agentic-workflow-manager 8.1.4 → 8.1.5

package/dist/src/commands/sensors/run.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.applyBaseline = applyBaseline;
+exports.applyBaseline = void 0;
 exports.detectPackDrift = detectPackDrift;
 exports.findManifestDir = findManifestDir;
 exports.resolveConcurrency = resolveConcurrency;
@@ -11,23 +11,17 @@ exports.runSensors = runSensors;
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
-const exec_1 = require("./exec");
-const tsc_1 = require("./formatters/tsc");
-const eslint_1 = require("./formatters/eslint");
-const semgrep_1 = require("./formatters/semgrep");
-const generic_1 = require("./formatters/generic");
-const test_1 = require("./formatters/test");
-const mypy_1 = require("./formatters/mypy");
-const ruff_1 = require("./formatters/ruff");
-const shellcheck_1 = require("./formatters/shellcheck");
 const baseline_1 = require("./baseline");
+const result_1 = require("./result");
+Object.defineProperty(exports, "applyBaseline", { enumerable: true, get: function () { return result_1.applyBaseline; } });
 const changed_1 = require("./changed");
 // Solo `detectStack` (puro, lee el arbol) — NO `initSensors`, que escribe. `run` es un
 // verbo de lectura: no debe tener a mano ninguna funcion capaz de mutar el proyecto.
 const init_1 = require("./init");
-const paths_1 = require("../../core/paths");
 const manifest_1 = require("./compatibility/manifest");
 const live_1 = require("./compatibility/live");
+const prepare_1 = require("./prepare");
+const verdict_1 = require("./verdict");
 const MANIFEST_FILE = '.awm/sensors.json';
 const DEFAULT_FAST_TIMEOUT = 10_000;
 const DEFAULT_SLOW_TIMEOUT = 120_000;
@@ -37,38 +31,6 @@ const DEFAULT_SLOW_TIMEOUT = 120_000;
 const MAX_BUFFER = 64 * 1024 * 1024;
 /** Hard ceiling on parallel sensors: past this, they only contend for the same cores. */
 const MAX_CONCURRENCY = 4;
-/**
- * Apply the baseline to a sensor result: keep only findings not already accepted.
- * `status` becomes 'pass' when every finding was baseline-suppressed. Results
- * without a verdict of their own — skipped and inconclusive — are returned
- * untouched: there is nothing to ratchet, and letting them through here would
- * hand back a `pass` for a sensor that never reported anything.
- */
-function applyBaseline(result, accepted) {
-    if (result.status === 'skipped' || result.status === 'inconclusive')
-        return result;
-    const { newErrors, suppressed } = (0, baseline_1.partition)(result.name, result.errors, accepted);
-    if (suppressed === 0)
-        return result;
-    return {
-        ...result,
-        errors: newErrors,
-        status: newErrors.length > 0 ? 'fail' : 'pass',
-        newCount: newErrors.length,
-        baselineCount: suppressed,
-    };
-}
-function readManifest(cwd) {
-    const p = path_1.default.join(cwd, MANIFEST_FILE);
-    if (!fs_1.default.existsSync(p))
-        return null;
-    try {
-        return JSON.parse(fs_1.default.readFileSync(p, 'utf-8'));
-    }
-    catch {
-        return null;
-    }
-}
 async function resolveLiveV2(cwd, manifest) {
     if (manifest.kind !== 'v2')
         return null;
@@ -79,18 +41,6 @@ async function resolveLiveV2(cwd, manifest) {
         return null;
     }
 }
-async function runV2Sensor(name, command, timeout, cwd, formatter) {
-    const res = await (0, exec_1.runStructuredCommand)(command, { timeout, cwd, maxBuffer: MAX_BUFFER });
-    const format = getFormatter(name, formatter);
-    if (res.spawnError)
-        return { name, status: 'fail', errors: [{ message: `sensor could not be started: ${res.spawnError.message}` }] };
-    if (res.timedOut || res.overflowed)
-        return { name, status: 'inconclusive', errors: [], skipReason: res.timedOut ? `timeout after ${timeout}ms` : `output exceeded ${MAX_BUFFER} bytes` };
-    const errors = format(res.stdout + res.stderr);
-    if (res.code === 0)
-        return { name, status: errors.length ? 'fail' : 'pass', errors };
-    return errors.length ? { name, status: 'fail', errors } : { name, status: 'inconclusive', errors: [], skipReason: `exit ${res.code}` };
-}
 /**
  * Detect — and only detect — that the manifest's pack no longer describes the tree:
  * it sits on the `generic` fallback while real stack indicators (package.json,
@@ -142,137 +92,13 @@ function findManifestDir(startCwd) {
 function shouldRun(isFast, opts) {
     if (opts.all)
         return true;
-    if (opts.fast && isFast)
-        return true;
-    if (opts.slow && !isFast)
+    if (opts.fast && opts.slow)
         return true;
-    if (!opts.fast && !opts.slow && !opts.all)
-        return true;
-    return false;
-}
-/**
- * Dispatch by the pack's `formatter` field (the real tool behind the sensor slot —
- * `lint` is eslint on js-ts but ruff on python, shellcheck on shell) when present.
- * Manifests written before this field existed carry no `formatter`, so they fall back
- * to the pre-existing name-based dispatch — nothing already installed breaks.
- */
-function getFormatter(name, formatterField) {
-    // A `formatter` field that is PRESENT but unrecognized (a typo in a pack.json, or a
-    // future pack declaring a tool this CLI version doesn't know about yet) is a
-    // different situation from no field at all. Falling through to name-based dispatch
-    // in that case would silently misparse a foreign output shape via the wrong parser
-    // (e.g. a `bandit` formatter falling through to `parseSemgrepOutput`, reading
-    // bandit's differently-shaped JSON and producing garbage findings). Only the
-    // ABSENT case (old manifest, written before this field existed) gets name-based
-    // backward-compat dispatch; a present-but-unknown value degrades honestly to the
-    // generic raw-wrap formatter instead.
-    if (formatterField !== undefined) {
-        switch (formatterField) {
-            case 'tsc': return tsc_1.parseTscOutput;
-            case 'eslint-llm': return eslint_1.parseEslintOutput;
-            case 'semgrep': return semgrep_1.parseSemgrepOutput;
-            case 'test': return test_1.parseTestOutput;
-            case 'mypy': return mypy_1.parseMypyOutput;
-            case 'ruff': return ruff_1.parseRuffOutput;
-            case 'shellcheck': return shellcheck_1.parseShellcheckOutput;
-            case 'generic': return generic_1.parseGenericOutput;
-            default: return generic_1.parseGenericOutput;
-        }
-    }
-    if (name === 'typecheck')
-        return tsc_1.parseTscOutput;
-    if (name === 'lint')
-        return eslint_1.parseEslintOutput;
-    if (name === 'security')
-        return semgrep_1.parseSemgrepOutput;
-    if (name === 'test')
-        return test_1.parseTestOutput;
-    return generic_1.parseGenericOutput;
-}
-function isExitCodeSensor(name) {
-    return name === 'test';
-}
-async function runSensor(name, cmd, timeout, cwd, formatterField) {
-    const res = await (0, exec_1.runCommand)(cmd, { timeout, cwd, maxBuffer: MAX_BUFFER });
-    const format = getFormatter(name, formatterField);
-    // The shell itself never started (bad cwd, no shell). Nothing ran.
-    if (res.spawnError) {
-        return {
-            name,
-            status: 'fail',
-            errors: [{ message: `sensor could not be started: ${res.spawnError.message}` }],
-        };
-    }
-    // Cut short by the deadline or the output cap. The run is NOT a verdict — but
-    // whatever it printed before being cut is still evidence, and throwing it away
-    // is what forced the caller to re-run the same command by hand to learn
-    // anything. Findings in the partial output are real findings; their absence
-    // proves nothing, so a clean partial can never be `pass`.
-    if (res.timedOut || res.overflowed) {
-        const reason = res.timedOut
-            ? `timeout after ${timeout}ms`
-            : `output exceeded ${MAX_BUFFER} bytes`;
-        const errors = format(res.stdout + res.stderr);
-        if (errors.length > 0) {
-            return {
-                name,
-                status: 'fail',
-                errors,
-                incomplete: `${reason} — findings below are from partial output; the run did not finish`,
-            };
-        }
-        return { name, status: 'inconclusive', errors: [], skipReason: reason };
-    }
-    if (res.code === 0) {
-        const errors = format(res.stdout);
-        return { name, status: errors.length > 0 ? 'fail' : 'pass', errors };
-    }
-    // Non-zero exit — the normal path for linters/typecheckers that found
-    // findings. Parse the output; if it yields findings, that's a fail.
-    const raw = res.stdout + res.stderr;
-    const errors = format(raw);
-    if (errors.length > 0)
-        return { name, status: 'fail', errors };
-    // A missing tool (binary not installed) must NOT pass silently — the gate
-    // cannot certify what it could not run. Treat it as a fail with a clear message.
-    //
-    // Exit 127 is the POSIX signal for "command not found" and is the only check
-    // here that holds across shells and locales: bash writes `command not found`
-    // but dash — `/bin/sh` on Debian/Ubuntu, hence most CI runners and containers
-    // — writes `not found`, so matching shell text alone read an absent tool as a
-    // benign skip. A failure to spawn the shell itself is a different thing and
-    // is handled above via `spawnError`. The cut-short branches are evaluated
-    // above too, so reaching here with status 127 means the command did not exist.
-    //
-    // A wrapper (`npm test`, `npx …`) that exits 127 because a binary it invokes
-    // is absent is classified the same way, deliberately: the gate still ran
-    // nothing and still cannot certify anything.
-    const lower = raw.toLowerCase();
-    const toolMissing = res.code === 127 || // POSIX: command not found
-        lower.includes('command not found') || // bash, zsh
-        // cmd.exe reports an absent binary with exit 1, so 127 does not cover
-        // Windows; this exact phrase does. Kept narrow on purpose — a loose
-        // `not found` would also match a tool that ran and said "not found"
-        // for reasons of its own.
-        lower.includes('is not recognized as an internal or external command') ||
-        lower.includes('enoent') ||
-        lower.includes('could not determine executable');
-    if (toolMissing) {
-        return {
-            name,
-            status: 'fail',
-            errors: [{ message: `sensor tool not available: ${raw.slice(0, 200)}` }],
-        };
-    }
-    // Exit-code sensors (tests): any genuine non-zero exit is a real failure,
-    // even when no per-line findings can be parsed from the output.
-    if (isExitCodeSensor(name)) {
-        return { name, status: 'fail', errors: [{ message: `SENSOR[${name}] failed (exit ${res.code})` }] };
-    }
-    // Residual case: it exited non-zero, the tool exists, and no finding
-    // could be parsed. We do not know what happened — say so instead of
-    // reporting a benign skip.
-    return { name, status: 'inconclusive', errors: [], skipReason: `exit ${res.code}: ${raw.slice(0, 200)}` };
+    if (opts.fast)
+        return isFast;
+    if (opts.slow)
+        return !isFast;
+    return true;
 }
 /**
  * How many sensors may run at once. Sensors are separate processes over the same
@@ -302,170 +128,65 @@ async function pooled(tasks, limit) {
     await Promise.all(Array.from({ length: Math.min(limit, tasks.length) }, worker));
     return results;
 }
+/**
+ * One orchestration path for both manifest contracts. Preparation selects the
+ * authorized command; execution, baseline handling, and verdict reduction are
+ * deliberately format-agnostic.
+ */
 async function runSensors(opts = {}) {
-    const startCwd = opts.cwd ?? process.cwd();
-    const manifestDir = findManifestDir(startCwd);
+    (0, prepare_1.validateRunOptions)(opts);
+    const manifestDir = findManifestDir(opts.cwd ?? process.cwd());
     if (!manifestDir)
         return { sensors: [], overall: 'not_certified' };
-    const manifest = readManifest(manifestDir);
-    if (!manifest)
-        return { sensors: [], overall: 'not_certified' };
-    let parsedManifest;
+    let parsed;
     try {
-        parsedManifest = (0, manifest_1.parseSensorManifest)(JSON.parse(fs_1.default.readFileSync(path_1.default.join(manifestDir, MANIFEST_FILE), 'utf8')), path_1.default.join(manifestDir, MANIFEST_FILE));
+        parsed = (0, manifest_1.parseSensorManifest)(JSON.parse(fs_1.default.readFileSync(path_1.default.join(manifestDir, MANIFEST_FILE), 'utf8')), path_1.default.join(manifestDir, MANIFEST_FILE));
     }
     catch {
         return { sensors: [], overall: 'not_certified' };
     }
-    if (parsedManifest.kind === 'v2') {
-        const live = await resolveLiveV2(manifestDir, parsedManifest);
-        const tasks = [];
-        for (const [name, sensor] of Object.entries(parsedManifest.pack.sensors)) {
-            const state = live?.sensors[name];
-            const liveSensor = live?.pack.sensors[name];
-            if (!shouldRun(sensor.fast ?? liveSensor?.fast ?? false, opts))
-                continue;
-            if (sensor.enabled === false) {
-                tasks.push(() => Promise.resolve({ name, status: 'skipped', errors: [], skipReason: 'disabled' }));
-                continue;
-            }
-            if (!state || state.state !== 'certified') {
-                tasks.push(() => Promise.resolve({ name, status: 'inconclusive', errors: [], skipReason: state ? `${state.state}: ${state.reason}` : 'compatibility could not be revalidated' }));
-                continue;
-            }
-            if (state.variantId !== sensor.variantId) {
-                tasks.push(() => Promise.resolve({ name, status: 'inconclusive', errors: [], skipReason: `variant-drift: manifest ${sensor.variantId}, live ${state.variantId ?? 'none'}; run \`awm sensors init\`` }));
-                continue;
-            }
-            const selected = liveSensor?.variants.find(candidate => candidate.id === state.variantId);
-            if (!selected) {
-                tasks.push(() => Promise.resolve({ name, status: 'inconclusive', errors: [], skipReason: 'variant-drift: selected live variant has no command; run `awm sensors init`' }));
-                continue;
-            }
-            // Variant IDs are stable selectors, not immutable command snapshots.
-            // Only the just re-resolved pack command is authorized to execute.
-            tasks.push(() => runV2Sensor(name, selected.command, (sensor.fast ?? liveSensor?.fast ?? false) ? DEFAULT_FAST_TIMEOUT : DEFAULT_SLOW_TIMEOUT, manifestDir, selected.formatter));
-        }
-        const sensors = await pooled(tasks, Math.min(MAX_CONCURRENCY, Math.max(1, tasks.length)));
-        return { sensors, overall: sensors.some(sensor => sensor.status === 'fail') ? 'fail' : sensors.some(sensor => sensor.status === 'inconclusive') ? 'not_certified' : sensors.length ? 'pass' : 'skipped' };
-    }
-    const drift = detectPackDrift(manifestDir, manifest);
-    const activeManifest = manifest; // el manifest COMITEADO es lo que se corre; `run` no lo reescribe
-    const cwd = manifestDir; // ejecutar sensores y baseline desde donde vive el manifest
-    // Baseline suppresses already-accepted findings so sensors fail only on NEW
-    // ones (essential on repos with a large pre-existing baseline). Absent file or
-    // --ignore-baseline → every finding counts (backward-compatible).
-    const baseline = opts.ignoreBaseline ? null : (0, baseline_1.readBaseline)(cwd);
-    // A scoped run must never define the accepted set. `buildBaseline` snapshots the
-    // findings of the run it is given, so baselining a `--changed` run would write a
-    // baseline covering only the touched files and silently drop every accepted
-    // finding elsewhere in the repo — which then reports as NEW on the next full run.
-    // The two flags only ever meet by mistake, so refuse rather than pick a meaning.
-    if (opts.changed && opts.ignoreBaseline) {
-        throw new Error('refusing to combine --changed with a baseline capture: a partial run cannot define '
-            + 'the accepted set (it would drop every accepted finding outside the diff). '
-            + 'Run `awm sensors baseline` without --changed.');
-    }
-    // Resolved once for the whole run, not per sensor: `git` is cheap but the answer
-    // must be identical across sensors, or two of them scope to different file sets.
-    const changed = opts.changed ? (0, changed_1.changedFiles)(cwd, opts.base ?? 'HEAD') : null;
-    // Security (BatBadBut / CVE-2024-27980): on native Windows, `runCommand` spawns
-    // the sensor command through cmd.exe (`shell: true`), which parses `& | < > ^ %`
-    // as ITS OWN syntax before the target program ever sees argv — quoting does not
-    // reliably neutralize this layer (the primary research this fix is based on
-    // concludes escaping it is not safely possible). A changed filename carrying one
-    // of these is refused, not escaped: routed through the exact same fallback the
-    // module already has for "scope could not be resolved" (`changed.error`), so
-    // every sensor degrades to its full unscoped command rather than interpolating
-    // an unsafe path. POSIX is unaffected — single-quote quoting there is fully
-    // literal per POSIX shell grammar, no metacharacter exception exists.
-    if (changed && !changed.error && (0, paths_1.isWindowsNative)() && changed.files.some(changed_1.hasUnsafeWin32Chars)) {
-        changed.error = 'a changed filename contains a cmd.exe metacharacter (& | < > ^ % or newline/CR) '
-            + 'that quoting cannot reliably neutralize on native Windows — refusing to interpolate it, '
-            + 'falling back to the full unscoped command';
-    }
-    // Sensors are independent processes over the same tree, so they run
-    // concurrently rather than one-after-another: wall clock becomes the slowest
-    // sensor instead of the sum of all of them. Tasks are built — and dispatched —
-    // in manifest order, so the reported order stays stable.
-    const tasks = [];
-    const settled = (r) => () => Promise.resolve(r);
-    for (const [name, config] of Object.entries(activeManifest.sensors ?? {})) {
-        const isFast = config.fast ?? false;
-        if (!shouldRun(isFast, opts))
-            continue;
-        if (config.enabled === false) {
-            tasks.push(settled({ name, status: 'skipped', errors: [], skipReason: 'disabled' }));
-            continue;
-        }
-        if (!config.cmd) {
-            // Enabled but with nothing to run: broken config, not a deliberate
-            // opt-out. `enabled: false` is how a sensor is turned off.
-            tasks.push(settled({ name, status: 'inconclusive', errors: [], skipReason: 'no cmd configured' }));
+    const baseline = opts.ignoreBaseline ? null : (0, baseline_1.readBaseline)(manifestDir);
+    const changed = opts.changed ? (0, changed_1.changedFiles)(manifestDir, opts.base ?? 'HEAD') : null;
+    // Legacy commands pass changed filenames through a shell; preserve the native
+    // Windows safety fallback. Structured v2 argv never crosses that shell layer.
+    if (parsed.kind === 'legacy' && changed && !changed.error) {
+        const scopeError = (0, changed_1.changedScopeError)(changed);
+        if (scopeError)
+            changed.error = scopeError;
+    }
+    const live = parsed.kind === 'v2' ? await resolveLiveV2(manifestDir, parsed) : null;
+    const drift = parsed.kind === 'legacy' ? detectPackDrift(manifestDir, parsed.pack) : undefined;
+    const requestedScope = opts.changed ? 'changed' : 'full';
+    const prepared = [];
+    for (const [name, sensor] of Object.entries(parsed.pack.sensors)) {
+        const liveSensor = parsed.kind === 'v2' ? live?.pack.sensors[name] : undefined;
+        const fast = parsed.kind === 'v2'
+            ? sensor.fast ?? liveSensor?.fast ?? false
+            : sensor.fast ?? false;
+        if (!shouldRun(fast, opts))
             continue;
-        }
-        // Scoping applies only where the pack opted in AND the scope resolved. Any
-        // other combination falls back to the full command: slower, never wrong.
-        let cmd = config.cmd;
-        let scope;
-        if (changed && !changed.error && config.changedCmd) {
-            if (!config.changedCmd.includes('{files}')) {
-                // Running the template as-is would cover the whole repo while the
-                // result claimed to be scoped — a mislabel, not a slow path.
-                tasks.push(settled({
-                    name,
-                    status: 'inconclusive',
-                    errors: [],
-                    skipReason: 'changedCmd has no {files} placeholder',
-                }));
-                continue;
-            }
-            const inScope = (0, changed_1.filterByExtension)(changed.files, config.changedExtensions);
-            if (inScope.length === 0) {
-                tasks.push(settled({
-                    name,
-                    status: 'skipped',
-                    errors: [],
-                    skipReason: 'no changed files in scope',
-                    scope: 'changed',
-                }));
-                continue;
-            }
-            cmd = (0, changed_1.applyChangedCmd)(config.changedCmd, inScope);
-            scope = 'changed';
-        }
-        const timeout = config.timeout ?? (isFast ? DEFAULT_FAST_TIMEOUT : DEFAULT_SLOW_TIMEOUT);
-        tasks.push(async () => {
-            const result = await runSensor(name, cmd, timeout, cwd, config.formatter);
-            const scoped = scope ? { ...result, scope } : result;
-            return baseline ? applyBaseline(scoped, baseline[name]) : scoped;
-        });
-    }
-    const results = await pooled(tasks, resolveConcurrency(activeManifest, tasks.length));
-    // `fail` outranks `inconclusive`: when something is broken AND something
-    // could not be measured, the broken thing is the actionable verdict.
-    let overall = results.some(r => r.status === 'fail') ? 'fail'
-        : results.some(r => r.status === 'inconclusive') ? 'not_certified'
-            : results.length > 0 && results.every(r => r.status === 'skipped') ? 'skipped'
-                : results.length === 0 ? 'skipped'
-                    : 'pass';
-    // Legacy commands retain operational compatibility but their unversioned,
-    // shell-backed contract can never certify a run.
-    if (parsedManifest.kind === 'legacy' && overall === 'pass')
+        const execution = parsed.kind === 'v2'
+            ? (0, prepare_1.prepareV2Sensor)({ name, sensor, liveSensor, liveState: live?.sensors[name], requestedScope, changed: changed ?? undefined })
+            : (0, prepare_1.prepareLegacySensor)({ name, config: sensor, requestedScope, changed: changed ?? undefined });
+        prepared.push(sensor.enabled === false
+            ? { ...execution, command: undefined, syntheticStatus: 'skipped', syntheticReason: 'disabled' }
+            : execution);
+    }
+    const results = await pooled(prepared.map(entry => async () => {
+        const result = await (0, result_1.executePrepared)(entry, manifestDir);
+        return baseline ? (0, result_1.applyBaseline)(result, baseline[entry.name]) : result;
+    }), resolveConcurrency(parsed.pack, prepared.length));
+    let overall = (0, verdict_1.reduceVerdict)(results);
+    // Legacy commands retain operational compatibility but their shell-backed
+    // contract cannot certify a green run.
+    if (parsed.kind === 'legacy' && overall === 'pass')
         overall = 'not_certified';
-    // Honest floor: a benign-green 'skipped' over a tree that clearly HAS a stack
-    // (indicators present) is a false green — the gate ran nothing real. Never green.
-    if (overall === 'skipped' && drift.detection.pack !== 'generic') {
+    if (overall === 'skipped' && drift && drift.detection.pack !== 'generic')
         overall = 'not_certified';
-    }
     return {
         sensors: results,
         overall,
-        ...(drift.drift ? { packDrift: drift.drift } : {}),
-        // Always emitted on a --changed run, including when the scope failed to
-        // resolve: a green that came back from an unscoped fallback and a green from a
-        // genuinely scoped run are different claims, and the caller cannot tell them
-        // apart from the sensor list alone.
+        ...(drift?.drift ? { packDrift: drift.drift } : {}),
         ...(changed ? { changedScope: { files: changed.files.length, ...(changed.error ? { error: changed.error } : {}) } } : {}),
     };
 }

package/dist/src/commands/sensors/status.js

@@ -8,7 +8,10 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const paths_1 = require("../../core/paths");
 const manifest_1 = require("./compatibility/manifest");
-const live_1 = require("./compatibility/live");
+const contract_1 = require("./compatibility/contract");
+const discovery_1 = require("./compatibility/discovery");
+const pack_source_1 = require("./compatibility/pack-source");
+const resolve_1 = require("./compatibility/resolve");
 /** First non-flag token after `npx` — the tool the command actually runs. */
 function npxTool(parts) {
     for (let i = 1; i < parts.length; i++) {
@@ -55,6 +58,83 @@ function checkCmd(cmd, cwd) {
     }
     return configCheck(parts, cwd) ?? { ok: true, detail: bin };
 }
+/** Check a v2 command's declared local prerequisite without invoking it. */
+function checkStructuredCommand(command, cwd, assets = []) {
+    const missingAsset = assets.find(asset => !fs_1.default.existsSync(path_1.default.join(cwd, asset)));
+    if (missingAsset)
+        return { ok: false, detail: `missing config: ${missingAsset}` };
+    if (command.resolution === 'node-modules-bin') {
+        const binary = path_1.default.join(cwd, 'node_modules', '.bin', command.executable);
+        const present = fs_1.default.existsSync(binary)
+            || fs_1.default.existsSync(`${binary}.cmd`)
+            || fs_1.default.existsSync(`${binary}.exe`);
+        return present
+            ? { ok: true, detail: `${command.executable} (node_modules/.bin)` }
+            : { ok: false, detail: `${command.executable} not installed locally` };
+    }
+    if (command.resolution === 'python-environment') {
+        if (!command.pythonEnvironmentRoot)
+            return { ok: false, detail: `${command.executable} has no selected Python environment` };
+        const root = path_1.default.join(cwd, command.pythonEnvironmentRoot);
+        const candidates = process.platform === 'win32'
+            ? [path_1.default.join(root, 'Scripts', `${command.executable}.exe`), path_1.default.join(root, 'Scripts', `${command.executable}.cmd`)]
+            : [path_1.default.join(root, 'bin', command.executable)];
+        return candidates.some(candidate => fs_1.default.existsSync(candidate))
+            ? { ok: true, detail: `${command.executable} (${command.pythonEnvironmentRoot})` }
+            : { ok: false, detail: `${command.executable} not found in ${command.pythonEnvironmentRoot}` };
+    }
+    return (0, paths_1.resolveOnPath)(command.executable)
+        ? { ok: true, detail: command.executable }
+        : { ok: false, detail: `${command.executable} not found in PATH` };
+}
+/**
+ * Re-evaluate only locally discoverable v2 compatibility evidence. Unlike the
+ * execution path, status never runs a compatibility probe: probes such as
+ * `eslint --print-config` are process execution and would turn this command
+ * into a health check. A selected variant still proves that its current tool
+ * and runtime ranges are compatible; its probe state remains unverifiable.
+ */
+function resolveStaticV2Compatibility(cwd, manifest) {
+    const source = manifest.registryRoot === undefined
+        ? (0, pack_source_1.resolvePackSource)(manifest.pack)
+        : (0, pack_source_1.resolvePackSource)(manifest.pack, { registries: [{ name: 'manifest-provenance', remote: 'local', contentRoot: manifest.registryRoot }] });
+    const parsed = (0, contract_1.parseSensorPack)(JSON.parse(source.content), source.path);
+    if (parsed.kind !== 'v2')
+        throw new Error(`sensor pack "${manifest.pack}" does not provide a v2 compatibility contract`);
+    const evidence = (0, discovery_1.discoverProjectEvidence)(cwd, parsed.pack);
+    const resolutionEvidence = {
+        ...evidence,
+        ...(manifest.packSelection === 'explicit' ? { packSelection: 'explicit' } : {}),
+    };
+    const initial = (0, resolve_1.resolveProjectCompatibility)(parsed.pack, resolutionEvidence).sensors;
+    return Object.fromEntries(Object.entries(parsed.pack.sensors).map(([name, sensor]) => {
+        const variant = initial[name]?.variantId === null
+            ? null
+            : sensor.variants.find(candidate => candidate.id === initial[name]?.variantId) ?? null;
+        // These two probe kinds consume discovery output only. Keep their useful
+        // static validation in status while leaving every command-backed probe
+        // inconclusive rather than dispatching it.
+        const probeStatus = variant?.probe.kind === 'config-present'
+            ? (evidence.configFiles.length > 0 ? 'matched' : 'not-matched')
+            : variant?.probe.kind === 'package-script-present'
+                ? (evidence.scripts.length > 0 ? 'matched' : 'not-matched')
+                : undefined;
+        return [name, probeStatus === undefined
+                ? initial[name]
+                : (0, resolve_1.resolveSensorCompatibility)(sensor, { ...resolutionEvidence, probe: { status: probeStatus } }, { pack: parsed.pack.name, sensor: name })];
+    }));
+}
+function staticCompatibilityCheck(sensor, live) {
+    if (!live)
+        return { ok: false, detail: 'live compatibility unavailable' };
+    if (live.variantId !== sensor.variantId) {
+        return { ok: false, detail: `compatibility drift: initialized ${sensor.variantId}, resolved ${live.variantId ?? live.state}` };
+    }
+    if (live.state === 'incompatible' || live.state === 'missing-tool' || live.state === 'not-applicable' || live.reason === 'probe-not-matched') {
+        return { ok: false, detail: `live compatibility ${live.state}: ${live.reason}` };
+    }
+    return null;
+}
 async function computeSensorStatus(cwd = process.cwd()) {
     const manifestPath = path_1.default.join(cwd, '.awm', 'sensors.json');
     if (!fs_1.default.existsSync(manifestPath)) {
@@ -66,32 +146,26 @@ async function computeSensorStatus(cwd = process.cwd()) {
         const parsed = (0, manifest_1.parseSensorManifest)(raw, manifestPath);
         if (parsed.kind === 'v2') {
             const checks = {};
-            let live;
+            let compatibility;
             try {
-                live = await (0, live_1.resolveLiveCompatibility)(cwd, parsed.pack.pack, parsed.pack.registryRoot, { packSelection: parsed.pack.packSelection });
+                compatibility = resolveStaticV2Compatibility(cwd, parsed.pack);
             }
             catch (error) {
-                const detail = `compatibility revalidation failed: ${error instanceof Error ? error.message : String(error)}`;
+                const detail = error instanceof Error ? error.message : 'live compatibility unavailable';
                 for (const [name, sensor] of Object.entries(parsed.pack.sensors)) {
                     checks[name] = sensor.enabled === false ? { ok: true, detail: 'disabled' } : { ok: false, detail };
                 }
                 return { overall: 'DEGRADED', pack: parsed.pack.pack, checks };
             }
             for (const [name, sensor] of Object.entries(parsed.pack.sensors)) {
-                const state = live.sensors[name];
-                checks[name] = sensor.enabled === false
-                    ? { ok: true, detail: 'disabled' }
-                    : !state
-                        ? { ok: false, detail: 'variant-drift: sensor no longer exists in the live pack; run `awm sensors init`' }
-                        : state.variantId !== sensor.variantId
-                            ? { ok: false, detail: `variant-drift: manifest ${sensor.variantId}, live ${state.variantId ?? 'none'}; run \`awm sensors init\`` }
-                            : state.state === 'certified'
-                                ? { ok: true, detail: `certified (${state.variantId})` }
-                                : state.state === 'not-applicable'
-                                    ? { ok: true, detail: 'not applicable' }
-                                    : { ok: false, detail: `${state.state}: ${state.reason}` };
+                if (sensor.enabled === false) {
+                    checks[name] = { ok: true, detail: 'disabled' };
+                    continue;
+                }
+                checks[name] = staticCompatibilityCheck(sensor, compatibility[name])
+                    ?? checkStructuredCommand(sensor.command, cwd, sensor.assets);
             }
-            return { overall: Object.keys(checks).length > 0 && Object.values(checks).every(check => check.ok) ? 'HEALTHY' : 'DEGRADED', pack: parsed.pack.pack, checks };
+            return { overall: Object.keys(checks).length > 0 && Object.values(checks).every(check => check.ok) ? 'READY' : 'DEGRADED', pack: parsed.pack.pack, checks };
         }
         manifest = parsed.pack;
     }
@@ -122,12 +196,10 @@ async function computeSensorStatus(cwd = process.cwd()) {
     }
     // `Object.values({}).every(...)` is vacuously true — a manifest with zero sensor
     // entries (the registry had no pack.json for this stack; see init.ts) must not read
-    // as HEALTHY just because there was nothing to fail. Same false-green `checkManifest`
+    // as READY just because there was nothing to fail. Same false-green `checkManifest`
     // guards against in preflight.
     if (Object.keys(manifest.sensors ?? {}).length === 0) {
         return { overall: 'DEGRADED', pack: manifest.pack, checks };
     }
-    // A legacy manifest may be operational (the checks are still useful), but it
-    // has no versioned/structured contract and must never present as certified.
-    return { overall: 'DEGRADED', pack: manifest.pack, checks };
+    return { overall: Object.values(checks).every(check => check.ok) ? 'READY' : 'DEGRADED', pack: manifest.pack, checks };
 }

package/dist/src/commands/sensors/verdict.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exitCodeForVerdict = exitCodeForVerdict;
+exports.reduceVerdict = reduceVerdict;
+/** Map the semantic sensor verdict to the CLI process status. Only a global pass succeeds. */
+function exitCodeForVerdict(overall) {
+    return overall === 'pass' ? 0 : 1;
+}
+/** Reduce all selected sensor outcomes through one format-agnostic verdict rule. */
+function reduceVerdict(results) {
+    if (!Array.isArray(results))
+        throw new Error('sensor results must be an array');
+    for (const result of results) {
+        if (!result || typeof result !== 'object')
+            throw new Error('sensor result must be an object');
+        if (!['pass', 'fail', 'inconclusive', 'skipped'].includes(result.status)) {
+            throw new Error('sensor result status is invalid');
+        }
+    }
+    if (results.some(result => result.status === 'fail'))
+        return 'fail';
+    if (results.some(result => result.status === 'inconclusive'))
+        return 'not_certified';
+    if (results.some(result => result.status === 'pass'))
+        return 'pass';
+    return 'skipped';
+}