agentic-workflow-manager 8.1.1 → 8.1.3

package/dist/scripts/sensor-support-matrix.js

@@ -30,8 +30,8 @@ exports.R3_PREPUBLICATION_FIXTURE_RELATIVE_PATH = 'tests/fixtures/sensor-support
  * never an invented description of an unpublished registry release.
  */
 exports.R3_PREPUBLICATION_FIXTURE_PURPOSE = 'R3 pre-publication contract fixture';
-exports.R3_PUBLISHED_REGISTRY_TAG = 'v2.0.0';
-exports.R3_PUBLISHED_REGISTRY_COMMIT = 'c35c087a0801c0b4e69e0a4ac3eafef9ecdf37cd';
+exports.R3_PUBLISHED_REGISTRY_TAG = 'v2.0.1';
+exports.R3_PUBLISHED_REGISTRY_COMMIT = '6f40632006fc65300ac633c5a54f2635cf0eb8e9';
 /**
  * Extract the registry-owned certification matrix without copying or rewording it.
  * `SUPPORT.md` is generated by the registry from its manifests and frozen tool pins;

package/dist/src/commands/sensors/compatibility/contract.js

@@ -206,7 +206,7 @@ function parseVariant(input, source, location) {
         invalid(source, `${location} requires requirements and probe when policyRef is absent`);
     const requirements = policy ? undefined : record(value.requirements, source, `${location}.requirements`);
     if (requirements)
-        fields(requirements, ['tool', 'toolRange', 'runtime', 'runtimeRange', 'configFiles'], source, `${location}.requirements`);
+        fields(requirements, ['tool', 'toolRange', 'runtime', 'runtimeRange', 'configFiles', 'packageJsonFields'], source, `${location}.requirements`);
     const toolRange = policy?.toolRange ?? text(requirements.toolRange, source, `${location}.requirements.toolRange`);
     const runtimeRange = policy?.runtimeRange ?? text(requirements.runtimeRange, source, `${location}.requirements.runtimeRange`);
     if (semver_1.default.validRange(toolRange) === null || semver_1.default.validRange(runtimeRange) === null)
@@ -223,7 +223,8 @@ function parseVariant(input, source, location) {
         certifiedRange,
         requirements: policy
             ? { tool: policy.tool, toolRange, runtime: policy.runtime, runtimeRange }
-            : { tool: text(requirements.tool, source, `${location}.requirements.tool`), toolRange, runtime: text(requirements.runtime, source, `${location}.requirements.runtime`), runtimeRange, ...('configFiles' in requirements ? { configFiles: stringArray(requirements.configFiles, source, `${location}.requirements.configFiles`).map((file, index) => asset(file, source, `${location}.requirements.configFiles[${index}]`)) } : {}) },
+            : { tool: text(requirements.tool, source, `${location}.requirements.tool`), toolRange, runtime: text(requirements.runtime, source, `${location}.requirements.runtime`), runtimeRange, ...('configFiles' in requirements ? { configFiles: stringArray(requirements.configFiles, source, `${location}.requirements.configFiles`).map((file, index) => asset(file, source, `${location}.requirements.configFiles[${index}]`)) } : {}), ...('packageJsonFields' in requirements ? { packageJsonFields: stringArray(requirements.packageJsonFields, source, `${location}.requirements.packageJsonFields`).map((field, index) => { if (!/^[A-Za-z][A-Za-z0-9]*$/.test(field))
+                        invalid(source, `${location}.requirements.packageJsonFields[${index}] must be a stable package.json field`); return field; }) } : {}) },
         assets: assetArray(value.assets, source, `${location}.assets`, true),
         formatter: text(value.formatter, source, `${location}.formatter`),
         probe: { kind: policy?.probe ?? probe.kind },

package/dist/src/commands/sensors/compatibility/discovery.js

@@ -190,6 +190,7 @@ function discoverProjectEvidence(cwd, pack, dependencies = {}) {
     }
     const configFiles = [...configCandidates].filter(file => safeFile(root, file)).sort();
     const scripts = Object.keys(stringMap(pkg?.scripts)).sort();
+    const packageJsonFields = Object.keys(pkg ?? {}).filter(field => /^[A-Za-z][A-Za-z0-9]*$/.test(field)).sort();
     const declaredToolRanges = { ...stringMap(pkg?.dependencies), ...stringMap(pkg?.devDependencies), ...stringMap(pkg?.peerDependencies) };
     const tools = new Set();
     if ('schemaVersion' in pack)
@@ -202,6 +203,6 @@ function discoverProjectEvidence(cwd, pack, dependencies = {}) {
     return {
         cwd: root, os: targetPlatform, runtimeVersions: { node: process.versions.node ?? null, ...(environment ? { python: environment.runtimeVersion } : {}) }, pythonEnvironmentRoot: environment?.rootParts[0] ?? null, declaredToolRanges, toolVersions,
         packageManager: declaredManager ?? (lockManagers.size === 1 ? [...lockManagers][0] : null), packageManagerConflict: lockManagers.size > 1,
-        scripts, configFiles, paths: [...new Set([...(safeFile(root, 'package.json') ? ['package.json'] : []), ...locks, ...configFiles])].sort(),
+        scripts, configFiles, packageJsonFields, paths: [...new Set([...(safeFile(root, 'package.json') ? ['package.json'] : []), ...locks, ...configFiles])].sort(),
     };
 }

package/dist/src/commands/sensors/compatibility/live.js

@@ -82,6 +82,7 @@ async function resolveParsedPackCompatibility(cwd, pack, options = {}) {
                 toolExecutable: variant.command.executable,
                 toolResolution: variant.command.resolution,
                 pythonEnvironmentRoot: variant.command.pythonEnvironmentRoot,
+                environment: variant.command.environment,
                 configFiles: evidence.configFiles,
                 scripts: evidence.scripts,
             })

package/dist/src/commands/sensors/compatibility/probe.js

@@ -16,7 +16,12 @@ function commandFor(kind, evidence) {
         return null;
     if (kind === 'config-present')
         return null;
-    const command = { executable, resolution, ...(resolution === 'python-environment' && evidence.pythonEnvironmentRoot ? { pythonEnvironmentRoot: evidence.pythonEnvironmentRoot } : {}) };
+    const command = {
+        executable,
+        resolution,
+        ...(resolution === 'python-environment' && evidence.pythonEnvironmentRoot ? { pythonEnvironmentRoot: evidence.pythonEnvironmentRoot } : {}),
+        ...(evidence.environment ? { environment: evidence.environment } : {}),
+    };
     if (kind === 'version')
         return { ...command, args: ['--version'] };
     if (kind === 'eslint-print-config')

package/dist/src/commands/sensors/compatibility/resolve.js

@@ -45,6 +45,17 @@ function toolFor(variant, evidence) {
 function runtimeFor(variant, evidence) {
     return evidence.runtimeVersions === undefined ? evidence.runtimeVersion : evidence.runtimeVersions[variant.requirements.runtime];
 }
+/** A variant may name alternative native configuration files that make it
+ * applicable. They are alternatives (for example `.eslintrc.*`), not a list
+ * that a project must contain in full. A variant without this requirement is
+ * configuration-agnostic. */
+function hasRequiredConfig(variant, evidence) {
+    const requiredFiles = variant.requirements.configFiles ?? [];
+    const requiredFields = variant.requirements.packageJsonFields ?? [];
+    return (requiredFiles.length === 0 && requiredFields.length === 0)
+        || requiredFiles.some(file => evidence.paths?.includes(file))
+        || requiredFields.some(field => evidence.packageJsonFields?.includes(field));
+}
 /** Pure precedence resolver. It consumes discovered evidence and neither probes nor executes commands. */
 function resolveSensorCompatibility(sensor, evidence, context) {
     if (!sensor || typeof sensor !== 'object' || !evidence || typeof evidence !== 'object')
@@ -66,7 +77,9 @@ function resolveSensorCompatibility(sensor, evidence, context) {
     const operational = v2.variants.filter(variant => validVersion(toolFor(variant, evidence)) && validVersion(runtimeFor(variant, evidence)));
     if (operational.length === 0)
         return result('unverifiable', 'invalid-or-missing-version-evidence', null, evidence);
-    const matches = operational.filter(variant => semver_1.default.satisfies(toolFor(variant, evidence), variant.requirements.toolRange) && semver_1.default.satisfies(runtimeFor(variant, evidence), variant.requirements.runtimeRange));
+    const matches = operational.filter(variant => semver_1.default.satisfies(toolFor(variant, evidence), variant.requirements.toolRange)
+        && semver_1.default.satisfies(runtimeFor(variant, evidence), variant.requirements.runtimeRange)
+        && hasRequiredConfig(variant, evidence));
     if (matches.length === 0)
         return result('incompatible', 'no-operational-variant', null, evidence);
     matches.sort((a, b) => b.priority - a.priority || specificity(b) - specificity(a) || a.id.localeCompare(b.id));

package/dist/tests/commands/sensors/compatibility/contract.test.js

@@ -150,9 +150,11 @@ describe('sensor pack v2 contract', () => {
         expect(() => (0, contract_1.parseSensorPack)({ ...validPack(), sensors: { lint: { applicability: { allFiles: [3] }, variants: [variant] } } }, 'pack')).toThrow('allFiles[0]');
         expect(() => (0, contract_1.parseSensorPack)({ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [{ ...variant, probe: { kind: 'version', extra: true } }] } } }, 'pack')).toThrow('unknown field');
     });
-    it('preserves configFiles and rejects incomplete public overlap input', () => {
-        const variant = { ...validPack().sensors.lint.variants[0], requirements: { ...validPack().sensors.lint.variants[0].requirements, configFiles: ['eslint.config.js'] } };
-        expect((0, contract_1.parseSensorPack)({ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [variant] } } }, 'pack')).toMatchObject({ kind: 'v2', pack: { sensors: { lint: { variants: [{ requirements: { configFiles: ['eslint.config.js'] } }] } } } });
+    it('preserves config selectors and validates package.json field names', () => {
+        const variant = { ...validPack().sensors.lint.variants[0], requirements: { ...validPack().sensors.lint.variants[0].requirements, configFiles: ['eslint.config.js'], packageJsonFields: ['eslintConfig'] } };
+        expect((0, contract_1.parseSensorPack)({ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [variant] } } }, 'pack')).toMatchObject({ kind: 'v2', pack: { sensors: { lint: { variants: [{ requirements: { configFiles: ['eslint.config.js'], packageJsonFields: ['eslintConfig'] } }] } } } });
+        const malformed = { ...variant, requirements: { ...variant.requirements, packageJsonFields: ['eslint-config'] } };
+        expect(() => (0, contract_1.parseSensorPack)({ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [malformed] } } }, 'pack')).toThrow('packageJsonFields[0]');
         const complete = validPack().sensors.lint.variants[0];
         expect(() => (0, contract_1.assertNoEqualPriorityOverlap)([{ ...complete, id: '../bad' }])).toThrow('stable lowercase id');
         expect(() => (0, contract_1.assertNoEqualPriorityOverlap)([{ ...complete, command: undefined }])).toThrow('command');

package/dist/tests/commands/sensors/compatibility/discovery.test.js

@@ -11,7 +11,7 @@ describe('discoverProjectEvidence', () => {
     it('returns only local, relative project evidence and detects conflicting lockfiles', () => {
         const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-discovery-'));
         try {
-            fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), JSON.stringify({ scripts: { lint: 'eslint .' }, devDependencies: { eslint: '10.0.0' } }));
+            fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), JSON.stringify({ scripts: { lint: 'eslint .' }, eslintConfig: { env: { node: true } }, devDependencies: { eslint: '10.0.0' } }));
             fs_1.default.writeFileSync(path_1.default.join(root, 'package-lock.json'), '{}');
             fs_1.default.writeFileSync(path_1.default.join(root, 'pnpm-lock.yaml'), 'lockfileVersion: 9');
             fs_1.default.writeFileSync(path_1.default.join(root, 'eslint.config.js'), 'export default []');
@@ -24,6 +24,7 @@ describe('discoverProjectEvidence', () => {
             expect(evidence.toolVersions.eslint).toBe('10.4.1');
             expect(evidence.scripts).toContain('lint');
             expect(evidence.configFiles).toContain('eslint.config.js');
+            expect(evidence.packageJsonFields).toContain('eslintConfig');
             expect(evidence.paths.every((item) => !path_1.default.isAbsolute(item) && !item.includes('..'))).toBe(true);
         }
         finally {

package/dist/tests/commands/sensors/compatibility/probe.test.js

@@ -20,6 +20,15 @@ describe('runCompatibilityProbe', () => {
         await (0, probe_1.runCompatibilityProbe)({ kind: 'eslint-print-config' }, evidence, fakeExecutor);
         expect(fakeExecutor).toHaveBeenCalledWith(expect.objectContaining({ executable: 'eslint', resolution: 'node-modules-bin' }), expect.any(Object));
     });
+    it('propagates the selected ESLint mode to its compatibility probe', async () => {
+        await (0, probe_1.runCompatibilityProbe)({ kind: 'eslint-print-config' }, {
+            ...evidence,
+            toolExecutable: 'eslint',
+            toolResolution: 'node-modules-bin',
+            environment: { ESLINT_USE_FLAT_CONFIG: 'true' },
+        }, fakeExecutor);
+        expect(fakeExecutor).toHaveBeenCalledWith(expect.objectContaining({ environment: { ESLINT_USE_FLAT_CONFIG: 'true' } }), expect.any(Object));
+    });
     it('binds Semgrep validation to the contained Python environment', async () => {
         await (0, probe_1.runCompatibilityProbe)({ kind: 'semgrep-validate' }, evidence, fakeExecutor);
         expect(fakeExecutor).toHaveBeenCalledWith(expect.objectContaining({ executable: 'semgrep', resolution: 'python-environment' }), expect.any(Object));

package/dist/tests/commands/sensors/compatibility/resolve.test.js

@@ -50,6 +50,32 @@ describe('resolveSensorCompatibility', () => {
         const resolved = (0, resolve_1.resolveSensorCompatibility)({ applicability: { allFiles: ['package.json'] }, variants }, evidence({ toolVersions: { eslint: '10.4.1', biome: null }, runtimeVersions: { node: '22.0.0' }, toolVersion: '8.0.0', runtimeVersion: '8.0.0' }), context);
         expect(resolved).toMatchObject({ state: 'certified', variantId: 'eslint', toolVersion: '10.4.1', runtimeVersion: '22.0.0' });
     });
+    it('selects the ESLint 8 flat variant from native config evidence before priority', () => {
+        const eslintrc = {
+            ...variant('eslint-8-eslintrc', 40, '>=8 <9', '=8.57.1'),
+            requirements: { ...variant('eslint-8-eslintrc').requirements, toolRange: '>=8 <9', configFiles: ['.eslintrc.json'] },
+        };
+        const flat = {
+            ...variant('eslint-8-flat', 30, '>=8 <9', '=8.57.1'),
+            requirements: { ...variant('eslint-8-flat').requirements, toolRange: '>=8 <9', configFiles: ['eslint.config.mjs'] },
+        };
+        const resolved = (0, resolve_1.resolveSensorCompatibility)({ applicability: { allFiles: ['package.json'] }, variants: [eslintrc, flat] }, evidence({ toolVersion: '8.57.1', paths: ['package.json', 'eslint.config.mjs'] }), context);
+        expect(resolved).toMatchObject({ state: 'certified', variantId: 'eslint-8-flat' });
+    });
+    it('selects the ESLint 8 eslintrc variant from package.json eslintConfig evidence', () => {
+        const eslintrc = {
+            ...variant('eslint-8-eslintrc', 40, '>=8 <9', '=8.57.1'),
+            requirements: { ...variant('eslint-8-eslintrc').requirements, toolRange: '>=8 <9', packageJsonFields: ['eslintConfig'] },
+        };
+        const flat = {
+            ...variant('eslint-8-flat', 30, '>=8 <9', '=8.57.1'),
+            requirements: { ...variant('eslint-8-flat').requirements, toolRange: '>=8 <9', configFiles: ['eslint.config.mjs'] },
+        };
+        const resolved = (0, resolve_1.resolveSensorCompatibility)({ applicability: { allFiles: ['package.json'] }, variants: [eslintrc, flat] }, evidence({ toolVersion: '8.57.1', paths: ['package.json'], packageJsonFields: ['eslintConfig'] }), context);
+        expect(resolved).toMatchObject({ state: 'certified', variantId: 'eslint-8-eslintrc' });
+        expect((0, resolve_1.resolveSensorCompatibility)({ applicability: { allFiles: ['package.json'] }, variants: [eslintrc, flat] }, evidence({ toolVersion: '8.57.1', paths: ['package.json'], packageJsonFields: [] }), context))
+            .toMatchObject({ state: 'incompatible', variantId: null });
+    });
     it('does not reuse scalar evidence for a missing key in a version map', () => {
         const biome = { ...variant('biome'), requirements: { ...variant('biome').requirements, tool: 'biome', runtime: 'bun' } };
         expect((0, resolve_1.resolveSensorCompatibility)({ applicability: { allFiles: ['package.json'] }, variants: [biome] }, evidence({ toolVersions: { biome: null }, runtimeVersions: { bun: null }, toolVersion: '10.4.1', runtimeVersion: '22.0.0' }), context))

package/dist/tests/commands/sensors/init.test.js

@@ -305,6 +305,7 @@ describe('initSensors', () => {
             const automatic = await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry, configure: false });
             expect(automatic.manifest).toMatchObject({ schemaVersion: 2, pack: 'generic', sensors: {} });
             expect(automatic.manifest.packSelection).toBeUndefined();
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'generic.config'), 'fixture\n');
             const explicit = await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry, pack: 'generic' });
             const written = JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), 'utf8'));
             expect(explicit.manifest).toMatchObject({ schemaVersion: 2, pack: 'generic', packSelection: 'explicit', sensors: { security: { variantId: 'eslint-10' } } });

package/dist/tests/commands/watch/runner.test.js

@@ -90,7 +90,28 @@ describe('runner concurrente', () => {
         expect(done.wrapperRef.pid).toBeGreaterThan(0);
     });
     test('job largo pasa por running con identidad real; jamas se mata por duracion (R3.5)', async () => {
-        seedJob(repo, { argv: ['node', '-e', 'setTimeout(()=>process.exit(0), 1500)'] });
+        // El hijo vive hasta que EL TEST lo libera, no hasta que se cumple un reloj.
+        //
+        // Con una duracion fija (era 1500 ms) esto era una carrera imposible de ganar:
+        // el test espera OBSERVAR el estado transitorio `running`, y en win32 cada
+        // consulta de vitalidad spawnea tasklist/WMI — cientos de ms bajo carga, el mismo
+        // costo que documenta el `jest.setTimeout` de arriba. Si la primera observacion
+        // llegaba despues de que el hijo ya habia muerto, el estado saltaba directo a
+        // `exited` y `running` NO VOLVIA A OCURRIR NUNCA: la condicion quedaba
+        // permanentemente falsa y `until` giraba hasta agotar su presupuesto. Subir el
+        // timeout no lo arregla — no falta tiempo, falta que el estado sea observable.
+        // Fallo real: run 32211063150, solo windows-latest, con Ubuntu y macOS en verde.
+        //
+        // El centinela invierte el control: el hijo sigue vivo mientras el test lo
+        // necesite, asi que `running` es observable con cualquier latencia de plataforma.
+        // Refuerza R3.5 en vez de aflojarlo — "jamas se mata por duracion" se prueba
+        // mejor con un job que vive tanto como haga falta que con uno de 1,5 s. El
+        // setTimeout de 60 s es solo una red: si el test muere antes de liberar, el hijo
+        // no queda huerfano reteniendo handles sobre el tmpdir (ver rmSyncRetryingEbusy).
+        const sentinel = path_1.default.join(repo, 'release-r35.sentinel');
+        seedJob(repo, {
+            argv: ['node', '-e', `const fs=require('fs'),f=${JSON.stringify(sentinel)};setTimeout(()=>process.exit(0),60000);setInterval(()=>{if(fs.existsSync(f))process.exit(0)},50)`],
+        });
         (0, runner_1.spawnPendingWrappers)(repo, 'rama', fakeSpawner);
         await until(() => {
             (0, runner_1.collectAndReconcile)(repo, 'rama');
@@ -105,6 +126,9 @@ describe('runner concurrente', () => {
         // exec-wrapper.test.ts) — este test no puede exigir mas certeza de
         // la que la plataforma real puede dar.
         expect(running.processRef.psArgsDigest).toMatch(/^([0-9a-f]{16}|unknown)$/);
+        // Recien ahora se libera al hijo: la transicion a `exited` la decide el test,
+        // no el reloj, asi que tampoco esa mitad depende de la latencia de la plataforma.
+        fs_1.default.writeFileSync(sentinel, '');
         await until(() => {
             (0, runner_1.collectAndReconcile)(repo, 'rama');
             return (0, store_1.readJournal)(repo, 'rama').state.jobs['j1'].executionState === 'exited';

package/dist/tests/integration/published-r3-acceptance.e2e.test.js

@@ -0,0 +1,118 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = __importDefault(require("crypto"));
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const publishedCliRoot = process.env.AWM_PUBLISHED_CLI_ROOT;
+// GitHub's Windows workspace expression can combine backslashes with a trailing
+// forward-slash path segment. The CLI rightly requires normalized provenance;
+// normalize the CI fixture boundary before passing it as user input.
+const publishedRegistryRoot = process.env.AWM_PUBLISHED_REGISTRY_ROOT
+    ? path_1.default.resolve(process.env.AWM_PUBLISHED_REGISTRY_ROOT)
+    : undefined;
+// This gate is pinned to the npm release that contains the native ESLint
+// configuration selection fix merged for R3.
+const expectedVersion = process.env.AWM_PUBLISHED_CLI_VERSION ?? '8.1.2';
+const enabled = Boolean(publishedCliRoot && publishedRegistryRoot);
+const acceptance = enabled ? describe : describe.skip;
+function hashTree(root) {
+    const hash = crypto_1.default.createHash('sha256');
+    const walk = (directory) => {
+        for (const entry of fs_1.default.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            const item = path_1.default.join(directory, entry.name);
+            hash.update(path_1.default.relative(root, item));
+            if (entry.isDirectory())
+                walk(item);
+            else if (entry.isFile())
+                hash.update(fs_1.default.readFileSync(item));
+        }
+    };
+    walk(root);
+    return hash.digest('hex');
+}
+function createFixture(kind) {
+    const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-published-r3-'));
+    const project = path_1.default.join(root, 'project');
+    const awmHome = path_1.default.join(root, 'awm-home');
+    fs_1.default.mkdirSync(project, { recursive: true });
+    fs_1.default.mkdirSync(path_1.default.join(awmHome, 'registries'), { recursive: true });
+    fs_1.default.cpSync(publishedRegistryRoot, path_1.default.join(awmHome, 'registries', 'baseline'), { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(awmHome, 'registries.json'), JSON.stringify([{ name: 'baseline', remote: 'published-acceptance' }]));
+    fs_1.default.writeFileSync(path_1.default.join(project, 'package.json'), JSON.stringify({ name: `published-${kind}`, version: '1.0.0', scripts: { test: 'node -e "process.exit(0)"' } }));
+    if (kind === 'legacy') {
+        fs_1.default.mkdirSync(path_1.default.join(project, '.awm'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(project, '.awm', 'sensors.json'), JSON.stringify({
+            pack: 'js-ts', sensors: { lint: { enabled: false, fast: true } },
+        }));
+    }
+    if (kind === 'future') {
+        fs_1.default.mkdirSync(path_1.default.join(project, 'node_modules', 'eslint'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(project, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ name: 'eslint', version: '11.0.0' }));
+    }
+    return { root, project, awmHome };
+}
+function command(fixture, ...args) {
+    const bin = path_1.default.join(publishedCliRoot, 'dist', 'src', 'index.js');
+    return (0, child_process_1.spawnSync)(process.execPath, [bin, ...args], {
+        cwd: fixture.project,
+        encoding: 'utf8',
+        env: { ...process.env, AWM_HOME: fixture.awmHome, AWM_NO_UPDATE_CHECK: '1' },
+    });
+}
+function json(result) {
+    if (result.stdout.trim() === '')
+        throw new Error(`expected JSON output; status=${result.status}; stderr=${result.stderr}`);
+    return JSON.parse(result.stdout);
+}
+acceptance('published R3 acceptance', () => {
+    beforeAll(() => {
+        const packageJson = JSON.parse(fs_1.default.readFileSync(path_1.default.join(publishedCliRoot, 'package.json'), 'utf8'));
+        expect(packageJson.version).toBe(expectedVersion);
+        expect(fs_1.default.existsSync(path_1.default.join(publishedCliRoot, 'dist', 'src', 'index.js'))).toBe(true);
+        expect(fs_1.default.existsSync(path_1.default.join(publishedRegistryRoot, 'sensor-packs', 'js-ts', 'pack.json'))).toBe(true);
+    });
+    test.each(['new', 'legacy', 'future'])('uses the npm-installed CLI for the %s compatibility case', (kind) => {
+        const fixture = createFixture(kind);
+        try {
+            if (kind !== 'legacy') {
+                const init = command(fixture, 'sensors', 'init', '--registry-root', publishedRegistryRoot, '--pack', 'js-ts', '--no-configure');
+                expect(init.status).toBe(0);
+            }
+            const beforeReadOnly = hashTree(fixture.project);
+            const status = command(fixture, 'sensors', 'status');
+            expect([0, 1]).toContain(status.status);
+            const preflight = command(fixture, 'preflight', '--json');
+            expect([0, 1]).toContain(preflight.status);
+            expect(json(preflight)).toHaveProperty('status');
+            const run = command(fixture, 'sensors', 'run', '--fast');
+            expect([0, 1]).toContain(run.status);
+            expect(json(run)).toHaveProperty('overall');
+            const coverage = command(fixture, 'sensors', 'coverage', '--json', '--min', '2');
+            if (process.platform === 'win32') {
+                expect(coverage.status).toBe(1);
+                expect(`${coverage.stdout}${coverage.stderr}`).toContain('platform cannot guarantee no symlink dereference');
+            }
+            else {
+                expect(coverage.status).toBe(0);
+                expect(json(coverage)).toHaveProperty('schemaVersion', 2);
+            }
+            expect(hashTree(fixture.project)).toBe(beforeReadOnly);
+            command(fixture, 'ledger', 'add', '--branch', 'published-acceptance', '--polarity', 'finding', '--class', 'seguridad', '--signature', 'published-r3-finding', '--severity', 'important', '--desc', 'sanitized acceptance finding', '--defect-class', 'hardcoded-secrets');
+            const beforeArchive = command(fixture, 'sensors', 'coverage', '--json', '--min', '2');
+            expect(beforeArchive.status).toBe(process.platform === 'win32' ? 1 : 0);
+            const archived = command(fixture, 'ledger', 'archive', '--branch', 'published-acceptance');
+            expect(archived.status).toBe(0);
+            expect(json(archived)).toMatchObject({ archived: true, branch: 'published-acceptance' });
+            expect(fs_1.default.existsSync(path_1.default.join(fixture.project, '.awm', 'ledger', 'published-acceptance.jsonl'))).toBe(false);
+            expect(fs_1.default.readdirSync(path_1.default.join(fixture.project, '.awm', 'ledger', 'archive'))).toHaveLength(1);
+        }
+        finally {
+            fs_1.default.rmSync(fixture.root, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/structural/release-flags-are-reachable-from-ci.test.js

@@ -0,0 +1,67 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Guard estructural — una capacidad del release que CI no puede invocar no existe en la
+// práctica, y su ausencia no se nota hasta el día que hace falta.
+//
+// Pasó con `--force`. El flag estaba implementado y cubierto por tests
+// (tests/release/orchestrator.test.ts: "--force patch publica aunque no haya commits
+// releasables"), pero `release.yml` solo pasaba `--dry-run`. Consecuencia real: el PR #88
+// corrigió `"license": "ISC"` -> `"Apache-2.0"` en el paquete publicado, se mergeó como
+// `chore(legal):`, `determineBump` devolvió null — correctamente, un chore no es un
+// release —, el workflow corrió EN VERDE y no publicó nada. `main` quedó bien y npm
+// siguió entregando la licencia equivocada. No había forma de publicarlo desde CI.
+//
+// La regla no enumera los flags a mano: los deriva del propio `parseArgs`, así que un
+// flag agregado mañana obliga a decidir explícitamente si CI puede alcanzarlo, en vez de
+// heredar el silencio.
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const js_yaml_1 = __importDefault(require("js-yaml"));
+const CLI_ROOT = path_1.default.resolve(__dirname, '..', '..');
+const REPO_ROOT = path_1.default.resolve(CLI_ROOT, '..');
+const RELEASE_ENTRY = path_1.default.join(CLI_ROOT, 'src', 'release', 'index.ts');
+const RELEASE_WORKFLOW = path_1.default.join(REPO_ROOT, '.github', 'workflows', 'release.yml');
+// Flags deliberadamente NO expuestos a CI, con la razón por la que no lo están. Sacar uno
+// de acá sin exponerlo en el workflow rompe el test a propósito.
+const NOT_FOR_CI = {
+    '--no-push': 'uso local: un release desde CI siempre empuja',
+    '--branch': 'CI siempre libera desde main; el gate de rama vive en el orquestador',
+};
+/** Los flags que `parseArgs` realmente acepta, leídos del código, no de una lista. */
+function acceptedFlags() {
+    const source = fs_1.default.readFileSync(RELEASE_ENTRY, 'utf8');
+    const found = [...source.matchAll(/a === '(--[a-z-]+)'/g)].map((m) => m[1]);
+    return [...new Set(found)];
+}
+/** El workflow sin sus comentarios. La alcanzabilidad se mide sobre lo que EJECUTA: un
+ *  comentario que menciona `--force` no lo hace invocable, y la primera versión de este
+ *  test se dejaba engañar por exactamente eso. */
+function withoutComments(source) {
+    return source
+        .split('\n')
+        .filter((line) => !/^\s*#/.test(line))
+        .join('\n');
+}
+describe('flags del release: implementados <=> alcanzables desde CI', () => {
+    const workflowSource = fs_1.default.readFileSync(RELEASE_WORKFLOW, 'utf8');
+    const executable = withoutComments(workflowSource);
+    const workflow = js_yaml_1.default.load(workflowSource);
+    it('parseArgs declara al menos un flag', () => {
+        expect(acceptedFlags().length).toBeGreaterThan(0);
+    });
+    it('cada flag del release está expuesto en release.yml o excluido con motivo', () => {
+        const unreachable = acceptedFlags().filter((flag) => !executable.includes(flag) && !(flag in NOT_FOR_CI));
+        expect(unreachable).toEqual([]);
+    });
+    it('workflow_dispatch expone el bump forzado', () => {
+        const inputs = workflow.on?.workflow_dispatch?.inputs ?? {};
+        expect(Object.keys(inputs)).toContain('bump');
+    });
+    it('el paso de Release pasa --force solo cuando el bump no es auto', () => {
+        expect(workflowSource).toMatch(/inputs\.bump != 'auto'/);
+        expect(workflowSource).toMatch(/--force \{0\}/);
+    });
+});

package/dist/tests/structural/support-matrix-is-current.test.js

@@ -55,10 +55,10 @@ describe('docs/support-matrix.md refleja el codigo', () => {
     it('CI regenerates the published matrix from the immutable registry tag', () => {
         const workflow = fs_1.default.readFileSync(CI_WORKFLOW_PATH, 'utf8');
         expect(workflow).toContain('repository: Kodria/awm-baseline-registry');
-        expect(workflow).toContain('ref: v2.0.0');
+        expect(workflow).toContain('ref: v2.0.1');
         expect(workflow).toContain('path: awm-baseline-registry');
         expect(workflow).toContain('Verify published sensor support matrix');
-        expect(workflow).toContain('--registry-root ../awm-baseline-registry --registry-tag v2.0.0 --registry-commit c35c087a0801c0b4e69e0a4ac3eafef9ecdf37cd');
+        expect(workflow).toContain('--registry-root ../awm-baseline-registry --registry-tag v2.0.1 --registry-commit 6f40632006fc65300ac633c5a54f2635cf0eb8e9');
         expect(workflow).toContain('git diff --exit-code -- docs/support-matrix.md');
     });
     it('retains the published registry certification rows verbatim instead of inventing fixture evidence', () => {
@@ -87,7 +87,7 @@ describe('docs/support-matrix.md refleja el codigo', () => {
         expect((0, sensor_support_matrix_1.extractPublishedSupportMetadata)(publishedSupport)).toContain('compatible-unverified');
         expect((0, sensor_support_matrix_1.extractPublishedSupportMetadata)(publishedSupport)).not.toContain('Fixture-declared ranges only');
     });
-    it('rejects a mutable checkout even when it contains the published v2.0.0 tag', () => {
+    it('rejects a mutable checkout even when it contains the published v2.0.1 tag', () => {
         const registryRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-published-registry-'));
         const git = (...args) => (0, child_process_1.execFileSync)('git', ['-C', registryRoot, ...args], { stdio: 'pipe' });
         try {
@@ -97,11 +97,11 @@ describe('docs/support-matrix.md refleja el codigo', () => {
             fs_1.default.writeFileSync(path_1.default.join(registryRoot, 'published.txt'), 'published\n');
             git('add', '.');
             git('commit', '-m', 'published registry');
-            git('tag', 'v2.0.0');
+            git('tag', 'v2.0.1');
             fs_1.default.writeFileSync(path_1.default.join(registryRoot, 'mutable.txt'), 'newer checkout\n');
             git('add', '.');
             git('commit', '-m', 'mutable checkout');
-            expect(() => (0, sensor_support_matrix_1.verifyPublishedRegistryIdentity)(registryRoot, 'v2.0.0', 'c35c087a0801c0b4e69e0a4ac3eafef9ecdf37cd')).toThrow(/HEAD .*expected commit/i);
+            expect(() => (0, sensor_support_matrix_1.verifyPublishedRegistryIdentity)(registryRoot, 'v2.0.1', '6f40632006fc65300ac633c5a54f2635cf0eb8e9')).toThrow(/HEAD .*expected commit/i);
         }
         finally {
             fs_1.default.rmSync(registryRoot, { recursive: true, force: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "8.1.1",
+  "version": "8.1.3",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"
@@ -38,7 +38,7 @@
     "ai"
   ],
   "author": "Kodria",
-  "license": "ISC",
+  "license": "Apache-2.0",
   "engines": {
     "node": ">=22"
   },