agentic-workflow-manager 9.16.1 → 9.17.0

package/dist/tests/commands/sensors/init.test.js

@@ -95,3 +95,110 @@ describe('initSensors compatibility API', () => {
         expect(bootstrap_1.applySensorBootstrap).not.toHaveBeenCalled();
     });
 });
+describe('buildManifest project-declared preserve (S3)', () => {
+    let tmpDir;
+    let registryRoot;
+    beforeEach(() => {
+        tmpDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-init-s3-'));
+        registryRoot = makeRegistry();
+        fs_1.default.writeFileSync(path_1.default.join(tmpDir, 'package.json'), '{}');
+    });
+    afterEach(() => {
+        fs_1.default.rmSync(tmpDir, { recursive: true, force: true });
+        fs_1.default.rmSync(registryRoot, { recursive: true, force: true });
+    });
+    it('preserves an existing source:project entry byte-stable when regenerating pack sensors (RF-3.1)', () => {
+        const projectEntry = {
+            source: 'project',
+            enabled: true,
+            fast: true,
+            command: { executable: 'terraform', resolution: 'path', args: ['fmt', '-check'] },
+            formatter: 'exit-code',
+            description: 'keep-me',
+        };
+        // Collides with a pack default name: per-field merge would otherwise inject pack `cmd`.
+        const existing = {
+            pack: 'js-ts',
+            sensors: {
+                typecheck: projectEntry,
+            },
+        };
+        const merged = (0, init_1.buildManifest)('js-ts', existing, registryRoot, tmpDir);
+        expect(merged.sensors.typecheck).toEqual(projectEntry);
+        expect(merged.sensors.typecheck).not.toHaveProperty('cmd');
+    });
+    it('writes an only-project manifest without forcing pack:"generic" (RF-3.2)', () => {
+        const projectEntry = {
+            source: 'project',
+            enabled: true,
+            command: { executable: 'terraform', resolution: 'path', args: ['fmt', '-check'] },
+            formatter: 'exit-code',
+        };
+        const onlyProject = (0, init_1.buildManifest)(null, {
+            sensors: { 'iac-format': projectEntry },
+        }, undefined, tmpDir);
+        expect(onlyProject).not.toMatchObject({ pack: 'generic' });
+        expect(Object.prototype.hasOwnProperty.call(onlyProject, 'pack')).toBe(false);
+        expect(onlyProject.sensors['iac-format']).toEqual(projectEntry);
+        expect(JSON.stringify(onlyProject)).not.toMatch(/"pack"\s*:/);
+    });
+    it('preserves source:project entries when materialize regenerates pack sensors (RF-3.1)', () => {
+        const { materializePortableSensors } = require('../../../src/commands/sensors/compatibility/materialize');
+        const home = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-init-mat-home-'));
+        const previousHome = process.env.AWM_HOME;
+        try {
+            process.env.AWM_HOME = home;
+            const packDir = path_1.default.join(home, 'registries', 'baseline', 'sensor-packs', 'js-ts');
+            fs_1.default.mkdirSync(packDir, { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(packDir, 'eslint.config.awm.mjs'), 'export default []\n');
+            fs_1.default.writeFileSync(path_1.default.join(packDir, 'pack.json'), JSON.stringify({
+                schemaVersion: 2, name: 'js-ts', description: 'fixture', detects: ['package.json'],
+                coverage: { schemaVersion: 1, classes: {} },
+                sensors: { lint: { variants: [] } },
+            }));
+            const projectEntry = {
+                source: 'project',
+                enabled: true,
+                command: { executable: 'terraform', resolution: 'path', args: ['fmt', '-check'] },
+                formatter: 'exit-code',
+                description: 'preserve-me',
+            };
+            fs_1.default.mkdirSync(path_1.default.join(tmpDir, '.awm'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), JSON.stringify({
+                schemaVersion: 3, mode: 'project-sensors', pack: 'js-ts', source: { registry: 'baseline' },
+                sensors: { 'iac-format': projectEntry },
+            }));
+            const evidence = {
+                state: 'certified', reason: 'range-and-probe', variantId: 'eslint-10',
+                toolVersion: '10.0.0', runtimeVersion: process.versions.node, certifiedRange: '>=10 <11', evidence: [],
+            };
+            const result = materializePortableSensors({
+                projectRoot: tmpDir,
+                pack: 'js-ts',
+                source: {
+                    path: path_1.default.join(packDir, 'pack.json'),
+                    content: fs_1.default.readFileSync(path_1.default.join(packDir, 'pack.json'), 'utf8'),
+                    registry: { name: 'baseline', remote: 'https://example.test/baseline.git', contentRoot: path_1.default.join(home, 'registries', 'baseline') },
+                },
+                configure: false,
+                sensors: {
+                    lint: {
+                        enabled: true, variantId: 'eslint-10',
+                        command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] },
+                        assets: ['eslint.config.awm.mjs'],
+                        initializedCompatibility: evidence,
+                    },
+                },
+            });
+            expect(result.manifest.sensors['iac-format']).toEqual(projectEntry);
+            expect(JSON.parse(fs_1.default.readFileSync(path_1.default.join(tmpDir, '.awm', 'sensors.json'), 'utf8')).sensors['iac-format']).toEqual(projectEntry);
+        }
+        finally {
+            if (previousHome === undefined)
+                delete process.env.AWM_HOME;
+            else
+                process.env.AWM_HOME = previousHome;
+            fs_1.default.rmSync(home, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/commands/sensors/migrate.test.js

@@ -154,11 +154,12 @@ describe('planV2Migration', () => {
         try {
             fs_1.default.writeFileSync(manifestPath, original);
             const candidate = (0, migrate_1.planV2Migration)({ manifest: v2, source: resolvedSource() }).candidate;
-            const withoutPolicy = { ...candidate.sensors.lint };
+            const lint = candidate.sensors.lint;
+            const withoutPolicy = { ...lint };
             delete withoutPolicy.policyRef;
             for (const changed of [
-                { ...candidate.sensors.lint, fast: false },
-                { ...candidate.sensors.lint, variantId: 'eslint-8', initializedCompatibility: { ...candidate.sensors.lint.initializedCompatibility, variantId: 'eslint-8', toolVersion: '8.0.0', certifiedRange: '>=8 <9' } },
+                { ...lint, fast: false },
+                { ...lint, variantId: 'eslint-8', initializedCompatibility: { ...lint.initializedCompatibility, variantId: 'eslint-8', toolVersion: '8.0.0', certifiedRange: '>=8 <9' } },
                 withoutPolicy,
             ]) {
                 expect(() => (0, migrate_1.replaceV2ManifestWithV3)(manifestPath, { ...candidate, sensors: { lint: changed } }, resolvedSource())).toThrow('semantic mismatch');

package/dist/tests/commands/sensors/partial-pack-bootstrap.test.js

@@ -52,7 +52,7 @@ describe('project-sensors bootstrap with a partially resolvable pack', () => {
         const manifest = created.manifest;
         // The manifest contents are the assertion, not the exit code.
         expect(Object.keys(manifest.sensors)).toEqual(['lint']);
-        expect(manifest.sensors.lint.variantId).toBe('eslint-10');
+        expect(manifest.sensors.lint).toMatchObject({ variantId: 'eslint-10' });
         expect(created.unresolved).toEqual([{ sensor: 'security', state: 'missing-tool', reason: 'tool-not-found' }]);
         // Nothing is invented for the skipped sensor: no entry, and none of its assets.
         expect(created.changes.map(change => change.path)).toEqual(['.awm/sensors.json']);

package/dist/tests/commands/sensors/prepare.test.js

@@ -86,6 +86,68 @@ describe('validateRunOptions', () => {
             .toThrow(/refusing to combine --changed with a baseline capture/);
     });
 });
+describe('prepareV2Sensor: project-declared entries (S2)', () => {
+    const projectSensor = (overrides = {}) => ({
+        source: 'project',
+        enabled: true,
+        command: { executable: 'node', resolution: 'path', args: ['scripts/iac-format.js'] },
+        formatter: 'exit-code',
+        timeout: 45_000,
+        ...overrides,
+    });
+    test('uses the manifest command, default exit-code formatter, project timeout, and project-declared provenance', () => {
+        const prepared = (0, prepare_1.prepareV2Sensor)({
+            name: 'iac-format',
+            sensor: projectSensor(),
+            requestedScope: 'full',
+        });
+        expect(prepared.command).toEqual({
+            kind: 'structured',
+            value: { executable: 'node', resolution: 'path', args: ['scripts/iac-format.js'] },
+        });
+        expect(prepared.formatter).toBe('exit-code');
+        expect(prepared.timeoutMs).toBe(45_000);
+        expect(prepared.timeoutSource).toBe('project');
+        expect(prepared.certification).toBe('project-declared');
+        expect(prepared.certification).not.toBe('certified');
+        expect(prepared.syntheticStatus).toBeUndefined();
+    });
+    test('skips live variant re-resolution for project entries', () => {
+        const prepared = (0, prepare_1.prepareV2Sensor)({
+            name: 'iac-format',
+            sensor: projectSensor(),
+            liveState: {
+                state: 'missing-tool',
+                reason: 'tool-not-found',
+                variantId: null,
+                toolVersion: null,
+                runtimeVersion: null,
+                certifiedRange: null,
+                evidence: [],
+            },
+            requestedScope: 'full',
+        });
+        expect(prepared.command).toEqual({
+            kind: 'structured',
+            value: { executable: 'node', resolution: 'path', args: ['scripts/iac-format.js'] },
+        });
+        expect(prepared.certification).toBe('project-declared');
+    });
+    test('returns synthetic not-applicable when project applicabilityPaths are not met', () => {
+        const prepared = (0, prepare_1.prepareV2Sensor)({
+            name: 'iac-format',
+            sensor: projectSensor({
+                applicability: { allFiles: ['terraform.tf'] },
+            }),
+            applicabilityPaths: ['README.md'],
+            requestedScope: 'full',
+        });
+        expect(prepared.command).toBeUndefined();
+        expect(prepared.syntheticStatus).toBe('inconclusive');
+        expect(prepared.syntheticReason).toBe('not-applicable: applicability-not-met');
+        expect(prepared.certification).toBe('project-declared');
+    });
+});
 // El bloqueo que esto arregla: `compatible-unverified` significa que la herramienta esta,
 // cae en el rango operativo declarado por el pack y su probe coincidio — solo la version
 // exacta no es la que el registry congelo. Saltearla dejaba el veredicto en

package/dist/tests/commands/sensors/result.test.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const result_1 = require("../../../src/commands/sensors/result");
+const exec_fixtures_1 = require("./exec-fixtures");
+function prepared(overrides = {}) {
+    return {
+        name: 'iac-format',
+        formatter: 'exit-code',
+        timeoutMs: 30_000,
+        timeoutSource: 'project',
+        requestedScope: 'full',
+        effectiveScope: 'full',
+        certification: 'project-declared',
+        command: { kind: 'structured', value: { executable: 'node', resolution: 'path', args: ['check.js'] } },
+        ...overrides,
+    };
+}
+describe('interpretResult exit-code formatter (RF-2.4)', () => {
+    it('maps exit 0 to pass with no per-file findings', () => {
+        const result = (0, result_1.interpretResult)(prepared(), (0, exec_fixtures_1.ok)('all good\n'));
+        expect(result).toMatchObject({
+            name: 'iac-format',
+            status: 'pass',
+            errors: [],
+            certification: 'project-declared',
+        });
+    });
+    it('maps non-zero exit to fail with truncated combined stdout/stderr evidence and no invented per-file findings', () => {
+        const long = `${'x'.repeat(300)}\n`;
+        const result = (0, result_1.interpretResult)(prepared(), (0, exec_fixtures_1.exited)(1, long, 'stderr-tail\n'));
+        expect(result.status).toBe('fail');
+        expect(result.errors).toHaveLength(1);
+        expect(result.errors[0].file).toBeUndefined();
+        expect(result.errors[0].line).toBeUndefined();
+        expect(result.errors[0].rule).toBeUndefined();
+        // Combined = stdout+stderr; truncateEvidence caps at 200 — must be truncated
+        // stdout-first content, not a loose "exit 1" / stderr-only fallback.
+        expect(result.errors[0].message.length).toBeLessThanOrEqual(200);
+        expect(result.errors[0].message).toMatch(/^x{10,}/);
+        expect(result.errors[0].message).not.toMatch(/exit 1/);
+        expect(result.certification).toBe('project-declared');
+    });
+    it('maps non-zero exit with empty stdout/stderr to fail evidence that includes exit N', () => {
+        const result = (0, result_1.interpretResult)(prepared(), (0, exec_fixtures_1.exited)(7, '', ''));
+        expect(result.status).toBe('fail');
+        expect(result.errors).toHaveLength(1);
+        expect(result.errors[0].file).toBeUndefined();
+        expect(result.errors[0].message).toMatch(/exit 7/);
+    });
+});
+describe('executePrepared synthetic provenance (RF-2.2)', () => {
+    it('includes certification on synthetic/disabled results the same way interpretResult does', async () => {
+        const result = await (0, result_1.executePrepared)(prepared({
+            command: undefined,
+            syntheticStatus: 'skipped',
+            syntheticReason: 'disabled',
+            certification: 'project-declared',
+        }));
+        expect(result).toMatchObject({
+            name: 'iac-format',
+            status: 'skipped',
+            skipReason: 'disabled',
+            certification: 'project-declared',
+        });
+    });
+});

package/dist/tests/commands/sensors/run.test.js

@@ -641,3 +641,334 @@ describe('runSensors — honest floor (not_certified over real stack)', () => {
         }
     });
 });
+describe('runSensors project-declared parity (S2)', () => {
+    let project;
+    let home;
+    const version = '10.0.0';
+    const packBoundLint = () => ({
+        enabled: true,
+        fast: true,
+        variantId: 'eslint-10',
+        command: { executable: 'stale-eslint', resolution: 'node-modules-bin', args: ['.'] },
+        assets: ['eslint.config.awm.mjs'],
+        initializedCompatibility: {
+            state: 'certified',
+            reason: 'range-and-probe',
+            variantId: 'eslint-10',
+            toolVersion: version,
+            runtimeVersion: process.versions.node,
+            certifiedRange: '>=10 <11',
+            evidence: [],
+        },
+    });
+    const projectIac = (exitScript = 'process.exit(0)') => ({
+        source: 'project',
+        enabled: true,
+        fast: true,
+        command: { executable: 'node', resolution: 'path', args: ['-e', exitScript] },
+        formatter: 'exit-code',
+    });
+    beforeEach(() => {
+        jest.resetModules();
+        project = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-v3-project-run-'));
+        home = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-v3-project-home-'));
+        process.env.AWM_HOME = home;
+        const registry = path_1.default.join(home, 'registries', 'baseline', 'sensor-packs', 'js-ts');
+        fs_1.default.mkdirSync(registry, { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(registry, 'eslint.config.awm.mjs'), 'export default []');
+        fs_1.default.writeFileSync(path_1.default.join(home, 'registries.json'), JSON.stringify([{ name: 'baseline', remote: 'https://example.test/baseline.git' }]));
+        fs_1.default.writeFileSync(path_1.default.join(project, 'package.json'), JSON.stringify({ scripts: { lint: 'eslint .' }, devDependencies: { eslint: '^10.0.0' } }));
+        fs_1.default.mkdirSync(path_1.default.join(project, 'node_modules', 'eslint'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(project, 'node_modules', 'eslint', 'package.json'), JSON.stringify({ version }));
+        fs_1.default.writeFileSync(path_1.default.join(registry, 'pack.json'), JSON.stringify({
+            schemaVersion: 2, name: 'js-ts', description: 'fixture', detects: ['package.json'],
+            coverage: { schemaVersion: 1, classes: { lint: { description: 'lint', detectors: [{ sensor: 'lint' }], remedy: { summary: 'fix', command: 'awm sensors init' } } } },
+            sensors: {
+                lint: {
+                    fast: true,
+                    applicability: { allFiles: ['package.json'] },
+                    variants: [{
+                            id: 'eslint-10', priority: 1, certifiedRange: '>=10 <11',
+                            requirements: { tool: 'eslint', toolRange: '>=10 <11', runtime: 'node', runtimeRange: '>=0' },
+                            assets: ['eslint.config.awm.mjs'], formatter: 'generic',
+                            probe: { kind: 'package-script-present', script: 'lint' },
+                            command: { executable: 'live-eslint', resolution: 'node-modules-bin', args: ['.'] },
+                        }],
+                },
+                typecheck: {
+                    fast: true,
+                    applicability: { allFiles: ['package.json'] },
+                    variants: [{
+                            id: 'tsc-5', priority: 1, certifiedRange: '>=5 <6',
+                            requirements: { tool: 'tsc', toolRange: '>=5 <6', runtime: 'node', runtimeRange: '>=0' },
+                            assets: [], formatter: 'tsc',
+                            probe: { kind: 'version' },
+                            command: { executable: 'tsc', resolution: 'node-modules-bin', args: ['--noEmit'] },
+                        }],
+                },
+            },
+        }));
+        fs_1.default.mkdirSync(path_1.default.join(project, '.awm'));
+        mockRunStructuredCommand.mockReset();
+        mockRunCommand.mockReset();
+    });
+    afterEach(() => {
+        delete process.env.AWM_HOME;
+        fs_1.default.rmSync(project, { recursive: true, force: true });
+        fs_1.default.rmSync(home, { recursive: true, force: true });
+    });
+    function writeManifest(sensors, pack = 'js-ts') {
+        const body = {
+            schemaVersion: 3,
+            mode: 'project-sensors',
+            sensors,
+        };
+        if (pack !== undefined) {
+            body.pack = pack;
+            if (typeof pack === 'string' && pack.length > 0)
+                body.source = { registry: 'baseline' };
+        }
+        fs_1.default.writeFileSync(path_1.default.join(project, '.awm', 'sensors.json'), JSON.stringify(body));
+    }
+    it('runs pack lint and project iac-format together with project-declared provenance and overall pass (RF-2.1/2.2/2.3)', async () => {
+        writeManifest({ lint: packBoundLint(), 'iac-format': projectIac('process.exit(0)') });
+        mockRunStructuredCommand.mockImplementation(async (command) => {
+            if (command.executable === 'live-eslint')
+                return ok();
+            if (command.executable === 'node')
+                return ok();
+            return ok();
+        });
+        const { runSensors } = require('../../../src/commands/sensors/run');
+        const result = await runSensors({ cwd: project, fast: true });
+        expect(result.sensors.map((s) => s.name).sort()).toEqual(['iac-format', 'lint']);
+        const projectRow = result.sensors.find((s) => s.name === 'iac-format');
+        expect(projectRow).toMatchObject({ status: 'pass', certification: 'project-declared' });
+        expect(projectRow.certification).not.toBe('certified');
+        expect(result.overall).toBe('pass');
+        expect(result.invalidEntries ?? []).toEqual([]);
+    });
+    it('fails overall when the project sensor exits non-zero (RF-2.5)', async () => {
+        writeManifest({ lint: packBoundLint(), 'iac-format': projectIac('process.exit(1)') });
+        mockRunStructuredCommand.mockImplementation(async (command) => {
+            if (command.executable === 'live-eslint')
+                return ok();
+            if (command.executable === 'node')
+                return exited(1, 'fmt drift\n');
+            return ok();
+        });
+        const { runSensors } = require('../../../src/commands/sensors/run');
+        const result = await runSensors({ cwd: project, fast: true });
+        expect(result.sensors.find((s) => s.name === 'iac-format')).toMatchObject({ status: 'fail' });
+        expect(result.overall).toBe('fail');
+    });
+    it('skips a schema-invalid project sibling, still runs pack, and lists the invalid entry (RF-2.6)', async () => {
+        writeManifest({
+            lint: packBoundLint(),
+            broken: {
+                source: 'project',
+                enabled: true,
+                fast: true,
+                command: { executable: 'node', resolution: 'path', args: ['.'] },
+                formatter: 'not-a-formatter',
+            },
+        });
+        mockRunStructuredCommand.mockResolvedValue(ok());
+        const { runSensors } = require('../../../src/commands/sensors/run');
+        const result = await runSensors({ cwd: project, fast: true });
+        expect(result.sensors.some((s) => s.name === 'lint')).toBe(true);
+        expect(result.sensors.some((s) => s.name === 'broken')).toBe(false);
+        expect(result.invalidEntries).toEqual([
+            expect.objectContaining({
+                name: 'broken',
+                reason: expect.stringMatching(/sensors\.broken\.formatter|not a registered formatter/i),
+            }),
+        ]);
+        expect(result.reason).not.toBe('manifest-malformed');
+        expect(result.sensors.length).toBeGreaterThan(0);
+    });
+    it('suppresses a baselined project exit-code failure as sensor-level debt (RF-2.7)', async () => {
+        writeManifest({ 'iac-format': projectIac('process.exit(1)') }, null);
+        mockRunStructuredCommand.mockResolvedValue(exited(1, 'fmt drift\n'));
+        const { runSensors } = require('../../../src/commands/sensors/run');
+        const { buildBaseline, writeBaseline } = require('../../../src/commands/sensors/baseline');
+        const first = await runSensors({ cwd: project, all: true });
+        expect(first.overall).toBe('fail');
+        const row = first.sensors.find((s) => s.name === 'iac-format');
+        expect(row.status).toBe('fail');
+        writeBaseline(project, buildBaseline(first.sensors.map((s) => ({ name: s.name, errors: s.errors }))));
+        mockRunStructuredCommand.mockResolvedValue(exited(1, 'fmt drift\n'));
+        const second = await runSensors({ cwd: project, all: true });
+        const suppressed = second.sensors.find((s) => s.name === 'iac-format');
+        expect(suppressed).toMatchObject({ status: 'pass', baselineCount: 1 });
+        expect(second.overall).toBe('pass');
+    });
+    it('yields overall pass for a passing project-only run (RF-2.3 provenance never gates)', async () => {
+        writeManifest({ 'iac-format': projectIac('process.exit(0)') }, null);
+        mockRunStructuredCommand.mockResolvedValue(ok());
+        const { runSensors } = require('../../../src/commands/sensors/run');
+        const result = await runSensors({ cwd: project, all: true });
+        expect(result.sensors).toEqual([
+            expect.objectContaining({ name: 'iac-format', status: 'pass', certification: 'project-declared' }),
+        ]);
+        expect(result.overall).toBe('pass');
+    });
+    it('marks a colliding project entry invalid and still prepares/runs the pack sensor for that id (RF-1.7)', async () => {
+        // Project entry reuses pack id `lint` — invalid, but pack lint must remain executable.
+        writeManifest({ lint: projectIac('process.exit(0)') });
+        mockRunStructuredCommand.mockResolvedValue(ok());
+        const { runSensors } = require('../../../src/commands/sensors/run');
+        const result = await runSensors({ cwd: project, all: true });
+        expect(result.invalidEntries).toEqual([
+            expect.objectContaining({
+                name: 'lint',
+                reason: expect.stringMatching(/project-sensor-name-collision:\s*lint/),
+            }),
+        ]);
+        const lint = result.sensors.find((s) => s.name === 'lint');
+        expect(lint).toBeDefined();
+        expect(lint.certification).not.toBe('project-declared');
+        expect(lint.status).toBe('pass');
+        expect(mockRunStructuredCommand).toHaveBeenCalledWith(expect.objectContaining({ executable: 'live-eslint' }), expect.any(Object));
+    });
+    it('on collision with null liveState.variantId still prepares pack (not project) for that id (RF-1.7)', async () => {
+        writeManifest({ lint: projectIac('process.exit(0)') });
+        // Remove the tool so live resolution yields missing-tool with variantId null,
+        // while the pack still defines the lint sensor.
+        fs_1.default.rmSync(path_1.default.join(project, 'node_modules', 'eslint'), { recursive: true, force: true });
+        fs_1.default.writeFileSync(path_1.default.join(project, 'package.json'), JSON.stringify({ scripts: { lint: 'eslint .' } }));
+        mockRunStructuredCommand.mockResolvedValue(ok());
+        const { runSensors } = require('../../../src/commands/sensors/run');
+        const result = await runSensors({ cwd: project, all: true });
+        expect(result.invalidEntries).toEqual([
+            expect.objectContaining({
+                name: 'lint',
+                reason: expect.stringMatching(/project-sensor-name-collision:\s*lint/),
+            }),
+        ]);
+        const lint = result.sensors.find((s) => s.name === 'lint');
+        expect(lint).toBeDefined();
+        expect(lint.certification).not.toBe('project-declared');
+        // Pack prepare/synthetic outcome — never the project node command.
+        expect(mockRunStructuredCommand).not.toHaveBeenCalledWith(expect.objectContaining({ executable: 'node' }), expect.any(Object));
+    });
+    it('carries project-declared provenance on a disabled/synthetic project sensor (RF-2.2)', async () => {
+        writeManifest({
+            'iac-format': { ...projectIac('process.exit(0)'), enabled: false },
+        }, null);
+        const { runSensors } = require('../../../src/commands/sensors/run');
+        const result = await runSensors({ cwd: project, all: true });
+        expect(result.sensors).toEqual([
+            expect.objectContaining({
+                name: 'iac-format',
+                status: 'skipped',
+                skipReason: 'disabled',
+                certification: 'project-declared',
+            }),
+        ]);
+        expect(mockRunStructuredCommand).not.toHaveBeenCalled();
+    });
+    it('runs a project sensor when its allFiles marker exists', async () => {
+        writeManifest({
+            'iac-format': {
+                ...projectIac('process.exit(0)'),
+                applicability: { allFiles: ['package.json'] },
+            },
+        }, null);
+        mockRunStructuredCommand.mockResolvedValue(ok());
+        const { runSensors } = require('../../../src/commands/sensors/run');
+        const result = await runSensors({ cwd: project, all: true });
+        expect(result.sensors).toEqual([
+            expect.objectContaining({ name: 'iac-format', status: 'pass', certification: 'project-declared' }),
+        ]);
+        expect(mockRunStructuredCommand).toHaveBeenCalledWith(expect.objectContaining({ executable: 'node' }), expect.any(Object));
+    });
+    it('keeps a project sensor synthetic not-applicable when its allFiles marker is missing', async () => {
+        writeManifest({
+            'iac-format': {
+                ...projectIac('process.exit(0)'),
+                applicability: { allFiles: ['missing-stack.marker'] },
+            },
+        }, null);
+        mockRunStructuredCommand.mockResolvedValue(ok());
+        const { runSensors } = require('../../../src/commands/sensors/run');
+        const result = await runSensors({ cwd: project, all: true });
+        expect(result.sensors).toEqual([
+            expect.objectContaining({
+                name: 'iac-format',
+                status: 'inconclusive',
+                skipReason: 'not-applicable: applicability-not-met',
+                certification: 'project-declared',
+            }),
+        ]);
+        expect(mockRunStructuredCommand).not.toHaveBeenCalled();
+    });
+    it('does not soft-recover when packageRoot is a symlink escaping the project root', async () => {
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-soft-escape-out-'));
+        try {
+            fs_1.default.symlinkSync(outside, path_1.default.join(project, 'pkg'));
+            const body = {
+                schemaVersion: 3,
+                mode: 'project-sensors',
+                packageRoot: 'pkg',
+                sensors: {
+                    broken: {
+                        source: 'project',
+                        enabled: true,
+                        fast: true,
+                        command: { executable: 'node', resolution: 'path', args: ['-e', 'process.exit(0)'] },
+                        formatter: 'not-a-formatter',
+                    },
+                    good: projectIac('process.exit(0)'),
+                },
+            };
+            fs_1.default.writeFileSync(path_1.default.join(project, '.awm', 'sensors.json'), JSON.stringify(body));
+            mockRunStructuredCommand.mockResolvedValue(ok());
+            const { runSensors } = require('../../../src/commands/sensors/run');
+            const result = await runSensors({ cwd: project, all: true });
+            expect(result.overall).toBe('not_certified');
+            expect(result.mode).toBe('invalid');
+            expect(result.sensors).toEqual([]);
+            expect(mockRunStructuredCommand).not.toHaveBeenCalled();
+        }
+        finally {
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    it('does not soft-recover a symlinked sensors.json (non-regular-file authority)', async () => {
+        const realManifest = path_1.default.join(project, 'elsewhere-sensors.json');
+        fs_1.default.writeFileSync(realManifest, JSON.stringify({
+            schemaVersion: 3,
+            mode: 'project-sensors',
+            sensors: { good: projectIac('process.exit(0)') },
+        }));
+        const manifestPath = path_1.default.join(project, '.awm', 'sensors.json');
+        if (fs_1.default.existsSync(manifestPath))
+            fs_1.default.unlinkSync(manifestPath);
+        fs_1.default.symlinkSync(realManifest, manifestPath);
+        mockRunStructuredCommand.mockResolvedValue(ok());
+        const { runSensors } = require('../../../src/commands/sensors/run');
+        const result = await runSensors({ cwd: project, all: true });
+        expect(result.overall).toBe('not_certified');
+        expect(result.mode).toBe('invalid');
+        expect(result.sensors).toEqual([]);
+        expect(mockRunStructuredCommand).not.toHaveBeenCalled();
+    });
+    it('fail-closes a project id collision when the live pack cannot be resolved (live null)', async () => {
+        writeManifest({ lint: projectIac('process.exit(0)') });
+        fs_1.default.writeFileSync(path_1.default.join(home, 'registries', 'baseline', 'sensor-packs', 'js-ts', 'pack.json'), 'not-valid-json{');
+        mockRunStructuredCommand.mockResolvedValue(ok());
+        const { runSensors } = require('../../../src/commands/sensors/run');
+        const result = await runSensors({ cwd: project, all: true });
+        expect(result.invalidEntries).toEqual([
+            expect.objectContaining({
+                name: 'lint',
+                reason: expect.stringMatching(/project-sensor-name-collision:\s*lint/),
+            }),
+        ]);
+        const lint = result.sensors.find((s) => s.name === 'lint');
+        if (lint)
+            expect(lint.certification).not.toBe('project-declared');
+        expect(mockRunStructuredCommand).not.toHaveBeenCalledWith(expect.objectContaining({ executable: 'node' }), expect.any(Object));
+    });
+});