agentic-workflow-manager 6.5.1 → 8.0.0

package/dist/tests/commands/sensors/compatibility/discovery.test.js

@@ -0,0 +1,119 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const discovery_1 = require("../../../../src/commands/sensors/compatibility/discovery");
+describe('discoverProjectEvidence', () => {
+    it('returns only local, relative project evidence and detects conflicting lockfiles', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-discovery-'));
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), JSON.stringify({ scripts: { lint: 'eslint .' }, devDependencies: { eslint: '10.0.0' } }));
+            fs_1.default.writeFileSync(path_1.default.join(root, 'package-lock.json'), '{}');
+            fs_1.default.writeFileSync(path_1.default.join(root, 'pnpm-lock.yaml'), 'lockfileVersion: 9');
+            fs_1.default.writeFileSync(path_1.default.join(root, 'eslint.config.js'), 'export default []');
+            fs_1.default.mkdirSync(path_1.default.join(root, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(root, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ name: 'eslint', version: '10.4.1' }));
+            const evidence = (0, discovery_1.discoverProjectEvidence)(root, { schemaVersion: 2, name: 'js-ts', detects: ['package.json'], sensors: { lint: { applicability: { allFiles: ['package.json'] }, variants: [{ requirements: { tool: 'eslint', configFiles: [] } }] } } }, { platform: () => 'darwin' });
+            expect(evidence.packageManagerConflict).toBe(true);
+            expect(evidence.os).toBe('darwin');
+            expect(evidence.declaredToolRanges.eslint).toBe('10.0.0');
+            expect(evidence.toolVersions.eslint).toBe('10.4.1');
+            expect(evidence.scripts).toContain('lint');
+            expect(evidence.configFiles).toContain('eslint.config.js');
+            expect(evidence.paths.every((item) => !path_1.default.isAbsolute(item) && !item.includes('..'))).toBe(true);
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('includes pack and applicability markers when deciding whether a sensor applies', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-discovery-markers-'));
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(root, 'pack-marker'), 'present');
+            fs_1.default.writeFileSync(path_1.default.join(root, 'sensor-marker'), 'present');
+            fs_1.default.writeFileSync(path_1.default.join(root, 'one-of-these'), 'present');
+            const evidence = (0, discovery_1.discoverProjectEvidence)(root, {
+                schemaVersion: 2,
+                name: 'custom',
+                detects: ['pack-marker'],
+                sensors: {
+                    lint: {
+                        applicability: { allFiles: ['sensor-marker'], anyFiles: ['one-of-these', 'missing-marker'] },
+                        variants: [{ requirements: { tool: 'eslint', configFiles: [] } }],
+                    },
+                },
+            });
+            expect(evidence.paths).toEqual(expect.arrayContaining(['pack-marker', 'sensor-marker', 'one-of-these']));
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('does not report package.json as evidence when the project has none', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-discovery-no-package-'));
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(root, 'pyproject.toml'), '[project]\nname = "sample"');
+            const evidence = (0, discovery_1.discoverProjectEvidence)(root, {
+                schemaVersion: 2,
+                name: 'python',
+                detects: ['pyproject.toml'],
+                sensors: {
+                    lint: { applicability: { allFiles: ['package.json'] }, variants: [{ requirements: { tool: 'ruff', configFiles: [] } }] },
+                },
+            });
+            expect(evidence.paths).not.toContain('package.json');
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    test.each([
+        ['linux', ['.venv', 'lib', 'python3.12', 'site-packages']],
+        ['win32', ['.venv', 'Lib', 'site-packages']],
+    ])('discovers exact local Python runtime and tool metadata on %s', (targetPlatform, sitePackages) => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-discovery-'));
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(root, ...sitePackages), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(root, '.venv', 'pyvenv.cfg'), 'version = 3.12.4\n');
+            for (const [tool, version] of Object.entries({ mypy: '1.11.2', ruff: '0.6.9', pytest: '8.3.3', semgrep: '1.91.0' })) {
+                const info = path_1.default.join(root, ...sitePackages, `${tool}-${version}.dist-info`);
+                fs_1.default.mkdirSync(info);
+                fs_1.default.writeFileSync(path_1.default.join(info, 'METADATA'), `Metadata-Version: 2.3\nName: ${tool}\nVersion: ${version}\n`);
+            }
+            const pack = { schemaVersion: 2, name: 'python', detects: ['pyproject.toml'], sensors: {
+                    quality: { applicability: { allFiles: ['pyproject.toml'] }, variants: Object.keys({ mypy: 0, ruff: 0, pytest: 0, semgrep: 0 }).map(tool => ({ requirements: { tool, runtime: 'python', configFiles: [] } })) },
+                } };
+            fs_1.default.writeFileSync(path_1.default.join(root, 'pyproject.toml'), '[project]\nname = "sample"');
+            const evidence = (0, discovery_1.discoverProjectEvidence)(root, pack, { platform: () => targetPlatform });
+            expect(evidence.runtimeVersions.python).toBe('3.12.4');
+            expect(evidence.toolVersions).toMatchObject({ mypy: '1.11.2', ruff: '0.6.9', pytest: '8.3.3', semgrep: '1.91.0' });
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('does not trust missing or escaping Python environment metadata', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-discovery-untrusted-'));
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-discovery-outside-'));
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(root, '.venv', 'lib', 'python3.12', 'site-packages'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(root, '.venv', 'pyvenv.cfg'), 'version = not-a-version\n');
+            const escaped = path_1.default.join(root, '.venv', 'lib', 'python3.12', 'site-packages', 'ruff-0.6.9.dist-info');
+            fs_1.default.mkdirSync(path_1.default.join(outside, 'ruff-0.6.9.dist-info'));
+            fs_1.default.writeFileSync(path_1.default.join(outside, 'ruff-0.6.9.dist-info', 'METADATA'), 'Name: ruff\nVersion: 0.6.9\n');
+            fs_1.default.symlinkSync(path_1.default.join(outside, 'ruff-0.6.9.dist-info'), escaped, 'dir');
+            const pack = { schemaVersion: 2, name: 'python', detects: [], sensors: { lint: { applicability: {}, variants: [{ requirements: { tool: 'ruff', runtime: 'python', configFiles: [] } }] } } };
+            const evidence = (0, discovery_1.discoverProjectEvidence)(root, pack, { platform: () => 'linux' });
+            expect(evidence.runtimeVersions.python).toBeNull();
+            expect(evidence.toolVersions.ruff).toBeNull();
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/commands/sensors/compatibility/manifest.test.js

@@ -0,0 +1,68 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const manifest_1 = require("../../../../src/commands/sensors/compatibility/manifest");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+describe('sensor manifest contract', () => {
+    it('keeps compatibility contracts on an acyclic import boundary', () => {
+        const source = (relative) => fs_1.default.readFileSync(path_1.default.join(__dirname, '../../../../src/commands/sensors', relative), 'utf8');
+        expect(source('types.ts')).not.toContain('./compatibility/');
+        expect(source('compatibility/types.ts')).not.toContain('../coverage/');
+        expect(source('coverage/contract.ts')).not.toContain('../compatibility/manifest');
+    });
+    it('normalizes a legacy string command with compatible-unverified evidence', () => {
+        expect((0, manifest_1.parseSensorManifest)({ pack: 'js-ts', sensors: { lint: 'npm run lint' } }, 'sensors.json')).toMatchObject({ kind: 'legacy', pack: {
+                pack: 'js-ts',
+                sensors: { lint: { cmd: 'npm run lint' } },
+                compatibility: (0, manifest_1.legacyCompatibility)(),
+            } });
+    });
+    it('accepts a v2 selected variant and structured command', () => {
+        const manifest = {
+            schemaVersion: 2,
+            pack: 'js-ts',
+            sensors: {
+                lint: {
+                    enabled: true, variantId: 'eslint-9',
+                    command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.', '--format', 'json'] },
+                    initializedCompatibility: { state: 'certified', reason: 'range-and-probe', variantId: 'eslint-9', toolVersion: '9.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] },
+                },
+            },
+        };
+        expect((0, manifest_1.parseSensorManifest)(manifest, 'sensors.json')).toMatchObject({ kind: 'v2', pack: manifest });
+        expect(JSON.parse((0, manifest_1.serializeManifestV2)(manifest))).toEqual(manifest);
+    });
+    it('accepts optional contained assets and rejects traversal', () => {
+        const sensor = { enabled: true, variantId: 'eslint-9', assets: ['eslint.config.awm.mjs'], command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, initializedCompatibility: { state: 'certified', reason: 'ok', variantId: 'eslint-9', toolVersion: '9.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] } };
+        expect((0, manifest_1.parseSensorManifest)({ schemaVersion: 2, pack: 'js-ts', sensors: { lint: sensor } }, 'sensors.json')).toMatchObject({ kind: 'v2' });
+        expect(() => (0, manifest_1.parseSensorManifest)({ schemaVersion: 2, pack: 'js-ts', sensors: { lint: { ...sensor, assets: ['C:/secret'] } } }, 'sensors.json')).toThrow('asset');
+    });
+    it('rejects mismatched compatibility variant and hostile source labels', () => {
+        const sensor = { enabled: true, variantId: 'eslint-9', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, initializedCompatibility: { state: 'certified', reason: 'ok', variantId: 'other', toolVersion: '9.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] } };
+        expect(() => (0, manifest_1.parseSensorManifest)({ schemaVersion: 2, pack: 'js-ts', sensors: { lint: sensor } }, { path: 'bad' })).toThrow('<unknown source>');
+        expect(() => (0, manifest_1.parseSensorManifest)({ schemaVersion: 2, pack: 'js-ts', sensors: { lint: sensor } }, 'source\nleak')).toThrow('<unknown source>');
+    });
+    it('rejects invalid semver evidence independently', () => {
+        const sensor = { enabled: true, variantId: 'eslint-9', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, initializedCompatibility: { state: 'certified', reason: 'ok', variantId: 'eslint-9', toolVersion: 'bad', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] } };
+        expect(() => (0, manifest_1.parseSensorManifest)({ schemaVersion: 2, pack: 'js-ts', sensors: { lint: sensor } }, 'source')).toThrow('toolVersion');
+    });
+    it('rejects certified evidence without a selected variant', () => {
+        const sensor = { enabled: true, variantId: 'eslint-9', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, initializedCompatibility: { state: 'certified', reason: 'ok', variantId: null, toolVersion: '9.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] } };
+        expect(() => (0, manifest_1.parseSensorManifest)({ schemaVersion: 2, pack: 'js-ts', sensors: { lint: sensor } }, 'source')).toThrow('variantId');
+    });
+    it('rejects a certified tool version outside its certified range', () => {
+        const sensor = { enabled: true, variantId: 'eslint-9', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, initializedCompatibility: { state: 'certified', reason: 'ok', variantId: 'eslint-9', toolVersion: '10.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] } };
+        expect(() => (0, manifest_1.parseSensorManifest)({ schemaVersion: 2, pack: 'js-ts', sensors: { lint: sensor } }, 'source')).toThrow('certifiedRange');
+    });
+    test.each([
+        [null, 'object'],
+        [{}, 'pack'],
+        [{ schemaVersion: 3, pack: 'js-ts', sensors: {} }, 'schemaVersion'],
+        [{ schemaVersion: 2, pack: 'js-ts', sensors: { lint: { variantId: 'eslint-9', command: { executable: 'eslint', resolution: 'path', args: [] } } } }, 'enabled'],
+    ])('rejects malformed manifest %j', (input, message) => {
+        expect(() => (0, manifest_1.parseSensorManifest)(input, 'sensors.json')).toThrow(message);
+    });
+});

package/dist/tests/commands/sensors/compatibility/materialize.test.js

@@ -0,0 +1,53 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const materialize_1 = require("../../../../src/commands/sensors/compatibility/materialize");
+const evidence = { state: 'certified', reason: 'range-and-probe', variantId: 'eslint-10', toolVersion: '10.0.0', runtimeVersion: '22.0.0', certifiedRange: '>=10 <11', evidence: [] };
+describe('materializeResolvedSensors', () => {
+    let projectRoot;
+    let packRoot;
+    beforeEach(() => {
+        projectRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-project-'));
+        packRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-materialize-pack-'));
+        fs_1.default.writeFileSync(path_1.default.join(packRoot, 'eslint.config.awm.mjs'), 'export default [];');
+        fs_1.default.writeFileSync(path_1.default.join(packRoot, 'tsconfig.awm.json'), '{}');
+    });
+    afterEach(() => {
+        fs_1.default.rmSync(projectRoot, { recursive: true, force: true });
+        fs_1.default.rmSync(packRoot, { recursive: true, force: true });
+    });
+    it('copies only selected assets and writes a v2 manifest atomically', () => {
+        const result = (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } });
+        expect(result.configured).toEqual(['eslint.config.awm.mjs']);
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'tsconfig.awm.json'))).toBe(false);
+        expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'), 'utf8'))).toMatchObject({ schemaVersion: 2, sensors: { lint: { variantId: 'eslint-10' } } });
+        expect(fs_1.default.readdirSync(path_1.default.join(projectRoot, '.awm'))).not.toContain('sensors.json.tmp');
+    });
+    it('preserves a destination that already exists', () => {
+        fs_1.default.writeFileSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'), 'owner content');
+        const result = (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } });
+        expect(result.preserved).toEqual(['eslint.config.awm.mjs']);
+        expect(fs_1.default.readFileSync(path_1.default.join(projectRoot, 'eslint.config.awm.mjs'), 'utf8')).toBe('owner content');
+    });
+    it('reports previous AWM assets as orphaned and never deletes them', () => {
+        fs_1.default.mkdirSync(path_1.default.join(projectRoot, '.awm'));
+        fs_1.default.writeFileSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'), JSON.stringify({ schemaVersion: 2, pack: 'js-ts', sensors: {
+                lint: { enabled: true, variantId: 'old', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.cjs'], initializedCompatibility: { ...evidence, variantId: 'old' } },
+            } }));
+        fs_1.default.writeFileSync(path_1.default.join(projectRoot, 'eslint.config.awm.cjs'), 'old');
+        const result = (0, materialize_1.materializeResolvedSensors)({ projectRoot, packRoot, pack: 'js-ts', sensors: {
+                lint: { enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: ['eslint.config.awm.mjs'], initializedCompatibility: evidence },
+            } });
+        expect(result.orphaned).toEqual(['eslint.config.awm.cjs']);
+        expect(fs_1.default.existsSync(path_1.default.join(projectRoot, 'eslint.config.awm.cjs'))).toBe(true);
+    });
+});

package/dist/tests/commands/sensors/compatibility/pack-source.test.js

@@ -0,0 +1,55 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const pack_source_1 = require("../../../../src/commands/sensors/compatibility/pack-source");
+describe('resolvePackSource', () => {
+    it('uses the first registry containing the exact contained pack file', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-'));
+        try {
+            const first = path_1.default.join(root, 'first');
+            const second = path_1.default.join(root, 'second');
+            for (const registry of [first, second])
+                fs_1.default.mkdirSync(path_1.default.join(registry, 'sensor-packs', 'js-ts'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(first, 'sensor-packs', 'js-ts', 'pack.json'), '{"from":"first"}');
+            fs_1.default.writeFileSync(path_1.default.join(second, 'sensor-packs', 'js-ts', 'pack.json'), '{"from":"second"}');
+            expect((0, pack_source_1.resolvePackSource)('js-ts', { registries: [{ name: 'first', remote: '', contentRoot: first }, { name: 'second', remote: '', contentRoot: second }] }).content).toContain('first');
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('rejects symlink, non-regular, and escaping pack sources', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-bad-'));
+        try {
+            const packs = path_1.default.join(root, 'sensor-packs');
+            fs_1.default.mkdirSync(packs, { recursive: true });
+            fs_1.default.symlinkSync(path_1.default.join(root, 'outside.json'), path_1.default.join(packs, 'js-ts'));
+            fs_1.default.writeFileSync(path_1.default.join(root, 'outside.json'), '{}');
+            expect(() => (0, pack_source_1.resolvePackSource)('js-ts', { registries: [{ name: 'bad', remote: '', contentRoot: root }] })).toThrow(/symbolic|contain/i);
+            expect(() => (0, pack_source_1.resolvePackSource)('../escape', { registries: [] })).toThrow(/pack/i);
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('rejects a symlinked pack directory even when its target remains inside the registry', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-internal-link-'));
+        try {
+            const packRoot = path_1.default.join(root, 'sensor-packs');
+            const target = path_1.default.join(packRoot, 'js-ts-source');
+            fs_1.default.mkdirSync(target, { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(target, 'pack.json'), '{}');
+            fs_1.default.symlinkSync(target, path_1.default.join(packRoot, 'js-ts'), 'dir');
+            expect(() => (0, pack_source_1.resolvePackSource)('js-ts', { registries: [{ name: 'linked', remote: '', contentRoot: root }] }))
+                .toThrow(/symbolic|symlink/i);
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/commands/sensors/compatibility/probe.test.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const probe_1 = require("../../../../src/commands/sensors/compatibility/probe");
+const fakeExecutor = jest.fn(async () => ({ code: 0, signal: null, timedOut: false, overflowed: false, stdout: 'SECRET_VALUE\nmatched', stderr: '' }));
+const evidence = { cwd: process.cwd(), configFiles: ['eslint.config.js'], scripts: ['lint'] };
+describe('runCompatibilityProbe', () => {
+    beforeEach(() => fakeExecutor.mockClear());
+    test.each(['eslint-print-config', 'typescript-show-config', 'semgrep-validate', 'version', 'package-script-present', 'config-present'])('runs the closed probe %s with sanitized output', async (kind) => {
+        const result = await (0, probe_1.runCompatibilityProbe)({ kind }, evidence, fakeExecutor);
+        expect(['matched', 'unverifiable']).toContain(result.status);
+        expect(JSON.stringify(result)).not.toContain('SECRET_VALUE');
+    });
+    it('never treats a timeout or overflow as a match', async () => {
+        fakeExecutor.mockResolvedValueOnce({ code: null, signal: 'SIGKILL', timedOut: true, overflowed: false, stdout: '', stderr: '' });
+        await expect((0, probe_1.runCompatibilityProbe)({ kind: 'version' }, evidence, fakeExecutor)).resolves.toMatchObject({ status: 'unverifiable' });
+        fakeExecutor.mockResolvedValueOnce({ code: 0, signal: null, timedOut: false, overflowed: true, stdout: 'ok', stderr: '' });
+        await expect((0, probe_1.runCompatibilityProbe)({ kind: 'version' }, evidence, fakeExecutor)).resolves.toMatchObject({ status: 'unverifiable' });
+    });
+    it('binds tool probes to the project node_modules executable instead of PATH', async () => {
+        await (0, probe_1.runCompatibilityProbe)({ kind: 'eslint-print-config' }, evidence, fakeExecutor);
+        expect(fakeExecutor).toHaveBeenCalledWith(expect.objectContaining({ executable: 'eslint', resolution: 'node-modules-bin' }), expect.any(Object));
+    });
+    it('binds Semgrep validation to the contained Python environment', async () => {
+        await (0, probe_1.runCompatibilityProbe)({ kind: 'semgrep-validate' }, evidence, fakeExecutor);
+        expect(fakeExecutor).toHaveBeenCalledWith(expect.objectContaining({ executable: 'semgrep', resolution: 'python-environment' }), expect.any(Object));
+    });
+});

package/dist/tests/commands/sensors/compatibility/resolve.test.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const resolve_1 = require("../../../../src/commands/sensors/compatibility/resolve");
+const manifest_1 = require("../../../../src/commands/sensors/compatibility/manifest");
+const variant = (id, priority = 10, toolRange = '>=9 <12', certifiedRange = '>=10 <11') => ({
+    id, priority, certifiedRange,
+    requirements: { tool: 'eslint', toolRange, runtime: 'node', runtimeRange: '>=20' },
+    assets: [], formatter: 'eslint', probe: { kind: 'version' },
+    command: { executable: 'eslint', resolution: 'path', args: ['--version'] },
+});
+const sensor = { applicability: { allFiles: ['package.json'] }, variants: [variant('eslint-main')] };
+const evidence = (input = {}) => ({ paths: ['package.json'], applicable: true, packageManagerConflict: false, toolVersion: '10.4.1', runtimeVersion: '22.0.0', probe: { status: 'matched' }, ...input });
+const context = { pack: 'js-ts', sensor: 'lint' };
+describe('resolveSensorCompatibility', () => {
+    test.each([
+        ['certified', evidence(), 'eslint-main'],
+        ['compatible-unverified', evidence({ toolVersion: '11.0.0' }), 'eslint-main'],
+        ['incompatible', evidence({ toolVersion: '8.0.0' }), null],
+        ['missing-tool', evidence({ toolVersion: null }), null],
+        ['unverifiable', evidence({ probe: { status: 'unverifiable' } }), 'eslint-main'],
+        ['not-applicable', evidence({ applicable: false, paths: [] }), null],
+    ])('resolves %s without conflating states', (state, discovered, variantId) => {
+        expect((0, resolve_1.resolveSensorCompatibility)(sensor, discovered, context)).toMatchObject({ state, variantId });
+    });
+    it('preserves legacy behavior without executing a probe', () => {
+        expect((0, resolve_1.resolveSensorCompatibility)({ defaultCmd: 'eslint .' }, evidence(), context)).toEqual((0, manifest_1.legacyCompatibility)('legacy pack without schemaVersion'));
+    });
+    it('fails an equal-precedence match with its pack, sensor, IDs, and ranges', () => {
+        expect(() => (0, resolve_1.resolveProjectCompatibility)({ schemaVersion: 2, name: 'js-ts', sensors: { lint: { ...sensor, variants: [variant('one'), variant('two')] } } }, evidence())).toThrow(/js-ts.*lint.*one.*>=9 <12.*two.*>=9 <12/i);
+    });
+    it('requires a real pack and sensor identity for direct resolution', () => {
+        expect(() => (0, resolve_1.resolveSensorCompatibility)(sensor, evidence(), undefined)).toThrow(/pack and sensor identity are required/i);
+    });
+    it('reports lockfile conflicts as unverifiable', () => {
+        expect((0, resolve_1.resolveSensorCompatibility)(sensor, evidence({ packageManagerConflict: true }), context)).toMatchObject({ state: 'unverifiable', reason: 'package-manager-conflict' });
+    });
+    it('selects an operational variant when another tool variant is absent locally', () => {
+        const variants = [
+            { ...variant('eslint'), requirements: { ...variant('eslint').requirements, tool: 'eslint' } },
+            { ...variant('biome'), requirements: { ...variant('biome').requirements, tool: 'biome' } },
+        ];
+        const resolved = (0, resolve_1.resolveSensorCompatibility)({ applicability: { allFiles: ['package.json'] }, variants }, evidence({ toolVersions: { eslint: '10.4.1', biome: null }, runtimeVersions: { node: '22.0.0' }, toolVersion: '8.0.0', runtimeVersion: '8.0.0' }), context);
+        expect(resolved).toMatchObject({ state: 'certified', variantId: 'eslint', toolVersion: '10.4.1', runtimeVersion: '22.0.0' });
+    });
+    it('does not reuse scalar evidence for a missing key in a version map', () => {
+        const biome = { ...variant('biome'), requirements: { ...variant('biome').requirements, tool: 'biome', runtime: 'bun' } };
+        expect((0, resolve_1.resolveSensorCompatibility)({ applicability: { allFiles: ['package.json'] }, variants: [biome] }, evidence({ toolVersions: { biome: null }, runtimeVersions: { bun: null }, toolVersion: '10.4.1', runtimeVersion: '22.0.0' }), context))
+            .toMatchObject({ state: 'missing-tool' });
+    });
+    it('carries bounded, sanitized evidence without raw probe output', () => {
+        const resolved = (0, resolve_1.resolveSensorCompatibility)(sensor, evidence({ paths: ['package.json', '../SECRET_VALUE'], probe: { status: 'matched', output: 'SECRET_VALUE' } }), context);
+        expect(resolved.evidence).toEqual(expect.arrayContaining([{ kind: 'project-path', status: 'present', path: 'package.json' }, { kind: 'probe', status: 'matched' }]));
+        expect(JSON.stringify(resolved)).not.toContain('SECRET_VALUE');
+    });
+    test.each(['linux', 'darwin', 'win32'])('resolves the six states under controlled %s evidence', (os) => {
+        const states = [
+            (0, resolve_1.resolveSensorCompatibility)(sensor, evidence({ os }), context),
+            (0, resolve_1.resolveSensorCompatibility)(sensor, evidence({ os, toolVersion: '11.0.0' }), context),
+            (0, resolve_1.resolveSensorCompatibility)(sensor, evidence({ os, toolVersion: '8.0.0' }), context),
+            (0, resolve_1.resolveSensorCompatibility)(sensor, evidence({ os, toolVersion: null }), context),
+            (0, resolve_1.resolveSensorCompatibility)(sensor, evidence({ os, probe: { status: 'unverifiable' } }), context),
+            (0, resolve_1.resolveSensorCompatibility)(sensor, evidence({ os, applicable: false, paths: [] }), context),
+        ].map(result => result.state);
+        expect(states).toEqual(['certified', 'compatible-unverified', 'incompatible', 'missing-tool', 'unverifiable', 'not-applicable']);
+    });
+    test.each(['linux', 'darwin', 'win32'])('keeps applicability and deterministic precedence above version resolution on %s', (os) => {
+        const broad = variant('broad', 10, '>=9 <12');
+        const narrow = variant('narrow', 10, '>=10 <11');
+        const precedenceSensor = { applicability: { allFiles: ['package.json'] }, variants: [broad, narrow] };
+        expect((0, resolve_1.resolveSensorCompatibility)(precedenceSensor, evidence({ os, packageManagerConflict: true, applicable: false, paths: [] }), context))
+            .toMatchObject({ state: 'not-applicable', reason: 'applicability-not-met' });
+        expect((0, resolve_1.resolveSensorCompatibility)(precedenceSensor, evidence({ os }), context)).toMatchObject({ variantId: 'narrow' });
+        expect(() => (0, resolve_1.resolveSensorCompatibility)({ ...precedenceSensor, variants: [variant('a'), variant('b')] }, evidence({ os }), context)).toThrow(/ambiguous/i);
+    });
+});

package/dist/tests/commands/sensors/coverage/contract.test.js

@@ -12,7 +12,7 @@ describe('coverage contract v1', () => {
                             sensor: 'contract-test',
                             evidence: {
                                 commandIncludes: ['coverage'],
-                                files: [{ path: 'contract.ts', containsAll: ['parseCoverageContract'] }],
+                                files: [{ path: 'eslint.config.awm.mjs', containsAll: ['parseCoverageContract'] }],
                             },
                         }],
                     remedy: { summary: 'Add a parser.', command: 'npm test -- contract.test.ts' },
@@ -32,7 +32,7 @@ describe('coverage contract v1', () => {
     ])('rejects malformed contract %j', (input, message) => {
         expect(() => (0, contract_1.parseCoverageContract)(input, 'coverage.json')).toThrow(message);
     });
-    test.each(['', '.', '..', 'a..b', '../secret', 'a/../../secret', '/etc/passwd', 'C:\\secret', 'a\\..\\secret', ' report.txt', 'report!.txt', 'ñ.txt', '.env', '.gitignore'])('rejects hostile evidence path %p', (path) => {
+    test.each(['', '.', '..', 'a..b', '../secret', 'a/../../secret', '/etc/passwd', 'C:\\secret', 'a\\..\\secret', ' report.txt', 'report!.txt', 'ñ.txt', '.env', '.gitignore', 'secrets.txt', 'id_rsa'])('rejects hostile evidence path %p', (path) => {
         const input = {
             schemaVersion: 1,
             classes: {
@@ -45,7 +45,17 @@ describe('coverage contract v1', () => {
         };
         expect(() => (0, contract_1.parseCoverageContract)(input, 'coverage.json')).toThrow('path');
     });
-    test.each(['.semgrep.awm.yml', '.dep-cruiser.awm.js'])('accepts safe dotfile evidence path %p', (path) => {
+    test.each([
+        'eslint.config.awm.mjs',
+        'eslint.config.js',
+        'eslint.config.mjs',
+        'eslint.config.cjs',
+        'eslint.config.ts',
+        'eslint.config.mts',
+        'eslint.config.cts',
+        '.semgrep.awm.yml',
+        '.dep-cruiser.awm.js',
+    ])('accepts contractual evidence path %p', (path) => {
         const input = {
             schemaVersion: 1,
             classes: {
@@ -64,7 +74,7 @@ describe('coverage contract v1', () => {
             classes: {
                 valid: {
                     description: 'x',
-                    detectors: [{ sensor: 'test', evidence: { files: [{ path: 'report.txt', containsAll: [' \n'] }] } }],
+                    detectors: [{ sensor: 'test', evidence: { files: [{ path: 'eslint.config.awm.mjs', containsAll: [' \n'] }] } }],
                     remedy: { summary: 'x', command: 'x' },
                 },
             },
@@ -84,31 +94,17 @@ describe('coverage contract v1', () => {
         };
         expect(() => (0, contract_1.parseCoverageContract)(input, 'coverage.json')).toThrow('unknown field');
     });
-});
-describe('coverage manifest boundary', () => {
-    it('accepts all legacy sensor fields', () => {
+    it('rejects a detector sensor name that is not a safe component', () => {
         const input = {
-            pack: 'js-ts',
-            concurrency: 2,
-            sensors: {
-                lint: {
-                    cmd: 'npm run lint', fast: true, enabled: true, timeout: 120, changedCmd: 'npm run lint -- {files}', changedExtensions: ['.ts'], formatter: 'eslint-llm',
+            schemaVersion: 1,
+            classes: {
+                valid: {
+                    description: 'x',
+                    detectors: [{ sensor: '../escape' }],
+                    remedy: { summary: 'x', command: 'x' },
                 },
             },
         };
-        expect((0, contract_1.parseCoverageManifest)(input, 'sensors.json')).toEqual(input);
-    });
-    test.each([
-        [null, 'object'],
-        [{}, 'pack'],
-        [{ pack: '', sensors: {} }, 'pack'],
-        [{ pack: ' js-ts', sensors: {} }, 'pack'],
-        [{ pack: 'js ts', sensors: {} }, 'pack'],
-        [{ pack: 'js@ts', sensors: {} }, 'pack'],
-        [{ pack: 'js-ts', sensors: null }, 'sensors'],
-        [{ pack: 'js-ts', sensors: { lint: { cmd: 3 } } }, 'cmd'],
-        [{ pack: 'js-ts', sensors: { 'lint!': {} } }, 'sensor name'],
-    ])('rejects malformed manifest %j', (input, message) => {
-        expect(() => (0, contract_1.parseCoverageManifest)(input, 'sensors.json')).toThrow(message);
+        expect(() => (0, contract_1.parseCoverageContract)(input, 'coverage.json')).toThrow('sensor');
     });
 });

package/dist/tests/commands/sensors/coverage/empirical.test.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const empirical_1 = require("../../../../src/commands/sensors/coverage/empirical");
+const finding = (defectClass, signature, ref, severity = 'minor') => ({
+    entry: { ts: '2026-08-14', branch: 'main', phase: 'qa', source_skill: 'test', polarity: 'finding',
+        class: 'structural', signature, severity, desc: 'private ledger description', ...(defectClass ? { defectClass } : {}) },
+    source: ref,
+    evidenceRef: ref,
+});
+const scanOf = (entries) => ({
+    entries,
+    sources: { activeFiles: 1, archivedFiles: 0, validEntries: entries.length, validFindings: entries.length, skippedFindings: 0, skippedByReason: {} },
+    omittedEvidenceRefs: 0,
+});
+test('distinguishes evidence, partial, no-evidence and inconclusive ledger states (R5.11)', () => {
+    const valid = scanOf([finding('lint-errors', 'valid', 'src/a.ts:1')]);
+    expect((0, empirical_1.evaluateEmpiricalCoverage)(valid, { 'lint-errors': 'covered' }, 2).status).toBe('evidence');
+    expect((0, empirical_1.evaluateEmpiricalCoverage)({ ...valid, sources: { ...valid.sources, skippedFindings: 1, skippedByReason: { 'invalid-json': 1 } } }, { 'lint-errors': 'covered' }, 2).status).toBe('partial');
+    expect((0, empirical_1.evaluateEmpiricalCoverage)(scanOf([]), {}, 2).status).toBe('no-evidence');
+    expect((0, empirical_1.evaluateEmpiricalCoverage)({ ...scanOf([]), sources: { activeFiles: 1, archivedFiles: 0, validEntries: 0, validFindings: 0, skippedFindings: 1, skippedByReason: { 'invalid-json': 1 } } }, {}, 2).status).toBe('inconclusive');
+});
+test('clusters only inside defectClass and keeps singles below min (R5.4, R5.6)', () => {
+    const report = (0, empirical_1.evaluateEmpiricalCoverage)(scanOf([
+        finding('lint-errors', 'same-signature', 'a.ts:1'),
+        finding('static-type-errors', 'same-signature', 'b.ts:1'),
+    ]), { 'lint-errors': 'covered', 'static-type-errors': 'covered' }, 2);
+    expect(report.classes).toHaveLength(2);
+    expect(report.classes.every((item) => item.occurrences === 1 && item.recurrent === false)).toBe(true);
+});
+test('preserves cluster kind and only sorted safe signatures in public empirical clusters (R5.5)', () => {
+    const report = (0, empirical_1.evaluateEmpiricalCoverage)(scanOf([
+        finding('lint-errors', 'src/z.ts:9', 'src/z.ts:9'),
+        finding('lint-errors', 'PR #12', 'src/z.ts:10'),
+        finding('lint-errors', 'secret-token=do-not-expose', 'src/z.ts:11'),
+    ]), { 'lint-errors': 'covered' }, 1);
+    expect(report.classes).toHaveLength(1);
+    expect(report.classes[0].clusters).toEqual([expect.objectContaining({
+            kind: 'convergent',
+            signatures: ['PR #12', 'src/z.ts:9'],
+            omittedSignatures: 1,
+        })]);
+    expect(JSON.stringify(report)).not.toContain('secret-token=do-not-expose');
+});
+test.each([
+    ['covered', 'covered-by-sensor'], ['missing', 'gap'], ['incompatible', 'gap'],
+    ['missing-tool', 'gap'], ['unverifiable', 'coverage-unverifiable'],
+    ['compatible-unverified', 'coverage-unverifiable'], ['not-applicable', 'applicability-contradiction'],
+])('crosses %s to %s (R5.9)', (staticState, outcome) => {
+    expect((0, empirical_1.outcomeFor)(staticState, true)).toBe(outcome);
+});
+test('maps a valid defect class absent from the static contract to unmapped-class (R5.12)', () => {
+    expect((0, empirical_1.outcomeFor)(undefined, true)).toBe('unmapped-class');
+    expect((0, empirical_1.evaluateEmpiricalCoverage)(scanOf([finding('legacy-lint', 'legacy', 'src/a.ts:1')]), {}, 2).classes[0].outcome)
+        .toBe('unmapped-class');
+});
+test('treats a class as coverage-unverifiable when the static catalog is unavailable', () => {
+    const scan = scanOf([finding('legacy-lint', 'legacy', 'src/a.ts:1')]);
+    expect((0, empirical_1.evaluateEmpiricalCoverage)(scan, {}, 2, 'unavailable').classes[0].outcome)
+        .toBe('coverage-unverifiable');
+});
+test('changes recurrence emphasis and stable ordering when --min changes (R5.13)', () => {
+    const entries = scanOf([
+        { ...finding('lint-errors', 'solo-orange', 'src/a.ts:1'), entry: { ...finding('lint-errors', 'solo-orange', 'src/a.ts:1').entry, desc: 'orchard fruit gamma' } },
+        { ...finding('lint-errors', 'repeat-protocol', 'src/b.ts:1'), entry: { ...finding('lint-errors', 'repeat-protocol', 'src/b.ts:1').entry, desc: 'network handshake delta' } },
+        { ...finding('lint-errors', 'repeat-protocol', 'src/b.ts:2'), entry: { ...finding('lint-errors', 'repeat-protocol', 'src/b.ts:2').entry, desc: 'network handshake delta' } },
+    ]);
+    const minTwo = (0, empirical_1.evaluateEmpiricalCoverage)(entries, { 'lint-errors': 'covered' }, 2);
+    const minThree = (0, empirical_1.evaluateEmpiricalCoverage)(entries, { 'lint-errors': 'covered' }, 3);
+    expect(minTwo.recurrenceThreshold).toBe(2);
+    expect(minTwo.classes.map((item) => [item.occurrences, item.recurrent])).toEqual([[3, true]]);
+    expect(minTwo.classes[0].clusters).toHaveLength(2);
+    expect(minThree.recurrenceThreshold).toBe(3);
+    expect(minThree.classes.map((item) => [item.occurrences, item.recurrent])).toEqual([[3, false]]);
+    expect(JSON.stringify(minTwo)).not.toEqual(JSON.stringify(minThree));
+});
+test('does not infer a missing class from text and never emits description or signature (R5.3, R5.10)', () => {
+    const report = (0, empirical_1.evaluateEmpiricalCoverage)(scanOf([finding(undefined, 'secret-signature', 'src/a.ts:2')]), { 'lint-errors': 'covered' }, 2);
+    expect(report.unclassified.occurrences).toBe(1);
+    expect(report.classes).toEqual([]);
+    expect(JSON.stringify(report)).not.toContain('private ledger description');
+    expect(JSON.stringify(report)).not.toContain('secret-signature');
+});
+test('sanitizes, deduplicates and bounds allowed evidence refs (R5.7, R5.8)', () => {
+    const report = (0, empirical_1.evaluateEmpiricalCoverage)(scanOf([
+        finding('lint-errors', 'a', '\u001b]8;;https://evil\u0007src/z.ts:8'),
+        finding('lint-errors', 'b', 'PR #12', 'blocker'),
+        finding('lint-errors', 'c', 'PR #12'),
+        finding('lint-errors', 'd', 'not an allowed ref'),
+    ]), { 'lint-errors': 'missing' }, 1);
+    expect(report.classes[0]).toMatchObject({ outcome: 'gap', severity: 'blocker', evidenceRefs: ['PR #12', 'src/z.ts:8'], omittedEvidenceRefs: 1 });
+    expect(JSON.stringify(report)).not.toMatch(/[\u0000-\u001f\u007f-\u009f]/);
+});
+test('includes invalid and scanner-omitted evidence refs in the partial public status', () => {
+    const scan = {
+        ...scanOf([finding('lint-errors', 'invalid-ref', 'not an allowed ref')]),
+        sources: {
+            activeFiles: 1, archivedFiles: 0, validEntries: 1, validFindings: 1,
+            skippedFindings: 3, skippedByReason: { 'evidence-ref-limit': 3 },
+        },
+        omittedEvidenceRefs: 3,
+    };
+    const report = (0, empirical_1.evaluateEmpiricalCoverage)(scan, { 'lint-errors': 'covered' }, 2);
+    expect(report).toMatchObject({ status: 'partial', omittedEvidenceRefs: 4 });
+    expect(report.classes[0]).toMatchObject({ omittedEvidenceRefs: 1, evidenceRefs: [] });
+});
+test('does not double-count scanner-truncated evidence refs', () => {
+    const scan = { ...scanOf([finding('lint-errors', 'a', 'src/a.ts:1')]),
+        entries: [{ ...finding('lint-errors', 'a', 'src/a.ts:1'), evidenceRef: null }], omittedEvidenceRefs: 1 };
+    const report = (0, empirical_1.evaluateEmpiricalCoverage)(scan, { 'lint-errors': 'covered' }, 2);
+    expect(report.omittedEvidenceRefs).toBe(1);
+});