agentic-workflow-manager 9.8.0 → 9.9.0

package/dist/src/core/model-policy/capabilities.js

@@ -0,0 +1,197 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateRuntimeKey = validateRuntimeKey;
+exports.capabilityReceiptDigest = capabilityReceiptDigest;
+exports.validateCapabilityReceipt = validateCapabilityReceipt;
+exports.receiptIsCurrent = receiptIsCurrent;
+exports.routingDiagnostic = routingDiagnostic;
+exports.capabilityReceiptPath = capabilityReceiptPath;
+exports.readCapabilities = readCapabilities;
+exports.approveCapabilities = approveCapabilities;
+const crypto_1 = require("crypto");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const providers_1 = require("../../providers");
+const validate_1 = require("./validate");
+const paths_1 = require("../paths");
+const json_1 = require("../plan/json");
+const native_bridge_1 = require("../secure-fs/native-bridge");
+const RUNTIME_KIND = /^[a-z0-9][a-z0-9_-]{0,127}$/;
+const SEMVER = /^\d+\.\d+\.\d+$/;
+const CONTROL = /[\u0000-\u001f\u007f-\u009f]/;
+const CAPABILITY_KEYS = ['artifactDelivery', 'interactiveExecution', 'unattendedController', 'nativeSubagents', 'modelOverride', 'effortOverride', 'observedModelEvidence', 'durableResume'];
+const CAPABILITY_VALUES = new Set(['supported', 'unsupported', 'unverified']);
+function object(value, name) { if (!value || typeof value !== 'object' || Array.isArray(value))
+    throw new Error(`${name} must be an object`); return value; }
+function exact(value, keys, name) { const actual = Object.keys(value); if (actual.length !== keys.length || actual.some(key => !keys.includes(key)))
+    throw new Error(`${name} has unknown or missing fields`); }
+function text(value, name, pattern) { if (typeof value !== 'string' || value.length === 0 || value.length > validate_1.MAX_IDENTIFIER || CONTROL.test(value) || (pattern && !pattern.test(value)))
+    throw new Error(`${name} is invalid`); return value; }
+function timestamp(value, name) { return (0, validate_1.canonicalUtcTimestamp)(value, name); }
+function selection(value, name) {
+    const item = object(value, name);
+    exact(item, ['selector', 'effort'], name);
+    const selector = object(item.selector, `${name}.selector`);
+    exact(selector, ['kind', 'id'], `${name}.selector`);
+    if (selector.kind !== 'model' && selector.kind !== 'tier')
+        throw new Error(`${name}.selector.kind is invalid`);
+    const effort = object(item.effort, `${name}.effort`);
+    if (effort.kind === 'explicit') {
+        exact(effort, ['kind', 'value'], `${name}.effort`);
+        return { selector: { kind: selector.kind, id: text(selector.id, `${name}.selector.id`) }, effort: { kind: 'explicit', value: text(effort.value, `${name}.effort.value`) } };
+    }
+    if (effort.kind === 'runtime-default') {
+        exact(effort, ['kind'], `${name}.effort`);
+        return { selector: { kind: selector.kind, id: text(selector.id, `${name}.selector.id`) }, effort: { kind: 'runtime-default' } };
+    }
+    throw new Error(`${name}.effort.kind is invalid`);
+}
+function sameSelection(left, right) { return left.selector.kind === right.selector.kind && left.selector.id === right.selector.id && left.effort.kind === right.effort.kind && (left.effort.kind !== 'explicit' || left.effort.value === right.effort.value); }
+function validateRuntimeKey(value) {
+    const item = object(value, 'runtime');
+    exact(item, ['target', 'kind', 'version', 'accountScopeDigest'], 'runtime');
+    if (typeof item.target !== 'string' || !providers_1.AGENT_TARGETS.includes(item.target))
+        throw new Error('runtime target is invalid');
+    const accountScopeDigest = text(item.accountScopeDigest, 'runtime.accountScopeDigest');
+    (0, validate_1.assertDigest)(accountScopeDigest, 'runtime.accountScopeDigest');
+    return { target: item.target, kind: text(item.kind, 'runtime.kind', RUNTIME_KIND), version: text(item.version, 'runtime.version', SEMVER), accountScopeDigest };
+}
+function capabilities(value) {
+    const item = object(value, 'capabilities');
+    exact(item, CAPABILITY_KEYS, 'capabilities');
+    for (const key of CAPABILITY_KEYS)
+        if (!CAPABILITY_VALUES.has(item[key]))
+            throw new Error(`capabilities.${key} is invalid`);
+    return item;
+}
+function canonical(value) { if (value === null || typeof value !== 'object')
+    return JSON.stringify(value); if (Array.isArray(value))
+    return `[${value.map(canonical).join(',')}]`; const item = value; return `{${Object.keys(item).sort().map(key => `${JSON.stringify(key)}:${canonical(item[key])}`).join(',')}}`; }
+function capabilityReceiptDigest(receipt) { return (0, crypto_1.createHash)('sha256').update(canonical(validateCapabilityReceipt(receipt)), 'utf8').digest('hex'); }
+function validateCapabilityReceipt(value) {
+    const item = object(value, 'capability receipt');
+    exact(item, ['schema', 'runtime', 'recordedAt', 'expiresAt', 'capabilities', 'availableSelections', 'runtimeDefaultSelection', 'evidence', 'approval'].filter(key => item[key] !== undefined), 'capability receipt');
+    if (item.schema !== 'routing-capabilities/v1')
+        throw new Error('capability receipt schema is invalid');
+    const runtime = validateRuntimeKey(item.runtime);
+    const recordedAt = timestamp(item.recordedAt, 'recordedAt');
+    const expiresAt = timestamp(item.expiresAt, 'expiresAt');
+    const elapsed = Date.parse(expiresAt) - Date.parse(recordedAt);
+    if (elapsed < 0 || elapsed > 24 * 60 * 60 * 1000)
+        throw new Error('capability receipt expiry must be within 24 hours');
+    const caps = capabilities(item.capabilities);
+    if (!Array.isArray(item.availableSelections) || item.availableSelections.length === 0 || item.availableSelections.length > 64)
+        throw new Error('availableSelections is invalid');
+    const availableSelections = item.availableSelections.map((entry, index) => selection(entry, `availableSelections[${index}]`));
+    if (new Set(availableSelections.map(canonical)).size !== availableSelections.length)
+        throw new Error('availableSelections contains duplicates');
+    const runtimeDefaultSelection = item.runtimeDefaultSelection === undefined ? undefined : selection(item.runtimeDefaultSelection, 'runtimeDefaultSelection');
+    if (runtimeDefaultSelection && !availableSelections.some(entry => sameSelection(entry, runtimeDefaultSelection)))
+        throw new Error('runtimeDefaultSelection must be available');
+    if (!Array.isArray(item.evidence) || item.evidence.length > 64)
+        throw new Error('evidence is invalid');
+    const evidence = item.evidence.map((entry, index) => { const proof = object(entry, `evidence[${index}]`); exact(proof, ['capability', 'kind', 'receiptDigest'], `evidence[${index}]`); if (!CAPABILITY_KEYS.includes(proof.capability) || !['native-control', 'native-dispatch', 'unsupported'].includes(proof.kind))
+        throw new Error(`evidence[${index}] is invalid`); const receiptDigest = text(proof.receiptDigest, `evidence[${index}].receiptDigest`); (0, validate_1.assertDigest)(receiptDigest, `evidence[${index}].receiptDigest`); return { capability: proof.capability, kind: proof.kind, receiptDigest }; });
+    for (const key of CAPABILITY_KEYS)
+        if (caps[key] === 'supported' && !evidence.some(proof => proof.capability === key && (proof.kind === 'native-control' || proof.kind === 'native-dispatch')))
+            throw new Error(`supported capability ${key} lacks native evidence`);
+    const approval = object(item.approval, 'approval');
+    exact(approval, ['approvalId', 'snapshotDigest'], 'approval');
+    const approvalId = text(approval.approvalId, 'approval.approvalId');
+    const snapshotDigest = text(approval.snapshotDigest, 'approval.snapshotDigest');
+    (0, validate_1.assertDigest)(snapshotDigest, 'approval.snapshotDigest');
+    return { schema: 'routing-capabilities/v1', runtime, recordedAt, expiresAt, capabilities: caps, availableSelections, ...(runtimeDefaultSelection ? { runtimeDefaultSelection } : {}), evidence, approval: { approvalId, snapshotDigest } };
+}
+function receiptIsCurrent(receipt, runtime, now) { return receipt.runtime.target === runtime.target && receipt.runtime.kind === runtime.kind && receipt.runtime.version === runtime.version && receipt.runtime.accountScopeDigest === runtime.accountScopeDigest && Number.isFinite(now.getTime()) && Date.parse(receipt.recordedAt) <= now.getTime() && now.getTime() <= Date.parse(receipt.expiresAt); }
+function routingDiagnostic(code, message) { return { code, message }; }
+function capabilityReceiptPath(runtime) { const valid = validateRuntimeKey(runtime); return path_1.default.join((0, paths_1.awmHome)(), 'routing-capabilities', valid.target, `${valid.kind}.json`); }
+function safeParents(file) { for (let dir = path_1.default.dirname(path_1.default.resolve(file));; dir = path_1.default.dirname(dir)) {
+    try {
+        const stat = fs_1.default.lstatSync(dir);
+        if (stat.isSymbolicLink() || !stat.isDirectory())
+            throw new Error(`unsafe capability parent: ${dir}`);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    if (dir === path_1.default.dirname(dir))
+        return;
+} }
+function readBytes(file) { safeParents(file); try {
+    const stat = fs_1.default.lstatSync(file, { bigint: true });
+    if (stat.isSymbolicLink() || !stat.isFile() || stat.size > BigInt(256 * 1024))
+        throw new Error('capability receipt is unsafe or exceeds 256 KiB');
+    return fs_1.default.readFileSync(file);
+}
+catch (error) {
+    if (error.code === 'ENOENT')
+        return null;
+    throw error;
+} }
+function parseReceipt(bytes) { return validateCapabilityReceipt((0, json_1.parseJsonNoDuplicate)(new TextDecoder('utf-8', { fatal: true }).decode(bytes))); }
+function readCapabilities(runtime, now) {
+    try {
+        const valid = validateRuntimeKey(runtime);
+        const bytes = readBytes(capabilityReceiptPath(valid));
+        if (!bytes)
+            return { state: 'absent' };
+        const receipt = parseReceipt(bytes);
+        if (!receiptIsCurrent(receipt, valid, now))
+            return { state: 'stale', reason: 'receipt runtime does not match or attestation expired' };
+        return { state: 'current', receipt, digest: capabilityReceiptDigest(receipt) };
+    }
+    catch (error) {
+        return { state: 'invalid', reason: error.message.slice(0, 4096) };
+    }
+}
+function ensureParents(file) { const chain = []; for (let dir = path_1.default.dirname(path_1.default.resolve(file));; dir = path_1.default.dirname(dir)) {
+    chain.unshift(dir);
+    if (dir === path_1.default.dirname(dir))
+        break;
+} for (const dir of chain) {
+    try {
+        const stat = fs_1.default.lstatSync(dir);
+        if (stat.isSymbolicLink() || !stat.isDirectory())
+            throw new Error(`unsafe capability parent: ${dir}`);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        fs_1.default.mkdirSync(dir, { mode: 0o700 });
+    }
+} }
+function approveCapabilities(input) {
+    if (!input || typeof input !== 'object' || typeof input.file !== 'string' || typeof input.cwd !== 'string')
+        throw new Error('capability approval input is required');
+    (0, validate_1.assertDigest)(input.expectedDigest, 'expectedDigest');
+    if (input.replaceDigest !== undefined)
+        (0, validate_1.assertDigest)(input.replaceDigest, 'replaceDigest');
+    const now = input.now ?? new Date();
+    if (!(now instanceof Date) || !Number.isFinite(now.getTime()))
+        throw new Error('capability approval requires a finite clock');
+    const candidate = readBytes(path_1.default.resolve(input.cwd, input.file));
+    if (!candidate)
+        throw new Error('capability candidate is absent');
+    const receipt = parseReceipt(candidate);
+    if (!receiptIsCurrent(receipt, receipt.runtime, now))
+        throw new Error('capability receipt is future or stale');
+    const digest = capabilityReceiptDigest(receipt);
+    if (digest !== input.expectedDigest)
+        throw new Error('capability receipt digest does not match expectedDigest');
+    const target = capabilityReceiptPath(receipt.runtime);
+    ensureParents(target);
+    const root = (0, paths_1.awmHome)();
+    const destination = path_1.default.relative(root, target).split(path_1.default.sep).join('/');
+    native_bridge_1.secureFs.withProjectLease(root, () => { const current = readBytes(target); if (!current) {
+        if (input.replaceDigest)
+            throw new Error('replacement requires existing capability receipt');
+        native_bridge_1.secureFs.writeProjectTransaction(root, destination, Buffer.from(`${JSON.stringify(receipt, null, 2)}\n`), { mode: 'create', createParents: true });
+        return;
+    } const observed = native_bridge_1.secureFs.readRegularFile(target, 256 * 1024); const prior = parseReceipt(observed.bytes); if (!input.replaceDigest || capabilityReceiptDigest(prior) !== input.replaceDigest)
+        throw new Error('capability receipt replacement predecessor mismatch'); native_bridge_1.secureFs.writeProjectTransaction(root, destination, Buffer.from(`${JSON.stringify(receipt, null, 2)}\n`), { mode: 'replace', createParents: false, expected: observed.bytes, expectedIdentity: observed.identity }); });
+    return receipt;
+}

package/dist/src/core/model-policy/capability-types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/core/model-policy/journal.js

@@ -0,0 +1,124 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reserveRoutingAttempt = reserveRoutingAttempt;
+exports.observeRoutingAttempt = observeRoutingAttempt;
+exports.resolveLineageEscalation = resolveLineageEscalation;
+exports.routingReport = routingReport;
+const crypto_1 = __importDefault(require("crypto"));
+const types_1 = require("../journal/types");
+function assertTimestamp(value) { if (typeof value !== 'string' || !Number.isFinite(Date.parse(value)))
+    throw new Error('routing timestamp is invalid'); }
+function canonical(value) { if (Array.isArray(value))
+    return `[${value.map(canonical).join(',')}]`; if (value !== null && typeof value === 'object') {
+    const record = value;
+    return `{${Object.keys(record).sort().map(key => `${JSON.stringify(key)}:${canonical(record[key])}`).join(',')}}`;
+} return JSON.stringify(value); }
+function digest(value) { return crypto_1.default.createHash('sha256').update(canonical(value)).digest('hex'); }
+function clone(state) { const next = structuredClone(state); if (!Array.isArray(next.routingAttempts))
+    next.routingAttempts = []; return next; }
+function reserveRoutingAttempt(state, input, now) {
+    assertTimestamp(now);
+    if (!(0, types_1.isWellFormedState)(state) || !input || typeof input.obligationId !== 'string' || input.obligationId.length === 0 || input.obligationId.length > 128 || typeof input.lineageId !== 'string' || input.lineageId.length === 0 || input.lineageId.length > 128 || !(0, types_1.isRoutingEnvelope)(input.envelope) || !/^[a-f0-9]{64}$/.test(input.fingerprint))
+        throw new Error('routing reservation is invalid');
+    const next = clone(state);
+    const envelopeDigest = digest(input.envelope);
+    const existing = next.routingAttempts.find(item => item.lineageId === input.lineageId && item.obligationId === input.obligationId && item.envelopeDigest === envelopeDigest && item.fingerprint === input.fingerprint && ['reserved', 'active'].includes(item.state));
+    if (existing)
+        return { state: next, attemptId: existing.id };
+    if (input.envelope.role === 'implementer' && input.envelope.sliceId === undefined)
+        throw new Error('routing implementer requires a slice');
+    next.implementationLineages ??= [];
+    const priorLineage = next.implementationLineages.find(lineage => lineage.id === input.lineageId);
+    if (input.envelope.role === 'implementer' && priorLineage === undefined)
+        next.implementationLineages.push({ id: input.lineageId, obligationId: input.obligationId, sliceId: input.envelope.sliceId, planDigest: input.envelope.planDigest, executionDigest: input.envelope.executionDigest, initialProfile: input.envelope.requestedProfile, initialEffort: input.envelope.resolved.effort.kind === 'explicit' && input.envelope.resolved.effort.value === 'high' ? 'high' : 'medium', attempts: 0 });
+    if (priorLineage !== undefined && (priorLineage.obligationId !== input.obligationId || priorLineage.planDigest !== input.envelope.planDigest || priorLineage.executionDigest !== input.envelope.executionDigest || priorLineage.sliceId !== input.envelope.sliceId || priorLineage.initialProfile !== input.envelope.requestedProfile))
+        throw new Error('routing lineage binding mismatch');
+    const attempts = next.routingAttempts.filter(item => item.lineageId === input.lineageId && item.envelope.role === 'implementer');
+    if (input.envelope.role === 'implementer' && attempts.length >= 3)
+        throw new Error('routing implementation budget exhausted');
+    if (input.envelope.role === 'implementer') {
+        const initial = input.envelope.requestedProfile;
+        if (initial === 'full')
+            throw new Error('routing implementer profile is invalid');
+        const expected = resolveLineageEscalation(next, input.lineageId, initial);
+        const actualEffort = input.envelope.resolved.effort.kind === 'explicit' ? input.envelope.resolved.effort.value : 'runtime-default';
+        if (input.envelope.effectiveProfile !== expected.profile || actualEffort !== expected.effort)
+            throw new Error('routing effective escalation mismatch');
+    }
+    const attempt = attempts.length + 1;
+    const id = `route-${crypto_1.default.createHash('sha256').update(`${input.lineageId}\0${attempt}\0${envelopeDigest}\0${input.fingerprint}`).digest('hex').slice(0, 24)}`;
+    next.routingAttempts.push({ schema: 'routing-attempt/v1', id, obligationId: input.obligationId, lineageId: input.lineageId, attempt, envelope: structuredClone(input.envelope), envelopeDigest, fingerprint: input.fingerprint, state: 'reserved' });
+    const lineage = next.implementationLineages.find(candidate => candidate.id === input.lineageId);
+    if (lineage !== undefined)
+        lineage.attempts = attempt;
+    return { state: next, attemptId: id };
+}
+function observeRoutingAttempt(state, input, now) {
+    assertTimestamp(now);
+    if (!(0, types_1.isWellFormedState)(state) || !input || typeof input.attemptId !== 'string' || input.attemptId.length === 0 || typeof input.nativeAgentId !== 'string' || input.nativeAgentId.length === 0 || input.nativeAgentId.length > 128 || (input.observed !== undefined && !(0, types_1.isRoutingSelection)(input.observed)) || (input.unavailableReason !== undefined && (typeof input.unavailableReason !== 'string' || input.unavailableReason.length === 0 || input.unavailableReason.length > 128)))
+        throw new Error('routing observation is invalid');
+    const next = clone(state);
+    const attempt = next.routingAttempts.find(item => item.id === input.attemptId);
+    if (!attempt)
+        throw new Error('routing attempt is unknown');
+    if (attempt.state === 'active') {
+        if (attempt.nativeAgentId === input.nativeAgentId && canonical(attempt.observed) === canonical(input.observed))
+            return next;
+        throw new Error('routing observation is immutable');
+    }
+    if (attempt.state !== 'reserved')
+        throw new Error('routing attempt cannot be observed');
+    attempt.state = 'active';
+    attempt.nativeAgentId = input.nativeAgentId;
+    if (input.observed)
+        attempt.observed = structuredClone(input.observed);
+    if (input.unavailableReason)
+        attempt.reasonCode = input.unavailableReason;
+    return next;
+}
+/** Computes, but never persists, the only permitted implementation retry.
+ * A live/unknown attempt is custody, not an escalation opportunity.  Judgment
+ * high is an effort escalation of the same approved judgment capability. */
+function resolveLineageEscalation(state, lineageId, initial) {
+    if (!(0, types_1.isWellFormedState)(state) || typeof lineageId !== 'string' || lineageId.length === 0)
+        throw new Error('routing lineage is invalid');
+    const attempts = (state.routingAttempts ?? []).filter((attempt) => attempt.lineageId === lineageId && attempt.envelope.role === 'implementer').sort((left, right) => left.attempt - right.attempt);
+    if (attempts.some((attempt) => ['reserved', 'active', 'unknown'].includes(attempt.state)))
+        throw new Error('routing lineage has a live or unknown attempt');
+    if (attempts.length === 0)
+        return { profile: initial, effort: 'medium' };
+    const last = attempts[attempts.length - 1];
+    if (last.verdict !== 'fail')
+        throw new Error('routing lineage advances only after a terminal failed verdict');
+    if (last.envelope.effectiveProfile === 'mechanical')
+        return { profile: 'integration', effort: 'medium' };
+    if (last.envelope.effectiveProfile === 'integration')
+        return { profile: 'judgment', effort: 'medium' };
+    if (last.envelope.effectiveProfile === 'judgment' && last.envelope.resolved.effort.kind === 'explicit' && last.envelope.resolved.effort.value === 'medium')
+        return { profile: 'judgment', effort: 'high' };
+    throw new Error('routing lineage escalation exhausted');
+}
+/** Read-only operational summary. Deliberately excludes envelopes, prompts and
+ * native identities: this is safe to expose in a status command. */
+function routingReport(state) {
+    const attempts = state.routingAttempts ?? [];
+    const plannedByRole = {};
+    const actualByRole = {};
+    const byState = {};
+    const unavailable = {};
+    const verdicts = {};
+    for (const attempt of attempts) {
+        plannedByRole[attempt.envelope.role] = (plannedByRole[attempt.envelope.role] ?? 0) + 1;
+        if (attempt.nativeAgentId !== undefined)
+            actualByRole[attempt.envelope.role] = (actualByRole[attempt.envelope.role] ?? 0) + 1;
+        byState[attempt.state] = (byState[attempt.state] ?? 0) + 1;
+        for (const reason of attempt.envelope.unavailableEvidence)
+            unavailable[reason] = (unavailable[reason] ?? 0) + 1;
+        if (attempt.verdict !== undefined)
+            verdicts[attempt.verdict] = (verdicts[attempt.verdict] ?? 0) + 1;
+    }
+    return { schema: 'routing-report/v1', attempts: attempts.length, plannedByRole, actualByRole, byState, retries: attempts.filter((attempt) => attempt.attempt > 1).length, fallbacks: attempts.filter((attempt) => attempt.envelope.outcome === 'degraded').length, unavailable, verdicts, administrativeRepairs: attempts.filter((attempt) => attempt.administrativeRepair === true).length };
+}

package/dist/src/core/model-policy/paths.js

@@ -0,0 +1,12 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.userPolicyPath = userPolicyPath;
+exports.projectPolicyPath = projectPolicyPath;
+const path_1 = __importDefault(require("path"));
+const paths_1 = require("../paths");
+function userPolicyPath() { return path_1.default.join((0, paths_1.awmHome)(), 'model-policy.json'); }
+function projectPolicyPath(cwd) { if (typeof cwd !== 'string' || cwd.length === 0)
+    throw new Error('cwd must be a non-empty path'); return path_1.default.join(path_1.default.resolve(cwd), '.awm', 'model-policy.json'); }

package/dist/src/core/model-policy/resolve.js

@@ -0,0 +1,116 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveDispatch = resolveDispatch;
+exports.resolveV1Dispatch = resolveV1Dispatch;
+exports.resolveSelection = resolveSelection;
+const capabilities_1 = require("./capabilities");
+const validate_1 = require("./validate");
+const validate_2 = require("../plan/validate");
+/** Resolve only from the immutable validator report; a reopened plan may never
+ * provide a routing profile after validation. */
+function resolveDispatch(input) {
+    if (!input || typeof input !== 'object' || !input.plan)
+        throw new Error('resolveDispatch requires a plan');
+    (0, validate_2.assertVerifiedValidPlanReport)(input.plan);
+    const local = ['implementer', 'specification-reviewer', 'code-quality-reviewer'].includes(input.role);
+    if (input.plan.schema === 'compact-slices/v1') {
+        if (input.sliceId !== undefined && !input.plan.manifest.slices.some(slice => slice.id === input.sliceId))
+            throw new Error('routing slice does not exist in the validated plan');
+        if (local && typeof input.sliceId !== 'string')
+            throw new Error('local routing requires a slice');
+        return resolveV1Dispatch(input);
+    }
+    if (input.role !== 'implementer') {
+        if (local && (typeof input.sliceId !== 'string' || !input.plan.manifest.slices.some(slice => slice.id === input.sliceId)))
+            throw new Error('local routing requires a valid slice');
+        if (!local && input.sliceId !== undefined)
+            throw new Error('slice is only valid for local routing');
+        return resolveSelection({ ...input, requestedProfile: 'full' });
+    }
+    if (typeof input.sliceId !== 'string' || input.sliceId.length === 0)
+        throw new Error('implementer routing requires a slice');
+    const slice = input.plan.manifest.slices.find(candidate => candidate.id === input.sliceId);
+    if (!slice)
+        throw new Error('routing slice does not exist in the validated plan');
+    return resolveSelection({ ...input, requestedProfile: slice.implementerProfile });
+}
+function resolveV1Dispatch(input) {
+    if (!input.plan || input.plan.schema !== 'compact-slices/v1')
+        throw new Error('resolveV1Dispatch requires an authenticated v1 plan report');
+    (0, validate_2.assertVerifiedValidPlanReport)(input.plan);
+    if (!input.optInV1)
+        return { state: 'not-required', reason: 'v1-without-opt-in' };
+    return resolveSelection({ ...input, requestedProfile: 'full' });
+}
+function equal(left, right) { return left.selector.kind === right.selector.kind && left.selector.id === right.selector.id && left.effort.kind === right.effort.kind && (left.effort.kind !== 'explicit' || left.effort.value === right.effort.value); }
+function blocked(code, message) { return { state: 'blocked', diagnostics: [(0, capabilities_1.routingDiagnostic)(code, message)] }; }
+function resolveSelection(input) {
+    if (!input || typeof input !== 'object' || !input.runtime || !(input.now instanceof Date) || !Number.isFinite(input.now.getTime()))
+        throw new Error('resolveSelection requires a runtime and finite clock');
+    if (!['implementer', 'specification-reviewer', 'code-quality-reviewer', 'final-reviewer', 'architecture', 'track-a-qa', 'track-b-qa', 'controller', 'documentation', 'retro', 'finishing'].includes(input.role))
+        throw new Error('resolveSelection role is invalid');
+    if (!['mechanical', 'integration', 'judgment', 'full'].includes(input.requestedProfile))
+        throw new Error('resolveSelection requestedProfile is invalid');
+    if (!input.policy)
+        return blocked('ROUTING_POLICY_ABSENT', 'A digest-bound approved routing policy is required.');
+    if (!input.capabilities)
+        return blocked('ROUTING_CAPABILITY_ABSENT', 'A current capability receipt is required.');
+    let policy;
+    let capabilities;
+    try {
+        policy = (0, validate_1.validateApprovedPolicy)(input.policy);
+    }
+    catch {
+        return blocked('ROUTING_POLICY_INVALID', 'Approved routing policy is corrupt.');
+    }
+    try {
+        capabilities = (0, capabilities_1.validateCapabilityReceipt)(input.capabilities);
+    }
+    catch {
+        return blocked('ROUTING_CAPABILITY_INVALID', 'Capability receipt is corrupt.');
+    }
+    if (!(0, capabilities_1.receiptIsCurrent)(capabilities, input.runtime, input.now))
+        return blocked('ROUTING_CAPABILITY_RUNTIME_MISMATCH', 'Capability receipt does not match the current runtime or is stale.');
+    const mapping = policy.content.mappings.find(row => row.target === input.runtime.target && row.runtimeKind === input.runtime.kind);
+    if (!mapping)
+        return blocked('ROUTING_POLICY_MAPPING_ABSENT', 'Approved policy has no exact target/runtime mapping.');
+    const effectiveProfile = input.role === 'implementer' ? input.requestedProfile : 'full';
+    const wanted = effectiveProfile === 'full' ? mapping.fullCapability : mapping.profiles[effectiveProfile];
+    let selection = wanted;
+    const unavailableEvidence = [];
+    let outcome = 'native';
+    const canDegrade = (capability, allowed, code) => {
+        const state = capabilities.capabilities[capability];
+        if (state === 'supported')
+            return undefined;
+        if (state === 'unverified')
+            return blocked(code, `${capability} is unverified.`);
+        if (!allowed || !capabilities.runtimeDefaultSelection || !equal(capabilities.runtimeDefaultSelection, mapping.fullCapability))
+            return blocked(code, `${capability} is unavailable and no matching approved full default is attested.`);
+        selection = mapping.fullCapability;
+        outcome = 'degraded';
+        unavailableEvidence.push(capability);
+        return undefined;
+    };
+    const model = canDegrade('modelOverride', mapping.degradation.allowMissingModelOverride, 'ROUTING_MODEL_OVERRIDE_UNAVAILABLE');
+    if (model)
+        return model;
+    if (!capabilities.availableSelections.some(candidate => equal(candidate, selection)))
+        return blocked('ROUTING_SELECTION_UNAVAILABLE', 'Approved selection is not currently available; no substitute is allowed.');
+    if (selection.effort.kind === 'runtime-default') {
+        if (!capabilities.runtimeDefaultSelection || !equal(capabilities.runtimeDefaultSelection, selection))
+            return blocked('ROUTING_SELECTION_UNAVAILABLE', 'Runtime-default selection is not explicitly attested.');
+    }
+    else {
+        const effort = canDegrade('effortOverride', mapping.degradation.allowMissingEffortOverride, 'ROUTING_EFFORT_OVERRIDE_UNAVAILABLE');
+        if (effort)
+            return effort;
+    }
+    if (capabilities.capabilities.observedModelEvidence !== 'supported') {
+        if (!mapping.degradation.allowMissingObservedIdentity)
+            return blocked('ROUTING_OBSERVED_IDENTITY_UNAVAILABLE', 'Observed model identity is required and unavailable.');
+        outcome = 'degraded';
+        unavailableEvidence.push('observedModelEvidence');
+    }
+    return { state: 'resolved', selection, effectiveProfile, outcome, policyDigest: policy.contentDigest, capabilityDigest: (0, capabilities_1.capabilityReceiptDigest)(capabilities), unavailableEvidence };
+}

package/dist/src/core/model-policy/store.js

@@ -0,0 +1,182 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readEffectivePolicy = readEffectivePolicy;
+exports.approvePolicyWithBoundary = approvePolicyWithBoundary;
+exports.approvePolicy = approvePolicy;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const json_1 = require("../plan/json");
+const native_bridge_1 = require("../secure-fs/native-bridge");
+const canonical_1 = require("./canonical");
+const paths_1 = require("./paths");
+const validate_1 = require("./validate");
+function assertPath(value, label) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > 4096 || /[\u0000-\u001f\u007f-\u009f]/.test(value))
+        throw new Error(`${label} must be a bounded path without control characters`);
+}
+function ancestors(file) { const absolute = path_1.default.resolve(file); const result = []; for (let current = path_1.default.dirname(absolute);; current = path_1.default.dirname(current)) {
+    result.unshift(current);
+    if (current === path_1.default.dirname(current))
+        return result;
+} }
+function assertSafeParents(file) {
+    for (const parent of ancestors(file)) {
+        try {
+            const stat = fs_1.default.lstatSync(parent, { bigint: true });
+            if (stat.isSymbolicLink() || !stat.isDirectory())
+                throw new Error(`unsafe policy parent: ${parent}`);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+}
+function assertRegularOrAbsent(file) { try {
+    const stat = fs_1.default.lstatSync(file, { bigint: true });
+    if (stat.isSymbolicLink() || !stat.isFile())
+        throw new Error(`policy file rejects symlink or non-regular file: ${file}`);
+}
+catch (error) {
+    if (error.code !== 'ENOENT')
+        throw error;
+} }
+function readBounded(file) {
+    assertSafeParents(file);
+    let inspected;
+    try {
+        inspected = fs_1.default.lstatSync(file, { bigint: true });
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+    if (inspected.isSymbolicLink() || !inspected.isFile() || inspected.size < 0n || inspected.size > BigInt(validate_1.MAX_POLICY_BYTES))
+        throw new Error('policy file is unsafe or exceeds 256 KiB');
+    const fd = fs_1.default.openSync(file, fs_1.default.constants.O_RDONLY | (fs_1.default.constants.O_NOFOLLOW ?? 0));
+    try {
+        const opened = fs_1.default.fstatSync(fd, { bigint: true });
+        if (!opened.isFile() || opened.dev !== inspected.dev || opened.ino !== inspected.ino || opened.size !== inspected.size)
+            throw new Error('policy file identity changed');
+        assertSafeParents(file);
+        return fs_1.default.readFileSync(fd, 'utf8');
+    }
+    finally {
+        fs_1.default.closeSync(fd);
+    }
+}
+function parseApproved(raw) { const policy = (0, validate_1.validateApprovedPolicy)((0, json_1.parseJsonNoDuplicate)(raw)); if ((0, canonical_1.canonicalPolicyDigest)(policy.content) !== policy.contentDigest)
+    throw new Error('approved policy content digest mismatch'); return policy; }
+function policyTarget(scope, cwd) { if (scope !== 'user' && scope !== 'project')
+    throw new Error('scope must be user or project'); assertPath(cwd, 'cwd'); return scope === 'user' ? (0, paths_1.userPolicyPath)() : (0, paths_1.projectPolicyPath)(cwd); }
+function createDirectories(file) {
+    const chain = ancestors(file);
+    for (const directory of chain) {
+        try {
+            const stat = fs_1.default.lstatSync(directory);
+            if (stat.isSymbolicLink() || !stat.isDirectory())
+                throw new Error(`unsafe policy parent: ${directory}`);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            fs_1.default.mkdirSync(directory, { mode: 0o700 });
+        }
+    }
+}
+function lock(file) { const lockPath = `${file}.lock`; assertRegularOrAbsent(lockPath); let fd; try {
+    fd = fs_1.default.openSync(lockPath, 'wx', 0o600);
+}
+catch (error) {
+    if (error.code === 'EEXIST')
+        throw new Error('policy writer lock already exists; explicit recovery required');
+    throw error;
+} return () => { try {
+    fs_1.default.closeSync(fd);
+}
+finally {
+    fs_1.default.rmSync(lockPath, { force: false });
+} }; }
+function readEffectivePolicy(cwd) {
+    assertPath(cwd, 'cwd');
+    const project = (0, paths_1.projectPolicyPath)(cwd);
+    try {
+        const raw = readBounded(project);
+        if (raw !== null)
+            return { state: 'approved', provenance: 'project', policy: parseApproved(raw) };
+    }
+    catch (error) {
+        return { state: 'invalid', provenance: 'project', reason: error.message.slice(0, 4096) };
+    }
+    const user = (0, paths_1.userPolicyPath)();
+    try {
+        const raw = readBounded(user);
+        if (raw === null)
+            return { state: 'absent' };
+        return { state: 'approved', provenance: 'user', policy: parseApproved(raw) };
+    }
+    catch (error) {
+        return { state: 'invalid', provenance: 'user', reason: error.message.slice(0, 4096) };
+    }
+}
+/** Testable transaction seam; production callers use approvePolicy, which binds secureFs. */
+function approvePolicyWithBoundary(input, boundary) {
+    if (!input || typeof input !== 'object')
+        throw new Error('approval input is required');
+    assertPath(input.file, 'file');
+    assertPath(input.cwd, 'cwd');
+    (0, validate_1.assertDigest)(input.expectedDigest, 'expectedDigest');
+    if (input.replaceDigest !== undefined)
+        (0, validate_1.assertDigest)(input.replaceDigest, 'replaceDigest');
+    const cwd = path_1.default.resolve(input.cwd);
+    const candidateRaw = readBounded(path_1.default.resolve(cwd, input.file));
+    if (candidateRaw === null)
+        throw new Error('policy candidate is absent');
+    const content = (0, validate_1.validatePolicyContent)((0, json_1.parseJsonNoDuplicate)(candidateRaw));
+    const digest = (0, canonical_1.canonicalPolicyDigest)(content);
+    if (digest !== input.expectedDigest)
+        throw new Error('policy content digest does not match expectedDigest');
+    const target = policyTarget(input.scope, cwd);
+    createDirectories(target);
+    assertSafeParents(target);
+    assertRegularOrAbsent(target);
+    const unlock = lock(target);
+    try {
+        const existingRaw = readBounded(target);
+        const existing = existingRaw === null ? null : parseApproved(existingRaw);
+        if (existing === null && input.replaceDigest !== undefined)
+            throw new Error('replacement requires an existing predecessor');
+        if (existing !== null && input.replaceDigest === undefined)
+            throw new Error('existing policy requires replaceDigest');
+        if (existing !== null && existing.contentDigest !== input.replaceDigest)
+            throw new Error('replacement predecessor digest mismatch');
+        const approved = { schema: 'approved-model-policy/v1', content, contentDigest: digest, approval: { approvedAt: new Date().toISOString(), approvalId: crypto_1.default.randomUUID() }, lineage: { previousDigest: existing?.contentDigest ?? null } };
+        const serialized = `${JSON.stringify(approved, null, 2)}\n`;
+        const root = input.scope === 'project' ? cwd : path_1.default.dirname(target);
+        const destination = input.scope === 'project' ? '.awm/model-policy.json' : path_1.default.basename(target);
+        boundary.withProjectLease(root, () => {
+            if (existing === null) {
+                boundary.writeProjectTransaction(root, destination, Buffer.from(serialized, 'utf8'), { mode: 'create', createParents: true });
+                return;
+            }
+            // A native identity-fenced transaction proves that neither bytes nor
+            // file identity changed after the bounded observation. A JS rename
+            // cannot make that CAS claim, so it is deliberately not used here.
+            const observed = boundary.readRegularFile(target, validate_1.MAX_POLICY_BYTES);
+            const current = parseApproved(new TextDecoder('utf-8', { fatal: true }).decode(observed.bytes));
+            if (current.contentDigest !== input.replaceDigest)
+                throw new Error('replacement predecessor digest changed under writer lock');
+            boundary.writeProjectTransaction(root, destination, Buffer.from(serialized, 'utf8'), { mode: 'replace', createParents: false, expected: observed.bytes, expectedIdentity: observed.identity });
+        });
+        return approved;
+    }
+    finally {
+        unlock();
+    }
+}
+function approvePolicy(input) { return approvePolicyWithBoundary(input, native_bridge_1.secureFs); }

package/dist/src/core/model-policy/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });