agentic-workflow-manager 6.5.2 → 8.1.0

package/dist/tests/commands/sensors/index.test.js

@@ -52,6 +52,14 @@ describe('sensors coverage Commander wiring', () => {
         expect(render_1.renderCoverageHuman).toHaveBeenCalledWith(report);
         expect(stdoutWrite).toHaveBeenCalledWith('human\n');
     });
+    it.each(['0', '-1', '1.5', '2x', 'Infinity', 'NaN', '9007199254740992'])('Commander rejects unsafe --min %s before coverage I/O (R5.5)', async (value) => {
+        await expect(programWithSensors().parseAsync(['node', 'awm', 'sensors', 'coverage', '--min', value])).rejects.toThrow('--min must be a positive safe integer');
+        expect(coverage_1.runCoverage).not.toHaveBeenCalled();
+    });
+    it('passes --min as a positive integer to coverage', async () => {
+        await programWithSensors().parseAsync(['node', 'awm', 'sensors', 'coverage', '--min', '3']);
+        expect(coverage_1.runCoverage).toHaveBeenCalledWith(process.cwd(), {}, { min: 3 });
+    });
     it('emits JSON for --json and does not exit for gaps or inconclusive (R2.9)', async () => {
         for (const overall of ['gaps', 'inconclusive']) {
             coverage_1.runCoverage.mockReturnValue({ ...report, overall, static: { ...report.static, status: overall } });

package/dist/tests/commands/sensors/init-pack-unavailable.test.js

@@ -47,49 +47,49 @@ describe('awm sensors init — detected pack missing from the registry', () => {
     const manifestOf = (dir) => JSON.parse(fs_1.default.readFileSync(path_1.default.join(dir, '.awm', 'sensors.json'), 'utf-8'));
     afterAll(() => { for (const d of made)
         fs_1.default.rmSync(d, { recursive: true, force: true }); });
-    it('names the missing pack instead of writing an empty manifest silently', () => {
+    it('names the missing pack instead of writing an empty manifest silently', async () => {
         const cwd = project();
-        const result = (0, init_1.initSensors)({ cwd, registryRoot: registry({ 'js-ts': {}, generic: GENERIC }) });
+        const result = await (0, init_1.initSensors)({ cwd, registryRoot: registry({ 'js-ts': {}, generic: GENERIC }) });
         expect(result.unavailablePack).toBe('python');
         expect(result.detection.pack).toBe('python'); // what the tree actually is — unchanged
     });
-    it('falls back to a pack the registry does have, so the gate still measures something', () => {
+    it('falls back to a pack the registry does have, so the gate still measures something', async () => {
         const cwd = project();
-        const result = (0, init_1.initSensors)({ cwd, registryRoot: registry({ 'js-ts': {}, generic: GENERIC }) });
+        const result = await (0, init_1.initSensors)({ cwd, registryRoot: registry({ 'js-ts': {}, generic: GENERIC }) });
         expect(result.manifest.pack).toBe('generic');
         expect(Object.keys(result.manifest.sensors)).toEqual(['security']);
         expect(manifestOf(cwd).pack).toBe('generic');
     });
-    it('stays on the detected pack when the registry has no fallback either', () => {
+    it('stays on the detected pack when the registry has no fallback either', async () => {
         // Nothing better exists. The manifest is honestly empty and still says so —
         // preflight's `manifest` check fails on `total === 0` with a registry remedy.
         const cwd = project();
-        const result = (0, init_1.initSensors)({ cwd, registryRoot: registry({ 'js-ts': {} }) });
+        const result = await (0, init_1.initSensors)({ cwd, registryRoot: registry({ 'js-ts': {} }) });
         expect(result.unavailablePack).toBe('python');
         expect(result.manifest.pack).toBe('python');
         expect(result.manifest.sensors).toEqual({});
     });
-    it('is quiet when the registry does have the detected pack', () => {
+    it('is quiet when the registry does have the detected pack', async () => {
         const cwd = project();
-        const result = (0, init_1.initSensors)({ cwd, registryRoot: registry({ python: PYTHON, generic: GENERIC }) });
+        const result = await (0, init_1.initSensors)({ cwd, registryRoot: registry({ python: PYTHON, generic: GENERIC }) });
         expect(result.unavailablePack).toBeUndefined();
         expect(result.manifest.pack).toBe('python');
         expect(Object.keys(result.manifest.sensors)).toEqual(['typecheck']);
     });
-    it('does not fall back when there is no registry to check against', () => {
+    it('does not fall back when there is no registry to check against', async () => {
         // No registryRoot means nothing to validate against, the same tolerance
         // `--pack` already has — not evidence that the pack is missing.
         const cwd = project();
-        const result = (0, init_1.initSensors)({ cwd });
+        const result = await (0, init_1.initSensors)({ cwd });
         expect(result.unavailablePack).toBeUndefined();
         expect(result.manifest.pack).toBe('python');
     });
-    it('keeps sensors the user already had when falling back', () => {
+    it('keeps sensors the user already had when falling back', async () => {
         // The fallback must not be a way to lose hand-written configuration.
         const cwd = project();
         fs_1.default.mkdirSync(path_1.default.join(cwd, '.awm'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(cwd, '.awm', 'sensors.json'), JSON.stringify({ pack: 'python', sensors: { test: { cmd: 'pytest -q', fast: false } } }));
-        const result = (0, init_1.initSensors)({ cwd, registryRoot: registry({ generic: GENERIC }) });
+        const result = await (0, init_1.initSensors)({ cwd, registryRoot: registry({ generic: GENERIC }) });
         expect(result.manifest.sensors.test?.cmd).toBe('pytest -q');
         expect(Object.keys(result.manifest.sensors).sort()).toEqual(['security', 'test']);
     });

package/dist/tests/commands/sensors/init.test.js

@@ -7,6 +7,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const init_1 = require("../../../src/commands/sensors/init");
+const status_1 = require("../../../src/commands/sensors/status");
 // Build a throwaway registry with a js-ts pack.json (the single source of truth
 // init now reads from). `defaultCmd` uses the {{SOURCE_DIRS}} placeholder for depcheck.
 function makeRegistry() {
@@ -40,69 +41,105 @@ function makePythonRegistry() {
     }));
     return registryRoot;
 }
+function makeV2Registry() {
+    const registryRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-reg-v2-'));
+    const packDir = path_1.default.join(registryRoot, 'sensor-packs', 'js-ts');
+    fs_1.default.mkdirSync(packDir, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(packDir, 'eslint.config.awm.mjs'), 'export default []\n');
+    fs_1.default.writeFileSync(path_1.default.join(packDir, 'tsconfig.awm.json'), '{ "compilerOptions": { "strict": true } }\n');
+    fs_1.default.writeFileSync(path_1.default.join(packDir, 'pack.json'), JSON.stringify({
+        schemaVersion: 2, name: 'js-ts', description: 'fixture', detects: ['package.json'],
+        coverage: { schemaVersion: 1, classes: { lint: { description: 'lint', detectors: [{ sensor: 'lint' }], remedy: { summary: 'fix lint', command: 'awm sensors init --pack js-ts' } } } },
+        hardening: { 'typescript-strict': { assets: ['tsconfig.awm.json'] } },
+        sensors: { lint: { applicability: { allFiles: ['package.json'] }, variants: [{
+                        id: 'eslint-10', priority: 10, certifiedRange: '>=10.0.0 <11.0.0',
+                        requirements: { tool: 'eslint', toolRange: '>=10.0.0 <11.0.0', runtime: 'node', runtimeRange: '>=0.0.0' },
+                        assets: ['eslint.config.awm.mjs'], formatter: 'eslint-llm', probe: { kind: 'config-present' },
+                        command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] },
+                    }] } },
+    }));
+    return registryRoot;
+}
+function makeGenericV2Registry() {
+    const registryRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-reg-generic-v2-'));
+    const packDir = path_1.default.join(registryRoot, 'sensor-packs', 'generic');
+    fs_1.default.mkdirSync(packDir, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(packDir, 'generic.config'), 'fixture\n');
+    fs_1.default.writeFileSync(path_1.default.join(packDir, 'pack.json'), JSON.stringify({
+        schemaVersion: 2, name: 'generic', description: 'fixture', detects: ['README.md'],
+        coverage: { schemaVersion: 1, classes: { security: { description: 'security', detectors: [{ sensor: 'security' }], remedy: { summary: 'run security', command: 'awm sensors init --pack generic' } } } },
+        sensors: { security: { applicability: { kind: 'explicit-or-supported-language' }, variants: [{
+                        id: 'eslint-10', priority: 10, certifiedRange: '>=10.0.0 <11.0.0',
+                        requirements: { tool: 'eslint', toolRange: '>=10.0.0 <11.0.0', runtime: 'node', runtimeRange: '>=0.0.0', configFiles: ['generic.config'] },
+                        assets: ['generic.config'], formatter: 'eslint-llm', probe: { kind: 'config-present' },
+                        command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] },
+                    }] } },
+    }));
+    return registryRoot;
+}
 describe('detectStack', () => {
     let tmpDir;
     beforeEach(() => { tmpDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-init-')); });
     afterEach(() => { fs_1.default.rmSync(tmpDir, { recursive: true }); });
-    it('detects js-ts when package.json exists', () => {
+    it('detects js-ts when package.json exists', async () => {
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), '{}');
         expect((0, init_1.detectStack)(tmpDir).pack).toBe('js-ts');
     });
-    it('detects python when pyproject.toml exists', () => {
+    it('detects python when pyproject.toml exists', async () => {
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'pyproject.toml'), '');
         expect((0, init_1.detectStack)(tmpDir).pack).toBe('python');
     });
-    it('falls back to generic when no indicators found', () => {
+    it('falls back to generic when no indicators found', async () => {
         expect((0, init_1.detectStack)(tmpDir).pack).toBe('generic');
     });
-    it('detects shell from a root-level *.sh file when no js-ts/python marker exists', () => {
+    it('detects shell from a root-level *.sh file when no js-ts/python marker exists', async () => {
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'deploy.sh'), '#!/bin/sh\n');
         const result = (0, init_1.detectStack)(tmpDir);
         expect(result.pack).toBe('shell');
         expect(result.indicators).toEqual(['deploy.sh']);
     });
-    it('detects shell from a scripts/*.sh file when root has nothing', () => {
+    it('detects shell from a scripts/*.sh file when root has nothing', async () => {
         fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'scripts'));
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'scripts', 'build.sh'), '#!/bin/sh\n');
         const result = (0, init_1.detectStack)(tmpDir);
         expect(result.pack).toBe('shell');
         expect(result.indicators).toEqual([path_1.default.join('scripts', 'build.sh')]);
     });
-    it('js-ts wins over shell when both package.json and a root .sh file exist', () => {
+    it('js-ts wins over shell when both package.json and a root .sh file exist', async () => {
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), '{}');
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'deploy.sh'), '#!/bin/sh\n');
         expect((0, init_1.detectStack)(tmpDir).pack).toBe('js-ts');
     });
-    it('python wins over shell when both a python marker and a root .sh file exist', () => {
+    it('python wins over shell when both a python marker and a root .sh file exist', async () => {
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'pyproject.toml'), '');
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'deploy.sh'), '#!/bin/sh\n');
         expect((0, init_1.detectStack)(tmpDir).pack).toBe('python');
     });
-    it('falls through to generic when scripts/ has only non-.sh files (glob must not over-match)', () => {
+    it('falls through to generic when scripts/ has only non-.sh files (glob must not over-match)', async () => {
         fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'scripts'));
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'scripts', 'notes.txt'), 'not shell');
         expect((0, init_1.detectStack)(tmpDir).pack).toBe('generic');
     });
-    it('detects python from requirements.txt alone', () => {
+    it('detects python from requirements.txt alone', async () => {
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'requirements.txt'), '');
         expect((0, init_1.detectStack)(tmpDir).pack).toBe('python');
     });
-    it('detects python from Pipfile alone', () => {
+    it('detects python from Pipfile alone', async () => {
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'Pipfile'), '');
         expect((0, init_1.detectStack)(tmpDir).pack).toBe('python');
     });
-    it('python (via Pipfile) wins over shell when both a Pipfile and a root .sh file exist', () => {
+    it('python (via Pipfile) wins over shell when both a Pipfile and a root .sh file exist', async () => {
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'Pipfile'), '');
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'deploy.sh'), '#!/bin/sh\n');
         expect((0, init_1.detectStack)(tmpDir).pack).toBe('python');
     });
-    it('does not report a directory named "*.sh" as a shell indicator', () => {
+    it('does not report a directory named "*.sh" as a shell indicator', async () => {
         // Directory literally named `something.sh` (not a file) — findShellIndicators'
         // `entry.isFile()` guard must exclude it. Nothing else present → generic.
         fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'something.sh'));
         expect((0, init_1.detectStack)(tmpDir).pack).toBe('generic');
     });
-    it('ignores a directory named "*.sh" but still finds a real .sh file alongside it', () => {
+    it('ignores a directory named "*.sh" but still finds a real .sh file alongside it', async () => {
         fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'notreal.sh'));
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'deploy.sh'), '#!/bin/sh\n');
         const result = (0, init_1.detectStack)(tmpDir);
@@ -114,16 +151,16 @@ describe('detectSourceDirs', () => {
     let tmpDir;
     beforeEach(() => { tmpDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-src-')); });
     afterEach(() => { fs_1.default.rmSync(tmpDir, { recursive: true }); });
-    it('returns the App-Router-style dirs that exist', () => {
+    it('returns the App-Router-style dirs that exist', async () => {
         for (const d of ['app', 'lib', 'components'])
             fs_1.default.mkdirSync(path_1.default.join(tmpDir, d));
         expect((0, init_1.detectSourceDirs)(tmpDir)).toEqual(['app', 'lib', 'components']);
     });
-    it('returns src when it exists', () => {
+    it('returns src when it exists', async () => {
         fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'src'));
         expect((0, init_1.detectSourceDirs)(tmpDir)).toEqual(['src']);
     });
-    it('falls back to ["src"] when no known source dir exists', () => {
+    it('falls back to ["src"] when no known source dir exists', async () => {
         expect((0, init_1.detectSourceDirs)(tmpDir)).toEqual(['src']);
     });
 });
@@ -138,26 +175,26 @@ describe('buildManifest', () => {
         fs_1.default.rmSync(registryRoot, { recursive: true });
         fs_1.default.rmSync(cwd, { recursive: true });
     });
-    it('builds manifest from the pack.json single source', () => {
+    it('builds manifest from the pack.json single source', async () => {
         const m = (0, init_1.buildManifest)('js-ts', undefined, registryRoot, cwd);
         expect(m.pack).toBe('js-ts');
         expect(m.sensors.typecheck.cmd).toBe('npx tsc --noEmit');
         expect(m.sensors.lint.cmd).toContain('--config eslint.config.awm.mjs');
     });
-    it('substitutes {{SOURCE_DIRS}} in depcheck with the detected dirs', () => {
+    it('substitutes {{SOURCE_DIRS}} in depcheck with the detected dirs', async () => {
         for (const d of ['app', 'lib'])
             fs_1.default.mkdirSync(path_1.default.join(cwd, d));
         const m = (0, init_1.buildManifest)('js-ts', undefined, registryRoot, cwd);
         expect(m.sensors.depcheck.cmd).toBe('npx depcruise --config .dep-cruiser.awm.js app lib');
         expect(m.sensors.depcheck.cmd).not.toContain('{{SOURCE_DIRS}}');
     });
-    it('merges conservatively — existing sensor commands are preserved', () => {
+    it('merges conservatively — existing sensor commands are preserved', async () => {
         const existing = { pack: 'js-ts', sensors: { typecheck: { cmd: 'custom-tsc', fast: true } } };
         const m = (0, init_1.buildManifest)('js-ts', existing, registryRoot, cwd);
         expect(m.sensors.typecheck.cmd).toBe('custom-tsc');
         expect(m.sensors.lint).toBeDefined();
     });
-    it('carries the formatter field through from pack.json into the built manifest', () => {
+    it('carries the formatter field through from pack.json into the built manifest', async () => {
         // readPackDefaults must copy `formatter` the same way it already copies
         // `changedCmd`/`changedExtensions` — this is what lets run.ts's getFormatter
         // dispatch by real tool (ruff/mypy/shellcheck) instead of guessing from the
@@ -167,14 +204,14 @@ describe('buildManifest', () => {
         expect(m.sensors.typecheck.formatter).toBe('tsc');
         expect(m.sensors.lint.formatter).toBe('eslint-llm');
     });
-    it('returns an empty sensors object when the pack has no pack.json in the registry', () => {
+    it('returns an empty sensors object when the pack has no pack.json in the registry', async () => {
         // No FALLBACK_DEFAULTS anymore: `python` has no pack dir in this fixture
         // registry (only js-ts does — see makeRegistry) → the honest floor is `{}`,
         // never CLI-hardcoded commands that can drift from what the registry ships.
         const m = (0, init_1.buildManifest)('python', undefined, registryRoot, cwd);
         expect(m.sensors).toEqual({});
     });
-    it('per-field merge: an existing sensor missing a newer pack field still inherits it', () => {
+    it('per-field merge: an existing sensor missing a newer pack field still inherits it', async () => {
         // Regression for Finding 1: a manifest written by the old FALLBACK_DEFAULTS-era
         // CLI has `typecheck: { cmd: 'mypy .', fast: true }` — no `formatter`, because
         // that field didn't exist yet. A naive `{ ...defaults, ...existingSensors }`
@@ -209,37 +246,163 @@ describe('initSensors', () => {
         fs_1.default.rmSync(tmpDir, { recursive: true });
         fs_1.default.rmSync(registryRoot, { recursive: true });
     });
-    it('creates .awm/sensors.json for js-ts project', () => {
+    it('creates .awm/sensors.json for js-ts project', async () => {
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), '{}');
-        const result = (0, init_1.initSensors)({ cwd: tmpDir, registryRoot });
+        const result = await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot });
         expect(fs_1.default.existsSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'))).toBe(true);
         expect(result.detection.pack).toBe('js-ts');
         expect(result.manifest.sensors.typecheck).toBeDefined();
     });
-    it('is idempotent — existing sensor commands survive re-init', () => {
+    it('is idempotent — existing sensor commands survive re-init', async () => {
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), '{}');
         fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
         const existing = { pack: 'js-ts', sensors: { typecheck: { cmd: 'my-tsc', fast: true } } };
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify(existing));
-        (0, init_1.initSensors)({ cwd: tmpDir, registryRoot });
+        await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot });
         const written = JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), 'utf-8'));
         expect(written.sensors.typecheck.cmd).toBe('my-tsc');
         expect(written.sensors.lint).toBeDefined(); // new sensor added
     });
-    it('copies pack config files into the repo by default (configure on)', () => {
+    it('copies pack config files into the repo by default (configure on)', async () => {
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), '{}');
         fs_1.default.writeFileSync(path_1.default.join(registryRoot, 'sensor-packs', 'js-ts', 'tsconfig.awm.json'), '{}');
-        const result = (0, init_1.initSensors)({ cwd: tmpDir, registryRoot }); // no explicit configure → default true
+        const result = await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot }); // no explicit configure → default true
         expect(result.configured).toContain('tsconfig.awm.json');
         expect(fs_1.default.existsSync(path_1.default.join(tmpDir, 'tsconfig.awm.json'))).toBe(true);
     });
-    it('does NOT copy config files when configure is false', () => {
+    it('does NOT copy config files when configure is false', async () => {
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), '{}');
         fs_1.default.writeFileSync(path_1.default.join(registryRoot, 'sensor-packs', 'js-ts', 'tsconfig.awm.json'), '{}');
-        const result = (0, init_1.initSensors)({ cwd: tmpDir, registryRoot, configure: false });
+        const result = await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot, configure: false });
         expect(result.configured).toEqual([]);
         expect(fs_1.default.existsSync(path_1.default.join(tmpDir, 'tsconfig.awm.json'))).toBe(false);
     });
+    it('awaits v2 compatibility probes and persists their materialized evidence', async () => {
+        const v2Registry = makeV2Registry();
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), JSON.stringify({ devDependencies: { eslint: '^10.0.0' } }));
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.0.0' }));
+            const result = await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry });
+            const written = JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), 'utf8'));
+            expect(result.manifest).toMatchObject({ schemaVersion: 2, sensors: { lint: { variantId: 'eslint-10' } } });
+            // `package.json` is a declared detection file, so config-present matches.
+            // Without init awaiting the probe the resolver stays `unverifiable`; this
+            // exact assertion therefore distinguishes the async probe integration.
+            expect(written.sensors.lint.initializedCompatibility).toMatchObject({ variantId: 'eslint-10', state: 'certified', reason: 'range-and-probe' });
+            expect(written.registryRoot).toBe(v2Registry);
+            expect(fs_1.default.existsSync(path_1.default.join(tmpDir, 'eslint.config.awm.mjs'))).toBe(true);
+        }
+        finally {
+            fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
+        }
+    });
+    it('persists an explicit generic selection for live revalidation without promoting automatic generic fallback', async () => {
+        const v2Registry = makeGenericV2Registry();
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.0.0' }));
+            const automatic = await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry, configure: false });
+            expect(automatic.manifest).toMatchObject({ schemaVersion: 2, pack: 'generic', sensors: {} });
+            expect(automatic.manifest.packSelection).toBeUndefined();
+            const explicit = await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry, pack: 'generic' });
+            const written = JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), 'utf8'));
+            expect(explicit.manifest).toMatchObject({ schemaVersion: 2, pack: 'generic', packSelection: 'explicit', sensors: { security: { variantId: 'eslint-10' } } });
+            expect(written.packSelection).toBe('explicit');
+            await expect((0, status_1.computeSensorStatus)(tmpDir)).resolves.toMatchObject({ overall: 'HEALTHY', checks: { security: { ok: true } } });
+        }
+        finally {
+            fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
+        }
+    });
+    it('never materializes an opt-in hardening asset during ordinary v2 init', async () => {
+        const v2Registry = makeV2Registry();
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), JSON.stringify({ devDependencies: { eslint: '^10.0.0' } }));
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.0.0' }));
+            await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry });
+            expect(fs_1.default.existsSync(path_1.default.join(tmpDir, 'eslint.config.awm.mjs'))).toBe(true);
+            expect(fs_1.default.existsSync(path_1.default.join(tmpDir, 'tsconfig.awm.json'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
+        }
+    });
+    it('initializes a selected v2 variant with an explicitly empty assets list', async () => {
+        const v2Registry = makeV2Registry();
+        try {
+            const packPath = path_1.default.join(v2Registry, 'sensor-packs', 'js-ts', 'pack.json');
+            const pack = JSON.parse(fs_1.default.readFileSync(packPath, 'utf8'));
+            pack.sensors.lint.variants[0].assets = [];
+            fs_1.default.writeFileSync(packPath, JSON.stringify(pack));
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), JSON.stringify({ devDependencies: { eslint: '^10.0.0' } }));
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.0.0' }));
+            await expect((0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry })).resolves.toMatchObject({
+                manifest: { schemaVersion: 2, sensors: { lint: { assets: [] } } },
+                configured: [],
+            });
+            expect(fs_1.default.existsSync(path_1.default.join(tmpDir, 'eslint.config.awm.mjs'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
+        }
+    });
+    it('preserves enabled and fast choices when a valid v2 manifest is re-initialized', async () => {
+        const v2Registry = makeV2Registry();
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), JSON.stringify({ devDependencies: { eslint: '^10.0.0' } }));
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.0.0' }));
+            await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry });
+            const manifestPath = path_1.default.join(tmpDir, '.awm', 'sensors.json');
+            const selected = JSON.parse(fs_1.default.readFileSync(manifestPath, 'utf8'));
+            selected.sensors.lint.enabled = false;
+            selected.sensors.lint.fast = true;
+            fs_1.default.writeFileSync(manifestPath, JSON.stringify(selected));
+            await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry });
+            const written = JSON.parse(fs_1.default.readFileSync(manifestPath, 'utf8'));
+            expect(written.sensors.lint).toMatchObject({ enabled: false, fast: true, variantId: 'eslint-10' });
+        }
+        finally {
+            fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
+        }
+    });
+    it('rejects a symlinked v2 pack source instead of reading it through init', async () => {
+        const v2Registry = makeV2Registry();
+        try {
+            const packPath = path_1.default.join(v2Registry, 'sensor-packs', 'js-ts', 'pack.json');
+            const outside = path_1.default.join(v2Registry, 'outside-pack.json');
+            fs_1.default.renameSync(packPath, outside);
+            fs_1.default.symlinkSync(outside, packPath);
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), '{}');
+            await expect((0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry })).rejects.toThrow(/symbolic|regular|contain/i);
+            expect(fs_1.default.existsSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
+        }
+    });
+    it('migrates legacy overrides explicitly without silently certifying or re-enabling them', async () => {
+        const v2Registry = makeV2Registry();
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), JSON.stringify({ devDependencies: { eslint: '^10.0.0' } }));
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.0.0' }));
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'));
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({
+                pack: 'js-ts', sensors: { lint: { cmd: 'my-company-eslint .', enabled: false, fast: true } },
+            }));
+            await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry });
+            const written = JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), 'utf8'));
+            expect(written.sensors.lint).toMatchObject({ enabled: false, fast: true });
+            expect(written.sensors.lint.initializedCompatibility).toMatchObject({ state: 'compatible-unverified', reason: expect.stringContaining('legacy custom command') });
+        }
+        finally {
+            fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
+        }
+    });
 });
 describe('initSensors — --pack override', () => {
     let tmpDir;
@@ -252,38 +415,31 @@ describe('initSensors — --pack override', () => {
         fs_1.default.rmSync(tmpDir, { recursive: true });
         fs_1.default.rmSync(registryRoot, { recursive: true });
     });
-    it('skips detection and uses the override pack when it exists in the registry', () => {
+    it('skips detection and uses the override pack when it exists in the registry', async () => {
         // No package.json/pyproject.toml here — if detection ran, this would be 'generic'.
-        const result = (0, init_1.initSensors)({ pack: 'js-ts', registryRoot, cwd: tmpDir });
+        const result = await (0, init_1.initSensors)({ pack: 'js-ts', registryRoot, cwd: tmpDir });
         expect(result.detection.pack).toBe('js-ts');
         // Indicators must reflect an override, not file-based detection.
         expect(result.detection.indicators).not.toEqual(['package.json']);
         expect(result.detection.indicators.join(' ')).toMatch(/pack override/i);
     });
-    it('throws listing available packs when the override pack is not in the registry', () => {
-        expect(() => (0, init_1.initSensors)({ pack: 'bogus', registryRoot, cwd: tmpDir })).toThrow(/js-ts/);
-        try {
-            (0, init_1.initSensors)({ pack: 'bogus', registryRoot, cwd: tmpDir });
-            throw new Error('expected initSensors to throw');
-        }
-        catch (e) {
-            expect(e.message).toContain('bogus');
-            expect(e.message).toContain('js-ts');
-        }
+    it('throws listing available packs when the override pack is not in the registry', async () => {
+        await expect((0, init_1.initSensors)({ pack: 'bogus', registryRoot, cwd: tmpDir })).rejects.toThrow(/js-ts/);
+        await expect((0, init_1.initSensors)({ pack: 'bogus', registryRoot, cwd: tmpDir })).rejects.toThrow(/bogus/);
     });
-    it('does not throw when no registryRoot is given — nothing to validate against', () => {
-        expect(() => (0, init_1.initSensors)({ pack: 'anything', cwd: tmpDir })).not.toThrow();
-        const result = (0, init_1.initSensors)({ pack: 'anything', cwd: tmpDir });
+    it('does not throw when no registryRoot is given — nothing to validate against', async () => {
+        await expect((0, init_1.initSensors)({ pack: 'anything', cwd: tmpDir })).resolves.toBeDefined();
+        const result = await (0, init_1.initSensors)({ pack: 'anything', cwd: tmpDir });
         expect(result.detection.pack).toBe('anything');
     });
-    it('throws a distinct message when the registry root has no sensor-packs directory at all', () => {
+    it('throws a distinct message when the registry root has no sensor-packs directory at all', async () => {
         // Different failure shape from "pack not in the list": the registry root
         // itself is missing sensor-packs/, so there's no list to show — must say
         // so plainly instead of reporting an empty `available: `.
         const emptyRegistryRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-empty-reg-'));
         try {
-            expect(() => (0, init_1.initSensors)({ pack: 'js-ts', registryRoot: emptyRegistryRoot, cwd: tmpDir }))
-                .toThrow(/no sensor-packs directory/);
+            await expect((0, init_1.initSensors)({ pack: 'js-ts', registryRoot: emptyRegistryRoot, cwd: tmpDir }))
+                .rejects.toThrow(/no sensor-packs directory/);
         }
         finally {
             fs_1.default.rmSync(emptyRegistryRoot, { recursive: true });

package/dist/tests/commands/sensors/run-inconclusive.test.js

@@ -157,7 +157,7 @@ describe('runSensors — inconclusive: a sensor that could not certify is never
         expect(out.sensors.find((s) => s.name === 'security').status).toBe('inconclusive');
         expect(out.overall).toBe('not_certified');
     });
-    it('does not degrade the verdict for a disabled sensor alongside healthy ones', async () => {
+    it('does not let healthy legacy commands certify a run when another sensor is disabled', async () => {
         fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({
             pack: 'js-ts',
             sensors: {
@@ -168,7 +168,14 @@ describe('runSensors — inconclusive: a sensor that could not certify is never
         mockRunCommand.mockResolvedValueOnce(ok());
         const { runSensors } = load();
         const out = await runSensors({ cwd: root });
-        expect(out.overall).toBe('pass');
+        // `enabled: false` is informational; the non-certification comes solely
+        // from this pre-R3 (schema-less) manifest.  Legacy commands remain
+        // operational, but their shell-backed, unversioned contract cannot issue
+        // a certified `pass` verdict (R3 design R1.4 / R7.2).
+        expect(out.sensors.find((s) => s.name === 'typecheck').status).toBe('pass');
+        expect(out.sensors.find((s) => s.name === 'mutation').status).toBe('skipped');
+        expect(out.sensors.find((s) => s.name === 'mutation').skipReason).toBe('disabled');
+        expect(out.overall).toBe('not_certified');
     });
     it('still refuses to certify a tree whose sensors are all disabled', async () => {
         fs_1.default.writeFileSync(path_1.default.join(root, '.awm', 'sensors.json'), JSON.stringify({