agentic-workflow-manager 9.9.0 → 9.10.1

package/dist/src/commands/model-policy/index.js

@@ -6,6 +6,7 @@ const providers_1 = require("../../providers");
 const store_1 = require("../../core/model-policy/store");
 const validate_1 = require("../../core/model-policy/validate");
 const capabilities_1 = require("../../core/model-policy/capabilities");
+const digest_1 = require("../../core/model-policy/digest");
 const roles = ['implementer', 'specification-reviewer', 'code-quality-reviewer', 'final-reviewer', 'architecture', 'track-a-qa', 'track-b-qa', 'controller', 'documentation', 'retro', 'finishing'];
 const implementerProfiles = ['mechanical', 'integration', 'judgment'];
 const contract = { schema: 'routing-protocol/v1', supportedPlanSchemas: ['compact-slices/v1', 'compact-slices/v2'], roles, implementerProfiles, limits: { maxFileBytes: validate_1.MAX_POLICY_BYTES, maxMappings: validate_1.MAX_MAPPINGS, maxIdentifierChars: 128, maxDiagnostics: 20, maxDiagnosticChars: 4096 } };
@@ -20,9 +21,21 @@ function registerModelPolicyCommand(program, deps = {}) {
     const read = deps.readEffectivePolicy ?? store_1.readEffectivePolicy;
     const approveReceipt = deps.approveCapabilities ?? capabilities_1.approveCapabilities;
     const readReceipt = deps.readCapabilities ?? capabilities_1.readCapabilities;
+    const digest = deps.candidateDigest ?? digest_1.candidateDigest;
     const command = program.command('model-policy').description('inspect and explicitly approve portable routing policy');
     command.command('contract').option('--cwd <path>').option('--json').action((options) => { if (options.cwd !== undefined)
         text(options.cwd, '--cwd'); output({ ...contract, protocolDigest }, options.json === true); });
+    // Approval demands --expected-digest so that it stays an explicit operator
+    // act. Without a way to observe the digest first, that safeguard blocked the
+    // legitimate path instead of gating it, and the only way through was to
+    // reimplement canonicalisation outside the CLI — the second parser the
+    // admission contract forbids. This discloses the digest and approves nothing.
+    command.command('digest').description('compute the canonical digest of a candidate policy or capability receipt without approving it').requiredOption('--file <path>').option('--cwd <path>').option('--json').action((options) => {
+        text(options.file, '--file');
+        if (options.cwd !== undefined)
+            text(options.cwd, '--cwd');
+        output(digest({ file: options.file, cwd: options.cwd ?? process.cwd() }), options.json === true);
+    });
     command.command('approve').requiredOption('--file <path>').requiredOption('--scope <scope>').requiredOption('--expected-digest <sha>').option('--replace-digest <sha>').option('--cwd <path>').option('--json').action((options) => {
         text(options.file, '--file');
         text(options.scope, '--scope');
@@ -37,7 +50,15 @@ function registerModelPolicyCommand(program, deps = {}) {
         const policy = approve({ file: options.file, scope: options.scope, cwd: options.cwd ?? process.cwd(), expectedDigest: options.expectedDigest, replaceDigest: options.replaceDigest });
         output({ state: 'approved', policy }, options.json === true);
     });
-    command.command('capabilities approve').requiredOption('--file <path>').requiredOption('--expected-digest <sha>').option('--replace-digest <sha>').option('--cwd <path>').option('--json').action((options) => {
+    // `command('capabilities approve')` registered ONE command named
+    // `capabilities` with a required positional `<approve>`, so Commander called
+    // the action as (positional, options, command) and the handler's first
+    // parameter — read as `options` — was the string 'approve'. Every invocation
+    // therefore died on `--file requires a non-empty value`, and the path could
+    // never approve anything. A real subcommand group keeps the invocation
+    // spelling identical and gives the action the options object it expects.
+    const capabilities = command.command('capabilities').description('inspect and explicitly approve runtime capability attestations');
+    capabilities.command('approve').requiredOption('--file <path>').requiredOption('--expected-digest <sha>').option('--replace-digest <sha>').option('--cwd <path>').option('--json').action((options) => {
         text(options.file, '--file');
         text(options.expectedDigest, '--expected-digest');
         if (options.replaceDigest !== undefined)

package/dist/src/commands/plan/index.js

@@ -183,10 +183,39 @@ function registerPlanCommand(program, deps = { validatePlanFile: validate_1.vali
         if (!roles.includes(options.role))
             throw new Error('--role is invalid');
         const runtime = (0, capabilities_1.validateRuntimeKey)({ target: options.provider, kind: options.runtimeKind, version: options.runtimeVersion, accountScopeDigest: options.accountScopeDigest });
-        const result = report.schema === 'compact-slices/v1' && !options.optInV1 ? (0, resolve_1.resolveDispatch)({ plan: report, role: options.role, policy: undefined, capabilities: undefined, runtime, now: new Date(), optInV1: false }) : (() => { const policy = (deps.readEffectivePolicy ?? store_2.readEffectivePolicy)(cwd); const capabilities = (deps.readCapabilities ?? capabilities_1.readCapabilities)(runtime, new Date()); if (!options.lineage)
-            return (0, resolve_1.resolveDispatch)({ plan: report, role: options.role, sliceId: options.slice, policy: policy.state === 'approved' ? policy.policy : undefined, capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined, runtime, now: new Date(), optInV1: options.optInV1 === true }); const state = journalObservation(cwd).journalState; const lineage = state.implementationLineages.find(candidate => candidate.id === options.lineage); const next = (0, journal_1.resolveLineageEscalation)(state, options.lineage, lineage.initialProfile); const resolved = (0, resolve_1.resolveSelection)({ role: 'implementer', requestedProfile: next.profile, policy: policy.state === 'approved' ? policy.policy : undefined, capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined, runtime, now: new Date() }); if (resolved.state === 'blocked')
-            return resolved; const highRequiresFull = next.effort !== 'high' || (policy.state === 'approved' && (() => { const full = policy.policy.content.mappings.find(row => row.target === runtime.target && row.runtimeKind === runtime.kind)?.fullCapability; return full?.selector.kind === resolved.selection.selector.kind && full.selector.id === resolved.selection.selector.id && full.effort.kind === 'explicit' && full.effort.value === 'high'; })()); if (resolved.selection.effort.kind !== 'explicit' || resolved.selection.effort.value !== next.effort || !highRequiresFull)
-            return { state: 'blocked', diagnostics: [{ code: 'ROUTING_ESCALATION_EFFORT_UNAVAILABLE', message: 'The approved selected effort does not match the next lineage escalation.' }] }; return { ...resolved, envelope: { schema: 'routing-envelope/v1', runtime, role: 'implementer', planDigest: report.planDigest, executionDigest: report.executionDigest, sliceId: lineage.sliceId, requestedProfile: lineage.initialProfile, effectiveProfile: next.profile, resolved: resolved.selection, policyDigest: resolved.policyDigest, capabilityDigest: resolved.capabilityDigest, outcome: resolved.outcome, unavailableEvidence: resolved.unavailableEvidence }, custodyHandoff: { kind: 'routing-reserve', obligationId: lineage.obligationId, lineageId: lineage.id } }; })();
+        const result = report.schema === 'compact-slices/v1' && !options.optInV1 ? (0, resolve_1.resolveDispatch)({ plan: report, role: options.role, policy: undefined, capabilities: undefined, runtime, now: new Date(), optInV1: false }) : (() => {
+            const policy = (deps.readEffectivePolicy ?? store_2.readEffectivePolicy)(cwd);
+            const capabilities = (deps.readCapabilities ?? capabilities_1.readCapabilities)(runtime, new Date());
+            if (!options.lineage) {
+                const first = (0, resolve_1.resolveDispatch)({ plan: report, role: options.role, sliceId: options.slice, policy: policy.state === 'approved' ? policy.policy : undefined, capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined, runtime, now: new Date(), optInV1: options.optInV1 === true });
+                // The consumer forwards THIS envelope to `job routing-reserve`, which
+                // is what creates the lineage the --lineage escalation path below
+                // then reads. Emitting it only there made the first attempt of any
+                // lineage unreservable: envelope <= lineage <= reserve <= envelope.
+                // Every field comes from values already in hand, so the CLI stays the
+                // sole author and the consumer never assembles a protocol document.
+                // No custodyHandoff here on purpose: the obligation and lineage ids
+                // are the caller's to choose on a first attempt, and inventing them
+                // would put identity the CLI cannot know into custody.
+                if (first.state !== 'resolved' || report.schema !== 'compact-slices/v2' || report.executionDigest === undefined)
+                    return first;
+                const slice = report.manifest.slices.find((candidate) => candidate.id === options.slice);
+                const requestedProfile = options.role === 'implementer' ? slice?.implementerProfile : 'full';
+                if (requestedProfile === undefined)
+                    return first;
+                return { ...first, envelope: { schema: 'routing-envelope/v1', runtime, role: options.role, planDigest: report.planDigest, executionDigest: report.executionDigest, ...(options.slice === undefined ? {} : { sliceId: options.slice }), requestedProfile, effectiveProfile: first.effectiveProfile, resolved: first.selection, policyDigest: first.policyDigest, capabilityDigest: first.capabilityDigest, outcome: first.outcome, unavailableEvidence: first.unavailableEvidence } };
+            }
+            const state = journalObservation(cwd).journalState;
+            const lineage = state.implementationLineages.find(candidate => candidate.id === options.lineage);
+            const next = (0, journal_1.resolveLineageEscalation)(state, options.lineage, lineage.initialProfile);
+            const resolved = (0, resolve_1.resolveSelection)({ role: 'implementer', requestedProfile: next.profile, policy: policy.state === 'approved' ? policy.policy : undefined, capabilities: capabilities.state === 'current' ? capabilities.receipt : undefined, runtime, now: new Date() });
+            if (resolved.state === 'blocked')
+                return resolved;
+            const highRequiresFull = next.effort !== 'high' || (policy.state === 'approved' && (() => { const full = policy.policy.content.mappings.find(row => row.target === runtime.target && row.runtimeKind === runtime.kind)?.fullCapability; return full?.selector.kind === resolved.selection.selector.kind && full.selector.id === resolved.selection.selector.id && full.effort.kind === 'explicit' && full.effort.value === 'high'; })());
+            if (resolved.selection.effort.kind !== 'explicit' || resolved.selection.effort.value !== next.effort || !highRequiresFull)
+                return { state: 'blocked', diagnostics: [{ code: 'ROUTING_ESCALATION_EFFORT_UNAVAILABLE', message: 'The approved selected effort does not match the next lineage escalation.' }] };
+            return { ...resolved, envelope: { schema: 'routing-envelope/v1', runtime, role: 'implementer', planDigest: report.planDigest, executionDigest: report.executionDigest, sliceId: lineage.sliceId, requestedProfile: lineage.initialProfile, effectiveProfile: next.profile, resolved: resolved.selection, policyDigest: resolved.policyDigest, capabilityDigest: resolved.capabilityDigest, outcome: resolved.outcome, unavailableEvidence: resolved.unavailableEvidence }, custodyHandoff: { kind: 'routing-reserve', obligationId: lineage.obligationId, lineageId: lineage.id } };
+        })();
         process.stdout.write(options.json ? `${JSON.stringify(result)}\n` : `Plan routing: ${result.state}\n`);
         if (result.state === 'blocked')
             process.exitCode = 2;

package/dist/src/commands/watch/supervisor.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Supervisor = exports.DEFAULT_SUPERVISOR_CONFIG = void 0;
+exports.Supervisor = exports.MAX_SENSOR_DEFERRALS = exports.DEFAULT_SUPERVISOR_CONFIG = void 0;
 exports.runSupervisorLoop = runSupervisorLoop;
 const store_1 = require("../../core/journal/store");
 const fingerprint_1 = require("../../core/journal/fingerprint");
@@ -120,6 +120,15 @@ exports.DEFAULT_SUPERVISOR_CONFIG = {
     jobStallObservationMs: 5 * 60000, // R3.5 default: mismo orden de magnitud que heartbeatTimeoutMs, concern independiente
     maxParallelTracks: 1, // overridden en tiempo de ejecución con loadDefaultParallelism() (watch/index.ts)
 };
+// 'frozen' (R5.2/R6.3, Task 10): SOLO puede ocurrir en el journal de un
+// TRACK individual (nunca en el del plan) — el track terminó, con las 6
+// observaciones demostrables (cero jobs vivos, gate local verde, worktree
+// limpio, generación propia terminada con identidad confirmada), de
+// atender un `track-freeze-request` pedido por el supervisor del plan.
+/** How many consecutive ticks an inconclusive sensor verdict may defer dispatch
+ *  before the supervisor says so out loud. Small: the deferral covers a verdict
+ *  still settling, not one that never will. */
+exports.MAX_SENSOR_DEFERRALS = 3;
 const LIVE = ['received', 'spawn-intent', 'claimed', 'running', 'cancel-requested'];
 function recoveryWhitelistBlocker(state) {
     if (state.cycle.status === 'BLOCKED')
@@ -149,6 +158,10 @@ class Supervisor {
     dispatchAdmission;
     backoff = new generations_1.Backoff();
     relaunchNotBefore = 0;
+    /** Consecutive ticks deferred on an inconclusive sensor verdict. Bounded:
+     *  the deferral exists for a verdict that is still settling, and a verdict
+     *  that never settles must become visible rather than loop forever. */
+    sensorDeferrals = 0;
     lastActivity = null;
     lastGenerationToken = null;
     trackRuntime;
@@ -226,12 +239,30 @@ class Supervisor {
                 // the already-started controller is still settling. It never
                 // authorizes dispatch; retry the read-only admission next tick
                 // instead of permanently custodying a healthy cycle.
+                //
+                // Bounded, because the verdict is not always transient: a
+                // registry whose sensors are all disabled reports
+                // `not-certified` forever. Unbounded, this returned before
+                // `consumePendingRequests` below, so the supervisor ticked
+                // indefinitely applying nothing and writing nothing — no event,
+                // no state change, no exit. Refusing to progress is correct
+                // here; refusing invisibly is not. Consuming requests cannot be
+                // hoisted above this gate to compensate: applying a job-request
+                // creates a Job that runnerTick can start, which is the dispatch
+                // this admission exists to authorize.
                 if (admission.planState === 'valid' && admission.currentness === 'current'
-                    && admission.sensors === 'not-certified' && admission.journal === 'not-required')
-                    return 'continue';
+                    && admission.sensors === 'not-certified' && admission.journal === 'not-required') {
+                    this.sensorDeferrals += 1;
+                    if (this.sensorDeferrals <= exports.MAX_SENSOR_DEFERRALS)
+                        return 'continue';
+                    (0, generations_1.enterCustody)(this.repoRoot, this.branch, `veredicto de sensores no concluyente tras ${this.sensorDeferrals} ticks: ${admission.diagnostics.map(diagnostic => `${diagnostic.code}: ${diagnostic.message}`).join('; ')}`);
+                    return 'custody';
+                }
                 (0, generations_1.enterCustody)(this.repoRoot, this.branch, `admisión compacta desatendida bloqueada antes de dispatch: ${admission.diagnostics.map(diagnostic => `${diagnostic.code}: ${diagnostic.message}`).join('; ')}`);
                 return 'custody';
             }
+            // The verdict settled, which is exactly what the deferral waited for.
+            this.sensorDeferrals = 0;
         }
         let recoveryResumeAction;
         // Schema-2 custody is reconciled before any controller launch.  This is

package/dist/src/core/model-policy/digest.js

@@ -0,0 +1,35 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.candidateDigest = candidateDigest;
+const path_1 = __importDefault(require("path"));
+const json_1 = require("../plan/json");
+const capabilities_1 = require("./capabilities");
+const canonical_1 = require("./canonical");
+const store_1 = require("./store");
+const validate_1 = require("./validate");
+const CONTROL = /[\u0000-\u001f\u007f-\u009f]/;
+function assertPath(value, label) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > 4096 || CONTROL.test(value))
+        throw new Error(`${label} must be a bounded path without control characters`);
+}
+function candidateDigest(input) {
+    if (!input || typeof input !== 'object')
+        throw new Error('digest input is required');
+    assertPath(input.file, 'file');
+    assertPath(input.cwd, 'cwd');
+    const raw = (0, store_1.readBoundedCandidate)(path_1.default.resolve(path_1.default.resolve(input.cwd), input.file));
+    if (raw === null)
+        throw new Error('digest candidate is absent');
+    const parsed = (0, json_1.parseJsonNoDuplicate)(raw);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        throw new Error('digest candidate must be a JSON object');
+    const schema = parsed.schema;
+    if (schema === 'model-policy/v1')
+        return { schema, digest: (0, canonical_1.canonicalPolicyDigest)((0, validate_1.validatePolicyContent)(parsed)) };
+    if (schema === 'routing-capabilities/v1')
+        return { schema, digest: (0, capabilities_1.capabilityReceiptDigest)((0, capabilities_1.validateCapabilityReceipt)(parsed)) };
+    throw new Error('digest candidate must declare schema model-policy/v1 or routing-capabilities/v1');
+}

package/dist/src/core/model-policy/resolve.js

@@ -79,33 +79,72 @@ function resolveSelection(input) {
     let selection = wanted;
     const unavailableEvidence = [];
     let outcome = 'native';
-    const canDegrade = (capability, allowed, code) => {
-        const state = capabilities.capabilities[capability];
+    // Surrendering the model means the runtime picks, so the only safe landing
+    // place is the attested runtime default, and it must be the approved full
+    // capability. Surrendering the EFFORT is a narrower loss and is handled
+    // separately below: collapsing to fullCapability there would throw away a
+    // model override the runtime demonstrably honours.
+    const degradeModel = () => {
+        const state = capabilities.capabilities.modelOverride;
         if (state === 'supported')
             return undefined;
         if (state === 'unverified')
-            return blocked(code, `${capability} is unverified.`);
-        if (!allowed || !capabilities.runtimeDefaultSelection || !equal(capabilities.runtimeDefaultSelection, mapping.fullCapability))
-            return blocked(code, `${capability} is unavailable and no matching approved full default is attested.`);
+            return blocked('ROUTING_MODEL_OVERRIDE_UNAVAILABLE', 'modelOverride is unverified.');
+        if (!mapping.degradation.allowMissingModelOverride || !capabilities.runtimeDefaultSelection || !equal(capabilities.runtimeDefaultSelection, mapping.fullCapability))
+            return blocked('ROUTING_MODEL_OVERRIDE_UNAVAILABLE', 'modelOverride is unavailable and no matching approved full default is attested.');
         selection = mapping.fullCapability;
         outcome = 'degraded';
-        unavailableEvidence.push(capability);
+        unavailableEvidence.push('modelOverride');
         return undefined;
     };
-    const model = canDegrade('modelOverride', mapping.degradation.allowMissingModelOverride, 'ROUTING_MODEL_OVERRIDE_UNAVAILABLE');
+    // Degrading effort surrenders the effort component ONLY, keeping the routed
+    // model. On a runtime where the model can be overridden but reasoning effort
+    // cannot — effort belongs to the agent definition, not the invocation — the
+    // alternative was to route every profile to the full-capability model, so a
+    // mechanical slice would quietly run the judgment model while the diagnostic
+    // spoke only of effort. That is the silent defaulting the consumer reference
+    // forbids. The model at runtime-default effort must itself be attested.
+    const degradeEffort = () => {
+        const state = capabilities.capabilities.effortOverride;
+        if (state === 'supported')
+            return undefined;
+        if (state === 'unverified')
+            return blocked('ROUTING_EFFORT_OVERRIDE_UNAVAILABLE', 'effortOverride is unverified.');
+        if (!mapping.degradation.allowMissingEffortOverride)
+            return blocked('ROUTING_EFFORT_OVERRIDE_UNAVAILABLE', 'effortOverride is unavailable and the mapping does not allow degrading it.');
+        const degraded = { selector: selection.selector, effort: { kind: 'runtime-default' } };
+        if (!capabilities.runtimeDefaultSelection || !capabilities.availableSelections.some(candidate => equal(candidate, degraded)))
+            return blocked('ROUTING_EFFORT_OVERRIDE_UNAVAILABLE', 'effortOverride is unavailable and the routed model at runtime-default effort is not attested.');
+        selection = degraded;
+        outcome = 'degraded';
+        unavailableEvidence.push('effortOverride');
+        return undefined;
+    };
+    const model = degradeModel();
     if (model)
         return model;
-    if (!capabilities.availableSelections.some(candidate => equal(candidate, selection)))
-        return blocked('ROUTING_SELECTION_UNAVAILABLE', 'Approved selection is not currently available; no substitute is allowed.');
-    if (selection.effort.kind === 'runtime-default') {
-        if (!capabilities.runtimeDefaultSelection || !equal(capabilities.runtimeDefaultSelection, selection))
-            return blocked('ROUTING_SELECTION_UNAVAILABLE', 'Runtime-default selection is not explicitly attested.');
-    }
-    else {
-        const effort = canDegrade('effortOverride', mapping.degradation.allowMissingEffortOverride, 'ROUTING_EFFORT_OVERRIDE_UNAVAILABLE');
+    if (selection.effort.kind === 'explicit') {
+        const effort = degradeEffort();
         if (effort)
             return effort;
     }
+    // availableSelections is the receipt's attestation of what can actually be
+    // chosen, so it is checked on the FINAL selection, after any degradation
+    // rewrote it. Checking it first forced a runtime that cannot honour explicit
+    // effort to attest selections it could never run, purely to reach the
+    // degradation that would then discard them — the honest receipt was the one
+    // that failed.
+    if (!capabilities.availableSelections.some(candidate => equal(candidate, selection)))
+        return blocked('ROUTING_SELECTION_UNAVAILABLE', 'Approved selection is not currently available; no substitute is allowed.');
+    // A runtime-default effort is only meaningful if the receipt declares what the
+    // runtime default is. It need NOT equal this selection: requiring that made
+    // every per-profile selection unreachable on a runtime whose default model
+    // differs, even with modelOverride attested supported and the selection
+    // itself attested available. Attesting `haiku at runtime-default effort` is
+    // precisely the statement that the model may be overridden while effort is
+    // left alone.
+    if (selection.effort.kind === 'runtime-default' && !capabilities.runtimeDefaultSelection)
+        return blocked('ROUTING_SELECTION_UNAVAILABLE', 'Runtime-default selection is not explicitly attested.');
     if (capabilities.capabilities.observedModelEvidence !== 'supported') {
         if (!mapping.degradation.allowMissingObservedIdentity)
             return blocked('ROUTING_OBSERVED_IDENTITY_UNAVAILABLE', 'Observed model identity is required and unavailable.');

package/dist/src/core/model-policy/store.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.readBoundedCandidate = readBoundedCandidate;
 exports.readEffectivePolicy = readEffectivePolicy;
 exports.approvePolicyWithBoundary = approvePolicyWithBoundary;
 exports.approvePolicy = approvePolicy;
@@ -45,7 +46,13 @@ catch (error) {
     if (error.code !== 'ENOENT')
         throw error;
 } }
-function readBounded(file) {
+/**
+ * Bounded, symlink-refusing, identity-fenced read of a candidate or stored file.
+ * Exported so the read-only digest path observes a file under exactly the same
+ * constraints the approval path does, rather than growing a second reader that
+ * could drift from it.
+ */
+function readBoundedCandidate(file) {
     assertSafeParents(file);
     let inspected;
     try {
@@ -106,7 +113,7 @@ function readEffectivePolicy(cwd) {
     assertPath(cwd, 'cwd');
     const project = (0, paths_1.projectPolicyPath)(cwd);
     try {
-        const raw = readBounded(project);
+        const raw = readBoundedCandidate(project);
         if (raw !== null)
             return { state: 'approved', provenance: 'project', policy: parseApproved(raw) };
     }
@@ -115,7 +122,7 @@ function readEffectivePolicy(cwd) {
     }
     const user = (0, paths_1.userPolicyPath)();
     try {
-        const raw = readBounded(user);
+        const raw = readBoundedCandidate(user);
         if (raw === null)
             return { state: 'absent' };
         return { state: 'approved', provenance: 'user', policy: parseApproved(raw) };
@@ -134,7 +141,7 @@ function approvePolicyWithBoundary(input, boundary) {
     if (input.replaceDigest !== undefined)
         (0, validate_1.assertDigest)(input.replaceDigest, 'replaceDigest');
     const cwd = path_1.default.resolve(input.cwd);
-    const candidateRaw = readBounded(path_1.default.resolve(cwd, input.file));
+    const candidateRaw = readBoundedCandidate(path_1.default.resolve(cwd, input.file));
     if (candidateRaw === null)
         throw new Error('policy candidate is absent');
     const content = (0, validate_1.validatePolicyContent)((0, json_1.parseJsonNoDuplicate)(candidateRaw));
@@ -147,7 +154,7 @@ function approvePolicyWithBoundary(input, boundary) {
     assertRegularOrAbsent(target);
     const unlock = lock(target);
     try {
-        const existingRaw = readBounded(target);
+        const existingRaw = readBoundedCandidate(target);
         const existing = existingRaw === null ? null : parseApproved(existingRaw);
         if (existing === null && input.replaceDigest !== undefined)
             throw new Error('replacement requires an existing predecessor');

package/dist/tests/commands/model-policy/index.test.js

@@ -47,11 +47,71 @@ describe('model-policy command', () => {
         expect(JSON.parse(String(out.mock.calls[0][0]))).toMatchObject({ policy: { state: 'absent' }, capability: { state: 'stale' } });
         expect(process.exitCode).toBe(2);
     });
+    it('discloses the canonical digest through a read-only subcommand', async () => {
+        const candidateDigest = jest.fn(() => ({ schema: 'model-policy/v1', digest: 'b'.repeat(64) }));
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, model_policy_1.registerModelPolicyCommand)(program, { candidateDigest });
+        await program.parseAsync(['node', 'awm', 'model-policy', 'digest', '--file', 'policy.json', '--cwd', 'fixture-root', '--json']);
+        expect(candidateDigest).toHaveBeenCalledWith({ file: 'policy.json', cwd: 'fixture-root' });
+        expect(JSON.parse(String(out.mock.calls[0][0]))).toEqual({ schema: 'model-policy/v1', digest: 'b'.repeat(64) });
+    });
+    it('takes no approval arguments on digest, so it cannot approve by accident', async () => {
+        const candidateDigest = jest.fn(() => ({ schema: 'model-policy/v1', digest: 'b'.repeat(64) }));
+        const approvePolicy = jest.fn();
+        const approveCapabilities = jest.fn();
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, model_policy_1.registerModelPolicyCommand)(program, { candidateDigest, approvePolicy: approvePolicy, approveCapabilities: approveCapabilities });
+        await expect(program.parseAsync(['node', 'awm', 'model-policy', 'digest', '--file', 'policy.json', '--expected-digest', 'a'.repeat(64)])).rejects.toThrow();
+        expect(approvePolicy).not.toHaveBeenCalled();
+        expect(approveCapabilities).not.toHaveBeenCalled();
+    });
+    it('rejects a missing or malformed --file on digest instead of digesting the flag', async () => {
+        const candidateDigest = jest.fn(() => ({ schema: 'model-policy/v1', digest: 'b'.repeat(64) }));
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, model_policy_1.registerModelPolicyCommand)(program, { candidateDigest });
+        await expect(program.parseAsync(['node', 'awm', 'model-policy', 'digest'])).rejects.toThrow();
+        await expect(program.parseAsync(['node', 'awm', 'model-policy', 'digest', '--file', '--cwd'])).rejects.toThrow(/requires a non-empty value/);
+        expect(candidateDigest).not.toHaveBeenCalled();
+    });
+    // This positive case is what the negative guard below could never establish.
+    // While `capabilities approve` was registered as one command with a
+    // positional `<approve>`, Commander handed the action (positional, options),
+    // so `--file` read as undefined and EVERY invocation — well-formed ones
+    // included — died on 'requires a non-empty value'. A suite that only
+    // asserted that rejection was green against a command that could not
+    // approve at all.
+    it('reaches the capability approval with parsed options, not a positional', async () => {
+        const approveCapabilities = jest.fn(() => ({ schema: 'routing-capabilities/v1' }));
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, model_policy_1.registerModelPolicyCommand)(program, { approveCapabilities: approveCapabilities });
+        await program.parseAsync(['node', 'awm', 'model-policy', 'capabilities', 'approve', '--file', 'receipt.json', '--expected-digest', 'a'.repeat(64), '--cwd', 'fixture-root', '--json']);
+        expect(approveCapabilities).toHaveBeenCalledWith({ file: 'receipt.json', cwd: 'fixture-root', expectedDigest: 'a'.repeat(64), replaceDigest: undefined });
+        expect(JSON.parse(String(out.mock.calls[0][0]))).toMatchObject({ state: 'approved' });
+    });
+    it('rejects an unknown capabilities subcommand instead of treating it as an approval', async () => {
+        const approveCapabilities = jest.fn();
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, model_policy_1.registerModelPolicyCommand)(program, { approveCapabilities: approveCapabilities });
+        await expect(program.parseAsync(['node', 'awm', 'model-policy', 'capabilities', 'revoke', '--file', 'receipt.json', '--expected-digest', 'a'.repeat(64)])).rejects.toThrow();
+        expect(approveCapabilities).not.toHaveBeenCalled();
+    });
     it('rejects an empty replacement digest for capability approval at the command boundary', async () => {
+        const approveCapabilities = jest.fn();
         const program = new commander_1.Command();
         program.exitOverride();
         program.configureOutput({ writeErr: () => undefined });
-        (0, model_policy_1.registerModelPolicyCommand)(program, { approveCapabilities: jest.fn() });
+        (0, model_policy_1.registerModelPolicyCommand)(program, { approveCapabilities: approveCapabilities });
         await expect(program.parseAsync(['node', 'awm', 'model-policy', 'capabilities', 'approve', '--file', 'receipt.json', '--expected-digest', 'a'.repeat(64), '--replace-digest', ''])).rejects.toThrow(/requires a non-empty value/);
+        expect(approveCapabilities).not.toHaveBeenCalled();
     });
 });

package/dist/tests/commands/plan/index.test.js

@@ -13,12 +13,20 @@ const plan_1 = require("../../../src/commands/plan");
 const init_1 = require("../../../src/commands/watch/init");
 const providers_1 = require("../../../src/providers");
 const registry_1 = require("../../../src/core/renderers/registry");
+const canonical_1 = require("../../../src/core/model-policy/canonical");
+const capabilities_1 = require("../../../src/core/model-policy/capabilities");
+const journal_1 = require("../../../src/core/model-policy/journal");
+const types_1 = require("../../../src/core/journal/types");
 const stdoutWrite = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
 const repositoryRoot = path_1.default.resolve(__dirname, '../../../..');
 const approved = (0, validate_1.validatePlanFile)('docs/plans/2026-09-14-compact-only-bootstrap-plan.md', repositoryRoot);
 if (approved.state !== 'valid')
     throw new Error(`tracked bootstrap plan must validate before command tests: ${approved.state}`);
 const valid = approved;
+const approvedV2 = (0, validate_1.validatePlanFile)('valid.md', path_1.default.join(__dirname, '../../core/plan/fixtures/compact-slices-v2'));
+if (approvedV2.state !== 'valid')
+    throw new Error(`v2 fixture must validate before command tests: ${approvedV2.state}`);
+const v2Valid = approvedV2;
 const invalid = {
     state: 'invalid', diagnostics: [{ code: 'PLAN_MARKERS', message: 'compact markers must occur once in order' }],
 };
@@ -60,6 +68,56 @@ describe('plan validate Commander wiring', () => {
         expect(policy).not.toHaveBeenCalled();
         expect(capabilities).not.toHaveBeenCalled();
     });
+    // The consumer reference says: call `plan resolve` for the exact role and
+    // local slice, then send ITS frozen envelope to `job routing-reserve`. The
+    // envelope was only ever built on the --lineage branch, which resolves the
+    // lineage out of journal state — and lineages are created by
+    // reserveRoutingAttempt, i.e. by routing-reserve itself. envelope <= lineage
+    // <= reserve <= envelope, so the first attempt of any lineage could never be
+    // reserved. This test goes from resolve output to a reserved attempt with no
+    // hand-built envelope literal, which is the only shape that can catch it:
+    // tests/commands/job/routing.test.ts passes a literal and so starts one step
+    // past the gap.
+    it('emits a reservable envelope on a first v2 attempt, closing the resolve to reserve path', async () => {
+        // A genuinely validated report: the resolver rejects any object that did
+        // not come out of validatePlanFile, so a spread-and-relabel fixture
+        // cannot reach this path at all.
+        const sliceId = 'S1';
+        const sel = { selector: { kind: 'model', id: 'gpt-5.6-luna' }, effort: { kind: 'explicit', value: 'medium' } };
+        const full = { selector: { kind: 'model', id: 'gpt-5.6-sol' }, effort: { kind: 'explicit', value: 'high' } };
+        const sha = 'a'.repeat(64);
+        const content = { schema: 'model-policy/v1', mappings: [{ target: 'codex', runtimeKind: 'native', profiles: { mechanical: sel, integration: sel, judgment: sel }, fullCapability: full, degradation: { allowMissingModelOverride: false, allowMissingEffortOverride: false, allowMissingObservedIdentity: false } }], implementationBudget: { maxAttempts: 3, escalation: ['mechanical', 'integration', 'judgment'], judgmentEfforts: ['medium', 'high'] } };
+        const readEffectivePolicy = () => ({ state: 'approved', provenance: 'user', policy: { schema: 'approved-model-policy/v1', content, contentDigest: (0, canonical_1.canonicalPolicyDigest)(content), approval: { approvedAt: '2026-09-19T00:00:00.000Z', approvalId: 'a1' }, lineage: { previousDigest: null } } });
+        const receipt = {
+            schema: 'routing-capabilities/v1',
+            runtime: { target: 'codex', kind: 'native', version: '1.0.0', accountScopeDigest: sha },
+            recordedAt: new Date(Date.now() - 60_000).toISOString(), expiresAt: new Date(Date.now() + 6 * 3600_000).toISOString(),
+            capabilities: { artifactDelivery: 'supported', interactiveExecution: 'supported', unattendedController: 'supported', nativeSubagents: 'supported', modelOverride: 'supported', effortOverride: 'supported', observedModelEvidence: 'supported', durableResume: 'unverified' },
+            availableSelections: [sel, full], runtimeDefaultSelection: full,
+            evidence: ['modelOverride', 'effortOverride', 'observedModelEvidence', 'nativeSubagents', 'artifactDelivery', 'interactiveExecution', 'unattendedController'].map(capability => ({ capability, kind: 'native-control', receiptDigest: 'b'.repeat(64) })),
+            approval: { approvalId: 'r1', snapshotDigest: 'c'.repeat(64) },
+        };
+        const readCapabilities = () => ({ state: 'current', receipt, digest: (0, capabilities_1.capabilityReceiptDigest)(receipt) });
+        const program = new commander_1.Command();
+        program.exitOverride();
+        program.configureOutput({ writeErr: () => undefined });
+        (0, plan_1.registerPlanCommand)(program, { validatePlanFile: () => v2Valid, readEffectivePolicy: readEffectivePolicy, readCapabilities: readCapabilities });
+        await program.parseAsync(['node', 'awm', 'plan', 'resolve', 'plans/r4.md', '--provider', 'codex', '--runtime-kind', 'native', '--runtime-version', '1.0.0', '--account-scope-digest', sha, '--role', 'implementer', '--slice', sliceId, '--cwd', repositoryRoot, '--json']);
+        const emitted = JSON.parse(String(stdoutWrite.mock.calls[stdoutWrite.mock.calls.length - 1][0]));
+        expect(emitted.state).toBe('resolved');
+        expect(emitted.envelope).toBeDefined();
+        // The CLI must be the sole author: the envelope has to satisfy the same
+        // predicate routing-reserve applies, with nothing filled in by the caller.
+        expect((0, types_1.isRoutingEnvelope)(emitted.envelope)).toBe(true);
+        expect(emitted.envelope).toMatchObject({ schema: 'routing-envelope/v1', role: 'implementer', sliceId, requestedProfile: 'mechanical', effectiveProfile: 'mechanical', resolved: sel });
+        expect(emitted.envelope.planDigest).toBe(v2Valid.planDigest);
+        expect(emitted.envelope.executionDigest).toBe(v2Valid.executionDigest);
+        // The point of the whole thing: that envelope reserves a first attempt,
+        // which is what creates the lineage the escalation path later needs.
+        const reserved = (0, journal_1.reserveRoutingAttempt)((0, types_1.emptyState)('main'), { obligationId: 'o1', lineageId: 'l1', envelope: emitted.envelope, fingerprint: 'e'.repeat(64) }, '2026-09-19T00:00:00.000Z');
+        expect(reserved.attemptId).toEqual(expect.any(String));
+        expect(reserved.state.implementationLineages).toEqual([expect.objectContaining({ id: 'l1', sliceId, initialProfile: 'mechanical' })]);
+    });
     it('emits deterministic human output for a valid compact plan', async () => {
         await commandFor(valid).parseAsync(['node', 'awm', 'plan', 'validate', 'plans/r4.md']);
         expect(String(stdoutWrite.mock.calls[0][0])).toBe('Plan validation: valid "plans/r4.md" (compact-slices/v1; 1 slices; 5 requirements; complete ownership)\n');

package/dist/tests/commands/watch/supervisor-loop.test.js

@@ -390,6 +390,44 @@ describe('supervisor loop', () => {
         await expect(new supervisor_1.Supervisor(repo, 'main', cfg, spy, undefined, admitted).tick()).rejects.toThrow(/rama|branch/i);
         expect(calls).toBe(0);
     });
+    // The sensor deferral at the top of tick() covers a first inconclusive read
+    // while a controller settles, and returns 'continue' so a transient does not
+    // custody a healthy cycle. It returns BEFORE consumePendingRequests, and
+    // `sensors: 'not-certified'` is not always transient: it is the steady state
+    // of any registry whose sensors are all disabled, which the baseline registry
+    // documents about itself. Unbounded, the supervisor ticked forever applying
+    // nothing and writing nothing — no event, no state change, no exit. Observed
+    // against published 9.10.0: a routing-reserve and an unrelated
+    // controller-heartbeat both sat unconsumed for ~36 ticks with appliedRequests
+    // empty and the cycle still IN_PROGRESS.
+    test('an inconclusive sensor verdict defers dispatch a bounded number of ticks, then says so', async () => {
+        const repo = setupRepo();
+        initUnattendedFixture(repo);
+        (0, generations_1.beginGeneration)(repo, 'main');
+        const token = (0, generations_1.activeGeneration)((0, store_1.readJournal)(repo, 'main').state).token;
+        (0, request_1.requestJob)(repo, 'main', token, ['node', '-e', 'process.exit(0)'], [], '.');
+        // Exactly what `awm plan admit --require-current --verify-sensors` returns
+        // for that registry: valid plan, current contracts, sensors not certified.
+        // Every field matches the deferral condition.
+        const notCertified = async () => ({
+            state: 'blocked', planState: 'valid', executionMode: 'desatendido',
+            journal: 'not-required', currentness: 'current', sensors: 'not-certified',
+            diagnostics: [{ code: 'ADMISSION_SENSORS_BLOCKED', message: 'sensors not certified' }],
+        });
+        let spawned = 0;
+        const sup = new supervisor_1.Supervisor(repo, 'main', supervisor_1.DEFAULT_SUPERVISOR_CONFIG, () => { spawned += 1; }, undefined, notCertified);
+        for (let i = 0; i < supervisor_1.MAX_SENSOR_DEFERRALS; i += 1) {
+            expect(await sup.tick()).toBe('continue');
+            expect((0, store_1.readJournal)(repo, 'main').state.cycle.status).toBe('IN_PROGRESS');
+        }
+        // The verdict never settled, so the supervisor must stop pretending it might.
+        expect(await sup.tick()).toBe('custody');
+        const state = (0, store_1.readJournal)(repo, 'main').state;
+        expect(state.cycle.status).toBe('BLOCKED');
+        expect(state.cycle.blockedReason).toMatch(/sensor/i);
+        // Deferring dispatch was right throughout, and stays right.
+        expect(spawned).toBe(0);
+    });
     test('una admisión compacta bloqueada no lanza controlador ni wrappers', async () => {
         initUnattendedFixture(repo);
         const state = (0, store_1.readJournal)(repo, 'main').state;

package/dist/tests/core/model-policy/digest.test.js

@@ -0,0 +1,117 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const digest_1 = require("../../../src/core/model-policy/digest");
+const store_1 = require("../../../src/core/model-policy/store");
+const capabilities_1 = require("../../../src/core/model-policy/capabilities");
+const canonical_1 = require("../../../src/core/model-policy/canonical");
+const capabilities_2 = require("../../../src/core/model-policy/capabilities");
+const sha = 'a'.repeat(64);
+const policy = () => ({ schema: 'model-policy/v1', mappings: [{ target: 'codex', runtimeKind: 'native', profiles: {
+                mechanical: { selector: { kind: 'model', id: 'gpt-5.6-luna' }, effort: { kind: 'explicit', value: 'medium' } },
+                integration: { selector: { kind: 'model', id: 'gpt-5.6-terra' }, effort: { kind: 'explicit', value: 'medium' } },
+                judgment: { selector: { kind: 'model', id: 'gpt-5.6-sol' }, effort: { kind: 'explicit', value: 'medium' } },
+            }, fullCapability: { selector: { kind: 'model', id: 'gpt-5.6-sol' }, effort: { kind: 'explicit', value: 'high' } }, degradation: { allowMissingModelOverride: false, allowMissingEffortOverride: false, allowMissingObservedIdentity: false } }], implementationBudget: { maxAttempts: 3, escalation: ['mechanical', 'integration', 'judgment'], judgmentEfforts: ['medium', 'high'] } });
+const receipt = () => ({
+    schema: 'routing-capabilities/v1',
+    runtime: { target: 'codex', kind: 'native', version: '1.0.0', accountScopeDigest: sha },
+    recordedAt: '2026-09-17T00:00:00.000Z', expiresAt: '2026-09-18T00:00:00.000Z',
+    capabilities: { artifactDelivery: 'unverified', interactiveExecution: 'supported', unattendedController: 'supported', nativeSubagents: 'unverified', modelOverride: 'supported', effortOverride: 'supported', observedModelEvidence: 'supported', durableResume: 'unverified' },
+    availableSelections: [{ selector: { kind: 'model', id: 'full' }, effort: { kind: 'explicit', value: 'high' } }],
+    runtimeDefaultSelection: { selector: { kind: 'model', id: 'full' }, effort: { kind: 'explicit', value: 'high' } },
+    evidence: ['interactiveExecution', 'unattendedController', 'modelOverride', 'effortOverride', 'observedModelEvidence'].map(capability => ({ capability, kind: 'native-control', receiptDigest: sha })),
+    approval: { approvalId: 'approval-1', snapshotDigest: sha },
+});
+describe('candidateDigest', () => {
+    let cwd;
+    const home = process.env.HOME;
+    const awmHome = process.env.AWM_HOME;
+    beforeEach(() => { cwd = fs_1.default.mkdtempSync(path_1.default.join(fs_1.default.realpathSync(os_1.default.tmpdir()), 'awm-digest-')); process.env.HOME = cwd; process.env.AWM_HOME = path_1.default.join(cwd, '.awm'); });
+    afterEach(() => { fs_1.default.rmSync(cwd, { recursive: true, force: true }); if (home === undefined)
+        delete process.env.HOME;
+    else
+        process.env.HOME = home; if (awmHome === undefined)
+        delete process.env.AWM_HOME;
+    else
+        process.env.AWM_HOME = awmHome; });
+    const write = (name, value) => { const file = path_1.default.join(cwd, name); fs_1.default.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`); return name; };
+    it('emits the digest the policy approval path will demand, not a second opinion', () => {
+        const file = write('policy.json', policy());
+        expect((0, digest_1.candidateDigest)({ file, cwd })).toEqual({ schema: 'model-policy/v1', digest: (0, canonical_1.canonicalPolicyDigest)(policy()) });
+    });
+    it('emits the digest the capability approval path will demand', () => {
+        const file = write('receipt.json', receipt());
+        expect((0, digest_1.candidateDigest)({ file, cwd })).toEqual({ schema: 'routing-capabilities/v1', digest: (0, capabilities_2.capabilityReceiptDigest)(receipt()) });
+    });
+    it('is insensitive to key order and whitespace, because the digest is over the canonical form', () => {
+        const content = policy();
+        const reordered = { implementationBudget: content.implementationBudget, mappings: content.mappings, schema: content.schema };
+        fs_1.default.writeFileSync(path_1.default.join(cwd, 'a.json'), JSON.stringify(content));
+        fs_1.default.writeFileSync(path_1.default.join(cwd, 'b.json'), JSON.stringify(reordered, null, 4));
+        expect((0, digest_1.candidateDigest)({ file: 'a.json', cwd }).digest).toBe((0, digest_1.candidateDigest)({ file: 'b.json', cwd }).digest);
+    });
+    it('refuses a document whose declared schema it does not own, instead of guessing', () => {
+        const file = write('other.json', { schema: 'approved-model-policy/v1' });
+        expect(() => (0, digest_1.candidateDigest)({ file, cwd })).toThrow(/schema model-policy\/v1 or routing-capabilities\/v1/);
+    });
+    it('refuses an invalid document rather than emitting a digest approval would reject', () => {
+        const broken = policy();
+        delete broken.implementationBudget;
+        const file = write('broken.json', broken);
+        expect(() => (0, digest_1.candidateDigest)({ file, cwd })).toThrow();
+    });
+    it('reports an absent candidate loudly', () => {
+        expect(() => (0, digest_1.candidateDigest)({ file: 'missing.json', cwd })).toThrow(/absent/);
+    });
+    it('refuses a symlinked candidate, matching the approval path', () => {
+        write('policy.json', policy());
+        fs_1.default.symlinkSync(path_1.default.join(cwd, 'policy.json'), path_1.default.join(cwd, 'link.json'));
+        expect(() => (0, digest_1.candidateDigest)({ file: 'link.json', cwd })).toThrow(/unsafe/);
+    });
+    it('rejects malformed input instead of returning undefined', () => {
+        expect(() => (0, digest_1.candidateDigest)(undefined)).toThrow(/digest input is required/);
+        expect(() => (0, digest_1.candidateDigest)({ file: '', cwd })).toThrow(/bounded path/);
+        expect(() => (0, digest_1.candidateDigest)({ file: 'policy.json', cwd: '' })).toThrow(/bounded path/);
+        fs_1.default.writeFileSync(path_1.default.join(cwd, 'array.json'), '[]');
+        expect(() => (0, digest_1.candidateDigest)({ file: 'array.json', cwd })).toThrow(/must be a JSON object/);
+    });
+    // The point of the command: the digest it discloses is the one approval
+    // demands. A digest that merely looked plausible would be worthless, so the
+    // proof is that approval ACCEPTS it, not that two functions agree.
+    it('produces a digest that the policy approval path accepts end to end', () => {
+        const file = write('policy.json', policy());
+        const observed = [];
+        const boundary = {
+            withProjectLease: (_root, operation) => operation(),
+            readRegularFile: (target) => { const entry = { bytes: fs_1.default.readFileSync(target), identity: Object.freeze({}) }; observed.push(entry); return entry; },
+            writeProjectTransaction: (root, destination, content) => { const target = path_1.default.join(root, destination); fs_1.default.mkdirSync(path_1.default.dirname(target), { recursive: true }); fs_1.default.writeFileSync(target, content); },
+        };
+        const approved = (0, store_1.approvePolicyWithBoundary)({ file, scope: 'project', cwd, expectedDigest: (0, digest_1.candidateDigest)({ file, cwd }).digest }, boundary);
+        expect(approved.contentDigest).toBe((0, digest_1.candidateDigest)({ file, cwd }).digest);
+        expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(cwd, '.awm', 'model-policy.json'), 'utf8')).contentDigest).toBe(approved.contentDigest);
+    });
+    it('produces a digest that the capability approval path accepts end to end', () => {
+        const value = receipt();
+        const file = write('receipt.json', value);
+        const approved = (0, capabilities_1.approveCapabilities)({ file, cwd, expectedDigest: (0, digest_1.candidateDigest)({ file, cwd }).digest, now: new Date('2026-09-17T12:00:00.000Z') });
+        expect(approved).toEqual(value);
+    });
+    // Falsifiability: the same approval must REJECT any digest but the disclosed
+    // one, or the assertion above would pass against a command that emitted noise.
+    it('is the only digest approval accepts', () => {
+        const value = receipt();
+        const file = write('receipt.json', value);
+        expect(() => (0, capabilities_1.approveCapabilities)({ file, cwd, expectedDigest: 'f'.repeat(64), now: new Date('2026-09-17T12:00:00.000Z') })).toThrow(/does not match expectedDigest/);
+    });
+    it('writes nothing: digesting is not approving', () => {
+        const file = write('policy.json', policy());
+        (0, digest_1.candidateDigest)({ file, cwd });
+        expect(fs_1.default.existsSync(path_1.default.join(cwd, '.awm'))).toBe(false);
+        expect(fs_1.default.readdirSync(cwd).sort()).toEqual(['policy.json']);
+    });
+});

package/dist/tests/core/model-policy/resolve.test.js

@@ -98,6 +98,80 @@ describe('resolveSelection', () => {
         value.capabilities.capabilities.effortOverride = 'unsupported';
         expect((0, resolve_2.resolveV1Dispatch)({ ...value, plan: verifiedV1Plan, optInV1: true })).toMatchObject({ state: 'resolved', outcome: 'native', selection: runtimeDefaultSelection('full') });
     });
+    // Regression for the collapse that made routed model and surrendered effort
+    // indistinguishable: degrading effort used to rewrite the selection to
+    // fullCapability, so a mechanical slice silently ran the judgment model while
+    // the only evidence emitted named effortOverride.
+    it('keeps the routed per-profile model when effort override degrades', () => {
+        const value = input();
+        value.policy.content.mappings[0].degradation.allowMissingEffortOverride = true;
+        value.capabilities.capabilities.effortOverride = 'unsupported';
+        value.capabilities.runtimeDefaultSelection = runtimeDefaultSelection('full');
+        value.capabilities.availableSelections = [...value.capabilities.availableSelections, runtimeDefaultSelection('mechanical'), runtimeDefaultSelection('integration'), runtimeDefaultSelection('full')];
+        expect((0, resolve_1.resolveSelection)({ ...value, requestedProfile: 'mechanical' })).toMatchObject({ state: 'resolved', outcome: 'degraded', selection: runtimeDefaultSelection('mechanical'), effectiveProfile: 'mechanical', unavailableEvidence: ['effortOverride'] });
+        expect((0, resolve_1.resolveSelection)({ ...value, requestedProfile: 'integration' })).toMatchObject({ state: 'resolved', outcome: 'degraded', selection: runtimeDefaultSelection('integration'), effectiveProfile: 'integration', unavailableEvidence: ['effortOverride'] });
+    });
+    // An honest receipt for a runtime with no effort control attests ONLY
+    // runtime-default selections — it cannot claim `mechanical at low effort` is
+    // selectable. Checking availability before degradation rejected exactly that
+    // receipt, so the contract only worked for a receipt that overclaimed.
+    it('degrades effort against a receipt that attests only runtime-default selections', () => {
+        const value = input();
+        value.policy.content.mappings[0].degradation.allowMissingEffortOverride = true;
+        value.capabilities.capabilities.effortOverride = 'unsupported';
+        value.capabilities.availableSelections = [runtimeDefaultSelection('mechanical'), runtimeDefaultSelection('integration'), runtimeDefaultSelection('judgment'), runtimeDefaultSelection('full')];
+        value.capabilities.runtimeDefaultSelection = runtimeDefaultSelection('full');
+        expect((0, resolve_1.resolveSelection)({ ...value, requestedProfile: 'mechanical' })).toMatchObject({ state: 'resolved', outcome: 'degraded', selection: runtimeDefaultSelection('mechanical'), unavailableEvidence: ['effortOverride'] });
+    });
+    // The runtime default is one selection; a per-profile selection at
+    // runtime-default effort is a different one. Requiring them equal made every
+    // profile but the default model unroutable, with modelOverride attested
+    // supported and the selection itself attested available.
+    it('routes a per-profile runtime-default selection whose model differs from the runtime default', () => {
+        const value = input();
+        value.policy.content.mappings[0].profiles.mechanical = runtimeDefaultSelection('mechanical');
+        value.capabilities.availableSelections = [runtimeDefaultSelection('mechanical'), runtimeDefaultSelection('full')];
+        value.capabilities.runtimeDefaultSelection = runtimeDefaultSelection('full');
+        expect((0, resolve_1.resolveSelection)({ ...value, requestedProfile: 'mechanical' })).toMatchObject({ state: 'resolved', outcome: 'native', selection: runtimeDefaultSelection('mechanical'), effectiveProfile: 'mechanical' });
+    });
+    it('still blocks a runtime-default selection the receipt does not attest at all', () => {
+        const value = input();
+        value.policy.content.mappings[0].profiles.mechanical = runtimeDefaultSelection('mechanical');
+        value.capabilities.availableSelections = [runtimeDefaultSelection('full')];
+        value.capabilities.runtimeDefaultSelection = runtimeDefaultSelection('full');
+        expect((0, resolve_1.resolveSelection)({ ...value, requestedProfile: 'mechanical' })).toMatchObject({ state: 'blocked', diagnostics: [{ code: 'ROUTING_SELECTION_UNAVAILABLE' }] });
+    });
+    it('still blocks a runtime-default selection when the receipt declares no runtime default', () => {
+        const value = input();
+        value.policy.content.mappings[0].profiles.mechanical = runtimeDefaultSelection('mechanical');
+        value.capabilities.availableSelections = [runtimeDefaultSelection('mechanical')];
+        delete value.capabilities.runtimeDefaultSelection;
+        expect((0, resolve_1.resolveSelection)({ ...value, requestedProfile: 'mechanical' })).toMatchObject({ state: 'blocked', diagnostics: [{ code: 'ROUTING_SELECTION_UNAVAILABLE' }] });
+    });
+    it('blocks effort degradation when the routed model at runtime-default effort is not attested', () => {
+        const value = input();
+        value.policy.content.mappings[0].degradation.allowMissingEffortOverride = true;
+        value.capabilities.capabilities.effortOverride = 'unsupported';
+        value.capabilities.runtimeDefaultSelection = runtimeDefaultSelection('full');
+        value.capabilities.availableSelections = [...value.capabilities.availableSelections, runtimeDefaultSelection('full')];
+        expect((0, resolve_1.resolveSelection)({ ...value, requestedProfile: 'mechanical' })).toMatchObject({ state: 'blocked', diagnostics: [{ code: 'ROUTING_EFFORT_OVERRIDE_UNAVAILABLE' }] });
+    });
+    it('keeps effort strict when the mapping does not allow degrading it', () => {
+        const value = input();
+        value.capabilities.capabilities.effortOverride = 'unsupported';
+        value.capabilities.runtimeDefaultSelection = runtimeDefaultSelection('full');
+        value.capabilities.availableSelections = [...value.capabilities.availableSelections, runtimeDefaultSelection('mechanical'), runtimeDefaultSelection('full')];
+        expect(value.policy.content.mappings[0].degradation.allowMissingEffortOverride).toBe(false);
+        expect((0, resolve_1.resolveSelection)({ ...value, requestedProfile: 'mechanical' })).toMatchObject({ state: 'blocked', diagnostics: [{ code: 'ROUTING_EFFORT_OVERRIDE_UNAVAILABLE' }] });
+    });
+    it('never degrades effort on an unverified capability, only on an attested unsupported one', () => {
+        const value = input();
+        value.policy.content.mappings[0].degradation.allowMissingEffortOverride = true;
+        value.capabilities.capabilities.effortOverride = 'unverified';
+        value.capabilities.runtimeDefaultSelection = runtimeDefaultSelection('full');
+        value.capabilities.availableSelections = [...value.capabilities.availableSelections, runtimeDefaultSelection('mechanical'), runtimeDefaultSelection('full')];
+        expect((0, resolve_1.resolveSelection)({ ...value, requestedProfile: 'mechanical' })).toMatchObject({ state: 'blocked', diagnostics: [{ code: 'ROUTING_EFFORT_OVERRIDE_UNAVAILABLE', message: expect.stringMatching(/unverified/) }] });
+    });
     it('does not require effort override after model fallback selects an attested runtime-default full selection', () => {
         const value = input();
         value.policy.content.mappings[0].fullCapability = runtimeDefaultSelection('full');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "9.9.0",
+  "version": "9.10.1",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"