         schema: 1, revision: 0, journalId: `j-${crypto_1.default.randomUUID()}`, branch,
@@ -88,6 +92,10 @@ function isWellFormedState(x) {
         return false;
     if (!isObj(x.appliedRequests) || !Object.values(x.appliedRequests).every(isWellFormedAppliedRequest))
         return false;
+    if (x.routingAttempts !== undefined && (!Array.isArray(x.routingAttempts) || x.routingAttempts.length > 4096 || !x.routingAttempts.every(isWellFormedRoutingAttempt)))
+        return false;
+    if (x.implementationLineages !== undefined && (!Array.isArray(x.implementationLineages) || x.implementationLineages.length > 4096 || !x.implementationLineages.every(isWellFormedImplementationLineage)))
+        return false;
     if (!Array.isArray(x.requestProblems) || !x.requestProblems.every(isWellFormedRequestProblem))
         return false;
     if (x.custodyDecisions !== undefined && (!Array.isArray(x.custodyDecisions) || !x.custodyDecisions.every(isWellFormedCustodyDecision)))
@@ -190,7 +198,8 @@ function isWellFormedVerdict(x) {
     return isObj(x) && typeof x.id === 'string' && typeof x.obligationId === 'string'
         && ['pass', 'fail', 'inconclusive'].includes(String(x.result))
         && typeof x.detail === 'string' && typeof x.receivedAt === 'string'
-        && typeof x.fingerprint === 'string' && strings(x.argv) && strings(x.paths) && typeof x.cwd === 'string';
+        && typeof x.fingerprint === 'string' && strings(x.argv) && strings(x.paths) && typeof x.cwd === 'string'
+        && (x.routingAttemptId === undefined || typeof x.routingAttemptId === 'string');
 }
 function isWellFormedFix(x) {
     return isObj(x) && typeof x.id === 'string' && typeof x.verdictId === 'string' && typeof x.closed === 'boolean';
@@ -201,6 +210,18 @@ function isWellFormedAppliedRequest(x) {
         && ['applied', 'rejected-stale-generation', 'rejected-digest-mismatch', 'rejected-secret'].includes(String(x.outcome))
         && (x.resultRef === undefined || typeof x.resultRef === 'string');
 }
+function isWellFormedRoutingAttempt(x) {
+    return isObj(x) && Object.keys(x).every(key => ['schema', 'id', 'obligationId', 'lineageId', 'attempt', 'envelope', 'envelopeDigest', 'fingerprint', 'state', 'nativeAgentId', 'observed', 'verdict', 'reasonCode', 'administrativeRepair'].includes(key))
+        && x.schema === 'routing-attempt/v1'
+        && typeof x.id === 'string' && typeof x.obligationId === 'string' && typeof x.lineageId === 'string' && Number.isSafeInteger(x.attempt) && x.attempt > 0
+        && typeof x.envelopeDigest === 'string' && /^[a-f0-9]{64}$/.test(x.envelopeDigest) && typeof x.fingerprint === 'string' && /^[a-f0-9]{64}$/.test(x.fingerprint)
+        && ['reserved', 'active', 'complete', 'blocked', 'unknown'].includes(String(x.state)) && (x.nativeAgentId === undefined || typeof x.nativeAgentId === 'string') && (x.observed === undefined || isRoutingSelection(x.observed)) && (x.verdict === undefined || ['pass', 'fail', 'inconclusive'].includes(String(x.verdict))) && (x.reasonCode === undefined || typeof x.reasonCode === 'string') && (x.administrativeRepair === undefined || x.administrativeRepair === true) && isRoutingEnvelope(x.envelope);
+}
+function isDigest(value) { return typeof value === 'string' && /^[a-f0-9]{64}$/.test(value); }
+function isRoutingSelection(x) { return isObj(x) && Object.keys(x).every(key => key === 'selector' || key === 'effort') && isObj(x.selector) && Object.keys(x.selector).every(key => key === 'kind' || key === 'id') && ['model', 'tier'].includes(String(x.selector.kind)) && typeof x.selector.id === 'string' && x.selector.id.length > 0 && x.selector.id.length <= 128 && isObj(x.effort) && ((x.effort.kind === 'runtime-default' && Object.keys(x.effort).length === 1) || (x.effort.kind === 'explicit' && Object.keys(x.effort).length === 2 && typeof x.effort.value === 'string' && x.effort.value.length > 0 && x.effort.value.length <= 128)); }
+function isRoutingEnvelope(x) { if (!isObj(x) || !Object.keys(x).every(key => ['schema', 'runtime', 'role', 'planDigest', 'executionDigest', 'sliceId', 'requestedProfile', 'effectiveProfile', 'resolved', 'policyDigest', 'capabilityDigest', 'outcome', 'unavailableEvidence'].includes(key)))
+    return false; const runtime = x.runtime; return x.schema === 'routing-envelope/v1' && isObj(runtime) && Object.keys(runtime).every(key => ['target', 'kind', 'version', 'accountScopeDigest'].includes(key)) && ['codex', 'claude-code', 'cursor', 'copilot', 'opencode', 'antigravity'].includes(String(runtime.target)) && typeof runtime.kind === 'string' && runtime.kind.length > 0 && runtime.kind.length <= 128 && typeof runtime.version === 'string' && runtime.version.length > 0 && runtime.version.length <= 128 && isDigest(runtime.accountScopeDigest) && typeof x.role === 'string' && ROUTING_ROLES.includes(x.role) && isDigest(x.planDigest) && isDigest(x.executionDigest) && (x.sliceId === undefined || (typeof x.sliceId === 'string' && x.sliceId.length > 0 && x.sliceId.length <= 128)) && ['mechanical', 'integration', 'judgment', 'full'].includes(String(x.requestedProfile)) && ['mechanical', 'integration', 'judgment', 'full'].includes(String(x.effectiveProfile)) && isRoutingSelection(x.resolved) && isDigest(x.policyDigest) && isDigest(x.capabilityDigest) && ['native', 'degraded'].includes(String(x.outcome)) && Array.isArray(x.unavailableEvidence) && x.unavailableEvidence.length <= UNAVAILABLE_EVIDENCE.length && x.unavailableEvidence.every(value => typeof value === 'string' && UNAVAILABLE_EVIDENCE.includes(value)); }
+function isWellFormedImplementationLineage(x) { return isObj(x) && Object.keys(x).every(key => ['id', 'obligationId', 'sliceId', 'planDigest', 'executionDigest', 'initialProfile', 'initialEffort', 'attempts'].includes(key)) && typeof x.id === 'string' && x.id.length > 0 && typeof x.obligationId === 'string' && x.obligationId.length > 0 && typeof x.sliceId === 'string' && x.sliceId.length > 0 && isDigest(x.planDigest) && isDigest(x.executionDigest) && ['mechanical', 'integration', 'judgment'].includes(String(x.initialProfile)) && ['medium', 'high'].includes(String(x.initialEffort)) && Number.isSafeInteger(x.attempts) && x.attempts >= 0 && x.attempts <= 3; }
 function isWellFormedRequestProblem(x) {
     return isObj(x) && typeof x.file === 'string' && (x.kind === 'corrupt' || x.kind === 'rejected')
         && typeof x.detail === 'string' && typeof x.at === 'string';

package/dist/src/core/model-policy/canonical.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalPolicyDigest = canonicalPolicyDigest;
+const node_crypto_1 = require("node:crypto");
+const validate_1 = require("./validate");
+function canonical(value) {
+    if (value === null || typeof value !== 'object') {
+        const serialized = JSON.stringify(value);
+        if (serialized === undefined)
+            throw new Error('Invalid canonical value');
+        return serialized;
+    }
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    const object = value;
+    return `{${Object.keys(object).sort().map(key => `${JSON.stringify(key)}:${canonical(object[key])}`).join(',')}}`;
+}
+function canonicalPolicyDigest(content) { const validated = (0, validate_1.validatePolicyContent)(content); return (0, node_crypto_1.createHash)('sha256').update(canonical(validated), 'utf8').digest('hex'); }