agentic-workflow-manager 9.16.1 → 9.18.0

package/dist/src/commands/sensors/compatibility/contract.js

@@ -137,61 +137,65 @@ function resolveSemgrepPolicy(policyRef, source, location = 'policy') {
     }
     return parseSemgrepPolicy(parsed, candidate);
 }
-function parseStructuredCommand(input, source) {
-    const value = record(input, source, 'command');
-    fields(value, ['executable', 'resolution', 'args', 'packageManager', 'environment', 'fileInput', 'pythonEnvironmentRoot'], source, 'command');
-    const executable = text(value.executable, source, 'command.executable');
+function parseStructuredCommand(input, source, location = 'command') {
+    const value = record(input, source, location);
+    fields(value, ['executable', 'resolution', 'args', 'packageManager', 'environment', 'fileInput', 'pythonEnvironmentRoot'], source, location);
+    const executable = text(value.executable, source, `${location}.executable`);
     if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(executable) || SHELL_EXECUTABLES.has(executable.toLowerCase().replace(/\.exe$/, ''))) {
-        invalid(source, 'command.executable must not be a shell or path');
+        invalid(source, `${location}.executable must not be a shell or path`);
     }
     if (value.resolution !== 'node-modules-bin' && value.resolution !== 'python-environment' && value.resolution !== 'path') {
-        invalid(source, 'command.resolution must be a supported resolution');
+        invalid(source, `${location}.resolution must be a supported resolution`);
     }
-    const args = stringArray(value.args, source, 'command.args');
+    const args = stringArray(value.args, source, `${location}.args`);
     for (const [index, arg] of args.entries()) {
         if (arg.includes('{files}') && arg !== '{files}')
-            invalid(source, `command.args[${index}] must not embed {files}`);
+            invalid(source, `${location}.args[${index}] must not embed {files}`);
     }
     const command = { executable, resolution: value.resolution, args };
     if ('pythonEnvironmentRoot' in value) {
-        if (value.resolution !== 'python-environment' || (value.pythonEnvironmentRoot !== '.venv' && value.pythonEnvironmentRoot !== 'venv'))
-            invalid(source, 'command.pythonEnvironmentRoot must name the selected .venv or venv Python environment');
+        if (value.resolution !== 'python-environment' || (value.pythonEnvironmentRoot !== '.venv' && value.pythonEnvironmentRoot !== 'venv')) {
+            invalid(source, `${location}.pythonEnvironmentRoot must name the selected .venv or venv Python environment`);
+        }
         command.pythonEnvironmentRoot = value.pythonEnvironmentRoot;
     }
     const executablePackageManager = normalizedPackageManager(executable);
-    if (PACKAGE_MANAGERS.has(executablePackageManager) && !('packageManager' in value))
-        invalid(source, 'command.packageManager is required for a package-manager executable');
+    if (PACKAGE_MANAGERS.has(executablePackageManager) && !('packageManager' in value)) {
+        invalid(source, `${location}.packageManager is required for a package-manager executable`);
+    }
     if ('packageManager' in value) {
-        if (typeof value.packageManager !== 'string' || !PACKAGE_MANAGERS.has(normalizedPackageManager(value.packageManager)))
-            invalid(source, 'command.packageManager must be npm, pnpm, yarn, or bun');
+        if (typeof value.packageManager !== 'string' || !PACKAGE_MANAGERS.has(normalizedPackageManager(value.packageManager))) {
+            invalid(source, `${location}.packageManager must be npm, pnpm, yarn, or bun`);
+        }
         const packageManager = normalizedPackageManager(value.packageManager);
         if (packageManager !== executablePackageManager)
-            invalid(source, 'command.packageManager must match executable');
+            invalid(source, `${location}.packageManager must match executable`);
         command.packageManager = packageManager;
     }
     if ('environment' in value) {
-        const environment = record(value.environment, source, 'command.environment');
-        fields(environment, ['ESLINT_USE_FLAT_CONFIG'], source, 'command.environment');
-        if ((environment.ESLINT_USE_FLAT_CONFIG !== 'true' && environment.ESLINT_USE_FLAT_CONFIG !== 'false') || Object.keys(environment).length !== 1)
-            invalid(source, 'command.environment must be the exact allowlisted ESLINT_USE_FLAT_CONFIG=true or false mapping');
+        const environment = record(value.environment, source, `${location}.environment`);
+        fields(environment, ['ESLINT_USE_FLAT_CONFIG'], source, `${location}.environment`);
+        if ((environment.ESLINT_USE_FLAT_CONFIG !== 'true' && environment.ESLINT_USE_FLAT_CONFIG !== 'false') || Object.keys(environment).length !== 1) {
+            invalid(source, `${location}.environment must be the exact allowlisted ESLINT_USE_FLAT_CONFIG=true or false mapping`);
+        }
         command.environment = { ESLINT_USE_FLAT_CONFIG: environment.ESLINT_USE_FLAT_CONFIG };
     }
     if ('fileInput' in value) {
-        const fileInput = record(value.fileInput, source, 'command.fileInput');
-        fields(fileInput, ['placeholder', 'extensions'], source, 'command.fileInput');
+        const fileInput = record(value.fileInput, source, `${location}.fileInput`);
+        fields(fileInput, ['placeholder', 'extensions'], source, `${location}.fileInput`);
         if (fileInput.placeholder !== '{files}')
-            invalid(source, 'command.fileInput.placeholder must be {files}');
-        const extensions = stringArray(fileInput.extensions, source, 'command.fileInput.extensions');
+            invalid(source, `${location}.fileInput.placeholder must be {files}`);
+        const extensions = stringArray(fileInput.extensions, source, `${location}.fileInput.extensions`);
         for (const [index, extension] of extensions.entries()) {
             if (!/^\.[A-Za-z0-9]+$/.test(extension))
-                invalid(source, `command.fileInput.extensions[${index}] must be an extension`);
+                invalid(source, `${location}.fileInput.extensions[${index}] must be an extension`);
         }
         if (args.filter(arg => arg === '{files}').length !== 1)
-            invalid(source, 'command.fileInput requires exactly one {files} argument');
+            invalid(source, `${location}.fileInput requires exactly one {files} argument`);
         command.fileInput = { placeholder: '{files}', extensions };
     }
     else if (args.includes('{files}')) {
-        invalid(source, 'command {files} argument requires fileInput');
+        invalid(source, `${location} {files} argument requires fileInput`);
     }
     return command;
 }

package/dist/src/commands/sensors/compatibility/discovery.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.discoverPresentMarkers = discoverPresentMarkers;
 exports.discoverProjectEvidence = discoverProjectEvidence;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
@@ -21,6 +22,26 @@ function safeFile(root, relative) {
         return false;
     }
 }
+/**
+ * Present contained marker files under cwd — same `safeFile` rules pack discovery
+ * uses when evaluating applicability allFiles/anyFiles.
+ */
+function discoverPresentMarkers(cwd, markers) {
+    if (typeof cwd !== 'string' || cwd.trim() === '')
+        throw new Error('cwd must be a non-empty path');
+    if (!Array.isArray(markers))
+        throw new Error('markers must be an array');
+    let root;
+    try {
+        root = fs_1.default.realpathSync(cwd);
+        if (!fs_1.default.statSync(root).isDirectory())
+            throw new Error();
+    }
+    catch {
+        throw new Error(`cwd is not a readable project directory: ${cwd}`);
+    }
+    return [...new Set(markers.filter((marker) => typeof marker === 'string' && safeFile(root, marker)))].sort();
+}
 function safeParts(parts) {
     return parts.length > 0 && parts.every(part => Boolean(part) && part !== '.' && part !== '..' && !part.includes('/') && !part.includes('\\'));
 }

package/dist/src/commands/sensors/compatibility/manifest.js

@@ -3,7 +3,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isProjectDeclaredSensor = isProjectDeclaredSensor;
+exports.isPackBoundManifestSensor = isPackBoundManifestSensor;
+exports.asPackBoundProjectSensors = asPackBoundProjectSensors;
 exports.legacyCompatibility = legacyCompatibility;
+exports.parseSensorManifestWithIssues = parseSensorManifestWithIssues;
 exports.parseSensorManifest = parseSensorManifest;
 exports.serializeManifestV2 = serializeManifestV2;
 exports.serializeManifestV3 = serializeManifestV3;
@@ -11,6 +15,28 @@ const contract_1 = require("./contract");
 const timeout_1 = require("./timeout");
 const semver_1 = __importDefault(require("semver"));
 const path_1 = __importDefault(require("path"));
+/** Registered CLI formatter ids plus exit-code (default for project-declared sensors). */
+const PROJECT_FORMATTERS = new Set([
+    'tsc', 'eslint-llm', 'semgrep', 'test', 'mypy', 'ruff', 'shellcheck', 'generic', 'exit-code',
+]);
+function isProjectDeclaredSensor(sensor) {
+    return 'source' in sensor && sensor.source === 'project';
+}
+function isPackBoundManifestSensor(sensor) {
+    return !isProjectDeclaredSensor(sensor);
+}
+/** Narrow a parsed v3 manifest to the pack-bound shape expected by migrate/materialize. */
+function asPackBoundProjectSensors(manifest) {
+    if (typeof manifest.pack !== 'string' || manifest.pack.length === 0 || !manifest.source) {
+        throw new Error('project-sensors manifest requires a nonempty pack and source.registry');
+    }
+    for (const [name, sensor] of Object.entries(manifest.sensors)) {
+        if (isProjectDeclaredSensor(sensor)) {
+            throw new Error(`sensors.${name} is project-declared; pack-bound operation required`);
+        }
+    }
+    return manifest;
+}
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -93,6 +119,9 @@ function parseLegacySensor(input, source, location) {
     if (typeof input === 'string')
         return { cmd: text(input, source, `${location}.cmd`) };
     const value = record(input, source, location);
+    if (value.source === 'project') {
+        invalid(source, `${location}.source "project" requires schemaVersion 3; migrate-to-v3`);
+    }
     fields(value, ['cmd', 'fast', 'enabled', 'timeout', 'changedCmd', 'changedExtensions', 'formatter'], source, location);
     const sensor = {};
     if ('cmd' in value)
@@ -138,14 +167,96 @@ function parseLegacyManifest(value, source) {
     }
     return manifest;
 }
+function parseApplicability(input, source, location) {
+    const applicabilityInput = record(input, source, location);
+    fields(applicabilityInput, ['allFiles', 'anyFiles', 'kind'], source, location);
+    const applicability = {};
+    if ('allFiles' in applicabilityInput) {
+        applicability.allFiles = stringArray(applicabilityInput.allFiles, source, `${location}.allFiles`, false)
+            .map((file, index) => asset(file, source, `${location}.allFiles[${index}]`));
+    }
+    if ('anyFiles' in applicabilityInput) {
+        applicability.anyFiles = stringArray(applicabilityInput.anyFiles, source, `${location}.anyFiles`, false)
+            .map((file, index) => asset(file, source, `${location}.anyFiles[${index}]`));
+    }
+    if ('kind' in applicabilityInput) {
+        const kind = text(applicabilityInput.kind, source, `${location}.kind`);
+        if (kind !== 'explicit-or-supported-language' && kind !== 'explicit-opt-in') {
+            invalid(source, `${location}.kind must be a supported applicability kind`);
+        }
+        applicability.kind = kind;
+    }
+    if (Object.keys(applicability).length === 0)
+        invalid(source, `${location} must declare a condition`);
+    return applicability;
+}
+function parseProjectSensor(input, source, location) {
+    const value = record(input, source, location);
+    if ('variantId' in value)
+        invalid(source, `${location}.variantId is forbidden on source:"project" entries`);
+    if ('initializedCompatibility' in value)
+        invalid(source, `${location}.initializedCompatibility is forbidden on source:"project" entries`);
+    fields(value, ['source', 'enabled', 'command', 'formatter', 'fast', 'timeout', 'assets', 'applicability', 'description'], source, location);
+    if (value.source !== 'project')
+        invalid(source, `${location}.source must be "project"`);
+    if (typeof value.enabled !== 'boolean')
+        invalid(source, `${location}.enabled must be a boolean`);
+    const sensor = {
+        source: 'project',
+        enabled: value.enabled,
+        command: (0, contract_1.parseStructuredCommand)(value.command, source, `${location}.command`),
+        formatter: 'exit-code',
+    };
+    if ('formatter' in value) {
+        const formatter = text(value.formatter, source, `${location}.formatter`);
+        if (!PROJECT_FORMATTERS.has(formatter))
+            invalid(source, `${location}.formatter is not a registered formatter id`);
+        sensor.formatter = formatter;
+    }
+    if ('assets' in value) {
+        sensor.assets = stringArray(value.assets, source, `${location}.assets`, true)
+            .map((entry, index) => asset(entry, source, `${location}.assets[${index}]`));
+    }
+    if ('applicability' in value)
+        sensor.applicability = parseApplicability(value.applicability, source, `${location}.applicability`);
+    if ('description' in value)
+        sensor.description = text(value.description, source, `${location}.description`);
+    if ('fast' in value) {
+        if (typeof value.fast !== 'boolean')
+            invalid(source, `${location}.fast must be a boolean`);
+        sensor.fast = value.fast;
+    }
+    if ('timeout' in value) {
+        try {
+            sensor.timeout = (0, timeout_1.positiveTimeout)(value.timeout, `${location}.timeout`);
+        }
+        catch (error) {
+            invalid(source, error instanceof Error ? error.message : `${location}.timeout must be a positive safe integer`);
+        }
+    }
+    return sensor;
+}
+function parseV3SensorEntry(input, source, location) {
+    const value = record(input, source, location);
+    if (value.source === 'project')
+        return parseProjectSensor(value, source, location);
+    const unmarkedCustom = !('variantId' in value) && !('initializedCompatibility' in value) && 'command' in value;
+    if (unmarkedCustom) {
+        invalid(source, `${location}.source is required for project-declared sensors; add source:"project"`);
+    }
+    return parseV2Sensor(input, source, location);
+}
 function parseV2Sensor(input, source, location) {
     const value = record(input, source, location);
+    if (value.source === 'project') {
+        invalid(source, `${location}.source "project" requires schemaVersion 3; migrate-to-v3`);
+    }
     fields(value, ['enabled', 'fast', 'timeout', 'variantId', 'command', 'assets', 'policyRef', 'initializedCompatibility'], source, location);
     if (typeof value.enabled !== 'boolean')
         invalid(source, `${location}.enabled must be a boolean`);
     const sensor = {
         enabled: value.enabled, variantId: id(value.variantId, source, `${location}.variantId`),
-        command: (0, contract_1.parseStructuredCommand)(value.command, source),
+        command: (0, contract_1.parseStructuredCommand)(value.command, source, `${location}.command`),
         initializedCompatibility: parseCompatibilityEvidence(value.initializedCompatibility, source, `${location}.initializedCompatibility`),
     };
     if (sensor.initializedCompatibility.variantId !== null && sensor.initializedCompatibility.variantId !== sensor.variantId)
@@ -226,24 +337,28 @@ function parseV2Manifest(value, source) {
     }
     return manifest;
 }
-function parseV3ProjectManifest(value, source) {
+function parseV3ProjectManifestRoot(value, source) {
     fields(value, ['schemaVersion', 'mode', 'pack', 'packSelection', 'source', 'packageRoot', 'sensors', 'concurrency'], source, 'root');
-    const sourceValue = record(value.source, source, 'source');
-    fields(sourceValue, ['registry'], source, 'source');
-    const sensorsInput = record(value.sensors, source, 'sensors');
-    const sensors = {};
-    for (const name of Object.keys(sensorsInput))
-        sensors[id(name, source, 'sensor id')] = parseV2Sensor(sensorsInput[name], source, `sensors.${name}`);
+    const hasPackKey = 'pack' in value;
+    const pack = !hasPackKey ? undefined : value.pack === null ? null : id(value.pack, source, 'pack');
     const manifest = {
         schemaVersion: 3,
         mode: 'project-sensors',
-        pack: id(value.pack, source, 'pack'),
-        source: { registry: id(sourceValue.registry, source, 'source.registry') },
-        sensors,
+        ...(hasPackKey ? { pack } : {}),
     };
+    if (typeof pack === 'string' && pack.length > 0) {
+        const sourceValue = record(value.source, source, 'source');
+        fields(sourceValue, ['registry'], source, 'source');
+        manifest.source = { registry: id(sourceValue.registry, source, 'source.registry') };
+    }
+    else if ('source' in value) {
+        invalid(source, 'source requires a nonempty pack id');
+    }
     if ('packSelection' in value) {
         if (value.packSelection !== 'explicit')
             invalid(source, 'packSelection must be "explicit" when present');
+        if (typeof pack !== 'string' || pack.length === 0)
+            invalid(source, 'packSelection requires a nonempty pack id');
         manifest.packSelection = 'explicit';
     }
     if ('packageRoot' in value)
@@ -255,26 +370,63 @@ function parseV3ProjectManifest(value, source) {
     }
     return manifest;
 }
+function parseV3ProjectSensorsMap(sensorsInput, source, soft) {
+    const sensors = {};
+    const invalidEntries = [];
+    for (const name of Object.keys(sensorsInput)) {
+        const sensorName = id(name, source, 'sensor id');
+        try {
+            sensors[sensorName] = parseV3SensorEntry(sensorsInput[name], source, `sensors.${sensorName}`);
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : String(error);
+            if (!soft)
+                throw error instanceof Error ? error : new Error(reason);
+            invalidEntries.push({ name: sensorName, reason });
+        }
+    }
+    return { sensors, invalidEntries };
+}
+function parseV3ProjectManifest(value, source, soft) {
+    const root = parseV3ProjectManifestRoot(value, source);
+    const sensorsInput = record(value.sensors, source, 'sensors');
+    const { sensors, invalidEntries } = parseV3ProjectSensorsMap(sensorsInput, source, soft);
+    return { pack: { ...root, sensors }, invalidEntries };
+}
 function parseV3Manifest(value, source) {
     if (value.schemaVersion !== 3)
         invalid(source, `unsupported manifest schemaVersion ${String(value.schemaVersion)}; supported: legacy, 2, 3; upgrade or migrate the manifest`);
     if (value.mode === 'project-sensors')
-        return parseV3ProjectManifest(value, source);
+        return parseV3ProjectManifest(value, source, false).pack;
     if (value.mode !== 'native-gate' && value.mode !== 'opt-out')
         invalid(source, 'schemaVersion 3 mode must be "project-sensors", "native-gate", or "opt-out"');
     fields(value, ['schemaVersion', 'mode', 'reason'], source, 'root');
     return { schemaVersion: 3, mode: value.mode, reason: text(value.reason, source, 'reason') };
 }
-function parseSensorManifest(input, source) {
+/** Soft per-entry parse for v3 project-sensors; document-level errors still throw. */
+function parseSensorManifestWithIssues(input, source) {
     const value = record(input, source, 'root');
     if (!('schemaVersion' in value))
-        return { kind: 'legacy', pack: parseLegacyManifest(value, source) };
+        return { kind: 'legacy', pack: parseLegacyManifest(value, source), invalidEntries: [] };
     if (value.schemaVersion === 2)
-        return { kind: 'v2', pack: parseV2Manifest(value, source) };
-    if (value.schemaVersion === 3)
-        return { kind: 'v3', pack: parseV3Manifest(value, source) };
+        return { kind: 'v2', pack: parseV2Manifest(value, source), invalidEntries: [] };
+    if (value.schemaVersion === 3) {
+        if (value.mode === 'project-sensors') {
+            const parsed = parseV3ProjectManifest(value, source, true);
+            return { kind: 'v3', pack: parsed.pack, invalidEntries: parsed.invalidEntries };
+        }
+        return { kind: 'v3', pack: parseV3Manifest(value, source), invalidEntries: [] };
+    }
     invalid(source, `unsupported manifest schemaVersion ${String(value.schemaVersion)}; supported: legacy, 2, 3; upgrade or migrate the manifest`);
 }
+function parseSensorManifest(input, source) {
+    const withIssues = parseSensorManifestWithIssues(input, source);
+    if (withIssues.invalidEntries.length > 0) {
+        throw new Error(withIssues.invalidEntries[0].reason);
+    }
+    const { invalidEntries: _invalidEntries, ...parsed } = withIssues;
+    return parsed;
+}
 function serializeManifestV2(input) {
     const parsed = parseSensorManifest(input, 'manifest serialization');
     if (parsed.kind !== 'v2')

package/dist/src/commands/sensors/compatibility/materialize.js

@@ -217,6 +217,23 @@ function priorAssets(projectRoot) {
         return Object.values(parsedManifest.pack.sensors).flatMap(sensor => sensor.assets ?? []);
     return [];
 }
+/** Existing `"source": "project"` entries to keep when regenerating pack sensors (RF-3.1). */
+function priorProjectSensors(projectRoot) {
+    const manifestPath = path_1.default.join(projectRoot, '.awm', 'sensors.json');
+    try {
+        const stat = fs_1.default.lstatSync(manifestPath, { bigint: true });
+        if (!stat.isFile() || stat.isSymbolicLink())
+            return {};
+        // Soft-parse so one invalid sibling does not drop every valid project entry.
+        const parsed = (0, manifest_1.parseSensorManifestWithIssues)(JSON.parse((0, safe_file_1.readInspectedBoundedFile)(manifestPath, stat, MAX_ASSET_BYTES, () => new Error('prior manifest unreadable')).toString('utf8')), manifestPath);
+        if (parsed.kind !== 'v3' || parsed.pack.mode !== 'project-sensors')
+            return {};
+        return Object.fromEntries(Object.entries(parsed.pack.sensors).filter(([, sensor]) => (0, manifest_1.isProjectDeclaredSensor)(sensor)));
+    }
+    catch {
+        return {};
+    }
+}
 /** Materialize a previously selected logical registry source into a portable v3 manifest. */
 function materializePortableSensors(input) {
     if (!input || typeof input !== 'object')
@@ -237,18 +254,25 @@ function materializePortableSensors(input) {
     const parsed = (0, manifest_1.parseSensorManifest)(candidate, 'portable materialized manifest');
     if (parsed.kind !== 'v3' || parsed.pack.mode !== 'project-sensors')
         throw new Error('portable materialized manifest must be v3 project-sensors');
-    const manifest = parsed.pack;
-    for (const [name, sensor] of Object.entries(manifest.sensors)) {
-        if (sensor.policyRef)
+    const packBound = (0, manifest_1.asPackBoundProjectSensors)(parsed.pack);
+    for (const [name, sensor] of Object.entries(packBound.sensors)) {
+        if ((0, manifest_1.isPackBoundManifestSensor)(sensor) && sensor.policyRef)
             (0, contract_1.resolveSemgrepPolicy)(sensor.policyRef, path_1.default.join(packRoot, 'pack.json'), `sensors.${name}`);
     }
-    const selected = [...new Set(Object.values(manifest.sensors).flatMap(sensor => sensor.assets ?? []))].map((asset, index) => containedAsset(asset, `assets[${index}]`)).sort();
+    const priorProject = priorProjectSensors(projectRoot);
+    // Project entries win on name collision so regen never drops them (RF-3.1).
+    const manifest = {
+        ...packBound,
+        sensors: { ...packBound.sensors, ...priorProject },
+    };
+    const selected = [...new Set(Object.values(packBound.sensors).flatMap(sensor => sensor.assets ?? []))].map((asset, index) => containedAsset(asset, `assets[${index}]`)).sort();
     // Establish every registry authority and read every selected byte before the
     // first project mutation. A bad later asset must not strand an earlier one.
     const publications = input.configure === false ? [] : selected.map(asset => {
         const selectedSource = selectedRegistryAsset(packRoot, asset);
         return { asset, content: readSelectedRegistryAsset(packRoot, selectedSource, asset) };
     });
+    const manifestExists = fs_1.default.existsSync(path_1.default.join(projectRoot, '.awm', 'sensors.json'));
     return (0, safe_file_1.withProjectLease)(projectRoot, () => {
         const configRoot = manifest.packageRoot ? containedPackageRoot(projectRoot, manifest.packageRoot) : projectRoot;
         const prior = priorAssets(projectRoot);
@@ -273,7 +297,8 @@ function materializePortableSensors(input) {
                         preserved.push(publication.asset);
                 }
             }
-            atomicWrite(projectRoot, '.awm/sensors.json', (0, manifest_1.serializeManifestV3)(manifest), true);
+            // Replace when regenerating over an existing manifest so project entries can be re-merged.
+            atomicWrite(projectRoot, '.awm/sensors.json', (0, manifest_1.serializeManifestV3)(manifest), !manifestExists);
         }
         catch (error) {
             for (const entry of created.reverse()) {

package/dist/src/commands/sensors/compatibility/source.js

@@ -49,10 +49,11 @@ function resolveSensorSource(manifest, deps) {
             || !v3.source || typeof v3.source.registry !== 'string') {
             throw new Error('sensor source resolution requires a valid project-sensors manifest');
         }
-        if (!/^[a-z][a-z0-9-]*$/.test(v3.source.registry)) {
+        const registryName = v3.source.registry;
+        if (!/^[a-z][a-z0-9-]*$/.test(registryName)) {
             throw new Error('sensor source registry must be a stable lowercase id');
         }
-        const matches = registries.filter(entry => entry?.name === v3.source.registry);
+        const matches = registries.filter(entry => entry?.name === registryName);
         if (matches.length !== 1)
             return unavailable('registry-not-installed');
         const source = (0, pack_source_1.listPackSources)(v3.pack, { registries: matches })[0];

package/dist/src/commands/sensors/coverage/render.js

@@ -225,8 +225,9 @@ function assertCoverageEnvelope(report, renderer) {
         return;
     }
     if (staticReport.reason === 'no_reference') {
-        if (report.overall !== 'inconclusive' || !isNonBlankString(report.pack) || !isNonBlankString(report.registry)
-            || staticReport.classes.length !== 0) {
+        const packReferenced = isNonBlankString(report.pack) && isNonBlankString(report.registry);
+        const onlyProject = report.pack === null && report.registry === null;
+        if (report.overall !== 'inconclusive' || staticReport.classes.length !== 0 || (!packReferenced && !onlyProject)) {
             invalidReport(renderer);
         }
         if (report.empirical !== undefined) {
@@ -303,6 +304,11 @@ function renderCoverageHuman(report) {
         return ['Sensor coverage', 'Overall: inconclusive', 'Reason: sensors are not configured', 'Run: awm sensors init', ...(report.empirical ? [empiricalHuman(report)] : []), ''].join('\n');
     }
     if (report.static.reason === 'no_reference') {
+        if (report.pack === null && report.registry === null) {
+            return ['Sensor coverage', 'Pack: none', 'Overall: inconclusive',
+                'No pack coverage reference (project-declared sensors only)',
+                ...(report.empirical ? [empiricalHuman(report)] : []), ''].join('\n');
+        }
         return ['Sensor coverage', `Pack: ${safeHumanText(report.pack ?? 'unknown')}`, `Registry: ${safeHumanText(report.registry ?? 'unknown')}`,
             'Overall: inconclusive', `No coverage reference for pack '${safeHumanText(report.pack ?? 'unknown')}'`, ...(report.empirical ? [empiricalHuman(report)] : []), ''].join('\n');
     }

package/dist/src/commands/sensors/coverage/resolve.js

@@ -97,6 +97,13 @@ function resolveCoverageInputs(cwd) {
     if (manifest.kind === 'v3' && manifest.pack.mode !== 'project-sensors')
         return { kind: 'not_configured' };
     const coverageManifest = manifest;
+    // Only-project manifests have no pack coverage contract to evaluate (RF-2.9).
+    if (coverageManifest.kind === 'v3') {
+        const packId = coverageManifest.pack.pack;
+        if (typeof packId !== 'string' || packId.length === 0) {
+            return { kind: 'no_reference', projectRoot, pack: null, registry: null, manifest: coverageManifest };
+        }
+    }
     const source = coverageManifest.kind === 'v3'
         ? (() => {
             const resolution = (0, source_1.resolveSensorSource)(coverageManifest, { registries: (0, registries_1.listRegistries)() });

package/dist/src/commands/sensors/init.js

@@ -117,13 +117,15 @@ function readPackDefaults(pack, registryRoot, cwd) {
     return sensors;
 }
 function buildManifest(pack, existing, registryRoot, cwd = process.cwd()) {
-    const fromPack = registryRoot ? readPackDefaults(pack, registryRoot, cwd) : null;
+    const fromPack = typeof pack === 'string' && pack.length > 0 && registryRoot
+        ? readPackDefaults(pack, registryRoot, cwd)
+        : null;
     // No registry root, or the pack has no pack.json there → `{}` is the honest floor,
     // not a bug to paper over with CLI-hardcoded defaults. `checkManifest` (preflight)
     // and `computeSensorStatus` both surface a zero-sensor manifest as degraded, with a
     // remedy pointing at the registry — never silently inventing sensors here instead.
     const defaults = fromPack ?? {};
-    const existingSensors = existing?.sensors ?? {};
+    const existingSensors = (existing?.sensors ?? {});
     // Per-FIELD merge, not whole-sensor-object replacement: if `existingSensors.foo`
     // exists at all, a naive `{ ...defaults, ...existingSensors }` would replace
     // `defaults.foo` wholesale, permanently dropping any field that only lives in the
@@ -132,11 +134,22 @@ function buildManifest(pack, existing, registryRoot, cwd = process.cwd()) {
     // field-by-field within each sensor entry lets a user's hand-edited field (e.g. a
     // custom `cmd`) win, while still inheriting any field the existing manifest doesn't
     // specify.
+    //
+    // Exception — `source: "project"` entries are project-owned: never overlay pack
+    // defaults onto them (RF-3.1). Keep the entry byte-stable in meaning.
     const sensorNames = new Set([...Object.keys(defaults), ...Object.keys(existingSensors)]);
     const sensors = {};
     for (const name of sensorNames) {
+        const existingEntry = existingSensors[name];
+        if (existingEntry && existingEntry.source === 'project') {
+            sensors[name] = { ...existingEntry };
+            continue;
+        }
         sensors[name] = { ...defaults[name], ...existingSensors[name] };
     }
+    // Only-project write path: omit pack entirely — never invent `generic` (RF-3.2).
+    if (typeof pack !== 'string' || pack.length === 0)
+        return { sensors };
     return { pack, sensors };
 }
 async function initSensors(opts = {}) {

package/dist/src/commands/sensors/migrate.js

@@ -172,10 +172,11 @@ function planV2Migration(input) {
     if (validated.kind !== 'v3' || validated.pack.mode !== 'project-sensors') {
         throw new Error('v2 migration candidate semantic mismatch');
     }
-    const equivalence = compareV2Semantics(parsed.pack, validated.pack, source.registry.name);
+    const packBound = (0, manifest_1.asPackBoundProjectSensors)(validated.pack);
+    const equivalence = compareV2Semantics(parsed.pack, packBound, source.registry.name);
     if (!allEquivalent(equivalence))
         throw new Error('v2 migration candidate semantic mismatch');
-    return { candidate: validated.pack, equivalent: true, equivalence };
+    return { candidate: packBound, equivalent: true, equivalence };
 }
 /** Validate the old and new durable contracts, then atomically replace only the manifest. */
 function replaceV2ManifestWithV3(manifestPath, candidate, source) {
@@ -203,17 +204,18 @@ function replaceV2ManifestWithV3(manifestPath, candidate, source) {
         if (before.kind !== 'v2' || after.kind !== 'v3' || after.pack.mode !== 'project-sensors') {
             throw new Error('v2 migration candidate semantic mismatch');
         }
+        const afterPack = (0, manifest_1.asPackBoundProjectSensors)(after.pack);
         const logicalSource = exactLogicalSource(source, before.pack.pack);
         assertSourceCompatibleWithManifest(logicalSource, before.pack);
-        if (after.pack.source.registry !== logicalSource.registry.name) {
+        if (afterPack.source.registry !== logicalSource.registry.name) {
             throw new Error('v2 migration candidate semantic mismatch');
         }
         if (hasPhysicalSensorPath(before.pack.sensors, [before.pack.registryRoot, logicalSource.registry.contentRoot])
-            || hasPhysicalSensorPath(after.pack.sensors, [before.pack.registryRoot, logicalSource.registry.contentRoot])
-            || hasPhysicalSensorPath(before.pack.packageRoot, []) || hasPhysicalSensorPath(after.pack.packageRoot, [])) {
+            || hasPhysicalSensorPath(afterPack.sensors, [before.pack.registryRoot, logicalSource.registry.contentRoot])
+            || hasPhysicalSensorPath(before.pack.packageRoot, []) || hasPhysicalSensorPath(afterPack.packageRoot, [])) {
             throw new Error('v2 migration candidate contains a physical path');
         }
-        if (!allEquivalent(compareV2Semantics(before.pack, after.pack, logicalSource.registry.name))) {
+        if (!allEquivalent(compareV2Semantics(before.pack, afterPack, logicalSource.registry.name))) {
             throw new Error('v2 migration candidate semantic mismatch');
         }
         // The native implementation reopens every ancestor without following links,
@@ -255,10 +257,11 @@ function replaceLegacyManifestWithV3(manifestPath, candidate, source) {
         if (before.kind !== 'legacy' || after.kind !== 'v3' || after.pack.mode !== 'project-sensors') {
             throw new Error('legacy migration candidate semantic mismatch');
         }
-        const logicalSource = exactLogicalSource({ kind: 'logical', source }, after.pack.pack);
-        assertSourceCompatibleWithCandidate(logicalSource, after.pack);
-        if (after.pack.source.registry !== logicalSource.registry.name || hasPhysicalSensorPath(after.pack.sensors, [logicalSource.registry.contentRoot])
-            || hasPhysicalSensorPath(after.pack.packageRoot, [])) {
+        const afterPack = (0, manifest_1.asPackBoundProjectSensors)(after.pack);
+        const logicalSource = exactLogicalSource({ kind: 'logical', source }, afterPack.pack);
+        assertSourceCompatibleWithCandidate(logicalSource, afterPack);
+        if (afterPack.source.registry !== logicalSource.registry.name || hasPhysicalSensorPath(afterPack.sensors, [logicalSource.registry.contentRoot])
+            || hasPhysicalSensorPath(afterPack.packageRoot, [])) {
             throw new Error('legacy migration candidate contains an unsafe source or physical path');
         }
         assertManifestUnchanged(manifestPath, inspected);