agentic-workflow-manager 3.2.2 → 3.3.1

package/dist/src/commands/init.js

@@ -49,6 +49,7 @@ const bundles_1 = require("../core/bundles");
 const registries_1 = require("../core/registries");
 const orchestrator_1 = require("../core/init/orchestrator");
 const steps_1 = require("../core/init/steps");
+const failure_1 = require("../core/init/failure");
 const mutation_targets_1 = require("../core/init/mutation-targets");
 const provider_facts_1 = require("../core/init/provider-facts");
 const install_transaction_1 = require("../core/install-transaction");
@@ -94,6 +95,35 @@ function renderInitOutcome(o) {
     lines.push(`status: ${status} · ${pendingCount} steps require an agent (skills above)`);
     return lines.join('\n');
 }
+// ---------------------------------------------------------------------------
+// Failure reporting
+// ---------------------------------------------------------------------------
+/**
+ * Single exit point for every failed `awm init`. Honours `--json`'s contract on
+ * the error path — the whole point of the flag for a headless bootstrap is to
+ * learn WHICH step failed — and, in human mode, renders the same evidence
+ * through the normal init dashboard instead of discarding it.
+ *
+ * stdout carries the machine-readable document (JSON mode) or the dashboard
+ * (human mode); stderr always carries the one-line summary plus the
+ * transaction verdict, so `2>&1`-free scripts still see a reason.
+ */
+function reportInitFailure(o) {
+    const payload = (0, failure_1.buildInitFailureOutput)({
+        error: o.error,
+        outcome: o.outcome,
+        transaction: o.transaction,
+    });
+    if (o.json) {
+        process.stdout.write(JSON.stringify(payload, null, 2) + '\n');
+    }
+    else if (o.outcome) {
+        process.stdout.write(renderInitOutcome(o.outcome) + '\n');
+    }
+    process.stderr.write(`awm init: ${payload.error}\n`);
+    process.stderr.write(`awm init: ${payload.transaction.note}\n`);
+    return 2;
+}
 async function runInit(opts = {}) {
     const cwd = opts.cwd ?? process.cwd();
     const agent = opts.agent === undefined ? 'claude-code' : (0, providers_1.requireAgentTarget)(opts.agent);
@@ -125,6 +155,10 @@ async function runInit(opts = {}) {
     // and would incorrectly be flagged as a violation.
     const beforeClaudeFacts = agent === 'claude-code' ? null : (0, provider_facts_1.gatherProviderFacts)('claude-code');
     let outcome;
+    // Populated as soon as each becomes available, so the failure reporter can
+    // emit whatever evidence THIS run got far enough to produce.
+    let pipelineOutcome;
+    let transaction;
     try {
         const mergedActions = {
             ...steps_1.defaultActions,
@@ -155,7 +189,11 @@ async function runInit(opts = {}) {
             (0, config_1.savePreferences)(nextPreferences);
             (0, registries_1.seedBaselineRegistry)();
             if ((0, registries_1.listRegistries)().some((r) => !fs_1.default.existsSync(r.contentRoot))) {
-                await mergedActions.syncCache();
+                // `syncRegistries()` reports per-registry failures as RESULTS,
+                // never as throws (core/registries.ts) — swallowing them here
+                // let an unavailable registry degrade silently into some later
+                // step's failure instead of being reported as its own cause.
+                (0, registries_1.assertSyncedRegistriesUsable)((await mergedActions.syncCache()) ?? []);
             }
             const bundles = (0, bundles_1.discoverAllBundles)();
             const ctx = (0, context_1.gatherContext)({ cwd, bundles, agent });
@@ -177,8 +215,13 @@ async function runInit(opts = {}) {
                 confirmExtensions,
                 actions: mergedActions,
             });
+            pipelineOutcome = outcome;
             if (outcome.failed > 0) {
-                throw new Error('one or more init steps failed');
+                // Typed so the outcome — the only record of WHICH step failed
+                // and why — survives the rollback below and reaches the
+                // reporter. A bare Error here is what made `--json` emit
+                // nothing on the one path that most needed it.
+                throw new failure_1.InitStepsFailedError(outcome);
             }
             if (beforeClaudeFacts) {
                 (0, provider_facts_1.assertClaudeBaselinePreserved)(beforeClaudeFacts, (0, provider_facts_1.gatherProviderFacts)('claude-code'));
@@ -188,21 +231,49 @@ async function runInit(opts = {}) {
             outcome.modifiedFiles = backup.targetPaths;
         }
         catch (error) {
-            backup.rollback();
+            // Rollback is best-effort and must never mask the original failure
+            // (same policy as applyInstallPlan's own rollback loop): the
+            // operator needs the step that failed, not the restore that also did.
+            let rollbackError;
+            try {
+                backup.rollback();
+            }
+            catch (e) {
+                rollbackError = e instanceof Error ? e.message : String(e);
+            }
+            transaction = {
+                committed: false,
+                rolledBack: rollbackError === undefined,
+                transactionId: backup.transactionId,
+                restoredFiles: backup.targetPaths,
+                ...(rollbackError === undefined ? {} : { rollbackError }),
+                note: (0, failure_1.transactionNote)(rollbackError === undefined),
+            };
             throw error;
         }
     }
     catch (err) {
-        process.stderr.write(`awm init: internal error: ${err.message}\n`);
-        return 2;
+        // The typed error carries its own outcome (so it stays self-sufficient
+        // for any caller of runInit); `pipelineOutcome` covers the other way a
+        // run can fail *after* the pipeline produced one — e.g. the R19
+        // Claude-baseline assertion.
+        return reportInitFailure({
+            error: err,
+            outcome: err instanceof failure_1.InitStepsFailedError ? err.outcome : pipelineOutcome,
+            transaction,
+            json: opts.json,
+        });
     }
+    // `result` mirrors the exit code, so a consumer can branch on one field
+    // instead of correlating stdout with $?: ok → 0, degraded → 1, failed → 2.
+    const result = outcome.after.overall === 'healthy' ? 'ok' : 'degraded';
     if (opts.json) {
-        process.stdout.write(JSON.stringify(outcome, null, 2) + '\n');
+        process.stdout.write(JSON.stringify({ result, ...outcome }, null, 2) + '\n');
     }
     else {
         process.stdout.write(renderInitOutcome(outcome) + '\n');
     }
-    return outcome.after.overall === 'healthy' ? 0 : 1;
+    return result === 'ok' ? 0 : 1;
 }
 // ---------------------------------------------------------------------------
 // Extension confirmation factory
@@ -240,7 +311,7 @@ function registerInitCommand(program) {
         .option('-y, --yes', 'Skip confirmation prompts')
         .option('-a, --agent <agent>', 'Target agent (default: claude-code)')
         .option('--machine-only', 'Only run machine-level steps (skip project steps)')
-        .option('--json', 'Emit the InitOutcome as JSON')
+        .option('--json', 'Emit the InitOutcome as JSON — on success and on failure (failed steps + rollback)')
         .action(async (options) => {
         (0, paths_1.warnIfUnsupportedPlatform)((m) => console.warn(picocolors_1.default.yellow(`⚠ ${m}`)));
         const code = await runInit({

package/dist/src/commands/sensors/run.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyBaseline = applyBaseline;
 exports.reconcilePack = reconcilePack;
 exports.findManifestDir = findManifestDir;
 exports.runSensors = runSensors;
@@ -26,11 +27,13 @@ const DEFAULT_SLOW_TIMEOUT = 120_000;
 const MAX_BUFFER = 64 * 1024 * 1024;
 /**
  * Apply the baseline to a sensor result: keep only findings not already accepted.
- * `status` becomes 'pass' when every finding was baseline-suppressed. Skipped
- * sensors are returned untouched.
+ * `status` becomes 'pass' when every finding was baseline-suppressed. Results
+ * without a verdict of their own — skipped and inconclusive — are returned
+ * untouched: there is nothing to ratchet, and letting them through here would
+ * hand back a `pass` for a sensor that never reported anything.
  */
 function applyBaseline(result, accepted) {
-    if (result.status === 'skipped')
+    if (result.status === 'skipped' || result.status === 'inconclusive')
         return result;
     const { newErrors, suppressed } = (0, baseline_1.partition)(result.name, result.errors, accepted);
     if (suppressed === 0)
@@ -131,12 +134,14 @@ function runSensor(name, cmd, timeout, cwd) {
     catch (err) {
         // Output exceeded maxBuffer — child is killed before output can be read.
         // Check this BEFORE the SIGTERM branch (ENOBUFS kills with SIGTERM too).
+        // Nothing could be read, so nothing was certified.
         if (err.code === 'ENOBUFS') {
-            return { name, status: 'skipped', errors: [], skipReason: `output exceeded ${MAX_BUFFER} bytes` };
+            return { name, status: 'inconclusive', errors: [], skipReason: `output exceeded ${MAX_BUFFER} bytes` };
         }
-        // Genuine timeout: execSync kills with SIGTERM after `timeout` ms.
+        // Genuine timeout: execSync kills with SIGTERM after `timeout` ms. The
+        // sensor produced no verdict — inconclusive, not a benign skip.
         if (err.code === 'ETIMEDOUT' || (err.killed && err.signal === 'SIGTERM')) {
-            return { name, status: 'skipped', errors: [], skipReason: `timeout after ${timeout}ms` };
+            return { name, status: 'inconclusive', errors: [], skipReason: `timeout after ${timeout}ms` };
         }
         // Non-zero exit — the normal path for linters/typecheckers that found
         // findings. Parse the output; if it yields findings, that's a fail.
@@ -146,9 +151,28 @@ function runSensor(name, cmd, timeout, cwd) {
             return { name, status: 'fail', errors };
         // A missing tool (binary not installed) must NOT pass silently — the gate
         // cannot certify what it could not run. Treat it as a fail with a clear message.
+        //
+        // Exit 127 is the POSIX signal for "command not found" and is the only check
+        // here that holds across shells and locales: bash writes `command not found`
+        // but dash — `/bin/sh` on Debian/Ubuntu, hence most CI runners and containers
+        // — writes `not found`, so matching shell text alone read an absent tool as a
+        // benign skip. `err.code` does not cover it either: that is ENOENT only when
+        // spawning the shell itself fails, not when the shell starts and the command
+        // inside it is missing. The ENOBUFS and timeout branches are evaluated above,
+        // so reaching here with status 127 means the command did not exist.
+        //
+        // A wrapper (`npm test`, `npx …`) that exits 127 because a binary it invokes
+        // is absent is classified the same way, deliberately: the gate still ran
+        // nothing and still cannot certify anything.
         const lower = raw.toLowerCase();
-        const toolMissing = err.code === 'ENOENT' || // execSync spawn failure (no shell)
-            lower.includes('command not found') ||
+        const toolMissing = err.status === 127 || // POSIX: command not found
+            err.code === 'ENOENT' || // execSync spawn failure (no shell)
+            lower.includes('command not found') || // bash, zsh
+            // cmd.exe reports an absent binary with exit 1, so 127 does not cover
+            // Windows; this exact phrase does. Kept narrow on purpose — a loose
+            // `not found` would also match a tool that ran and said "not found"
+            // for reasons of its own.
+            lower.includes('is not recognized as an internal or external command') ||
             lower.includes('enoent') ||
             lower.includes('could not determine executable');
         if (toolMissing) {
@@ -163,7 +187,10 @@ function runSensor(name, cmd, timeout, cwd) {
         if (isExitCodeSensor(name)) {
             return { name, status: 'fail', errors: [{ message: `SENSOR[${name}] failed (exit ${err.status})` }] };
         }
-        return { name, status: 'skipped', errors: [], skipReason: `exit ${err.status}: ${raw.slice(0, 200)}` };
+        // Residual case: it exited non-zero, the tool exists, and no finding
+        // could be parsed. We do not know what happened — say so instead of
+        // reporting a benign skip.
+        return { name, status: 'inconclusive', errors: [], skipReason: `exit ${err.status}: ${raw.slice(0, 200)}` };
     }
 }
 function runSensors(opts = {}) {
@@ -191,7 +218,9 @@ function runSensors(opts = {}) {
             continue;
         }
         if (!config.cmd) {
-            results.push({ name, status: 'skipped', errors: [], skipReason: 'no cmd configured' });
+            // Enabled but with nothing to run: broken config, not a deliberate
+            // opt-out. `enabled: false` is how a sensor is turned off.
+            results.push({ name, status: 'inconclusive', errors: [], skipReason: 'no cmd configured' });
             continue;
         }
         const timeout = config.timeout ?? (isFast ? DEFAULT_FAST_TIMEOUT : DEFAULT_SLOW_TIMEOUT);
@@ -200,10 +229,13 @@ function runSensors(opts = {}) {
             result = applyBaseline(result, baseline[name]);
         results.push(result);
     }
+    // `fail` outranks `inconclusive`: when something is broken AND something
+    // could not be measured, the broken thing is the actionable verdict.
     let overall = results.some(r => r.status === 'fail') ? 'fail'
-        : results.length > 0 && results.every(r => r.status === 'skipped') ? 'skipped'
-            : results.length === 0 ? 'skipped'
-                : 'pass';
+        : results.some(r => r.status === 'inconclusive') ? 'not_certified'
+            : results.length > 0 && results.every(r => r.status === 'skipped') ? 'skipped'
+                : results.length === 0 ? 'skipped'
+                    : 'pass';
     // Honest floor: a benign-green 'skipped' over a tree that clearly HAS a stack
     // (indicators present) is a false green — the gate ran nothing real. Never green.
     if (overall === 'skipped' && reconciled.detection.pack !== 'generic') {

package/dist/src/core/init/failure.js

@@ -0,0 +1,74 @@
+"use strict";
+// src/core/init/failure.ts
+//
+// Failure evidence for `awm init`.
+//
+// `awm init` is transactional: any failure rolls every write back. That part
+// was always right — what was missing is the EVIDENCE. `runInitSteps` already
+// records, per step, `{ id, action: 'failed', error }` (orchestrator.ts's
+// `wrapStep`), but commands/init.ts used to collapse the whole outcome into a
+// bare `new Error('one or more init steps failed')`, so `--json` — whose only
+// job is to emit that outcome — printed nothing at all on the exact path an
+// operator needs it: a headless cloud bootstrap that just aborted.
+//
+// `InitStepsFailedError` carries the outcome across the rollback boundary, and
+// `buildInitFailureOutput` shapes it into the JSON envelope the CLI emits.
+// The envelope is deliberately self-describing (`result`, `failedSteps`,
+// `transaction`) so a bootstrap script can branch on it without re-deriving
+// anything from prose on stderr.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InitStepsFailedError = void 0;
+exports.failedSteps = failedSteps;
+exports.transactionNote = transactionNote;
+exports.buildInitFailureOutput = buildInitFailureOutput;
+/** Only the steps that actually failed — the subset an operator needs first. */
+function failedSteps(outcome) {
+    return outcome.steps.filter((s) => s.action === 'failed');
+}
+/**
+ * Thrown when the step pipeline ran to completion but ≥1 step failed. Carries
+ * the full `InitOutcome` so the rollback path can still emit it, and builds a
+ * message that names every failed step instead of the old generic sentence.
+ */
+class InitStepsFailedError extends Error {
+    outcome;
+    constructor(outcome) {
+        const detail = failedSteps(outcome)
+            .map((s) => `${s.id}: ${s.error ?? 'no error recorded'}`)
+            .join('; ');
+        super(`one or more init steps failed — ${detail || 'no failed step recorded'}`);
+        this.name = 'InitStepsFailedError';
+        this.outcome = outcome;
+    }
+}
+exports.InitStepsFailedError = InitStepsFailedError;
+const NO_TRANSACTION_NOTE = 'init failed before a backup session was opened — nothing was written, so there was nothing to roll back.';
+/** The note explaining what a given rollback outcome means for the machine. */
+function transactionNote(rolledBack) {
+    return rolledBack
+        ? 'the transaction was NOT committed: every path in restoredFiles was restored to its pre-init state. '
+            + '`after` reflects the state observed at the end of the step pipeline, BEFORE this rollback ran.'
+        : 'the transaction was NOT committed and the rollback did not complete — see rollbackError and '
+            + 'restore manually with `awm backup restore <transactionId>`.';
+}
+function buildInitFailureOutput(o) {
+    const steps = o.outcome?.steps ?? [];
+    return {
+        result: 'failed',
+        error: o.error.message,
+        steps,
+        failedSteps: steps.filter((s) => s.action === 'failed'),
+        applied: o.outcome?.applied ?? 0,
+        pending: o.outcome?.pending ?? 0,
+        failed: o.outcome?.failed ?? 0,
+        before: o.outcome?.before ?? null,
+        after: o.outcome?.after ?? null,
+        transaction: o.transaction ?? {
+            committed: false,
+            rolledBack: false,
+            transactionId: null,
+            restoredFiles: [],
+            note: NO_TRANSACTION_NOTE,
+        },
+    };
+}

package/dist/src/core/init/steps.js

@@ -39,7 +39,7 @@ const codex_agents_1 = require("../context/strategies/codex-agents");
 // ---------------------------------------------------------------------------
 const realInjectionOrchestrator = new orchestrator_1.InjectionOrchestrator();
 exports.defaultActions = {
-    syncCache: async () => { await (0, registries_1.syncRegistries)(); },
+    syncCache: async () => (0, registries_1.syncRegistries)(),
     installHook: (o) => (0, install_1.installHook)({
         agent: o.agent,
         registryRoot: o.registryRoot,
@@ -135,14 +135,30 @@ async function stepCache(d) {
     const needsSync = !registryCache.present || registryCache.gitState === 'behind';
     if (!needsSync)
         return ok('machine.cache', 'machine', 'skipped');
+    let results;
     try {
-        await d.actions.syncCache();
-        return ok('machine.cache', 'machine', 'applied');
+        results = (await d.actions.syncCache()) ?? [];
     }
     catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
         return failed('machine.cache', 'machine', msg);
     }
+    // `syncRegistries()` reports per-registry failures as RESULTS, not throws
+    // (registries.ts), so the `try` above catches none of them. Ignoring them
+    // is what let an unavailable base registry degrade silently into some
+    // later step's failure — with its own cause already gone.
+    const errors = (0, registries_1.registrySyncErrors)(results);
+    if (errors.length === 0)
+        return ok('machine.cache', 'machine', 'applied');
+    // A registry that errored and has no content on disk is unusable, and every
+    // later step that reads it will fail for a reason that no longer names this
+    // cause — so machine.cache owns it here. One that errored but still has
+    // content is stale, not broken: record it and carry on.
+    const unusable = (0, registries_1.unusableSyncedRegistries)(results);
+    if (unusable.length > 0) {
+        return failed('machine.cache', 'machine', `registry unavailable — ${(0, registries_1.describeRegistrySyncErrors)(unusable)}`);
+    }
+    return ok('machine.cache', 'machine', 'applied', `stale registries — ${(0, registries_1.describeRegistrySyncErrors)(errors)}`);
 }
 /** Step 2 – Install the session-start hook for the target agent. */
 function stepHook(d) {

package/dist/src/core/registries.js

@@ -13,6 +13,10 @@ exports.contentRoots = contentRoots;
 exports.capabilityRoot = capabilityRoot;
 exports.validateRegistryLayout = validateRegistryLayout;
 exports.syncRegistries = syncRegistries;
+exports.registrySyncErrors = registrySyncErrors;
+exports.describeRegistrySyncErrors = describeRegistrySyncErrors;
+exports.unusableSyncedRegistries = unusableSyncedRegistries;
+exports.assertSyncedRegistriesUsable = assertSyncedRegistriesUsable;
 exports.readRegistryManifest = readRegistryManifest;
 exports.registryNameForPath = registryNameForPath;
 exports.verifyMinCliVersions = verifyMinCliVersions;
@@ -144,6 +148,46 @@ async function syncRegistries() {
     }
     return results;
 }
+/** The errored entries of a `syncRegistries()` run, in `listRegistries()` order. */
+function registrySyncErrors(results) {
+    return results
+        .filter((r) => r.action === 'error')
+        .map((r) => ({ name: r.name, error: r.error }));
+}
+/** `name: reason; name: reason` — the shape both init and stepCache report errors in. */
+function describeRegistrySyncErrors(errors) {
+    return errors.map((e) => `${e.name}: ${e.error}`).join('; ');
+}
+/**
+ * Registries that both errored during sync AND have no content on disk
+ * afterwards — i.e. genuinely unusable, as opposed to merely stale.
+ *
+ * `syncRegistries()` deliberately reports per-registry failures as results
+ * rather than throwing, so a flaky secondary registry never aborts a whole
+ * run. Callers that go on to READ registry content (init) still need to know
+ * whether what they are about to read exists: otherwise a missing registry
+ * resurfaces much later as an unrelated step's failure, with its real cause
+ * already discarded. Note that "usable" is deliberately about content on disk,
+ * not about being a healthy git clone — a seeded content root with no `.git`
+ * fails to sync every time and is still perfectly readable.
+ */
+function unusableSyncedRegistries(results) {
+    const errors = registrySyncErrors(results);
+    if (errors.length === 0)
+        return [];
+    const roots = new Map(listRegistries().map((r) => [r.name, r.contentRoot]));
+    return errors.filter((e) => {
+        const root = roots.get(e.name);
+        return root === undefined || !fs_1.default.existsSync(root);
+    });
+}
+/** `unusableSyncedRegistries` as a guard: throws naming every unusable registry. */
+function assertSyncedRegistriesUsable(results) {
+    const unusable = unusableSyncedRegistries(results);
+    if (unusable.length === 0)
+        return;
+    throw new Error(`registry sync failed and left no content on disk — ${describeRegistrySyncErrors(unusable)}`);
+}
 exports.REGISTRY_MANIFEST_NAME = 'awm-registry.json';
 function readRegistryManifest(root) {
     const file = path_1.default.join(root, exports.REGISTRY_MANIFEST_NAME);

package/dist/tests/commands/init.test.js

@@ -91,6 +91,7 @@ describe('runInit', () => {
         const parsed = JSON.parse(written);
         expect(Array.isArray(parsed.steps)).toBe(true);
         expect(parsed.after.overall).toBe('degraded');
+        expect(parsed.result).toBe('degraded'); // success envelope is self-describing too
         expect(code).toBe(1);
     });
     const prefsFile = () => path_1.default.join(process.env.AWM_HOME, 'preferences.json');
@@ -291,4 +292,85 @@ describe('runInit', () => {
         // rollback must restore its exact pre-run content, not just leave it be.
         expect(JSON.parse(fs_1.default.readFileSync(settingsPath, 'utf8'))).toEqual({ pristine: true, unrelated: 'keep' });
     });
+    // -----------------------------------------------------------------------
+    // Failure evidence — `--json` must honour its contract on the ERROR path
+    // -----------------------------------------------------------------------
+    describe('failure evidence', () => {
+        let errSpy;
+        beforeEach(() => {
+            errSpy = jest.spyOn(process.stderr, 'write').mockImplementation(() => true);
+        });
+        afterEach(() => errSpy.mockRestore());
+        const stdout = () => writeSpy.mock.calls.map((c) => c[0]).join('');
+        const stderr = () => errSpy.mock.calls.map((c) => c[0]).join('');
+        /** InitActions whose `machine.hook` step blows up inside the step pipeline. */
+        function actionsWithFailingHook() {
+            const actions = fakeActions([]);
+            actions.installHook = () => { throw new Error('hook boom'); };
+            return actions;
+        }
+        it('--json emits parseable JSON carrying the failed step id and error', async () => {
+            const { runInit } = require('../../src/commands/init');
+            const code = await runInit({
+                cwd: tmpHome,
+                yes: true,
+                json: true,
+                actions: actionsWithFailingHook(),
+            });
+            expect(code).not.toBe(0);
+            expect(code).toBe(2);
+            const parsed = JSON.parse(stdout());
+            expect(parsed.result).toBe('failed');
+            const failedStep = parsed.steps.find((s) => s.action === 'failed');
+            expect(failedStep.id).toBe('machine.hook');
+            expect(failedStep.error).toBe('hook boom');
+            expect(parsed.failedSteps).toEqual([failedStep]);
+            expect(parsed.failed).toBe(1);
+            // The top-level message names the step too — no generic "internal error".
+            expect(parsed.error).toContain('machine.hook');
+            expect(parsed.error).toContain('hook boom');
+            // `before` is the pre-run snapshot the issue asks for.
+            expect(parsed.before.results.length).toBeGreaterThan(0);
+        });
+        it('--json reports the transaction as not committed and rolled back', async () => {
+            const { runInit } = require('../../src/commands/init');
+            await runInit({ cwd: tmpHome, yes: true, json: true, actions: actionsWithFailingHook() });
+            const { transaction } = JSON.parse(stdout());
+            expect(transaction.committed).toBe(false);
+            expect(transaction.rolledBack).toBe(true);
+            expect(typeof transaction.transactionId).toBe('string');
+            expect(Array.isArray(transaction.restoredFiles)).toBe(true);
+            expect(transaction.note).toBeTruthy();
+            // The backup manifest on disk agrees: nothing was committed.
+            const { listBackups } = require('../../src/core/install-transaction');
+            const backups = listBackups();
+            expect(backups.length).toBeGreaterThan(0);
+            expect(backups.every((b) => b.committed)).toBe(false);
+            // …and the run really did not persist anything.
+            expect(fs_1.default.existsSync(prefsFile())).toBe(false);
+        });
+        it('--json still emits a failure envelope when init fails before the step pipeline', async () => {
+            const actions = fakeActions([]);
+            actions.syncCache = async () => { throw new Error('registry unreachable'); };
+            const { runInit } = require('../../src/commands/init');
+            const code = await runInit({ cwd: tmpHome, yes: true, json: true, actions });
+            expect(code).toBe(2);
+            const parsed = JSON.parse(stdout());
+            expect(parsed.result).toBe('failed');
+            expect(parsed.error).toContain('registry unreachable');
+            expect(parsed.steps).toEqual([]);
+            expect(parsed.before).toBeNull();
+            expect(parsed.transaction.committed).toBe(false);
+        });
+        it('human mode renders the failed outcome instead of swallowing it', async () => {
+            const { runInit } = require('../../src/commands/init');
+            const code = await runInit({ cwd: tmpHome, yes: true, actions: actionsWithFailingHook() });
+            expect(code).toBe(2);
+            expect(stdout()).toContain('AWM · init');
+            expect(stdout()).toContain('machine.hook');
+            expect(stdout()).toContain('hook boom');
+            expect(stderr()).toContain('machine.hook');
+            expect(stderr()).toContain('hook boom');
+        });
+    });
 });

package/dist/tests/commands/sensors/run-inconclusive.test.js

@@ -0,0 +1,237 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const mockExecSyncFn = jest.fn();
+jest.mock('child_process', () => ({
+    execSync: (...args) => mockExecSyncFn(...args),
+}));
+/** Sensors run in manifest insertion order, so mocks are queued in that order. */
+const MANIFEST = {
+    pack: 'js-ts',
+    sensors: {
+        typecheck: { cmd: 'npx tsc --noEmit', fast: true },
+        security: { cmd: 'semgrep .', fast: false },
+    },
+};
+const timeoutError = () => { throw Object.assign(new Error('killed'), { code: 'ETIMEDOUT' }); };
+describe('runSensors — inconclusive: a sensor that could not certify is never green', () => {
+    let root;
+    let fakeAwmHome;
+    let prevAwmHome;
+    beforeEach(() => {
+        jest.resetModules();
+        mockExecSyncFn.mockReset();
+        root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-inconclusive-'));
+        fs_1.default.mkdirSync(path_1.default.join(root, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify(MANIFEST));
+        // CLAUDE.md: no test may reach the real ~/.awm.
+        fakeAwmHome = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-home-'));
+        prevAwmHome = process.env.AWM_HOME;
+        process.env.AWM_HOME = fakeAwmHome;
+    });
+    afterEach(() => {
+        process.env.AWM_HOME = prevAwmHome;
+        fs_1.default.rmSync(root, { recursive: true, force: true });
+        fs_1.default.rmSync(fakeAwmHome, { recursive: true, force: true });
+    });
+    const load = () => require('../../../src/commands/sensors/run');
+    it('reports a timed-out sensor as inconclusive, keeping its reason', () => {
+        mockExecSyncFn
+            .mockReturnValueOnce('') // typecheck: clean
+            .mockImplementationOnce(timeoutError); // security: times out
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        const security = out.sensors.find((s) => s.name === 'security');
+        expect(security.status).toBe('inconclusive');
+        expect(security.skipReason).toMatch(/timeout/);
+    });
+    it('does not let a healthy sensor carry the run to pass while another could not certify', () => {
+        mockExecSyncFn
+            .mockReturnValueOnce('')
+            .mockImplementationOnce(timeoutError);
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        expect(out.sensors.find((s) => s.name === 'typecheck').status).toBe('pass');
+        expect(out.overall).toBe('not_certified');
+    });
+    it('reports a sensor whose output was truncated as inconclusive', () => {
+        mockExecSyncFn
+            .mockReturnValueOnce('')
+            .mockImplementationOnce(() => { throw Object.assign(new Error('too big'), { code: 'ENOBUFS' }); });
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        const security = out.sensors.find((s) => s.name === 'security');
+        expect(security.status).toBe('inconclusive');
+        expect(security.skipReason).toMatch(/exceeded/);
+        expect(out.overall).toBe('not_certified');
+    });
+    it('reports an uninterpretable non-zero exit as inconclusive', () => {
+        mockExecSyncFn
+            .mockReturnValueOnce('')
+            .mockImplementationOnce(() => {
+            // semgrep formatter yields no findings for non-JSON output, the
+            // tool is present (exit 2, not 127), and `security` is not an
+            // exit-code sensor — the residual "I don't know" case.
+            throw Object.assign(new Error('failed'), {
+                stdout: '', stderr: 'internal error: rule engine crashed\n', status: 2,
+            });
+        });
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        const security = out.sensors.find((s) => s.name === 'security');
+        expect(security.status).toBe('inconclusive');
+        expect(security.skipReason).toMatch(/exit 2/);
+        expect(out.overall).toBe('not_certified');
+    });
+    it('reports an enabled sensor with no cmd as inconclusive', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
+            pack: 'js-ts',
+            sensors: {
+                typecheck: { cmd: 'npx tsc --noEmit', fast: true },
+                depcheck: { fast: false }, // enabled, but nothing to run
+            },
+        }));
+        mockExecSyncFn.mockReturnValueOnce(''); // typecheck: clean
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        const depcheck = out.sensors.find((s) => s.name === 'depcheck');
+        expect(depcheck.status).toBe('inconclusive');
+        expect(depcheck.skipReason).toBe('no cmd configured');
+        expect(out.overall).toBe('not_certified');
+    });
+    it('reports fail, not not_certified, when something is broken and something could not run', () => {
+        mockExecSyncFn
+            .mockImplementationOnce(() => {
+            throw Object.assign(new Error(), {
+                stdout: 'src/a.ts(1,1): error TS0001: Bad type.', stderr: '', status: 1,
+            });
+        })
+            .mockImplementationOnce(timeoutError); // security: times out
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        expect(out.sensors.find((s) => s.name === 'typecheck').status).toBe('fail');
+        expect(out.sensors.find((s) => s.name === 'security').status).toBe('inconclusive');
+        expect(out.overall).toBe('fail');
+    });
+    it('never emits an overall value outside the published domain', () => {
+        // `inconclusive` is a per-sensor status only. External consumers (the
+        // registry skills) read `overall`, whose domain must not grow — this
+        // pins that invariant at runtime on a three-sensor pass+fail+inconclusive
+        // mix, a combination neither R8 (pass+inconclusive) nor R9
+        // (fail+inconclusive) exercises. R9's own assertion already catches a
+        // fail/inconclusive precedence regression specifically; what this test
+        // adds is runtime coverage of the domain claim itself, on a fixture
+        // neither of those covers — not independent detection of every
+        // aggregation mutation.
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
+            pack: 'js-ts',
+            sensors: {
+                typecheck: { cmd: 'npx tsc --noEmit', fast: true },
+                lint: { cmd: 'npx eslint . --format json', fast: true },
+                security: { cmd: 'semgrep .', fast: false },
+            },
+        }));
+        const DOMAIN = ['pass', 'fail', 'skipped', 'not_certified'];
+        mockExecSyncFn
+            .mockImplementationOnce(() => {
+            throw Object.assign(new Error(), {
+                stdout: 'src/a.ts(1,1): error TS0001: Bad type.', stderr: '', status: 1,
+            });
+        })
+            .mockReturnValueOnce('') // lint: clean → pass
+            .mockImplementationOnce(timeoutError); // security: times out → inconclusive
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        expect(DOMAIN).toContain(out.overall);
+        expect(out.overall).not.toBe('inconclusive');
+    });
+    it('keeps a deliberately disabled sensor apart from one that could not certify', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
+            pack: 'js-ts',
+            sensors: {
+                security: { cmd: 'semgrep .', fast: false },
+                mutation: { cmd: 'npx stryker run', enabled: false },
+            },
+        }));
+        mockExecSyncFn.mockImplementationOnce(timeoutError); // security: times out
+        // mutation: never invoked
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        // Same run, two different meanings — the whole point of the split.
+        expect(out.sensors.find((s) => s.name === 'mutation').status).toBe('skipped');
+        expect(out.sensors.find((s) => s.name === 'mutation').skipReason).toBe('disabled');
+        expect(out.sensors.find((s) => s.name === 'security').status).toBe('inconclusive');
+        expect(out.overall).toBe('not_certified');
+    });
+    it('does not degrade the verdict for a disabled sensor alongside healthy ones', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
+            pack: 'js-ts',
+            sensors: {
+                typecheck: { cmd: 'npx tsc --noEmit', fast: true },
+                mutation: { cmd: 'npx stryker run', enabled: false },
+            },
+        }));
+        mockExecSyncFn.mockReturnValueOnce('');
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        expect(out.overall).toBe('pass');
+    });
+    it('still refuses to certify a tree whose sensors are all disabled', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
+            pack: 'js-ts',
+            sensors: {
+                typecheck: { cmd: 'npx tsc --noEmit', enabled: false },
+                security: { cmd: 'semgrep .', enabled: false },
+            },
+        }));
+        fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), '{}'); // real stack indicator
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        expect(out.sensors.every((s) => s.status === 'skipped')).toBe(true);
+        expect(out.overall).toBe('not_certified');
+        expect(mockExecSyncFn).not.toHaveBeenCalled();
+    });
+    it('leaves an inconclusive result untouched when a baseline is applied', () => {
+        const { writeBaseline } = require('../../../src/commands/sensors/baseline');
+        writeBaseline(root, { security: ['some-accepted-fingerprint'] });
+        mockExecSyncFn
+            .mockReturnValueOnce('')
+            .mockImplementationOnce(timeoutError);
+        const { runSensors } = load();
+        const out = runSensors({ cwd: root });
+        const security = out.sensors.find((s) => s.name === 'security');
+        expect(security.status).toBe('inconclusive');
+        expect(security.baselineCount).toBeUndefined();
+        expect(out.overall).toBe('not_certified');
+    });
+    it('applyBaseline leaves an inconclusive result untouched even if it somehow carried findings', () => {
+        // Every current `inconclusive` producer sets `errors: []`, so a test built
+        // on the public `runSensors()` API can't tell "the explicit guard fired"
+        // apart from "fell through to partition() and incidentally suppressed 0
+        // findings." This unit-tests applyBaseline directly, with a hand-built
+        // result that has `errors` populated, to prove the guard itself — not an
+        // accidental empty-array interaction — is what keeps inconclusive inert.
+        const { applyBaseline } = load();
+        const { buildBaseline } = require('../../../src/commands/sensors/baseline');
+        const result = {
+            name: 'security',
+            status: 'inconclusive',
+            errors: [{ message: 'hypothetical finding that should never be ratcheted', rule: 'some-rule', file: 'src/x.ts' }],
+            skipReason: 'timeout after 10000ms',
+        };
+        // Build a baseline that partition() WOULD genuinely match/suppress for
+        // this exact finding, so the old code (without the inconclusive guard)
+        // would have mutated the result — proving the new guard, not an
+        // incidental "suppressed === 0", is what keeps it untouched.
+        const accepted = buildBaseline([{ name: result.name, errors: result.errors }])[result.name];
+        const out = applyBaseline(result, accepted);
+        expect(out).toBe(result);
+        expect(out.status).toBe('inconclusive');
+        expect(out.baselineCount).toBeUndefined();
+    });
+});

package/dist/tests/commands/sensors/run-tool-missing.test.js

@@ -0,0 +1,69 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const run_1 = require("../../../src/commands/sensors/run");
+/**
+ * These tests deliberately do NOT mock `child_process`: the defect they pin only
+ * exists against a real shell. On Debian/Ubuntu `/bin/sh` is dash, which writes
+ * `not found` — not bash's `command not found` — so a string-matching heuristic
+ * reads a missing binary as a benign skip. What is being fixed here is the
+ * invariant "a tool that could not run is never green", NOT the wording of any
+ * particular shell, so no assertion below matches shell text.
+ *
+ * The sensor is named `security` on purpose. Sensors with a structured formatter
+ * (semgrep/tsc/eslint) return zero findings for unparseable shell noise and fall
+ * through to the tool-missing branch; a sensor with the generic formatter turns
+ * any stderr into a finding and never reaches it.
+ */
+const MISSING_BIN = 'awm-nonexistent-binary-xyz';
+function mkProject(sensors) {
+    const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-tool-missing-'));
+    fs_1.default.mkdirSync(path_1.default.join(root, '.awm'));
+    fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({ pack: 'js-ts', sensors }));
+    return root;
+}
+describe('runSensors — an absent tool never reads as green (real /bin/sh)', () => {
+    const roots = [];
+    afterAll(() => { for (const r of roots)
+        fs_1.default.rmSync(r, { recursive: true, force: true }); });
+    const project = (sensors) => {
+        const root = mkProject(sensors);
+        roots.push(root);
+        return root;
+    };
+    it('marks a sensor whose binary is absent as fail, not skipped', () => {
+        const root = project({ security: { cmd: `${MISSING_BIN} .`, fast: true } });
+        const out = (0, run_1.runSensors)({ cwd: root });
+        const security = out.sensors.find(s => s.name === 'security');
+        expect(security.status).toBe('fail');
+        expect(security.errors[0].message).toMatch(/not available/i);
+    });
+    it('does not let a healthy sensor carry the run to pass while another tool is absent', () => {
+        const root = project({
+            typecheck: { cmd: 'node -e ""', fast: true },
+            security: { cmd: `${MISSING_BIN} .`, fast: true },
+        });
+        const out = (0, run_1.runSensors)({ cwd: root });
+        expect(out.sensors.find(s => s.name === 'typecheck').status).toBe('pass');
+        expect(out.overall).toBe('fail');
+    });
+    it('does not misread a tool that ran and merely printed "not found" as an absent tool', () => {
+        // Exits 1, not 127: the binary existed and reported something of its own.
+        // Classifying this as a missing tool would be a false accusation. It also
+        // must not read as a benign 'skipped': the formatter parsed no findings
+        // from a genuine non-zero exit, which is the residual "I don't know" case
+        // (Task 3) — 'inconclusive', not 'fail' and not 'skipped'.
+        const root = project({
+            security: { cmd: `node -e "console.error('rule pack not found'); process.exit(1)"`, fast: true },
+        });
+        const out = (0, run_1.runSensors)({ cwd: root });
+        const security = out.sensors.find(s => s.name === 'security');
+        expect(security.status).toBe('inconclusive');
+        expect(security.errors).toEqual([]);
+    });
+});

package/dist/tests/commands/sensors/run.test.js

@@ -68,13 +68,13 @@ describe('runSensors', () => {
         expect(tc.status).toBe('fail');
         expect(tc.errors[0].message).toMatch('SENSOR[typecheck]');
     });
-    it('marks sensor as skipped on timeout', () => {
+    it('marks sensor as inconclusive on timeout', () => {
         mockExecSyncFn.mockImplementationOnce(() => { throw Object.assign(new Error('killed'), { code: 'ETIMEDOUT' }); });
         mockExecSyncFn.mockReturnValueOnce('');
         const { runSensors } = load();
         const result = runSensors({ fast: true, cwd: tmpDir });
         const tc = result.sensors.find((s) => s.name === 'typecheck');
-        expect(tc.status).toBe('skipped');
+        expect(tc.status).toBe('inconclusive');
         expect(tc.skipReason).toMatch('timeout');
     });
     it('skips disabled sensors', () => {
@@ -134,26 +134,34 @@ describe('runSensors — missing tool is a fail, not a skip', () => {
     });
     beforeEach(() => {
         mockExecSyncFn.mockReset();
-        // Simulate shell exit 127 "command not found" — matches what Node's execSync
-        // captures in err.stderr when the binary does not exist on PATH.
+        // What Node's execSync actually throws when the binary is absent and `/bin/sh`
+        // is dash (Debian/Ubuntu, hence most CI runners): status 127, `not found`
+        // rather than bash's `command not found`, and no `code` — ENOENT is set only
+        // when spawning the shell itself fails, not the command inside it.
         mockExecSyncFn.mockImplementation(() => {
-            throw Object.assign(new Error('Command failed: awm-nonexistent-binary-xyz --check'), {
+            throw Object.assign(new Error('Command failed: awm-nonexistent-binary-xyz .'), {
                 stdout: '',
-                stderr: '/bin/sh: awm-nonexistent-binary-xyz: command not found\n',
+                stderr: '/bin/sh: 1: awm-nonexistent-binary-xyz: not found\n',
                 status: 127,
             });
         });
     });
+    // The sensor is named `security` so it uses the semgrep formatter, which returns
+    // zero findings for unparseable shell noise and lets execution reach the
+    // tool-missing branch. Under the generic formatter any stderr becomes a finding,
+    // so a sensor named `ghost` would report `fail` without that branch ever running —
+    // green for a reason unrelated to what this test claims to cover.
     it('marks a sensor whose binary is missing as fail', () => {
         root = mkTmp();
         fs_1.default.mkdirSync(path_1.default.join(root, '.awm'));
         fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
-            pack: 'test',
-            sensors: { ghost: { cmd: 'awm-nonexistent-binary-xyz --check', fast: true } },
+            pack: 'js-ts',
+            sensors: { security: { cmd: 'awm-nonexistent-binary-xyz .', fast: true } },
         }));
         const out = (0, run_1.runSensors)({ cwd: root });
-        const ghost = out.sensors.find((s) => s.name === 'ghost');
-        expect(ghost?.status).toBe('fail');
+        const security = out.sensors.find((s) => s.name === 'security');
+        expect(security?.status).toBe('fail');
+        expect(security?.errors[0].message).toMatch(/not available/i);
         expect(out.overall).toBe('fail');
     });
 });

package/dist/tests/core/init/steps-registry-sync.test.js

@@ -0,0 +1,109 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// stepCache vs. syncRegistries()'s RESULT-shaped failures.
+//
+// `syncRegistries()` never throws on a per-registry failure — it returns
+// `{ action: 'error', error }` for that registry and keeps going. stepCache
+// used to `await` it and report a blanket 'applied', so a registry that never
+// landed on disk degraded silently into some later step's failure with its own
+// cause already gone.
+//
+// Isolated in its own file (not steps.test.ts) because these assertions reach
+// `listRegistries()`, which resolves AWM_HOME at module require time — the env
+// override therefore has to happen before the module is required, which means
+// `jest.resetModules()` + `require`, not a static import.
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+describe('stepCache — registry sync error results', () => {
+    let tmpHome;
+    let originalHome;
+    let originalAwmHome;
+    beforeEach(() => {
+        tmpHome = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-stepcache-'));
+        originalHome = process.env.HOME;
+        originalAwmHome = process.env.AWM_HOME;
+        process.env.HOME = tmpHome;
+        process.env.AWM_HOME = path_1.default.join(tmpHome, '.awm');
+        jest.resetModules();
+    });
+    afterEach(() => {
+        fs_1.default.rmSync(tmpHome, { recursive: true, force: true });
+        if (originalHome === undefined)
+            delete process.env.HOME;
+        else
+            process.env.HOME = originalHome;
+        if (originalAwmHome === undefined)
+            delete process.env.AWM_HOME;
+        else
+            process.env.AWM_HOME = originalAwmHome;
+    });
+    const awmHome = () => process.env.AWM_HOME;
+    /** Declares `names` in registries.json; creates a content root only for `withContent`. */
+    function configureRegistries(names, withContent) {
+        fs_1.default.mkdirSync(awmHome(), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(awmHome(), 'registries.json'), JSON.stringify(names.map((name) => ({ name, remote: `https://example.com/${name}.git` })), null, 2));
+        for (const name of withContent) {
+            const skills = path_1.default.join(awmHome(), 'registries', name, 'skills');
+            fs_1.default.mkdirSync(skills, { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(skills, 'placeholder.md'), '# placeholder\n');
+        }
+    }
+    /** InitDeps just complete enough for stepCache: a machine with no registry cache yet. */
+    function deps(results) {
+        const ctx = {
+            machine: {
+                registryCache: { present: false },
+                hook: { present: true, degraded: false },
+                devCore: { present: true, brokenLinks: [] },
+                ambient: { wanted: [], installed: [] },
+                contextInjection: [],
+                globalSkills: { valid: [], repairable: [], dead: [] },
+            },
+            project: null,
+        };
+        const actions = { syncCache: async () => results };
+        return {
+            cwd: tmpHome, ctx, bundles: [], agent: 'claude-code', enabledAgents: ['claude-code'],
+            installMethod: 'symlink', registryRoot: '', contentDir: '', sensorPacksRoot: '',
+            confirmExtensions: async (p) => p, actions,
+        };
+    }
+    async function run(results) {
+        const { stepCache } = require('../../../src/core/init/steps');
+        return stepCache(deps(results));
+    }
+    it('fails, naming the registry, when a sync error left no content on disk', async () => {
+        configureRegistries(['baseline'], []);
+        const r = await run([{ name: 'baseline', action: 'error', error: 'could not clone' }]);
+        expect(r.action).toBe('failed');
+        expect(r.error).toContain('baseline');
+        expect(r.error).toContain('could not clone');
+    });
+    it('stays applied but records the error when content is already on disk', async () => {
+        configureRegistries(['baseline'], ['baseline']);
+        const r = await run([{ name: 'baseline', action: 'error', error: 'pull timed out' }]);
+        expect(r.action).toBe('applied');
+        expect(r.detail).toContain('baseline');
+        expect(r.detail).toContain('pull timed out');
+    });
+    it('fails on a secondary registry that never landed, even when the base one synced', async () => {
+        configureRegistries(['baseline', 'documentation'], ['baseline']);
+        const r = await run([
+            { name: 'baseline', action: 'pulled', version: 'v1.0.0' },
+            { name: 'documentation', action: 'error', error: 'host unreachable' },
+        ]);
+        expect(r.action).toBe('failed');
+        expect(r.error).toContain('documentation');
+        expect(r.error).not.toContain('baseline');
+    });
+    it('reports applied with no detail when every registry synced', async () => {
+        configureRegistries(['baseline'], ['baseline']);
+        const r = await run([{ name: 'baseline', action: 'pulled', version: 'v1.0.0' }]);
+        expect(r.action).toBe('applied');
+        expect(r.detail).toBeUndefined();
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "3.2.2",
+  "version": "3.3.1",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"