agentic-workflow-manager 9.8.0 → 9.10.0

package/dist/tests/core/model-policy/capabilities.test.js

@@ -0,0 +1,365 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const capabilities_1 = require("../../../src/core/model-policy/capabilities");
+const digest = 'a'.repeat(64);
+const receipt = () => ({
+    schema: 'routing-capabilities/v1',
+    runtime: { target: 'codex', kind: 'native', version: '1.0.0', accountScopeDigest: digest },
+    recordedAt: '2026-09-17T00:00:00.000Z', expiresAt: '2026-09-18T00:00:00.000Z',
+    capabilities: { artifactDelivery: 'unverified', interactiveExecution: 'supported', unattendedController: 'supported', nativeSubagents: 'unverified', modelOverride: 'supported', effortOverride: 'supported', observedModelEvidence: 'supported', durableResume: 'unverified' },
+    availableSelections: [{ selector: { kind: 'model', id: 'full' }, effort: { kind: 'explicit', value: 'high' } }],
+    runtimeDefaultSelection: { selector: { kind: 'model', id: 'full' }, effort: { kind: 'explicit', value: 'high' } },
+    evidence: ['interactiveExecution', 'unattendedController', 'modelOverride', 'effortOverride', 'observedModelEvidence'].map(capability => ({ capability, kind: 'native-control', receiptDigest: digest })),
+    approval: { approvalId: 'approval-1', snapshotDigest: digest },
+});
+/** A child can retain its fixture script briefly after it reports an outcome on
+ * Windows. Retry only that documented transient after every child has exited. */
+async function removeC2Fixture(target, attempts = 10, delayMs = 50, remove = (pathToRemove) => fs_1.default.rmSync(pathToRemove, { recursive: true, force: true }), isWindows = process.platform === 'win32') {
+    for (let attempt = 0; attempt < attempts; attempt++) {
+        try {
+            remove(target);
+            return;
+        }
+        catch (error) {
+            if (!isWindows || error.code !== 'EBUSY' || attempt === attempts - 1)
+                throw error;
+            await new Promise(resolve => setTimeout(resolve, delayMs));
+        }
+    }
+}
+function startC2Competitor(root, candidate, expectedDigest, predecessor, awmHome) {
+    const module = path_1.default.resolve(__dirname, '../../../dist/src/core/model-policy/capabilities.js');
+    const worker = path_1.default.join(root, `c2-competitor-${path_1.default.basename(candidate)}.js`);
+    fs_1.default.writeFileSync(worker, `
+const { approveCapabilities, capabilityReceiptDigest } = require(process.env.C2_CAPABILITIES_MODULE);
+function report(message) {
+    if (typeof process.send !== 'function' || !process.connected) process.exit(1);
+    process.send(message, () => {
+        if (process.connected) process.disconnect();
+    });
+}
+process.once('message', message => {
+    if (message !== 'go') process.exit(1);
+    try {
+        const receipt = approveCapabilities({ file: process.env.C2_CANDIDATE, cwd: process.env.C2_CWD, expectedDigest: process.env.C2_EXPECTED_DIGEST, replaceDigest: process.env.C2_PREDECESSOR, now: new Date(process.env.C2_NOW) });
+        report({ outcome: 'accepted', digest: capabilityReceiptDigest(receipt) });
+    } catch (error) {
+        report({ outcome: 'rejected', reason: error instanceof Error ? error.message : String(error) });
+    }
+});
+process.once('disconnect', () => process.exit(0));
+process.send({ type: 'ready' });
+`);
+    let readyResolve;
+    let readyReject;
+    let outcomeResolve;
+    let outcomeReject;
+    let readySettled = false;
+    let outcomeSettled = false;
+    let exitResolve;
+    const ready = new Promise((resolve, reject) => { readyResolve = resolve; readyReject = reject; });
+    const outcome = new Promise((resolve, reject) => { outcomeResolve = resolve; outcomeReject = reject; });
+    const exited = new Promise(resolve => { exitResolve = resolve; });
+    const child = (0, child_process_1.fork)(worker, [], { cwd: root, env: { ...process.env, AWM_HOME: awmHome, C2_CAPABILITIES_MODULE: module, C2_CANDIDATE: candidate, C2_CWD: root, C2_EXPECTED_DIGEST: expectedDigest, C2_PREDECESSOR: predecessor, C2_NOW: '2026-09-17T12:00:00.000Z' }, stdio: ['ignore', 'ignore', 'ignore', 'ipc'] });
+    const rejectPending = (error) => {
+        if (!readySettled) {
+            readySettled = true;
+            readyReject(error);
+        }
+        if (!outcomeSettled) {
+            outcomeSettled = true;
+            outcomeReject(error);
+        }
+    };
+    child.once('error', rejectPending);
+    child.on('message', (message) => {
+        if (message && typeof message === 'object' && message.type === 'ready') {
+            if (!readySettled) {
+                readySettled = true;
+                readyResolve();
+            }
+            return;
+        }
+        const result = message;
+        if (!outcomeSettled && (result.outcome === 'accepted' || result.outcome === 'rejected')) {
+            outcomeSettled = true;
+            outcomeResolve(result);
+        }
+    });
+    child.once('exit', code => { exitResolve(); rejectPending(new Error(`C2 competitor exited before reporting an outcome (${code})`)); });
+    // A failure before both outcomes are awaited must not leave a rejected
+    // promise unobserved while the test's finally block is closing the child.
+    void ready.catch(() => undefined);
+    void outcome.catch(() => undefined);
+    return {
+        ready,
+        release: () => {
+            if (!child.connected)
+                throw new Error('C2 competitor IPC closed before release');
+            child.send('go');
+        },
+        outcome,
+        close: async () => {
+            if (child.exitCode !== null || child.signalCode !== null)
+                return exited;
+            if (child.connected) {
+                try {
+                    child.disconnect();
+                }
+                catch (error) {
+                    if (error.code !== 'ERR_IPC_DISCONNECTED')
+                        throw error;
+                }
+            }
+            const timeout = setTimeout(() => {
+                if (child.exitCode === null && child.signalCode === null)
+                    child.kill();
+            }, 5000);
+            try {
+                await exited;
+            }
+            finally {
+                clearTimeout(timeout);
+            }
+        },
+    };
+}
+describe('capability receipt validation', () => {
+    it('accepts an exhaustive explicit native attestation', () => {
+        expect((0, capabilities_1.validateCapabilityReceipt)(receipt())).toMatchObject({ runtime: { target: 'codex', kind: 'native' } });
+    });
+    it.each([
+        ['renderer-only supported evidence', () => { const value = receipt(); value.evidence[0].kind = 'unsupported'; return value; }],
+        ['expiry greater than 24 hours', () => { const value = receipt(); value.expiresAt = '2026-09-18T00:00:00.001Z'; return value; }],
+        ['missing capability field', () => { const value = receipt(); delete value.capabilities.effortOverride; return value; }],
+    ])('rejects %s', (_name, make) => expect(() => (0, capabilities_1.validateCapabilityReceipt)(make())).toThrow());
+    it.each(['September 17, 2026 00:00:00 UTC', '2026-09-17', '2026-09-17T00:00:00.000+00:00', '2026-09-17T00:00:00.000Zx', '2026-02-30T00:00:00.000Z', '2026-09-17T00:00:00Z'])('rejects a noncanonical receipt timestamp: %s', timestamp => {
+        const recorded = receipt();
+        recorded.recordedAt = timestamp;
+        const expires = receipt();
+        expires.expiresAt = timestamp;
+        expect(() => (0, capabilities_1.validateCapabilityReceipt)(recorded)).toThrow();
+        expect(() => (0, capabilities_1.validateCapabilityReceipt)(expires)).toThrow();
+    });
+    it.each(['renderer', 'documentation'])('does not certify supported execution from %s evidence', kind => {
+        const value = receipt();
+        value.evidence = value.evidence.map(entry => ({ ...entry, kind: kind }));
+        expect(() => (0, capabilities_1.validateCapabilityReceipt)(value)).toThrow(/evidence|native/i);
+    });
+    it('reads absent capability state without creating operator storage', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-receipt-'));
+        const prior = process.env.AWM_HOME;
+        process.env.AWM_HOME = path_1.default.join(root, 'operator');
+        try {
+            expect((0, capabilities_1.readCapabilities)(receipt().runtime, new Date('2026-09-17T12:00:00.000Z'))).toEqual({ state: 'absent' });
+            expect(fs_1.default.existsSync(process.env.AWM_HOME)).toBe(false);
+        }
+        finally {
+            if (prior === undefined)
+                delete process.env.AWM_HOME;
+            else
+                process.env.AWM_HOME = prior;
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('uses only a validated target and runtime kind in its persistence path', () => {
+        expect((0, capabilities_1.capabilityReceiptPath)(receipt().runtime)).toMatch(/routing-capabilities[\\/]codex[\\/]native\.json$/);
+        expect(() => (0, capabilities_1.capabilityReceiptPath)({ ...receipt().runtime, kind: '../native' })).toThrow();
+    });
+    it.each(['2026-09-15T23:59:59.999Z', '2026-09-18T00:00:00.001Z'])('rejects stale or future approval at the injected clock', recordedAt => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-receipt-'));
+        const candidate = path_1.default.join(root, 'receipt.json');
+        const value = receipt();
+        value.recordedAt = recordedAt;
+        value.expiresAt = recordedAt === '2026-09-15T23:59:59.999Z' ? '2026-09-16T23:59:59.999Z' : '2026-09-19T00:00:00.001Z';
+        fs_1.default.writeFileSync(candidate, JSON.stringify(value));
+        try {
+            expect(() => (0, capabilities_1.approveCapabilities)({ file: candidate, cwd: root, expectedDigest: (0, capabilities_1.capabilityReceiptDigest)(value), now: new Date('2026-09-17T00:00:00.000Z') })).toThrow(/future|stale/);
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('rejects an empty replace digest before reading or writing capability state', () => {
+        expect(() => (0, capabilities_1.approveCapabilities)({ file: 'missing.json', cwd: process.cwd(), expectedDigest: digest, replaceDigest: '' })).toThrow(/replaceDigest/);
+    });
+    it('rejects a symlinked candidate and a symlinked receipt destination', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-receipt-'));
+        const linked = path_1.default.join(root, 'linked.json');
+        const outside = path_1.default.join(root, 'outside.json');
+        fs_1.default.writeFileSync(outside, JSON.stringify(receipt()));
+        const before = fs_1.default.readFileSync(outside);
+        fs_1.default.symlinkSync(outside, linked);
+        try {
+            expect(() => (0, capabilities_1.approveCapabilities)({ file: linked, cwd: root, expectedDigest: digest, now: new Date('2026-09-17T00:00:00.000Z') })).toThrow(/symlink|unsafe/);
+            expect(fs_1.default.readFileSync(outside).equals(before)).toBe(true);
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it.each(['destination', 'ancestor'])('rejects a symlinked %s without changing external bytes', kind => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-receipt-'));
+        const prior = process.env.AWM_HOME;
+        process.env.AWM_HOME = path_1.default.join(root, 'operator');
+        const external = path_1.default.join(root, 'external.json');
+        fs_1.default.writeFileSync(external, 'outside');
+        const runtime = receipt().runtime;
+        try {
+            const target = (0, capabilities_1.capabilityReceiptPath)(runtime);
+            const ancestor = path_1.default.dirname(path_1.default.dirname(target));
+            if (kind === 'destination') {
+                fs_1.default.mkdirSync(path_1.default.dirname(target), { recursive: true });
+                fs_1.default.symlinkSync(external, target);
+            }
+            else {
+                const externalTree = path_1.default.join(root, 'external-tree');
+                const sentinel = path_1.default.join(externalTree, 'codex', 'native.json');
+                fs_1.default.mkdirSync(path_1.default.dirname(sentinel), { recursive: true });
+                fs_1.default.writeFileSync(sentinel, 'sentinel');
+                fs_1.default.mkdirSync(path_1.default.dirname(ancestor), { recursive: true });
+                fs_1.default.symlinkSync(externalTree, ancestor);
+            }
+            expect((0, capabilities_1.readCapabilities)(runtime, new Date('2026-09-17T12:00:00.000Z')).state).toBe('invalid');
+            expect(fs_1.default.readFileSync(external, 'utf8')).toBe('outside');
+        }
+        finally {
+            if (prior === undefined)
+                delete process.env.AWM_HOME;
+            else
+                process.env.AWM_HOME = prior;
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('publishes with exact predecessor CAS and leaves the accepted C2 receipt intact', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-receipt-'));
+        const previous = process.env.AWM_HOME;
+        process.env.AWM_HOME = path_1.default.join(root, 'operator');
+        const file = path_1.default.join(root, 'receipt.json');
+        const now = new Date('2026-09-17T12:00:00.000Z');
+        const first = receipt();
+        fs_1.default.writeFileSync(file, JSON.stringify(first));
+        try {
+            const firstDigest = (0, capabilities_1.capabilityReceiptDigest)(first);
+            expect((0, capabilities_1.approveCapabilities)({ file, cwd: root, expectedDigest: firstDigest, now })).toEqual(first);
+            expect(() => (0, capabilities_1.approveCapabilities)({ file, cwd: root, expectedDigest: firstDigest, now })).toThrow(/predecessor|exists/i);
+            const second = receipt();
+            second.approval.approvalId = 'approval-2';
+            fs_1.default.writeFileSync(file, JSON.stringify(second));
+            const secondDigest = (0, capabilities_1.capabilityReceiptDigest)(second);
+            expect(() => (0, capabilities_1.approveCapabilities)({ file, cwd: root, expectedDigest: secondDigest, replaceDigest: 'f'.repeat(64), now })).toThrow(/predecessor/);
+            expect((0, capabilities_1.approveCapabilities)({ file, cwd: root, expectedDigest: secondDigest, replaceDigest: firstDigest, now })).toEqual(second);
+            expect((0, capabilities_1.readCapabilities)(second.runtime, now)).toMatchObject({ state: 'current', digest: secondDigest });
+        }
+        finally {
+            if (previous === undefined)
+                delete process.env.AWM_HOME;
+            else
+                process.env.AWM_HOME = previous;
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('retries only bounded Windows EBUSY cleanup after a C2 child exits', async () => {
+        const calls = [];
+        await removeC2Fixture('fixture', 3, 0, () => {
+            calls.push('remove');
+            if (calls.length < 3)
+                throw Object.assign(new Error('busy'), { code: 'EBUSY' });
+        }, true);
+        expect(calls).toHaveLength(3);
+        await expect(removeC2Fixture('fixture', 3, 0, () => {
+            calls.push('non-busy');
+            throw Object.assign(new Error('denied'), { code: 'EPERM' });
+        }, true)).rejects.toThrow('denied');
+        expect(calls.filter(call => call === 'non-busy')).toHaveLength(1);
+    });
+    it('accepts exactly one process-raced C2 replacement from the same observed predecessor', async () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-receipt-'));
+        const prior = process.env.AWM_HOME;
+        const now = new Date('2026-09-17T12:00:00.000Z');
+        const file = path_1.default.join(root, 'receipt.json');
+        const base = receipt();
+        let leftProcess;
+        let rightProcess;
+        process.env.AWM_HOME = path_1.default.join(root, 'operator');
+        fs_1.default.writeFileSync(file, JSON.stringify(base));
+        try {
+            const predecessor = (0, capabilities_1.capabilityReceiptDigest)(base);
+            (0, capabilities_1.approveCapabilities)({ file, cwd: root, expectedDigest: predecessor, now });
+            const candidate = (id) => {
+                const value = receipt();
+                value.approval.approvalId = id;
+                const candidateFile = path_1.default.join(root, `${id}.json`);
+                fs_1.default.writeFileSync(candidateFile, JSON.stringify(value), { mode: 0o400 });
+                return { file: candidateFile, digest: (0, capabilities_1.capabilityReceiptDigest)(value) };
+            };
+            const left = candidate('left');
+            const right = candidate('right');
+            leftProcess = startC2Competitor(root, left.file, left.digest, predecessor, process.env.AWM_HOME);
+            rightProcess = startC2Competitor(root, right.file, right.digest, predecessor, process.env.AWM_HOME);
+            await Promise.all([leftProcess.ready, rightProcess.ready]);
+            leftProcess.release();
+            rightProcess.release();
+            const outcomes = await Promise.all([leftProcess.outcome, rightProcess.outcome]);
+            const accepted = outcomes.filter((outcome) => outcome.outcome === 'accepted');
+            const rejected = outcomes.filter((outcome) => outcome.outcome === 'rejected');
+            expect(accepted).toHaveLength(1);
+            expect(rejected).toHaveLength(1);
+            expect(rejected[0].reason).toMatch(/predecessor|lease|exist/i);
+            const persisted = (0, capabilities_1.readCapabilities)(base.runtime, now);
+            expect(persisted).toMatchObject({ state: 'current', digest: accepted[0].digest });
+            expect([left.digest, right.digest]).toContain(accepted[0].digest);
+        }
+        finally {
+            await Promise.all([leftProcess?.close(), rightProcess?.close()].filter((value) => value !== undefined));
+            if (prior === undefined)
+                delete process.env.AWM_HOME;
+            else
+                process.env.AWM_HOME = prior;
+            await removeC2Fixture(root);
+        }
+    });
+    it.each(['destination', 'ancestor'])('writer rejects symlinked %s and preserves external bytes', kind => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-receipt-'));
+        const prior = process.env.AWM_HOME;
+        process.env.AWM_HOME = path_1.default.join(root, 'operator');
+        const now = new Date('2026-09-17T12:00:00.000Z');
+        const value = receipt();
+        const file = path_1.default.join(root, 'candidate.json');
+        fs_1.default.writeFileSync(file, JSON.stringify(value));
+        const outside = path_1.default.join(root, 'outside');
+        fs_1.default.writeFileSync(outside, 'outside');
+        const target = (0, capabilities_1.capabilityReceiptPath)(value.runtime);
+        const ancestor = path_1.default.dirname(path_1.default.dirname(target));
+        try {
+            if (kind === 'destination') {
+                fs_1.default.mkdirSync(path_1.default.dirname(target), { recursive: true });
+                fs_1.default.symlinkSync(outside, target);
+            }
+            else {
+                const externalTree = path_1.default.join(root, 'external-tree');
+                const sentinel = path_1.default.join(externalTree, 'codex', 'native.json');
+                fs_1.default.mkdirSync(path_1.default.dirname(sentinel), { recursive: true });
+                fs_1.default.writeFileSync(sentinel, 'sentinel');
+                fs_1.default.mkdirSync(path_1.default.dirname(ancestor), { recursive: true });
+                fs_1.default.symlinkSync(externalTree, ancestor);
+            }
+            expect(() => (0, capabilities_1.approveCapabilities)({ file, cwd: root, expectedDigest: (0, capabilities_1.capabilityReceiptDigest)(value), now })).toThrow(/unsafe|symlink|lease/);
+            expect(fs_1.default.readFileSync(outside, 'utf8')).toBe('outside');
+        }
+        finally {
+            if (prior === undefined)
+                delete process.env.AWM_HOME;
+            else
+                process.env.AWM_HOME = prior;
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/core/model-policy/digest.test.js

@@ -0,0 +1,117 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const digest_1 = require("../../../src/core/model-policy/digest");
+const store_1 = require("../../../src/core/model-policy/store");
+const capabilities_1 = require("../../../src/core/model-policy/capabilities");
+const canonical_1 = require("../../../src/core/model-policy/canonical");
+const capabilities_2 = require("../../../src/core/model-policy/capabilities");
+const sha = 'a'.repeat(64);
+const policy = () => ({ schema: 'model-policy/v1', mappings: [{ target: 'codex', runtimeKind: 'native', profiles: {
+                mechanical: { selector: { kind: 'model', id: 'gpt-5.6-luna' }, effort: { kind: 'explicit', value: 'medium' } },
+                integration: { selector: { kind: 'model', id: 'gpt-5.6-terra' }, effort: { kind: 'explicit', value: 'medium' } },
+                judgment: { selector: { kind: 'model', id: 'gpt-5.6-sol' }, effort: { kind: 'explicit', value: 'medium' } },
+            }, fullCapability: { selector: { kind: 'model', id: 'gpt-5.6-sol' }, effort: { kind: 'explicit', value: 'high' } }, degradation: { allowMissingModelOverride: false, allowMissingEffortOverride: false, allowMissingObservedIdentity: false } }], implementationBudget: { maxAttempts: 3, escalation: ['mechanical', 'integration', 'judgment'], judgmentEfforts: ['medium', 'high'] } });
+const receipt = () => ({
+    schema: 'routing-capabilities/v1',
+    runtime: { target: 'codex', kind: 'native', version: '1.0.0', accountScopeDigest: sha },
+    recordedAt: '2026-09-17T00:00:00.000Z', expiresAt: '2026-09-18T00:00:00.000Z',
+    capabilities: { artifactDelivery: 'unverified', interactiveExecution: 'supported', unattendedController: 'supported', nativeSubagents: 'unverified', modelOverride: 'supported', effortOverride: 'supported', observedModelEvidence: 'supported', durableResume: 'unverified' },
+    availableSelections: [{ selector: { kind: 'model', id: 'full' }, effort: { kind: 'explicit', value: 'high' } }],
+    runtimeDefaultSelection: { selector: { kind: 'model', id: 'full' }, effort: { kind: 'explicit', value: 'high' } },
+    evidence: ['interactiveExecution', 'unattendedController', 'modelOverride', 'effortOverride', 'observedModelEvidence'].map(capability => ({ capability, kind: 'native-control', receiptDigest: sha })),
+    approval: { approvalId: 'approval-1', snapshotDigest: sha },
+});
+describe('candidateDigest', () => {
+    let cwd;
+    const home = process.env.HOME;
+    const awmHome = process.env.AWM_HOME;
+    beforeEach(() => { cwd = fs_1.default.mkdtempSync(path_1.default.join(fs_1.default.realpathSync(os_1.default.tmpdir()), 'awm-digest-')); process.env.HOME = cwd; process.env.AWM_HOME = path_1.default.join(cwd, '.awm'); });
+    afterEach(() => { fs_1.default.rmSync(cwd, { recursive: true, force: true }); if (home === undefined)
+        delete process.env.HOME;
+    else
+        process.env.HOME = home; if (awmHome === undefined)
+        delete process.env.AWM_HOME;
+    else
+        process.env.AWM_HOME = awmHome; });
+    const write = (name, value) => { const file = path_1.default.join(cwd, name); fs_1.default.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`); return name; };
+    it('emits the digest the policy approval path will demand, not a second opinion', () => {
+        const file = write('policy.json', policy());
+        expect((0, digest_1.candidateDigest)({ file, cwd })).toEqual({ schema: 'model-policy/v1', digest: (0, canonical_1.canonicalPolicyDigest)(policy()) });
+    });
+    it('emits the digest the capability approval path will demand', () => {
+        const file = write('receipt.json', receipt());
+        expect((0, digest_1.candidateDigest)({ file, cwd })).toEqual({ schema: 'routing-capabilities/v1', digest: (0, capabilities_2.capabilityReceiptDigest)(receipt()) });
+    });
+    it('is insensitive to key order and whitespace, because the digest is over the canonical form', () => {
+        const content = policy();
+        const reordered = { implementationBudget: content.implementationBudget, mappings: content.mappings, schema: content.schema };
+        fs_1.default.writeFileSync(path_1.default.join(cwd, 'a.json'), JSON.stringify(content));
+        fs_1.default.writeFileSync(path_1.default.join(cwd, 'b.json'), JSON.stringify(reordered, null, 4));
+        expect((0, digest_1.candidateDigest)({ file: 'a.json', cwd }).digest).toBe((0, digest_1.candidateDigest)({ file: 'b.json', cwd }).digest);
+    });
+    it('refuses a document whose declared schema it does not own, instead of guessing', () => {
+        const file = write('other.json', { schema: 'approved-model-policy/v1' });
+        expect(() => (0, digest_1.candidateDigest)({ file, cwd })).toThrow(/schema model-policy\/v1 or routing-capabilities\/v1/);
+    });
+    it('refuses an invalid document rather than emitting a digest approval would reject', () => {
+        const broken = policy();
+        delete broken.implementationBudget;
+        const file = write('broken.json', broken);
+        expect(() => (0, digest_1.candidateDigest)({ file, cwd })).toThrow();
+    });
+    it('reports an absent candidate loudly', () => {
+        expect(() => (0, digest_1.candidateDigest)({ file: 'missing.json', cwd })).toThrow(/absent/);
+    });
+    it('refuses a symlinked candidate, matching the approval path', () => {
+        write('policy.json', policy());
+        fs_1.default.symlinkSync(path_1.default.join(cwd, 'policy.json'), path_1.default.join(cwd, 'link.json'));
+        expect(() => (0, digest_1.candidateDigest)({ file: 'link.json', cwd })).toThrow(/unsafe/);
+    });
+    it('rejects malformed input instead of returning undefined', () => {
+        expect(() => (0, digest_1.candidateDigest)(undefined)).toThrow(/digest input is required/);
+        expect(() => (0, digest_1.candidateDigest)({ file: '', cwd })).toThrow(/bounded path/);
+        expect(() => (0, digest_1.candidateDigest)({ file: 'policy.json', cwd: '' })).toThrow(/bounded path/);
+        fs_1.default.writeFileSync(path_1.default.join(cwd, 'array.json'), '[]');
+        expect(() => (0, digest_1.candidateDigest)({ file: 'array.json', cwd })).toThrow(/must be a JSON object/);
+    });
+    // The point of the command: the digest it discloses is the one approval
+    // demands. A digest that merely looked plausible would be worthless, so the
+    // proof is that approval ACCEPTS it, not that two functions agree.
+    it('produces a digest that the policy approval path accepts end to end', () => {
+        const file = write('policy.json', policy());
+        const observed = [];
+        const boundary = {
+            withProjectLease: (_root, operation) => operation(),
+            readRegularFile: (target) => { const entry = { bytes: fs_1.default.readFileSync(target), identity: Object.freeze({}) }; observed.push(entry); return entry; },
+            writeProjectTransaction: (root, destination, content) => { const target = path_1.default.join(root, destination); fs_1.default.mkdirSync(path_1.default.dirname(target), { recursive: true }); fs_1.default.writeFileSync(target, content); },
+        };
+        const approved = (0, store_1.approvePolicyWithBoundary)({ file, scope: 'project', cwd, expectedDigest: (0, digest_1.candidateDigest)({ file, cwd }).digest }, boundary);
+        expect(approved.contentDigest).toBe((0, digest_1.candidateDigest)({ file, cwd }).digest);
+        expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(cwd, '.awm', 'model-policy.json'), 'utf8')).contentDigest).toBe(approved.contentDigest);
+    });
+    it('produces a digest that the capability approval path accepts end to end', () => {
+        const value = receipt();
+        const file = write('receipt.json', value);
+        const approved = (0, capabilities_1.approveCapabilities)({ file, cwd, expectedDigest: (0, digest_1.candidateDigest)({ file, cwd }).digest, now: new Date('2026-09-17T12:00:00.000Z') });
+        expect(approved).toEqual(value);
+    });
+    // Falsifiability: the same approval must REJECT any digest but the disclosed
+    // one, or the assertion above would pass against a command that emitted noise.
+    it('is the only digest approval accepts', () => {
+        const value = receipt();
+        const file = write('receipt.json', value);
+        expect(() => (0, capabilities_1.approveCapabilities)({ file, cwd, expectedDigest: 'f'.repeat(64), now: new Date('2026-09-17T12:00:00.000Z') })).toThrow(/does not match expectedDigest/);
+    });
+    it('writes nothing: digesting is not approving', () => {
+        const file = write('policy.json', policy());
+        (0, digest_1.candidateDigest)({ file, cwd });
+        expect(fs_1.default.existsSync(path_1.default.join(cwd, '.awm'))).toBe(false);
+        expect(fs_1.default.readdirSync(cwd).sort()).toEqual(['policy.json']);
+    });
+});

package/dist/tests/core/model-policy/journal.test.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const types_1 = require("../../../src/core/journal/types");
+const journal_1 = require("../../../src/core/model-policy/journal");
+const envelope = { schema: 'routing-envelope/v1', runtime: { target: 'codex', kind: 'native', version: '1', accountScopeDigest: '0'.repeat(64) }, role: 'implementer', sliceId: 'S1', requestedProfile: 'mechanical', effectiveProfile: 'mechanical', resolved: { selector: { kind: 'model', id: 'm' }, effort: { kind: 'explicit', value: 'medium' } }, outcome: 'native', unavailableEvidence: [], policyDigest: 'a'.repeat(64), capabilityDigest: 'b'.repeat(64), planDigest: 'c'.repeat(64), executionDigest: 'd'.repeat(64) };
+describe('routing journal helpers', () => {
+    it('reserves one idempotent attempt and records native observation', () => {
+        const state = (0, types_1.emptyState)('main');
+        const reserved = (0, journal_1.reserveRoutingAttempt)(state, { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope, fingerprint: 'e'.repeat(64) }, '2026-09-17T00:00:00.000Z');
+        const replay = (0, journal_1.reserveRoutingAttempt)(reserved.state, { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope, fingerprint: 'e'.repeat(64) }, '2026-09-17T00:01:00.000Z');
+        expect(replay.attemptId).toBe(reserved.attemptId);
+        const observed = (0, journal_1.observeRoutingAttempt)(replay.state, { attemptId: reserved.attemptId, nativeAgentId: 'native-1' }, '2026-09-17T00:02:00.000Z');
+        expect(observed.routingAttempts?.[0]).toMatchObject({ state: 'active', nativeAgentId: 'native-1' });
+    });
+    it('rejects a fourth implementer attempt in one lineage', () => {
+        let state = (0, types_1.emptyState)('main');
+        for (const [index, profile] of ['mechanical', 'integration', 'judgment'].entries()) {
+            state = (0, journal_1.reserveRoutingAttempt)(state, { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope: { ...envelope, effectiveProfile: profile }, fingerprint: `${'a'.repeat(63)}${index}` }, '2026-09-17T00:00:00.000Z').state;
+            state.routingAttempts[state.routingAttempts.length - 1].state = 'blocked';
+            state.routingAttempts[state.routingAttempts.length - 1].verdict = 'fail';
+        }
+        expect(() => (0, journal_1.reserveRoutingAttempt)(state, { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope, fingerprint: 'f'.repeat(64) }, '2026-09-17T00:00:00.000Z')).toThrow(/budget/i);
+    });
+    it('reports routing attempts without envelope bodies or native identities', () => {
+        const state = (0, journal_1.reserveRoutingAttempt)((0, types_1.emptyState)('main'), { obligationId: 'impl:S1', lineageId: 'lineage:S1', envelope, fingerprint: 'e'.repeat(64) }, '2026-09-17T00:00:00.000Z').state;
+        expect((0, journal_1.routingReport)(state)).toEqual({ schema: 'routing-report/v1', attempts: 1, plannedByRole: { implementer: 1 }, actualByRole: {}, byState: { reserved: 1 }, retries: 0, fallbacks: 0, unavailable: {}, verdicts: {}, administrativeRepairs: 0 });
+    });
+    it('uses the exact deterministic implementation escalation sequence', () => {
+        let state = (0, types_1.emptyState)('main');
+        expect((0, journal_1.resolveLineageEscalation)(state, 'l1', 'mechanical')).toEqual({ profile: 'mechanical', effort: 'medium' });
+        state = (0, journal_1.reserveRoutingAttempt)(state, { obligationId: 'impl:S1', lineageId: 'l1', envelope, fingerprint: '1'.repeat(64) }, '2026-09-17T00:00:00.000Z').state;
+        state.routingAttempts[0].state = 'blocked';
+        state.routingAttempts[0].verdict = 'fail';
+        expect((0, journal_1.resolveLineageEscalation)(state, 'l1', 'mechanical')).toEqual({ profile: 'integration', effort: 'medium' });
+        state.routingAttempts.push({ ...state.routingAttempts[0], id: 'route-2', attempt: 2, envelope: { ...envelope, effectiveProfile: 'integration' }, state: 'blocked', verdict: 'fail' });
+        expect((0, journal_1.resolveLineageEscalation)(state, 'l1', 'mechanical')).toEqual({ profile: 'judgment', effort: 'medium' });
+        state.routingAttempts.push({ ...state.routingAttempts[0], id: 'route-3', attempt: 3, envelope: { ...envelope, effectiveProfile: 'judgment', resolved: { selector: { kind: 'model', id: 'm' }, effort: { kind: 'explicit', value: 'medium' } } }, state: 'blocked', verdict: 'fail' });
+        expect((0, journal_1.resolveLineageEscalation)(state, 'l1', 'mechanical')).toEqual({ profile: 'judgment', effort: 'high' });
+        state.routingAttempts[2].envelope = { ...state.routingAttempts[2].envelope, resolved: { selector: { kind: 'model', id: 'm' }, effort: { kind: 'explicit', value: 'high' } } };
+        expect(() => (0, journal_1.resolveLineageEscalation)(state, 'l1', 'mechanical')).toThrow(/exhausted/i);
+    });
+    it('rejects hostile roles and unavailable provenance before it can reach a report', () => {
+        expect((0, types_1.isRoutingEnvelope)({ ...envelope, role: 'attacker-key' })).toBe(false);
+        expect((0, types_1.isRoutingEnvelope)({ ...envelope, unavailableEvidence: ['secret=leak'] })).toBe(false);
+    });
+});

package/dist/tests/core/model-policy/policy.test.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const canonical_1 = require("../../../src/core/model-policy/canonical");
+const validate_1 = require("../../../src/core/model-policy/validate");
+const selection = (id, effort = 'medium') => ({ selector: { kind: 'model', id }, effort: { kind: 'explicit', value: effort } });
+const policy = () => ({
+    schema: 'model-policy/v1',
+    mappings: [{ target: 'codex', runtimeKind: 'native', profiles: {
+                mechanical: selection('gpt-5.6-luna'), integration: selection('gpt-5.6-terra'), judgment: selection('gpt-5.6-sol'),
+            }, fullCapability: selection('gpt-5.6-sol', 'high'), degradation: {
+                allowMissingModelOverride: false, allowMissingEffortOverride: false, allowMissingObservedIdentity: false,
+            } }],
+    implementationBudget: { maxAttempts: 3, escalation: ['mechanical', 'integration', 'judgment'], judgmentEfforts: ['medium', 'high'] },
+});
+const approvedPolicy = () => ({ schema: 'approved-model-policy/v1', content: policy(), contentDigest: 'a'.repeat(64), approval: { approvedAt: '2026-09-17T00:00:00.000Z', approvalId: 'approval-1' }, lineage: { previousDigest: null } });
+describe('model policy validation and canonical digest', () => {
+    it.each(['September 17, 2026 00:00:00 UTC', '2026-09-17', '2026-09-17T00:00:00.000+00:00', '2026-09-17T00:00:00.000Zx', '2026-02-30T00:00:00.000Z', '2026-09-17T00:00:00Z'])('rejects a noncanonical approval timestamp: %s', approvedAt => {
+        const candidate = approvedPolicy();
+        candidate.approval.approvedAt = approvedAt;
+        expect(() => (0, validate_1.validateApprovedPolicy)(candidate)).toThrow(/approval\.approvedAt/);
+    });
+    it('validates the complete policy contract and gives reordered object keys the same digest', () => {
+        const candidate = policy();
+        const reordered = JSON.parse('{"implementationBudget":{"judgmentEfforts":["medium","high"],"escalation":["mechanical","integration","judgment"],"maxAttempts":3},"mappings":[{"fullCapability":{"effort":{"value":"high","kind":"explicit"},"selector":{"id":"gpt-5.6-sol","kind":"model"}},"degradation":{"allowMissingObservedIdentity":false,"allowMissingEffortOverride":false,"allowMissingModelOverride":false},"profiles":{"judgment":{"selector":{"kind":"model","id":"gpt-5.6-sol"},"effort":{"kind":"explicit","value":"medium"}},"integration":{"selector":{"kind":"model","id":"gpt-5.6-terra"},"effort":{"kind":"explicit","value":"medium"}},"mechanical":{"selector":{"kind":"model","id":"gpt-5.6-luna"},"effort":{"kind":"explicit","value":"medium"}}},"runtimeKind":"native","target":"codex"}],"schema":"model-policy/v1"}');
+        expect((0, validate_1.validatePolicyContent)(candidate)).toEqual(candidate);
+        expect((0, canonical_1.canonicalPolicyDigest)(candidate)).toBe((0, canonical_1.canonicalPolicyDigest)(reordered));
+    });
+    it('preserves array order in the digest', () => {
+        const candidate = policy();
+        const swapped = structuredClone(policy());
+        const second = structuredClone(swapped.mappings[0]);
+        second.target = 'claude-code';
+        swapped.mappings.push(second);
+        candidate.mappings.push(structuredClone(second));
+        swapped.mappings.reverse();
+        expect((0, canonical_1.canonicalPolicyDigest)(candidate)).not.toBe((0, canonical_1.canonicalPolicyDigest)(swapped));
+    });
+    it.each([
+        ['unknown field', () => ({ ...policy(), unexpected: true })],
+        ['partial profile map', () => { const value = policy(); delete value.mappings[0].profiles.judgment; return value; }],
+        ['duplicate target/runtime map', () => { const value = policy(); value.mappings.push(structuredClone(value.mappings[0])); return value; }],
+        ['unsafe runtime kind', () => { const value = policy(); value.mappings[0].runtimeKind = '../native'; return value; }],
+        ['unsafe model id control character', () => { const value = policy(); value.mappings[0].profiles.mechanical.selector.id = 'bad\nmodel'; return value; }],
+    ])('rejects %s', (_name, make) => {
+        expect(() => (0, validate_1.validatePolicyContent)(make())).toThrow();
+    });
+});