agentic-workflow-manager 6.5.2 → 8.1.0

package/dist/tests/commands/sensors/compatibility/pack-source.test.js

@@ -0,0 +1,55 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const pack_source_1 = require("../../../../src/commands/sensors/compatibility/pack-source");
+describe('resolvePackSource', () => {
+    it('uses the first registry containing the exact contained pack file', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-'));
+        try {
+            const first = path_1.default.join(root, 'first');
+            const second = path_1.default.join(root, 'second');
+            for (const registry of [first, second])
+                fs_1.default.mkdirSync(path_1.default.join(registry, 'sensor-packs', 'js-ts'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(first, 'sensor-packs', 'js-ts', 'pack.json'), '{"from":"first"}');
+            fs_1.default.writeFileSync(path_1.default.join(second, 'sensor-packs', 'js-ts', 'pack.json'), '{"from":"second"}');
+            expect((0, pack_source_1.resolvePackSource)('js-ts', { registries: [{ name: 'first', remote: '', contentRoot: first }, { name: 'second', remote: '', contentRoot: second }] }).content).toContain('first');
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('rejects symlink, non-regular, and escaping pack sources', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-bad-'));
+        try {
+            const packs = path_1.default.join(root, 'sensor-packs');
+            fs_1.default.mkdirSync(packs, { recursive: true });
+            fs_1.default.symlinkSync(path_1.default.join(root, 'outside.json'), path_1.default.join(packs, 'js-ts'));
+            fs_1.default.writeFileSync(path_1.default.join(root, 'outside.json'), '{}');
+            expect(() => (0, pack_source_1.resolvePackSource)('js-ts', { registries: [{ name: 'bad', remote: '', contentRoot: root }] })).toThrow(/symbolic|contain/i);
+            expect(() => (0, pack_source_1.resolvePackSource)('../escape', { registries: [] })).toThrow(/pack/i);
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('rejects a symlinked pack directory even when its target remains inside the registry', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-pack-source-internal-link-'));
+        try {
+            const packRoot = path_1.default.join(root, 'sensor-packs');
+            const target = path_1.default.join(packRoot, 'js-ts-source');
+            fs_1.default.mkdirSync(target, { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(target, 'pack.json'), '{}');
+            fs_1.default.symlinkSync(target, path_1.default.join(packRoot, 'js-ts'), 'dir');
+            expect(() => (0, pack_source_1.resolvePackSource)('js-ts', { registries: [{ name: 'linked', remote: '', contentRoot: root }] }))
+                .toThrow(/symbolic|symlink/i);
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/commands/sensors/compatibility/probe.test.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const probe_1 = require("../../../../src/commands/sensors/compatibility/probe");
+const fakeExecutor = jest.fn(async () => ({ code: 0, signal: null, timedOut: false, overflowed: false, stdout: 'SECRET_VALUE\nmatched', stderr: '' }));
+const evidence = { cwd: process.cwd(), configFiles: ['eslint.config.js'], scripts: ['lint'] };
+describe('runCompatibilityProbe', () => {
+    beforeEach(() => fakeExecutor.mockClear());
+    test.each(['eslint-print-config', 'typescript-show-config', 'semgrep-validate', 'version', 'package-script-present', 'config-present'])('runs the closed probe %s with sanitized output', async (kind) => {
+        const result = await (0, probe_1.runCompatibilityProbe)({ kind }, evidence, fakeExecutor);
+        expect(['matched', 'unverifiable']).toContain(result.status);
+        expect(JSON.stringify(result)).not.toContain('SECRET_VALUE');
+    });
+    it('never treats a timeout or overflow as a match', async () => {
+        fakeExecutor.mockResolvedValueOnce({ code: null, signal: 'SIGKILL', timedOut: true, overflowed: false, stdout: '', stderr: '' });
+        await expect((0, probe_1.runCompatibilityProbe)({ kind: 'version' }, evidence, fakeExecutor)).resolves.toMatchObject({ status: 'unverifiable' });
+        fakeExecutor.mockResolvedValueOnce({ code: 0, signal: null, timedOut: false, overflowed: true, stdout: 'ok', stderr: '' });
+        await expect((0, probe_1.runCompatibilityProbe)({ kind: 'version' }, evidence, fakeExecutor)).resolves.toMatchObject({ status: 'unverifiable' });
+    });
+    it('binds tool probes to the project node_modules executable instead of PATH', async () => {
+        await (0, probe_1.runCompatibilityProbe)({ kind: 'eslint-print-config' }, evidence, fakeExecutor);
+        expect(fakeExecutor).toHaveBeenCalledWith(expect.objectContaining({ executable: 'eslint', resolution: 'node-modules-bin' }), expect.any(Object));
+    });
+    it('binds Semgrep validation to the contained Python environment', async () => {
+        await (0, probe_1.runCompatibilityProbe)({ kind: 'semgrep-validate' }, evidence, fakeExecutor);
+        expect(fakeExecutor).toHaveBeenCalledWith(expect.objectContaining({ executable: 'semgrep', resolution: 'python-environment' }), expect.any(Object));
+    });
+    it('keeps Windows Semgrep validation on the discovered .venv executable', async () => {
+        await (0, probe_1.runCompatibilityProbe)({ kind: 'semgrep-validate' }, {
+            cwd: process.cwd(), toolExecutable: 'semgrep', toolResolution: 'python-environment', pythonEnvironmentRoot: '.venv',
+        }, fakeExecutor);
+        expect(fakeExecutor).toHaveBeenCalledWith({ executable: 'semgrep', resolution: 'python-environment', pythonEnvironmentRoot: '.venv', args: ['--validate'] }, expect.objectContaining({ cwd: process.cwd() }));
+    });
+    it.each(['mypy', 'ruff', 'pytest'])('probes a %s variant through the contained Python environment', async (toolExecutable) => {
+        await (0, probe_1.runCompatibilityProbe)({ kind: 'version' }, { ...evidence, toolExecutable, toolResolution: 'python-environment' }, fakeExecutor);
+        expect(fakeExecutor).toHaveBeenCalledWith(expect.objectContaining({ executable: toolExecutable, resolution: 'python-environment', args: ['--version'] }), expect.any(Object));
+    });
+});

package/dist/tests/commands/sensors/compatibility/python-venv-fixture.js

@@ -0,0 +1,29 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSemgrepVenvFixture = createSemgrepVenvFixture;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+/** Creates contained Semgrep metadata and the host-appropriate virtualenv executable. */
+function createSemgrepVenvFixture(root, targetPlatform = process.platform, environmentRoot = '.venv', options = {}) {
+    if (typeof root !== 'string' || root.trim() === '')
+        throw new Error('fixture root must be a non-empty path');
+    const windows = targetPlatform === 'win32';
+    const sitePackages = windows
+        ? [environmentRoot, 'Lib', 'site-packages']
+        : [environmentRoot, 'lib', 'python3.12', 'site-packages'];
+    const metadata = path_1.default.join(root, ...sitePackages, 'semgrep-1.91.0.dist-info');
+    fs_1.default.mkdirSync(metadata, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(root, environmentRoot, 'pyvenv.cfg'), 'version = 3.12.4\n');
+    fs_1.default.writeFileSync(path_1.default.join(metadata, 'METADATA'), 'Name: semgrep\nVersion: 1.91.0\n');
+    if (options.executable === false)
+        return;
+    const executable = path_1.default.join(root, environmentRoot, windows ? 'Scripts' : 'bin', windows ? 'semgrep.exe' : 'semgrep');
+    fs_1.default.mkdirSync(path_1.default.dirname(executable), { recursive: true });
+    if (windows)
+        fs_1.default.copyFileSync(process.execPath, executable);
+    else
+        fs_1.default.writeFileSync(executable, '#!/bin/sh\necho local-semgrep\n', { mode: 0o755 });
+}

package/dist/tests/commands/sensors/compatibility/resolve.test.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const resolve_1 = require("../../../../src/commands/sensors/compatibility/resolve");
+const manifest_1 = require("../../../../src/commands/sensors/compatibility/manifest");
+const variant = (id, priority = 10, toolRange = '>=9 <12', certifiedRange = '>=10 <11') => ({
+    id, priority, certifiedRange,
+    requirements: { tool: 'eslint', toolRange, runtime: 'node', runtimeRange: '>=20' },
+    assets: [], formatter: 'eslint', probe: { kind: 'version' },
+    command: { executable: 'eslint', resolution: 'path', args: ['--version'] },
+});
+const sensor = { applicability: { allFiles: ['package.json'] }, variants: [variant('eslint-main')] };
+const evidence = (input = {}) => ({ paths: ['package.json'], applicable: true, packageManagerConflict: false, toolVersion: '10.4.1', runtimeVersion: '22.0.0', probe: { status: 'matched' }, ...input });
+const context = { pack: 'js-ts', sensor: 'lint' };
+describe('resolveSensorCompatibility', () => {
+    it('keeps an automatically selected generic pack not-applicable despite language markers', () => {
+        const resolved = (0, resolve_1.resolveSensorCompatibility)({ applicability: { kind: 'explicit-or-supported-language' }, variants: [variant('semgrep')] }, evidence({ applicable: undefined, paths: ['pyproject.toml'], toolVersion: '1.0.0', runtimeVersion: '3.12.0', probe: { status: 'matched' } }), { pack: 'generic', sensor: 'security' });
+        expect(resolved).toMatchObject({ state: 'not-applicable', reason: 'applicability-not-met' });
+    });
+    it('treats the persisted explicit generic pack selection as positive capability in project resolution', () => {
+        const resolved = (0, resolve_1.resolveProjectCompatibility)({ schemaVersion: 2, name: 'generic', sensors: { security: { applicability: { kind: 'explicit-or-supported-language' }, variants: [variant('semgrep')] } } }, evidence({ applicable: undefined, paths: [], packSelection: 'explicit' }));
+        expect(resolved.sensors.security.state).not.toBe('not-applicable');
+    });
+    test.each([
+        ['certified', evidence(), 'eslint-main'],
+        ['compatible-unverified', evidence({ toolVersion: '11.0.0' }), 'eslint-main'],
+        ['incompatible', evidence({ toolVersion: '8.0.0' }), null],
+        ['missing-tool', evidence({ toolVersion: null }), null],
+        ['unverifiable', evidence({ probe: { status: 'unverifiable' } }), 'eslint-main'],
+        ['not-applicable', evidence({ applicable: false, paths: [] }), null],
+    ])('resolves %s without conflating states', (state, discovered, variantId) => {
+        expect((0, resolve_1.resolveSensorCompatibility)(sensor, discovered, context)).toMatchObject({ state, variantId });
+    });
+    it('preserves legacy behavior without executing a probe', () => {
+        expect((0, resolve_1.resolveSensorCompatibility)({ defaultCmd: 'eslint .' }, evidence(), context)).toEqual((0, manifest_1.legacyCompatibility)('legacy pack without schemaVersion'));
+    });
+    it('fails an equal-precedence match with its pack, sensor, IDs, and ranges', () => {
+        expect(() => (0, resolve_1.resolveProjectCompatibility)({ schemaVersion: 2, name: 'js-ts', sensors: { lint: { ...sensor, variants: [variant('one'), variant('two')] } } }, evidence())).toThrow(/js-ts.*lint.*one.*>=9 <12.*two.*>=9 <12/i);
+    });
+    it('requires a real pack and sensor identity for direct resolution', () => {
+        expect(() => (0, resolve_1.resolveSensorCompatibility)(sensor, evidence(), undefined)).toThrow(/pack and sensor identity are required/i);
+    });
+    it('reports lockfile conflicts as unverifiable', () => {
+        expect((0, resolve_1.resolveSensorCompatibility)(sensor, evidence({ packageManagerConflict: true }), context)).toMatchObject({ state: 'unverifiable', reason: 'package-manager-conflict' });
+    });
+    it('selects an operational variant when another tool variant is absent locally', () => {
+        const variants = [
+            { ...variant('eslint'), requirements: { ...variant('eslint').requirements, tool: 'eslint' } },
+            { ...variant('biome'), requirements: { ...variant('biome').requirements, tool: 'biome' } },
+        ];
+        const resolved = (0, resolve_1.resolveSensorCompatibility)({ applicability: { allFiles: ['package.json'] }, variants }, evidence({ toolVersions: { eslint: '10.4.1', biome: null }, runtimeVersions: { node: '22.0.0' }, toolVersion: '8.0.0', runtimeVersion: '8.0.0' }), context);
+        expect(resolved).toMatchObject({ state: 'certified', variantId: 'eslint', toolVersion: '10.4.1', runtimeVersion: '22.0.0' });
+    });
+    it('does not reuse scalar evidence for a missing key in a version map', () => {
+        const biome = { ...variant('biome'), requirements: { ...variant('biome').requirements, tool: 'biome', runtime: 'bun' } };
+        expect((0, resolve_1.resolveSensorCompatibility)({ applicability: { allFiles: ['package.json'] }, variants: [biome] }, evidence({ toolVersions: { biome: null }, runtimeVersions: { bun: null }, toolVersion: '10.4.1', runtimeVersion: '22.0.0' }), context))
+            .toMatchObject({ state: 'missing-tool' });
+    });
+    it('carries bounded, sanitized evidence without raw probe output', () => {
+        const resolved = (0, resolve_1.resolveSensorCompatibility)(sensor, evidence({ paths: ['package.json', '../SECRET_VALUE'], probe: { status: 'matched', output: 'SECRET_VALUE' } }), context);
+        expect(resolved.evidence).toEqual(expect.arrayContaining([{ kind: 'project-path', status: 'present', path: 'package.json' }, { kind: 'probe', status: 'matched' }]));
+        expect(JSON.stringify(resolved)).not.toContain('SECRET_VALUE');
+    });
+    test.each(['linux', 'darwin', 'win32'])('resolves the six states under controlled %s evidence', (os) => {
+        const states = [
+            (0, resolve_1.resolveSensorCompatibility)(sensor, evidence({ os }), context),
+            (0, resolve_1.resolveSensorCompatibility)(sensor, evidence({ os, toolVersion: '11.0.0' }), context),
+            (0, resolve_1.resolveSensorCompatibility)(sensor, evidence({ os, toolVersion: '8.0.0' }), context),
+            (0, resolve_1.resolveSensorCompatibility)(sensor, evidence({ os, toolVersion: null }), context),
+            (0, resolve_1.resolveSensorCompatibility)(sensor, evidence({ os, probe: { status: 'unverifiable' } }), context),
+            (0, resolve_1.resolveSensorCompatibility)(sensor, evidence({ os, applicable: false, paths: [] }), context),
+        ].map(result => result.state);
+        expect(states).toEqual(['certified', 'compatible-unverified', 'incompatible', 'missing-tool', 'unverifiable', 'not-applicable']);
+    });
+    test.each(['linux', 'darwin', 'win32'])('keeps applicability and deterministic precedence above version resolution on %s', (os) => {
+        const broad = variant('broad', 10, '>=9 <12');
+        const narrow = variant('narrow', 10, '>=10 <11');
+        const precedenceSensor = { applicability: { allFiles: ['package.json'] }, variants: [broad, narrow] };
+        expect((0, resolve_1.resolveSensorCompatibility)(precedenceSensor, evidence({ os, packageManagerConflict: true, applicable: false, paths: [] }), context))
+            .toMatchObject({ state: 'not-applicable', reason: 'applicability-not-met' });
+        expect((0, resolve_1.resolveSensorCompatibility)(precedenceSensor, evidence({ os }), context)).toMatchObject({ variantId: 'narrow' });
+        expect(() => (0, resolve_1.resolveSensorCompatibility)({ ...precedenceSensor, variants: [variant('a'), variant('b')] }, evidence({ os }), context)).toThrow(/ambiguous/i);
+    });
+});

package/dist/tests/commands/sensors/coverage/contract.test.js

@@ -94,31 +94,17 @@ describe('coverage contract v1', () => {
         };
         expect(() => (0, contract_1.parseCoverageContract)(input, 'coverage.json')).toThrow('unknown field');
     });
-});
-describe('coverage manifest boundary', () => {
-    it('accepts all legacy sensor fields', () => {
+    it('rejects a detector sensor name that is not a safe component', () => {
         const input = {
-            pack: 'js-ts',
-            concurrency: 2,
-            sensors: {
-                lint: {
-                    cmd: 'npm run lint', fast: true, enabled: true, timeout: 120, changedCmd: 'npm run lint -- {files}', changedExtensions: ['.ts'], formatter: 'eslint-llm',
+            schemaVersion: 1,
+            classes: {
+                valid: {
+                    description: 'x',
+                    detectors: [{ sensor: '../escape' }],
+                    remedy: { summary: 'x', command: 'x' },
                 },
             },
         };
-        expect((0, contract_1.parseCoverageManifest)(input, 'sensors.json')).toEqual(input);
-    });
-    test.each([
-        [null, 'object'],
-        [{}, 'pack'],
-        [{ pack: '', sensors: {} }, 'pack'],
-        [{ pack: ' js-ts', sensors: {} }, 'pack'],
-        [{ pack: 'js ts', sensors: {} }, 'pack'],
-        [{ pack: 'js@ts', sensors: {} }, 'pack'],
-        [{ pack: 'js-ts', sensors: null }, 'sensors'],
-        [{ pack: 'js-ts', sensors: { lint: { cmd: 3 } } }, 'cmd'],
-        [{ pack: 'js-ts', sensors: { 'lint!': {} } }, 'sensor name'],
-    ])('rejects malformed manifest %j', (input, message) => {
-        expect(() => (0, contract_1.parseCoverageManifest)(input, 'sensors.json')).toThrow(message);
+        expect(() => (0, contract_1.parseCoverageContract)(input, 'coverage.json')).toThrow('sensor');
     });
 });

package/dist/tests/commands/sensors/coverage/empirical.test.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const empirical_1 = require("../../../../src/commands/sensors/coverage/empirical");
+const finding = (defectClass, signature, ref, severity = 'minor') => ({
+    entry: { ts: '2026-08-14', branch: 'main', phase: 'qa', source_skill: 'test', polarity: 'finding',
+        class: 'structural', signature, severity, desc: 'private ledger description', ...(defectClass ? { defectClass } : {}) },
+    source: ref,
+    evidenceRef: ref,
+});
+const scanOf = (entries) => ({
+    entries,
+    sources: { activeFiles: 1, archivedFiles: 0, validEntries: entries.length, validFindings: entries.length, skippedFindings: 0, skippedByReason: {} },
+    omittedEvidenceRefs: 0,
+});
+test('distinguishes evidence, partial, no-evidence and inconclusive ledger states (R5.11)', () => {
+    const valid = scanOf([finding('lint-errors', 'valid', 'src/a.ts:1')]);
+    expect((0, empirical_1.evaluateEmpiricalCoverage)(valid, { 'lint-errors': 'covered' }, 2).status).toBe('evidence');
+    expect((0, empirical_1.evaluateEmpiricalCoverage)({ ...valid, sources: { ...valid.sources, skippedFindings: 1, skippedByReason: { 'invalid-json': 1 } } }, { 'lint-errors': 'covered' }, 2).status).toBe('partial');
+    expect((0, empirical_1.evaluateEmpiricalCoverage)(scanOf([]), {}, 2).status).toBe('no-evidence');
+    expect((0, empirical_1.evaluateEmpiricalCoverage)({ ...scanOf([]), sources: { activeFiles: 1, archivedFiles: 0, validEntries: 0, validFindings: 0, skippedFindings: 1, skippedByReason: { 'invalid-json': 1 } } }, {}, 2).status).toBe('inconclusive');
+});
+test('clusters only inside defectClass and keeps singles below min (R5.4, R5.6)', () => {
+    const report = (0, empirical_1.evaluateEmpiricalCoverage)(scanOf([
+        finding('lint-errors', 'same-signature', 'a.ts:1'),
+        finding('static-type-errors', 'same-signature', 'b.ts:1'),
+    ]), { 'lint-errors': 'covered', 'static-type-errors': 'covered' }, 2);
+    expect(report.classes).toHaveLength(2);
+    expect(report.classes.every((item) => item.occurrences === 1 && item.recurrent === false)).toBe(true);
+});
+test('preserves cluster kind and only sorted safe signatures in public empirical clusters (R5.5)', () => {
+    const report = (0, empirical_1.evaluateEmpiricalCoverage)(scanOf([
+        finding('lint-errors', 'src/z.ts:9', 'src/z.ts:9'),
+        finding('lint-errors', 'PR #12', 'src/z.ts:10'),
+        finding('lint-errors', 'secret-token=do-not-expose', 'src/z.ts:11'),
+    ]), { 'lint-errors': 'covered' }, 1);
+    expect(report.classes).toHaveLength(1);
+    expect(report.classes[0].clusters).toEqual([expect.objectContaining({
+            kind: 'convergent',
+            signatures: ['PR #12', 'src/z.ts:9'],
+            omittedSignatures: 1,
+        })]);
+    expect(JSON.stringify(report)).not.toContain('secret-token=do-not-expose');
+});
+test.each([
+    ['covered', 'covered-by-sensor'], ['missing', 'gap'], ['incompatible', 'gap'],
+    ['missing-tool', 'gap'], ['unverifiable', 'coverage-unverifiable'],
+    ['compatible-unverified', 'coverage-unverifiable'], ['not-applicable', 'applicability-contradiction'],
+])('crosses %s to %s (R5.9)', (staticState, outcome) => {
+    expect((0, empirical_1.outcomeFor)(staticState, true)).toBe(outcome);
+});
+test('maps a valid defect class absent from the static contract to unmapped-class (R5.12)', () => {
+    expect((0, empirical_1.outcomeFor)(undefined, true)).toBe('unmapped-class');
+    expect((0, empirical_1.evaluateEmpiricalCoverage)(scanOf([finding('legacy-lint', 'legacy', 'src/a.ts:1')]), {}, 2).classes[0].outcome)
+        .toBe('unmapped-class');
+});
+test('treats a class as coverage-unverifiable when the static catalog is unavailable', () => {
+    const scan = scanOf([finding('legacy-lint', 'legacy', 'src/a.ts:1')]);
+    expect((0, empirical_1.evaluateEmpiricalCoverage)(scan, {}, 2, 'unavailable').classes[0].outcome)
+        .toBe('coverage-unverifiable');
+});
+test('changes recurrence emphasis and stable ordering when --min changes (R5.13)', () => {
+    const entries = scanOf([
+        { ...finding('lint-errors', 'solo-orange', 'src/a.ts:1'), entry: { ...finding('lint-errors', 'solo-orange', 'src/a.ts:1').entry, desc: 'orchard fruit gamma' } },
+        { ...finding('lint-errors', 'repeat-protocol', 'src/b.ts:1'), entry: { ...finding('lint-errors', 'repeat-protocol', 'src/b.ts:1').entry, desc: 'network handshake delta' } },
+        { ...finding('lint-errors', 'repeat-protocol', 'src/b.ts:2'), entry: { ...finding('lint-errors', 'repeat-protocol', 'src/b.ts:2').entry, desc: 'network handshake delta' } },
+    ]);
+    const minTwo = (0, empirical_1.evaluateEmpiricalCoverage)(entries, { 'lint-errors': 'covered' }, 2);
+    const minThree = (0, empirical_1.evaluateEmpiricalCoverage)(entries, { 'lint-errors': 'covered' }, 3);
+    expect(minTwo.recurrenceThreshold).toBe(2);
+    expect(minTwo.classes.map((item) => [item.occurrences, item.recurrent])).toEqual([[3, true]]);
+    expect(minTwo.classes[0].clusters).toHaveLength(2);
+    expect(minThree.recurrenceThreshold).toBe(3);
+    expect(minThree.classes.map((item) => [item.occurrences, item.recurrent])).toEqual([[3, false]]);
+    expect(JSON.stringify(minTwo)).not.toEqual(JSON.stringify(minThree));
+});
+test('does not infer a missing class from text and never emits description or signature (R5.3, R5.10)', () => {
+    const report = (0, empirical_1.evaluateEmpiricalCoverage)(scanOf([finding(undefined, 'secret-signature', 'src/a.ts:2')]), { 'lint-errors': 'covered' }, 2);
+    expect(report.unclassified.occurrences).toBe(1);
+    expect(report.classes).toEqual([]);
+    expect(JSON.stringify(report)).not.toContain('private ledger description');
+    expect(JSON.stringify(report)).not.toContain('secret-signature');
+});
+test('sanitizes, deduplicates and bounds allowed evidence refs (R5.7, R5.8)', () => {
+    const report = (0, empirical_1.evaluateEmpiricalCoverage)(scanOf([
+        finding('lint-errors', 'a', '\u001b]8;;https://evil\u0007src/z.ts:8'),
+        finding('lint-errors', 'b', 'PR #12', 'blocker'),
+        finding('lint-errors', 'c', 'PR #12'),
+        finding('lint-errors', 'd', 'not an allowed ref'),
+    ]), { 'lint-errors': 'missing' }, 1);
+    expect(report.classes[0]).toMatchObject({ outcome: 'gap', severity: 'blocker', evidenceRefs: ['PR #12', 'src/z.ts:8'], omittedEvidenceRefs: 1 });
+    expect(JSON.stringify(report)).not.toMatch(/[\u0000-\u001f\u007f-\u009f]/);
+});
+test('includes invalid and scanner-omitted evidence refs in the partial public status', () => {
+    const scan = {
+        ...scanOf([finding('lint-errors', 'invalid-ref', 'not an allowed ref')]),
+        sources: {
+            activeFiles: 1, archivedFiles: 0, validEntries: 1, validFindings: 1,
+            skippedFindings: 3, skippedByReason: { 'evidence-ref-limit': 3 },
+        },
+        omittedEvidenceRefs: 3,
+    };
+    const report = (0, empirical_1.evaluateEmpiricalCoverage)(scan, { 'lint-errors': 'covered' }, 2);
+    expect(report).toMatchObject({ status: 'partial', omittedEvidenceRefs: 4 });
+    expect(report.classes[0]).toMatchObject({ omittedEvidenceRefs: 1, evidenceRefs: [] });
+});
+test('does not double-count scanner-truncated evidence refs', () => {
+    const scan = { ...scanOf([finding('lint-errors', 'a', 'src/a.ts:1')]),
+        entries: [{ ...finding('lint-errors', 'a', 'src/a.ts:1'), evidenceRef: null }], omittedEvidenceRefs: 1 };
+    const report = (0, empirical_1.evaluateEmpiricalCoverage)(scan, { 'lint-errors': 'covered' }, 2);
+    expect(report.omittedEvidenceRefs).toBe(1);
+});

package/dist/tests/commands/sensors/coverage/evaluate.test.js

@@ -18,6 +18,35 @@ const contract = {
 };
 const observation = (classId, detectorIndex, sensor, status) => ({ classId, detectorIndex, sensor, status, evidence: [] });
 describe('coverage evaluation', () => {
+    test('empirical evidence contradicts an inapplicable static class', () => {
+        expect((0, evaluate_1.crossEmpiricalOutcome)('not-applicable', true)).toBe('applicability-contradiction');
+    });
+    test.each([
+        [['certified', 'incompatible'], 'covered'],
+        [['compatible-unverified', 'missing-tool'], 'unverifiable'],
+        [['unverifiable', 'not-applicable'], 'unverifiable'],
+        [['incompatible', 'not-applicable'], 'missing'],
+        [['not-applicable', 'not-applicable'], 'not-applicable'],
+    ])('reduces compatibility states %p to %s', (states, expected) => {
+        const compatibility = (state) => ({
+            state,
+            reason: 'fixture',
+            variantId: null,
+            toolVersion: null,
+            runtimeVersion: null,
+            certifiedRange: null,
+            evidence: [],
+        });
+        const observations = states.map((state, detectorIndex) => ({
+            ...observation('alpha', detectorIndex, detectorIndex === 0 ? 'one' : 'two', 'covered'),
+            compatibility: compatibility(state),
+        }));
+        const result = (0, evaluate_1.evaluateCoverage)(contract, [...observations, {
+                ...observation('zeta', 0, 'three', 'covered'),
+                compatibility: compatibility('certified'),
+            }]);
+        expect(result.classes.find((item) => item.id === 'alpha')?.status).toBe(expected);
+    });
     test.each([
         [[observation('alpha', 0, 'one', 'covered'), observation('alpha', 1, 'two', 'missing')], 'covered'],
         [[observation('alpha', 0, 'one', 'missing'), observation('alpha', 1, 'two', 'disabled')], 'missing'],

package/dist/tests/commands/sensors/coverage/evidence.test.js

@@ -54,6 +54,15 @@ test('active matching sensor with all AND evidence is covered (R2.2)', () => {
         ],
     });
 });
+test('structured v2 commands supply structural coverage evidence without exposing argv', () => {
+    fs_1.default.writeFileSync(path_1.default.join(root, 'eslint.config.js'), "rules: { 'no-unreachable': 'error' }");
+    const observed = (0, evidence_1.observeDetector)(root, 'style', 0, detector, {
+        enabled: true,
+        command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.', '--config', 'eslint.config.js'] },
+    });
+    expect(observed.status).toBe(regularFileStatus('covered'));
+    expect(JSON.stringify(observed)).not.toContain('--config');
+});
 test.each([
     [undefined, 'missing'],
     [{ cmd: 'npx eslint .', enabled: false }, 'disabled'],

package/dist/tests/commands/sensors/coverage/index.test.js

@@ -1,20 +1,45 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const coverage_1 = require("../../../../src/commands/sensors/coverage");
-test('not configured is explicit, actionable and exit-0 data', () => {
-    expect((0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'not_configured' }) })).toEqual({
-        schemaVersion: 1, pack: null, registry: null, overall: 'inconclusive',
+test('not configured is explicit, actionable and exit-0 data', async () => {
+    await expect((0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'not_configured' }), scan: () => ({
+            entries: [], sources: { activeFiles: 0, archivedFiles: 0, validEntries: 0, validFindings: 0, skippedFindings: 0, skippedByReason: {} }, omittedEvidenceRefs: 0,
+        }) })).resolves.toEqual({
+        schemaVersion: 2, pack: null, registry: null, overall: 'inconclusive',
         static: { status: 'inconclusive', reason: 'not_configured', classes: [] },
+        empirical: expect.objectContaining({ status: 'no-evidence' }),
     });
 });
-test('old pack is no_reference and preserves pack and registry', () => {
-    const manifest = { pack: 'legacy', sensors: {} };
-    expect((0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'no_reference', projectRoot: '/fixture', pack: 'legacy', registry: 'baseline', manifest }) }))
-        .toEqual({ schemaVersion: 1, pack: 'legacy', registry: 'baseline', overall: 'inconclusive',
-        static: { status: 'inconclusive', reason: 'no_reference', classes: [] } });
+test('unavailable static contracts make empirical findings coverage-unverifiable', async () => {
+    const scan = {
+        entries: [{ entry: { ts: 'x', branch: 'main', phase: 'qa', source_skill: 'test', polarity: 'finding',
+                    class: 'structural', signature: 'private', severity: 'minor', desc: 'secret', defectClass: 'lint-errors' }, source: '.awm/ledger/main.jsonl:1', evidenceRef: '.awm/ledger/main.jsonl:1' }],
+        sources: { activeFiles: 1, archivedFiles: 0, validEntries: 1, validFindings: 1, skippedFindings: 0, skippedByReason: {} }, omittedEvidenceRefs: 0,
+    };
+    const notConfigured = await (0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'not_configured' }), scan: () => scan });
+    expect(notConfigured.empirical?.classes[0].outcome).toBe('coverage-unverifiable');
+    const manifest = { kind: 'legacy', pack: { pack: 'legacy', sensors: {}, compatibility: {
+                state: 'compatible-unverified', reason: 'legacy', variantId: null, toolVersion: null, runtimeVersion: null, certifiedRange: null, evidence: [],
+            } } };
+    const noReference = await (0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'no_reference', projectRoot: '/fixture', pack: 'legacy', registry: 'baseline', manifest }), scan: () => scan });
+    expect(noReference.empirical?.classes[0].outcome).toBe('coverage-unverifiable');
 });
-test('ready input observes every declared detector and evaluates once', () => {
-    const manifest = { pack: 'js-ts', sensors: { lint: { cmd: 'eslint .' }, format: { cmd: 'prettier --check .' } } };
+test('old pack is no_reference and preserves pack and registry', async () => {
+    const manifest = { kind: 'legacy', pack: { pack: 'legacy', sensors: {}, compatibility: {
+                state: 'compatible-unverified', reason: 'legacy', variantId: null, toolVersion: null, runtimeVersion: null, certifiedRange: null, evidence: [],
+            } } };
+    await expect((0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'no_reference', projectRoot: '/fixture', pack: 'legacy', registry: 'baseline', manifest }), scan: () => ({
+            entries: [{ entry: { ts: 'x', branch: 'main', phase: 'qa', source_skill: 'test', polarity: 'finding', class: 'structural', signature: 'private', severity: 'minor', desc: 'secret', defectClass: 'lint-errors' }, source: '.awm/ledger/main.jsonl:1', evidenceRef: '.awm/ledger/main.jsonl:1' }],
+            sources: { activeFiles: 1, archivedFiles: 0, validEntries: 1, validFindings: 1, skippedFindings: 0, skippedByReason: {} }, omittedEvidenceRefs: 0,
+        }) }))
+        .resolves.toEqual({ schemaVersion: 2, pack: 'legacy', registry: 'baseline', overall: 'inconclusive',
+        static: { status: 'inconclusive', reason: 'no_reference', classes: [] },
+        empirical: expect.objectContaining({ status: 'evidence', classes: [expect.objectContaining({ outcome: 'coverage-unverifiable' })] }) });
+});
+test('ready input observes every declared detector and evaluates once', async () => {
+    const manifest = { kind: 'legacy', pack: { pack: 'js-ts', sensors: { lint: { cmd: 'eslint .' }, format: { cmd: 'prettier --check .' } }, compatibility: {
+                state: 'compatible-unverified', reason: 'legacy', variantId: null, toolVersion: null, runtimeVersion: null, certifiedRange: null, evidence: [],
+            } } };
     const contract = { schemaVersion: 1, classes: {
             formatting: { description: 'Formatting', detectors: [{ sensor: 'format' }], remedy: { summary: 'Add format', command: 'npm i -D prettier' } },
             linting: { description: 'Linting', detectors: [{ sensor: 'lint' }], remedy: { summary: 'Add lint', command: 'npm i -D eslint' } },
@@ -22,9 +47,11 @@ test('ready input observes every declared detector and evaluates once', () => {
     const observe = jest.fn((_root, classId, detectorIndex, detector) => ({
         classId, detectorIndex, sensor: detector.sensor, status: 'covered', evidence: [],
     }));
-    const out = (0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'ready', projectRoot: '/fixture', pack: 'js-ts', registry: 'baseline', manifest, contract }), observe });
+    const out = await (0, coverage_1.runCoverage)('/fixture', { resolve: () => ({ kind: 'ready', projectRoot: '/fixture', pack: 'js-ts', registry: 'baseline', manifest, contract }), observe, scan: () => ({
+            entries: [], sources: { activeFiles: 0, archivedFiles: 0, validEntries: 0, validFindings: 0, skippedFindings: 0, skippedByReason: {} }, omittedEvidenceRefs: 0,
+        }) });
     expect(observe.mock.calls.map((call) => [call[1], call[2]])).toEqual([['formatting', 0], ['linting', 0]]);
     expect(out.static.classes.map((item) => item.id)).toEqual(['formatting', 'linting']);
-    expect(out.overall).toBe('covered');
-    expect(out).not.toHaveProperty('empirical');
+    expect(out.overall).toBe('inconclusive');
+    expect(out.empirical).toMatchObject({ status: 'no-evidence' });
 });