agentic-workflow-manager 9.8.0 → 9.9.0

package/dist/tests/core/model-policy/store.test.js

@@ -0,0 +1,177 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const atomic_file_1 = require("../../../src/core/atomic-file");
+const canonical_1 = require("../../../src/core/model-policy/canonical");
+const store_1 = require("../../../src/core/model-policy/store");
+const paths_1 = require("../../../src/core/model-policy/paths");
+const policy = () => ({ schema: 'model-policy/v1', mappings: [{ target: 'codex', runtimeKind: 'native', profiles: {
+                mechanical: { selector: { kind: 'model', id: 'gpt-5.6-luna' }, effort: { kind: 'explicit', value: 'medium' } },
+                integration: { selector: { kind: 'model', id: 'gpt-5.6-terra' }, effort: { kind: 'explicit', value: 'medium' } },
+                judgment: { selector: { kind: 'model', id: 'gpt-5.6-sol' }, effort: { kind: 'explicit', value: 'medium' } },
+            }, fullCapability: { selector: { kind: 'model', id: 'gpt-5.6-sol' }, effort: { kind: 'explicit', value: 'high' } }, degradation: { allowMissingModelOverride: false, allowMissingEffortOverride: false, allowMissingObservedIdentity: false } }], implementationBudget: { maxAttempts: 3, escalation: ['mechanical', 'integration', 'judgment'], judgmentEfforts: ['medium', 'high'] } });
+function createIdentityFencedBoundary() {
+    const observations = new WeakMap();
+    return {
+        withProjectLease: (_root, operation) => operation(),
+        readRegularFile: (file) => {
+            const identity = Object.freeze({});
+            const bytes = fs_1.default.readFileSync(file);
+            observations.set(identity, { file, bytes });
+            return { bytes, identity };
+        },
+        writeProjectTransaction: (root, destination, content, options) => {
+            const file = path_1.default.join(root, destination);
+            fs_1.default.mkdirSync(path_1.default.dirname(file), { recursive: true });
+            if (options.mode === 'create' && fs_1.default.existsSync(file))
+                throw new Error('project destination already exists');
+            if (options.mode === 'replace') {
+                const observed = observations.get(options.expectedIdentity);
+                if (!observed || observed.file !== file || !observed.bytes.equals(options.expected) || !fs_1.default.readFileSync(file).equals(options.expected))
+                    throw new Error('original changed before fenced replacement');
+            }
+            const temporary = `${file}.test-tmp`;
+            const fd = fs_1.default.openSync(temporary, 'wx', 0o600);
+            try {
+                fs_1.default.writeFileSync(fd, content);
+                fs_1.default.fsyncSync(fd);
+                fs_1.default.closeSync(fd);
+                fs_1.default.renameSync(temporary, file);
+                // La durabilidad de la ENTRADA publicada se pide por el unico helper
+                // que define esa politica (atomic-file.fsyncDirSync): fail-closed en
+                // POSIX y degradado SOLO ante el gap conocido de win32 (EPERM al
+                // fsync-ear un fd de directorio, capacidad que el SO no expone).
+                // Reimplementarla aca la hacia divergir y rompia la matriz Windows.
+                (0, atomic_file_1.fsyncDirSync)(path_1.default.dirname(file));
+            }
+            finally {
+                try {
+                    fs_1.default.rmSync(temporary, { force: true });
+                }
+                catch { /* preserve transaction result */ }
+            }
+        },
+    };
+}
+const identityFencedBoundary = createIdentityFencedBoundary();
+const approve = (input) => (0, store_1.approvePolicyWithBoundary)(input, identityFencedBoundary);
+describe('approved policy store', () => {
+    let root;
+    let oldHome;
+    let oldAwmHome;
+    beforeEach(() => { root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-policy-')); oldHome = process.env.HOME; oldAwmHome = process.env.AWM_HOME; process.env.AWM_HOME = path_1.default.join(root, 'operator'); });
+    afterEach(() => { jest.restoreAllMocks(); delete process.env.POLICY_TEST_FAIL_WRITE; delete process.env.POLICY_TEST_MUTATE_DURING_REPLACE; if (oldHome === undefined)
+        delete process.env.HOME;
+    else
+        process.env.HOME = oldHome; if (oldAwmHome === undefined)
+        delete process.env.AWM_HOME;
+    else
+        process.env.AWM_HOME = oldAwmHome; fs_1.default.rmSync(root, { recursive: true, force: true }); });
+    const candidate = () => { const file = path_1.default.join(root, 'candidate.json'); fs_1.default.writeFileSync(file, JSON.stringify(policy())); return file; };
+    it('publishes only an expected digest and reads it without creating state', () => {
+        const file = candidate();
+        const digest = (0, canonical_1.canonicalPolicyDigest)(policy());
+        expect((0, store_1.readEffectivePolicy)(root)).toEqual({ state: 'absent' });
+        const approved = approve({ file, scope: 'user', cwd: root, expectedDigest: digest });
+        expect(approved.contentDigest).toBe(digest);
+        expect((0, store_1.readEffectivePolicy)(root)).toMatchObject({ state: 'approved', provenance: 'user', policy: { contentDigest: digest } });
+    });
+    it('rejects a mismatched digest before writing', () => {
+        const file = candidate();
+        expect(() => approve({ file, scope: 'user', cwd: root, expectedDigest: '0'.repeat(64) })).toThrow(/digest/i);
+        expect(fs_1.default.existsSync((0, paths_1.userPolicyPath)())).toBe(false);
+    });
+    it('allows exactly one initial writer and exact CAS replacement', () => {
+        const file = candidate();
+        const digest = (0, canonical_1.canonicalPolicyDigest)(policy());
+        approve({ file, scope: 'user', cwd: root, expectedDigest: digest });
+        expect(() => approve({ file, scope: 'user', cwd: root, expectedDigest: digest })).toThrow(/replace|existing/i);
+        expect(() => approve({ file, scope: 'user', cwd: root, expectedDigest: digest, replaceDigest: 'f'.repeat(64) })).toThrow(/predecessor|replace/i);
+        expect(approve({ file, scope: 'user', cwd: root, expectedDigest: digest, replaceDigest: digest }).lineage.previousDigest).toBe(digest);
+    });
+    it('rejects an unexpected opaque identity token before replacing bytes', () => {
+        const target = path_1.default.join(root, 'identity.json');
+        fs_1.default.writeFileSync(target, 'observed');
+        const observed = identityFencedBoundary.readRegularFile(target, 1024);
+        expect(() => identityFencedBoundary.writeProjectTransaction(root, 'identity.json', Buffer.from('replacement'), {
+            mode: 'replace', createParents: false, expected: observed.bytes, expectedIdentity: Object.freeze({}),
+        })).toThrow(/original changed/i);
+        expect(fs_1.default.readFileSync(target, 'utf8')).toBe('observed');
+    });
+    it('resolves a relative candidate through cwd instead of process cwd', () => {
+        const cwd = path_1.default.join(root, 'project');
+        fs_1.default.mkdirSync(cwd);
+        const file = path_1.default.join(cwd, 'candidate.json');
+        fs_1.default.writeFileSync(file, JSON.stringify(policy()));
+        const digest = (0, canonical_1.canonicalPolicyDigest)(policy());
+        expect(approve({ file: 'candidate.json', scope: 'project', cwd, expectedDigest: digest }).contentDigest).toBe(digest);
+    });
+    it('accepts exactly one of two competing fenced replacements', () => {
+        const file = candidate();
+        const digest = (0, canonical_1.canonicalPolicyDigest)(policy());
+        approve({ file, scope: 'user', cwd: root, expectedDigest: digest });
+        const input = { file, scope: 'user', cwd: root, expectedDigest: digest, replaceDigest: digest };
+        let entered = false;
+        let accepted = 0;
+        const boundary = {
+            withProjectLease: (_root, operation) => operation(),
+            readRegularFile: (target) => ({ bytes: fs_1.default.readFileSync(target), identity: Object.freeze({}) }),
+            writeProjectTransaction: (base, destination, bytes, options) => {
+                const target = path_1.default.join(base, destination);
+                if (options.mode === 'replace' && !entered) {
+                    entered = true;
+                    // Model a non-cooperating external process: the native
+                    // identity fence, not this advisory lock, must reject us.
+                    fs_1.default.rmSync(`${target}.lock`);
+                    (0, store_1.approvePolicyWithBoundary)(input, boundary);
+                    fs_1.default.writeFileSync(`${target}.lock`, 'outer lock placeholder');
+                }
+                if (options.mode === 'replace' && (!options.expected || !fs_1.default.readFileSync(target).equals(options.expected)))
+                    throw new Error('original changed before fenced replacement');
+                fs_1.default.mkdirSync(path_1.default.dirname(target), { recursive: true });
+                fs_1.default.writeFileSync(target, bytes);
+                accepted++;
+            },
+        };
+        expect(() => (0, store_1.approvePolicyWithBoundary)(input, boundary)).toThrow(/changed|replacement/i);
+        expect(accepted).toBe(1);
+    });
+    it('returns a failed publication and preserves predecessor bytes on injected transaction failure', () => {
+        const file = candidate();
+        const digest = (0, canonical_1.canonicalPolicyDigest)(policy());
+        approve({ file, scope: 'user', cwd: root, expectedDigest: digest });
+        const before = fs_1.default.readFileSync((0, paths_1.userPolicyPath)());
+        const boundary = {
+            withProjectLease: (_root, operation) => operation(),
+            readRegularFile: (target) => ({ bytes: fs_1.default.readFileSync(target), identity: Object.freeze({}) }),
+            writeProjectTransaction: () => { throw new Error('injected durable publication failure'); },
+        };
+        expect(() => (0, store_1.approvePolicyWithBoundary)({ file, scope: 'user', cwd: root, expectedDigest: digest, replaceDigest: digest }, boundary)).toThrow(/publication failure/);
+        expect(fs_1.default.readFileSync((0, paths_1.userPolicyPath)()).equals(before)).toBe(true);
+    });
+    it('blocks an invalid project policy instead of falling back to a valid user policy', () => {
+        const file = candidate();
+        const digest = (0, canonical_1.canonicalPolicyDigest)(policy());
+        approve({ file, scope: 'user', cwd: root, expectedDigest: digest });
+        fs_1.default.mkdirSync(path_1.default.join(root, '.awm'));
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'model-policy.json'), '{"content":');
+        expect((0, store_1.readEffectivePolicy)(root)).toMatchObject({ state: 'invalid', provenance: 'project' });
+    });
+    it('rejects duplicate JSON keys and symlinked parent or destination without touching the target', () => {
+        const duplicate = path_1.default.join(root, 'duplicate.json');
+        fs_1.default.writeFileSync(duplicate, '{"schema":"model-policy/v1","schema":"model-policy/v1"}');
+        expect(() => approve({ file: duplicate, scope: 'user', cwd: root, expectedDigest: 'a'.repeat(64) })).toThrow(/duplicate/i);
+        const file = candidate();
+        const digest = (0, canonical_1.canonicalPolicyDigest)(policy());
+        fs_1.default.mkdirSync(process.env.AWM_HOME);
+        fs_1.default.symlinkSync(root, path_1.default.join(process.env.AWM_HOME, 'link'));
+        const target = (0, paths_1.userPolicyPath)();
+        fs_1.default.symlinkSync(path_1.default.join(root, 'outside'), target);
+        expect(() => approve({ file, scope: 'user', cwd: root, expectedDigest: digest })).toThrow(/symlink/i);
+    });
+});

package/dist/tests/core/plan/validate.test.js

@@ -50,6 +50,15 @@ function fixture(root, mutate) {
     fs_1.default.writeFileSync(plan, markdown);
     return plan;
 }
+function v2Fixture(root, profile = 'mechanical') {
+    const plan = fixture(root, manifest => {
+        manifest.schema = 'compact-slices/v2';
+        const slices = manifest.slices;
+        slices[0].implementerProfile = profile;
+    });
+    fs_1.default.writeFileSync(plan, fs_1.default.readFileSync(plan, 'utf8').replace(START, '<!-- AWM:COMPACT-SLICES:START v2 -->').replace(END, '<!-- AWM:COMPACT-SLICES:END v2 -->'));
+    return plan;
+}
 describe('validatePlanFile', () => {
     it('validates an authenticated snapshot without reopening a swapped plan parent', () => {
         const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-plan-snapshot-'));
@@ -86,6 +95,35 @@ describe('validatePlanFile', () => {
         expect((0, validate_1.validatePlanFile)(plan, root)).toMatchObject({ state: 'valid', schema: 'compact-slices/v1' });
         expect(fs_1.default.readFileSync(plan, 'utf8')).toBe(before);
     });
+    test.each(['mechanical', 'integration', 'judgment'])('accepts v2 with the exact %s implementer profile', profile => {
+        const report = (0, validate_1.validatePlanFile)(v2Fixture(root, profile), root);
+        expect(report).toMatchObject({ state: 'valid', schema: 'compact-slices/v2', manifest: { slices: [expect.objectContaining({ implementerProfile: profile })] } });
+    });
+    test('rejects v1 profile without weakening exact keys', () => {
+        expect((0, validate_1.validatePlanFile)(fixture(root, manifest => { (manifest.slices[0]).implementerProfile = 'mechanical'; }), root)).toMatchObject({ state: 'invalid' });
+    });
+    test.each([
+        ['missing profile', (text) => text.replace(/,\n\s*"implementerProfile": "mechanical"/, '')],
+        ['concrete model', (text) => text.replace('"implementerProfile": "mechanical"', '"implementerProfile": "mechanical",\n      "model": "vendor-model"')],
+        ['unknown profile', (text) => text.replace('"implementerProfile": "mechanical"', '"implementerProfile": "cheap"')],
+    ])('rejects v2 %s without weakening exact keys', (_name, mutate) => {
+        const plan = v2Fixture(root);
+        fs_1.default.writeFileSync(plan, mutate(fs_1.default.readFileSync(plan, 'utf8')));
+        expect((0, validate_1.validatePlanFile)(plan, root)).toMatchObject({ state: 'invalid' });
+    });
+    test('preserves v2 profile bytes in the execution identity', () => {
+        const mechanical = fs_1.default.readFileSync(v2Fixture(root, 'mechanical'), 'utf8');
+        const integration = mechanical.replace('"implementerProfile": "mechanical"', '"implementerProfile": "integration"');
+        const integrationPath = path_1.default.join(root, 'integration.md');
+        fs_1.default.writeFileSync(integrationPath, integration);
+        const left = (0, validate_1.validatePlanFile)(path_1.default.join(root, 'plan.md'), root);
+        const right = (0, validate_1.validatePlanFile)(integrationPath, root);
+        expect(left).toMatchObject({ state: 'valid', schema: 'compact-slices/v2' });
+        expect(right).toMatchObject({ state: 'valid', schema: 'compact-slices/v2' });
+        if (left.state !== 'valid' || right.state !== 'valid')
+            throw new Error('v2 fixture must validate');
+        expect(left.executionDigest).not.toBe(right.executionDigest);
+    });
     test('makes an approved valid report and its nested manifest immutable after verification', () => {
         const report = (0, validate_1.validatePlanFile)(fixture(root), root);
         expectApprovedPlanValid(report);
@@ -436,7 +474,7 @@ describe('validatePlanFile', () => {
     test('keeps a future schema behind partial markers invalid rather than unsupported', () => {
         const plan = path_1.default.join(root, 'partial-future.md');
         fs_1.default.writeFileSync(plan, `${START}\n{"schema":"compact-slices/v2"}`);
-        expect((0, validate_1.validatePlanFile)(plan, root)).toMatchObject({ state: 'unsupported', schema: 'compact-slices/v2' });
+        expect((0, validate_1.validatePlanFile)(plan, root)).toMatchObject({ state: 'invalid', diagnostics: [expect.objectContaining({ code: 'PLAN_MARKERS' })] });
     });
     test('applies scalar limits before classifying a future schema as unsupported', () => {
         const plan = path_1.default.join(root, 'future-too-large.md');
@@ -733,7 +771,7 @@ describe('validatePlanFile', () => {
     test('recognizes a parseable future schema when only the END marker is broken', () => {
         const plan = path_1.default.join(root, 'future-missing-end.md');
         fs_1.default.writeFileSync(plan, `${START}\n{"schema":"compact-slices/v2"}\n`);
-        expect((0, validate_1.validatePlanFile)(plan, root)).toMatchObject({ state: 'unsupported', schema: 'compact-slices/v2' });
+        expect((0, validate_1.validatePlanFile)(plan, root)).toMatchObject({ state: 'invalid', diagnostics: [expect.objectContaining({ code: 'PLAN_MARKERS' })] });
     });
     test('accepts CRLF Markdown with nested headings and fenced code in a required section', () => {
         const plan = fixture(root);

package/dist/tests/core/secure-fs/native-bridge.test.js

@@ -160,6 +160,28 @@ describe('native secure-fs Windows source contract', () => {
         expect(removal).not.toMatch(/\bDeleteFileW\b/);
     });
 });
+describe('native secure-fs durable publication source contract', () => {
+    const source = () => fs_1.default.readFileSync(path_1.default.resolve(__dirname, '../../../native/secure_fs.cc'), 'utf8').replace(/\r\n/g, '\n');
+    it('turns parent-directory fsync failure after publication into a bounded error', () => {
+        const native = source();
+        const write = native.slice(native.indexOf('napi_value WriteProjectTransaction'), native.indexOf('\n}  // namespace'));
+        expect(native).toMatch(/if \(fsync\(parent\) != 0\)[\s\S]{0,240}Throw\(env, "secure-fs durable directory sync failed"\)/);
+        expect(write).toMatch(/fsync\(parent\) == 0;[\s\S]{0,180}secure-fs durable directory sync failed/);
+        const withoutWriteSync = write.replace('fsync(parent) == 0', 'true');
+        expect(withoutWriteSync).not.toMatch(/fsync\(parent\) == 0;/);
+        expect(withoutWriteSync).not.toMatch(/fsync\(parent\) == 0;[\s\S]{0,180}secure-fs durable directory sync failed/);
+    });
+    it('degrades only the unsupported Windows directory flush and retains all other durable failures', () => {
+        expect(source()).toMatch(/FlushFileBuffers\(parent\.handle\) == 0 && GetLastError\(\) != ERROR_ACCESS_DENIED/);
+        expect(source()).toMatch(/if \(directory_sync_failed\).*secure-fs durable directory sync failed/);
+    });
+    it('does not clean a staging name already consumed by a fenced POSIX rename', () => {
+        const write = source().slice(source().indexOf('napi_value WriteProjectTransaction'), source().indexOf('\n}  // namespace'));
+        expect(write).toContain('const bool cleaned = options.replace || unlinkat(parent, temporary.c_str(), 0) == 0;');
+        const reverted = write.replace('options.replace || ', '');
+        expect(reverted).not.toContain('const bool cleaned = options.replace || unlinkat(parent, temporary.c_str(), 0) == 0;');
+    });
+});
 describe('native secure-fs POSIX source contract', () => {
     const source = () => fs_1.default.readFileSync(path_1.default.resolve(__dirname, '../../../native/secure_fs.cc'), 'utf8');
     it('uses an unpredictable nonce and a bounded retry loop for descriptor-relative staging', () => {
@@ -399,6 +421,38 @@ const nativeFixtureAvailable = ['linux', 'darwin', 'win32'].includes(process.pla
     && ['x64', 'arm64'].includes(process.arch)
     && fs_1.default.existsSync(path_1.default.join(__dirname, '../../../prebuilds', `${process.platform}-${process.arch}`, 'secure_fs.node'));
 const nativeOnly = nativeFixtureAvailable ? describe : describe.skip;
+const testAddonPath = path_1.default.join(__dirname, '../../../native/build/Release/secure_fs_test.node');
+const nativeTestOnly = describe;
+nativeTestOnly('native secure-fs directory-sync fault injection', () => {
+    let root;
+    let testBinding;
+    beforeEach(() => {
+        expect(fs_1.default.existsSync(testAddonPath)).toBe(true);
+        root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-secure-fs-fsync-'));
+        testBinding = require(testAddonPath);
+    });
+    afterEach(() => { testBinding.setDirectoryFsyncFailureForTests(false); fs_1.default.rmSync(root, { recursive: true, force: true }); });
+    it('writes the target then reports the forced post-publication directory-sync failure', () => {
+        testBinding.setDirectoryFsyncFailureForTests(true);
+        expect(() => testBinding.writeProjectTransaction(root, 'durable.txt', Buffer.from('published'), { mode: 'create', createParents: false })).toThrow('secure-fs durable directory sync failed');
+        expect(fs_1.default.readFileSync(path_1.default.join(root, 'durable.txt'), 'utf8')).toBe('published');
+    });
+    it('publishes an exact fenced replacement with fault injection disabled', () => {
+        const target = path_1.default.join(root, 'replace.json');
+        fs_1.default.writeFileSync(target, 'before');
+        const observed = testBinding.readRegularFile(target, 1024);
+        expect(() => testBinding.writeProjectTransaction(root, 'replace.json', Buffer.from('after'), {
+            mode: 'replace', expected: observed.bytes, expectedIdentity: observed.identity, createParents: false,
+        })).not.toThrow();
+        expect(fs_1.default.readFileSync(target, 'utf8')).toBe('after');
+    });
+    it('keeps the production prebuild free of the test-only control', () => {
+        if (!nativeFixtureAvailable)
+            return;
+        const production = require(path_1.default.join(__dirname, '../../../prebuilds', `${process.platform}-${process.arch}`, 'secure_fs.node'));
+        expect(production.setDirectoryFsyncFailureForTests).toBeUndefined();
+    });
+});
 nativeOnly('native secure-fs identity fence fixtures', () => {
     let root;
     let binding;
@@ -406,6 +460,11 @@ nativeOnly('native secure-fs identity fence fixtures', () => {
         root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-secure-fs-identity-'));
         binding = require(path_1.default.join(__dirname, '../../../prebuilds', `${process.platform}-${process.arch}`, 'secure_fs.node'));
     });
+    it('performs a real artifact-backed publish when the CI prebuild is available', () => {
+        const target = path_1.default.join(root, 'durable.txt');
+        binding.writeProjectTransaction(root, 'durable.txt', Buffer.from('published'), { mode: 'create', createParents: false });
+        expect(fs_1.default.readFileSync(target, 'utf8')).toBe('published');
+    });
     afterEach(() => { fs_1.default.rmSync(root, { recursive: true, force: true }); });
     it('returns bytes with a canonical native identity from the same regular-file read', () => {
         const target = path_1.default.join(root, 'sensors.json');
@@ -690,6 +749,7 @@ windowsOnly('native secure-fs Windows handle fixtures', () => {
                     fs.symlinkSync(workerData.outside, workerData.trusted, 'junction');
                     Atomics.add(state, 1, 1);
                     Atomics.notify(state, 1);
+                    parentPort.postMessage('ready');
                     Atomics.wait(state, 0, 0, 1);
                     fs.rmSync(workerData.trusted);
                     fs.renameSync(workerData.parked, workerData.trusted);
@@ -701,13 +761,30 @@ windowsOnly('native secure-fs Windows handle fixtures', () => {
             restore();
             parentPort.postMessage('done');
             `, { eval: true, workerData: { shared, trusted, parked, outside } });
-        const done = new Promise((resolve, reject) => {
-            worker.once('message', () => resolve());
-            worker.once('error', reject);
+        let resolveReady;
+        let rejectReady;
+        let resolveDone;
+        let rejectDone;
+        const ready = new Promise((resolve, reject) => { resolveReady = resolve; rejectReady = reject; });
+        const done = new Promise((resolve, reject) => { resolveDone = resolve; rejectDone = reject; });
+        const readyTimeout = setTimeout(() => rejectReady(new Error('junction swap worker did not become ready')), 5_000);
+        worker.on('message', message => {
+            if (message === 'ready') {
+                clearTimeout(readyTimeout);
+                resolveReady();
+            }
+            if (message === 'done')
+                resolveDone();
+        });
+        worker.once('error', error => {
+            clearTimeout(readyTimeout);
+            const failure = error instanceof Error ? error : new Error('junction swap worker failed');
+            rejectReady(failure);
+            rejectDone(failure);
         });
         let published = 0;
         try {
-            Atomics.wait(state, 1, 0, 5_000);
+            await ready;
             expect(Atomics.load(state, 1)).toBeGreaterThan(0);
             for (let attempt = 0; attempt < 500; attempt += 1) {
                 try {

package/dist/tests/structural/directory-fsync-is-single-source.test.js

@@ -0,0 +1,97 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Structural guard, same family as symlink-type-is-explicit.test.ts.
+//
+// fsync-ing a DIRECTORY file descriptor is a POSIX-only capability. On Windows
+// `fs.openSync(dir, 'r')` succeeds and the following `fs.fsyncSync(fd)` always
+// fails with EPERM — libuv's mapping of `FlushFileBuffers` on a directory
+// handle, which Win32 rejects categorically. That is not a durability failure
+// (NTFS journals the rename itself); the mechanism simply does not exist there.
+//
+// `atomic-file.fsyncDirSync` is where that decision lives, and it is deliberately
+// narrow: degrade ONLY on win32 + EPERM at the fsync, keep throwing everywhere
+// else. Re-implementing the open/fsync/close sequence inline re-creates the gap
+// without the exception, and it fails on Windows and nowhere else — invisible to
+// every local run, and behind CI's `--bail` it costs one full matrix round to
+// surface. That is exactly how `tests/core/model-policy/store.test.ts` broke the
+// Windows legs of the matrix while all four POSIX legs stayed green.
+//
+// So the rule is about the CALL, not about any one call site: a directory fd may
+// be flushed only through `fsyncDirSync`. This scans `tests` as well as `src` —
+// the regression that motivated it lived in a test double, and a guard that only
+// watched `src` would have reported a clean bill of health.
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const CLI = path_1.default.join(__dirname, '..', '..');
+const ROOTS = ['src', 'tests'];
+/** The single source of the policy: the one file allowed to flush a directory fd. */
+const SINGLE_SOURCE = path_1.default.join('src', 'core', 'atomic-file.ts');
+/** This guard itself, which must quote the forbidden shape to describe and test it. */
+const THIS_GUARD = path_1.default.join('tests', 'structural', 'directory-fsync-is-single-source.test.ts');
+function sourceFiles(dir) {
+    const out = [];
+    for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
+        const full = path_1.default.join(dir, entry.name);
+        if (entry.isDirectory())
+            out.push(...sourceFiles(full));
+        else if (entry.name.endsWith('.ts'))
+            out.push(full);
+    }
+    return out;
+}
+/** True when `lines[i]` opens something that reads as a directory. Deliberately
+ *  shallow — it recognises the shapes this codebase actually writes. Something
+ *  cleverer that defeats it should be calling `fsyncDirSync` instead. */
+function opensADirectory(line) {
+    const open = /\bfs\.openSync\s*\(\s*([^,]+),/.exec(line);
+    if (!open)
+        return false;
+    const target = open[1];
+    return /\bpath\.dirname\s*\(|\bdirname\s*\(/.test(target) || /\b(dir|Dir|root|Root)\b|Dir\b/.test(target);
+}
+/** True when the fd opened at `lines[i]` is flushed within the next few lines. */
+function flushedNearby(lines, i) {
+    return /\bfsyncSync\s*\(/.test(lines.slice(i, i + 4).join('\n'));
+}
+describe('directory fsync has exactly one implementation', () => {
+    it('no file outside atomic-file.ts opens a directory and flushes it inline', () => {
+        const offenders = [];
+        for (const root of ROOTS) {
+            for (const file of sourceFiles(path_1.default.join(CLI, root))) {
+                const relative = path_1.default.relative(CLI, file);
+                if (relative === SINGLE_SOURCE || relative === THIS_GUARD)
+                    continue;
+                const lines = fs_1.default.readFileSync(file, 'utf-8').split('\n');
+                lines.forEach((line, i) => {
+                    if (!opensADirectory(line) || !flushedNearby(lines, i))
+                        return;
+                    offenders.push(`${relative}:${i + 1}: ${line.trim()}`);
+                });
+            }
+        }
+        expect(offenders).toEqual([]);
+    });
+    it('the guard actually rejects the shape that broke the Windows matrix', () => {
+        // Without this, a guard whose regex silently stopped matching would read as
+        // a clean bill of health forever — the failure mode of every structural test.
+        const rejects = (lines, i) => opensADirectory(lines[i]) && flushedNearby(lines, i);
+        // Verbatim shape of the store.test.ts regression this guard exists to stop.
+        const regression = [
+            'fs.renameSync(temporary, file);',
+            "const parent = fs.openSync(path.dirname(file), 'r');",
+            'try { fs.fsyncSync(parent); } finally { fs.closeSync(parent); }',
+        ];
+        expect(rejects(regression, 1)).toBe(true);
+        // The sanctioned replacement carries no directory open at all.
+        expect(regression.map((_, i) => i).some(i => rejects(['fsyncDirSync(path.dirname(file));'], 0))).toBe(false);
+        // Flushing a FILE descriptor stays legal — that is a real, portable fsync.
+        const fileFlush = ["const fd = fs.openSync(temporary, 'wx', 0o600);", 'fs.fsyncSync(fd);'];
+        expect(rejects(fileFlush, 0)).toBe(false);
+        // Opening a directory without flushing it (readdir-style handles) stays legal.
+        const openOnly = ["const parent = fs.openSync(path.dirname(file), 'r');", 'fs.closeSync(parent);'];
+        expect(rejects(openOnly, 0)).toBe(false);
+    });
+});

package/dist/tests/structural/native-release-artifacts.test.js

@@ -35,4 +35,18 @@ describe('native release artifacts', () => {
         expect(gitignore).toContain('cli/native-artifacts/');
         expect(tracked).toBe('');
     });
+    it('builds the fault-injection addon before every Jest suite without publishing it', () => {
+        const pkg = JSON.parse(fs_1.default.readFileSync(path_1.default.join(CLI_ROOT, 'package.json'), 'utf8'));
+        expect(pkg.scripts['native:test-build']).toContain('secure_fs_test');
+        for (const name of ['ci.yml', 'release.yml']) {
+            const workflow = fs_1.default.readFileSync(path_1.default.join(REPO_ROOT, '.github', 'workflows', name), 'utf8');
+            const testBuild = workflow.indexOf('run: npm run native:test-build');
+            const jest = workflow.indexOf('run: npx jest --runInBand --bail');
+            expect(testBuild).toBeGreaterThanOrEqual(0);
+            expect(testBuild).toBeLessThan(jest);
+            expect(workflow).toContain("'native/build/Release', 'secure_fs_test.node'");
+            expect(workflow).not.toContain('path: cli/prebuilds/${{ matrix.target }}/secure_fs_test.node');
+            expect(workflow).not.toContain('secure_fs_test.node\n');
+        }
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "9.8.0",
+  "version": "9.9.0",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"
@@ -18,7 +18,8 @@
     "doc": "docs"
   },
   "scripts": {
-    "native:build": "node-gyp rebuild --directory native && node scripts/package-native.js",
+    "native:build": "node-gyp configure --directory native && node-gyp build --directory native -- secure_fs && node scripts/package-native.js",
+    "native:test-build": "node-gyp configure --directory native && node-gyp build --directory native -- secure_fs_test",
     "native:package-check": "node scripts/assert-native-package.js",
     "build": "tsc && chmod +x dist/src/index.js",
     "typecheck": "tsc --noEmit",