agentic-workflow-manager 9.8.0 → 9.10.0

package/dist/tests/core/model-policy/resolve.test.js

@@ -0,0 +1,185 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = __importDefault(require("path"));
+const resolve_1 = require("../../../src/core/model-policy/resolve");
+const resolve_2 = require("../../../src/core/model-policy/resolve");
+const validate_1 = require("../../../src/core/plan/validate");
+const sha = 'a'.repeat(64);
+const selection = (id, value) => ({ selector: { kind: 'model', id }, effort: { kind: 'explicit', value } });
+const runtimeDefaultSelection = (id) => ({ selector: { kind: 'model', id }, effort: { kind: 'runtime-default' } });
+const verifiedV1Plan = (0, validate_1.validatePlanFile)('docs/plans/2026-09-14-compact-only-bootstrap-plan.md', path_1.default.resolve(__dirname, '../../../..'));
+if (verifiedV1Plan.state !== 'valid')
+    throw new Error(`tracked bootstrap plan must validate before resolver tests: ${verifiedV1Plan.state}`);
+const policy = () => ({ schema: 'approved-model-policy/v1', content: { schema: 'model-policy/v1', mappings: [{ target: 'codex', runtimeKind: 'native', profiles: { mechanical: selection('mechanical', 'low'), integration: selection('integration', 'medium'), judgment: selection('judgment', 'medium') }, fullCapability: selection('full', 'high'), degradation: { allowMissingModelOverride: false, allowMissingEffortOverride: false, allowMissingObservedIdentity: false } }], implementationBudget: { maxAttempts: 3, escalation: ['mechanical', 'integration', 'judgment'], judgmentEfforts: ['medium', 'high'] } }, contentDigest: sha, approval: { approvedAt: '2026-09-17T00:00:00.000Z', approvalId: 'approval-1' }, lineage: { previousDigest: null } });
+const capabilities = () => ({ schema: 'routing-capabilities/v1', runtime: { target: 'codex', kind: 'native', version: '1.0.0', accountScopeDigest: sha }, recordedAt: '2026-09-17T00:00:00.000Z', expiresAt: '2026-09-18T00:00:00.000Z', capabilities: { artifactDelivery: 'unverified', interactiveExecution: 'supported', unattendedController: 'supported', nativeSubagents: 'unverified', modelOverride: 'supported', effortOverride: 'supported', observedModelEvidence: 'supported', durableResume: 'unverified' }, availableSelections: [selection('mechanical', 'low'), selection('integration', 'medium'), selection('judgment', 'medium'), selection('full', 'high')], evidence: ['interactiveExecution', 'unattendedController', 'modelOverride', 'effortOverride', 'observedModelEvidence'].map(capability => ({ capability, kind: 'native-control', receiptDigest: sha })), approval: { approvalId: 'approval-1', snapshotDigest: sha } });
+const input = () => ({ role: 'implementer', requestedProfile: 'mechanical', policy: policy(), capabilities: capabilities(), runtime: capabilities().runtime, now: new Date('2026-09-17T12:00:00.000Z') });
+describe('resolveSelection', () => {
+    it('rejects a structurally fabricated v1 report before resolution', () => {
+        expect(() => (0, resolve_2.resolveV1Dispatch)({ ...input(), plan: { state: 'valid', schema: 'compact-slices/v1', planDigest: sha, manifest: {} }, optInV1: false })).toThrow(/invalid valid report/);
+    });
+    it('fails loudly for an unknown runtime role or requested profile', () => {
+        expect(() => (0, resolve_1.resolveSelection)({ ...input(), role: 'renderer' })).toThrow(/role is invalid/);
+        expect(() => (0, resolve_1.resolveSelection)({ ...input(), requestedProfile: 'cheap' })).toThrow(/requestedProfile is invalid/);
+    });
+    it.each(['antigravity', 'opencode', 'claude-code', 'cursor', 'copilot'])('does not infer routed support for %s from any renderer fact', target => {
+        const value = input();
+        value.runtime = { ...value.runtime, target };
+        value.capabilities.runtime = { ...value.capabilities.runtime, target };
+        expect((0, resolve_1.resolveSelection)(value)).toMatchObject({ state: 'blocked' });
+    });
+    it('accepts codex only through its explicit native receipt fixture', () => expect((0, resolve_1.resolveSelection)(input())).toMatchObject({ state: 'resolved' }));
+    it.each(['antigravity', 'opencode', 'claude-code', 'codex', 'cursor', 'copilot'])('resolves an explicit matching policy and native receipt for %s', target => {
+        const value = input();
+        value.policy.content.mappings = ['antigravity', 'opencode', 'claude-code', 'codex', 'cursor', 'copilot'].map(rowTarget => ({ ...structuredClone(value.policy.content.mappings[0]), target: rowTarget }));
+        value.runtime = { ...value.runtime, target };
+        value.capabilities.runtime = { ...value.capabilities.runtime, target };
+        expect((0, resolve_1.resolveSelection)(value)).toMatchObject({ state: 'resolved' });
+    });
+    it('blocks an explicit unverified override despite a complete target mapping', () => {
+        const value = input();
+        value.capabilities.capabilities.modelOverride = 'unverified';
+        expect((0, resolve_1.resolveSelection)(value)).toMatchObject({ state: 'blocked', diagnostics: [{ code: 'ROUTING_MODEL_OVERRIDE_UNAVAILABLE' }] });
+    });
+    it.each(['specification-reviewer', 'code-quality-reviewer', 'final-reviewer', 'architecture', 'track-a-qa', 'track-b-qa', 'controller', 'documentation', 'retro', 'finishing'])('routes %s to full capability independently of requested profile', role => {
+        const result = (0, resolve_1.resolveSelection)({ ...input(), role, requestedProfile: 'mechanical' });
+        expect(result.state).toBe('resolved');
+        if (result.state === 'resolved')
+            expect(result.selection).toEqual(selection('full', 'high'));
+    });
+    it('blocks a receipt whose runtime account differs even when selections match', () => {
+        const value = input();
+        value.runtime = { ...value.runtime, accountScopeDigest: 'b'.repeat(64) };
+        expect((0, resolve_1.resolveSelection)(value)).toMatchObject({ state: 'blocked', diagnostics: [{ code: 'ROUTING_CAPABILITY_RUNTIME_MISMATCH' }] });
+    });
+    it('blocks an unavailable approved selection instead of silently substituting', () => {
+        const value = input();
+        value.capabilities.availableSelections = [selection('full', 'high')];
+        expect((0, resolve_1.resolveSelection)(value)).toMatchObject({ state: 'blocked', diagnostics: [{ code: 'ROUTING_SELECTION_UNAVAILABLE' }] });
+    });
+    it('blocks a corrupt receipt before trusting its availability list', () => {
+        const value = input();
+        value.capabilities.availableSelections = [];
+        expect((0, resolve_1.resolveSelection)(value)).toMatchObject({ state: 'blocked', diagnostics: [{ code: 'ROUTING_CAPABILITY_INVALID' }] });
+    });
+    it('degrades only to an attested matching full default when a missing override is approved', () => {
+        const value = input();
+        value.policy.content.mappings[0].degradation.allowMissingModelOverride = true;
+        value.capabilities.capabilities.modelOverride = 'unsupported';
+        value.capabilities.runtimeDefaultSelection = selection('full', 'high');
+        expect((0, resolve_1.resolveSelection)(value)).toMatchObject({ state: 'resolved', outcome: 'degraded', selection: selection('full', 'high') });
+    });
+    it('blocks missing override where its full default is not actually attested', () => {
+        const value = input();
+        value.policy.content.mappings[0].degradation.allowMissingModelOverride = true;
+        value.capabilities.capabilities.modelOverride = 'unsupported';
+        expect((0, resolve_1.resolveSelection)(value)).toMatchObject({ state: 'blocked', diagnostics: [{ code: 'ROUTING_MODEL_OVERRIDE_UNAVAILABLE' }] });
+    });
+    it('requires effort override for an explicit native full selection', () => {
+        const value = input();
+        value.capabilities.capabilities.effortOverride = 'unsupported';
+        expect((0, resolve_1.resolveSelection)({ ...value, role: 'code-quality-reviewer' })).toMatchObject({ state: 'blocked', diagnostics: [{ code: 'ROUTING_EFFORT_OVERRIDE_UNAVAILABLE' }] });
+    });
+    it('does not require effort override for an attested runtime-default native full selection', () => {
+        const value = input();
+        value.policy.content.mappings[0].fullCapability = runtimeDefaultSelection('full');
+        value.capabilities.availableSelections = [selection('mechanical', 'low'), selection('integration', 'medium'), selection('judgment', 'medium'), runtimeDefaultSelection('full')];
+        value.capabilities.runtimeDefaultSelection = runtimeDefaultSelection('full');
+        value.capabilities.capabilities.effortOverride = 'unsupported';
+        expect((0, resolve_1.resolveSelection)({ ...value, role: 'code-quality-reviewer' })).toMatchObject({ state: 'resolved', outcome: 'native', selection: runtimeDefaultSelection('full') });
+    });
+    it('does not require effort override for an attested runtime-default v1 full selection', () => {
+        const value = input();
+        value.policy.content.mappings[0].fullCapability = runtimeDefaultSelection('full');
+        value.capabilities.availableSelections = [selection('mechanical', 'low'), selection('integration', 'medium'), selection('judgment', 'medium'), runtimeDefaultSelection('full')];
+        value.capabilities.runtimeDefaultSelection = runtimeDefaultSelection('full');
+        value.capabilities.capabilities.effortOverride = 'unsupported';
+        expect((0, resolve_2.resolveV1Dispatch)({ ...value, plan: verifiedV1Plan, optInV1: true })).toMatchObject({ state: 'resolved', outcome: 'native', selection: runtimeDefaultSelection('full') });
+    });
+    // Regression for the collapse that made routed model and surrendered effort
+    // indistinguishable: degrading effort used to rewrite the selection to
+    // fullCapability, so a mechanical slice silently ran the judgment model while
+    // the only evidence emitted named effortOverride.
+    it('keeps the routed per-profile model when effort override degrades', () => {
+        const value = input();
+        value.policy.content.mappings[0].degradation.allowMissingEffortOverride = true;
+        value.capabilities.capabilities.effortOverride = 'unsupported';
+        value.capabilities.runtimeDefaultSelection = runtimeDefaultSelection('full');
+        value.capabilities.availableSelections = [...value.capabilities.availableSelections, runtimeDefaultSelection('mechanical'), runtimeDefaultSelection('integration'), runtimeDefaultSelection('full')];
+        expect((0, resolve_1.resolveSelection)({ ...value, requestedProfile: 'mechanical' })).toMatchObject({ state: 'resolved', outcome: 'degraded', selection: runtimeDefaultSelection('mechanical'), effectiveProfile: 'mechanical', unavailableEvidence: ['effortOverride'] });
+        expect((0, resolve_1.resolveSelection)({ ...value, requestedProfile: 'integration' })).toMatchObject({ state: 'resolved', outcome: 'degraded', selection: runtimeDefaultSelection('integration'), effectiveProfile: 'integration', unavailableEvidence: ['effortOverride'] });
+    });
+    // An honest receipt for a runtime with no effort control attests ONLY
+    // runtime-default selections — it cannot claim `mechanical at low effort` is
+    // selectable. Checking availability before degradation rejected exactly that
+    // receipt, so the contract only worked for a receipt that overclaimed.
+    it('degrades effort against a receipt that attests only runtime-default selections', () => {
+        const value = input();
+        value.policy.content.mappings[0].degradation.allowMissingEffortOverride = true;
+        value.capabilities.capabilities.effortOverride = 'unsupported';
+        value.capabilities.availableSelections = [runtimeDefaultSelection('mechanical'), runtimeDefaultSelection('integration'), runtimeDefaultSelection('judgment'), runtimeDefaultSelection('full')];
+        value.capabilities.runtimeDefaultSelection = runtimeDefaultSelection('full');
+        expect((0, resolve_1.resolveSelection)({ ...value, requestedProfile: 'mechanical' })).toMatchObject({ state: 'resolved', outcome: 'degraded', selection: runtimeDefaultSelection('mechanical'), unavailableEvidence: ['effortOverride'] });
+    });
+    // The runtime default is one selection; a per-profile selection at
+    // runtime-default effort is a different one. Requiring them equal made every
+    // profile but the default model unroutable, with modelOverride attested
+    // supported and the selection itself attested available.
+    it('routes a per-profile runtime-default selection whose model differs from the runtime default', () => {
+        const value = input();
+        value.policy.content.mappings[0].profiles.mechanical = runtimeDefaultSelection('mechanical');
+        value.capabilities.availableSelections = [runtimeDefaultSelection('mechanical'), runtimeDefaultSelection('full')];
+        value.capabilities.runtimeDefaultSelection = runtimeDefaultSelection('full');
+        expect((0, resolve_1.resolveSelection)({ ...value, requestedProfile: 'mechanical' })).toMatchObject({ state: 'resolved', outcome: 'native', selection: runtimeDefaultSelection('mechanical'), effectiveProfile: 'mechanical' });
+    });
+    it('still blocks a runtime-default selection the receipt does not attest at all', () => {
+        const value = input();
+        value.policy.content.mappings[0].profiles.mechanical = runtimeDefaultSelection('mechanical');
+        value.capabilities.availableSelections = [runtimeDefaultSelection('full')];
+        value.capabilities.runtimeDefaultSelection = runtimeDefaultSelection('full');
+        expect((0, resolve_1.resolveSelection)({ ...value, requestedProfile: 'mechanical' })).toMatchObject({ state: 'blocked', diagnostics: [{ code: 'ROUTING_SELECTION_UNAVAILABLE' }] });
+    });
+    it('still blocks a runtime-default selection when the receipt declares no runtime default', () => {
+        const value = input();
+        value.policy.content.mappings[0].profiles.mechanical = runtimeDefaultSelection('mechanical');
+        value.capabilities.availableSelections = [runtimeDefaultSelection('mechanical')];
+        delete value.capabilities.runtimeDefaultSelection;
+        expect((0, resolve_1.resolveSelection)({ ...value, requestedProfile: 'mechanical' })).toMatchObject({ state: 'blocked', diagnostics: [{ code: 'ROUTING_SELECTION_UNAVAILABLE' }] });
+    });
+    it('blocks effort degradation when the routed model at runtime-default effort is not attested', () => {
+        const value = input();
+        value.policy.content.mappings[0].degradation.allowMissingEffortOverride = true;
+        value.capabilities.capabilities.effortOverride = 'unsupported';
+        value.capabilities.runtimeDefaultSelection = runtimeDefaultSelection('full');
+        value.capabilities.availableSelections = [...value.capabilities.availableSelections, runtimeDefaultSelection('full')];
+        expect((0, resolve_1.resolveSelection)({ ...value, requestedProfile: 'mechanical' })).toMatchObject({ state: 'blocked', diagnostics: [{ code: 'ROUTING_EFFORT_OVERRIDE_UNAVAILABLE' }] });
+    });
+    it('keeps effort strict when the mapping does not allow degrading it', () => {
+        const value = input();
+        value.capabilities.capabilities.effortOverride = 'unsupported';
+        value.capabilities.runtimeDefaultSelection = runtimeDefaultSelection('full');
+        value.capabilities.availableSelections = [...value.capabilities.availableSelections, runtimeDefaultSelection('mechanical'), runtimeDefaultSelection('full')];
+        expect(value.policy.content.mappings[0].degradation.allowMissingEffortOverride).toBe(false);
+        expect((0, resolve_1.resolveSelection)({ ...value, requestedProfile: 'mechanical' })).toMatchObject({ state: 'blocked', diagnostics: [{ code: 'ROUTING_EFFORT_OVERRIDE_UNAVAILABLE' }] });
+    });
+    it('never degrades effort on an unverified capability, only on an attested unsupported one', () => {
+        const value = input();
+        value.policy.content.mappings[0].degradation.allowMissingEffortOverride = true;
+        value.capabilities.capabilities.effortOverride = 'unverified';
+        value.capabilities.runtimeDefaultSelection = runtimeDefaultSelection('full');
+        value.capabilities.availableSelections = [...value.capabilities.availableSelections, runtimeDefaultSelection('mechanical'), runtimeDefaultSelection('full')];
+        expect((0, resolve_1.resolveSelection)({ ...value, requestedProfile: 'mechanical' })).toMatchObject({ state: 'blocked', diagnostics: [{ code: 'ROUTING_EFFORT_OVERRIDE_UNAVAILABLE', message: expect.stringMatching(/unverified/) }] });
+    });
+    it('does not require effort override after model fallback selects an attested runtime-default full selection', () => {
+        const value = input();
+        value.policy.content.mappings[0].fullCapability = runtimeDefaultSelection('full');
+        value.capabilities.availableSelections = [selection('mechanical', 'low'), selection('integration', 'medium'), selection('judgment', 'medium'), runtimeDefaultSelection('full')];
+        value.capabilities.runtimeDefaultSelection = runtimeDefaultSelection('full');
+        value.policy.content.mappings[0].degradation.allowMissingModelOverride = true;
+        value.capabilities.capabilities.modelOverride = 'unsupported';
+        value.capabilities.capabilities.effortOverride = 'unsupported';
+        expect((0, resolve_1.resolveSelection)(value)).toMatchObject({ state: 'resolved', outcome: 'degraded', selection: runtimeDefaultSelection('full'), unavailableEvidence: ['modelOverride'] });
+    });
+});

package/dist/tests/core/model-policy/store.test.js

@@ -0,0 +1,177 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const atomic_file_1 = require("../../../src/core/atomic-file");
+const canonical_1 = require("../../../src/core/model-policy/canonical");
+const store_1 = require("../../../src/core/model-policy/store");
+const paths_1 = require("../../../src/core/model-policy/paths");
+const policy = () => ({ schema: 'model-policy/v1', mappings: [{ target: 'codex', runtimeKind: 'native', profiles: {
+                mechanical: { selector: { kind: 'model', id: 'gpt-5.6-luna' }, effort: { kind: 'explicit', value: 'medium' } },
+                integration: { selector: { kind: 'model', id: 'gpt-5.6-terra' }, effort: { kind: 'explicit', value: 'medium' } },
+                judgment: { selector: { kind: 'model', id: 'gpt-5.6-sol' }, effort: { kind: 'explicit', value: 'medium' } },
+            }, fullCapability: { selector: { kind: 'model', id: 'gpt-5.6-sol' }, effort: { kind: 'explicit', value: 'high' } }, degradation: { allowMissingModelOverride: false, allowMissingEffortOverride: false, allowMissingObservedIdentity: false } }], implementationBudget: { maxAttempts: 3, escalation: ['mechanical', 'integration', 'judgment'], judgmentEfforts: ['medium', 'high'] } });
+function createIdentityFencedBoundary() {
+    const observations = new WeakMap();
+    return {
+        withProjectLease: (_root, operation) => operation(),
+        readRegularFile: (file) => {
+            const identity = Object.freeze({});
+            const bytes = fs_1.default.readFileSync(file);
+            observations.set(identity, { file, bytes });
+            return { bytes, identity };
+        },
+        writeProjectTransaction: (root, destination, content, options) => {
+            const file = path_1.default.join(root, destination);
+            fs_1.default.mkdirSync(path_1.default.dirname(file), { recursive: true });
+            if (options.mode === 'create' && fs_1.default.existsSync(file))
+                throw new Error('project destination already exists');
+            if (options.mode === 'replace') {
+                const observed = observations.get(options.expectedIdentity);
+                if (!observed || observed.file !== file || !observed.bytes.equals(options.expected) || !fs_1.default.readFileSync(file).equals(options.expected))
+                    throw new Error('original changed before fenced replacement');
+            }
+            const temporary = `${file}.test-tmp`;
+            const fd = fs_1.default.openSync(temporary, 'wx', 0o600);
+            try {
+                fs_1.default.writeFileSync(fd, content);
+                fs_1.default.fsyncSync(fd);
+                fs_1.default.closeSync(fd);
+                fs_1.default.renameSync(temporary, file);
+                // La durabilidad de la ENTRADA publicada se pide por el unico helper
+                // que define esa politica (atomic-file.fsyncDirSync): fail-closed en
+                // POSIX y degradado SOLO ante el gap conocido de win32 (EPERM al
+                // fsync-ear un fd de directorio, capacidad que el SO no expone).
+                // Reimplementarla aca la hacia divergir y rompia la matriz Windows.
+                (0, atomic_file_1.fsyncDirSync)(path_1.default.dirname(file));
+            }
+            finally {
+                try {
+                    fs_1.default.rmSync(temporary, { force: true });
+                }
+                catch { /* preserve transaction result */ }
+            }
+        },
+    };
+}
+const identityFencedBoundary = createIdentityFencedBoundary();
+const approve = (input) => (0, store_1.approvePolicyWithBoundary)(input, identityFencedBoundary);
+describe('approved policy store', () => {
+    let root;
+    let oldHome;
+    let oldAwmHome;
+    beforeEach(() => { root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-policy-')); oldHome = process.env.HOME; oldAwmHome = process.env.AWM_HOME; process.env.AWM_HOME = path_1.default.join(root, 'operator'); });
+    afterEach(() => { jest.restoreAllMocks(); delete process.env.POLICY_TEST_FAIL_WRITE; delete process.env.POLICY_TEST_MUTATE_DURING_REPLACE; if (oldHome === undefined)
+        delete process.env.HOME;
+    else
+        process.env.HOME = oldHome; if (oldAwmHome === undefined)
+        delete process.env.AWM_HOME;
+    else
+        process.env.AWM_HOME = oldAwmHome; fs_1.default.rmSync(root, { recursive: true, force: true }); });
+    const candidate = () => { const file = path_1.default.join(root, 'candidate.json'); fs_1.default.writeFileSync(file, JSON.stringify(policy())); return file; };
+    it('publishes only an expected digest and reads it without creating state', () => {
+        const file = candidate();
+        const digest = (0, canonical_1.canonicalPolicyDigest)(policy());
+        expect((0, store_1.readEffectivePolicy)(root)).toEqual({ state: 'absent' });
+        const approved = approve({ file, scope: 'user', cwd: root, expectedDigest: digest });
+        expect(approved.contentDigest).toBe(digest);
+        expect((0, store_1.readEffectivePolicy)(root)).toMatchObject({ state: 'approved', provenance: 'user', policy: { contentDigest: digest } });
+    });
+    it('rejects a mismatched digest before writing', () => {
+        const file = candidate();
+        expect(() => approve({ file, scope: 'user', cwd: root, expectedDigest: '0'.repeat(64) })).toThrow(/digest/i);
+        expect(fs_1.default.existsSync((0, paths_1.userPolicyPath)())).toBe(false);
+    });
+    it('allows exactly one initial writer and exact CAS replacement', () => {
+        const file = candidate();
+        const digest = (0, canonical_1.canonicalPolicyDigest)(policy());
+        approve({ file, scope: 'user', cwd: root, expectedDigest: digest });
+        expect(() => approve({ file, scope: 'user', cwd: root, expectedDigest: digest })).toThrow(/replace|existing/i);
+        expect(() => approve({ file, scope: 'user', cwd: root, expectedDigest: digest, replaceDigest: 'f'.repeat(64) })).toThrow(/predecessor|replace/i);
+        expect(approve({ file, scope: 'user', cwd: root, expectedDigest: digest, replaceDigest: digest }).lineage.previousDigest).toBe(digest);
+    });
+    it('rejects an unexpected opaque identity token before replacing bytes', () => {
+        const target = path_1.default.join(root, 'identity.json');
+        fs_1.default.writeFileSync(target, 'observed');
+        const observed = identityFencedBoundary.readRegularFile(target, 1024);
+        expect(() => identityFencedBoundary.writeProjectTransaction(root, 'identity.json', Buffer.from('replacement'), {
+            mode: 'replace', createParents: false, expected: observed.bytes, expectedIdentity: Object.freeze({}),
+        })).toThrow(/original changed/i);
+        expect(fs_1.default.readFileSync(target, 'utf8')).toBe('observed');
+    });
+    it('resolves a relative candidate through cwd instead of process cwd', () => {
+        const cwd = path_1.default.join(root, 'project');
+        fs_1.default.mkdirSync(cwd);
+        const file = path_1.default.join(cwd, 'candidate.json');
+        fs_1.default.writeFileSync(file, JSON.stringify(policy()));
+        const digest = (0, canonical_1.canonicalPolicyDigest)(policy());
+        expect(approve({ file: 'candidate.json', scope: 'project', cwd, expectedDigest: digest }).contentDigest).toBe(digest);
+    });
+    it('accepts exactly one of two competing fenced replacements', () => {
+        const file = candidate();
+        const digest = (0, canonical_1.canonicalPolicyDigest)(policy());
+        approve({ file, scope: 'user', cwd: root, expectedDigest: digest });
+        const input = { file, scope: 'user', cwd: root, expectedDigest: digest, replaceDigest: digest };
+        let entered = false;
+        let accepted = 0;
+        const boundary = {
+            withProjectLease: (_root, operation) => operation(),
+            readRegularFile: (target) => ({ bytes: fs_1.default.readFileSync(target), identity: Object.freeze({}) }),
+            writeProjectTransaction: (base, destination, bytes, options) => {
+                const target = path_1.default.join(base, destination);
+                if (options.mode === 'replace' && !entered) {
+                    entered = true;
+                    // Model a non-cooperating external process: the native
+                    // identity fence, not this advisory lock, must reject us.
+                    fs_1.default.rmSync(`${target}.lock`);
+                    (0, store_1.approvePolicyWithBoundary)(input, boundary);
+                    fs_1.default.writeFileSync(`${target}.lock`, 'outer lock placeholder');
+                }
+                if (options.mode === 'replace' && (!options.expected || !fs_1.default.readFileSync(target).equals(options.expected)))
+                    throw new Error('original changed before fenced replacement');
+                fs_1.default.mkdirSync(path_1.default.dirname(target), { recursive: true });
+                fs_1.default.writeFileSync(target, bytes);
+                accepted++;
+            },
+        };
+        expect(() => (0, store_1.approvePolicyWithBoundary)(input, boundary)).toThrow(/changed|replacement/i);
+        expect(accepted).toBe(1);
+    });
+    it('returns a failed publication and preserves predecessor bytes on injected transaction failure', () => {
+        const file = candidate();
+        const digest = (0, canonical_1.canonicalPolicyDigest)(policy());
+        approve({ file, scope: 'user', cwd: root, expectedDigest: digest });
+        const before = fs_1.default.readFileSync((0, paths_1.userPolicyPath)());
+        const boundary = {
+            withProjectLease: (_root, operation) => operation(),
+            readRegularFile: (target) => ({ bytes: fs_1.default.readFileSync(target), identity: Object.freeze({}) }),
+            writeProjectTransaction: () => { throw new Error('injected durable publication failure'); },
+        };
+        expect(() => (0, store_1.approvePolicyWithBoundary)({ file, scope: 'user', cwd: root, expectedDigest: digest, replaceDigest: digest }, boundary)).toThrow(/publication failure/);
+        expect(fs_1.default.readFileSync((0, paths_1.userPolicyPath)()).equals(before)).toBe(true);
+    });
+    it('blocks an invalid project policy instead of falling back to a valid user policy', () => {
+        const file = candidate();
+        const digest = (0, canonical_1.canonicalPolicyDigest)(policy());
+        approve({ file, scope: 'user', cwd: root, expectedDigest: digest });
+        fs_1.default.mkdirSync(path_1.default.join(root, '.awm'));
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'model-policy.json'), '{"content":');
+        expect((0, store_1.readEffectivePolicy)(root)).toMatchObject({ state: 'invalid', provenance: 'project' });
+    });
+    it('rejects duplicate JSON keys and symlinked parent or destination without touching the target', () => {
+        const duplicate = path_1.default.join(root, 'duplicate.json');
+        fs_1.default.writeFileSync(duplicate, '{"schema":"model-policy/v1","schema":"model-policy/v1"}');
+        expect(() => approve({ file: duplicate, scope: 'user', cwd: root, expectedDigest: 'a'.repeat(64) })).toThrow(/duplicate/i);
+        const file = candidate();
+        const digest = (0, canonical_1.canonicalPolicyDigest)(policy());
+        fs_1.default.mkdirSync(process.env.AWM_HOME);
+        fs_1.default.symlinkSync(root, path_1.default.join(process.env.AWM_HOME, 'link'));
+        const target = (0, paths_1.userPolicyPath)();
+        fs_1.default.symlinkSync(path_1.default.join(root, 'outside'), target);
+        expect(() => approve({ file, scope: 'user', cwd: root, expectedDigest: digest })).toThrow(/symlink/i);
+    });
+});

package/dist/tests/core/plan/validate.test.js

@@ -50,6 +50,15 @@ function fixture(root, mutate) {
     fs_1.default.writeFileSync(plan, markdown);
     return plan;
 }
+function v2Fixture(root, profile = 'mechanical') {
+    const plan = fixture(root, manifest => {
+        manifest.schema = 'compact-slices/v2';
+        const slices = manifest.slices;
+        slices[0].implementerProfile = profile;
+    });
+    fs_1.default.writeFileSync(plan, fs_1.default.readFileSync(plan, 'utf8').replace(START, '<!-- AWM:COMPACT-SLICES:START v2 -->').replace(END, '<!-- AWM:COMPACT-SLICES:END v2 -->'));
+    return plan;
+}
 describe('validatePlanFile', () => {
     it('validates an authenticated snapshot without reopening a swapped plan parent', () => {
         const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-plan-snapshot-'));
@@ -86,6 +95,35 @@ describe('validatePlanFile', () => {
         expect((0, validate_1.validatePlanFile)(plan, root)).toMatchObject({ state: 'valid', schema: 'compact-slices/v1' });
         expect(fs_1.default.readFileSync(plan, 'utf8')).toBe(before);
     });
+    test.each(['mechanical', 'integration', 'judgment'])('accepts v2 with the exact %s implementer profile', profile => {
+        const report = (0, validate_1.validatePlanFile)(v2Fixture(root, profile), root);
+        expect(report).toMatchObject({ state: 'valid', schema: 'compact-slices/v2', manifest: { slices: [expect.objectContaining({ implementerProfile: profile })] } });
+    });
+    test('rejects v1 profile without weakening exact keys', () => {
+        expect((0, validate_1.validatePlanFile)(fixture(root, manifest => { (manifest.slices[0]).implementerProfile = 'mechanical'; }), root)).toMatchObject({ state: 'invalid' });
+    });
+    test.each([
+        ['missing profile', (text) => text.replace(/,\n\s*"implementerProfile": "mechanical"/, '')],
+        ['concrete model', (text) => text.replace('"implementerProfile": "mechanical"', '"implementerProfile": "mechanical",\n      "model": "vendor-model"')],
+        ['unknown profile', (text) => text.replace('"implementerProfile": "mechanical"', '"implementerProfile": "cheap"')],
+    ])('rejects v2 %s without weakening exact keys', (_name, mutate) => {
+        const plan = v2Fixture(root);
+        fs_1.default.writeFileSync(plan, mutate(fs_1.default.readFileSync(plan, 'utf8')));
+        expect((0, validate_1.validatePlanFile)(plan, root)).toMatchObject({ state: 'invalid' });
+    });
+    test('preserves v2 profile bytes in the execution identity', () => {
+        const mechanical = fs_1.default.readFileSync(v2Fixture(root, 'mechanical'), 'utf8');
+        const integration = mechanical.replace('"implementerProfile": "mechanical"', '"implementerProfile": "integration"');
+        const integrationPath = path_1.default.join(root, 'integration.md');
+        fs_1.default.writeFileSync(integrationPath, integration);
+        const left = (0, validate_1.validatePlanFile)(path_1.default.join(root, 'plan.md'), root);
+        const right = (0, validate_1.validatePlanFile)(integrationPath, root);
+        expect(left).toMatchObject({ state: 'valid', schema: 'compact-slices/v2' });
+        expect(right).toMatchObject({ state: 'valid', schema: 'compact-slices/v2' });
+        if (left.state !== 'valid' || right.state !== 'valid')
+            throw new Error('v2 fixture must validate');
+        expect(left.executionDigest).not.toBe(right.executionDigest);
+    });
     test('makes an approved valid report and its nested manifest immutable after verification', () => {
         const report = (0, validate_1.validatePlanFile)(fixture(root), root);
         expectApprovedPlanValid(report);
@@ -436,7 +474,7 @@ describe('validatePlanFile', () => {
     test('keeps a future schema behind partial markers invalid rather than unsupported', () => {
         const plan = path_1.default.join(root, 'partial-future.md');
         fs_1.default.writeFileSync(plan, `${START}\n{"schema":"compact-slices/v2"}`);
-        expect((0, validate_1.validatePlanFile)(plan, root)).toMatchObject({ state: 'unsupported', schema: 'compact-slices/v2' });
+        expect((0, validate_1.validatePlanFile)(plan, root)).toMatchObject({ state: 'invalid', diagnostics: [expect.objectContaining({ code: 'PLAN_MARKERS' })] });
     });
     test('applies scalar limits before classifying a future schema as unsupported', () => {
         const plan = path_1.default.join(root, 'future-too-large.md');
@@ -733,7 +771,7 @@ describe('validatePlanFile', () => {
     test('recognizes a parseable future schema when only the END marker is broken', () => {
         const plan = path_1.default.join(root, 'future-missing-end.md');
         fs_1.default.writeFileSync(plan, `${START}\n{"schema":"compact-slices/v2"}\n`);
-        expect((0, validate_1.validatePlanFile)(plan, root)).toMatchObject({ state: 'unsupported', schema: 'compact-slices/v2' });
+        expect((0, validate_1.validatePlanFile)(plan, root)).toMatchObject({ state: 'invalid', diagnostics: [expect.objectContaining({ code: 'PLAN_MARKERS' })] });
     });
     test('accepts CRLF Markdown with nested headings and fenced code in a required section', () => {
         const plan = fixture(root);

package/dist/tests/core/secure-fs/native-bridge.test.js

@@ -160,6 +160,28 @@ describe('native secure-fs Windows source contract', () => {
         expect(removal).not.toMatch(/\bDeleteFileW\b/);
     });
 });
+describe('native secure-fs durable publication source contract', () => {
+    const source = () => fs_1.default.readFileSync(path_1.default.resolve(__dirname, '../../../native/secure_fs.cc'), 'utf8').replace(/\r\n/g, '\n');
+    it('turns parent-directory fsync failure after publication into a bounded error', () => {
+        const native = source();
+        const write = native.slice(native.indexOf('napi_value WriteProjectTransaction'), native.indexOf('\n}  // namespace'));
+        expect(native).toMatch(/if \(fsync\(parent\) != 0\)[\s\S]{0,240}Throw\(env, "secure-fs durable directory sync failed"\)/);
+        expect(write).toMatch(/fsync\(parent\) == 0;[\s\S]{0,180}secure-fs durable directory sync failed/);
+        const withoutWriteSync = write.replace('fsync(parent) == 0', 'true');
+        expect(withoutWriteSync).not.toMatch(/fsync\(parent\) == 0;/);
+        expect(withoutWriteSync).not.toMatch(/fsync\(parent\) == 0;[\s\S]{0,180}secure-fs durable directory sync failed/);
+    });
+    it('degrades only the unsupported Windows directory flush and retains all other durable failures', () => {
+        expect(source()).toMatch(/FlushFileBuffers\(parent\.handle\) == 0 && GetLastError\(\) != ERROR_ACCESS_DENIED/);
+        expect(source()).toMatch(/if \(directory_sync_failed\).*secure-fs durable directory sync failed/);
+    });
+    it('does not clean a staging name already consumed by a fenced POSIX rename', () => {
+        const write = source().slice(source().indexOf('napi_value WriteProjectTransaction'), source().indexOf('\n}  // namespace'));
+        expect(write).toContain('const bool cleaned = options.replace || unlinkat(parent, temporary.c_str(), 0) == 0;');
+        const reverted = write.replace('options.replace || ', '');
+        expect(reverted).not.toContain('const bool cleaned = options.replace || unlinkat(parent, temporary.c_str(), 0) == 0;');
+    });
+});
 describe('native secure-fs POSIX source contract', () => {
     const source = () => fs_1.default.readFileSync(path_1.default.resolve(__dirname, '../../../native/secure_fs.cc'), 'utf8');
     it('uses an unpredictable nonce and a bounded retry loop for descriptor-relative staging', () => {
@@ -399,6 +421,38 @@ const nativeFixtureAvailable = ['linux', 'darwin', 'win32'].includes(process.pla
     && ['x64', 'arm64'].includes(process.arch)
     && fs_1.default.existsSync(path_1.default.join(__dirname, '../../../prebuilds', `${process.platform}-${process.arch}`, 'secure_fs.node'));
 const nativeOnly = nativeFixtureAvailable ? describe : describe.skip;
+const testAddonPath = path_1.default.join(__dirname, '../../../native/build/Release/secure_fs_test.node');
+const nativeTestOnly = describe;
+nativeTestOnly('native secure-fs directory-sync fault injection', () => {
+    let root;
+    let testBinding;
+    beforeEach(() => {
+        expect(fs_1.default.existsSync(testAddonPath)).toBe(true);
+        root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-secure-fs-fsync-'));
+        testBinding = require(testAddonPath);
+    });
+    afterEach(() => { testBinding.setDirectoryFsyncFailureForTests(false); fs_1.default.rmSync(root, { recursive: true, force: true }); });
+    it('writes the target then reports the forced post-publication directory-sync failure', () => {
+        testBinding.setDirectoryFsyncFailureForTests(true);
+        expect(() => testBinding.writeProjectTransaction(root, 'durable.txt', Buffer.from('published'), { mode: 'create', createParents: false })).toThrow('secure-fs durable directory sync failed');
+        expect(fs_1.default.readFileSync(path_1.default.join(root, 'durable.txt'), 'utf8')).toBe('published');
+    });
+    it('publishes an exact fenced replacement with fault injection disabled', () => {
+        const target = path_1.default.join(root, 'replace.json');
+        fs_1.default.writeFileSync(target, 'before');
+        const observed = testBinding.readRegularFile(target, 1024);
+        expect(() => testBinding.writeProjectTransaction(root, 'replace.json', Buffer.from('after'), {
+            mode: 'replace', expected: observed.bytes, expectedIdentity: observed.identity, createParents: false,
+        })).not.toThrow();
+        expect(fs_1.default.readFileSync(target, 'utf8')).toBe('after');
+    });
+    it('keeps the production prebuild free of the test-only control', () => {
+        if (!nativeFixtureAvailable)
+            return;
+        const production = require(path_1.default.join(__dirname, '../../../prebuilds', `${process.platform}-${process.arch}`, 'secure_fs.node'));
+        expect(production.setDirectoryFsyncFailureForTests).toBeUndefined();
+    });
+});
 nativeOnly('native secure-fs identity fence fixtures', () => {
     let root;
     let binding;
@@ -406,6 +460,11 @@ nativeOnly('native secure-fs identity fence fixtures', () => {
         root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-secure-fs-identity-'));
         binding = require(path_1.default.join(__dirname, '../../../prebuilds', `${process.platform}-${process.arch}`, 'secure_fs.node'));
     });
+    it('performs a real artifact-backed publish when the CI prebuild is available', () => {
+        const target = path_1.default.join(root, 'durable.txt');
+        binding.writeProjectTransaction(root, 'durable.txt', Buffer.from('published'), { mode: 'create', createParents: false });
+        expect(fs_1.default.readFileSync(target, 'utf8')).toBe('published');
+    });
     afterEach(() => { fs_1.default.rmSync(root, { recursive: true, force: true }); });
     it('returns bytes with a canonical native identity from the same regular-file read', () => {
         const target = path_1.default.join(root, 'sensors.json');
@@ -690,6 +749,7 @@ windowsOnly('native secure-fs Windows handle fixtures', () => {
                     fs.symlinkSync(workerData.outside, workerData.trusted, 'junction');
                     Atomics.add(state, 1, 1);
                     Atomics.notify(state, 1);
+                    parentPort.postMessage('ready');
                     Atomics.wait(state, 0, 0, 1);
                     fs.rmSync(workerData.trusted);
                     fs.renameSync(workerData.parked, workerData.trusted);
@@ -701,13 +761,30 @@ windowsOnly('native secure-fs Windows handle fixtures', () => {
             restore();
             parentPort.postMessage('done');
             `, { eval: true, workerData: { shared, trusted, parked, outside } });
-        const done = new Promise((resolve, reject) => {
-            worker.once('message', () => resolve());
-            worker.once('error', reject);
+        let resolveReady;
+        let rejectReady;
+        let resolveDone;
+        let rejectDone;
+        const ready = new Promise((resolve, reject) => { resolveReady = resolve; rejectReady = reject; });
+        const done = new Promise((resolve, reject) => { resolveDone = resolve; rejectDone = reject; });
+        const readyTimeout = setTimeout(() => rejectReady(new Error('junction swap worker did not become ready')), 5_000);
+        worker.on('message', message => {
+            if (message === 'ready') {
+                clearTimeout(readyTimeout);
+                resolveReady();
+            }
+            if (message === 'done')
+                resolveDone();
+        });
+        worker.once('error', error => {
+            clearTimeout(readyTimeout);
+            const failure = error instanceof Error ? error : new Error('junction swap worker failed');
+            rejectReady(failure);
+            rejectDone(failure);
         });
         let published = 0;
         try {
-            Atomics.wait(state, 1, 0, 5_000);
+            await ready;
             expect(Atomics.load(state, 1)).toBeGreaterThan(0);
             for (let attempt = 0; attempt < 500; attempt += 1) {
                 try {