agentic-workflow-manager 8.1.5 → 8.2.0

package/dist/src/commands/sensors/compatibility/manifest.js

@@ -184,7 +184,7 @@ function provenanceRoot(value, source) {
     return parsed;
 }
 function parseV2Manifest(value, source) {
-    fields(value, ['schemaVersion', 'pack', 'packSelection', 'registryRoot', 'sensors', 'concurrency'], source, 'root');
+    fields(value, ['schemaVersion', 'pack', 'packSelection', 'registryRoot', 'packageRoot', 'sensors', 'concurrency'], source, 'root');
     if (value.schemaVersion !== 2)
         invalid(source, `unsupported manifest schemaVersion ${String(value.schemaVersion)}; supported: legacy, 2; upgrade or migrate the manifest`);
     const pack = id(value.pack, source, 'pack');
@@ -200,6 +200,8 @@ function parseV2Manifest(value, source) {
     }
     if ('registryRoot' in value)
         manifest.registryRoot = provenanceRoot(value.registryRoot, source);
+    if ('packageRoot' in value)
+        manifest.packageRoot = asset(value.packageRoot, source, 'packageRoot');
     if ('concurrency' in value) {
         if (typeof value.concurrency !== 'number' || !Number.isSafeInteger(value.concurrency) || value.concurrency <= 0)
             invalid(source, 'concurrency must be a positive safe integer');

package/dist/src/commands/sensors/compatibility/materialize.js

@@ -82,7 +82,11 @@ function materializeResolvedSensors(input) {
             throw new Error('materialized sensor must be v2');
         sensors[name] = parsed.pack.sensors[name];
     }
-    const manifest = { schemaVersion: 2, pack, sensors, ...(input.packSelection === 'explicit' ? { packSelection: 'explicit' } : {}), ...(input.registryRoot ? { registryRoot: input.registryRoot } : {}) };
+    const manifest = { schemaVersion: 2, pack, sensors, ...(input.packSelection === 'explicit' ? { packSelection: 'explicit' } : {}), ...(input.registryRoot ? { registryRoot: input.registryRoot } : {}), ...(input.packageRoot ? { packageRoot: containedAsset(input.packageRoot, 'packageRoot') } : {}) };
+    // Assets land where sensors will actually run — projectRoot by default, or
+    // packageRoot underneath it for a monorepo. The manifest write below stays
+    // pinned to projectRoot either way (see atomicWrite call at the end).
+    const configRoot = manifest.packageRoot ? root(path_1.default.join(projectRoot, manifest.packageRoot), 'packageRoot') : projectRoot;
     // A policy reference is deliberately not a materialized asset. Resolve it here
     // from the registry-owned sibling only, so a manifest cannot turn arbitrary
     // registry content into a project write through a cosmetic policy field.
@@ -99,7 +103,7 @@ function materializeResolvedSensors(input) {
         if (input.configure !== false) {
             for (const asset of selected) {
                 const source = path_1.default.join(packRoot, ...asset.split('/'));
-                const destination = path_1.default.join(projectRoot, ...asset.split('/'));
+                const destination = path_1.default.join(configRoot, ...asset.split('/'));
                 let stat;
                 try {
                     stat = fs_1.default.lstatSync(source);

package/dist/src/commands/sensors/index.js

@@ -67,10 +67,11 @@ function registerSensorsCommand(program) {
         .option('--no-configure', 'skip copying sensor pack config files into the project')
         .option('--registry-root <path>', 'path to AWM registry root')
         .option('--pack <name>', 'skip auto-detection, use this pack explicitly')
+        .option('--package-root <dir>', 'run detection/execution from this subdirectory (monorepo support) — the manifest still writes at the current directory')
         .action(async (opts) => {
         const registryRoot = opts.registryRoot ?? (0, registries_1.capabilityRoot)('sensor-packs') ?? undefined;
         try {
-            const result = await (0, init_1.initSensors)({ configure: opts.configure, registryRoot, pack: opts.pack });
+            const result = await (0, init_1.initSensors)({ configure: opts.configure, registryRoot, pack: opts.pack, packageRoot: opts.packageRoot });
             prompts_1.log.success(`Detected: ${result.detection.pack} (${result.detection.indicators.join(', ') || 'fallback'})`);
             // Said BEFORE "Wrote .awm/sensors.json": the manifest about to be
             // reported as written is not the one the detection implied.

package/dist/src/commands/sensors/init.js

@@ -213,6 +213,10 @@ async function initSensors(opts = {}) {
     const cwd = opts.cwd ?? process.cwd();
     const configure = opts.configure ?? true; // configure (copy pack config files) by default
     const manifestPath = path_1.default.join(cwd, '.awm', 'sensors.json');
+    // Monorepo support: detection and evidence both need to see the real project,
+    // not the (possibly unrelated) directory the manifest lives in. The manifest
+    // write itself stays pinned to cwd regardless — see manifestPath above.
+    const detectionCwd = opts.packageRoot ? path_1.default.resolve(cwd, opts.packageRoot) : cwd;
     // --pack skips the heuristic entirely. Only validate against the registry when a
     // registryRoot was actually given — same tolerance pattern as readPackDefaults /
     // buildManifest elsewhere in this file for a missing registry: nothing to validate
@@ -224,7 +228,7 @@ async function initSensors(opts = {}) {
         detection = { pack: opts.pack, indicators: ['--pack override'] };
     }
     else {
-        detection = detectStack(cwd);
+        detection = detectStack(detectionCwd);
     }
     let existing;
     let existingV2;
@@ -254,7 +258,7 @@ async function initSensors(opts = {}) {
         const resolvedV2 = readV2Pack(resolvedPack, opts.registryRoot);
         if (resolvedV2) {
             const packSelection = opts.pack ? 'explicit' : undefined;
-            const live = await (0, live_1.resolveParsedPackCompatibility)(cwd, resolvedV2.pack, { packSelection });
+            const live = await (0, live_1.resolveParsedPackCompatibility)(detectionCwd, resolvedV2.pack, { packSelection });
             const compatibility = live.sensors;
             const sensors = {};
             for (const [name, sensor] of Object.entries(live.pack.sensors)) {
@@ -285,7 +289,8 @@ async function initSensors(opts = {}) {
             }
             const materialized = (0, materialize_1.materializeResolvedSensors)({
                 projectRoot: cwd, packRoot: resolvedV2.packRoot,
-                pack: resolvedPack, ...(packSelection ? { packSelection } : {}), registryRoot: opts.registryRoot, sensors, configure,
+                pack: resolvedPack, ...(packSelection ? { packSelection } : {}), registryRoot: opts.registryRoot,
+                ...(opts.packageRoot ? { packageRoot: opts.packageRoot } : {}), sensors, configure,
             });
             return { detection, ...materialized,
                 compatibility, ...(unavailablePack ? { unavailablePack } : {}) };

package/dist/src/commands/sensors/prepare.js

@@ -42,7 +42,11 @@ function expandFileInput(command, files) {
     if (index < 0 || command.args.lastIndexOf(command.fileInput.placeholder) !== index) {
         throw new Error('changed command requires exactly one standalone {files} argument');
     }
-    return { ...command, args: [...command.args.slice(0, index), ...files, ...command.args.slice(index + 1)] };
+    // `fileInput` describes the unexpanded registry template. Leaving it on the
+    // materialized command makes the execution boundary (correctly) demand a
+    // placeholder that has already been replaced with literal argv entries.
+    const { fileInput: _templateInput, ...materialized } = command;
+    return { ...materialized, args: [...command.args.slice(0, index), ...files, ...command.args.slice(index + 1)] };
 }
 function timeout(project, pack, fast) {
     const resolved = (0, timeout_1.resolveTimeout)({ project, pack, fast });

package/dist/src/commands/sensors/run.js

@@ -154,7 +154,15 @@ async function runSensors(opts = {}) {
         if (scopeError)
             changed.error = scopeError;
     }
-    const live = parsed.kind === 'v2' ? await resolveLiveV2(manifestDir, parsed) : null;
+    // Monorepo support: a v2 manifest may declare packageRoot so detection and
+    // execution both happen against the real package (e.g. "cli"), while the
+    // manifest itself stays discoverable at the repo root via findManifestDir.
+    // Legacy manifests never carry this field — manifestDir is always correct
+    // for them, unchanged.
+    const projectCwd = parsed.kind === 'v2' && parsed.pack.packageRoot
+        ? path_1.default.resolve(manifestDir, parsed.pack.packageRoot)
+        : manifestDir;
+    const live = parsed.kind === 'v2' ? await resolveLiveV2(projectCwd, parsed) : null;
     const drift = parsed.kind === 'legacy' ? detectPackDrift(manifestDir, parsed.pack) : undefined;
     const requestedScope = opts.changed ? 'changed' : 'full';
     const prepared = [];
@@ -173,7 +181,7 @@ async function runSensors(opts = {}) {
             : execution);
     }
     const results = await pooled(prepared.map(entry => async () => {
-        const result = await (0, result_1.executePrepared)(entry, manifestDir);
+        const result = await (0, result_1.executePrepared)(entry, projectCwd);
         return baseline ? (0, result_1.applyBaseline)(result, baseline[entry.name]) : result;
     }), resolveConcurrency(parsed.pack, prepared.length));
     let overall = (0, verdict_1.reduceVerdict)(results);

package/dist/tests/commands/sensors/compatibility/manifest.test.js

@@ -82,6 +82,18 @@ describe('sensor manifest contract', () => {
         const sensor = { enabled: true, variantId: 'eslint-9', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, initializedCompatibility: { state: 'certified', reason: 'ok', variantId: 'eslint-9', toolVersion: '10.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] } };
         expect(() => (0, manifest_1.parseSensorManifest)({ schemaVersion: 2, pack: 'js-ts', sensors: { lint: sensor } }, 'source')).toThrow('certifiedRange');
     });
+    it('accepts a v2 packageRoot for monorepo-scoped sensor detection/execution', () => {
+        const manifest = { ...validV2Manifest(), packageRoot: 'cli' };
+        expect((0, manifest_1.parseSensorManifest)(manifest, 'source')).toMatchObject({ kind: 'v2', pack: { packageRoot: 'cli' } });
+    });
+    it('rejects a packageRoot that escapes the manifest directory', () => {
+        const manifest = { ...validV2Manifest(), packageRoot: '../outside' };
+        expect(() => (0, manifest_1.parseSensorManifest)(manifest, 'source')).toThrow('packageRoot');
+    });
+    it('rejects an absolute packageRoot', () => {
+        const manifest = { ...validV2Manifest(), packageRoot: '/etc' };
+        expect(() => (0, manifest_1.parseSensorManifest)(manifest, 'source')).toThrow('packageRoot');
+    });
     test.each([
         [null, 'object'],
         [{}, 'pack'],

package/dist/tests/commands/sensors/exec.test.js

@@ -8,6 +8,7 @@ const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const exec_1 = require("../../../src/commands/sensors/exec");
 const result_1 = require("../../../src/commands/sensors/result");
+const prepare_1 = require("../../../src/commands/sensors/prepare");
 const sensor = (overrides = {}) => ({
     name: 'lint',
     command: { kind: 'legacy', value: 'node -e "setTimeout(() => {}, 1000)"' },
@@ -148,6 +149,24 @@ describe('runCommand — spawn failure', () => {
     });
 });
 describe('runStructuredCommand — public boundary validation', () => {
+    it('dispatches argv materialized from a validated changed-command template without requiring its placeholder again', async () => {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-exec-changed-argv-'));
+        const received = path_1.default.join(dir, 'received.json');
+        try {
+            const command = (0, prepare_1.expandFileInput)({
+                executable: 'node',
+                resolution: 'path',
+                args: ['-e', "require('fs').writeFileSync(process.argv[1], JSON.stringify(process.argv.slice(2)))", received, '{files}'],
+                fileInput: { placeholder: '{files}', extensions: ['.ts'] },
+            }, ['src/a.ts', 'src/with space.ts']);
+            const result = await (0, exec_1.runStructuredCommand)(command, { timeout: 5_000, cwd: dir });
+            expect(result.code).toBe(0);
+            expect(JSON.parse(fs_1.default.readFileSync(received, 'utf8'))).toEqual(['src/a.ts', 'src/with space.ts']);
+        }
+        finally {
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+        }
+    });
     it.each(['sh', 'cmd.exe', '/usr/bin/node', 'nested/tool', 'nested\\tool'])('rejects unsafe executable %j before resolution', executable => {
         expect(() => (0, exec_1.runStructuredCommand)({ executable, resolution: 'path', args: ['--version'] }, { timeout: 5000, cwd: process.cwd() }))
             .toThrow(/safe executable name|shell/i);

package/dist/tests/commands/sensors/init.test.js

@@ -434,6 +434,59 @@ describe('initSensors', () => {
         }
     });
 });
+describe('initSensors — packageRoot (monorepo)', () => {
+    let tmpDir;
+    beforeEach(() => {
+        tmpDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-init-monorepo-'));
+    });
+    afterEach(() => {
+        fs_1.default.rmSync(tmpDir, { recursive: true, force: true });
+    });
+    it('detects the real package under packageRoot, not the manifest directory', async () => {
+        const v2Registry = makeV2Registry();
+        try {
+            // The manifest will live at tmpDir/.awm/sensors.json (repo root), but the
+            // real package — package.json, node_modules — lives under tmpDir/cli.
+            const packageDir = path_1.default.join(tmpDir, 'cli');
+            fs_1.default.mkdirSync(packageDir, { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(packageDir, 'package.json'), JSON.stringify({ devDependencies: { eslint: '^10.0.0' } }));
+            fs_1.default.mkdirSync(path_1.default.join(packageDir, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(packageDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.0.0' }));
+            const result = await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry, packageRoot: 'cli' });
+            // Real detection succeeded — a manifest built against tmpDir root (with no
+            // package.json there) would leave lint unresolved/absent.
+            expect(result.manifest).toMatchObject({ packageRoot: 'cli', sensors: { lint: { variantId: 'eslint-10' } } });
+            // The manifest itself stays discoverable at the repo root (findManifestDir
+            // walks up from cwd, never down into subdirectories).
+            expect(fs_1.default.existsSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'))).toBe(true);
+            expect(fs_1.default.existsSync(path_1.default.join(packageDir, '.awm', 'sensors.json'))).toBe(false);
+            const written = JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), 'utf8'));
+            expect(written.packageRoot).toBe('cli');
+        }
+        finally {
+            fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
+        }
+    });
+    it('copies configured assets into packageRoot, not the manifest directory', async () => {
+        const v2Registry = makeV2Registry();
+        try {
+            const packageDir = path_1.default.join(tmpDir, 'cli');
+            fs_1.default.mkdirSync(packageDir, { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(packageDir, 'package.json'), JSON.stringify({ devDependencies: { eslint: '^10.0.0' } }));
+            fs_1.default.mkdirSync(path_1.default.join(packageDir, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(packageDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.0.0' }));
+            await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry, packageRoot: 'cli' });
+            // The asset must land where the lint sensor will actually execute (cwd=cli),
+            // not at the manifest's own directory (repo root) — otherwise a config-relative
+            // tool invocation can never find it.
+            expect(fs_1.default.existsSync(path_1.default.join(packageDir, 'eslint.config.awm.mjs'))).toBe(true);
+            expect(fs_1.default.existsSync(path_1.default.join(tmpDir, 'eslint.config.awm.mjs'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
+        }
+    });
+});
 describe('initSensors — --pack override', () => {
     let tmpDir;
     let registryRoot;

package/dist/tests/commands/sensors/prepare.test.js

@@ -30,7 +30,7 @@ function v2Input(overrides = {}) {
 describe('prepareV2Sensor', () => {
     test('v2 uses the live command and project > pack > fallback timeout (R1.1, R3.1)', () => {
         const prepared = (0, prepare_1.prepareV2Sensor)(v2Input());
-        expect(prepared.command).toEqual({ kind: 'structured', value: { ...changedCommand, args: ['--format', 'json', 'src/a.ts'] } });
+        expect(prepared.command).toEqual({ kind: 'structured', value: { executable: 'live-eslint', resolution: 'path', args: ['--format', 'json', 'src/a.ts'] } });
         expect(prepared.timeoutMs).toBe(90_000);
         expect(prepared.timeoutSource).toBe('project');
         expect((0, prepare_1.prepareV2Sensor)(v2Input({ projectTimeout: undefined })).timeoutSource).toBe('pack');
@@ -42,7 +42,7 @@ describe('prepareV2Sensor', () => {
     });
     test('expands changed paths as literal argv entries (R4.1, R10.2)', () => {
         const prepared = (0, prepare_1.prepareV2Sensor)(v2Input({ changed: { files: ['src/a b.ts', 'src/$x.ts'] } }));
-        expect(prepared.command).toEqual({ kind: 'structured', value: { ...changedCommand, args: ['--format', 'json', 'src/a b.ts', 'src/$x.ts'] } });
+        expect(prepared.command).toEqual({ kind: 'structured', value: { executable: 'live-eslint', resolution: 'path', args: ['--format', 'json', 'src/a b.ts', 'src/$x.ts'] } });
         expect(prepared.effectiveScope).toBe('changed');
     });
     test('falls back full with an explicit reason without changedCommand (R4.2)', () => {

package/dist/tests/commands/sensors/run.test.js

@@ -282,6 +282,33 @@ describe('runSensors v2 lifecycle contract', () => {
         expect(result).toEqual(expect.objectContaining({ overall: 'pass' }));
         expect(mockRunStructuredCommand).toHaveBeenCalledWith(expect.objectContaining({ executable: 'live-eslint' }), expect.any(Object));
     });
+    it('scopes applicability detection and execution to packageRoot for a monorepo manifest', async () => {
+        // Move the fixture project into a subdirectory ("cli") and point the
+        // manifest at it via packageRoot — mirrors a monorepo where the
+        // manifest lives at the repo root but the real package lives deeper.
+        const packageDir = path_1.default.join(project, 'cli');
+        fs_1.default.mkdirSync(packageDir, { recursive: true });
+        fs_1.default.renameSync(path_1.default.join(project, 'package.json'), path_1.default.join(packageDir, 'package.json'));
+        fs_1.default.renameSync(path_1.default.join(project, 'node_modules'), path_1.default.join(packageDir, 'node_modules'));
+        const manifestPath = path_1.default.join(project, '.awm', 'sensors.json');
+        const manifest = JSON.parse(fs_1.default.readFileSync(manifestPath, 'utf8'));
+        manifest.packageRoot = 'cli';
+        fs_1.default.writeFileSync(manifestPath, JSON.stringify(manifest));
+        const { runSensors } = require('../../../src/commands/sensors/run');
+        const result = await runSensors({ cwd: project, fast: true });
+        expect(result).toEqual(expect.objectContaining({ overall: 'pass' }));
+        expect(mockRunStructuredCommand).toHaveBeenCalledWith(expect.objectContaining({ executable: 'live-eslint' }), expect.objectContaining({ cwd: packageDir }));
+    });
+    it('degrades to not_certified (never a false pass, never a crash) when packageRoot points nowhere', async () => {
+        const manifestPath = path_1.default.join(project, '.awm', 'sensors.json');
+        const manifest = JSON.parse(fs_1.default.readFileSync(manifestPath, 'utf8'));
+        manifest.packageRoot = 'does-not-exist';
+        fs_1.default.writeFileSync(manifestPath, JSON.stringify(manifest));
+        const { runSensors } = require('../../../src/commands/sensors/run');
+        const result = await runSensors({ cwd: project, fast: true });
+        expect(result.overall).toBe('not_certified');
+        expect(mockRunStructuredCommand).not.toHaveBeenCalled();
+    });
     it('honors disabled v2 sensors before dispatching them', async () => {
         const manifest = JSON.parse(fs_1.default.readFileSync(path_1.default.join(project, '.awm', 'sensors.json'), 'utf8'));
         manifest.sensors.lint.enabled = false;

package/dist/tests/integration/published-sensor-gate-matrix.e2e.test.js

@@ -0,0 +1,237 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = __importDefault(require("crypto"));
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+/**
+ * This acceptance gate is deliberately opt-in. It downloads two release
+ * artifacts and installs fixture dependencies, so normal unit/PR runs must not
+ * accidentally treat a mutable checkout as publication evidence.
+ *
+ * Run it with:
+ *   AWM_RUN_PUBLISHED_SENSOR_GATE_MATRIX=1 npm test -- published-sensor-gate-matrix
+ */
+const enabled = process.env.AWM_RUN_PUBLISHED_SENSOR_GATE_MATRIX === '1';
+const acceptance = enabled ? describe : describe.skip;
+const cliVersion = process.env.AWM_PUBLISHED_CLI_VERSION ?? '8.1.6';
+const registryTag = process.env.AWM_PUBLISHED_REGISTRY_TAG ?? 'v3.0.0';
+const registryRemote = process.env.AWM_PUBLISHED_REGISTRY_REMOTE ?? 'https://github.com/Kodria/awm-baseline-registry.git';
+// Keep the shorter name used by the release orchestrator, while accepting the
+// original explicit name for local invocation.
+const reportFile = process.env.AWM_PUBLISHED_MATRIX_REPORT ?? process.env.AWM_PUBLISHED_SENSOR_GATE_MATRIX_REPORT;
+function hash(value) {
+    return crypto_1.default.createHash('sha256').update(value).digest('hex');
+}
+function writeJson(file, value) {
+    fs_1.default.mkdirSync(path_1.default.dirname(file), { recursive: true });
+    fs_1.default.writeFileSync(file, JSON.stringify(value, null, 2));
+}
+function assertProcess(result, description) {
+    if (result.error || result.status !== 0 || result.signal !== null) {
+        throw new Error(`${description} failed: status=${String(result.status)} signal=${String(result.signal)} error=${result.error?.message ?? 'none'}\n${result.stderr}`);
+    }
+}
+function command(cwd, executable, args, env = process.env) {
+    return (0, child_process_1.spawnSync)(executable, args, { cwd, encoding: 'utf8', env, maxBuffer: 64 * 1024 * 1024 });
+}
+function installArtifacts(root) {
+    const artifacts = path_1.default.join(root, 'artifacts');
+    fs_1.default.mkdirSync(artifacts, { recursive: true });
+    writeJson(path_1.default.join(artifacts, 'package.json'), { private: true, name: 'published-sensor-gate-artifacts' });
+    assertProcess(command(artifacts, 'npm', ['install', '--ignore-scripts', '--no-audit', '--no-fund', `agentic-workflow-manager@${cliVersion}`]), `npm install agentic-workflow-manager@${cliVersion}`);
+    const registryRoot = path_1.default.join(root, 'registry');
+    assertProcess(command(root, 'git', ['clone', '--depth', '1', '--branch', registryTag, registryRemote, registryRoot]), `git clone ${registryTag}`);
+    const actualVersion = JSON.parse(fs_1.default.readFileSync(path_1.default.join(artifacts, 'node_modules', 'agentic-workflow-manager', 'package.json'), 'utf8')).version;
+    if (actualVersion !== cliVersion)
+        throw new Error(`npm resolved CLI ${String(actualVersion)} instead of immutable ${cliVersion}`);
+    const actualTag = command(registryRoot, 'git', ['describe', '--exact-match', '--tags', 'HEAD']);
+    assertProcess(actualTag, `verify registry tag ${registryTag}`);
+    if (actualTag.stdout.trim() !== registryTag)
+        throw new Error(`registry checkout resolved ${actualTag.stdout.trim()} instead of ${registryTag}`);
+    return { cliRoot: path_1.default.join(artifacts, 'node_modules', 'agentic-workflow-manager'), registryRoot };
+}
+function createFixture(root, registryRoot, name) {
+    const fixtureRoot = path_1.default.join(root, name);
+    const project = path_1.default.join(fixtureRoot, 'project');
+    const awmHome = path_1.default.join(fixtureRoot, 'awm-home');
+    fs_1.default.mkdirSync(project, { recursive: true });
+    fs_1.default.mkdirSync(path_1.default.join(awmHome, 'registries'), { recursive: true });
+    fs_1.default.cpSync(registryRoot, path_1.default.join(awmHome, 'registries', 'baseline'), { recursive: true });
+    writeJson(path_1.default.join(awmHome, 'registries.json'), [{ name: 'baseline', remote: registryRemote }]);
+    writeJson(path_1.default.join(project, 'package.json'), { name: `published-${name}`, private: true });
+    // The real v3 pack requires an ESLint 8 eslintrc project. These dependencies
+    // belong to the isolated fixture, never to the CLI under test.
+    assertProcess(command(project, 'npm', ['install', '--ignore-scripts', '--no-audit', '--no-fund', '--save-dev', 'eslint@8.57.1']), `install ESLint fixture for ${name}`);
+    fs_1.default.writeFileSync(path_1.default.join(project, '.eslintrc.js'), 'module.exports = { env: { node: true, es2022: true } };\n');
+    fs_1.default.writeFileSync(path_1.default.join(project, 'clean.js'), 'const answer = 42;\nconsole.log(answer);\n');
+    return { root: fixtureRoot, project, awmHome };
+}
+function parseJson(result, description) {
+    if (!result.stdout.trim())
+        throw new Error(`${description} emitted no JSON; stderr=${result.stderr}`);
+    return JSON.parse(result.stdout);
+}
+function runCli(cliRoot, fixture, ...args) {
+    return command(fixture.project, process.execPath, [path_1.default.join(cliRoot, 'dist', 'src', 'index.js'), ...args], {
+        ...process.env,
+        AWM_HOME: fixture.awmHome,
+        AWM_NO_UPDATE_CHECK: '1',
+    });
+}
+function record(records, name, argv, result, output) {
+    records.push({ name, argv, exit: result.status, signal: result.signal, stdoutHash: hash(result.stdout), stderrHash: hash(result.stderr), ...(output ? { output } : {}) });
+}
+function runJson(records, name, cliRoot, fixture, ...args) {
+    const result = runCli(cliRoot, fixture, ...args);
+    let output;
+    try {
+        output = parseJson(result, name);
+    }
+    catch (error) {
+        // A missing JSON envelope is itself release evidence. Persist argv,
+        // process status and hashes before surfacing the failed acceptance gate.
+        record(records, name, args, result);
+        throw error;
+    }
+    record(records, name, args, result, output);
+    return { result, output };
+}
+function assertExitMatchesVerdict(result, output) {
+    expect(result.status).toBe(output.overall === 'pass' ? 0 : 1);
+}
+function writeReport(root, cliRoot, registryRoot, records) {
+    const target = reportFile ? path_1.default.resolve(reportFile) : path_1.default.join(root, 'published-sensor-gate-matrix.json');
+    writeJson(target, {
+        schemaVersion: 1,
+        generatedAt: new Date().toISOString(),
+        cli: { version: cliVersion, packageHash: hash(fs_1.default.readFileSync(path_1.default.join(cliRoot, 'package.json'), 'utf8')) },
+        registry: {
+            tag: registryTag,
+            commit: command(registryRoot, 'git', ['rev-parse', 'HEAD']).stdout.trim(),
+            packHash: hash(fs_1.default.readFileSync(path_1.default.join(registryRoot, 'sensor-packs', 'js-ts', 'pack.json'), 'utf8')),
+        },
+        commands: records,
+    });
+    process.stdout.write(`published sensor gate matrix: ${target}\n`);
+}
+acceptance('published sensor gate matrix', () => {
+    jest.setTimeout(10 * 60_000);
+    test('records real legacy, v2, changed, baseline, status and preflight evidence from immutable releases', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-published-sensor-gates-'));
+        const records = [];
+        let artifacts;
+        try {
+            artifacts = installArtifacts(root);
+            const { cliRoot, registryRoot } = artifacts;
+            expect(fs_1.default.existsSync(path_1.default.join(cliRoot, 'dist', 'src', 'index.js'))).toBe(true);
+            expect(fs_1.default.existsSync(path_1.default.join(registryRoot, 'sensor-packs', 'js-ts', 'pack.json'))).toBe(true);
+            const v2 = createFixture(root, registryRoot, 'v2');
+            const initialized = runCli(cliRoot, v2, 'sensors', 'init', '--registry-root', registryRoot, '--pack', 'js-ts');
+            record(records, 'v2-init', ['sensors', 'init', '--registry-root', '<registry-root>', '--pack', 'js-ts'], initialized);
+            assertProcess(initialized, 'v2 init');
+            const status = runCli(cliRoot, v2, 'sensors', 'status');
+            record(records, 'v2-status', ['sensors', 'status'], status);
+            expect(status.status).toBe(0);
+            const preflight = runJson(records, 'v2-preflight', cliRoot, v2, 'preflight', '--verify-sensors', '--json');
+            expect(['ready', 'degraded', 'not_configured']).toContain(preflight.output.status);
+            expect(preflight.output.status).toBe('degraded');
+            expect(preflight.result.status).toBe(1);
+            const clean = runJson(records, 'v2-clean-fast', cliRoot, v2, 'sensors', 'run', '--fast');
+            assertExitMatchesVerdict(clean.result, clean.output);
+            expect(clean.output.sensors).toEqual(expect.arrayContaining([
+                expect.objectContaining({ execution: expect.objectContaining({ timeoutSource: 'pack' }) }),
+            ]));
+            const v2ManifestPath = path_1.default.join(v2.project, '.awm', 'sensors.json');
+            const projectTimeoutManifest = JSON.parse(fs_1.default.readFileSync(v2ManifestPath, 'utf8'));
+            projectTimeoutManifest.sensors.lint.timeout = 30_000;
+            writeJson(v2ManifestPath, projectTimeoutManifest);
+            const projectTimeout = runJson(records, 'v2-project-timeout-fast', cliRoot, v2, 'sensors', 'run', '--fast');
+            assertExitMatchesVerdict(projectTimeout.result, projectTimeout.output);
+            expect(projectTimeout.output.sensors).toEqual(expect.arrayContaining([
+                expect.objectContaining({ execution: expect.objectContaining({ timeoutMs: 30_000, timeoutSource: 'project' }) }),
+            ]));
+            delete projectTimeoutManifest.sensors.lint.timeout;
+            writeJson(v2ManifestPath, projectTimeoutManifest);
+            // A v2 manifest can deliberately disable an otherwise applicable
+            // sensor. Exercise the published skip verdict before any failing
+            // fixture source is introduced, so this is a real all-skipped run
+            // rather than a filtered pass or a baseline side effect.
+            const disabledManifest = JSON.parse(fs_1.default.readFileSync(v2ManifestPath, 'utf8'));
+            const fastSensor = Object.entries(disabledManifest.sensors).find(([, sensor]) => sensor.fast === true);
+            expect(fastSensor).toBeDefined();
+            if (!fastSensor)
+                throw new Error('published v2 js-ts pack has no fast sensor to disable');
+            disabledManifest.sensors[fastSensor[0]].enabled = false;
+            writeJson(v2ManifestPath, disabledManifest);
+            const skipped = runJson(records, 'v2-disabled-fast', cliRoot, v2, 'sensors', 'run', '--fast');
+            assertExitMatchesVerdict(skipped.result, skipped.output);
+            expect(skipped.output.overall).toBe('skipped');
+            disabledManifest.sensors[fastSensor[0]].enabled = true;
+            writeJson(v2ManifestPath, disabledManifest);
+            const invalidTimeoutManifest = JSON.parse(fs_1.default.readFileSync(v2ManifestPath, 'utf8'));
+            invalidTimeoutManifest.sensors.lint.timeout = 0;
+            writeJson(v2ManifestPath, invalidTimeoutManifest);
+            const invalidTimeout = runCli(cliRoot, v2, 'sensors', 'run', '--fast');
+            expect(invalidTimeout.status).toBe(1);
+            // Release 8.1.6 does not surface the parser rejection required by
+            // the target contract. Record its actual fallback rather than
+            // inventing a pre-spawn guarantee the artifact does not provide.
+            const invalidTimeoutOutput = parseJson(invalidTimeout, 'v2 invalid timeout');
+            record(records, 'v2-invalid-timeout-fast', ['sensors', 'run', '--fast'], invalidTimeout, invalidTimeoutOutput);
+            expect(invalidTimeoutOutput.overall).toBe('not_certified');
+            delete invalidTimeoutManifest.sensors.lint.timeout;
+            writeJson(v2ManifestPath, invalidTimeoutManifest);
+            fs_1.default.writeFileSync(path_1.default.join(v2.project, 'failure.js'), 'missingPublishedSensorGateValue;\n');
+            const failing = runJson(records, 'v2-failing-fast', cliRoot, v2, 'sensors', 'run', '--fast');
+            assertExitMatchesVerdict(failing.result, failing.output);
+            expect(failing.output.overall).toBe('fail');
+            const baseline = runCli(cliRoot, v2, 'sensors', 'baseline');
+            record(records, 'v2-baseline', ['sensors', 'baseline'], baseline);
+            assertProcess(baseline, 'v2 baseline');
+            const baselined = runJson(records, 'v2-baselined-fast', cliRoot, v2, 'sensors', 'run', '--fast');
+            assertExitMatchesVerdict(baselined.result, baselined.output);
+            expect(baselined.output.overall).toBe('pass');
+            assertProcess(command(v2.project, 'git', ['init']), 'git init changed fixture');
+            assertProcess(command(v2.project, 'git', ['config', 'user.email', 'acceptance@example.invalid']), 'git user email');
+            assertProcess(command(v2.project, 'git', ['config', 'user.name', 'Published acceptance']), 'git user name');
+            assertProcess(command(v2.project, 'git', ['add', '.']), 'git add changed fixture');
+            assertProcess(command(v2.project, 'git', ['commit', '-m', 'baseline']), 'git commit changed fixture');
+            fs_1.default.writeFileSync(path_1.default.join(v2.project, 'clean.js'), 'const changed = 1;\nconsole.log(changed);\n');
+            const changed = runJson(records, 'v2-changed-fast', cliRoot, v2, 'sensors', 'run', '--fast', '--changed');
+            assertExitMatchesVerdict(changed.result, changed.output);
+            expect(changed.output).toMatchObject({ overall: 'pass', changedScope: { files: 1 } });
+            const legacy = createFixture(root, registryRoot, 'legacy');
+            fs_1.default.mkdirSync(path_1.default.join(legacy.project, '.awm'), { recursive: true });
+            writeJson(path_1.default.join(legacy.project, '.awm', 'sensors.json'), { pack: 'js-ts', sensors: { lint: { fast: true, cmd: 'npx eslint . --format json' } } });
+            const legacyRun = runJson(records, 'legacy-fast', cliRoot, legacy, 'sensors', 'run', '--fast');
+            assertExitMatchesVerdict(legacyRun.result, legacyRun.output);
+            expect(legacyRun.output.sensors).toEqual(expect.arrayContaining([
+                expect.objectContaining({ status: 'pass', execution: expect.objectContaining({ timeoutSource: 'fallback' }) }),
+            ]));
+            expect(legacyRun.output.overall).toBe('not_certified');
+            const outcomes = new Map(records.flatMap(record => record.output?.overall ? [[String(record.output.overall), record.exit]] : []));
+            // This is an explicit observation table for the immutable release:
+            // only pass is process-success; every non-pass is process-failure.
+            expect([...outcomes.entries()].sort()).toEqual([
+                ['fail', 1], ['not_certified', 1], ['pass', 0], ['skipped', 1],
+            ]);
+            writeReport(root, cliRoot, registryRoot, records);
+        }
+        catch (error) {
+            // Do not turn a release mismatch into a synthetic success. When an
+            // artifact is available, leave the exact partial trace for review.
+            if (artifacts)
+                writeReport(root, artifacts.cliRoot, artifacts.registryRoot, records);
+            throw error;
+        }
+        finally {
+            if (!reportFile)
+                fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/structural/published-sensor-gate-acceptance.test.js

@@ -0,0 +1,35 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const acceptancePath = path_1.default.resolve(__dirname, '../../../docs/research/sensor-gate-honesty/published-acceptance.json');
+const reportPath = path_1.default.resolve(__dirname, '../../../docs/research/sensor-gate-honesty/published-sensor-gate-matrix.json');
+describe('published sensor gate acceptance artifact', () => {
+    it('contains only complete, portable publication identities and evidence references', () => {
+        const artifact = JSON.parse(fs_1.default.readFileSync(acceptancePath, 'utf8'));
+        const report = JSON.parse(fs_1.default.readFileSync(reportPath, 'utf8'));
+        expect(artifact.schemaVersion).toBe(1);
+        expect(artifact.issues).toEqual([95, 96, 97, 98]);
+        expect(artifact.verdict).toBe('partial');
+        expect(artifact.cli.version).toMatch(/^\d+\.\d+\.\d+$/);
+        expect(artifact.cli.packageHash).toMatch(/^[0-9a-f]{64}$/);
+        expect(artifact.registry.tag).toMatch(/^v\d+\.\d+\.\d+$/);
+        expect(artifact.registry.commit).toMatch(/^[0-9a-f]{40}$/);
+        expect(artifact.registry.packHash).toMatch(/^[0-9a-f]{64}$/);
+        expect(artifact.matrix.report).toBe('published-sensor-gate-matrix.json');
+        expect(artifact.matrix.commandCount).toBe(12);
+        expect(report.commands).toHaveLength(artifact.matrix.commandCount);
+        expect(report.cli.version).toBe(artifact.cli.version);
+        expect(report.registry).toMatchObject(artifact.registry);
+        expect(JSON.stringify(report)).not.toMatch(/\/(tmp|srv)\//);
+        expect(Object.keys(artifact.platforms).sort()).toEqual(['linux', 'macos', 'windows']);
+        for (const platform of Object.values(artifact.platforms)) {
+            expect(platform.status).toBe('pass');
+            expect(platform.evidence).toMatch(/^https:\/\//);
+        }
+        expect(fs_1.default.readFileSync(acceptancePath, 'utf8').endsWith('\n')).toBe(true);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "8.1.5",
+  "version": "8.2.0",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"