agentic-workflow-manager 9.16.1 → 9.17.0

package/dist/src/commands/sensors/coverage/resolve.js

@@ -97,6 +97,13 @@ function resolveCoverageInputs(cwd) {
     if (manifest.kind === 'v3' && manifest.pack.mode !== 'project-sensors')
         return { kind: 'not_configured' };
     const coverageManifest = manifest;
+    // Only-project manifests have no pack coverage contract to evaluate (RF-2.9).
+    if (coverageManifest.kind === 'v3') {
+        const packId = coverageManifest.pack.pack;
+        if (typeof packId !== 'string' || packId.length === 0) {
+            return { kind: 'no_reference', projectRoot, pack: null, registry: null, manifest: coverageManifest };
+        }
+    }
     const source = coverageManifest.kind === 'v3'
         ? (() => {
             const resolution = (0, source_1.resolveSensorSource)(coverageManifest, { registries: (0, registries_1.listRegistries)() });

package/dist/src/commands/sensors/init.js

@@ -117,13 +117,15 @@ function readPackDefaults(pack, registryRoot, cwd) {
     return sensors;
 }
 function buildManifest(pack, existing, registryRoot, cwd = process.cwd()) {
-    const fromPack = registryRoot ? readPackDefaults(pack, registryRoot, cwd) : null;
+    const fromPack = typeof pack === 'string' && pack.length > 0 && registryRoot
+        ? readPackDefaults(pack, registryRoot, cwd)
+        : null;
     // No registry root, or the pack has no pack.json there → `{}` is the honest floor,
     // not a bug to paper over with CLI-hardcoded defaults. `checkManifest` (preflight)
     // and `computeSensorStatus` both surface a zero-sensor manifest as degraded, with a
     // remedy pointing at the registry — never silently inventing sensors here instead.
     const defaults = fromPack ?? {};
-    const existingSensors = existing?.sensors ?? {};
+    const existingSensors = (existing?.sensors ?? {});
     // Per-FIELD merge, not whole-sensor-object replacement: if `existingSensors.foo`
     // exists at all, a naive `{ ...defaults, ...existingSensors }` would replace
     // `defaults.foo` wholesale, permanently dropping any field that only lives in the
@@ -132,11 +134,22 @@ function buildManifest(pack, existing, registryRoot, cwd = process.cwd()) {
     // field-by-field within each sensor entry lets a user's hand-edited field (e.g. a
     // custom `cmd`) win, while still inheriting any field the existing manifest doesn't
     // specify.
+    //
+    // Exception — `source: "project"` entries are project-owned: never overlay pack
+    // defaults onto them (RF-3.1). Keep the entry byte-stable in meaning.
     const sensorNames = new Set([...Object.keys(defaults), ...Object.keys(existingSensors)]);
     const sensors = {};
     for (const name of sensorNames) {
+        const existingEntry = existingSensors[name];
+        if (existingEntry && existingEntry.source === 'project') {
+            sensors[name] = { ...existingEntry };
+            continue;
+        }
         sensors[name] = { ...defaults[name], ...existingSensors[name] };
     }
+    // Only-project write path: omit pack entirely — never invent `generic` (RF-3.2).
+    if (typeof pack !== 'string' || pack.length === 0)
+        return { sensors };
     return { pack, sensors };
 }
 async function initSensors(opts = {}) {

package/dist/src/commands/sensors/migrate.js

@@ -172,10 +172,11 @@ function planV2Migration(input) {
     if (validated.kind !== 'v3' || validated.pack.mode !== 'project-sensors') {
         throw new Error('v2 migration candidate semantic mismatch');
     }
-    const equivalence = compareV2Semantics(parsed.pack, validated.pack, source.registry.name);
+    const packBound = (0, manifest_1.asPackBoundProjectSensors)(validated.pack);
+    const equivalence = compareV2Semantics(parsed.pack, packBound, source.registry.name);
     if (!allEquivalent(equivalence))
         throw new Error('v2 migration candidate semantic mismatch');
-    return { candidate: validated.pack, equivalent: true, equivalence };
+    return { candidate: packBound, equivalent: true, equivalence };
 }
 /** Validate the old and new durable contracts, then atomically replace only the manifest. */
 function replaceV2ManifestWithV3(manifestPath, candidate, source) {
@@ -203,17 +204,18 @@ function replaceV2ManifestWithV3(manifestPath, candidate, source) {
         if (before.kind !== 'v2' || after.kind !== 'v3' || after.pack.mode !== 'project-sensors') {
             throw new Error('v2 migration candidate semantic mismatch');
         }
+        const afterPack = (0, manifest_1.asPackBoundProjectSensors)(after.pack);
         const logicalSource = exactLogicalSource(source, before.pack.pack);
         assertSourceCompatibleWithManifest(logicalSource, before.pack);
-        if (after.pack.source.registry !== logicalSource.registry.name) {
+        if (afterPack.source.registry !== logicalSource.registry.name) {
             throw new Error('v2 migration candidate semantic mismatch');
         }
         if (hasPhysicalSensorPath(before.pack.sensors, [before.pack.registryRoot, logicalSource.registry.contentRoot])
-            || hasPhysicalSensorPath(after.pack.sensors, [before.pack.registryRoot, logicalSource.registry.contentRoot])
-            || hasPhysicalSensorPath(before.pack.packageRoot, []) || hasPhysicalSensorPath(after.pack.packageRoot, [])) {
+            || hasPhysicalSensorPath(afterPack.sensors, [before.pack.registryRoot, logicalSource.registry.contentRoot])
+            || hasPhysicalSensorPath(before.pack.packageRoot, []) || hasPhysicalSensorPath(afterPack.packageRoot, [])) {
             throw new Error('v2 migration candidate contains a physical path');
         }
-        if (!allEquivalent(compareV2Semantics(before.pack, after.pack, logicalSource.registry.name))) {
+        if (!allEquivalent(compareV2Semantics(before.pack, afterPack, logicalSource.registry.name))) {
             throw new Error('v2 migration candidate semantic mismatch');
         }
         // The native implementation reopens every ancestor without following links,
@@ -255,10 +257,11 @@ function replaceLegacyManifestWithV3(manifestPath, candidate, source) {
         if (before.kind !== 'legacy' || after.kind !== 'v3' || after.pack.mode !== 'project-sensors') {
             throw new Error('legacy migration candidate semantic mismatch');
         }
-        const logicalSource = exactLogicalSource({ kind: 'logical', source }, after.pack.pack);
-        assertSourceCompatibleWithCandidate(logicalSource, after.pack);
-        if (after.pack.source.registry !== logicalSource.registry.name || hasPhysicalSensorPath(after.pack.sensors, [logicalSource.registry.contentRoot])
-            || hasPhysicalSensorPath(after.pack.packageRoot, [])) {
+        const afterPack = (0, manifest_1.asPackBoundProjectSensors)(after.pack);
+        const logicalSource = exactLogicalSource({ kind: 'logical', source }, afterPack.pack);
+        assertSourceCompatibleWithCandidate(logicalSource, afterPack);
+        if (afterPack.source.registry !== logicalSource.registry.name || hasPhysicalSensorPath(afterPack.sensors, [logicalSource.registry.contentRoot])
+            || hasPhysicalSensorPath(afterPack.packageRoot, [])) {
             throw new Error('legacy migration candidate contains an unsafe source or physical path');
         }
         assertManifestUnchanged(manifestPath, inspected);

package/dist/src/commands/sensors/prepare.js

@@ -6,6 +6,7 @@ exports.prepareLegacySensor = prepareLegacySensor;
 exports.prepareV2Sensor = prepareV2Sensor;
 const changed_1 = require("./changed");
 const timeout_1 = require("./compatibility/timeout");
+const manifest_1 = require("./compatibility/manifest");
 function resolveRequestedScope(value) {
     if (value === undefined)
         return 'full';
@@ -108,13 +109,59 @@ function v2Synthetic(input, reason) {
         syntheticReason: reason,
     };
 }
+function projectApplicabilityMet(sensor, paths) {
+    const rule = sensor.applicability;
+    if (!rule)
+        return true;
+    if (rule.kind === 'explicit-or-supported-language' || rule.kind === 'explicit-opt-in') {
+        // Project sensors do not receive pack-selection signals; treat these kinds
+        // as met when no path markers were declared.
+        if (!rule.allFiles?.length && !rule.anyFiles?.length)
+            return true;
+    }
+    const present = new Set(paths ?? []);
+    return (!rule.allFiles || rule.allFiles.every(file => present.has(file)))
+        && (!rule.anyFiles || rule.anyFiles.some(file => present.has(file)));
+}
 /**
- * Prepare a v2 command from the freshly resolved pack. The manifest command is
- * deliberately never read: variantId is only a selector for live authority.
+ * Prepare a project-declared sensor from its manifest entry. No live pack variant
+ * re-resolution: the structured command on the entry is authoritative.
+ */
+function prepareProjectSensor(input) {
+    const sensor = input.sensor;
+    const requestedScope = resolveRequestedScope(input.requestedScope);
+    if (!projectApplicabilityMet(sensor, input.applicabilityPaths)) {
+        return {
+            name: input.name,
+            ...timeout(input.projectTimeout ?? sensor.timeout, input.packTimeout, sensor.fast ?? false),
+            requestedScope,
+            effectiveScope: 'full',
+            syntheticStatus: 'inconclusive',
+            syntheticReason: 'not-applicable: applicability-not-met',
+            certification: 'project-declared',
+        };
+    }
+    return {
+        name: input.name,
+        command: { kind: 'structured', value: sensor.command },
+        formatter: sensor.formatter || 'exit-code',
+        ...timeout(input.projectTimeout ?? sensor.timeout, input.packTimeout, sensor.fast ?? false),
+        requestedScope,
+        effectiveScope: 'full',
+        certification: 'project-declared',
+    };
+}
+/**
+ * Prepare a v2/v3 command. Pack-bound sensors re-resolve from the live pack
+ * (manifest command is never authority). Project-declared sensors use the
+ * entry command and carry `project-declared` provenance.
  */
 function prepareV2Sensor(input) {
     if (!input || typeof input !== 'object' || !input.sensor || typeof input.name !== 'string' || input.name === '')
         throw new Error('v2 preparation input is invalid');
+    if ((0, manifest_1.isProjectDeclaredSensor)(input.sensor))
+        return prepareProjectSensor(input);
+    const packSensor = input.sensor;
     const requestedScope = resolveRequestedScope(input.requestedScope);
     // Un sensor se ejecuta cuando la herramienta ESTA y funciona aca: `certified` es
     // la version exacta que el registry congelo, y `compatible-unverified` es una que
@@ -133,16 +180,16 @@ function prepareV2Sensor(input) {
     if (!input.liveState || (input.liveState.state !== 'certified' && input.liveState.state !== 'compatible-unverified')) {
         return v2Synthetic(input, input.liveState ? `${input.liveState.state}: ${input.liveState.reason}` : 'compatibility could not be revalidated');
     }
-    if (input.liveState.variantId !== input.sensor.variantId)
-        return v2Synthetic(input, `variant-drift: manifest ${input.sensor.variantId}, live ${input.liveState.variantId ?? 'none'}; run \`awm sensors init\``);
-    const variant = input.liveSensor?.variants.find(candidate => candidate.id === input.sensor.variantId);
+    if (input.liveState.variantId !== packSensor.variantId)
+        return v2Synthetic(input, `variant-drift: manifest ${packSensor.variantId}, live ${input.liveState.variantId ?? 'none'}; run \`awm sensors init\``);
+    const variant = input.liveSensor?.variants.find(candidate => candidate.id === packSensor.variantId);
     if (!variant)
         return v2Synthetic(input, 'variant-drift: selected live variant has no command; run `awm sensors init`');
     const common = {
         name: input.name,
         certification: input.liveState.state === 'certified' ? 'certified' : 'operational-unverified',
         ...(variant.formatter ? { formatter: variant.formatter } : {}),
-        ...timeout(input.projectTimeout ?? input.sensor.timeout, input.packTimeout ?? input.liveSensor?.timeout, input.sensor.fast ?? input.liveSensor?.fast ?? false),
+        ...timeout(input.projectTimeout ?? packSensor.timeout, input.packTimeout ?? input.liveSensor?.timeout, packSensor.fast ?? input.liveSensor?.fast ?? false),
         requestedScope,
     };
     if (requestedScope !== 'changed' || !input.changed)

package/dist/src/commands/sensors/project.js

@@ -3,6 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveContainedPackageRoot = resolveContainedPackageRoot;
+exports.softRecoverInvalidProject = softRecoverInvalidProject;
 exports.resolveSensorProject = resolveSensorProject;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
@@ -17,6 +19,60 @@ function regularManifest(manifestPath) {
         return false;
     }
 }
+/**
+ * Resolve packageRoot under projectRoot with the same realpath containment
+ * check used by hard authority selection. Returns null when the path is
+ * missing, not a directory, or escapes the project root (including via symlink).
+ */
+function resolveContainedPackageRoot(projectRoot, configuredPackageRoot) {
+    const packageRoot = configuredPackageRoot ? path_1.default.resolve(projectRoot, configuredPackageRoot) : projectRoot;
+    if (!fs_1.default.existsSync(packageRoot) || !fs_1.default.statSync(packageRoot).isDirectory())
+        return null;
+    try {
+        const realProjectRoot = fs_1.default.realpathSync(projectRoot);
+        const realPackageRoot = fs_1.default.realpathSync(packageRoot);
+        const relative = path_1.default.relative(realProjectRoot, realPackageRoot);
+        if (relative === '..' || relative.startsWith(`..${path_1.default.sep}`) || path_1.default.isAbsolute(relative))
+            return null;
+        return packageRoot;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Soft-recover schema-entry failures after a successful JSON.parse of a
+ * *regular* sensors.json. Refuses symlink/non-regular manifests and any
+ * packageRoot that escapes the project root — same trust boundary as hard parse.
+ */
+function softRecoverInvalidProject(project) {
+    if (!regularManifest(project.manifestPath))
+        return null;
+    if (/regular file/i.test(project.reason))
+        return null;
+    try {
+        const text = new util_1.TextDecoder('utf-8', { fatal: true }).decode(fs_1.default.readFileSync(project.manifestPath));
+        const soft = (0, manifest_1.parseSensorManifestWithIssues)(JSON.parse(text), project.manifestPath);
+        if (soft.kind !== 'v3' || soft.pack.mode !== 'project-sensors')
+            return null;
+        if (Object.keys(soft.pack.sensors).length === 0 && soft.invalidEntries.length === 0)
+            return null;
+        const packageRoot = resolveContainedPackageRoot(project.projectRoot, soft.pack.packageRoot);
+        if (packageRoot === null)
+            return null;
+        const { invalidEntries, ...manifest } = soft;
+        return {
+            projectRoot: project.projectRoot,
+            manifestPath: project.manifestPath,
+            packageRoot,
+            manifest,
+            invalidEntries,
+        };
+    }
+    catch {
+        return null;
+    }
+}
 function gitMarker(directory) {
     try {
         const stat = fs_1.default.lstatSync(path_1.default.join(directory, '.git'));
@@ -52,14 +108,12 @@ function manifestResolution(projectRoot) {
             configuredPackageRoot = manifest.pack.packageRoot;
         if (manifest.kind === 'v3' && manifest.pack.mode === 'project-sensors')
             configuredPackageRoot = manifest.pack.packageRoot;
-        const packageRoot = configuredPackageRoot ? path_1.default.resolve(projectRoot, configuredPackageRoot) : projectRoot;
-        if (!fs_1.default.existsSync(packageRoot) || !fs_1.default.statSync(packageRoot).isDirectory()) {
+        const candidate = configuredPackageRoot ? path_1.default.resolve(projectRoot, configuredPackageRoot) : projectRoot;
+        if (!fs_1.default.existsSync(candidate) || !fs_1.default.statSync(candidate).isDirectory()) {
             return { state: 'invalid', projectRoot, manifestPath, reason: 'packageRoot must name an existing directory' };
         }
-        const realProjectRoot = fs_1.default.realpathSync(projectRoot);
-        const realPackageRoot = fs_1.default.realpathSync(packageRoot);
-        const relative = path_1.default.relative(realProjectRoot, realPackageRoot);
-        if (relative === '..' || relative.startsWith(`..${path_1.default.sep}`) || path_1.default.isAbsolute(relative)) {
+        const packageRoot = resolveContainedPackageRoot(projectRoot, configuredPackageRoot);
+        if (packageRoot === null) {
             return { state: 'invalid', projectRoot, manifestPath, reason: 'packageRoot escapes the manifest directory' };
         }
         return { state: 'configured', projectRoot, manifestPath, packageRoot, manifest };

package/dist/src/commands/sensors/result.js

@@ -14,6 +14,13 @@ const mypy_1 = require("./formatters/mypy");
 const ruff_1 = require("./formatters/ruff");
 const shellcheck_1 = require("./formatters/shellcheck");
 const MAX_BUFFER = 64 * 1024 * 1024;
+/** Exit-code sensors signal solely via process status — never invent per-file findings. */
+function parseExitCodeOutput(_raw) {
+    return [];
+}
+function truncateEvidence(raw, max = 200) {
+    return raw.length <= max ? raw : raw.slice(0, max);
+}
 function formatterFor(name, formatter) {
     if (formatter !== undefined) {
         switch (formatter) {
@@ -25,6 +32,7 @@ function formatterFor(name, formatter) {
             case 'ruff': return ruff_1.parseRuffOutput;
             case 'shellcheck': return shellcheck_1.parseShellcheckOutput;
             case 'generic': return generic_1.parseGenericOutput;
+            case 'exit-code': return parseExitCodeOutput;
             default: return generic_1.parseGenericOutput;
         }
     }
@@ -92,12 +100,18 @@ function interpretResult(prepared, raw) {
         return withEvidence({ name: prepared.name, status: 'inconclusive', errors: [], skipReason: reason });
     }
     if (raw.code === 0) {
-        if (format === generic_1.parseGenericOutput)
+        if (format === generic_1.parseGenericOutput || format === parseExitCodeOutput) {
             return withEvidence({ name: prepared.name, status: 'pass', errors: [] });
+        }
         const errors = format(raw.stdout);
         return withEvidence({ name: prepared.name, status: errors.length ? 'fail' : 'pass', errors });
     }
     const output = raw.stdout + raw.stderr;
+    if (prepared.formatter === 'exit-code' || format === parseExitCodeOutput) {
+        const combined = output.trim();
+        const evidence = truncateEvidence(combined.length > 0 ? combined : `exit ${raw.code}`);
+        return withEvidence({ name: prepared.name, status: 'fail', errors: [{ message: evidence }] });
+    }
     const errors = format(output);
     if (errors.length > 0)
         return withEvidence({ name: prepared.name, status: 'fail', errors });
@@ -108,10 +122,10 @@ function interpretResult(prepared, raw) {
         || lower.includes('enoent')
         || lower.includes('could not determine executable');
     if (toolMissing)
-        return withEvidence({ name: prepared.name, status: 'fail', errors: [{ message: `sensor tool not available: ${output.slice(0, 200)}` }] });
+        return withEvidence({ name: prepared.name, status: 'fail', errors: [{ message: `sensor tool not available: ${truncateEvidence(output)}` }] });
     if (prepared.name === 'test')
         return withEvidence({ name: prepared.name, status: 'fail', errors: [{ message: `SENSOR[${prepared.name}] failed (exit ${raw.code})` }] });
-    return withEvidence({ name: prepared.name, status: 'inconclusive', errors: [], skipReason: `exit ${raw.code}: ${output.slice(0, 200)}` });
+    return withEvidence({ name: prepared.name, status: 'inconclusive', errors: [], skipReason: `exit ${raw.code}: ${truncateEvidence(output)}` });
 }
 /** Execute a validated prepared command, or render its deliberate synthetic result. */
 async function executePrepared(prepared, cwd = process.cwd()) {
@@ -123,6 +137,7 @@ async function executePrepared(prepared, cwd = process.cwd()) {
             status,
             errors: [],
             ...(prepared.syntheticReason ? { skipReason: prepared.syntheticReason } : {}),
+            ...(prepared.certification ? { certification: prepared.certification } : {}),
             execution: executionEvidence(prepared, 0),
         }, prepared);
     }

package/dist/src/commands/sensors/run.js

@@ -22,6 +22,8 @@ const detection_1 = require("./detection");
 const live_1 = require("./compatibility/live");
 const contract_1 = require("./compatibility/contract");
 const source_1 = require("./compatibility/source");
+const manifest_1 = require("./compatibility/manifest");
+const discovery_1 = require("./compatibility/discovery");
 const registries_1 = require("../../core/registries");
 const prepare_1 = require("./prepare");
 const verdict_1 = require("./verdict");
@@ -172,6 +174,12 @@ async function pooled(tasks, limit) {
     await Promise.all(Array.from({ length: Math.min(limit, tasks.length) }, worker));
     return results;
 }
+function v3ProjectSensors(parsed) {
+    return parsed.kind === 'v3' && parsed.pack.mode === 'project-sensors' ? parsed.pack : null;
+}
+function hasSelectedPack(manifest) {
+    return typeof manifest.pack === 'string' && manifest.pack.length > 0;
+}
 /**
  * One orchestration path for both manifest contracts. Preparation selects the
  * authorized command; execution, baseline handling, and verdict reduction are
@@ -190,22 +198,34 @@ async function runSensors(opts = {}) {
     if (project.state === 'missing') {
         return { sensors: [], overall: 'not_certified', mode: 'missing', reason: 'manifest-absent', projectRoot: project.projectRoot, manifestPath: project.manifestPath, remedy: 'run-awm-sensors-bootstrap' };
     }
+    let invalidEntries = [];
+    let configured;
     if (project.state === 'invalid') {
-        const reason = project.reason.includes('unsupported manifest schemaVersion') ? 'schema-unsupported' : 'manifest-malformed';
-        return { sensors: [], overall: 'not_certified', mode: 'invalid', reason, projectRoot: project.projectRoot, manifestPath: project.manifestPath, remedy: 'repair-sensor-manifest' };
+        const recovered = (0, project_1.softRecoverInvalidProject)(project);
+        if (!recovered) {
+            const reason = project.reason.includes('unsupported manifest schemaVersion') ? 'schema-unsupported' : 'manifest-malformed';
+            return { sensors: [], overall: 'not_certified', mode: 'invalid', reason, projectRoot: project.projectRoot, manifestPath: project.manifestPath, remedy: 'repair-sensor-manifest' };
+        }
+        invalidEntries = recovered.invalidEntries;
+        configured = recovered;
+    }
+    else {
+        configured = project;
     }
-    const manifestDir = project.projectRoot;
+    const manifestDir = configured.projectRoot;
     const beforeReadOnly = opts.readOnly ? filesystemSnapshot(manifestDir) : undefined;
     if (opts.readOnly && beforeReadOnly === null) {
-        return { sensors: [], overall: 'not_certified', projectRoot: project.projectRoot, manifestPath: project.manifestPath, mode: 'invalid', reason: 'read-only-observation-unavailable', remedy: 'run admission from a readable git worktree' };
+        return { sensors: [], overall: 'not_certified', projectRoot: configured.projectRoot, manifestPath: configured.manifestPath, mode: 'invalid', reason: 'read-only-observation-unavailable', remedy: 'run admission from a readable git worktree' };
     }
-    const parsed = project.manifest;
-    const authority = { projectRoot: project.projectRoot, manifestPath: project.manifestPath };
+    const parsed = configured.manifest;
+    const authority = { projectRoot: configured.projectRoot, manifestPath: configured.manifestPath };
     if (parsed.kind === 'v3' && (parsed.pack.mode === 'native-gate' || parsed.pack.mode === 'opt-out')) {
         return { sensors: [], overall: 'not_certified', ...authority, mode: parsed.pack.mode, reason: `${parsed.pack.mode}-declared`, declarationReason: parsed.pack.reason };
     }
+    const projectSensorsManifest = v3ProjectSensors(parsed);
+    const onlyProject = projectSensorsManifest !== null && !hasSelectedPack(projectSensorsManifest);
     let resolvedSource;
-    if (parsed.kind === 'v2' || parsed.kind === 'v3') {
+    if (parsed.kind === 'v2' || (parsed.kind === 'v3' && projectSensorsManifest && hasSelectedPack(projectSensorsManifest))) {
         try {
             resolvedSource = (0, source_1.resolveSensorSource)(parsed, { registries: (0, registries_1.listRegistries)() });
         }
@@ -230,25 +250,108 @@ async function runSensors(opts = {}) {
     // manifest itself stays discoverable at the repo root via findManifestDir.
     // Legacy manifests never carry this field — manifestDir is always correct
     // for them, unchanged.
-    const projectCwd = project.packageRoot;
+    const projectCwd = configured.packageRoot;
     const live = parsed.kind !== 'legacy' && resolvedSource && 'source' in resolvedSource
-        ? await resolveLiveFromSource(projectCwd, resolvedSource.source, 'packSelection' in parsed.pack ? parsed.pack.packSelection : undefined)
+        ? await resolveLiveFromSource(projectCwd, resolvedSource.source, projectSensorsManifest && 'packSelection' in projectSensorsManifest ? projectSensorsManifest.packSelection : undefined)
         : null;
     const drift = parsed.kind === 'legacy' ? detectPackDrift(manifestDir, parsed.pack) : undefined;
     const requestedScope = opts.changed ? 'changed' : 'full';
     const prepared = [];
     const activeManifest = parsed.pack;
-    for (const [name, sensor] of Object.entries(activeManifest.sensors)) {
+    const sensorsMap = activeManifest.sensors ?? {};
+    const packSelected = projectSensorsManifest !== null && hasSelectedPack(projectSensorsManifest);
+    for (const [name, sensor] of Object.entries(sensorsMap)) {
+        const entry = sensor;
+        const projectEntry = parsed.kind !== 'legacy' && (0, manifest_1.isProjectDeclaredSensor)(entry)
+            ? entry
+            : null;
+        // RF-1.7: collision when the live pack defines this id. When pack is selected
+        // but live cannot be resolved, fail closed — never run a project override that
+        // might be colliding with an unresolved pack sensor name.
+        const collidedWithPack = projectEntry !== null && (packSelected && live === null
+            ? true
+            : live?.pack.sensors[name] !== undefined);
+        if (collidedWithPack) {
+            invalidEntries.push({ name, reason: `project-sensor-name-collision: ${name}` });
+            // RF-1.7: keep the pack sensor when live is available; otherwise skip.
+            if (live === null || live.pack.sensors[name] === undefined)
+                continue;
+            // Fall through to pack-bound prepare using live.
+        }
+        else if (projectEntry !== null) {
+            const fast = projectEntry.fast ?? false;
+            if (!shouldRun(fast, opts))
+                continue;
+            const markers = [
+                ...(projectEntry.applicability?.allFiles ?? []),
+                ...(projectEntry.applicability?.anyFiles ?? []),
+            ];
+            const applicabilityPaths = markers.length > 0
+                ? (0, discovery_1.discoverPresentMarkers)(projectCwd, markers)
+                : undefined;
+            const execution = (0, prepare_1.prepareV2Sensor)({
+                name,
+                sensor: projectEntry,
+                requestedScope,
+                changed: changed ?? undefined,
+                projectTimeout: projectEntry.timeout,
+                applicabilityPaths,
+            });
+            prepared.push(projectEntry.enabled === false
+                ? { ...execution, command: undefined, syntheticStatus: 'skipped', syntheticReason: 'disabled' }
+                : execution);
+            continue;
+        }
         const liveSensor = parsed.kind !== 'legacy' ? live?.pack.sensors[name] : undefined;
+        const liveState = parsed.kind !== 'legacy' ? live?.sensors[name] : undefined;
+        let packBoundSensor = entry;
+        if (collidedWithPack && liveSensor) {
+            // Always reconstruct from live — never leave packBoundSensor as the project entry.
+            const fallbackVariant = liveSensor.variants[0];
+            if (!fallbackVariant)
+                continue;
+            const variantId = liveState?.variantId ?? fallbackVariant.id;
+            const variant = liveSensor.variants.find(candidate => candidate.id === variantId) ?? fallbackVariant;
+            const packSyntheticCompatibility = {
+                state: 'compatible-unverified',
+                reason: 'collision-pack-fallback',
+                variantId,
+                toolVersion: null,
+                runtimeVersion: null,
+                certifiedRange: null,
+                evidence: [],
+            };
+            const reconstructed = {
+                enabled: true,
+                ...(liveSensor.fast !== undefined ? { fast: liveSensor.fast } : {}),
+                ...(liveSensor.timeout !== undefined ? { timeout: liveSensor.timeout } : {}),
+                variantId,
+                command: variant.command,
+                initializedCompatibility: liveState ?? packSyntheticCompatibility,
+            };
+            packBoundSensor = reconstructed;
+        }
         const fast = parsed.kind !== 'legacy'
-            ? sensor.fast ?? liveSensor?.fast ?? false
-            : sensor.fast ?? false;
+            ? packBoundSensor.fast ?? liveSensor?.fast ?? false
+            : entry.fast ?? false;
         if (!shouldRun(fast, opts))
             continue;
         const execution = parsed.kind !== 'legacy'
-            ? (0, prepare_1.prepareV2Sensor)({ name, sensor: sensor, liveSensor, liveState: live?.sensors[name], requestedScope, changed: changed ?? undefined })
-            : (0, prepare_1.prepareLegacySensor)({ name, config: sensor, requestedScope, changed: changed ?? undefined });
-        prepared.push(sensor.enabled === false
+            ? (0, prepare_1.prepareV2Sensor)({
+                name,
+                sensor: packBoundSensor,
+                liveSensor,
+                liveState,
+                requestedScope,
+                changed: changed ?? undefined,
+            })
+            : (0, prepare_1.prepareLegacySensor)({
+                name,
+                config: entry,
+                requestedScope,
+                changed: changed ?? undefined,
+            });
+        prepared.push(packBoundSensor.enabled === false
             ? { ...execution, command: undefined, syntheticStatus: 'skipped', syntheticReason: 'disabled' }
             : execution);
     }
@@ -268,9 +371,14 @@ async function runSensors(opts = {}) {
         overall,
         ...authority,
         mode: 'project-sensors',
-        reason: parsed.kind === 'legacy' ? 'legacy-v1' : resolvedSource?.kind === 'logical' ? 'configured-v3' : resolvedSource?.kind,
+        reason: parsed.kind === 'legacy'
+            ? 'legacy-v1'
+            : onlyProject
+                ? 'configured-v3'
+                : resolvedSource?.kind === 'logical' ? 'configured-v3' : resolvedSource?.kind,
         ...(parsed.kind !== 'legacy' && resolvedSource && 'source' in resolvedSource
             ? { source: { kind: resolvedSource.kind, registry: resolvedSource.source.registry.name } } : {}),
+        ...(invalidEntries.length > 0 ? { invalidEntries } : {}),
         ...(drift?.drift ? { packDrift: drift.drift } : {}),
         ...(changed ? { changedScope: { files: changed.files.length, ...(changed.error ? { error: changed.error } : {}) } } : {}),
     };