agentic-workflow-manager 9.8.0 → 9.10.0

package/dist/src/core/model-policy/store.js

@@ -0,0 +1,189 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readBoundedCandidate = readBoundedCandidate;
+exports.readEffectivePolicy = readEffectivePolicy;
+exports.approvePolicyWithBoundary = approvePolicyWithBoundary;
+exports.approvePolicy = approvePolicy;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const json_1 = require("../plan/json");
+const native_bridge_1 = require("../secure-fs/native-bridge");
+const canonical_1 = require("./canonical");
+const paths_1 = require("./paths");
+const validate_1 = require("./validate");
+function assertPath(value, label) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > 4096 || /[\u0000-\u001f\u007f-\u009f]/.test(value))
+        throw new Error(`${label} must be a bounded path without control characters`);
+}
+function ancestors(file) { const absolute = path_1.default.resolve(file); const result = []; for (let current = path_1.default.dirname(absolute);; current = path_1.default.dirname(current)) {
+    result.unshift(current);
+    if (current === path_1.default.dirname(current))
+        return result;
+} }
+function assertSafeParents(file) {
+    for (const parent of ancestors(file)) {
+        try {
+            const stat = fs_1.default.lstatSync(parent, { bigint: true });
+            if (stat.isSymbolicLink() || !stat.isDirectory())
+                throw new Error(`unsafe policy parent: ${parent}`);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+}
+function assertRegularOrAbsent(file) { try {
+    const stat = fs_1.default.lstatSync(file, { bigint: true });
+    if (stat.isSymbolicLink() || !stat.isFile())
+        throw new Error(`policy file rejects symlink or non-regular file: ${file}`);
+}
+catch (error) {
+    if (error.code !== 'ENOENT')
+        throw error;
+} }
+/**
+ * Bounded, symlink-refusing, identity-fenced read of a candidate or stored file.
+ * Exported so the read-only digest path observes a file under exactly the same
+ * constraints the approval path does, rather than growing a second reader that
+ * could drift from it.
+ */
+function readBoundedCandidate(file) {
+    assertSafeParents(file);
+    let inspected;
+    try {
+        inspected = fs_1.default.lstatSync(file, { bigint: true });
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+    if (inspected.isSymbolicLink() || !inspected.isFile() || inspected.size < 0n || inspected.size > BigInt(validate_1.MAX_POLICY_BYTES))
+        throw new Error('policy file is unsafe or exceeds 256 KiB');
+    const fd = fs_1.default.openSync(file, fs_1.default.constants.O_RDONLY | (fs_1.default.constants.O_NOFOLLOW ?? 0));
+    try {
+        const opened = fs_1.default.fstatSync(fd, { bigint: true });
+        if (!opened.isFile() || opened.dev !== inspected.dev || opened.ino !== inspected.ino || opened.size !== inspected.size)
+            throw new Error('policy file identity changed');
+        assertSafeParents(file);
+        return fs_1.default.readFileSync(fd, 'utf8');
+    }
+    finally {
+        fs_1.default.closeSync(fd);
+    }
+}
+function parseApproved(raw) { const policy = (0, validate_1.validateApprovedPolicy)((0, json_1.parseJsonNoDuplicate)(raw)); if ((0, canonical_1.canonicalPolicyDigest)(policy.content) !== policy.contentDigest)
+    throw new Error('approved policy content digest mismatch'); return policy; }
+function policyTarget(scope, cwd) { if (scope !== 'user' && scope !== 'project')
+    throw new Error('scope must be user or project'); assertPath(cwd, 'cwd'); return scope === 'user' ? (0, paths_1.userPolicyPath)() : (0, paths_1.projectPolicyPath)(cwd); }
+function createDirectories(file) {
+    const chain = ancestors(file);
+    for (const directory of chain) {
+        try {
+            const stat = fs_1.default.lstatSync(directory);
+            if (stat.isSymbolicLink() || !stat.isDirectory())
+                throw new Error(`unsafe policy parent: ${directory}`);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            fs_1.default.mkdirSync(directory, { mode: 0o700 });
+        }
+    }
+}
+function lock(file) { const lockPath = `${file}.lock`; assertRegularOrAbsent(lockPath); let fd; try {
+    fd = fs_1.default.openSync(lockPath, 'wx', 0o600);
+}
+catch (error) {
+    if (error.code === 'EEXIST')
+        throw new Error('policy writer lock already exists; explicit recovery required');
+    throw error;
+} return () => { try {
+    fs_1.default.closeSync(fd);
+}
+finally {
+    fs_1.default.rmSync(lockPath, { force: false });
+} }; }
+function readEffectivePolicy(cwd) {
+    assertPath(cwd, 'cwd');
+    const project = (0, paths_1.projectPolicyPath)(cwd);
+    try {
+        const raw = readBoundedCandidate(project);
+        if (raw !== null)
+            return { state: 'approved', provenance: 'project', policy: parseApproved(raw) };
+    }
+    catch (error) {
+        return { state: 'invalid', provenance: 'project', reason: error.message.slice(0, 4096) };
+    }
+    const user = (0, paths_1.userPolicyPath)();
+    try {
+        const raw = readBoundedCandidate(user);
+        if (raw === null)
+            return { state: 'absent' };
+        return { state: 'approved', provenance: 'user', policy: parseApproved(raw) };
+    }
+    catch (error) {
+        return { state: 'invalid', provenance: 'user', reason: error.message.slice(0, 4096) };
+    }
+}
+/** Testable transaction seam; production callers use approvePolicy, which binds secureFs. */
+function approvePolicyWithBoundary(input, boundary) {
+    if (!input || typeof input !== 'object')
+        throw new Error('approval input is required');
+    assertPath(input.file, 'file');
+    assertPath(input.cwd, 'cwd');
+    (0, validate_1.assertDigest)(input.expectedDigest, 'expectedDigest');
+    if (input.replaceDigest !== undefined)
+        (0, validate_1.assertDigest)(input.replaceDigest, 'replaceDigest');
+    const cwd = path_1.default.resolve(input.cwd);
+    const candidateRaw = readBoundedCandidate(path_1.default.resolve(cwd, input.file));
+    if (candidateRaw === null)
+        throw new Error('policy candidate is absent');
+    const content = (0, validate_1.validatePolicyContent)((0, json_1.parseJsonNoDuplicate)(candidateRaw));
+    const digest = (0, canonical_1.canonicalPolicyDigest)(content);
+    if (digest !== input.expectedDigest)
+        throw new Error('policy content digest does not match expectedDigest');
+    const target = policyTarget(input.scope, cwd);
+    createDirectories(target);
+    assertSafeParents(target);
+    assertRegularOrAbsent(target);
+    const unlock = lock(target);
+    try {
+        const existingRaw = readBoundedCandidate(target);
+        const existing = existingRaw === null ? null : parseApproved(existingRaw);
+        if (existing === null && input.replaceDigest !== undefined)
+            throw new Error('replacement requires an existing predecessor');
+        if (existing !== null && input.replaceDigest === undefined)
+            throw new Error('existing policy requires replaceDigest');
+        if (existing !== null && existing.contentDigest !== input.replaceDigest)
+            throw new Error('replacement predecessor digest mismatch');
+        const approved = { schema: 'approved-model-policy/v1', content, contentDigest: digest, approval: { approvedAt: new Date().toISOString(), approvalId: crypto_1.default.randomUUID() }, lineage: { previousDigest: existing?.contentDigest ?? null } };
+        const serialized = `${JSON.stringify(approved, null, 2)}\n`;
+        const root = input.scope === 'project' ? cwd : path_1.default.dirname(target);
+        const destination = input.scope === 'project' ? '.awm/model-policy.json' : path_1.default.basename(target);
+        boundary.withProjectLease(root, () => {
+            if (existing === null) {
+                boundary.writeProjectTransaction(root, destination, Buffer.from(serialized, 'utf8'), { mode: 'create', createParents: true });
+                return;
+            }
+            // A native identity-fenced transaction proves that neither bytes nor
+            // file identity changed after the bounded observation. A JS rename
+            // cannot make that CAS claim, so it is deliberately not used here.
+            const observed = boundary.readRegularFile(target, validate_1.MAX_POLICY_BYTES);
+            const current = parseApproved(new TextDecoder('utf-8', { fatal: true }).decode(observed.bytes));
+            if (current.contentDigest !== input.replaceDigest)
+                throw new Error('replacement predecessor digest changed under writer lock');
+            boundary.writeProjectTransaction(root, destination, Buffer.from(serialized, 'utf8'), { mode: 'replace', createParents: false, expected: observed.bytes, expectedIdentity: observed.identity });
+        });
+        return approved;
+    }
+    finally {
+        unlock();
+    }
+}
+function approvePolicy(input) { return approvePolicyWithBoundary(input, native_bridge_1.secureFs); }

package/dist/src/core/model-policy/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/core/model-policy/validate.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_IDENTIFIER = exports.MAX_MAPPINGS = exports.MAX_POLICY_BYTES = void 0;
+exports.canonicalUtcTimestamp = canonicalUtcTimestamp;
+exports.validatePolicyContent = validatePolicyContent;
+exports.validateApprovedPolicy = validateApprovedPolicy;
+exports.assertDigest = assertDigest;
+const providers_1 = require("../../providers");
+exports.MAX_POLICY_BYTES = 256 * 1024;
+exports.MAX_MAPPINGS = 64;
+exports.MAX_IDENTIFIER = 128;
+const SHA256 = /^[0-9a-f]{64}$/;
+const RUNTIME_KIND = /^[a-z0-9][a-z0-9_-]{0,127}$/;
+const CONTROL = /[\u0000-\u001f\u007f-\u009f]/;
+const CANONICAL_UTC_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+const profiles = ['mechanical', 'integration', 'judgment'];
+function record(value, label) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        throw new Error(`${label} must be an object`);
+    return value;
+}
+function exact(object, keys, label) {
+    const actual = Object.keys(object);
+    if (actual.length !== keys.length || actual.some(key => !keys.includes(key)))
+        throw new Error(`${label} has unknown or missing fields`);
+}
+function text(value, label, pattern) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > exports.MAX_IDENTIFIER || CONTROL.test(value) || (pattern && !pattern.test(value)))
+        throw new Error(`${label} is invalid`);
+    return value;
+}
+function canonicalUtcTimestamp(value, label) {
+    if (typeof value !== 'string' || !CANONICAL_UTC_TIMESTAMP.test(value))
+        throw new Error(`${label} must be a canonical UTC ISO-8601 timestamp`);
+    const parsed = new Date(value);
+    if (!Number.isFinite(parsed.getTime()) || parsed.toISOString() !== value)
+        throw new Error(`${label} must be a canonical UTC ISO-8601 timestamp`);
+    return value;
+}
+function bool(value, label) { if (typeof value !== 'boolean')
+    throw new Error(`${label} must be boolean`); return value; }
+function agent(value) { if (typeof value !== 'string' || !providers_1.AGENT_TARGETS.includes(value))
+    throw new Error('mapping target is invalid'); return value; }
+function selection(value, label) {
+    const item = record(value, label);
+    exact(item, ['selector', 'effort'], label);
+    const selector = record(item.selector, `${label}.selector`);
+    exact(selector, ['kind', 'id'], `${label}.selector`);
+    if (selector.kind !== 'model' && selector.kind !== 'tier')
+        throw new Error(`${label}.selector.kind is invalid`);
+    const effort = record(item.effort, `${label}.effort`);
+    if (effort.kind === 'explicit') {
+        exact(effort, ['kind', 'value'], `${label}.effort`);
+        return { selector: { kind: selector.kind, id: text(selector.id, `${label}.selector.id`) }, effort: { kind: 'explicit', value: text(effort.value, `${label}.effort.value`) } };
+    }
+    if (effort.kind === 'runtime-default') {
+        exact(effort, ['kind'], `${label}.effort`);
+        return { selector: { kind: selector.kind, id: text(selector.id, `${label}.selector.id`) }, effort: { kind: 'runtime-default' } };
+    }
+    throw new Error(`${label}.effort.kind is invalid`);
+}
+function mapping(value) {
+    const item = record(value, 'mapping');
+    exact(item, ['target', 'runtimeKind', 'profiles', 'fullCapability', 'degradation'], 'mapping');
+    const rawProfiles = record(item.profiles, 'mapping.profiles');
+    exact(rawProfiles, profiles, 'mapping.profiles');
+    const degradation = record(item.degradation, 'mapping.degradation');
+    exact(degradation, ['allowMissingModelOverride', 'allowMissingEffortOverride', 'allowMissingObservedIdentity'], 'mapping.degradation');
+    return { target: agent(item.target), runtimeKind: text(item.runtimeKind, 'mapping.runtimeKind', RUNTIME_KIND), profiles: {
+            mechanical: selection(rawProfiles.mechanical, 'mapping.profiles.mechanical'), integration: selection(rawProfiles.integration, 'mapping.profiles.integration'), judgment: selection(rawProfiles.judgment, 'mapping.profiles.judgment'),
+        }, fullCapability: selection(item.fullCapability, 'mapping.fullCapability'), degradation: {
+            allowMissingModelOverride: bool(degradation.allowMissingModelOverride, 'mapping.degradation.allowMissingModelOverride'), allowMissingEffortOverride: bool(degradation.allowMissingEffortOverride, 'mapping.degradation.allowMissingEffortOverride'), allowMissingObservedIdentity: bool(degradation.allowMissingObservedIdentity, 'mapping.degradation.allowMissingObservedIdentity'),
+        } };
+}
+function validatePolicyContent(value) {
+    const item = record(value, 'policy content');
+    exact(item, ['schema', 'mappings', 'implementationBudget'], 'policy content');
+    if (item.schema !== 'model-policy/v1')
+        throw new Error('policy schema is invalid');
+    if (!Array.isArray(item.mappings) || item.mappings.length > exports.MAX_MAPPINGS)
+        throw new Error('policy mappings are invalid');
+    const mappings = item.mappings.map(mapping);
+    const unique = new Set();
+    for (const row of mappings) {
+        const key = `${row.target}\0${row.runtimeKind}`;
+        if (unique.has(key))
+            throw new Error('duplicate policy target/runtime mapping');
+        unique.add(key);
+    }
+    const budget = record(item.implementationBudget, 'implementationBudget');
+    exact(budget, ['maxAttempts', 'escalation', 'judgmentEfforts'], 'implementationBudget');
+    if (budget.maxAttempts !== 3 || !Array.isArray(budget.escalation) || budget.escalation.length !== 3 || budget.escalation.join(',') !== 'mechanical,integration,judgment' || !Array.isArray(budget.judgmentEfforts) || budget.judgmentEfforts.join(',') !== 'medium,high')
+        throw new Error('implementation budget is invalid');
+    return { schema: 'model-policy/v1', mappings, implementationBudget: { maxAttempts: 3, escalation: ['mechanical', 'integration', 'judgment'], judgmentEfforts: ['medium', 'high'] } };
+}
+function validateApprovedPolicy(value) {
+    const item = record(value, 'approved policy');
+    exact(item, ['schema', 'content', 'contentDigest', 'approval', 'lineage'], 'approved policy');
+    if (item.schema !== 'approved-model-policy/v1')
+        throw new Error('approved policy schema is invalid');
+    const approval = record(item.approval, 'approval');
+    exact(approval, ['approvedAt', 'approvalId'], 'approval');
+    const lineage = record(item.lineage, 'lineage');
+    exact(lineage, ['previousDigest'], 'lineage');
+    const contentDigest = text(item.contentDigest, 'contentDigest', SHA256);
+    if (typeof approval.approvalId !== 'string' || approval.approvalId.length === 0 || approval.approvalId.length > exports.MAX_IDENTIFIER || CONTROL.test(approval.approvalId) || (lineage.previousDigest !== null && (typeof lineage.previousDigest !== 'string' || !SHA256.test(lineage.previousDigest))))
+        throw new Error('approved policy metadata is invalid');
+    const approvedAt = canonicalUtcTimestamp(approval.approvedAt, 'approval.approvedAt');
+    return { schema: 'approved-model-policy/v1', content: validatePolicyContent(item.content), contentDigest, approval: { approvedAt, approvalId: approval.approvalId }, lineage: { previousDigest: lineage.previousDigest } };
+}
+function assertDigest(value, label) { if (typeof value !== 'string' || !SHA256.test(value))
+    throw new Error(`${label} must be a 64-character lowercase SHA-256 digest`); }

package/dist/src/core/plan/identity.js

@@ -12,6 +12,8 @@ exports.MAX_PLAN_SNAPSHOT_BYTES = 1024 * 1024;
 exports.EXECUTION_IDENTITY_SCHEMA = 'awm-plan-execution/v1';
 const START = '<!-- AWM:COMPACT-SLICES:START v1 -->';
 const END = '<!-- AWM:COMPACT-SLICES:END v1 -->';
+const START_V2 = '<!-- AWM:COMPACT-SLICES:START v2 -->';
+const END_V2 = '<!-- AWM:COMPACT-SLICES:END v2 -->';
 /** Only lifecycle syntax actually emitted by the skills is non-executable.
  * Unknown metadata, prose, inline comments and code remain identity-bearing. */
 function lifecycleMarker(line) {
@@ -53,11 +55,11 @@ function executionPlanDigest(text) {
         }
         if (fence)
             return { line };
-        if (line === START) {
+        if (line === START || line === START_V2) {
             manifest = true;
             return { line };
         }
-        if (line === END) {
+        if (line === END || line === END_V2) {
             manifest = false;
             return { line };
         }

package/dist/src/core/plan/validate.js

@@ -14,6 +14,8 @@ const json_1 = require("./json");
 const identity_1 = require("./identity");
 const START = '<!-- AWM:COMPACT-SLICES:START v1 -->';
 const END = '<!-- AWM:COMPACT-SLICES:END v1 -->';
+const START_V2 = '<!-- AWM:COMPACT-SLICES:START v2 -->';
+const END_V2 = '<!-- AWM:COMPACT-SLICES:END v2 -->';
 const MAX_PLAN = 1024 * 1024;
 const MAX_MANIFEST = 256 * 1024;
 const MAX_SOURCE = 1024 * 1024;
@@ -356,22 +358,18 @@ function validatePlan(planPath, cwd, snapshot) {
     }
     const starts = count(text, START);
     const ends = count(text, END);
-    const signaled = starts > 0 || ends > 0 || compactSchemaSignal(text);
+    const signaled = starts > 0 || ends > 0 || count(text, START_V2) > 0 || count(text, END_V2) > 0 || compactSchemaSignal(text);
     if (!signaled)
         return markerlessSchemaClassification(text) ?? { state: 'migration-required', reason: 'unmarked-plan' };
-    if (starts === 0 && ends === 0)
+    const start = text.includes(START_V2) ? START_V2 : START;
+    const end = start === START_V2 ? END_V2 : END;
+    const startsForSchema = count(text, start);
+    const endsForSchema = count(text, end);
+    if (starts === 0 && ends === 0 && startsForSchema === 0 && endsForSchema === 0)
         return markerlessSchemaClassification(text) ?? diagnostic('PLAN_MARKERS', 'compact markers must occur once in order');
-    if (starts !== 1 || ends !== 1 || text.indexOf(START) > text.indexOf(END)) {
-        const partial = starts === 1 ? text.slice(text.indexOf(START) + START.length, ends ? text.indexOf(END) : undefined).trim() : '';
-        try {
-            const candidate = (0, json_1.parseJsonNoDuplicate)(partial);
-            if (object(candidate) && typeof candidate.schema === 'string' && Buffer.byteLength(candidate.schema, 'utf8') <= MAX_STRING && candidate.schema.startsWith('compact-slices/') && candidate.schema !== 'compact-slices/v1')
-                return unsupported(candidate.schema);
-        }
-        catch { /* invalid below */ }
+    if (startsForSchema !== 1 || endsForSchema !== 1 || text.indexOf(start) > text.indexOf(end) || (start === START && (count(text, START_V2) !== 0 || count(text, END_V2) !== 0)) || (start === START_V2 && (starts !== 0 || ends !== 0)))
         return diagnostic('PLAN_MARKERS', 'compact markers must occur once in order');
-    }
-    const body = text.slice(text.indexOf(START) + START.length, text.indexOf(END));
+    const body = text.slice(text.indexOf(start) + start.length, text.indexOf(end));
     if (Buffer.byteLength(body, 'utf8') > MAX_MANIFEST)
         return diagnostic('PLAN_LIMIT', 'manifest exceeds maximum size');
     let raw;
@@ -385,7 +383,7 @@ function validatePlan(planPath, cwd, snapshot) {
         return diagnostic('PLAN_SHAPE', 'manifest must be an object');
     if (typeof raw.schema === 'string' && Buffer.byteLength(raw.schema, 'utf8') > MAX_STRING)
         return diagnostic('PLAN_LIMIT', 'schema exceeds maximum string size');
-    if (typeof raw.schema === 'string' && raw.schema.startsWith('compact-slices/') && raw.schema !== 'compact-slices/v1')
+    if (typeof raw.schema === 'string' && raw.schema.startsWith('compact-slices/') && raw.schema !== 'compact-slices/v1' && !(raw.schema === 'compact-slices/v2' && start === START_V2))
         return unsupported(raw.schema);
     if (!exact(raw, ['schema', 'planId', 'requirements', 'sources', 'commands', 'slices', 'closureCommands']))
         return diagnostic(Object.keys(raw).some((key) => !['schema', 'planId', 'requirements', 'sources', 'commands', 'slices', 'closureCommands'].includes(key)) ? 'PLAN_UNKNOWN_FIELD' : 'PLAN_MISSING_FIELD', 'manifest fields must exactly match the contract');
@@ -395,7 +393,7 @@ function validatePlan(planPath, cwd, snapshot) {
         return diagnostic('PLAN_LIMIT', 'manifest exceeds collection limits');
     if (typeof raw.planId === 'string' && Buffer.byteLength(raw.planId, 'utf8') > MAX_STRING)
         return diagnostic('PLAN_LIMIT', 'plan id exceeds maximum string size');
-    if (raw.schema !== 'compact-slices/v1' || typeof raw.planId !== 'string' || !PLAN_ID.test(raw.planId) || !allStrings(raw.requirements) || new Set(raw.requirements).size !== raw.requirements.length)
+    if ((raw.schema !== 'compact-slices/v1' && raw.schema !== 'compact-slices/v2') || (raw.schema === 'compact-slices/v1' && start !== START) || (raw.schema === 'compact-slices/v2' && start !== START_V2) || typeof raw.planId !== 'string' || !PLAN_ID.test(raw.planId) || !allStrings(raw.requirements) || new Set(raw.requirements).size !== raw.requirements.length)
         return diagnostic('PLAN_SHAPE', 'manifest scalar fields are invalid');
     if (raw.requirements.some((id) => !validRequirementId(id)) || !allStrings(raw.closureCommands) || new Set(raw.closureCommands).size !== raw.closureCommands.length)
         return diagnostic('PLAN_SHAPE', 'manifest arrays or identifiers are invalid');
@@ -438,8 +436,9 @@ function validatePlan(planPath, cwd, snapshot) {
     }
     const sliceIds = new Set();
     const owners = new Map();
+    const sliceFields = ['id', 'title', 'requirements', 'dependsOn', 'sectionAnchor', 'sources', 'redCommands', 'greenCommands', 'reviewEvidence', 'risk', 'fallback'];
     for (const slice of raw.slices) {
-        if (!exact(slice, ['id', 'title', 'requirements', 'dependsOn', 'sectionAnchor', 'sources', 'redCommands', 'greenCommands', 'reviewEvidence', 'risk', 'fallback']) || !validId(slice.id) || sliceIds.has(slice.id) || typeof slice.title !== 'string' || slice.title.length === 0 || Buffer.byteLength(slice.title, 'utf8') > MAX_STRING || !allStrings(slice.requirements) || slice.requirements.length === 0 || slice.requirements.some((id) => !validRequirementId(id) || !raw.requirements.includes(id)) || !allStrings(slice.dependsOn) || typeof slice.sectionAnchor !== 'string' || slice.sectionAnchor.length === 0 || Buffer.byteLength(slice.sectionAnchor, 'utf8') > MAX_STRING || !uniqueRefs(slice.sources, sourceIds) || !uniqueRefs(slice.redCommands, commandIds) || slice.redCommands.length === 0 || !uniqueRefs(slice.greenCommands, commandIds) || slice.greenCommands.length === 0 || !allStrings(slice.fallback) || slice.fallback.length === 0 || slice.fallback.some((item) => item.trim().length === 0) || slice.risk !== 'bounded' && slice.risk !== 'full-context')
+        if (!exact(slice, raw.schema === 'compact-slices/v2' ? [...sliceFields, 'implementerProfile'] : sliceFields) || (raw.schema === 'compact-slices/v2' && !['mechanical', 'integration', 'judgment'].includes(slice.implementerProfile)) || !validId(slice.id) || sliceIds.has(slice.id) || typeof slice.title !== 'string' || slice.title.length === 0 || Buffer.byteLength(slice.title, 'utf8') > MAX_STRING || !allStrings(slice.requirements) || slice.requirements.length === 0 || slice.requirements.some((id) => !validRequirementId(id) || !raw.requirements.includes(id)) || !allStrings(slice.dependsOn) || typeof slice.sectionAnchor !== 'string' || slice.sectionAnchor.length === 0 || Buffer.byteLength(slice.sectionAnchor, 'utf8') > MAX_STRING || !uniqueRefs(slice.sources, sourceIds) || !uniqueRefs(slice.redCommands, commandIds) || slice.redCommands.length === 0 || !uniqueRefs(slice.greenCommands, commandIds) || slice.greenCommands.length === 0 || !allStrings(slice.fallback) || slice.fallback.length === 0 || slice.fallback.some((item) => item.trim().length === 0) || slice.risk !== 'bounded' && slice.risk !== 'full-context')
             return diagnostic('PLAN_SLICE_SHAPE', 'slice fields are invalid');
         sliceIds.add(slice.id);
         if (!Array.isArray(slice.reviewEvidence) || slice.reviewEvidence.length !== 2 || new Set(slice.reviewEvidence).size !== 2 || !slice.reviewEvidence.includes('specification') || !slice.reviewEvidence.includes('code-quality'))
@@ -485,7 +484,7 @@ function validatePlan(planPath, cwd, snapshot) {
     if (markdown)
         return markdown;
     const report = {
-        state: 'valid', schema: 'compact-slices/v1',
+        state: 'valid', schema: raw.schema,
         planDigest: crypto_1.default.createHash('sha256').update(text, 'utf8').digest('hex'),
         executionDigest: (0, identity_1.executionPlanDigest)(text),
         manifest: raw, executionMode: executionModeFromValidatedText(text),

package/dist/src/index.js

@@ -46,6 +46,7 @@ const track_1 = require("./commands/track");
 const evidence_1 = require("./commands/evidence");
 const process_1 = require("./commands/process");
 const context_1 = require("./commands/context");
+const model_policy_1 = require("./commands/model-policy");
 const add_1 = require("./commands/add");
 const sync_1 = require("./commands/sync");
 const update_1 = require("./commands/update");
@@ -54,6 +55,7 @@ const update_check_1 = require("./core/update-check");
 const cli_version_1 = require("./core/cli-version");
 exports.program = new commander_1.Command();
 exports.program.name('awm').description('Agentic Workflow Manager').version((0, cli_version_1.cliVersion)());
+(0, model_policy_1.registerModelPolicyCommand)(exports.program);
 exports.program.hook('postAction', (_command, actionCommand) => {
     if (actionCommand.name() === 'preflight')
         return;

package/dist/tests/commands/job/gate-reconcile.test.js

@@ -55,6 +55,22 @@ function passingState() {
     return s;
 }
 describe('gate', () => {
+    test('un verdict routed exige intento observado, identidad y fingerprint coincidentes', () => {
+        const s = passingState();
+        s.verdicts[0] = { ...s.verdicts[0], routingAttemptId: 'route-1' };
+        let gate = (0, gate_1.computeGate)(s, false, fpCurrent);
+        expect(gate.reasons.some((reason) => reason.category === 'routing-evidence')).toBe(true);
+        s.routingAttempts = [{
+                schema: 'routing-attempt/v1', id: 'route-1', obligationId: 'o-spec', lineageId: 'lineage-1', attempt: 1,
+                envelope: { schema: 'routing-envelope/v1', runtime: { target: 'codex', kind: 'native', version: '1', accountScopeDigest: '0'.repeat(64) }, role: 'specification-reviewer', requestedProfile: 'full', effectiveProfile: 'full', resolved: { selector: { kind: 'model', id: 'm' }, effort: { kind: 'explicit', value: 'high' } }, outcome: 'native', unavailableEvidence: [], policyDigest: 'a'.repeat(64), capabilityDigest: 'b'.repeat(64), planDigest: 'c'.repeat(64), executionDigest: 'd'.repeat(64) },
+                envelopeDigest: 'a'.repeat(64), fingerprint: 'fp', state: 'active', nativeAgentId: 'native-1', observed: { selector: { kind: 'model', id: 'm' }, effort: { kind: 'explicit', value: 'high' } },
+            }];
+        s.planBinding = { path: 'plan.md', digest: 'c'.repeat(64), executionDigest: 'd'.repeat(64), executionIdentitySchema: 'awm-plan-execution/v1', schema: 'compact-slices/v2', executionMode: 'desatendido', boundAt: 'now' };
+        expect((0, gate_1.computeGate)(s, false, fpCurrent).pass).toBe(true);
+        s.routingAttempts[0].fingerprint = 'different';
+        gate = (0, gate_1.computeGate)(s, false, fpCurrent);
+        expect(gate.reasons.some((reason) => reason.category === 'routing-evidence')).toBe(true);
+    });
     test('el estado de referencia pasa; la corrupcion bloquea (R3.2)', () => {
         expect((0, gate_1.computeGate)(passingState(), false, fpCurrent).pass).toBe(true);
         const g = (0, gate_1.computeGate)(null, true, fpCurrent);

package/dist/tests/commands/job/gate.test.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const gate_1 = require("../../../src/commands/job/gate");
+const types_1 = require("../../../src/core/journal/types");
+test('routed evidence cannot certify against a legacy journal without its attempt', () => {
+    const state = (0, types_1.emptyState)('main');
+    state.verdicts.push({ id: 'v1', obligationId: 'o1', result: 'pass', detail: '', receivedAt: 'now', fingerprint: 'fp', argv: [], paths: [], cwd: '.', routingAttemptId: 'missing' });
+    expect((0, gate_1.computeGate)(state, false, () => 'fp').reasons).toContainEqual(expect.objectContaining({ category: 'routing-evidence' }));
+});

package/dist/tests/commands/job/routing-report-cli.test.js

@@ -0,0 +1,46 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const commander_1 = require("commander");
+const job_1 = require("../../../src/commands/job");
+const store_1 = require("../../../src/core/journal/store");
+const journal_1 = require("../../../src/core/model-policy/journal");
+const envelope = { schema: 'routing-envelope/v1', runtime: { target: 'codex', kind: 'native', version: '1', accountScopeDigest: '0'.repeat(64) }, role: 'implementer', sliceId: 'S1', requestedProfile: 'mechanical', effectiveProfile: 'mechanical', resolved: { selector: { kind: 'model', id: 'model-private' }, effort: { kind: 'explicit', value: 'medium' } }, outcome: 'native', unavailableEvidence: [], policyDigest: 'a'.repeat(64), capabilityDigest: 'b'.repeat(64), planDigest: 'c'.repeat(64), executionDigest: 'd'.repeat(64) };
+function gitInit(repo) {
+    (0, child_process_1.execFileSync)('git', ['-c', 'user.email=t@t.t', '-c', 'user.name=t', 'init', '-q', '-b', 'main'], { cwd: repo });
+    fs_1.default.writeFileSync(path_1.default.join(repo, 'fixture'), 'x');
+    (0, child_process_1.execFileSync)('git', ['add', '.'], { cwd: repo });
+    (0, child_process_1.execFileSync)('git', ['-c', 'user.email=t@t.t', '-c', 'user.name=t', 'commit', '-qm', 'fixture'], { cwd: repo });
+}
+test('`job routing-report --json` emits only aggregate routing evidence', async () => {
+    const repo = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-routing-report-'));
+    try {
+        gitInit(repo);
+        (0, store_1.initJournal)(repo, 'main');
+        const state = (0, store_1.readJournal)(repo, 'main').state;
+        const reserved = (0, journal_1.reserveRoutingAttempt)(state, { obligationId: 'obligation', lineageId: 'lineage', envelope, fingerprint: 'e'.repeat(64) }, '2026-09-17T00:00:00.000Z');
+        (0, store_1.writeJournal)(repo, 'main', (0, journal_1.observeRoutingAttempt)(reserved.state, { attemptId: reserved.attemptId, nativeAgentId: 'native-private' }, '2026-09-17T00:01:00.000Z'));
+        const program = new commander_1.Command();
+        program.exitOverride();
+        (0, job_1.registerJobCommand)(program);
+        const out = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        const cwd = jest.spyOn(process, 'cwd').mockReturnValue(repo);
+        await program.parseAsync(['node', 'awm', 'job', 'routing-report', '--json']);
+        const rendered = String(out.mock.calls[0][0]);
+        const report = JSON.parse(rendered);
+        expect(report).toMatchObject({ schema: 'routing-report/v1', attempts: 1, plannedByRole: { implementer: 1 }, actualByRole: { implementer: 1 }, byState: { active: 1 } });
+        expect(rendered).not.toContain('native-private');
+        expect(rendered).not.toContain('model-private');
+        cwd.mockRestore();
+        out.mockRestore();
+    }
+    finally {
+        fs_1.default.rmSync(repo, { recursive: true, force: true });
+    }
+});

package/dist/tests/commands/job/routing.test.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const types_1 = require("../../../src/core/journal/types");
+const journal_1 = require("../../../src/core/model-policy/journal");
+const envelope = { schema: 'routing-envelope/v1', runtime: { target: 'codex', kind: 'native', version: '1', accountScopeDigest: '0'.repeat(64) }, role: 'implementer', sliceId: 'S1', requestedProfile: 'mechanical', effectiveProfile: 'mechanical', resolved: { selector: { kind: 'model', id: 'm' }, effort: { kind: 'explicit', value: 'medium' } }, outcome: 'native', unavailableEvidence: [], policyDigest: 'a'.repeat(64), capabilityDigest: 'b'.repeat(64), planDigest: 'c'.repeat(64), executionDigest: 'd'.repeat(64) };
+test('routing report remains read-only across an observed attempt', () => {
+    const reserved = (0, journal_1.reserveRoutingAttempt)((0, types_1.emptyState)('main'), { obligationId: 'o1', lineageId: 'l1', envelope, fingerprint: 'e'.repeat(64) }, '2026-09-17T00:00:00.000Z');
+    const observed = (0, journal_1.observeRoutingAttempt)(reserved.state, { attemptId: reserved.attemptId, nativeAgentId: 'native-id' }, '2026-09-17T00:01:00.000Z');
+    expect((0, journal_1.routingReport)(observed)).toMatchObject({ attempts: 1, byState: { active: 1 } });
+    expect(observed.routingAttempts[0].nativeAgentId).toBe('native-id');
+});