agentic-workflow-manager 8.1.4 → 8.1.6

package/dist/tests/commands/sensors/prepare.test.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const prepare_1 = require("../../../src/commands/sensors/prepare");
+const fullCommand = { executable: 'manifest-eslint', resolution: 'path', args: ['.'] };
+const changedCommand = {
+    executable: 'live-eslint',
+    resolution: 'path',
+    args: ['--format', 'json', '{files}'],
+    fileInput: { placeholder: '{files}', extensions: ['.ts'] },
+};
+function v2Input(overrides = {}) {
+    const liveVariant = {
+        id: 'eslint-live', priority: 1, certifiedRange: '>=1.0.0', requirements: { tool: 'eslint', toolRange: '>=1.0.0', runtime: 'node', runtimeRange: '>=1.0.0' }, assets: [],
+        probe: { kind: 'version' }, command: { executable: 'live-eslint', resolution: 'path', args: ['.'] }, changedCommand, formatter: 'eslint-llm',
+    };
+    return {
+        name: 'lint',
+        sensor: {
+            enabled: true, fast: false, variantId: 'eslint-live', command: fullCommand,
+            initializedCompatibility: { state: 'certified', reason: 'test', variantId: 'eslint-live', toolVersion: '1.0.0', runtimeVersion: '1.0.0', certifiedRange: '>=1.0.0', evidence: [] },
+        },
+        liveSensor: { applicability: {}, fast: false, timeout: 30_000, variants: [liveVariant] },
+        liveState: { state: 'certified', reason: 'test', variantId: 'eslint-live', toolVersion: '1.0.0', runtimeVersion: '1.0.0', certifiedRange: '>=1.0.0', evidence: [] },
+        changed: { files: ['src/a.ts'] },
+        requestedScope: 'changed',
+        projectTimeout: 90_000,
+        ...overrides,
+    };
+}
+describe('prepareV2Sensor', () => {
+    test('v2 uses the live command and project > pack > fallback timeout (R1.1, R3.1)', () => {
+        const prepared = (0, prepare_1.prepareV2Sensor)(v2Input());
+        expect(prepared.command).toEqual({ kind: 'structured', value: { executable: 'live-eslint', resolution: 'path', args: ['--format', 'json', 'src/a.ts'] } });
+        expect(prepared.timeoutMs).toBe(90_000);
+        expect(prepared.timeoutSource).toBe('project');
+        expect((0, prepare_1.prepareV2Sensor)(v2Input({ projectTimeout: undefined })).timeoutSource).toBe('pack');
+        const fallback = v2Input();
+        fallback.liveSensor.timeout = undefined;
+        fallback.liveSensor.fast = true;
+        fallback.sensor.fast = undefined;
+        expect((0, prepare_1.prepareV2Sensor)({ ...fallback, projectTimeout: undefined })).toMatchObject({ timeoutMs: 10_000, timeoutSource: 'fallback' });
+    });
+    test('expands changed paths as literal argv entries (R4.1, R10.2)', () => {
+        const prepared = (0, prepare_1.prepareV2Sensor)(v2Input({ changed: { files: ['src/a b.ts', 'src/$x.ts'] } }));
+        expect(prepared.command).toEqual({ kind: 'structured', value: { executable: 'live-eslint', resolution: 'path', args: ['--format', 'json', 'src/a b.ts', 'src/$x.ts'] } });
+        expect(prepared.effectiveScope).toBe('changed');
+    });
+    test('falls back full with an explicit reason without changedCommand (R4.2)', () => {
+        const input = v2Input();
+        input.liveSensor.variants[0].changedCommand = undefined;
+        const prepared = (0, prepare_1.prepareV2Sensor)(input);
+        expect(prepared.command).toEqual({ kind: 'structured', value: input.liveSensor.variants[0].command });
+        expect(prepared.effectiveScope).toBe('full');
+        expect(prepared.scopeReason).toMatch(/does not support changed scope/);
+    });
+    test('uses the full command with an explicit reason when the diff cannot resolve', () => {
+        const prepared = (0, prepare_1.prepareV2Sensor)(v2Input({ changed: { files: [], error: 'git failed' } }));
+        expect(prepared.effectiveScope).toBe('full');
+        expect(prepared.scopeReason).toMatch(/could not be resolved: git failed/);
+    });
+    test('returns zero-file pass plan without a process (R4.4)', () => {
+        const prepared = (0, prepare_1.prepareV2Sensor)(v2Input({ changed: { files: ['README.md'] } }));
+        expect(prepared).toMatchObject({ effectiveScope: 'changed', files: 0, syntheticStatus: 'pass' });
+        expect(prepared.command).toBeUndefined();
+    });
+    test('rejects an invalid requested scope before preparing a command', () => {
+        expect(() => (0, prepare_1.prepareV2Sensor)({ ...v2Input(), requestedScope: 'sideways' }))
+            .toThrow('requested scope must be "full" or "changed"');
+    });
+});
+describe('prepareLegacySensor', () => {
+    const originalPlatform = process.platform;
+    afterEach(() => Object.defineProperty(process, 'platform', { value: originalPlatform, configurable: true }));
+    test('falls back to the full command for an unsafe Windows filename', () => {
+        Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+        const prepared = (0, prepare_1.prepareLegacySensor)({
+            name: 'lint', config: { cmd: 'eslint .', changedCmd: 'eslint {files}' }, requestedScope: 'changed', changed: { files: ['src/a&b.ts'] },
+        });
+        expect(prepared).toMatchObject({ command: { kind: 'legacy', value: 'eslint .' }, effectiveScope: 'full' });
+        expect(prepared.scopeReason).toMatch(/cmd\.exe metacharacter/);
+    });
+});
+describe('validateRunOptions', () => {
+    test('rejects changed baseline capture before any scope preparation (R4.6)', () => {
+        expect(() => (0, prepare_1.validateRunOptions)({ changed: true, ignoreBaseline: true }))
+            .toThrow(/refusing to combine --changed with a baseline capture/);
+    });
+});

package/dist/tests/commands/sensors/router.test.js

@@ -4,7 +4,7 @@ jest.mock('@clack/prompts', () => ({ log: { success: jest.fn(), info: jest.fn()
 jest.mock('picocolors', () => ({ green: (s) => s, yellow: (s) => s, red: (s) => s }));
 jest.mock('../../../src/commands/sensors/run', () => ({ runSensors: jest.fn().mockReturnValue({ sensors: [], overall: 'pass' }) }));
 jest.mock('../../../src/commands/sensors/init', () => ({ initSensors: jest.fn().mockReturnValue({ detection: { pack: 'js-ts', indicators: [] }, manifest: { sensors: {} }, configured: [] }) }));
-jest.mock('../../../src/commands/sensors/status', () => ({ computeSensorStatus: jest.fn().mockReturnValue({ overall: 'HEALTHY', pack: 'js-ts', checks: {} }) }));
+jest.mock('../../../src/commands/sensors/status', () => ({ computeSensorStatus: jest.fn().mockReturnValue({ overall: 'READY', pack: 'js-ts', checks: {} }) }));
 jest.mock('../../../src/commands/sensors/install', () => ({ installSensorHook: jest.fn().mockReturnValue({ status: 'installed' }) }));
 const commander_1 = require("commander");
 const index_1 = require("../../../src/commands/sensors/index");
@@ -21,4 +21,18 @@ describe('registerSensorsCommand', () => {
         expect(subNames).toContain('install');
         expect(subNames).toContain('coverage');
     });
+    it('renders READY without claiming sensor execution, HEALTHY, or project certification', async () => {
+        const program = new commander_1.Command();
+        const output = jest.spyOn(console, 'log').mockImplementation(() => undefined);
+        try {
+            (0, index_1.registerSensorsCommand)(program);
+            await program.parseAsync(['node', 'awm', 'sensors', 'status']);
+            const rendered = output.mock.calls.flat().join('\n');
+            expect(rendered).toContain('READY');
+            expect(rendered).not.toMatch(/HEALTHY|certif/i);
+        }
+        finally {
+            output.mockRestore();
+        }
+    });
 });

package/dist/tests/commands/sensors/run-changed.test.js

@@ -84,12 +84,12 @@ describe('runSensors --changed', () => {
         expect(out.sensors[0].scope).toBeUndefined();
         expect(out.changedScope).toEqual({ files: 0, error: 'not a git repository' });
     });
-    it('skips an opted-in sensor when nothing changed, without touching the others', async () => {
+    it('records a clean synthetic pass when an opted-in sensor has no changed files, without touching the others', async () => {
         dir = project({ lint: LINT, typecheck: TYPECHECK });
         mockChangedFiles.mockReturnValue({ files: [] });
         const out = await load().runSensors({ cwd: dir, changed: true });
         const lint = out.sensors.find((s) => s.name === 'lint');
-        expect(lint.status).toBe('skipped');
+        expect(lint.status).toBe('pass');
         expect(lint.skipReason).toBe('no changed files in scope');
         expect(cmds()).toEqual(['tsc --noEmit']);
     });
@@ -101,13 +101,13 @@ describe('runSensors --changed', () => {
         await load().runSensors({ cwd: dir, changed: true });
         expect(cmds()).toEqual([`eslint --format json 'src/a.ts'`]);
     });
-    it('skips the sensor when the filter empties the scope, rather than running repo-wide', async () => {
+    it('records a clean synthetic pass when the filter empties the scope, rather than running repo-wide', async () => {
         // A docs-only commit means the lint sensor has nothing to say. Falling back to
         // the full command here would reintroduce exactly the cost --changed removes.
         dir = project({ lint: { ...LINT, changedExtensions: ['.ts'] }, typecheck: TYPECHECK });
         mockChangedFiles.mockReturnValue({ files: ['README.md'] });
         const out = await load().runSensors({ cwd: dir, changed: true });
-        expect(out.sensors.find((s) => s.name === 'lint').status).toBe('skipped');
+        expect(out.sensors.find((s) => s.name === 'lint').status).toBe('pass');
         expect(cmds()).toEqual(['tsc --noEmit']);
     });
     it('refuses a changedCmd without a {files} placeholder instead of running it repo-wide', async () => {

package/dist/tests/commands/sensors/run.test.js

@@ -7,6 +7,7 @@ const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const run_1 = require("../../../src/commands/sensors/run");
+const verdict_1 = require("../../../src/commands/sensors/verdict");
 function mkTmp() {
     return fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-sensors-'));
 }
@@ -53,6 +54,17 @@ describe('runSensors', () => {
             fs_1.default.rmSync(emptyDir, { recursive: true });
         }
     });
+    it.each([
+        ['fast', { fast: 'yes' }, 'run option fast must be a boolean'],
+        ['slow', { slow: 1 }, 'run option slow must be a boolean'],
+        ['all', { all: null }, 'run option all must be a boolean'],
+        ['cwd', { cwd: '   ' }, 'run option cwd must be a nonempty string'],
+    ])('rejects invalid public %s options before selecting or dispatching sensors', async (_name, options, message) => {
+        const { runSensors } = load();
+        await expect(runSensors(options)).rejects.toThrow(message);
+        expect(mockRunCommand).not.toHaveBeenCalled();
+        expect(mockRunStructuredCommand).not.toHaveBeenCalled();
+    });
     it('runs only fast sensors with --fast flag', async () => {
         mockRunCommand.mockResolvedValue(ok());
         const { runSensors } = load();
@@ -61,6 +73,12 @@ describe('runSensors', () => {
         expect(result.sensors.some((s) => s.name === 'security')).toBe(false);
         expect(result.overall).toBe('not_certified');
     });
+    it('runs both fast and slow sensors when --fast and --slow are combined', async () => {
+        mockRunCommand.mockResolvedValue(ok());
+        const { runSensors } = load();
+        const result = await runSensors({ fast: true, slow: true, cwd: tmpDir });
+        expect(result.sensors.map((sensor) => sensor.name)).toEqual(['typecheck', 'lint', 'security', 'mutation']);
+    });
     it('returns fail when a fast sensor has errors', async () => {
         mockRunCommand
             .mockResolvedValueOnce(exited(1, 'src/a.ts(1,1): error TS0001: Bad type.'))
@@ -203,6 +221,17 @@ describe('runSensors', () => {
         expect(result.overall).toBe('fail');
     });
 });
+describe('reduceVerdict', () => {
+    it('lets a failing full sensor outrank an empty changed-scope synthetic pass', () => {
+        expect((0, verdict_1.reduceVerdict)([
+            { name: 'lint', status: 'pass', errors: [], scope: 'changed' },
+            { name: 'typecheck', status: 'fail', errors: [{ message: 'broken' }] },
+        ])).toBe('fail');
+    });
+    it('rejects malformed result statuses instead of treating them as skipped', () => {
+        expect(() => (0, verdict_1.reduceVerdict)([{ name: 'lint', status: 'bogus', errors: [] }])).toThrow('sensor result status is invalid');
+    });
+});
 describe('runSensors v2 lifecycle contract', () => {
     let project;
     let home;

package/dist/tests/commands/sensors/status-windows.test.js

@@ -53,7 +53,7 @@ describe('computeSensorStatus — Windows PATH resolution', () => {
         // En win32 el usuario escribe `semgrep` y en disco existe `semgrep.cmd`.
         fs_1.default.writeFileSync(path_1.default.join(pathDir, 'semgrep.cmd'), '@echo off\r\n');
         const result = await (0, status_1.computeSensorStatus)(tmpDir);
-        expect(result.overall).toBe('DEGRADED');
+        expect(result.overall).toBe('READY');
         expect(result.checks.security.ok).toBe(true);
     });
     it('reporta ok:false en win32 cuando el binario no esta en PATH', async () => {

package/dist/tests/commands/sensors/status.test.js

@@ -7,8 +7,11 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const status_1 = require("../../../src/commands/sensors/status");
-const checks_1 = require("../../../src/commands/preflight/checks");
-const run_1 = require("../../../src/commands/sensors/run");
+jest.mock('../../../src/commands/sensors/exec', () => ({
+    runCommand: jest.fn(),
+    runStructuredCommand: jest.fn(),
+}));
+const { runCommand, runStructuredCommand } = require('../../../src/commands/sensors/exec');
 // `resolveOnPath` resuelve PATH en proceso (ya no invoca un shell — ver
 // core/paths.ts). Por eso estos tests controlan un PATH aislado en vez de
 // mockear `execSync`: ademas de reflejar el mecanismo real, los vuelve
@@ -43,13 +46,35 @@ describe('computeSensorStatus', () => {
         expect(result.overall).toBe('NOT_CONFIGURED');
         expect(result.pack).toBeNull();
     });
+    it.each([
+        ['valid manifest', 'READY', () => {
+                installLocalBin('eslint');
+                fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'eslint.config.awm.mjs'), 'export default []');
+                fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
+                fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({
+                    pack: 'js-ts', sensors: { lint: { cmd: 'npx eslint . --config eslint.config.awm.mjs' } },
+                }));
+            }],
+        ['missing tool', 'DEGRADED', () => {
+                fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
+                fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({
+                    pack: 'js-ts', sensors: { lint: { cmd: 'npx eslint .' } },
+                }));
+            }],
+        ['absent manifest', 'NOT_CONFIGURED', () => { }],
+    ])('reports %s as %s without dispatching sensor commands', async (_case, overall, setup) => {
+        setup();
+        await expect((0, status_1.computeSensorStatus)(tmpDir)).resolves.toMatchObject({ overall });
+        expect(runCommand).not.toHaveBeenCalled();
+        expect(runStructuredCommand).not.toHaveBeenCalled();
+    });
     // Helper: simulate a tool installed locally (node_modules/.bin/<tool>)
     function installLocalBin(tool) {
         const binDir = path_1.default.join(tmpDir, 'node_modules', '.bin');
         fs_1.default.mkdirSync(binDir, { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(binDir, tool), '');
     }
-    it('keeps an operational legacy manifest DEGRADED even when its npx tool is installed locally', async () => {
+    it('reports READY for an operational legacy manifest when its declared npx tool is installed locally', async () => {
         installLocalBin('tsc');
         fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({
@@ -57,7 +82,7 @@ describe('computeSensorStatus', () => {
             sensors: { typecheck: { cmd: 'npx tsc --noEmit', fast: true } }
         }));
         const result = await (0, status_1.computeSensorStatus)(tmpDir);
-        expect(result.overall).toBe('DEGRADED');
+        expect(result.overall).toBe('READY');
         expect(result.pack).toBe('js-ts');
         expect(result.checks.typecheck.ok).toBe(true);
     });
@@ -84,7 +109,7 @@ describe('computeSensorStatus', () => {
         expect(result.checks.lint.ok).toBe(false);
         expect(result.checks.lint.detail).toMatch(/missing config/i);
     });
-    it('is HEALTHY when the npx tool is installed and the --config file exists', async () => {
+    it('is READY when the declared npx tool and config are present without running a sensor command', async () => {
         installLocalBin('eslint');
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'eslint.config.awm.mjs'), 'export default []');
         fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
@@ -93,7 +118,10 @@ describe('computeSensorStatus', () => {
             sensors: { lint: { cmd: 'npx eslint . --config eslint.config.awm.mjs --format json', fast: true } }
         }));
         const result = await (0, status_1.computeSensorStatus)(tmpDir);
+        expect(result.overall).toBe('READY');
         expect(result.checks.lint.ok).toBe(true);
+        expect(runCommand).not.toHaveBeenCalled();
+        expect(runStructuredCommand).not.toHaveBeenCalled();
     });
     it('returns DEGRADED when a binary is missing', async () => {
         fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
@@ -122,7 +150,7 @@ describe('computeSensorStatus', () => {
             }));
             installOnPath('semgrep');
             const result = await (0, status_1.computeSensorStatus)(tmpDir);
-            expect(result.overall).toBe('DEGRADED');
+            expect(result.overall).toBe('READY');
             expect(result.checks.security.ok).toBe(true);
         });
     });
@@ -164,10 +192,10 @@ describe('computeSensorStatus', () => {
         expect(result.checks.mutation.ok).toBe(true);
         expect(result.checks.mutation.detail).toBe('disabled');
     });
-    it('does not trust the initialized v2 variant after local tool drift', async () => {
-        // The manifest records ESLint 9 at init time, but local evidence is now ESLint
-        // 10. Status must resolve the installed pack again, not certify the stale
-        // initializedCompatibility record.
+    it('degrades a v2 manifest whose live static compatibility has drifted', async () => {
+        // The manifest's initialization evidence remains durable diagnostic context.
+        // Status only checks its declared local executable; it never re-runs a project
+        // compatibility probe or calls a sensor command.
         const previousHome = process.env.AWM_HOME;
         const home = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-status-home-'));
         try {
@@ -178,7 +206,7 @@ describe('computeSensorStatus', () => {
             const variant = (id, range) => ({
                 id, priority: 10, certifiedRange: range,
                 requirements: { tool: 'eslint', toolRange: range, runtime: 'node', runtimeRange: '>=0.0.0' },
-                assets: ['eslint.config.awm.mjs'], formatter: 'eslint-llm', probe: { kind: 'config-present' },
+                assets: ['eslint.config.awm.mjs'], formatter: 'eslint-llm', probe: { kind: 'package-script-present' },
                 command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] },
             });
             fs_1.default.writeFileSync(path_1.default.join(registry, 'sensor-packs', 'js-ts', 'pack.json'), JSON.stringify({
@@ -188,6 +216,8 @@ describe('computeSensorStatus', () => {
             fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), JSON.stringify({ devDependencies: { eslint: '^10.0.0' } }));
             fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'node_modules', 'eslint'), { recursive: true });
             fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.0.0' }));
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, 'node_modules', '.bin'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', '.bin', 'eslint'), '');
             fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
             fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({
                 schemaVersion: 2, pack: 'js-ts', sensors: { lint: {
@@ -196,15 +226,17 @@ describe('computeSensorStatus', () => {
                     } },
             }));
             const result = await (0, status_1.computeSensorStatus)(tmpDir);
-            expect(result.overall).toBe('DEGRADED');
-            expect(result.checks.lint).toMatchObject({ ok: false, detail: expect.stringContaining('variant-drift') });
-            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'AGENTS.md'), '# test\n');
-            const gate = await (0, checks_1.preflight)(tmpDir);
-            expect(gate.status).toBe('degraded');
-            expect(gate.checks.find(check => check.id === 'tools')).toMatchObject({ ok: false, detail: expect.stringContaining('variant-drift') });
-            const run = await (0, run_1.runSensors)({ cwd: tmpDir, all: true });
-            expect(run.overall).toBe('not_certified');
-            expect(run.sensors).toEqual([expect.objectContaining({ name: 'lint', status: 'inconclusive', skipReason: expect.stringContaining('variant-drift') })]);
+            expect(result).toMatchObject({ overall: 'DEGRADED', checks: { lint: { ok: false } } });
+            expect(result.checks.lint.detail).toMatch(/drift|eslint-10/i);
+            // Once the installed tool matches the initialized variant, a failed
+            // static probe is still evidence of degraded readiness — it is not
+            // a runtime probe and cannot be waived as merely inconclusive.
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '9.0.0' }));
+            const staticProbeFailure = await (0, status_1.computeSensorStatus)(tmpDir);
+            expect(staticProbeFailure).toMatchObject({ overall: 'DEGRADED', checks: { lint: { ok: false } } });
+            expect(staticProbeFailure.checks.lint.detail).toMatch(/probe-not-matched|unverifiable/i);
+            expect(runCommand).not.toHaveBeenCalled();
+            expect(runStructuredCommand).not.toHaveBeenCalled();
         }
         finally {
             if (previousHome === undefined)

package/dist/tests/integration/preflight-json-pipe.e2e.test.js

@@ -7,20 +7,96 @@ const child_process_1 = require("child_process");
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const crypto_1 = __importDefault(require("crypto"));
 const cliRoot = path_1.default.resolve(__dirname, '../..');
 const bin = path_1.default.join(cliRoot, 'dist', 'src', 'index.js');
-test('preserves degraded preflight JSON when stdout is piped', () => {
+test('preserves actionable no-manifest preflight JSON when verify-sensors is piped', () => {
     const project = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-preflight-pipe-'));
     try {
-        const result = (0, child_process_1.spawnSync)(process.execPath, [bin, 'preflight', '--json'], {
+        const result = (0, child_process_1.spawnSync)(process.execPath, [bin, 'preflight', '--verify-sensors', '--json'], {
             cwd: project,
             encoding: 'utf8',
             env: { ...process.env, AWM_HOME: path_1.default.join(project, 'awm-home'), AWM_NO_UPDATE_CHECK: '1' },
         });
         expect(result.status).toBe(1);
-        expect(JSON.parse(result.stdout)).toMatchObject({ status: 'not_configured' });
+        expect(JSON.parse(result.stdout)).toMatchObject({
+            status: 'not_configured',
+            checks: expect.arrayContaining([expect.objectContaining({
+                    id: 'sensors-execution', ok: false,
+                    detail: 'sensor verdict was not_certified; no sensor established an empirical pass',
+                    remedy: expect.stringContaining('awm sensors init'),
+                })]),
+        });
     }
     finally {
         fs_1.default.rmSync(project, { recursive: true, force: true });
     }
 });
+function writeJson(file, value) {
+    fs_1.default.mkdirSync(path_1.default.dirname(file), { recursive: true });
+    fs_1.default.writeFileSync(file, JSON.stringify(value, null, 2));
+}
+function hashTree(root) {
+    const hash = crypto_1.default.createHash('sha256');
+    const walk = (dir) => {
+        for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            const file = path_1.default.join(dir, entry.name);
+            hash.update(path_1.default.relative(root, file));
+            if (entry.isDirectory())
+                walk(file);
+            else if (entry.isFile())
+                hash.update(fs_1.default.readFileSync(file));
+        }
+    };
+    walk(root);
+    return hash.digest('hex');
+}
+test('verify-sensors degrades parseably for a v2 sensor that exits 2 without findings and does not write the project', () => {
+    const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-preflight-verify-'));
+    const project = path_1.default.join(root, 'project');
+    const awmHome = path_1.default.join(root, 'awm-home');
+    const registry = path_1.default.join(awmHome, 'registries', 'baseline');
+    try {
+        fs_1.default.mkdirSync(project, { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(project, 'AGENTS.md'), '# context\n', { encoding: 'utf8', flag: 'w' });
+        writeJson(path_1.default.join(project, 'package.json'), { name: 'preflight-verify-fixture', private: true });
+        writeJson(path_1.default.join(project, 'node_modules', 'fixture-sensor', 'package.json'), { name: 'fixture-sensor', version: '1.0.0' });
+        fs_1.default.writeFileSync(path_1.default.join(project, 'fixture-sensor.config.mjs'), 'export default {};\n');
+        fs_1.default.writeFileSync(path_1.default.join(project, 'fixture-sensor.mjs'), 'process.exit(2);\n');
+        writeJson(path_1.default.join(registry, 'sensor-packs', 'fixture', 'pack.json'), {
+            schemaVersion: 2, name: 'fixture', description: 'preflight exit-2 fixture', detects: ['package.json'],
+            sensors: { lint: { applicability: { allFiles: ['package.json'] }, variants: [{
+                            id: 'fixture-v1', priority: 100,
+                            requirements: { tool: 'fixture-sensor', toolRange: '>=1 <2', runtime: 'node', runtimeRange: '>=20', configFiles: ['fixture-sensor.config.mjs'] },
+                            certifiedRange: '>=1 <2', command: { executable: 'node', resolution: 'path', args: ['fixture-sensor.mjs'] },
+                            assets: ['fixture-sensor.config.mjs'], formatter: 'generic', probe: { kind: 'config-present' },
+                        }] } },
+            coverage: { schemaVersion: 1, classes: {
+                    'fixture-output': {
+                        description: 'fixture output', detectors: [{ sensor: 'lint' }],
+                        remedy: { summary: 'run fixture', command: 'awm sensors init --pack fixture' },
+                    },
+                } },
+        });
+        writeJson(path_1.default.join(awmHome, 'registries.json'), [{ name: 'baseline', remote: 'fixture' }]);
+        writeJson(path_1.default.join(project, '.awm', 'sensors.json'), {
+            schemaVersion: 2, pack: 'fixture', packSelection: 'explicit', sensors: { lint: {
+                    enabled: true, fast: true, variantId: 'fixture-v1', command: { executable: 'node', resolution: 'path', args: ['fixture-sensor.mjs'] }, assets: ['fixture-sensor.config.mjs'],
+                    initializedCompatibility: { state: 'certified', reason: 'fixture', variantId: 'fixture-v1', toolVersion: '1.0.0', runtimeVersion: process.versions.node, certifiedRange: '>=1 <2', evidence: [] },
+                } },
+        });
+        const before = hashTree(project);
+        const result = (0, child_process_1.spawnSync)(process.execPath, [bin, 'preflight', '--verify-sensors', '--json', '--cwd', project], {
+            cwd: project, encoding: 'utf8', env: { ...process.env, AWM_HOME: awmHome, AWM_NO_UPDATE_CHECK: '1' },
+        });
+        expect(result.status).toBe(1);
+        expect(JSON.parse(result.stdout)).toMatchObject({
+            status: 'degraded',
+            checks: expect.arrayContaining([expect.objectContaining({ id: 'sensors-execution', ok: false, detail: expect.stringMatching(/lint.*exit 2/i) })]),
+        });
+        expect(hashTree(project)).toBe(before);
+    }
+    finally {
+        fs_1.default.rmSync(root, { recursive: true, force: true });
+    }
+});

package/dist/tests/integration/sensor-compatibility.e2e.test.js

@@ -58,6 +58,13 @@ function runCli(fixture, ...args) {
         env: { ...process.env, AWM_HOME: fixture.awmHome, AWM_NO_UPDATE_CHECK: '1' },
     });
 }
+function runAwm(fixture, ...args) {
+    return (0, child_process_1.spawnSync)(process.execPath, [bin, ...args], {
+        cwd: fixture.project,
+        encoding: 'utf8',
+        env: { ...process.env, AWM_HOME: fixture.awmHome, AWM_NO_UPDATE_CHECK: '1' },
+    });
+}
 function json(result) {
     expect(result.status).toBe(0);
     if (!(result.stdout ?? '').trim())
@@ -81,7 +88,7 @@ test.each(['linux', 'darwin', 'win32'])('keeps injected resolver semantics consi
             throw new Error('fixture must be a v2 pack');
         const discovered = (0, discovery_1.discoverProjectEvidence)(fixture.project, parsed.pack, { platform: () => platform });
         const probe = await (0, probe_1.runCompatibilityProbe)({ kind: 'version' }, { cwd: fixture.project, toolExecutable: 'eslint' }, async () => ({
-            code: 0, signal: null, timedOut: false, overflowed: false, stdout: 'eslint v10.4.1', stderr: '',
+            code: 0, signal: null, timedOut: false, overflowed: false, elapsedMs: 0, stdout: 'eslint v10.4.1', stderr: '',
         }));
         const result = (0, resolve_1.resolveSensorCompatibility)(parsed.pack.sensors.lint, { ...discovered, probe }, { pack: 'js-ts', sensor: 'lint' });
         expect(result).toMatchObject({ state: 'certified', variantId: 'eslint-10', toolVersion: '10.4.1' });
@@ -100,6 +107,38 @@ testWithNoFollow('compiled binary dispatches coverage and emits parseable JSON o
         fs_1.default.rmSync(fixture.root, { recursive: true, force: true });
     }
 });
+testWithNoFollow('compiled sensors run returns nonzero while preserving parseable not_certified JSON', () => {
+    const fixture = createFixture();
+    try {
+        fs_1.default.rmSync(path_1.default.join(fixture.project, '.awm', 'sensors.json'));
+        const result = runCli(fixture, 'run', '--fast');
+        expect(result.status).toBe(1);
+        expect(JSON.parse(result.stdout ?? '')).toMatchObject({ sensors: [], overall: 'not_certified' });
+    }
+    finally {
+        fs_1.default.rmSync(fixture.root, { recursive: true, force: true });
+    }
+});
+testWithNoFollow('compiled status reports static READY without writing or executing the project sensor (R6, R6.2)', () => {
+    const fixture = createFixture();
+    try {
+        const localBin = path_1.default.join(fixture.project, 'node_modules', '.bin', 'eslint');
+        fs_1.default.mkdirSync(path_1.default.dirname(localBin), { recursive: true });
+        fs_1.default.writeFileSync(localBin, 'this fixture must never be executed by status\n');
+        fs_1.default.copyFileSync(path_1.default.join(fixture.registryRoot, 'sensor-packs', 'js-ts', 'eslint.fixture.mjs'), path_1.default.join(fixture.project, 'eslint.fixture.mjs'));
+        const initialized = runCli(fixture, 'init', '--registry-root', fixture.registryRoot, '--pack', 'js-ts', '--no-configure');
+        expect(initialized.status).toBe(0);
+        const before = hashTree(fixture.project);
+        const result = runAwm(fixture, 'sensors', 'status');
+        expect(result.status).toBe(0);
+        expect(result.stdout).toContain('READY');
+        expect(result.stderr).toBe('');
+        expect(hashTree(fixture.project)).toBe(before);
+    }
+    finally {
+        fs_1.default.rmSync(fixture.root, { recursive: true, force: true });
+    }
+});
 testWithNoFollow('legacy coverage stays unverified, init migrates explicitly, and version drift is visible (R7.2, R7.8)', () => {
     const fixture = createFixture();
     try {

package/dist/tests/structural/sensor-documentation-contract.test.js

@@ -15,7 +15,25 @@ const sensors_1 = require("../../src/commands/sensors");
 const ROOT = path_1.default.resolve(__dirname, '../../..');
 const read = (file) => fs_1.default.readFileSync(path_1.default.join(ROOT, file), 'utf8');
 function documentedJson(files) {
-    return files.flatMap((file) => Array.from(read(file).matchAll(/```json\s*\n([\s\S]*?)```/g), (match) => JSON.parse(match[1])));
+    return files.flatMap((file) => {
+        const source = read(file);
+        return Array.from(source.matchAll(/```json\s*\n([\s\S]*?)```/g), (match) => {
+            const sectionStart = source.lastIndexOf('###', match.index ?? 0);
+            const leadIn = source.slice(Math.max(0, sectionStart), match.index ?? 0);
+            return {
+                value: JSON.parse(match[1]),
+                intentionallyIncomplete: /intentionally incomplete fragment/.test(leadIn),
+            };
+        });
+    });
+}
+function documentedV2Manifests(files) {
+    return documentedJson(files)
+        .filter((example) => !example.intentionallyIncomplete
+        && typeof example.value === 'object'
+        && example.value !== null
+        && example.value.schemaVersion === 2)
+        .map(example => example.value);
 }
 function helpFor(command) {
     const program = new commander_1.Command().name('awm');
@@ -38,17 +56,27 @@ describe('R3 canonical sensor documentation', () => {
         phrases.forEach((phrase) => expect(text).toContain(phrase));
     });
     test('parses every documented v2 sensor manifest example with the production parser', () => {
-        const examples = documentedJson(['docs/configuration.md', 'docs/cli-reference.md'])
-            .filter((value) => typeof value === 'object' && value !== null && value.schemaVersion === 2);
+        const examples = documentedV2Manifests(['docs/configuration.md', 'docs/cli-reference.md']);
         expect(examples.length).toBeGreaterThan(0);
         examples.forEach((example) => expect(() => (0, manifest_1.parseSensorManifest)(example, 'documented example')).not.toThrow());
     });
     test('keeps documented v2 sensor manifests portable across native platforms', () => {
-        const examples = documentedJson(['docs/configuration.md', 'docs/cli-reference.md'])
-            .filter((value) => typeof value === 'object' && value !== null && value.schemaVersion === 2);
+        const examples = documentedV2Manifests(['docs/configuration.md', 'docs/cli-reference.md']);
         expect(examples.length).toBeGreaterThan(0);
         examples.forEach((example) => expect(example).not.toHaveProperty('registryRoot'));
     });
+    test('excludes only an explicitly incomplete timeout fragment, not invalid full v2 manifests', () => {
+        const examples = documentedJson(['docs/configuration.md']);
+        const incomplete = examples.find(example => example.intentionallyIncomplete);
+        const complete = documentedV2Manifests(['docs/configuration.md']);
+        expect(incomplete?.value).toMatchObject({ schemaVersion: 2, sensors: { test: { timeout: 600000 } } });
+        expect(() => (0, manifest_1.parseSensorManifest)(incomplete?.value, 'incomplete timeout fragment')).toThrow();
+        expect(complete).toHaveLength(1);
+        expect(() => (0, manifest_1.parseSensorManifest)(complete[0], 'complete documented manifest')).not.toThrow();
+        expect(() => (0, manifest_1.parseSensorManifest)({
+            schemaVersion: 2, pack: 'js-ts', sensors: { test: { enabled: true, variantId: 'npm-script' } },
+        }, 'invalid full manifest')).toThrow();
+    });
     test('documents exact Commander flags', () => {
         expect(helpFor('sensors coverage')).toContain('--min <count>');
         expect(helpFor('ledger add')).toContain('--defect-class <id>');

package/dist/tests/structural/support-matrix-is-current.test.js

@@ -24,6 +24,31 @@ const sensor_support_matrix_1 = require("../../scripts/sensor-support-matrix");
 const SENSOR_FIXTURE_REGISTRY = path_1.default.join(__dirname, '..', 'fixtures', 'sensor-support-matrix', 'registry');
 const CI_WORKFLOW_PATH = path_1.default.resolve(__dirname, '../../..', '.github', 'workflows', 'ci.yml');
 describe('docs/support-matrix.md refleja el codigo', () => {
+    it('documents the bounded, empirical sensor gate contract (R3-R7, R10)', () => {
+        const root = path_1.default.resolve(__dirname, '../../..');
+        const cliReference = fs_1.default.readFileSync(path_1.default.join(root, 'docs', 'cli-reference.md'), 'utf8');
+        const configuration = fs_1.default.readFileSync(path_1.default.join(root, 'docs', 'configuration.md'), 'utf8');
+        const acceptance = fs_1.default.readFileSync(path_1.default.join(root, 'docs', 'testing', 'core-acceptance.md'), 'utf8');
+        const osMatrix = fs_1.default.readFileSync(path_1.default.join(root, 'docs', 'testing', 'os-matrix.md'), 'utf8');
+        for (const expected of [
+            '`execution.timeoutMs`', '`timeoutSource`', '`elapsedMs`',
+            '`requestedScope`', '`effectiveScope`', '`files`', '`scopeReason`',
+            '`project` → `pack` → `fallback`', '10,000 ms', '120,000 ms',
+            '`pass`', '`fail`', '`not_certified`', '`skipped`',
+            '`awm preflight --verify-sensors`', 'read-only', 'READY', 'not a health or certification claim',
+        ])
+            expect(cliReference + configuration + acceptance).toContain(expected);
+        expect(acceptance).toContain('legacy manifest');
+        expect(acceptance).toContain('v2 manifest without new fields');
+        expect(acceptance).toContain('supported, unsupported, empty, and Git-error');
+        expect(acceptance).toContain('project, pack, and fallback');
+        expect(cliReference).toContain('`not_certified` with an empty sensor list');
+        expect(cliReference).toContain('`awm sensors init`');
+        expect(acceptance).toContain('established (for example `not_certified` and an empty list)');
+        expect(acceptance).toMatch(/must not fabricate a\s+sensor name, timeout, source, or elapsed time/);
+        expect(osMatrix).toContain('Ubuntu, macOS, and native Windows');
+        expect(osMatrix).toContain('shell-free');
+    });
     it('el bloque generado esta al dia', () => {
         const doc = fs_1.default.readFileSync(support_matrix_1.DOC_PATH, 'utf-8');
         const expected = (0, support_matrix_1.spliceGenerated)(doc, (0, support_matrix_1.renderProviderTables)());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "8.1.4",
+  "version": "8.1.6",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"