agentic-workflow-manager 9.8.0 → 9.10.0

package/dist/tests/commands/model-policy/index.test.js

@@ -0,0 +1,117 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const commander_1 = require("commander");
+const model_policy_1 = require("../../../src/commands/model-policy");
+const out = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+describe('model-policy command', () => {
+    beforeEach(() => { jest.clearAllMocks(); process.exitCode = undefined; });
+    afterAll(() => out.mockRestore());
+    it('emits a read-only protocol contract as JSON', async () => {
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, model_policy_1.registerModelPolicyCommand)(program);
+        await program.parseAsync(['node', 'awm', 'model-policy', 'contract', '--json']);
+        expect(JSON.parse(String(out.mock.calls[0][0]))).toMatchObject({
+            schema: 'routing-protocol/v1',
+            supportedPlanSchemas: ['compact-slices/v1', 'compact-slices/v2'],
+            implementerProfiles: ['mechanical', 'integration', 'judgment'],
+            limits: { maxFileBytes: 262144 },
+        });
+    });
+    it('rejects missing values instead of silently accepting an incomplete approval', async () => {
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, model_policy_1.registerModelPolicyCommand)(program);
+        await expect(program.parseAsync(['node', 'awm', 'model-policy', 'approve', '--file', '--scope', 'user', '--expected-digest', 'a'.repeat(64)])).rejects.toThrow();
+    });
+    it('accepts and validates --cwd on contract, and resolves status through it', async () => {
+        const readEffectivePolicy = jest.fn(() => ({ state: 'absent' }));
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, model_policy_1.registerModelPolicyCommand)(program, { readEffectivePolicy });
+        await program.parseAsync(['node', 'awm', 'model-policy', 'contract', '--cwd', 'fixture-root', '--json']);
+        await program.parseAsync(['node', 'awm', 'model-policy', 'status', '--provider', 'codex', '--runtime-kind', 'native', '--runtime-version', '1.0.0', '--account-scope-digest', 'a'.repeat(64), '--cwd', 'fixture-root', '--json']);
+        expect(readEffectivePolicy).toHaveBeenCalledWith('fixture-root');
+        await expect(program.parseAsync(['node', 'awm', 'model-policy', 'contract', '--cwd', '--json'])).rejects.toThrow();
+    });
+    it('reports receipt provenance in status and rejects stale receipt state', async () => {
+        const readCapabilities = jest.fn(() => ({ state: 'stale', reason: 'expired' }));
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, model_policy_1.registerModelPolicyCommand)(program, { readEffectivePolicy: () => ({ state: 'absent' }), readCapabilities });
+        await program.parseAsync(['node', 'awm', 'model-policy', 'status', '--provider', 'codex', '--runtime-kind', 'native', '--runtime-version', '1.0.0', '--account-scope-digest', 'a'.repeat(64), '--json']);
+        expect(JSON.parse(String(out.mock.calls[0][0]))).toMatchObject({ policy: { state: 'absent' }, capability: { state: 'stale' } });
+        expect(process.exitCode).toBe(2);
+    });
+    it('discloses the canonical digest through a read-only subcommand', async () => {
+        const candidateDigest = jest.fn(() => ({ schema: 'model-policy/v1', digest: 'b'.repeat(64) }));
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, model_policy_1.registerModelPolicyCommand)(program, { candidateDigest });
+        await program.parseAsync(['node', 'awm', 'model-policy', 'digest', '--file', 'policy.json', '--cwd', 'fixture-root', '--json']);
+        expect(candidateDigest).toHaveBeenCalledWith({ file: 'policy.json', cwd: 'fixture-root' });
+        expect(JSON.parse(String(out.mock.calls[0][0]))).toEqual({ schema: 'model-policy/v1', digest: 'b'.repeat(64) });
+    });
+    it('takes no approval arguments on digest, so it cannot approve by accident', async () => {
+        const candidateDigest = jest.fn(() => ({ schema: 'model-policy/v1', digest: 'b'.repeat(64) }));
+        const approvePolicy = jest.fn();
+        const approveCapabilities = jest.fn();
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, model_policy_1.registerModelPolicyCommand)(program, { candidateDigest, approvePolicy: approvePolicy, approveCapabilities: approveCapabilities });
+        await expect(program.parseAsync(['node', 'awm', 'model-policy', 'digest', '--file', 'policy.json', '--expected-digest', 'a'.repeat(64)])).rejects.toThrow();
+        expect(approvePolicy).not.toHaveBeenCalled();
+        expect(approveCapabilities).not.toHaveBeenCalled();
+    });
+    it('rejects a missing or malformed --file on digest instead of digesting the flag', async () => {
+        const candidateDigest = jest.fn(() => ({ schema: 'model-policy/v1', digest: 'b'.repeat(64) }));
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, model_policy_1.registerModelPolicyCommand)(program, { candidateDigest });
+        await expect(program.parseAsync(['node', 'awm', 'model-policy', 'digest'])).rejects.toThrow();
+        await expect(program.parseAsync(['node', 'awm', 'model-policy', 'digest', '--file', '--cwd'])).rejects.toThrow(/requires a non-empty value/);
+        expect(candidateDigest).not.toHaveBeenCalled();
+    });
+    // This positive case is what the negative guard below could never establish.
+    // While `capabilities approve` was registered as one command with a
+    // positional `<approve>`, Commander handed the action (positional, options),
+    // so `--file` read as undefined and EVERY invocation — well-formed ones
+    // included — died on 'requires a non-empty value'. A suite that only
+    // asserted that rejection was green against a command that could not
+    // approve at all.
+    it('reaches the capability approval with parsed options, not a positional', async () => {
+        const approveCapabilities = jest.fn(() => ({ schema: 'routing-capabilities/v1' }));
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, model_policy_1.registerModelPolicyCommand)(program, { approveCapabilities: approveCapabilities });
+        await program.parseAsync(['node', 'awm', 'model-policy', 'capabilities', 'approve', '--file', 'receipt.json', '--expected-digest', 'a'.repeat(64), '--cwd', 'fixture-root', '--json']);
+        expect(approveCapabilities).toHaveBeenCalledWith({ file: 'receipt.json', cwd: 'fixture-root', expectedDigest: 'a'.repeat(64), replaceDigest: undefined });
+        expect(JSON.parse(String(out.mock.calls[0][0]))).toMatchObject({ state: 'approved' });
+    });
+    it('rejects an unknown capabilities subcommand instead of treating it as an approval', async () => {
+        const approveCapabilities = jest.fn();
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, model_policy_1.registerModelPolicyCommand)(program, { approveCapabilities: approveCapabilities });
+        await expect(program.parseAsync(['node', 'awm', 'model-policy', 'capabilities', 'revoke', '--file', 'receipt.json', '--expected-digest', 'a'.repeat(64)])).rejects.toThrow();
+        expect(approveCapabilities).not.toHaveBeenCalled();
+    });
+    it('rejects an empty replacement digest for capability approval at the command boundary', async () => {
+        const approveCapabilities = jest.fn();
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, model_policy_1.registerModelPolicyCommand)(program, { approveCapabilities: approveCapabilities });
+        await expect(program.parseAsync(['node', 'awm', 'model-policy', 'capabilities', 'approve', '--file', 'receipt.json', '--expected-digest', 'a'.repeat(64), '--replace-digest', ''])).rejects.toThrow(/requires a non-empty value/);
+        expect(approveCapabilities).not.toHaveBeenCalled();
+    });
+});

package/dist/tests/commands/plan/index.test.js

@@ -48,6 +48,18 @@ describe('plan validate Commander wiring', () => {
         stdoutWrite.mockRestore();
         process.exitCode = previousExitCode;
     });
+    it('returns v1 not-required before reading personal policy or capability state', async () => {
+        const policy = jest.fn();
+        const capabilities = jest.fn();
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, plan_1.registerPlanCommand)(program, { validatePlanFile: () => valid, readEffectivePolicy: policy, readCapabilities: capabilities });
+        await program.parseAsync(['node', 'awm', 'plan', 'resolve', 'plans/r4.md', '--provider', 'codex', '--runtime-kind', 'native', '--runtime-version', '1.0.0', '--account-scope-digest', 'a'.repeat(64), '--role', 'controller', '--json']);
+        expect(JSON.parse(String(stdoutWrite.mock.calls[0][0]))).toEqual({ state: 'not-required', reason: 'v1-without-opt-in' });
+        expect(policy).not.toHaveBeenCalled();
+        expect(capabilities).not.toHaveBeenCalled();
+    });
     it('emits deterministic human output for a valid compact plan', async () => {
         await commandFor(valid).parseAsync(['node', 'awm', 'plan', 'validate', 'plans/r4.md']);
         expect(String(stdoutWrite.mock.calls[0][0])).toBe('Plan validation: valid "plans/r4.md" (compact-slices/v1; 1 slices; 5 requirements; complete ownership)\n');
@@ -192,6 +204,46 @@ describe('plan validate Commander wiring', () => {
     });
 });
 describe('plan admit Commander wiring', () => {
+    it('does not read v2 routing facts after currentness blocks', async () => {
+        const policy = jest.fn();
+        const capabilities = jest.fn();
+        const output = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, plan_1.registerPlanCommand)(program, { validatePlanFile: () => ({ ...valid, schema: 'compact-slices/v2', manifest: { ...valid.manifest, schema: 'compact-slices/v2', slices: valid.manifest.slices.map(slice => ({ ...slice, implementerProfile: 'mechanical' })) } }), readPreferences: () => ({ defaultAgent: 'codex', enabledAgents: ['codex'], installMethod: 'symlink', defaultScope: 'local' }), readEffectivePolicy: policy, readCapabilities: capabilities, listRegistries: () => [], checkCurrentness: async () => ({ checkedAt: 'x', compatibility: { status: 'not-checked' }, components: [{ component: 'cli', installed: '1', latest: '2', channel: 'stable', source: 'x', checkedAt: 'x', status: 'stale', detail: 'x', remedy: 'x' }] }) });
+        try {
+            await program.parseAsync(['node', 'awm', 'plan', 'admit', 'plan.md', '--provider', 'codex', '--cwd', repositoryRoot, '--require-current', '--runtime-kind', 'native', '--runtime-version', '1.0.0', '--account-scope-digest', 'a'.repeat(64), '--json']);
+            expect(policy).not.toHaveBeenCalled();
+            expect(capabilities).not.toHaveBeenCalled();
+        }
+        finally {
+            output.mockRestore();
+            process.exitCode = undefined;
+        }
+    });
+    it.each([
+        ['invalid plan', invalid, 'codex', ['codex']],
+        ['invalid provider', valid, 'not-a-provider', ['codex']],
+        ['disabled provider', valid, 'codex', ['cursor']],
+    ])('does not read routing facts for %s even with complete runtime flags', async (_name, report, provider, enabledAgents) => {
+        const policy = jest.fn();
+        const capabilities = jest.fn();
+        const output = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, plan_1.registerPlanCommand)(program, { validatePlanFile: () => report, readPreferences: () => ({ defaultAgent: 'codex', enabledAgents: [...enabledAgents], installMethod: 'symlink', defaultScope: 'local' }), readEffectivePolicy: policy, readCapabilities: capabilities });
+        try {
+            await program.parseAsync(['node', 'awm', 'plan', 'admit', 'plan.md', '--provider', provider, '--cwd', repositoryRoot, '--runtime-kind', 'native', '--runtime-version', '1.0.0', '--account-scope-digest', 'a'.repeat(64), '--json']);
+            expect(policy).not.toHaveBeenCalled();
+            expect(capabilities).not.toHaveBeenCalled();
+        }
+        finally {
+            output.mockRestore();
+            process.exitCode = undefined;
+        }
+    });
     it('derives desatendido from the canonical plan header and requires a journal without a flag', async () => {
         const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-admit-header-'));
         const output = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);

package/dist/tests/commands/watch/apply.test.js

@@ -194,6 +194,18 @@ describe('aplicacion transaccional de requests', () => {
         expect(Object.values(s.appliedRequests).some((a) => a.outcome === 'rejected-stale-generation')).toBe(true);
         expect(s.controllerHeartbeatAt).toBeUndefined();
     });
+    test('routing reserve/observe es supervisado, idempotente y una generacion vieja no muta intentos', () => {
+        const envelope = { schema: 'routing-envelope/v1', runtime: { target: 'codex', kind: 'native', version: '1', accountScopeDigest: '0'.repeat(64) }, role: 'implementer', sliceId: 'S1', requestedProfile: 'mechanical', effectiveProfile: 'mechanical', resolved: { selector: { kind: 'model', id: 'm' }, effort: { kind: 'explicit', value: 'medium' } }, outcome: 'native', unavailableEvidence: [], policyDigest: 'a'.repeat(64), capabilityDigest: 'b'.repeat(64), planDigest: 'c'.repeat(64), executionDigest: 'd'.repeat(64) };
+        (0, requests_1.emitRequest)(repo, 'rama', { kind: 'routing-reserve', generationToken: 'g1', idempotencyKey: 'routing-1', payload: { obligationId: 'o1', lineageId: 'l1', envelope, fingerprint: 'e'.repeat(64) } });
+        (0, apply_1.consumePendingRequests)(repo, 'rama', 'g1');
+        const attempt = (0, store_1.readJournal)(repo, 'rama').state.routingAttempts[0];
+        (0, requests_1.emitRequest)(repo, 'rama', { kind: 'routing-observe', generationToken: 'g1', idempotencyKey: 'routing-2', payload: { attemptId: attempt.id, nativeAgentId: 'native-1' } });
+        (0, apply_1.consumePendingRequests)(repo, 'rama', 'g1');
+        expect((0, store_1.readJournal)(repo, 'rama').state.routingAttempts[0]).toMatchObject({ state: 'active', nativeAgentId: 'native-1' });
+        (0, requests_1.emitRequest)(repo, 'rama', { kind: 'routing-reserve', generationToken: 'old', idempotencyKey: 'routing-old', payload: { obligationId: 'o1', lineageId: 'l2', envelope, fingerprint: 'f'.repeat(64) } });
+        expect((0, apply_1.consumePendingRequests)(repo, 'rama', 'g1').rejectedStale).toBe(1);
+        expect((0, store_1.readJournal)(repo, 'rama').state.routingAttempts).toHaveLength(1);
+    });
     test('request corrupta se aparta VISIBLE como .corrupt, jamas se descarta (R1.6)', () => {
         fs_1.default.writeFileSync(path_1.default.join((0, paths_1.requestsDir)(repo, 'rama'), 'req-roto.json'), '{no-json');
         const out = (0, apply_1.consumePendingRequests)(repo, 'rama', 'g1');

package/dist/tests/core/admission/index.test.js

@@ -11,6 +11,54 @@ const valid = {
     },
 };
 describe('admitPlan', () => {
+    const sha = 'a'.repeat(64);
+    const routing = () => ({
+        now: new Date('2026-09-17T12:00:00.000Z'),
+        runtime: { target: 'codex', kind: 'native', version: '1.0.0', accountScopeDigest: sha },
+        policy: { schema: 'approved-model-policy/v1', content: { schema: 'model-policy/v1', mappings: [{ target: 'codex', runtimeKind: 'native', profiles: { mechanical: { selector: { kind: 'model', id: 'm' }, effort: { kind: 'explicit', value: 'low' } }, integration: { selector: { kind: 'model', id: 'i' }, effort: { kind: 'explicit', value: 'medium' } }, judgment: { selector: { kind: 'model', id: 'j' }, effort: { kind: 'explicit', value: 'medium' } } }, fullCapability: { selector: { kind: 'model', id: 'f' }, effort: { kind: 'explicit', value: 'high' } }, degradation: { allowMissingModelOverride: false, allowMissingEffortOverride: false, allowMissingObservedIdentity: false } }], implementationBudget: { maxAttempts: 3, escalation: ['mechanical', 'integration', 'judgment'], judgmentEfforts: ['medium', 'high'] } }, contentDigest: sha, approval: { approvedAt: '2026-09-17T00:00:00.000Z', approvalId: 'approval' }, lineage: { previousDigest: null } },
+        capabilities: { schema: 'routing-capabilities/v1', runtime: { target: 'codex', kind: 'native', version: '1.0.0', accountScopeDigest: sha }, recordedAt: '2026-09-17T00:00:00.000Z', expiresAt: '2026-09-18T00:00:00.000Z', capabilities: { artifactDelivery: 'unverified', interactiveExecution: 'supported', unattendedController: 'supported', nativeSubagents: 'unverified', modelOverride: 'supported', effortOverride: 'supported', observedModelEvidence: 'supported', durableResume: 'unverified' }, availableSelections: ['m', 'i', 'j', 'f'].map((id, n) => ({ selector: { kind: 'model', id }, effort: { kind: 'explicit', value: n === 0 ? 'low' : n === 3 ? 'high' : 'medium' } })), evidence: ['interactiveExecution', 'unattendedController', 'modelOverride', 'effortOverride', 'observedModelEvidence'].map(capability => ({ capability: capability, kind: 'native-control', receiptDigest: sha })), approval: { approvalId: 'approval', snapshotDigest: sha } },
+    });
+    const v2 = (profile = 'mechanical') => ({ ...valid, schema: 'compact-slices/v2', manifest: { ...valid.manifest, schema: 'compact-slices/v2', slices: valid.manifest.slices.map(slice => ({ ...slice, implementerProfile: profile })) } });
+    it('blocks v2 routing only after existing sensors pass when routing facts are absent', async () => {
+        const report = await (0, admission_1.admitPlan)({ plan: v2(), provider: 'codex', cwd: process.cwd(), enabledAgents: ['codex'], verifySensors: true, sensors: { overall: 'pass', sensors: [] } });
+        expect(report).toMatchObject({ state: 'blocked', sensors: 'pass' });
+        expect(report.diagnostics[0].code).toBe('ADMISSION_ROUTING_FACTS_REQUIRED');
+    });
+    it.each([
+        ['journal', { provider: 'codex', executionMode: 'desatendido' }],
+        ['provider capability', { provider: 'cursor', executionMode: 'interactivo' }],
+    ])('does not invoke deferred v2 routing facts when %s gate blocks', async (_name, fields) => {
+        const reader = jest.fn(() => { throw new Error('routing reader must not run'); });
+        const report = await (0, admission_1.admitPlan)({ plan: v2(), cwd: process.cwd(), enabledAgents: [fields.provider], routingReader: reader, ...fields });
+        expect(report.state).toBe('blocked');
+        expect(reader).not.toHaveBeenCalled();
+    });
+    it.each(['fail', 'not_certified'])('does not invoke deferred v2 routing facts when sensors are %s', async (overall) => {
+        const reader = jest.fn(() => { throw new Error('routing reader must not run'); });
+        const report = await (0, admission_1.admitPlan)({ plan: v2(), provider: 'codex', cwd: process.cwd(), enabledAgents: ['codex'], verifySensors: true, sensors: { overall, sensors: [] }, routingReader: reader });
+        expect(report).toMatchObject({ state: 'blocked', sensors: overall === 'not_certified' ? 'not-certified' : 'fail' });
+        expect(reader).not.toHaveBeenCalled();
+    });
+    it('does not invoke deferred v2 routing facts when compatibility blocks', async () => {
+        const reader = jest.fn(() => { throw new Error('routing reader must not run'); });
+        const currentness = { checkedAt: 'x', compatibility: { status: 'not-checked' }, components: [{ component: 'cli', installed: '1', latest: '1', channel: 'stable', source: 'x', checkedAt: 'x', status: 'current', detail: 'x', remedy: 'none' }] };
+        const report = await (0, admission_1.admitPlan)({ plan: v2(), provider: 'codex', cwd: process.cwd(), enabledAgents: ['codex'], requireCurrent: true, provenance: 'proven', currentness, compatibilityDiagnostics: [{ code: 'COMPAT', message: 'blocked' }], routingReader: reader });
+        expect(report).toMatchObject({ state: 'blocked', diagnostics: [expect.objectContaining({ code: 'COMPAT' })] });
+        expect(reader).not.toHaveBeenCalled();
+    });
+    it.each(['mechanical', 'integration', 'judgment'])('admits v2 %s with policy and capability evidence and an honest unknown forecast', async (profile) => {
+        const report = await (0, admission_1.admitPlan)({ plan: v2(profile), provider: 'codex', cwd: process.cwd(), enabledAgents: ['codex'], routing: routing() });
+        expect(report).toMatchObject({ state: 'admitted', routingForecast: { implementerProfiles: { [profile]: 1 }, trackB: { state: 'unavailable', lowerBound: 1 }, controller: { state: 'unavailable', lowerBound: 0 } } });
+    });
+    it('blocks a valid cross-provider policy and receipt instead of admitting codex under another runtime target', async () => {
+        const evidence = routing();
+        const foreign = structuredClone(evidence);
+        foreign.runtime.target = 'cursor';
+        foreign.policy.content.mappings[0].target = 'cursor';
+        foreign.capabilities.runtime.target = 'cursor';
+        const report = await (0, admission_1.admitPlan)({ plan: v2(), provider: 'codex', cwd: process.cwd(), enabledAgents: ['codex'], routing: foreign });
+        expect(report).toMatchObject({ state: 'blocked', provider: 'codex', diagnostics: [expect.objectContaining({ code: 'ADMISSION_ROUTING_PROVIDER_MISMATCH' })] });
+    });
     it('rejects a forecast whose total or role topology does not match its slices', () => {
         const forecast = { kind: 'topology', slices: 2, roles: { implementer: 2, 'specification-reviewer': 2, 'code-quality-reviewer': 2, 'final-reviewer': 1, 'track-a-qa': 1, 'track-b-qa': 1, documentation: 1, retro: 1, finishing: 1 }, total: 99 };
         expect(() => (0, admission_1.sanitizeAdmissionReport)({ state: 'admitted', planState: 'valid', journal: 'not-required', currentness: 'not-checked', sensors: 'not-required', diagnostics: [], forecast })).toThrow(/invalid report/);
@@ -18,6 +66,11 @@ describe('admitPlan', () => {
         forecast.roles.implementer = 1;
         expect(() => (0, admission_1.sanitizeAdmissionReport)({ state: 'admitted', planState: 'valid', journal: 'not-required', currentness: 'not-checked', sensors: 'not-required', diagnostics: [], forecast })).toThrow(/invalid report/);
     });
+    it('rejects forged routing forecast role keys and profile totals at the public sanitizer', () => {
+        const base = { kind: 'routing-v1', slices: 1, implementerProfiles: { mechanical: 1, integration: 0, judgment: 0 }, roles: { 'specification-reviewer': 1, 'code-quality-reviewer': 1, 'final-reviewer': 1, 'track-a-qa': 1, documentation: 1, retro: 1, finishing: 1 }, trackB: { state: 'unavailable', lowerBound: 1 }, controller: { state: 'unavailable', lowerBound: 0 } };
+        expect(() => (0, admission_1.sanitizeAdmissionReport)({ state: 'admitted', planState: 'valid', journal: 'not-required', currentness: 'not-checked', sensors: 'not-required', diagnostics: [], routingForecast: { ...base, roles: { ...base.roles, architecture: 1 } } })).toThrow(/invalid report/);
+        expect(() => (0, admission_1.sanitizeAdmissionReport)({ state: 'admitted', planState: 'valid', journal: 'not-required', currentness: 'not-checked', sensors: 'not-required', diagnostics: [], routingForecast: { ...base, implementerProfiles: { ...base.implementerProfiles, mechanical: 0 } } })).toThrow(/invalid report/);
+    });
     it('preserves the distinct unsupported plan state and bounded validator diagnostic', async () => {
         const report = await (0, admission_1.admitPlan)({ plan: { state: 'unsupported', schema: 'compact-slices/v9', diagnostics: [{ code: 'PLAN_UNSUPPORTED_SCHEMA', message: `future\u001b${'x'.repeat(5000)}` }] }, provider: 'codex', cwd: process.cwd() });
         expect(report).toMatchObject({ state: 'blocked', planState: 'unsupported', currentness: 'not-checked', sensors: 'not-required' });