agentic-workflow-manager 6.5.2 → 8.0.0

package/dist/src/commands/sensors/compatibility/probe.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCompatibilityProbe = runCompatibilityProbe;
+const exec_1 = require("../exec");
+const KINDS = new Set(['version', 'eslint-print-config', 'typescript-show-config', 'semgrep-validate', 'package-script-present', 'config-present']);
+function commandFor(kind, evidence) {
+    const executable = evidence.toolExecutable ?? (kind.startsWith('typescript') ? 'tsc' : kind.startsWith('eslint') ? 'eslint' : kind.startsWith('semgrep') ? 'semgrep' : 'node');
+    // A tool version certified from local package metadata must be probed through
+    // the same project installation. Only the Node runtime is intentionally PATH
+    // resolved: it is runtime evidence, not a package-local tool assertion.
+    const resolution = executable === 'node'
+        ? 'path'
+        : kind === 'semgrep-validate'
+            ? 'python-environment'
+            : 'node-modules-bin';
+    if (kind === 'package-script-present')
+        return null;
+    if (kind === 'config-present')
+        return null;
+    if (kind === 'version')
+        return { executable, resolution, args: ['--version'] };
+    if (kind === 'eslint-print-config')
+        return { executable, resolution, args: ['--print-config', evidence.configFiles?.[0] ?? 'package.json'] };
+    if (kind === 'typescript-show-config')
+        return { executable, resolution, args: ['--showConfig'] };
+    return { executable, resolution, args: ['--validate'] };
+}
+/** Executes only the closed probe enum. Raw output is intentionally discarded. */
+async function runCompatibilityProbe(probe, evidence, executor = exec_1.runStructuredCommand) {
+    if (!probe || typeof probe !== 'object' || !KINDS.has(probe.kind))
+        throw new Error('compatibility probe kind must be allowed');
+    if (!evidence || typeof evidence.cwd !== 'string' || evidence.cwd.trim() === '')
+        throw new Error('probe evidence requires cwd');
+    if (probe.kind === 'package-script-present')
+        return { status: (evidence.scripts?.length ?? 0) > 0 ? 'matched' : 'not-matched', reason: 'package-script' };
+    if (probe.kind === 'config-present')
+        return { status: (evidence.configFiles?.length ?? 0) > 0 ? 'matched' : 'not-matched', reason: 'config-file' };
+    try {
+        const result = await executor(commandFor(probe.kind, evidence), { cwd: evidence.cwd, timeout: 5_000, maxBuffer: 64 * 1024 });
+        if (result.timedOut || result.overflowed || result.spawnError)
+            return { status: 'unverifiable', reason: result.timedOut ? 'probe-timeout' : result.overflowed ? 'probe-output-limit' : 'probe-spawn-error' };
+        return result.code === 0 ? { status: 'matched', reason: 'probe-exit-zero' } : { status: 'not-matched', reason: 'probe-exit-nonzero' };
+    }
+    catch {
+        return { status: 'unverifiable', reason: 'probe-exception' };
+    }
+}

package/dist/src/commands/sensors/compatibility/resolve.js

@@ -0,0 +1,96 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSensorCompatibility = resolveSensorCompatibility;
+exports.resolveProjectCompatibility = resolveProjectCompatibility;
+const semver_1 = __importDefault(require("semver"));
+const manifest_1 = require("./manifest");
+function result(state, reason, variant, evidence) {
+    const toolVersion = (variant ? toolFor(variant, evidence) : evidence.toolVersion) ?? null;
+    const runtimeVersion = (variant ? runtimeFor(variant, evidence) : evidence.runtimeVersion) ?? null;
+    const refs = [];
+    for (const candidate of (evidence.paths ?? []).slice(0, 32)) {
+        if (typeof candidate === 'string' && candidate.length <= 240 && !candidate.startsWith('/') && !candidate.includes('\\') && !candidate.split('/').some(part => part === '' || part === '.' || part === '..'))
+            refs.push({ kind: 'project-path', status: 'present', path: candidate });
+    }
+    if (evidence.packageManagerConflict)
+        refs.push({ kind: 'package-manager', status: 'conflict' });
+    if (variant && validVersion(toolVersion))
+        refs.push({ kind: 'tool-version', status: toolVersion });
+    if (variant && validVersion(runtimeVersion))
+        refs.push({ kind: 'runtime-version', status: runtimeVersion });
+    if (evidence.probe?.status === 'matched' || evidence.probe?.status === 'not-matched' || evidence.probe?.status === 'unverifiable')
+        refs.push({ kind: 'probe', status: evidence.probe.status });
+    return { state, reason, variantId: variant?.id ?? null, toolVersion, runtimeVersion, certifiedRange: variant?.certifiedRange ?? null, evidence: refs.slice(0, 32) };
+}
+function applies(sensor, evidence) {
+    if (evidence.applicable === false)
+        return false;
+    const paths = new Set(evidence.paths ?? []);
+    const rule = sensor.applicability;
+    return (!rule.allFiles || rule.allFiles.every(file => paths.has(file))) && (!rule.anyFiles || rule.anyFiles.some(file => paths.has(file)));
+}
+function specificity(variant) {
+    return variant.requirements.toolRange.length + variant.requirements.runtimeRange.length + (variant.requirements.configFiles?.length ?? 0);
+}
+function validVersion(value) { return typeof value === 'string' && semver_1.default.valid(value) !== null; }
+function toolFor(variant, evidence) {
+    return evidence.toolVersions === undefined ? evidence.toolVersion : evidence.toolVersions[variant.requirements.tool];
+}
+function runtimeFor(variant, evidence) {
+    return evidence.runtimeVersions === undefined ? evidence.runtimeVersion : evidence.runtimeVersions[variant.requirements.runtime];
+}
+/** Pure precedence resolver. It consumes discovered evidence and neither probes nor executes commands. */
+function resolveSensorCompatibility(sensor, evidence, context) {
+    if (!sensor || typeof sensor !== 'object' || !evidence || typeof evidence !== 'object')
+        throw new Error('sensor and discovered evidence are required');
+    if (!context || typeof context.pack !== 'string' || !context.pack.trim() || typeof context.sensor !== 'string' || !context.sensor.trim())
+        throw new Error('pack and sensor identity are required for compatibility resolution');
+    if (!('variants' in sensor))
+        return (0, manifest_1.legacyCompatibility)('legacy pack without schemaVersion');
+    const v2 = sensor;
+    if (!Array.isArray(v2.variants) || !v2.applicability)
+        throw new Error('v2 sensor must declare variants and applicability');
+    if (!applies(v2, evidence))
+        return result('not-applicable', 'applicability-not-met', null, evidence);
+    if (evidence.packageManagerConflict)
+        return result('unverifiable', 'package-manager-conflict', null, evidence);
+    const availableTools = v2.variants.map(variant => toolFor(variant, evidence));
+    if (availableTools.every(version => version === null || version === undefined))
+        return result('missing-tool', 'tool-not-found', null, evidence);
+    const operational = v2.variants.filter(variant => validVersion(toolFor(variant, evidence)) && validVersion(runtimeFor(variant, evidence)));
+    if (operational.length === 0)
+        return result('unverifiable', 'invalid-or-missing-version-evidence', null, evidence);
+    const matches = operational.filter(variant => semver_1.default.satisfies(toolFor(variant, evidence), variant.requirements.toolRange) && semver_1.default.satisfies(runtimeFor(variant, evidence), variant.requirements.runtimeRange));
+    if (matches.length === 0)
+        return result('incompatible', 'no-operational-variant', null, evidence);
+    matches.sort((a, b) => b.priority - a.priority || specificity(b) - specificity(a) || a.id.localeCompare(b.id));
+    const best = matches[0];
+    const tied = matches.filter(variant => variant.priority === best.priority && specificity(variant) === specificity(best));
+    if (tied.length !== 1) {
+        const matching = tied.sort((a, b) => a.id.localeCompare(b.id)).map(variant => `${variant.id} (tool ${variant.requirements.toolRange}, runtime ${variant.requirements.runtimeRange})`).join(', ');
+        throw new Error(`ambiguous sensor variants in pack "${context.pack}" sensor "${context.sensor}": ${matching}`);
+    }
+    if (evidence.probe?.status !== 'matched')
+        return result('unverifiable', evidence.probe?.status === 'not-matched' ? 'probe-not-matched' : 'probe-inconclusive', best, evidence);
+    return semver_1.default.satisfies(toolFor(best, evidence), best.certifiedRange)
+        ? result('certified', 'range-and-probe', best, evidence)
+        : result('compatible-unverified', 'operational-range-and-probe', best, evidence);
+}
+/** Adapt bounded local project discovery into one source-aware resolution per sensor. */
+function resolveProjectCompatibility(pack, evidence) {
+    if (!pack || typeof pack !== 'object' || typeof pack.name !== 'string')
+        throw new Error('pack must be a parsed sensor pack');
+    const sensors = {};
+    if (!('schemaVersion' in pack)) {
+        for (const name of Object.keys(pack.sensors))
+            sensors[name] = (0, manifest_1.legacyCompatibility)('legacy pack without schemaVersion');
+        return { sensors };
+    }
+    for (const [name, sensor] of Object.entries(pack.sensors)) {
+        sensors[name] = resolveSensorCompatibility(sensor, evidence, { pack: pack.name, sensor: name });
+    }
+    return { sensors };
+}

package/dist/src/commands/sensors/compatibility/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/commands/sensors/coverage/contract.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MAX_COVERAGE_FILE_BYTES = exports.COVERAGE_SCHEMA_VERSION = void 0;
 exports.parseCoverageContract = parseCoverageContract;
-exports.parseCoverageManifest = parseCoverageManifest;
 exports.COVERAGE_SCHEMA_VERSION = 1;
 exports.MAX_COVERAGE_FILE_BYTES = 1024 * 1024;
 const COVERAGE_EVIDENCE_PATHS = new Set([
@@ -123,52 +122,3 @@ function parseCoverageContract(input, source) {
     }
     return { schemaVersion: exports.COVERAGE_SCHEMA_VERSION, classes };
 }
-function manifestString(value, source, location) {
-    return nonEmptyString(value, source, location);
-}
-function parseManifestSensor(input, source, location) {
-    const value = record(input, source, location);
-    fields(value, ['cmd', 'fast', 'enabled', 'timeout', 'changedCmd', 'changedExtensions', 'formatter'], source, location);
-    const sensor = {};
-    if ('cmd' in value)
-        sensor.cmd = manifestString(value.cmd, source, `${location}.cmd`);
-    if ('fast' in value) {
-        if (typeof value.fast !== 'boolean')
-            invalid(source, `${location}.fast must be a boolean`);
-        sensor.fast = value.fast;
-    }
-    if ('enabled' in value) {
-        if (typeof value.enabled !== 'boolean')
-            invalid(source, `${location}.enabled must be a boolean`);
-        sensor.enabled = value.enabled;
-    }
-    if ('timeout' in value) {
-        if (typeof value.timeout !== 'number' || !Number.isSafeInteger(value.timeout) || value.timeout <= 0)
-            invalid(source, `${location}.timeout must be a positive safe integer`);
-        sensor.timeout = value.timeout;
-    }
-    if ('changedCmd' in value)
-        sensor.changedCmd = manifestString(value.changedCmd, source, `${location}.changedCmd`);
-    if ('changedExtensions' in value)
-        sensor.changedExtensions = stringArray(value.changedExtensions, source, `${location}.changedExtensions`, true);
-    if ('formatter' in value)
-        sensor.formatter = manifestString(value.formatter, source, `${location}.formatter`);
-    return sensor;
-}
-function parseCoverageManifest(input, source) {
-    const value = record(input, source, 'manifest root');
-    fields(value, ['pack', 'sensors', 'concurrency'], source, 'manifest root');
-    const pack = safeName(value.pack, source, 'manifest.pack');
-    const sensorsInput = record(value.sensors, source, 'manifest.sensors');
-    const sensors = {};
-    for (const name of Object.keys(sensorsInput)) {
-        sensors[safeName(name, source, 'manifest sensor name')] = parseManifestSensor(sensorsInput[name], source, `manifest.sensors.${name}`);
-    }
-    const manifest = { pack, sensors };
-    if ('concurrency' in value) {
-        if (typeof value.concurrency !== 'number' || !Number.isSafeInteger(value.concurrency) || value.concurrency <= 0)
-            invalid(source, 'manifest.concurrency must be a positive safe integer');
-        manifest.concurrency = value.concurrency;
-    }
-    return manifest;
-}

package/dist/src/commands/sensors/coverage/empirical.js

@@ -0,0 +1,131 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.outcomeFor = outcomeFor;
+exports.evaluateEmpiricalCoverage = evaluateEmpiricalCoverage;
+const cluster_1 = require("../../../core/ledger/cluster");
+const ANSI = /\x1B\[[0-?]*[ -/]*[@-~]/g;
+const OSC = /\x1B\][\s\S]*?(?:\x07|\x1B\\)/g;
+const CONTROLS = /[\u0000-\u001F\u007F-\u009F]/g;
+const severityRank = { blocker: 4, important: 3, minor: 2, info: 1 };
+const relativeLine = /^(?!\/)(?!.*(?:^|\/)\.\.?\/)[A-Za-z0-9._@+~=-]+(?:\/[A-Za-z0-9._@+~=-]+)*:[1-9][0-9]*$/;
+const prRef = /^PR #[1-9][0-9]*$/;
+const hashRef = /^[a-f0-9]{7,64}$/i;
+function safeRef(value) {
+    if (typeof value !== 'string')
+        return null;
+    const cleaned = value.replace(OSC, '').replace(ANSI, '').replace(CONTROLS, '').trim().slice(0, 256);
+    return relativeLine.test(cleaned) || prRef.test(cleaned) || hashRef.test(cleaned) ? cleaned : null;
+}
+function refsFor(entries, scanned) {
+    const refs = new Set();
+    let omitted = 0;
+    for (const entry of entries) {
+        const scannedEntry = scanned.get(entry);
+        if (!scannedEntry || scannedEntry.evidenceRef === null)
+            continue;
+        const ref = safeRef(scannedEntry.evidenceRef);
+        if (ref === null)
+            omitted += 1;
+        else
+            refs.add(ref);
+    }
+    return { refs: [...refs].sort((a, b) => a.localeCompare(b)), omitted };
+}
+function signaturesFor(signatures) {
+    const safe = new Set();
+    let omitted = 0;
+    for (const signature of signatures) {
+        const publicSignature = safeRef(signature);
+        if (publicSignature === null)
+            omitted += 1;
+        else
+            safe.add(publicSignature);
+    }
+    return { signatures: [...safe].sort((a, b) => a.localeCompare(b)), omitted };
+}
+function maxSeverity(entries) {
+    return entries.reduce((best, entry) => severityRank[entry.severity] > severityRank[best] ? entry.severity : best, 'info');
+}
+function outcomeFor(staticState, hasEvidence, staticAvailability = 'available') {
+    if (typeof hasEvidence !== 'boolean')
+        throw new Error('outcomeFor: hasEvidence must be boolean');
+    if (staticAvailability !== 'available' && staticAvailability !== 'unavailable')
+        throw new Error('outcomeFor: invalid static availability');
+    if (staticAvailability === 'unavailable')
+        return 'coverage-unverifiable';
+    if (!hasEvidence || staticState === 'unverifiable' || staticState === 'compatible-unverified')
+        return 'coverage-unverifiable';
+    if (staticState === undefined)
+        return 'unmapped-class';
+    if (staticState === 'covered')
+        return 'covered-by-sensor';
+    if (staticState === 'not-applicable')
+        return 'applicability-contradiction';
+    if (staticState === 'missing' || staticState === 'incompatible' || staticState === 'missing-tool')
+        return 'gap';
+    throw new Error('outcomeFor: invalid static state');
+}
+/**
+ * Converts bounded ledger findings into a public aggregate. Defect classes are
+ * the sole grouping boundary: no description or signature is used to classify
+ * an entry, and those private fields never cross this module's output.
+ */
+function evaluateEmpiricalCoverage(scan, staticStates, min, staticAvailability = 'available') {
+    if (!scan || typeof scan !== 'object' || !Array.isArray(scan.entries) || !scan.sources || typeof scan.omittedEvidenceRefs !== 'number') {
+        throw new Error('evaluateEmpiricalCoverage: invalid ledger scan');
+    }
+    if (!Number.isSafeInteger(min) || min < 1)
+        throw new Error('evaluateEmpiricalCoverage: min must be a positive safe integer');
+    if (staticAvailability !== 'available' && staticAvailability !== 'unavailable')
+        throw new Error('evaluateEmpiricalCoverage: invalid static availability');
+    const scanned = new Map(scan.entries.map(item => [item.entry, item]));
+    const typed = new Map();
+    const unclassified = [];
+    for (const item of scan.entries) {
+        if (item.entry.polarity !== 'finding')
+            continue;
+        if (item.entry.defectClass === undefined)
+            unclassified.push(item.entry);
+        else
+            typed.set(item.entry.defectClass, [...(typed.get(item.entry.defectClass) ?? []), item.entry]);
+    }
+    const classes = [];
+    for (const [defectClass, entries] of [...typed.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+        const evidence = refsFor(entries, scanned);
+        const clusters = (0, cluster_1.clusterEntries)(entries, 1).map((cluster) => {
+            const signatures = signaturesFor(cluster.signatures);
+            const clusterEvidence = refsFor(cluster.entries, scanned);
+            return {
+                occurrences: cluster.count,
+                recurrent: cluster.count >= min,
+                severity: maxSeverity(cluster.entries),
+                kind: cluster.kind,
+                signatures: signatures.signatures,
+                omittedSignatures: signatures.omitted,
+                evidenceRefs: clusterEvidence.refs,
+                omittedEvidenceRefs: clusterEvidence.omitted,
+            };
+        });
+        classes.push({ defectClass, occurrences: entries.length, recurrent: clusters.some((cluster) => cluster.recurrent),
+            severity: maxSeverity(entries), outcome: outcomeFor(staticStates[defectClass], entries.length > 0, staticAvailability),
+            evidenceRefs: evidence.refs, omittedEvidenceRefs: evidence.omitted, clusters });
+    }
+    // Stable public order: recurrence emphasis, count, then class ID. The
+    // cluster helper already supplies its own deterministic inner ordering.
+    classes.sort((a, b) => Number(b.recurrent) - Number(a.recurrent) || b.occurrences - a.occurrences
+        || a.defectClass.localeCompare(b.defectClass));
+    const unclassifiedEvidence = refsFor(unclassified, scanned);
+    const retained = classes.reduce((total, item) => total + item.occurrences, 0) + unclassified.length;
+    const omittedEvidenceRefs = scan.omittedEvidenceRefs
+        + classes.reduce((total, item) => total + item.omittedEvidenceRefs, 0)
+        + unclassifiedEvidence.omitted;
+    const skipped = scan.sources.skippedFindings > 0 || omittedEvidenceRefs > 0 || unclassified.length > 0;
+    return {
+        recurrenceThreshold: min,
+        status: retained === 0 ? (skipped ? 'inconclusive' : 'no-evidence') : (skipped ? 'partial' : 'evidence'),
+        classes,
+        unclassified: { occurrences: unclassified.length, evidenceRefs: unclassifiedEvidence.refs, omittedEvidenceRefs: unclassifiedEvidence.omitted },
+        sources: { ...scan.sources, skippedByReason: { ...scan.sources.skippedByReason } },
+        omittedEvidenceRefs,
+    };
+}

package/dist/src/commands/sensors/coverage/evaluate.js

@@ -1,9 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.toClassStatus = toClassStatus;
+exports.reduceClassStatus = reduceClassStatus;
+exports.crossEmpiricalOutcome = crossEmpiricalOutcome;
 exports.evaluateCoverage = evaluateCoverage;
 const detectorStatuses = ['covered', 'missing', 'disabled', 'ineffective', 'unverifiable'];
 const commandStatuses = ['matched', 'custom', 'missing'];
 const fileStatuses = ['matched', 'missing', 'unverifiable'];
+const compatibilityStates = [
+    'certified', 'compatible-unverified', 'incompatible', 'missing-tool', 'unverifiable', 'not-applicable',
+];
 function keyFor(classId, detectorIndex) {
     return `${classId}:${detectorIndex}`;
 }
@@ -31,6 +37,20 @@ function validateEvidence(evidence) {
         return false;
     });
 }
+function validateCompatibility(value) {
+    if (!isRecord(value) || !compatibilityStates.includes(value.state)
+        || !isNonEmptyString(value.reason)
+        || !(value.variantId === null || isNonEmptyString(value.variantId))
+        || !(value.toolVersion === null || isNonEmptyString(value.toolVersion))
+        || !(value.runtimeVersion === null || isNonEmptyString(value.runtimeVersion))
+        || !(value.certifiedRange === null || isNonEmptyString(value.certifiedRange))
+        || !Array.isArray(value.evidence))
+        return false;
+    return value.evidence.every((item) => isRecord(item)
+        && isNonEmptyString(item.kind) && isNonEmptyString(item.status)
+        && (!('path' in item) || isNonEmptyString(item.path))
+        && Object.keys(item).every((key) => key === 'kind' || key === 'status' || key === 'path'));
+}
 function validateContract(contract) {
     if (!isRecord(contract) || contract.schemaVersion !== 1 || !isRecord(contract.classes) || Object.keys(contract.classes).length === 0) {
         throw new Error('evaluateCoverage: invalid coverage contract');
@@ -52,11 +72,64 @@ function validateContract(contract) {
 function validateObservation(item) {
     return isRecord(item) && isNonEmptyString(item.classId) && typeof item.detectorIndex === 'number' && Number.isSafeInteger(item.detectorIndex)
         && item.detectorIndex >= 0 && isNonEmptyString(item.sensor) && typeof item.status === 'string'
-        && detectorStatuses.includes(item.status) && validateEvidence(item.evidence);
+        && detectorStatuses.includes(item.status) && validateEvidence(item.evidence)
+        && (!('compatibility' in item) || validateCompatibility(item.compatibility));
 }
 function copyEvidence(evidence) {
     return evidence.map((item) => ({ ...item }));
 }
+function copyCompatibility(value) {
+    return value === undefined ? undefined : {
+        ...value,
+        evidence: value.evidence.map((item) => ({ ...item })),
+    };
+}
+/** Map a detector's live compatibility plus its R2 structural evidence to a
+ * deterministic class alternative. A missing compatibility field is the R2
+ * compatibility path retained for direct callers while legacy/v2 coverage
+ * collection always supplies an explicit live resolution. */
+function toClassStatus(detector) {
+    if (!detector || typeof detector !== 'object' || !detectorStatuses.includes(detector.status)
+        || !validateEvidence(detector.evidence))
+        throw new Error('toClassStatus: malformed detector observation');
+    const state = detector.compatibility?.state;
+    if (state === 'not-applicable')
+        return 'not-applicable';
+    if (state === 'compatible-unverified' || state === 'unverifiable')
+        return 'unverifiable';
+    if (state === 'incompatible' || state === 'missing-tool')
+        return 'missing';
+    if (detector.status === 'unverifiable')
+        return 'unverifiable';
+    if (detector.status === 'covered')
+        return 'covered';
+    return 'missing';
+}
+const rank = {
+    covered: 4,
+    unverifiable: 3,
+    missing: 2,
+    'not-applicable': 1,
+};
+function reduceClassStatus(detectors) {
+    if (!Array.isArray(detectors) || detectors.length === 0)
+        throw new Error('coverage class requires detectors');
+    const statuses = detectors.map(toClassStatus);
+    return statuses.reduce((best, current) => rank[current] > rank[best] ? current : best);
+}
+/** Shared static/empirical vocabulary. The empirical analyzer supplies the
+ * occurrence boolean in T6; keeping the contradiction decision here prevents
+ * a second interpretation of applicability in that later layer. */
+function crossEmpiricalOutcome(status, hasEvidence) {
+    if (typeof hasEvidence !== 'boolean' || !['covered', 'missing', 'unverifiable', 'not-applicable'].includes(status)) {
+        throw new Error('crossEmpiricalOutcome: invalid static status or evidence flag');
+    }
+    if (status === 'not-applicable' && hasEvidence)
+        return 'applicability-contradiction';
+    if (status === 'covered')
+        return 'covered-by-sensor';
+    return status === 'missing' ? 'gap' : 'coverage-unverifiable';
+}
 function evaluateCoverage(contract, observations) {
     validateContract(contract);
     if (!Array.isArray(observations))
@@ -80,11 +153,14 @@ function evaluateCoverage(contract, observations) {
             if (found.sensor !== detector.sensor) {
                 throw new Error(`evaluateCoverage: observation for '${identity}' must use sensor '${detector.sensor}'`);
             }
-            return { sensor: found.sensor, status: found.status, evidence: copyEvidence(found.evidence) };
+            return {
+                sensor: found.sensor,
+                status: found.status,
+                evidence: copyEvidence(found.evidence),
+                ...(found.compatibility === undefined ? {} : { compatibility: copyCompatibility(found.compatibility) }),
+            };
         });
-        const status = detectors.some((item) => item.status === 'covered') ? 'covered'
-            : detectors.some((item) => item.status === 'unverifiable') ? 'unverifiable'
-                : 'missing';
+        const status = reduceClassStatus(detectors);
         return {
             id,
             description: expected.description,
@@ -100,8 +176,10 @@ function evaluateCoverage(contract, observations) {
                 throw new Error(`evaluateCoverage: unexpected observation for '${identity}' (${observation.sensor})`);
         }
     }
-    const overall = classes.some((item) => item.status === 'missing') ? 'gaps'
+    const applicable = classes.filter((item) => item.status !== 'not-applicable');
+    const overall = applicable.some((item) => item.status === 'missing') ? 'gaps'
         : classes.some((item) => item.status === 'unverifiable') ? 'inconclusive'
-            : 'covered';
+            : applicable.some((item) => item.status === 'covered') ? 'covered'
+                : 'inconclusive';
     return { overall, classes };
 }

package/dist/src/commands/sensors/coverage/evidence.js

@@ -98,7 +98,11 @@ function observeDetector(root, classId, detectorIndex, detector, sensor, io = re
     if (sensor.enabled === false)
         return { ...base, status: 'disabled', evidence: [] };
     const requiredCommand = detector.evidence?.commandIncludes ?? [];
-    const command = sensor.cmd;
+    // v2 commands are compared only in-memory to the catalog's structural
+    // fragments. Neither the command nor its args cross the coverage boundary.
+    const command = 'command' in sensor
+        ? [sensor.command.executable, ...sensor.command.args].join(' ')
+        : sensor.cmd;
     if (requiredCommand.length > 0 && typeof command !== 'string') {
         return { ...base, status: 'unverifiable', evidence: [{ kind: 'command', status: 'missing' }] };
     }

package/dist/src/commands/sensors/coverage/index.js

@@ -1,31 +1,68 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runCoverage = runCoverage;
 const evidence_1 = require("./evidence");
 const evaluate_1 = require("./evaluate");
 const resolve_1 = require("./resolve");
-const defaults = { resolve: resolve_1.resolveCoverageInputs, observe: evidence_1.observeDetector };
+const live_1 = require("../compatibility/live");
+const manifest_1 = require("../compatibility/manifest");
+const scan_1 = require("../../../core/ledger/scan");
+const empirical_1 = require("./empirical");
+const path_1 = __importDefault(require("path"));
+const defaults = { resolve: resolve_1.resolveCoverageInputs, observe: evidence_1.observeDetector, resolveLive: live_1.resolveLiveCompatibility, scan: scan_1.scanProjectLedgers };
+function normalizedMin(value) {
+    if (value === undefined)
+        return 2;
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 1)
+        throw new Error('runCoverage: min must be a positive safe integer');
+    return value;
+}
+function empirical(deps, projectRoot, states, min, staticAvailability = 'available') {
+    return (0, empirical_1.evaluateEmpiricalCoverage)(deps.scan(projectRoot), states, min, staticAvailability);
+}
 /** Build static coverage data only: no command execution and no writes. */
-function runCoverage(cwd, dependencies = {}) {
+async function runCoverage(cwd, dependencies = {}, options = {}) {
     if (typeof cwd !== 'string' || cwd.trim().length === 0)
         throw new Error('runCoverage: cwd must be a non-empty string');
+    const min = normalizedMin(options.min);
     const deps = { ...defaults, ...dependencies };
-    const input = deps.resolve(cwd);
+    const input = await deps.resolve(cwd);
     if (input.kind === 'not_configured') {
-        return { schemaVersion: 1, pack: null, registry: null, overall: 'inconclusive', static: { status: 'inconclusive', reason: 'not_configured', classes: [] } };
+        return { schemaVersion: 2, pack: null, registry: null, overall: 'inconclusive', static: { status: 'inconclusive', reason: 'not_configured', classes: [] },
+            empirical: empirical(deps, path_1.default.resolve(cwd), {}, min, 'unavailable') };
     }
     if (input.kind === 'no_reference') {
-        return { schemaVersion: 1, pack: input.pack, registry: input.registry, overall: 'inconclusive', static: { status: 'inconclusive', reason: 'no_reference', classes: [] } };
+        return { schemaVersion: 2, pack: input.pack, registry: input.registry, overall: 'inconclusive', static: { status: 'inconclusive', reason: 'no_reference', classes: [] },
+            empirical: empirical(deps, input.projectRoot, {}, min, 'unavailable') };
+    }
+    let live;
+    if (input.manifest.kind === 'v2') {
+        live = (await deps.resolveLive(input.projectRoot, input.pack, input.manifest.pack.registryRoot)).sensors;
+    }
+    else {
+        live = Object.fromEntries(Object.keys(input.manifest.pack.sensors).map((name) => [name, (0, manifest_1.legacyCompatibility)('legacy manifest without schemaVersion')]));
     }
     const observations = [];
     for (const [classId, coverageClass] of Object.entries(input.contract.classes)) {
         coverageClass.detectors.forEach((detector, detectorIndex) => {
-            observations.push(deps.observe(input.projectRoot, classId, detectorIndex, detector, input.manifest.sensors[detector.sensor]));
+            const observed = deps.observe(input.projectRoot, classId, detectorIndex, detector, input.manifest.pack.sensors[detector.sensor]);
+            observations.push({
+                ...observed,
+                compatibility: live[detector.sensor] ?? {
+                    state: 'unverifiable', reason: 'sensor-not-resolved', variantId: null,
+                    toolVersion: null, runtimeVersion: null, certifiedRange: null, evidence: [],
+                },
+            });
         });
     }
     const evaluated = (0, evaluate_1.evaluateCoverage)(input.contract, observations);
+    const states = Object.fromEntries(evaluated.classes.map((entry) => [entry.id, entry.status]));
     return {
-        schemaVersion: 1, pack: input.pack, registry: input.registry, overall: evaluated.overall,
+        schemaVersion: 2, pack: input.pack, registry: input.registry, overall: evaluated.overall,
         static: { status: evaluated.overall, reason: null, classes: evaluated.classes },
+        empirical: empirical(deps, input.projectRoot, states, min),
     };
 }