agentic-workflow-manager 8.1.3 → 8.1.5

package/dist/tests/commands/sensors/run.test.js

@@ -7,6 +7,7 @@ const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const run_1 = require("../../../src/commands/sensors/run");
+const verdict_1 = require("../../../src/commands/sensors/verdict");
 function mkTmp() {
     return fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-sensors-'));
 }
@@ -53,6 +54,17 @@ describe('runSensors', () => {
             fs_1.default.rmSync(emptyDir, { recursive: true });
         }
     });
+    it.each([
+        ['fast', { fast: 'yes' }, 'run option fast must be a boolean'],
+        ['slow', { slow: 1 }, 'run option slow must be a boolean'],
+        ['all', { all: null }, 'run option all must be a boolean'],
+        ['cwd', { cwd: '   ' }, 'run option cwd must be a nonempty string'],
+    ])('rejects invalid public %s options before selecting or dispatching sensors', async (_name, options, message) => {
+        const { runSensors } = load();
+        await expect(runSensors(options)).rejects.toThrow(message);
+        expect(mockRunCommand).not.toHaveBeenCalled();
+        expect(mockRunStructuredCommand).not.toHaveBeenCalled();
+    });
     it('runs only fast sensors with --fast flag', async () => {
         mockRunCommand.mockResolvedValue(ok());
         const { runSensors } = load();
@@ -61,6 +73,12 @@ describe('runSensors', () => {
         expect(result.sensors.some((s) => s.name === 'security')).toBe(false);
         expect(result.overall).toBe('not_certified');
     });
+    it('runs both fast and slow sensors when --fast and --slow are combined', async () => {
+        mockRunCommand.mockResolvedValue(ok());
+        const { runSensors } = load();
+        const result = await runSensors({ fast: true, slow: true, cwd: tmpDir });
+        expect(result.sensors.map((sensor) => sensor.name)).toEqual(['typecheck', 'lint', 'security', 'mutation']);
+    });
     it('returns fail when a fast sensor has errors', async () => {
         mockRunCommand
             .mockResolvedValueOnce(exited(1, 'src/a.ts(1,1): error TS0001: Bad type.'))
@@ -203,6 +221,17 @@ describe('runSensors', () => {
         expect(result.overall).toBe('fail');
     });
 });
+describe('reduceVerdict', () => {
+    it('lets a failing full sensor outrank an empty changed-scope synthetic pass', () => {
+        expect((0, verdict_1.reduceVerdict)([
+            { name: 'lint', status: 'pass', errors: [], scope: 'changed' },
+            { name: 'typecheck', status: 'fail', errors: [{ message: 'broken' }] },
+        ])).toBe('fail');
+    });
+    it('rejects malformed result statuses instead of treating them as skipped', () => {
+        expect(() => (0, verdict_1.reduceVerdict)([{ name: 'lint', status: 'bogus', errors: [] }])).toThrow('sensor result status is invalid');
+    });
+});
 describe('runSensors v2 lifecycle contract', () => {
     let project;
     let home;

package/dist/tests/commands/sensors/status-windows.test.js

@@ -53,7 +53,7 @@ describe('computeSensorStatus — Windows PATH resolution', () => {
         // En win32 el usuario escribe `semgrep` y en disco existe `semgrep.cmd`.
         fs_1.default.writeFileSync(path_1.default.join(pathDir, 'semgrep.cmd'), '@echo off\r\n');
         const result = await (0, status_1.computeSensorStatus)(tmpDir);
-        expect(result.overall).toBe('DEGRADED');
+        expect(result.overall).toBe('READY');
         expect(result.checks.security.ok).toBe(true);
     });
     it('reporta ok:false en win32 cuando el binario no esta en PATH', async () => {

package/dist/tests/commands/sensors/status.test.js

@@ -7,8 +7,11 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const status_1 = require("../../../src/commands/sensors/status");
-const checks_1 = require("../../../src/commands/preflight/checks");
-const run_1 = require("../../../src/commands/sensors/run");
+jest.mock('../../../src/commands/sensors/exec', () => ({
+    runCommand: jest.fn(),
+    runStructuredCommand: jest.fn(),
+}));
+const { runCommand, runStructuredCommand } = require('../../../src/commands/sensors/exec');
 // `resolveOnPath` resuelve PATH en proceso (ya no invoca un shell — ver
 // core/paths.ts). Por eso estos tests controlan un PATH aislado en vez de
 // mockear `execSync`: ademas de reflejar el mecanismo real, los vuelve
@@ -43,13 +46,35 @@ describe('computeSensorStatus', () => {
         expect(result.overall).toBe('NOT_CONFIGURED');
         expect(result.pack).toBeNull();
     });
+    it.each([
+        ['valid manifest', 'READY', () => {
+                installLocalBin('eslint');
+                fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'eslint.config.awm.mjs'), 'export default []');
+                fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
+                fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({
+                    pack: 'js-ts', sensors: { lint: { cmd: 'npx eslint . --config eslint.config.awm.mjs' } },
+                }));
+            }],
+        ['missing tool', 'DEGRADED', () => {
+                fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
+                fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({
+                    pack: 'js-ts', sensors: { lint: { cmd: 'npx eslint .' } },
+                }));
+            }],
+        ['absent manifest', 'NOT_CONFIGURED', () => { }],
+    ])('reports %s as %s without dispatching sensor commands', async (_case, overall, setup) => {
+        setup();
+        await expect((0, status_1.computeSensorStatus)(tmpDir)).resolves.toMatchObject({ overall });
+        expect(runCommand).not.toHaveBeenCalled();
+        expect(runStructuredCommand).not.toHaveBeenCalled();
+    });
     // Helper: simulate a tool installed locally (node_modules/.bin/<tool>)
     function installLocalBin(tool) {
         const binDir = path_1.default.join(tmpDir, 'node_modules', '.bin');
         fs_1.default.mkdirSync(binDir, { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(binDir, tool), '');
     }
-    it('keeps an operational legacy manifest DEGRADED even when its npx tool is installed locally', async () => {
+    it('reports READY for an operational legacy manifest when its declared npx tool is installed locally', async () => {
         installLocalBin('tsc');
         fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({
@@ -57,7 +82,7 @@ describe('computeSensorStatus', () => {
             sensors: { typecheck: { cmd: 'npx tsc --noEmit', fast: true } }
         }));
         const result = await (0, status_1.computeSensorStatus)(tmpDir);
-        expect(result.overall).toBe('DEGRADED');
+        expect(result.overall).toBe('READY');
         expect(result.pack).toBe('js-ts');
         expect(result.checks.typecheck.ok).toBe(true);
     });
@@ -84,7 +109,7 @@ describe('computeSensorStatus', () => {
         expect(result.checks.lint.ok).toBe(false);
         expect(result.checks.lint.detail).toMatch(/missing config/i);
     });
-    it('is HEALTHY when the npx tool is installed and the --config file exists', async () => {
+    it('is READY when the declared npx tool and config are present without running a sensor command', async () => {
         installLocalBin('eslint');
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'eslint.config.awm.mjs'), 'export default []');
         fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
@@ -93,7 +118,10 @@ describe('computeSensorStatus', () => {
             sensors: { lint: { cmd: 'npx eslint . --config eslint.config.awm.mjs --format json', fast: true } }
         }));
         const result = await (0, status_1.computeSensorStatus)(tmpDir);
+        expect(result.overall).toBe('READY');
         expect(result.checks.lint.ok).toBe(true);
+        expect(runCommand).not.toHaveBeenCalled();
+        expect(runStructuredCommand).not.toHaveBeenCalled();
     });
     it('returns DEGRADED when a binary is missing', async () => {
         fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
@@ -122,7 +150,7 @@ describe('computeSensorStatus', () => {
             }));
             installOnPath('semgrep');
             const result = await (0, status_1.computeSensorStatus)(tmpDir);
-            expect(result.overall).toBe('DEGRADED');
+            expect(result.overall).toBe('READY');
             expect(result.checks.security.ok).toBe(true);
         });
     });
@@ -164,10 +192,10 @@ describe('computeSensorStatus', () => {
         expect(result.checks.mutation.ok).toBe(true);
         expect(result.checks.mutation.detail).toBe('disabled');
     });
-    it('does not trust the initialized v2 variant after local tool drift', async () => {
-        // The manifest records ESLint 9 at init time, but local evidence is now ESLint
-        // 10. Status must resolve the installed pack again, not certify the stale
-        // initializedCompatibility record.
+    it('degrades a v2 manifest whose live static compatibility has drifted', async () => {
+        // The manifest's initialization evidence remains durable diagnostic context.
+        // Status only checks its declared local executable; it never re-runs a project
+        // compatibility probe or calls a sensor command.
         const previousHome = process.env.AWM_HOME;
         const home = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-status-home-'));
         try {
@@ -178,7 +206,7 @@ describe('computeSensorStatus', () => {
             const variant = (id, range) => ({
                 id, priority: 10, certifiedRange: range,
                 requirements: { tool: 'eslint', toolRange: range, runtime: 'node', runtimeRange: '>=0.0.0' },
-                assets: ['eslint.config.awm.mjs'], formatter: 'eslint-llm', probe: { kind: 'config-present' },
+                assets: ['eslint.config.awm.mjs'], formatter: 'eslint-llm', probe: { kind: 'package-script-present' },
                 command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] },
             });
             fs_1.default.writeFileSync(path_1.default.join(registry, 'sensor-packs', 'js-ts', 'pack.json'), JSON.stringify({
@@ -188,6 +216,8 @@ describe('computeSensorStatus', () => {
             fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), JSON.stringify({ devDependencies: { eslint: '^10.0.0' } }));
             fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'node_modules', 'eslint'), { recursive: true });
             fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.0.0' }));
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'node_modules', '.bin'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', '.bin', 'eslint'), '');
             fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
             fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({
                 schemaVersion: 2, pack: 'js-ts', sensors: { lint: {
@@ -196,15 +226,17 @@ describe('computeSensorStatus', () => {
                     } },
             }));
             const result = await (0, status_1.computeSensorStatus)(tmpDir);
-            expect(result.overall).toBe('DEGRADED');
-            expect(result.checks.lint).toMatchObject({ ok: false, detail: expect.stringContaining('variant-drift') });
-            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'AGENTS.md'), '# test\n');
-            const gate = await (0, checks_1.preflight)(tmpDir);
-            expect(gate.status).toBe('degraded');
-            expect(gate.checks.find(check => check.id === 'tools')).toMatchObject({ ok: false, detail: expect.stringContaining('variant-drift') });
-            const run = await (0, run_1.runSensors)({ cwd: tmpDir, all: true });
-            expect(run.overall).toBe('not_certified');
-            expect(run.sensors).toEqual([expect.objectContaining({ name: 'lint', status: 'inconclusive', skipReason: expect.stringContaining('variant-drift') })]);
+            expect(result).toMatchObject({ overall: 'DEGRADED', checks: { lint: { ok: false } } });
+            expect(result.checks.lint.detail).toMatch(/drift|eslint-10/i);
+            // Once the installed tool matches the initialized variant, a failed
+            // static probe is still evidence of degraded readiness — it is not
+            // a runtime probe and cannot be waived as merely inconclusive.
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '9.0.0' }));
+            const staticProbeFailure = await (0, status_1.computeSensorStatus)(tmpDir);
+            expect(staticProbeFailure).toMatchObject({ overall: 'DEGRADED', checks: { lint: { ok: false } } });
+            expect(staticProbeFailure.checks.lint.detail).toMatch(/probe-not-matched|unverifiable/i);
+            expect(runCommand).not.toHaveBeenCalled();
+            expect(runStructuredCommand).not.toHaveBeenCalled();
         }
         finally {
             if (previousHome === undefined)

package/dist/tests/integration/preflight-json-pipe.e2e.test.js

@@ -7,20 +7,96 @@ const child_process_1 = require("child_process");
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const crypto_1 = __importDefault(require("crypto"));
 const cliRoot = path_1.default.resolve(__dirname, '../..');
 const bin = path_1.default.join(cliRoot, 'dist', 'src', 'index.js');
-test('preserves degraded preflight JSON when stdout is piped', () => {
+test('preserves actionable no-manifest preflight JSON when verify-sensors is piped', () => {
     const project = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-preflight-pipe-'));
     try {
-        const result = (0, child_process_1.spawnSync)(process.execPath, [bin, 'preflight', '--json'], {
+        const result = (0, child_process_1.spawnSync)(process.execPath, [bin, 'preflight', '--verify-sensors', '--json'], {
             cwd: project,
             encoding: 'utf8',
             env: { ...process.env, AWM_HOME: path_1.default.join(project, 'awm-home'), AWM_NO_UPDATE_CHECK: '1' },
         });
         expect(result.status).toBe(1);
-        expect(JSON.parse(result.stdout)).toMatchObject({ status: 'not_configured' });
+        expect(JSON.parse(result.stdout)).toMatchObject({
+            status: 'not_configured',
+            checks: expect.arrayContaining([expect.objectContaining({
+                    id: 'sensors-execution', ok: false,
+                    detail: 'sensor verdict was not_certified; no sensor established an empirical pass',
+                    remedy: expect.stringContaining('awm sensors init'),
+                })]),
+        });
     }
     finally {
         fs_1.default.rmSync(project, { recursive: true, force: true });
     }
 });
+function writeJson(file, value) {
+    fs_1.default.mkdirSync(path_1.default.dirname(file), { recursive: true });
+    fs_1.default.writeFileSync(file, JSON.stringify(value, null, 2));
+}
+function hashTree(root) {
+    const hash = crypto_1.default.createHash('sha256');
+    const walk = (dir) => {
+        for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            const file = path_1.default.join(dir, entry.name);
+            hash.update(path_1.default.relative(root, file));
+            if (entry.isDirectory())
+                walk(file);
+            else if (entry.isFile())
+                hash.update(fs_1.default.readFileSync(file));
+        }
+    };
+    walk(root);
+    return hash.digest('hex');
+}
+test('verify-sensors degrades parseably for a v2 sensor that exits 2 without findings and does not write the project', () => {
+    const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-preflight-verify-'));
+    const project = path_1.default.join(root, 'project');
+    const awmHome = path_1.default.join(root, 'awm-home');
+    const registry = path_1.default.join(awmHome, 'registries', 'baseline');
+    try {
+        fs_1.default.mkdirSync(project, { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(project, 'AGENTS.md'), '# context\n', { encoding: 'utf8', flag: 'w' });
+        writeJson(path_1.default.join(project, 'package.json'), { name: 'preflight-verify-fixture', private: true });
+        writeJson(path_1.default.join(project, 'node_modules', 'fixture-sensor', 'package.json'), { name: 'fixture-sensor', version: '1.0.0' });
+        fs_1.default.writeFileSync(path_1.default.join(project, 'fixture-sensor.config.mjs'), 'export default {};\n');
+        fs_1.default.writeFileSync(path_1.default.join(project, 'fixture-sensor.mjs'), 'process.exit(2);\n');
+        writeJson(path_1.default.join(registry, 'sensor-packs', 'fixture', 'pack.json'), {
+            schemaVersion: 2, name: 'fixture', description: 'preflight exit-2 fixture', detects: ['package.json'],
+            sensors: { lint: { applicability: { allFiles: ['package.json'] }, variants: [{
+                            id: 'fixture-v1', priority: 100,
+                            requirements: { tool: 'fixture-sensor', toolRange: '>=1 <2', runtime: 'node', runtimeRange: '>=20', configFiles: ['fixture-sensor.config.mjs'] },
+                            certifiedRange: '>=1 <2', command: { executable: 'node', resolution: 'path', args: ['fixture-sensor.mjs'] },
+                            assets: ['fixture-sensor.config.mjs'], formatter: 'generic', probe: { kind: 'config-present' },
+                        }] } },
+            coverage: { schemaVersion: 1, classes: {
+                    'fixture-output': {
+                        description: 'fixture output', detectors: [{ sensor: 'lint' }],
+                        remedy: { summary: 'run fixture', command: 'awm sensors init --pack fixture' },
+                    },
+                } },
+        });
+        writeJson(path_1.default.join(awmHome, 'registries.json'), [{ name: 'baseline', remote: 'fixture' }]);
+        writeJson(path_1.default.join(project, '.awm', 'sensors.json'), {
+            schemaVersion: 2, pack: 'fixture', packSelection: 'explicit', sensors: { lint: {
+                    enabled: true, fast: true, variantId: 'fixture-v1', command: { executable: 'node', resolution: 'path', args: ['fixture-sensor.mjs'] }, assets: ['fixture-sensor.config.mjs'],
+                    initializedCompatibility: { state: 'certified', reason: 'fixture', variantId: 'fixture-v1', toolVersion: '1.0.0', runtimeVersion: process.versions.node, certifiedRange: '>=1 <2', evidence: [] },
+                } },
+        });
+        const before = hashTree(project);
+        const result = (0, child_process_1.spawnSync)(process.execPath, [bin, 'preflight', '--verify-sensors', '--json', '--cwd', project], {
+            cwd: project, encoding: 'utf8', env: { ...process.env, AWM_HOME: awmHome, AWM_NO_UPDATE_CHECK: '1' },
+        });
+        expect(result.status).toBe(1);
+        expect(JSON.parse(result.stdout)).toMatchObject({
+            status: 'degraded',
+            checks: expect.arrayContaining([expect.objectContaining({ id: 'sensors-execution', ok: false, detail: expect.stringMatching(/lint.*exit 2/i) })]),
+        });
+        expect(hashTree(project)).toBe(before);
+    }
+    finally {
+        fs_1.default.rmSync(root, { recursive: true, force: true });
+    }
+});

package/dist/tests/integration/sensor-compatibility.e2e.test.js

@@ -58,6 +58,13 @@ function runCli(fixture, ...args) {
         env: { ...process.env, AWM_HOME: fixture.awmHome, AWM_NO_UPDATE_CHECK: '1' },
     });
 }
+function runAwm(fixture, ...args) {
+    return (0, child_process_1.spawnSync)(process.execPath, [bin, ...args], {
+        cwd: fixture.project,
+        encoding: 'utf8',
+        env: { ...process.env, AWM_HOME: fixture.awmHome, AWM_NO_UPDATE_CHECK: '1' },
+    });
+}
 function json(result) {
     expect(result.status).toBe(0);
     if (!(result.stdout ?? '').trim())
@@ -81,7 +88,7 @@ test.each(['linux', 'darwin', 'win32'])('keeps injected resolver semantics consi
             throw new Error('fixture must be a v2 pack');
         const discovered = (0, discovery_1.discoverProjectEvidence)(fixture.project, parsed.pack, { platform: () => platform });
         const probe = await (0, probe_1.runCompatibilityProbe)({ kind: 'version' }, { cwd: fixture.project, toolExecutable: 'eslint' }, async () => ({
-            code: 0, signal: null, timedOut: false, overflowed: false, stdout: 'eslint v10.4.1', stderr: '',
+            code: 0, signal: null, timedOut: false, overflowed: false, elapsedMs: 0, stdout: 'eslint v10.4.1', stderr: '',
         }));
         const result = (0, resolve_1.resolveSensorCompatibility)(parsed.pack.sensors.lint, { ...discovered, probe }, { pack: 'js-ts', sensor: 'lint' });
         expect(result).toMatchObject({ state: 'certified', variantId: 'eslint-10', toolVersion: '10.4.1' });
@@ -100,6 +107,38 @@ testWithNoFollow('compiled binary dispatches coverage and emits parseable JSON o
         fs_1.default.rmSync(fixture.root, { recursive: true, force: true });
     }
 });
+testWithNoFollow('compiled sensors run returns nonzero while preserving parseable not_certified JSON', () => {
+    const fixture = createFixture();
+    try {
+        fs_1.default.rmSync(path_1.default.join(fixture.project, '.awm', 'sensors.json'));
+        const result = runCli(fixture, 'run', '--fast');
+        expect(result.status).toBe(1);
+        expect(JSON.parse(result.stdout ?? '')).toMatchObject({ sensors: [], overall: 'not_certified' });
+    }
+    finally {
+        fs_1.default.rmSync(fixture.root, { recursive: true, force: true });
+    }
+});
+testWithNoFollow('compiled status reports static READY without writing or executing the project sensor (R6, R6.2)', () => {
+    const fixture = createFixture();
+    try {
+        const localBin = path_1.default.join(fixture.project, 'node_modules', '.bin', 'eslint');
+        fs_1.default.mkdirSync(path_1.default.dirname(localBin), { recursive: true });
+        fs_1.default.writeFileSync(localBin, 'this fixture must never be executed by status\n');
+        fs_1.default.copyFileSync(path_1.default.join(fixture.registryRoot, 'sensor-packs', 'js-ts', 'eslint.fixture.mjs'), path_1.default.join(fixture.project, 'eslint.fixture.mjs'));
+        const initialized = runCli(fixture, 'init', '--registry-root', fixture.registryRoot, '--pack', 'js-ts', '--no-configure');
+        expect(initialized.status).toBe(0);
+        const before = hashTree(fixture.project);
+        const result = runAwm(fixture, 'sensors', 'status');
+        expect(result.status).toBe(0);
+        expect(result.stdout).toContain('READY');
+        expect(result.stderr).toBe('');
+        expect(hashTree(fixture.project)).toBe(before);
+    }
+    finally {
+        fs_1.default.rmSync(fixture.root, { recursive: true, force: true });
+    }
+});
 testWithNoFollow('legacy coverage stays unverified, init migrates explicitly, and version drift is visible (R7.2, R7.8)', () => {
     const fixture = createFixture();
     try {

package/dist/tests/release/orchestrator.test.js

@@ -6,6 +6,10 @@ const core_1 = require("../../src/release/core");
 function makeIO(over = {}) {
     const calls = [];
     let pkgVersion = '2.1.1';
+    // El lockfile arranca en la MISMA version que el package.json, como en el repo real.
+    // Si el release no lo sincroniza, este valor se queda atras — que es exactamente el
+    // estado que dejaba `main` en rojo (#92).
+    let lockVersion = '2.1.1';
     const io = {
         run(cmd, args) {
             const full = `${cmd} ${args.join(' ')}`;
@@ -26,6 +30,7 @@ function makeIO(over = {}) {
         },
         readPackageVersion: () => pkgVersion,
         writePackageVersion: (v) => { pkgVersion = v; calls.push(`WRITE_PKG ${v}`); },
+        writeLockVersion: (v) => { lockVersion = v; calls.push(`WRITE_LOCK ${v}`); },
         readChangelog: () => '',
         writeChangelog: (c) => calls.push(`WRITE_CHANGELOG ${c.split('\n')[0]}`),
         writeNpmrc: () => calls.push('WRITE_NPMRC'),
@@ -35,7 +40,7 @@ function makeIO(over = {}) {
         env: { NPM_TOKEN: 'tok' },
         ...over,
     };
-    return { io, calls };
+    return { io, calls, versions: () => ({ pkg: pkgVersion, lock: lockVersion }) };
 }
 const opts = (o = {}) => ({ dryRun: false, force: null, push: true, branch: 'main', cliDir: '/cli', ...o });
 describe('release — happy path', () => {
@@ -54,6 +59,25 @@ describe('release — happy path', () => {
         expect(calls).toContain('WRITE_NPMRC');
         expect(calls).toContain('REMOVE_NPMRC');
     });
+    // #92: el bump escribia solo package.json, asi que el lockfile quedaba una version
+    // atras en CADA release. `r3-cli-major-version.test.ts` exige que coincidan, y el
+    // `[skip ci]` del commit de bump hacia que ese rojo no apareciera hasta el PR
+    // siguiente — que llegaba roto por algo que no habia hecho.
+    it('sincroniza package-lock.json con package.json y lo incluye en el commit de bump', () => {
+        const { io, calls, versions } = makeIO({ commits: `feat: x${core_1.US}${core_1.RS}` });
+        (0, orchestrator_1.release)(opts(), io);
+        expect(versions()).toEqual({ pkg: '2.2.0', lock: '2.2.0' });
+        expect(calls).toContain('WRITE_LOCK 2.2.0');
+        // Escribir el archivo no alcanza: si no se stagea, el commit de release lo deja
+        // fuera y el lockfile queda sucio en el working tree del runner.
+        expect(calls).toContain('git add cli/package.json cli/package-lock.json CHANGELOG.md');
+    });
+    it('no toca el lockfile cuando no hay nada que publicar', () => {
+        const { io, calls, versions } = makeIO({ commits: `docs: solo docs${core_1.US}${core_1.RS}` });
+        (0, orchestrator_1.release)(opts(), io);
+        expect(versions()).toEqual({ pkg: '2.1.1', lock: '2.1.1' });
+        expect(calls.some((c) => c.startsWith('WRITE_LOCK'))).toBe(false);
+    });
     it('sin commits releasables → no publica (exit 0 lógico)', () => {
         const { io, calls } = makeIO({ commits: `docs: solo docs${core_1.US}${core_1.RS}` });
         const res = (0, orchestrator_1.release)(opts(), io);

package/dist/tests/structural/sensor-documentation-contract.test.js

@@ -15,7 +15,25 @@ const sensors_1 = require("../../src/commands/sensors");
 const ROOT = path_1.default.resolve(__dirname, '../../..');
 const read = (file) => fs_1.default.readFileSync(path_1.default.join(ROOT, file), 'utf8');
 function documentedJson(files) {
-    return files.flatMap((file) => Array.from(read(file).matchAll(/```json\s*\n([\s\S]*?)```/g), (match) => JSON.parse(match[1])));
+    return files.flatMap((file) => {
+        const source = read(file);
+        return Array.from(source.matchAll(/```json\s*\n([\s\S]*?)```/g), (match) => {
+            const sectionStart = source.lastIndexOf('###', match.index ?? 0);
+            const leadIn = source.slice(Math.max(0, sectionStart), match.index ?? 0);
+            return {
+                value: JSON.parse(match[1]),
+                intentionallyIncomplete: /intentionally incomplete fragment/.test(leadIn),
+            };
+        });
+    });
+}
+function documentedV2Manifests(files) {
+    return documentedJson(files)
+        .filter((example) => !example.intentionallyIncomplete
+        && typeof example.value === 'object'
+        && example.value !== null
+        && example.value.schemaVersion === 2)
+        .map(example => example.value);
 }
 function helpFor(command) {
     const program = new commander_1.Command().name('awm');
@@ -38,17 +56,27 @@ describe('R3 canonical sensor documentation', () => {
         phrases.forEach((phrase) => expect(text).toContain(phrase));
     });
     test('parses every documented v2 sensor manifest example with the production parser', () => {
-        const examples = documentedJson(['docs/configuration.md', 'docs/cli-reference.md'])
-            .filter((value) => typeof value === 'object' && value !== null && value.schemaVersion === 2);
+        const examples = documentedV2Manifests(['docs/configuration.md', 'docs/cli-reference.md']);
         expect(examples.length).toBeGreaterThan(0);
         examples.forEach((example) => expect(() => (0, manifest_1.parseSensorManifest)(example, 'documented example')).not.toThrow());
     });
     test('keeps documented v2 sensor manifests portable across native platforms', () => {
-        const examples = documentedJson(['docs/configuration.md', 'docs/cli-reference.md'])
-            .filter((value) => typeof value === 'object' && value !== null && value.schemaVersion === 2);
+        const examples = documentedV2Manifests(['docs/configuration.md', 'docs/cli-reference.md']);
         expect(examples.length).toBeGreaterThan(0);
         examples.forEach((example) => expect(example).not.toHaveProperty('registryRoot'));
     });
+    test('excludes only an explicitly incomplete timeout fragment, not invalid full v2 manifests', () => {
+        const examples = documentedJson(['docs/configuration.md']);
+        const incomplete = examples.find(example => example.intentionallyIncomplete);
+        const complete = documentedV2Manifests(['docs/configuration.md']);
+        expect(incomplete?.value).toMatchObject({ schemaVersion: 2, sensors: { test: { timeout: 600000 } } });
+        expect(() => (0, manifest_1.parseSensorManifest)(incomplete?.value, 'incomplete timeout fragment')).toThrow();
+        expect(complete).toHaveLength(1);
+        expect(() => (0, manifest_1.parseSensorManifest)(complete[0], 'complete documented manifest')).not.toThrow();
+        expect(() => (0, manifest_1.parseSensorManifest)({
+            schemaVersion: 2, pack: 'js-ts', sensors: { test: { enabled: true, variantId: 'npm-script' } },
+        }, 'invalid full manifest')).toThrow();
+    });
     test('documents exact Commander flags', () => {
         expect(helpFor('sensors coverage')).toContain('--min <count>');
         expect(helpFor('ledger add')).toContain('--defect-class <id>');

package/dist/tests/structural/support-matrix-is-current.test.js

@@ -24,6 +24,31 @@ const sensor_support_matrix_1 = require("../../scripts/sensor-support-matrix");
 const SENSOR_FIXTURE_REGISTRY = path_1.default.join(__dirname, '..', 'fixtures', 'sensor-support-matrix', 'registry');
 const CI_WORKFLOW_PATH = path_1.default.resolve(__dirname, '../../..', '.github', 'workflows', 'ci.yml');
 describe('docs/support-matrix.md refleja el codigo', () => {
+    it('documents the bounded, empirical sensor gate contract (R3-R7, R10)', () => {
+        const root = path_1.default.resolve(__dirname, '../../..');
+        const cliReference = fs_1.default.readFileSync(path_1.default.join(root, 'docs', 'cli-reference.md'), 'utf8');
+        const configuration = fs_1.default.readFileSync(path_1.default.join(root, 'docs', 'configuration.md'), 'utf8');
+        const acceptance = fs_1.default.readFileSync(path_1.default.join(root, 'docs', 'testing', 'core-acceptance.md'), 'utf8');
+        const osMatrix = fs_1.default.readFileSync(path_1.default.join(root, 'docs', 'testing', 'os-matrix.md'), 'utf8');
+        for (const expected of [
+            '`execution.timeoutMs`', '`timeoutSource`', '`elapsedMs`',
+            '`requestedScope`', '`effectiveScope`', '`files`', '`scopeReason`',
+            '`project` → `pack` → `fallback`', '10,000 ms', '120,000 ms',
+            '`pass`', '`fail`', '`not_certified`', '`skipped`',
+            '`awm preflight --verify-sensors`', 'read-only', 'READY', 'not a health or certification claim',
+        ])
+            expect(cliReference + configuration + acceptance).toContain(expected);
+        expect(acceptance).toContain('legacy manifest');
+        expect(acceptance).toContain('v2 manifest without new fields');
+        expect(acceptance).toContain('supported, unsupported, empty, and Git-error');
+        expect(acceptance).toContain('project, pack, and fallback');
+        expect(cliReference).toContain('`not_certified` with an empty sensor list');
+        expect(cliReference).toContain('`awm sensors init`');
+        expect(acceptance).toContain('established (for example `not_certified` and an empty list)');
+        expect(acceptance).toMatch(/must not fabricate a\s+sensor name, timeout, source, or elapsed time/);
+        expect(osMatrix).toContain('Ubuntu, macOS, and native Windows');
+        expect(osMatrix).toContain('shell-free');
+    });
     it('el bloque generado esta al dia', () => {
         const doc = fs_1.default.readFileSync(support_matrix_1.DOC_PATH, 'utf-8');
         const expected = (0, support_matrix_1.spliceGenerated)(doc, (0, support_matrix_1.renderProviderTables)());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "8.1.3",
+  "version": "8.1.5",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"