agentic-workflow-manager 8.1.6 → 8.2.1

package/dist/src/commands/sensors/compatibility/live.js

@@ -85,6 +85,7 @@ async function resolveParsedPackCompatibility(cwd, pack, options = {}) {
                 environment: variant.command.environment,
                 configFiles: evidence.configFiles,
                 scripts: evidence.scripts,
+                variantArgs: variant.command.args,
             })
             : null;
         sensors[name] = (0, resolve_1.resolveProjectCompatibility)({ ...executionPack, sensors: { [name]: sensor } }, { ...resolutionEvidence, probe: probe ?? undefined }).sensors[name];

package/dist/src/commands/sensors/compatibility/manifest.js

@@ -184,7 +184,7 @@ function provenanceRoot(value, source) {
     return parsed;
 }
 function parseV2Manifest(value, source) {
-    fields(value, ['schemaVersion', 'pack', 'packSelection', 'registryRoot', 'sensors', 'concurrency'], source, 'root');
+    fields(value, ['schemaVersion', 'pack', 'packSelection', 'registryRoot', 'packageRoot', 'sensors', 'concurrency'], source, 'root');
     if (value.schemaVersion !== 2)
         invalid(source, `unsupported manifest schemaVersion ${String(value.schemaVersion)}; supported: legacy, 2; upgrade or migrate the manifest`);
     const pack = id(value.pack, source, 'pack');
@@ -200,6 +200,8 @@ function parseV2Manifest(value, source) {
     }
     if ('registryRoot' in value)
         manifest.registryRoot = provenanceRoot(value.registryRoot, source);
+    if ('packageRoot' in value)
+        manifest.packageRoot = asset(value.packageRoot, source, 'packageRoot');
     if ('concurrency' in value) {
         if (typeof value.concurrency !== 'number' || !Number.isSafeInteger(value.concurrency) || value.concurrency <= 0)
             invalid(source, 'concurrency must be a positive safe integer');

package/dist/src/commands/sensors/compatibility/materialize.js

@@ -82,7 +82,11 @@ function materializeResolvedSensors(input) {
             throw new Error('materialized sensor must be v2');
         sensors[name] = parsed.pack.sensors[name];
     }
-    const manifest = { schemaVersion: 2, pack, sensors, ...(input.packSelection === 'explicit' ? { packSelection: 'explicit' } : {}), ...(input.registryRoot ? { registryRoot: input.registryRoot } : {}) };
+    const manifest = { schemaVersion: 2, pack, sensors, ...(input.packSelection === 'explicit' ? { packSelection: 'explicit' } : {}), ...(input.registryRoot ? { registryRoot: input.registryRoot } : {}), ...(input.packageRoot ? { packageRoot: containedAsset(input.packageRoot, 'packageRoot') } : {}) };
+    // Assets land where sensors will actually run — projectRoot by default, or
+    // packageRoot underneath it for a monorepo. The manifest write below stays
+    // pinned to projectRoot either way (see atomicWrite call at the end).
+    const configRoot = manifest.packageRoot ? root(path_1.default.join(projectRoot, manifest.packageRoot), 'packageRoot') : projectRoot;
     // A policy reference is deliberately not a materialized asset. Resolve it here
     // from the registry-owned sibling only, so a manifest cannot turn arbitrary
     // registry content into a project write through a cosmetic policy field.
@@ -99,7 +103,7 @@ function materializeResolvedSensors(input) {
         if (input.configure !== false) {
             for (const asset of selected) {
                 const source = path_1.default.join(packRoot, ...asset.split('/'));
-                const destination = path_1.default.join(projectRoot, ...asset.split('/'));
+                const destination = path_1.default.join(configRoot, ...asset.split('/'));
                 let stat;
                 try {
                     stat = fs_1.default.lstatSync(source);

package/dist/src/commands/sensors/compatibility/probe.js

@@ -24,11 +24,23 @@ function commandFor(kind, evidence) {
     };
     if (kind === 'version')
         return { ...command, args: ['--version'] };
+    // A pack asset is never named the tool's default config filename (e.g.
+    // `eslint.config.awm.mjs`, not `eslint.config.js`), so the real command always
+    // pins it via an explicit `--config <file>`. Mirroring that same pair here — rather
+    // than probing with a bare invocation — is what lets the probe find the config the
+    // real run will actually use, for whatever name or tool version is in play.
     if (kind === 'eslint-print-config')
-        return { ...command, args: ['--print-config', evidence.configFiles?.[0] ?? 'package.json'] };
+        return { ...command, args: [...configFlag(evidence.variantArgs), '--print-config', evidence.configFiles?.[0] ?? 'package.json'] };
     if (kind === 'typescript-show-config')
-        return { ...command, args: ['--showConfig'] };
-    return { ...command, args: ['--validate'] };
+        return { ...command, args: [...configFlag(evidence.variantArgs), '--showConfig'] };
+    return { ...command, args: [...configFlag(evidence.variantArgs), '--validate'] };
+}
+/** The `--config <file>` pair from a variant's real command args, if it declares one. */
+function configFlag(variantArgs) {
+    if (!variantArgs)
+        return [];
+    const i = variantArgs.indexOf('--config');
+    return i !== -1 && variantArgs[i + 1] !== undefined ? ['--config', variantArgs[i + 1]] : [];
 }
 /** Executes only the closed probe enum. Raw output is intentionally discarded. */
 async function runCompatibilityProbe(probe, evidence, executor = exec_1.runStructuredCommand) {

package/dist/src/commands/sensors/index.js

@@ -67,10 +67,11 @@ function registerSensorsCommand(program) {
         .option('--no-configure', 'skip copying sensor pack config files into the project')
         .option('--registry-root <path>', 'path to AWM registry root')
         .option('--pack <name>', 'skip auto-detection, use this pack explicitly')
+        .option('--package-root <dir>', 'run detection/execution from this subdirectory (monorepo support) — the manifest still writes at the current directory')
         .action(async (opts) => {
         const registryRoot = opts.registryRoot ?? (0, registries_1.capabilityRoot)('sensor-packs') ?? undefined;
         try {
-            const result = await (0, init_1.initSensors)({ configure: opts.configure, registryRoot, pack: opts.pack });
+            const result = await (0, init_1.initSensors)({ configure: opts.configure, registryRoot, pack: opts.pack, packageRoot: opts.packageRoot });
             prompts_1.log.success(`Detected: ${result.detection.pack} (${result.detection.indicators.join(', ') || 'fallback'})`);
             // Said BEFORE "Wrote .awm/sensors.json": the manifest about to be
             // reported as written is not the one the detection implied.

package/dist/src/commands/sensors/init.js

@@ -213,6 +213,10 @@ async function initSensors(opts = {}) {
     const cwd = opts.cwd ?? process.cwd();
     const configure = opts.configure ?? true; // configure (copy pack config files) by default
     const manifestPath = path_1.default.join(cwd, '.awm', 'sensors.json');
+    // Monorepo support: detection and evidence both need to see the real project,
+    // not the (possibly unrelated) directory the manifest lives in. The manifest
+    // write itself stays pinned to cwd regardless — see manifestPath above.
+    const detectionCwd = opts.packageRoot ? path_1.default.resolve(cwd, opts.packageRoot) : cwd;
     // --pack skips the heuristic entirely. Only validate against the registry when a
     // registryRoot was actually given — same tolerance pattern as readPackDefaults /
     // buildManifest elsewhere in this file for a missing registry: nothing to validate
@@ -224,7 +228,7 @@ async function initSensors(opts = {}) {
         detection = { pack: opts.pack, indicators: ['--pack override'] };
     }
     else {
-        detection = detectStack(cwd);
+        detection = detectStack(detectionCwd);
     }
     let existing;
     let existingV2;
@@ -254,7 +258,7 @@ async function initSensors(opts = {}) {
         const resolvedV2 = readV2Pack(resolvedPack, opts.registryRoot);
         if (resolvedV2) {
             const packSelection = opts.pack ? 'explicit' : undefined;
-            const live = await (0, live_1.resolveParsedPackCompatibility)(cwd, resolvedV2.pack, { packSelection });
+            const live = await (0, live_1.resolveParsedPackCompatibility)(detectionCwd, resolvedV2.pack, { packSelection });
             const compatibility = live.sensors;
             const sensors = {};
             for (const [name, sensor] of Object.entries(live.pack.sensors)) {
@@ -285,7 +289,8 @@ async function initSensors(opts = {}) {
             }
             const materialized = (0, materialize_1.materializeResolvedSensors)({
                 projectRoot: cwd, packRoot: resolvedV2.packRoot,
-                pack: resolvedPack, ...(packSelection ? { packSelection } : {}), registryRoot: opts.registryRoot, sensors, configure,
+                pack: resolvedPack, ...(packSelection ? { packSelection } : {}), registryRoot: opts.registryRoot,
+                ...(opts.packageRoot ? { packageRoot: opts.packageRoot } : {}), sensors, configure,
             });
             return { detection, ...materialized,
                 compatibility, ...(unavailablePack ? { unavailablePack } : {}) };

package/dist/src/commands/sensors/run.js

@@ -154,7 +154,15 @@ async function runSensors(opts = {}) {
         if (scopeError)
             changed.error = scopeError;
     }
-    const live = parsed.kind === 'v2' ? await resolveLiveV2(manifestDir, parsed) : null;
+    // Monorepo support: a v2 manifest may declare packageRoot so detection and
+    // execution both happen against the real package (e.g. "cli"), while the
+    // manifest itself stays discoverable at the repo root via findManifestDir.
+    // Legacy manifests never carry this field — manifestDir is always correct
+    // for them, unchanged.
+    const projectCwd = parsed.kind === 'v2' && parsed.pack.packageRoot
+        ? path_1.default.resolve(manifestDir, parsed.pack.packageRoot)
+        : manifestDir;
+    const live = parsed.kind === 'v2' ? await resolveLiveV2(projectCwd, parsed) : null;
     const drift = parsed.kind === 'legacy' ? detectPackDrift(manifestDir, parsed.pack) : undefined;
     const requestedScope = opts.changed ? 'changed' : 'full';
     const prepared = [];
@@ -173,7 +181,7 @@ async function runSensors(opts = {}) {
             : execution);
     }
     const results = await pooled(prepared.map(entry => async () => {
-        const result = await (0, result_1.executePrepared)(entry, manifestDir);
+        const result = await (0, result_1.executePrepared)(entry, projectCwd);
         return baseline ? (0, result_1.applyBaseline)(result, baseline[entry.name]) : result;
     }), resolveConcurrency(parsed.pack, prepared.length));
     let overall = (0, verdict_1.reduceVerdict)(results);

package/dist/src/commands/sensors/status.js

@@ -145,10 +145,14 @@ async function computeSensorStatus(cwd = process.cwd()) {
         const raw = JSON.parse(fs_1.default.readFileSync(manifestPath, 'utf-8'));
         const parsed = (0, manifest_1.parseSensorManifest)(raw, manifestPath);
         if (parsed.kind === 'v2') {
+            // Monorepo support (mirrors run.ts/init.ts): detection and structured-command
+            // asset resolution both need to see the real package, not the (possibly
+            // unrelated) directory the manifest lives in.
+            const projectCwd = parsed.pack.packageRoot ? path_1.default.resolve(cwd, parsed.pack.packageRoot) : cwd;
             const checks = {};
             let compatibility;
             try {
-                compatibility = resolveStaticV2Compatibility(cwd, parsed.pack);
+                compatibility = resolveStaticV2Compatibility(projectCwd, parsed.pack);
             }
             catch (error) {
                 const detail = error instanceof Error ? error.message : 'live compatibility unavailable';
@@ -163,7 +167,7 @@ async function computeSensorStatus(cwd = process.cwd()) {
                     continue;
                 }
                 checks[name] = staticCompatibilityCheck(sensor, compatibility[name])
-                    ?? checkStructuredCommand(sensor.command, cwd, sensor.assets);
+                    ?? checkStructuredCommand(sensor.command, projectCwd, sensor.assets);
             }
             return { overall: Object.keys(checks).length > 0 && Object.values(checks).every(check => check.ok) ? 'READY' : 'DEGRADED', pack: parsed.pack.pack, checks };
         }

package/dist/tests/commands/sensors/compatibility/manifest.test.js

@@ -82,6 +82,18 @@ describe('sensor manifest contract', () => {
         const sensor = { enabled: true, variantId: 'eslint-9', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, initializedCompatibility: { state: 'certified', reason: 'ok', variantId: 'eslint-9', toolVersion: '10.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] } };
         expect(() => (0, manifest_1.parseSensorManifest)({ schemaVersion: 2, pack: 'js-ts', sensors: { lint: sensor } }, 'source')).toThrow('certifiedRange');
     });
+    it('accepts a v2 packageRoot for monorepo-scoped sensor detection/execution', () => {
+        const manifest = { ...validV2Manifest(), packageRoot: 'cli' };
+        expect((0, manifest_1.parseSensorManifest)(manifest, 'source')).toMatchObject({ kind: 'v2', pack: { packageRoot: 'cli' } });
+    });
+    it('rejects a packageRoot that escapes the manifest directory', () => {
+        const manifest = { ...validV2Manifest(), packageRoot: '../outside' };
+        expect(() => (0, manifest_1.parseSensorManifest)(manifest, 'source')).toThrow('packageRoot');
+    });
+    it('rejects an absolute packageRoot', () => {
+        const manifest = { ...validV2Manifest(), packageRoot: '/etc' };
+        expect(() => (0, manifest_1.parseSensorManifest)(manifest, 'source')).toThrow('packageRoot');
+    });
     test.each([
         [null, 'object'],
         [{}, 'pack'],

package/dist/tests/commands/sensors/compatibility/probe.test.js

@@ -53,4 +53,31 @@ describe('runCompatibilityProbe', () => {
         await (0, probe_1.runCompatibilityProbe)({ kind: 'version' }, { ...evidence, toolExecutable, toolResolution: 'python-environment' }, fakeExecutor);
         expect(fakeExecutor).toHaveBeenCalledWith(expect.objectContaining({ executable: toolExecutable, resolution: 'python-environment', args: ['--version'] }), expect.any(Object));
     });
+    // A pack asset is never named the tool's own default (e.g. `eslint.config.awm.mjs`,
+    // not `eslint.config.js`) so the real command always pins it via `--config`. A probe
+    // that omits the same flag never finds a config to load and always reports
+    // not-matched — a false negative on every AWM-configured project. The probe must
+    // mirror the variant's own `--config` argument, not guess a bare invocation.
+    it('carries the variant\'s --config argument into an eslint-print-config probe', async () => {
+        await (0, probe_1.runCompatibilityProbe)({ kind: 'eslint-print-config' }, {
+            ...evidence, variantArgs: ['.', '--config', 'eslint.config.awm.mjs', '--cache', '--format', 'json'],
+        }, fakeExecutor);
+        expect(fakeExecutor).toHaveBeenCalledWith(expect.objectContaining({ args: ['--config', 'eslint.config.awm.mjs', '--print-config', 'eslint.config.js'] }), expect.any(Object));
+    });
+    it('carries the variant\'s --config argument into a typescript-show-config probe', async () => {
+        await (0, probe_1.runCompatibilityProbe)({ kind: 'typescript-show-config' }, {
+            ...evidence, variantArgs: ['--config', 'tsconfig.awm.json', '--noEmit'],
+        }, fakeExecutor);
+        expect(fakeExecutor).toHaveBeenCalledWith(expect.objectContaining({ args: ['--config', 'tsconfig.awm.json', '--showConfig'] }), expect.any(Object));
+    });
+    it('carries the variant\'s --config argument into a semgrep-validate probe', async () => {
+        await (0, probe_1.runCompatibilityProbe)({ kind: 'semgrep-validate' }, {
+            ...evidence, variantArgs: ['--config', '.semgrep.awm.yml', '--json', '.'],
+        }, fakeExecutor);
+        expect(fakeExecutor).toHaveBeenCalledWith(expect.objectContaining({ args: ['--config', '.semgrep.awm.yml', '--validate'] }), expect.any(Object));
+    });
+    it('omits --config from the probe when the variant command declares none', async () => {
+        await (0, probe_1.runCompatibilityProbe)({ kind: 'eslint-print-config' }, { ...evidence, variantArgs: ['.', '--cache'] }, fakeExecutor);
+        expect(fakeExecutor).toHaveBeenCalledWith(expect.objectContaining({ args: ['--print-config', 'eslint.config.js'] }), expect.any(Object));
+    });
 });

package/dist/tests/commands/sensors/init.test.js

@@ -434,6 +434,59 @@ describe('initSensors', () => {
         }
     });
 });
+describe('initSensors — packageRoot (monorepo)', () => {
+    let tmpDir;
+    beforeEach(() => {
+        tmpDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-init-monorepo-'));
+    });
+    afterEach(() => {
+        fs_1.default.rmSync(tmpDir, { recursive: true, force: true });
+    });
+    it('detects the real package under packageRoot, not the manifest directory', async () => {
+        const v2Registry = makeV2Registry();
+        try {
+            // The manifest will live at tmpDir/.awm/sensors.json (repo root), but the
+            // real package — package.json, node_modules — lives under tmpDir/cli.
+            const packageDir = path_1.default.join(tmpDir, 'cli');
+            fs_1.default.mkdirSync(packageDir, { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(packageDir, 'package.json'), JSON.stringify({ devDependencies: { eslint: '^10.0.0' } }));
+            fs_1.default.mkdirSync(path_1.default.join(packageDir, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(packageDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.0.0' }));
+            const result = await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry, packageRoot: 'cli' });
+            // Real detection succeeded — a manifest built against tmpDir root (with no
+            // package.json there) would leave lint unresolved/absent.
+            expect(result.manifest).toMatchObject({ packageRoot: 'cli', sensors: { lint: { variantId: 'eslint-10' } } });
+            // The manifest itself stays discoverable at the repo root (findManifestDir
+            // walks up from cwd, never down into subdirectories).
+            expect(fs_1.default.existsSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'))).toBe(true);
+            expect(fs_1.default.existsSync(path_1.default.join(packageDir, '.awm', 'sensors.json'))).toBe(false);
+            const written = JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), 'utf8'));
+            expect(written.packageRoot).toBe('cli');
+        }
+        finally {
+            fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
+        }
+    });
+    it('copies configured assets into packageRoot, not the manifest directory', async () => {
+        const v2Registry = makeV2Registry();
+        try {
+            const packageDir = path_1.default.join(tmpDir, 'cli');
+            fs_1.default.mkdirSync(packageDir, { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(packageDir, 'package.json'), JSON.stringify({ devDependencies: { eslint: '^10.0.0' } }));
+            fs_1.default.mkdirSync(path_1.default.join(packageDir, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(packageDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.0.0' }));
+            await (0, init_1.initSensors)({ cwd: tmpDir, registryRoot: v2Registry, packageRoot: 'cli' });
+            // The asset must land where the lint sensor will actually execute (cwd=cli),
+            // not at the manifest's own directory (repo root) — otherwise a config-relative
+            // tool invocation can never find it.
+            expect(fs_1.default.existsSync(path_1.default.join(packageDir, 'eslint.config.awm.mjs'))).toBe(true);
+            expect(fs_1.default.existsSync(path_1.default.join(tmpDir, 'eslint.config.awm.mjs'))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(v2Registry, { recursive: true, force: true });
+        }
+    });
+});
 describe('initSensors — --pack override', () => {
     let tmpDir;
     let registryRoot;

package/dist/tests/commands/sensors/run.test.js

@@ -282,6 +282,33 @@ describe('runSensors v2 lifecycle contract', () => {
         expect(result).toEqual(expect.objectContaining({ overall: 'pass' }));
         expect(mockRunStructuredCommand).toHaveBeenCalledWith(expect.objectContaining({ executable: 'live-eslint' }), expect.any(Object));
     });
+    it('scopes applicability detection and execution to packageRoot for a monorepo manifest', async () => {
+        // Move the fixture project into a subdirectory ("cli") and point the
+        // manifest at it via packageRoot — mirrors a monorepo where the
+        // manifest lives at the repo root but the real package lives deeper.
+        const packageDir = path_1.default.join(project, 'cli');
+        fs_1.default.mkdirSync(packageDir, { recursive: true });
+        fs_1.default.renameSync(path_1.default.join(project, 'package.json'), path_1.default.join(packageDir, 'package.json'));
+        fs_1.default.renameSync(path_1.default.join(project, 'node_modules'), path_1.default.join(packageDir, 'node_modules'));
+        const manifestPath = path_1.default.join(project, '.awm', 'sensors.json');
+        const manifest = JSON.parse(fs_1.default.readFileSync(manifestPath, 'utf8'));
+        manifest.packageRoot = 'cli';
+        fs_1.default.writeFileSync(manifestPath, JSON.stringify(manifest));
+        const { runSensors } = require('../../../src/commands/sensors/run');
+        const result = await runSensors({ cwd: project, fast: true });
+        expect(result).toEqual(expect.objectContaining({ overall: 'pass' }));
+        expect(mockRunStructuredCommand).toHaveBeenCalledWith(expect.objectContaining({ executable: 'live-eslint' }), expect.objectContaining({ cwd: packageDir }));
+    });
+    it('degrades to not_certified (never a false pass, never a crash) when packageRoot points nowhere', async () => {
+        const manifestPath = path_1.default.join(project, '.awm', 'sensors.json');
+        const manifest = JSON.parse(fs_1.default.readFileSync(manifestPath, 'utf8'));
+        manifest.packageRoot = 'does-not-exist';
+        fs_1.default.writeFileSync(manifestPath, JSON.stringify(manifest));
+        const { runSensors } = require('../../../src/commands/sensors/run');
+        const result = await runSensors({ cwd: project, fast: true });
+        expect(result.overall).toBe('not_certified');
+        expect(mockRunStructuredCommand).not.toHaveBeenCalled();
+    });
     it('honors disabled v2 sensors before dispatching them', async () => {
         const manifest = JSON.parse(fs_1.default.readFileSync(path_1.default.join(project, '.awm', 'sensors.json'), 'utf8'));
         manifest.sensors.lint.enabled = false;

package/dist/tests/commands/sensors/status.test.js

@@ -182,6 +182,64 @@ describe('computeSensorStatus', () => {
         expect(result.pack).toBe('python');
         expect(result.checks).toEqual({});
     });
+    it('resolves v2 compatibility and structured-command assets against packageRoot in a monorepo', async () => {
+        // Monorepo support (mirrors run.ts/init.ts): the manifest lives at the repo
+        // root, but package.json/node_modules/the config asset all live under the
+        // declared packageRoot subdirectory. Without threading packageRoot through,
+        // detection finds no package.json at the manifest's own directory and every
+        // sensor reads back "not-applicable" — a false compatibility drift on every
+        // check, even immediately after a correct `awm sensors init --package-root`.
+        const previousHome = process.env.AWM_HOME;
+        const home = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-status-home-'));
+        try {
+            process.env.AWM_HOME = home;
+            const registry = path_1.default.join(home, 'registries', 'baseline');
+            fs_1.default.mkdirSync(path_1.default.join(registry, 'sensor-packs', 'js-ts'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(home, 'registries.json'), JSON.stringify([{ name: 'baseline', remote: 'https://example.test/baseline.git' }]));
+            fs_1.default.writeFileSync(path_1.default.join(registry, 'sensor-packs', 'js-ts', 'pack.json'), JSON.stringify({
+                schemaVersion: 2, name: 'js-ts', description: 'test', detects: ['package.json'],
+                coverage: { schemaVersion: 1, classes: { lint: { description: 'lint', detectors: [{ sensor: 'lint' }], remedy: { summary: 'fix lint', command: 'awm sensors init --pack js-ts' } } } },
+                sensors: { lint: {
+                        applicability: { allFiles: ['package.json'] },
+                        variants: [{
+                                id: 'eslint-10', priority: 10, certifiedRange: '>=10.0.0 <11.0.0',
+                                requirements: { tool: 'eslint', toolRange: '>=10.0.0 <11.0.0', runtime: 'node', runtimeRange: '>=0.0.0' },
+                                assets: ['eslint.config.awm.mjs'], formatter: 'eslint-llm', probe: { kind: 'package-script-present' },
+                                command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.', '--config', 'eslint.config.awm.mjs'] },
+                            }],
+                    } },
+            }));
+            const packageDir = path_1.default.join(tmpDir, 'cli');
+            fs_1.default.mkdirSync(packageDir, { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(packageDir, 'package.json'), JSON.stringify({ devDependencies: { eslint: '^10.0.0' }, scripts: { lint: 'eslint .' } }));
+            fs_1.default.mkdirSync(path_1.default.join(packageDir, 'node_modules', 'eslint'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(packageDir, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version: '10.4.1' }));
+            fs_1.default.mkdirSync(path_1.default.join(packageDir, 'node_modules', '.bin'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(packageDir, 'node_modules', '.bin', 'eslint'), '');
+            fs_1.default.writeFileSync(path_1.default.join(packageDir, 'eslint.config.awm.mjs'), 'export default []');
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({
+                schemaVersion: 2, pack: 'js-ts', packageRoot: 'cli', registryRoot: registry,
+                sensors: { lint: {
+                        enabled: true, variantId: 'eslint-10', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.', '--config', 'eslint.config.awm.mjs'] },
+                        assets: ['eslint.config.awm.mjs'],
+                        initializedCompatibility: { state: 'certified', reason: 'range-and-probe', variantId: 'eslint-10', toolVersion: '10.4.1', runtimeVersion: process.versions.node, certifiedRange: '>=10.0.0 <11.0.0', evidence: [] },
+                    } },
+            }));
+            const result = await (0, status_1.computeSensorStatus)(tmpDir);
+            expect(result.checks.lint).toMatchObject({ ok: true });
+            expect(result.overall).toBe('READY');
+            expect(runCommand).not.toHaveBeenCalled();
+            expect(runStructuredCommand).not.toHaveBeenCalled();
+        }
+        finally {
+            if (previousHome === undefined)
+                delete process.env.AWM_HOME;
+            else
+                process.env.AWM_HOME = previousHome;
+            fs_1.default.rmSync(home, { recursive: true, force: true });
+        }
+    });
     it('marks disabled sensors as ok', async () => {
         fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
         fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({

package/dist/tests/integration/published-sensor-gate-matrix.e2e.test.js

@@ -0,0 +1,237 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = __importDefault(require("crypto"));
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+/**
+ * This acceptance gate is deliberately opt-in. It downloads two release
+ * artifacts and installs fixture dependencies, so normal unit/PR runs must not
+ * accidentally treat a mutable checkout as publication evidence.
+ *
+ * Run it with:
+ *   AWM_RUN_PUBLISHED_SENSOR_GATE_MATRIX=1 npm test -- published-sensor-gate-matrix
+ */
+const enabled = process.env.AWM_RUN_PUBLISHED_SENSOR_GATE_MATRIX === '1';
+const acceptance = enabled ? describe : describe.skip;
+const cliVersion = process.env.AWM_PUBLISHED_CLI_VERSION ?? '8.1.6';
+const registryTag = process.env.AWM_PUBLISHED_REGISTRY_TAG ?? 'v3.0.0';
+const registryRemote = process.env.AWM_PUBLISHED_REGISTRY_REMOTE ?? 'https://github.com/Kodria/awm-baseline-registry.git';
+// Keep the shorter name used by the release orchestrator, while accepting the
+// original explicit name for local invocation.
+const reportFile = process.env.AWM_PUBLISHED_MATRIX_REPORT ?? process.env.AWM_PUBLISHED_SENSOR_GATE_MATRIX_REPORT;
+function hash(value) {
+    return crypto_1.default.createHash('sha256').update(value).digest('hex');
+}
+function writeJson(file, value) {
+    fs_1.default.mkdirSync(path_1.default.dirname(file), { recursive: true });
+    fs_1.default.writeFileSync(file, JSON.stringify(value, null, 2));
+}
+function assertProcess(result, description) {
+    if (result.error || result.status !== 0 || result.signal !== null) {
+        throw new Error(`${description} failed: status=${String(result.status)} signal=${String(result.signal)} error=${result.error?.message ?? 'none'}\n${result.stderr}`);
+    }
+}
+function command(cwd, executable, args, env = process.env) {
+    return (0, child_process_1.spawnSync)(executable, args, { cwd, encoding: 'utf8', env, maxBuffer: 64 * 1024 * 1024 });
+}
+function installArtifacts(root) {
+    const artifacts = path_1.default.join(root, 'artifacts');
+    fs_1.default.mkdirSync(artifacts, { recursive: true });
+    writeJson(path_1.default.join(artifacts, 'package.json'), { private: true, name: 'published-sensor-gate-artifacts' });
+    assertProcess(command(artifacts, 'npm', ['install', '--ignore-scripts', '--no-audit', '--no-fund', `agentic-workflow-manager@${cliVersion}`]), `npm install agentic-workflow-manager@${cliVersion}`);
+    const registryRoot = path_1.default.join(root, 'registry');
+    assertProcess(command(root, 'git', ['clone', '--depth', '1', '--branch', registryTag, registryRemote, registryRoot]), `git clone ${registryTag}`);
+    const actualVersion = JSON.parse(fs_1.default.readFileSync(path_1.default.join(artifacts, 'node_modules', 'agentic-workflow-manager', 'package.json'), 'utf8')).version;
+    if (actualVersion !== cliVersion)
+        throw new Error(`npm resolved CLI ${String(actualVersion)} instead of immutable ${cliVersion}`);
+    const actualTag = command(registryRoot, 'git', ['describe', '--exact-match', '--tags', 'HEAD']);
+    assertProcess(actualTag, `verify registry tag ${registryTag}`);
+    if (actualTag.stdout.trim() !== registryTag)
+        throw new Error(`registry checkout resolved ${actualTag.stdout.trim()} instead of ${registryTag}`);
+    return { cliRoot: path_1.default.join(artifacts, 'node_modules', 'agentic-workflow-manager'), registryRoot };
+}
+function createFixture(root, registryRoot, name) {
+    const fixtureRoot = path_1.default.join(root, name);
+    const project = path_1.default.join(fixtureRoot, 'project');
+    const awmHome = path_1.default.join(fixtureRoot, 'awm-home');
+    fs_1.default.mkdirSync(project, { recursive: true });
+    fs_1.default.mkdirSync(path_1.default.join(awmHome, 'registries'), { recursive: true });
+    fs_1.default.cpSync(registryRoot, path_1.default.join(awmHome, 'registries', 'baseline'), { recursive: true });
+    writeJson(path_1.default.join(awmHome, 'registries.json'), [{ name: 'baseline', remote: registryRemote }]);
+    writeJson(path_1.default.join(project, 'package.json'), { name: `published-${name}`, private: true });
+    // The real v3 pack requires an ESLint 8 eslintrc project. These dependencies
+    // belong to the isolated fixture, never to the CLI under test.
+    assertProcess(command(project, 'npm', ['install', '--ignore-scripts', '--no-audit', '--no-fund', '--save-dev', 'eslint@8.57.1']), `install ESLint fixture for ${name}`);
+    fs_1.default.writeFileSync(path_1.default.join(project, '.eslintrc.js'), 'module.exports = { env: { node: true, es2022: true } };\n');
+    fs_1.default.writeFileSync(path_1.default.join(project, 'clean.js'), 'const answer = 42;\nconsole.log(answer);\n');
+    return { root: fixtureRoot, project, awmHome };
+}
+function parseJson(result, description) {
+    if (!result.stdout.trim())
+        throw new Error(`${description} emitted no JSON; stderr=${result.stderr}`);
+    return JSON.parse(result.stdout);
+}
+function runCli(cliRoot, fixture, ...args) {
+    return command(fixture.project, process.execPath, [path_1.default.join(cliRoot, 'dist', 'src', 'index.js'), ...args], {
+        ...process.env,
+        AWM_HOME: fixture.awmHome,
+        AWM_NO_UPDATE_CHECK: '1',
+    });
+}
+function record(records, name, argv, result, output) {
+    records.push({ name, argv, exit: result.status, signal: result.signal, stdoutHash: hash(result.stdout), stderrHash: hash(result.stderr), ...(output ? { output } : {}) });
+}
+function runJson(records, name, cliRoot, fixture, ...args) {
+    const result = runCli(cliRoot, fixture, ...args);
+    let output;
+    try {
+        output = parseJson(result, name);
+    }
+    catch (error) {
+        // A missing JSON envelope is itself release evidence. Persist argv,
+        // process status and hashes before surfacing the failed acceptance gate.
+        record(records, name, args, result);
+        throw error;
+    }
+    record(records, name, args, result, output);
+    return { result, output };
+}
+function assertExitMatchesVerdict(result, output) {
+    expect(result.status).toBe(output.overall === 'pass' ? 0 : 1);
+}
+function writeReport(root, cliRoot, registryRoot, records) {
+    const target = reportFile ? path_1.default.resolve(reportFile) : path_1.default.join(root, 'published-sensor-gate-matrix.json');
+    writeJson(target, {
+        schemaVersion: 1,
+        generatedAt: new Date().toISOString(),
+        cli: { version: cliVersion, packageHash: hash(fs_1.default.readFileSync(path_1.default.join(cliRoot, 'package.json'), 'utf8')) },
+        registry: {
+            tag: registryTag,
+            commit: command(registryRoot, 'git', ['rev-parse', 'HEAD']).stdout.trim(),
+            packHash: hash(fs_1.default.readFileSync(path_1.default.join(registryRoot, 'sensor-packs', 'js-ts', 'pack.json'), 'utf8')),
+        },
+        commands: records,
+    });
+    process.stdout.write(`published sensor gate matrix: ${target}\n`);
+}
+acceptance('published sensor gate matrix', () => {
+    jest.setTimeout(10 * 60_000);
+    test('records real legacy, v2, changed, baseline, status and preflight evidence from immutable releases', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-published-sensor-gates-'));
+        const records = [];
+        let artifacts;
+        try {
+            artifacts = installArtifacts(root);
+            const { cliRoot, registryRoot } = artifacts;
+            expect(fs_1.default.existsSync(path_1.default.join(cliRoot, 'dist', 'src', 'index.js'))).toBe(true);
+            expect(fs_1.default.existsSync(path_1.default.join(registryRoot, 'sensor-packs', 'js-ts', 'pack.json'))).toBe(true);
+            const v2 = createFixture(root, registryRoot, 'v2');
+            const initialized = runCli(cliRoot, v2, 'sensors', 'init', '--registry-root', registryRoot, '--pack', 'js-ts');
+            record(records, 'v2-init', ['sensors', 'init', '--registry-root', '<registry-root>', '--pack', 'js-ts'], initialized);
+            assertProcess(initialized, 'v2 init');
+            const status = runCli(cliRoot, v2, 'sensors', 'status');
+            record(records, 'v2-status', ['sensors', 'status'], status);
+            expect(status.status).toBe(0);
+            const preflight = runJson(records, 'v2-preflight', cliRoot, v2, 'preflight', '--verify-sensors', '--json');
+            expect(['ready', 'degraded', 'not_configured']).toContain(preflight.output.status);
+            expect(preflight.output.status).toBe('degraded');
+            expect(preflight.result.status).toBe(1);
+            const clean = runJson(records, 'v2-clean-fast', cliRoot, v2, 'sensors', 'run', '--fast');
+            assertExitMatchesVerdict(clean.result, clean.output);
+            expect(clean.output.sensors).toEqual(expect.arrayContaining([
+                expect.objectContaining({ execution: expect.objectContaining({ timeoutSource: 'pack' }) }),
+            ]));
+            const v2ManifestPath = path_1.default.join(v2.project, '.awm', 'sensors.json');
+            const projectTimeoutManifest = JSON.parse(fs_1.default.readFileSync(v2ManifestPath, 'utf8'));
+            projectTimeoutManifest.sensors.lint.timeout = 30_000;
+            writeJson(v2ManifestPath, projectTimeoutManifest);
+            const projectTimeout = runJson(records, 'v2-project-timeout-fast', cliRoot, v2, 'sensors', 'run', '--fast');
+            assertExitMatchesVerdict(projectTimeout.result, projectTimeout.output);
+            expect(projectTimeout.output.sensors).toEqual(expect.arrayContaining([
+                expect.objectContaining({ execution: expect.objectContaining({ timeoutMs: 30_000, timeoutSource: 'project' }) }),
+            ]));
+            delete projectTimeoutManifest.sensors.lint.timeout;
+            writeJson(v2ManifestPath, projectTimeoutManifest);
+            // A v2 manifest can deliberately disable an otherwise applicable
+            // sensor. Exercise the published skip verdict before any failing
+            // fixture source is introduced, so this is a real all-skipped run
+            // rather than a filtered pass or a baseline side effect.
+            const disabledManifest = JSON.parse(fs_1.default.readFileSync(v2ManifestPath, 'utf8'));
+            const fastSensor = Object.entries(disabledManifest.sensors).find(([, sensor]) => sensor.fast === true);
+            expect(fastSensor).toBeDefined();
+            if (!fastSensor)
+                throw new Error('published v2 js-ts pack has no fast sensor to disable');
+            disabledManifest.sensors[fastSensor[0]].enabled = false;
+            writeJson(v2ManifestPath, disabledManifest);
+            const skipped = runJson(records, 'v2-disabled-fast', cliRoot, v2, 'sensors', 'run', '--fast');
+            assertExitMatchesVerdict(skipped.result, skipped.output);
+            expect(skipped.output.overall).toBe('skipped');
+            disabledManifest.sensors[fastSensor[0]].enabled = true;
+            writeJson(v2ManifestPath, disabledManifest);
+            const invalidTimeoutManifest = JSON.parse(fs_1.default.readFileSync(v2ManifestPath, 'utf8'));
+            invalidTimeoutManifest.sensors.lint.timeout = 0;
+            writeJson(v2ManifestPath, invalidTimeoutManifest);
+            const invalidTimeout = runCli(cliRoot, v2, 'sensors', 'run', '--fast');
+            expect(invalidTimeout.status).toBe(1);
+            // Release 8.1.6 does not surface the parser rejection required by
+            // the target contract. Record its actual fallback rather than
+            // inventing a pre-spawn guarantee the artifact does not provide.
+            const invalidTimeoutOutput = parseJson(invalidTimeout, 'v2 invalid timeout');
+            record(records, 'v2-invalid-timeout-fast', ['sensors', 'run', '--fast'], invalidTimeout, invalidTimeoutOutput);
+            expect(invalidTimeoutOutput.overall).toBe('not_certified');
+            delete invalidTimeoutManifest.sensors.lint.timeout;
+            writeJson(v2ManifestPath, invalidTimeoutManifest);
+            fs_1.default.writeFileSync(path_1.default.join(v2.project, 'failure.js'), 'missingPublishedSensorGateValue;\n');
+            const failing = runJson(records, 'v2-failing-fast', cliRoot, v2, 'sensors', 'run', '--fast');
+            assertExitMatchesVerdict(failing.result, failing.output);
+            expect(failing.output.overall).toBe('fail');
+            const baseline = runCli(cliRoot, v2, 'sensors', 'baseline');
+            record(records, 'v2-baseline', ['sensors', 'baseline'], baseline);
+            assertProcess(baseline, 'v2 baseline');
+            const baselined = runJson(records, 'v2-baselined-fast', cliRoot, v2, 'sensors', 'run', '--fast');
+            assertExitMatchesVerdict(baselined.result, baselined.output);
+            expect(baselined.output.overall).toBe('pass');
+            assertProcess(command(v2.project, 'git', ['init']), 'git init changed fixture');
+            assertProcess(command(v2.project, 'git', ['config', 'user.email', 'acceptance@example.invalid']), 'git user email');
+            assertProcess(command(v2.project, 'git', ['config', 'user.name', 'Published acceptance']), 'git user name');
+            assertProcess(command(v2.project, 'git', ['add', '.']), 'git add changed fixture');
+            assertProcess(command(v2.project, 'git', ['commit', '-m', 'baseline']), 'git commit changed fixture');
+            fs_1.default.writeFileSync(path_1.default.join(v2.project, 'clean.js'), 'const changed = 1;\nconsole.log(changed);\n');
+            const changed = runJson(records, 'v2-changed-fast', cliRoot, v2, 'sensors', 'run', '--fast', '--changed');
+            assertExitMatchesVerdict(changed.result, changed.output);
+            expect(changed.output).toMatchObject({ overall: 'pass', changedScope: { files: 1 } });
+            const legacy = createFixture(root, registryRoot, 'legacy');
+            fs_1.default.mkdirSync(path_1.default.join(legacy.project, '.awm'), { recursive: true });
+            writeJson(path_1.default.join(legacy.project, '.awm', 'sensors.json'), { pack: 'js-ts', sensors: { lint: { fast: true, cmd: 'npx eslint . --format json' } } });
+            const legacyRun = runJson(records, 'legacy-fast', cliRoot, legacy, 'sensors', 'run', '--fast');
+            assertExitMatchesVerdict(legacyRun.result, legacyRun.output);
+            expect(legacyRun.output.sensors).toEqual(expect.arrayContaining([
+                expect.objectContaining({ status: 'pass', execution: expect.objectContaining({ timeoutSource: 'fallback' }) }),
+            ]));
+            expect(legacyRun.output.overall).toBe('not_certified');
+            const outcomes = new Map(records.flatMap(record => record.output?.overall ? [[String(record.output.overall), record.exit]] : []));
+            // This is an explicit observation table for the immutable release:
+            // only pass is process-success; every non-pass is process-failure.
+            expect([...outcomes.entries()].sort()).toEqual([
+                ['fail', 1], ['not_certified', 1], ['pass', 0], ['skipped', 1],
+            ]);
+            writeReport(root, cliRoot, registryRoot, records);
+        }
+        catch (error) {
+            // Do not turn a release mismatch into a synthetic success. When an
+            // artifact is available, leave the exact partial trace for review.
+            if (artifacts)
+                writeReport(root, artifacts.cliRoot, artifacts.registryRoot, records);
+            throw error;
+        }
+        finally {
+            if (!reportFile)
+                fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/structural/published-sensor-gate-acceptance.test.js

@@ -0,0 +1,35 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const acceptancePath = path_1.default.resolve(__dirname, '../../../docs/research/sensor-gate-honesty/published-acceptance.json');
+const reportPath = path_1.default.resolve(__dirname, '../../../docs/research/sensor-gate-honesty/published-sensor-gate-matrix.json');
+describe('published sensor gate acceptance artifact', () => {
+    it('contains only complete, portable publication identities and evidence references', () => {
+        const artifact = JSON.parse(fs_1.default.readFileSync(acceptancePath, 'utf8'));
+        const report = JSON.parse(fs_1.default.readFileSync(reportPath, 'utf8'));
+        expect(artifact.schemaVersion).toBe(1);
+        expect(artifact.issues).toEqual([95, 96, 97, 98]);
+        expect(artifact.verdict).toBe('partial');
+        expect(artifact.cli.version).toMatch(/^\d+\.\d+\.\d+$/);
+        expect(artifact.cli.packageHash).toMatch(/^[0-9a-f]{64}$/);
+        expect(artifact.registry.tag).toMatch(/^v\d+\.\d+\.\d+$/);
+        expect(artifact.registry.commit).toMatch(/^[0-9a-f]{40}$/);
+        expect(artifact.registry.packHash).toMatch(/^[0-9a-f]{64}$/);
+        expect(artifact.matrix.report).toBe('published-sensor-gate-matrix.json');
+        expect(artifact.matrix.commandCount).toBe(12);
+        expect(report.commands).toHaveLength(artifact.matrix.commandCount);
+        expect(report.cli.version).toBe(artifact.cli.version);
+        expect(report.registry).toMatchObject(artifact.registry);
+        expect(JSON.stringify(report)).not.toMatch(/\/(tmp|srv)\//);
+        expect(Object.keys(artifact.platforms).sort()).toEqual(['linux', 'macos', 'windows']);
+        for (const platform of Object.values(artifact.platforms)) {
+            expect(platform.status).toBe('pass');
+            expect(platform.evidence).toMatch(/^https:\/\//);
+        }
+        expect(fs_1.default.readFileSync(acceptancePath, 'utf8').endsWith('\n')).toBe(true);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-workflow-manager",
-  "version": "8.1.6",
+  "version": "8.2.1",
   "main": "dist/src/index.js",
   "bin": {
     "awm": "./dist/src/index.js"
@@ -56,7 +56,7 @@
     "@types/node": "^25.3.0",
     "@types/semver": "^7.7.1",
     "dependency-cruiser": "^17.4.3",
-    "eslint": "^10.4.1",
+    "eslint": "10.8.1",
     "jest": "^30.2.0",
     "js-yaml": "4.1.0",
     "ts-jest": "^29.4.6",