agentic-workflow-manager 9.4.0 → 9.5.0

package/dist/src/commands/sensors/project.js

@@ -0,0 +1,107 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSensorProject = resolveSensorProject;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const util_1 = require("util");
+const manifest_1 = require("./compatibility/manifest");
+function regularManifest(manifestPath) {
+    try {
+        const stat = fs_1.default.lstatSync(manifestPath);
+        return stat.isFile() && !stat.isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+function gitMarker(directory) {
+    try {
+        const stat = fs_1.default.lstatSync(path_1.default.join(directory, '.git'));
+        return stat.isDirectory() || stat.isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function manifestResolution(projectRoot) {
+    const manifestPath = path_1.default.join(projectRoot, '.awm', 'sensors.json');
+    try {
+        fs_1.default.lstatSync(manifestPath);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { state: 'missing', projectRoot, manifestPath };
+        return { state: 'invalid', projectRoot, manifestPath, reason: 'sensor manifest cannot be inspected' };
+    }
+    if (!regularManifest(manifestPath))
+        return { state: 'invalid', projectRoot, manifestPath, reason: 'sensor manifest must be a regular file' };
+    try {
+        let text;
+        try {
+            text = new util_1.TextDecoder('utf-8', { fatal: true }).decode(fs_1.default.readFileSync(manifestPath));
+        }
+        catch {
+            return { state: 'invalid', projectRoot, manifestPath, reason: 'sensor manifest must be valid UTF-8' };
+        }
+        const manifest = (0, manifest_1.parseSensorManifest)(JSON.parse(text), manifestPath);
+        let configuredPackageRoot;
+        if (manifest.kind === 'v2')
+            configuredPackageRoot = manifest.pack.packageRoot;
+        if (manifest.kind === 'v3' && manifest.pack.mode === 'project-sensors')
+            configuredPackageRoot = manifest.pack.packageRoot;
+        const packageRoot = configuredPackageRoot ? path_1.default.resolve(projectRoot, configuredPackageRoot) : projectRoot;
+        if (!fs_1.default.existsSync(packageRoot) || !fs_1.default.statSync(packageRoot).isDirectory()) {
+            return { state: 'invalid', projectRoot, manifestPath, reason: 'packageRoot must name an existing directory' };
+        }
+        const realProjectRoot = fs_1.default.realpathSync(projectRoot);
+        const realPackageRoot = fs_1.default.realpathSync(packageRoot);
+        const relative = path_1.default.relative(realProjectRoot, realPackageRoot);
+        if (relative === '..' || relative.startsWith(`..${path_1.default.sep}`) || path_1.default.isAbsolute(relative)) {
+            return { state: 'invalid', projectRoot, manifestPath, reason: 'packageRoot escapes the manifest directory' };
+        }
+        return { state: 'configured', projectRoot, manifestPath, packageRoot, manifest };
+    }
+    catch (error) {
+        return { state: 'invalid', projectRoot, manifestPath, reason: error instanceof Error ? error.message : 'sensor manifest could not be parsed' };
+    }
+}
+/** Resolves one manifest authority, never crossing a Git worktree boundary. */
+function resolveSensorProject(startCwd) {
+    if (typeof startCwd !== 'string' || startCwd.length === 0)
+        throw new Error('startCwd must be a nonempty directory path');
+    let directory;
+    try {
+        directory = fs_1.default.realpathSync(path_1.default.resolve(startCwd));
+    }
+    catch {
+        throw new Error(`startCwd does not exist: ${startCwd}`);
+    }
+    if (!fs_1.default.statSync(directory).isDirectory())
+        throw new Error(`startCwd is not a directory: ${startCwd}`);
+    let boundary = null;
+    let probe = directory;
+    while (true) {
+        if (gitMarker(probe)) {
+            boundary = probe;
+            break;
+        }
+        const parent = path_1.default.dirname(probe);
+        if (parent === probe)
+            break;
+        probe = parent;
+    }
+    if (boundary === null)
+        return manifestResolution(directory);
+    let current = directory;
+    while (true) {
+        const resolved = manifestResolution(current);
+        if (resolved.state !== 'missing')
+            return resolved;
+        if (current === boundary)
+            return resolved;
+        current = path_1.default.dirname(current);
+    }
+}

package/dist/src/commands/sensors/run.js

@@ -4,11 +4,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.applyBaseline = void 0;
-exports.detectPackDrift = detectPackDrift;
 exports.findManifestDir = findManifestDir;
+exports.detectPackDrift = detectPackDrift;
 exports.resolveConcurrency = resolveConcurrency;
 exports.runSensors = runSensors;
-const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const baseline_1 = require("./baseline");
@@ -18,24 +17,35 @@ const changed_1 = require("./changed");
 // Solo `detectStack` (puro, lee el arbol) — NO `initSensors`, que escribe. `run` es un
 // verbo de lectura: no debe tener a mano ninguna funcion capaz de mutar el proyecto.
 const init_1 = require("./init");
-const manifest_1 = require("./compatibility/manifest");
 const live_1 = require("./compatibility/live");
+const contract_1 = require("./compatibility/contract");
+const source_1 = require("./compatibility/source");
+const registries_1 = require("../../core/registries");
 const prepare_1 = require("./prepare");
 const verdict_1 = require("./verdict");
-const MANIFEST_FILE = '.awm/sensors.json';
-const DEFAULT_FAST_TIMEOUT = 10_000;
-const DEFAULT_SLOW_TIMEOUT = 120_000;
+const project_1 = require("./project");
 // Sensor JSON output can be several MB on large repos (e.g. `eslint --format json`
 // with thousands of findings). A 1MB cap killed the child with SIGTERM when
 // exceeded — which previously surfaced as a false "timeout".
 const MAX_BUFFER = 64 * 1024 * 1024;
 /** Hard ceiling on parallel sensors: past this, they only contend for the same cores. */
 const MAX_CONCURRENCY = 4;
-async function resolveLiveV2(cwd, manifest) {
-    if (manifest.kind !== 'v2')
+async function resolveLiveFromSource(cwd, source, packSelection) {
+    try {
+        const parsed = (0, contract_1.parseSensorPack)(JSON.parse(source.content), source.path);
+        if (parsed.kind !== 'v2')
+            return null;
+        return await (0, live_1.resolveParsedPackCompatibility)(cwd, parsed.pack, { packSelection });
+    }
+    catch {
         return null;
+    }
+}
+/** Compatibility adapter retained for the baseline command; authority selection is shared. */
+function findManifestDir(startCwd) {
     try {
-        return await (0, live_1.resolveLiveCompatibility)(cwd, manifest.pack.pack, manifest.pack.registryRoot, { packSelection: manifest.pack.packSelection });
+        const project = (0, project_1.resolveSensorProject)(startCwd);
+        return project.state === 'configured' ? project.projectRoot : null;
     }
     catch {
         return null;
@@ -69,26 +79,6 @@ function detectPackDrift(manifestDir, manifest) {
         },
     };
 }
-/**
- * Walk up from `startCwd` looking for the nearest ancestor that contains
- * `.awm/sensors.json` (git/.git pattern). Returns that directory, or null
- * if none is found before the filesystem root.
- */
-function findManifestDir(startCwd) {
-    let dir = path_1.default.resolve(startCwd);
-    while (true) {
-        if (fs_1.default.existsSync(path_1.default.join(dir, MANIFEST_FILE)))
-            return dir;
-        // Temp directories are test/scratch boundaries, never project ancestors.
-        // This prevents an unrelated /tmp/.awm from being adopted by a fresh project.
-        if (dir === path_1.default.resolve(os_1.default.tmpdir()))
-            return null;
-        const parent = path_1.default.dirname(dir);
-        if (parent === dir)
-            return null; // reached filesystem root
-        dir = parent;
-    }
-}
 function shouldRun(isFast, opts) {
     if (opts.all)
         return true;
@@ -135,15 +125,38 @@ async function pooled(tasks, limit) {
  */
 async function runSensors(opts = {}) {
     (0, prepare_1.validateRunOptions)(opts);
-    const manifestDir = findManifestDir(opts.cwd ?? process.cwd());
-    if (!manifestDir)
-        return { sensors: [], overall: 'not_certified' };
-    let parsed;
+    let project;
     try {
-        parsed = (0, manifest_1.parseSensorManifest)(JSON.parse(fs_1.default.readFileSync(path_1.default.join(manifestDir, MANIFEST_FILE), 'utf8')), path_1.default.join(manifestDir, MANIFEST_FILE));
+        project = (0, project_1.resolveSensorProject)(opts.cwd ?? process.cwd());
     }
     catch {
-        return { sensors: [], overall: 'not_certified' };
+        const root = typeof opts.cwd === 'string' && opts.cwd.trim() !== '' ? path_1.default.resolve(opts.cwd) : process.cwd();
+        return { sensors: [], overall: 'not_certified', mode: 'invalid', reason: 'invalid-start-cwd', projectRoot: root, manifestPath: path_1.default.join(root, '.awm', 'sensors.json'), remedy: 'provide-an-existing-project-directory' };
+    }
+    if (project.state === 'missing') {
+        return { sensors: [], overall: 'not_certified', mode: 'missing', reason: 'manifest-absent', projectRoot: project.projectRoot, manifestPath: project.manifestPath, remedy: 'run-awm-sensors-bootstrap' };
+    }
+    if (project.state === 'invalid') {
+        const reason = project.reason.includes('unsupported manifest schemaVersion') ? 'schema-unsupported' : 'manifest-malformed';
+        return { sensors: [], overall: 'not_certified', mode: 'invalid', reason, projectRoot: project.projectRoot, manifestPath: project.manifestPath, remedy: 'repair-sensor-manifest' };
+    }
+    const manifestDir = project.projectRoot;
+    const parsed = project.manifest;
+    const authority = { projectRoot: project.projectRoot, manifestPath: project.manifestPath };
+    if (parsed.kind === 'v3' && (parsed.pack.mode === 'native-gate' || parsed.pack.mode === 'opt-out')) {
+        return { sensors: [], overall: 'not_certified', ...authority, mode: parsed.pack.mode, reason: `${parsed.pack.mode}-declared`, declarationReason: parsed.pack.reason };
+    }
+    let resolvedSource;
+    if (parsed.kind === 'v2' || parsed.kind === 'v3') {
+        try {
+            resolvedSource = (0, source_1.resolveSensorSource)(parsed, { registries: (0, registries_1.listRegistries)() });
+        }
+        catch {
+            return { sensors: [], overall: 'not_certified', ...authority, mode: 'invalid', reason: 'sensor-source-invalid', remedy: 'repair-or-run-awm-update' };
+        }
+        if (resolvedSource.kind === 'source-unavailable' || resolvedSource.kind === 'source-ambiguous') {
+            return { sensors: [], overall: 'not_certified', ...authority, mode: resolvedSource.kind, reason: resolvedSource.reason, remedy: resolvedSource.remedy, source: { kind: resolvedSource.kind, candidates: resolvedSource.kind === 'source-ambiguous' ? resolvedSource.candidates : undefined } };
+        }
     }
     const baseline = opts.ignoreBaseline ? null : (0, baseline_1.readBaseline)(manifestDir);
     const changed = opts.changed ? (0, changed_1.changedFiles)(manifestDir, opts.base ?? 'HEAD') : null;
@@ -159,22 +172,23 @@ async function runSensors(opts = {}) {
     // manifest itself stays discoverable at the repo root via findManifestDir.
     // Legacy manifests never carry this field — manifestDir is always correct
     // for them, unchanged.
-    const projectCwd = parsed.kind === 'v2' && parsed.pack.packageRoot
-        ? path_1.default.resolve(manifestDir, parsed.pack.packageRoot)
-        : manifestDir;
-    const live = parsed.kind === 'v2' ? await resolveLiveV2(projectCwd, parsed) : null;
+    const projectCwd = project.packageRoot;
+    const live = parsed.kind !== 'legacy' && resolvedSource && 'source' in resolvedSource
+        ? await resolveLiveFromSource(projectCwd, resolvedSource.source, 'packSelection' in parsed.pack ? parsed.pack.packSelection : undefined)
+        : null;
     const drift = parsed.kind === 'legacy' ? detectPackDrift(manifestDir, parsed.pack) : undefined;
     const requestedScope = opts.changed ? 'changed' : 'full';
     const prepared = [];
-    for (const [name, sensor] of Object.entries(parsed.pack.sensors)) {
-        const liveSensor = parsed.kind === 'v2' ? live?.pack.sensors[name] : undefined;
-        const fast = parsed.kind === 'v2'
+    const activeManifest = parsed.pack;
+    for (const [name, sensor] of Object.entries(activeManifest.sensors)) {
+        const liveSensor = parsed.kind !== 'legacy' ? live?.pack.sensors[name] : undefined;
+        const fast = parsed.kind !== 'legacy'
             ? sensor.fast ?? liveSensor?.fast ?? false
             : sensor.fast ?? false;
         if (!shouldRun(fast, opts))
             continue;
-        const execution = parsed.kind === 'v2'
-            ? (0, prepare_1.prepareV2Sensor)({ name, sensor, liveSensor, liveState: live?.sensors[name], requestedScope, changed: changed ?? undefined })
+        const execution = parsed.kind !== 'legacy'
+            ? (0, prepare_1.prepareV2Sensor)({ name, sensor: sensor, liveSensor, liveState: live?.sensors[name], requestedScope, changed: changed ?? undefined })
             : (0, prepare_1.prepareLegacySensor)({ name, config: sensor, requestedScope, changed: changed ?? undefined });
         prepared.push(sensor.enabled === false
             ? { ...execution, command: undefined, syntheticStatus: 'skipped', syntheticReason: 'disabled' }
@@ -183,7 +197,7 @@ async function runSensors(opts = {}) {
     const results = await pooled(prepared.map(entry => async () => {
         const result = await (0, result_1.executePrepared)(entry, projectCwd);
         return baseline ? (0, result_1.applyBaseline)(result, baseline[entry.name]) : result;
-    }), resolveConcurrency(parsed.pack, prepared.length));
+    }), resolveConcurrency(activeManifest, prepared.length));
     let overall = (0, verdict_1.reduceVerdict)(results);
     // Legacy commands retain operational compatibility but their shell-backed
     // contract cannot certify a green run.
@@ -194,6 +208,11 @@ async function runSensors(opts = {}) {
     return {
         sensors: results,
         overall,
+        ...authority,
+        mode: 'project-sensors',
+        reason: parsed.kind === 'legacy' ? 'legacy-v1' : resolvedSource?.kind === 'logical' ? 'configured-v3' : resolvedSource?.kind,
+        ...(parsed.kind !== 'legacy' && resolvedSource && 'source' in resolvedSource
+            ? { source: { kind: resolvedSource.kind, registry: resolvedSource.source.registry.name } } : {}),
         ...(drift?.drift ? { packDrift: drift.drift } : {}),
         ...(changed ? { changedScope: { files: changed.files.length, ...(changed.error ? { error: changed.error } : {}) } } : {}),
     };

package/dist/src/commands/sensors/status.js

@@ -7,11 +7,12 @@ exports.computeSensorStatus = computeSensorStatus;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const paths_1 = require("../../core/paths");
-const manifest_1 = require("./compatibility/manifest");
 const contract_1 = require("./compatibility/contract");
 const discovery_1 = require("./compatibility/discovery");
-const pack_source_1 = require("./compatibility/pack-source");
 const resolve_1 = require("./compatibility/resolve");
+const project_1 = require("./project");
+const source_1 = require("./compatibility/source");
+const registries_1 = require("../../core/registries");
 /** First non-flag token after `npx` — the tool the command actually runs. */
 function npxTool(parts) {
     for (let i = 1; i < parts.length; i++) {
@@ -94,10 +95,7 @@ function checkStructuredCommand(command, cwd, assets = []) {
  * into a health check. A selected variant still proves that its current tool
  * and runtime ranges are compatible; its probe state remains unverifiable.
  */
-function resolveStaticV2Compatibility(cwd, manifest) {
-    const source = manifest.registryRoot === undefined
-        ? (0, pack_source_1.resolvePackSource)(manifest.pack)
-        : (0, pack_source_1.resolvePackSource)(manifest.pack, { registries: [{ name: 'manifest-provenance', remote: 'local', contentRoot: manifest.registryRoot }] });
+function resolveStaticV2Compatibility(cwd, manifest, source) {
     const parsed = (0, contract_1.parseSensorPack)(JSON.parse(source.content), source.path);
     if (parsed.kind !== 'v2')
         throw new Error(`sensor pack "${manifest.pack}" does not provide a v2 compatibility contract`);
@@ -135,57 +133,104 @@ function staticCompatibilityCheck(sensor, live) {
     }
     return null;
 }
-async function computeSensorStatus(cwd = process.cwd()) {
-    const manifestPath = path_1.default.join(cwd, '.awm', 'sensors.json');
-    if (!fs_1.default.existsSync(manifestPath)) {
-        return { overall: 'NOT_CONFIGURED', pack: null, checks: {} };
+function resolvedSourceMetadata(source) {
+    return {
+        reason: source.kind === 'logical' ? 'configured-v3' : source.kind,
+        source: { kind: source.kind, registry: source.source.registry.name },
+    };
+}
+function projectMetadata(project, mode, reason, extra = {}) {
+    return {
+        mode, reason, projectRoot: project.projectRoot, manifestPath: project.manifestPath,
+        ...(project.state === 'configured' ? { packageRoot: project.packageRoot } : {}),
+        ...extra,
+    };
+}
+function sourceFailure(project, pack, source) {
+    if (source.kind === 'source-unavailable') {
+        return {
+            overall: 'DEGRADED', pack, checks: {},
+            ...projectMetadata(project, 'source-unavailable', source.reason, { remedy: source.remedy }),
+        };
     }
-    let manifest;
+    return {
+        overall: 'DEGRADED', pack, checks: {},
+        ...projectMetadata(project, 'source-ambiguous', source.reason, { remedy: source.remedy, candidates: source.candidates }),
+    };
+}
+function invalidStatus(project, pack, reason = 'manifest-malformed', remedy = 'repair-sensor-manifest') {
+    return {
+        overall: 'DEGRADED', pack, checks: {},
+        ...projectMetadata(project, 'invalid', reason, { remedy }),
+    };
+}
+async function computeSensorStatus(cwd = process.cwd()) {
+    let project;
     try {
-        const raw = JSON.parse(fs_1.default.readFileSync(manifestPath, 'utf-8'));
-        const parsed = (0, manifest_1.parseSensorManifest)(raw, manifestPath);
-        if (parsed.kind === 'v2') {
-            // Monorepo support (mirrors run.ts/init.ts): detection and structured-command
-            // asset resolution both need to see the real package, not the (possibly
-            // unrelated) directory the manifest lives in.
-            const projectCwd = parsed.pack.packageRoot ? path_1.default.resolve(cwd, parsed.pack.packageRoot) : cwd;
-            const checks = {};
-            let compatibility;
-            try {
-                compatibility = resolveStaticV2Compatibility(projectCwd, parsed.pack);
-            }
-            catch (error) {
-                const detail = error instanceof Error ? error.message : 'live compatibility unavailable';
-                for (const [name, sensor] of Object.entries(parsed.pack.sensors)) {
-                    checks[name] = sensor.enabled === false ? { ok: true, detail: 'disabled' } : { ok: false, detail };
-                }
-                return { overall: 'DEGRADED', pack: parsed.pack.pack, checks };
-            }
-            for (const [name, sensor] of Object.entries(parsed.pack.sensors)) {
-                if (sensor.enabled === false) {
-                    checks[name] = { ok: true, detail: 'disabled' };
-                    continue;
-                }
-                checks[name] = staticCompatibilityCheck(sensor, compatibility[name])
-                    ?? checkStructuredCommand(sensor.command, projectCwd, sensor.assets);
-            }
-            return { overall: Object.keys(checks).length > 0 && Object.values(checks).every(check => check.ok) ? 'READY' : 'DEGRADED', pack: parsed.pack.pack, checks };
-        }
-        manifest = parsed.pack;
+        project = (0, project_1.resolveSensorProject)(cwd);
     }
     catch {
-        // Preserve the historic diagnostic path for a hand-edited legacy manifest:
-        // malformed v2 is fail-closed, while a legacy `sensors:null` is surfaced as
-        // degraded rather than crashing the status command.
+        const root = typeof cwd === 'string' && cwd.trim() !== '' ? path_1.default.resolve(cwd) : process.cwd();
+        return { overall: 'DEGRADED', pack: null, checks: {}, mode: 'invalid', reason: 'invalid-start-cwd', projectRoot: root, manifestPath: path_1.default.join(root, '.awm', 'sensors.json'), remedy: 'provide-an-existing-project-directory' };
+    }
+    if (project.state === 'missing') {
+        return { overall: 'NOT_CONFIGURED', pack: null, checks: {}, ...projectMetadata(project, 'missing', 'manifest-absent', { remedy: 'run-awm-sensors-bootstrap' }) };
+    }
+    if (project.state === 'invalid') {
+        let pack = null;
         try {
-            const raw = JSON.parse(fs_1.default.readFileSync(manifestPath, 'utf-8'));
+            const raw = JSON.parse(fs_1.default.readFileSync(project.manifestPath, 'utf-8'));
             if (raw && typeof raw === 'object' && !Array.isArray(raw) && !('schemaVersion' in raw) && typeof raw.pack === 'string') {
-                return { overall: 'DEGRADED', pack: raw.pack, checks: {} };
+                pack = raw.pack;
             }
         }
         catch { /* malformed JSON is not configured */ }
-        return { overall: 'NOT_CONFIGURED', pack: null, checks: {} };
+        const reason = project.reason.includes('unsupported manifest schemaVersion') ? 'schema-unsupported' : 'manifest-malformed';
+        return invalidStatus(project, pack, reason);
     }
+    const packageRoot = project.packageRoot;
+    const parsed = project.manifest;
+    if (parsed.kind === 'v3' && parsed.pack.mode !== 'project-sensors') {
+        return {
+            overall: 'NOT_CONFIGURED', pack: null, checks: {},
+            ...projectMetadata(project, parsed.pack.mode, `${parsed.pack.mode}-declared`, { declarationReason: parsed.pack.reason }),
+        };
+    }
+    if (parsed.kind === 'v2' || parsed.kind === 'v3') {
+        const parsedPack = parsed.pack;
+        let resolution;
+        try {
+            resolution = (0, source_1.resolveSensorSource)(parsed, { registries: (0, registries_1.listRegistries)() });
+        }
+        catch {
+            return invalidStatus(project, parsedPack.pack, 'sensor-source-invalid', 'repair-or-run-awm-update');
+        }
+        if (!('source' in resolution))
+            return sourceFailure(project, parsedPack.pack, resolution);
+        const sourceMeta = resolvedSourceMetadata(resolution);
+        const manifest = parsedPack;
+        const checks = {};
+        let compatibility;
+        try {
+            compatibility = resolveStaticV2Compatibility(packageRoot, manifest, resolution.source);
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : 'live compatibility unavailable';
+            for (const [name, sensor] of Object.entries(manifest.sensors))
+                checks[name] = sensor.enabled === false ? { ok: true, detail: 'disabled' } : { ok: false, detail };
+            return { overall: 'DEGRADED', pack: manifest.pack, checks, ...projectMetadata(project, 'project-sensors', sourceMeta.reason, { ...sourceMeta }) };
+        }
+        for (const [name, sensor] of Object.entries(manifest.sensors)) {
+            checks[name] = sensor.enabled === false ? { ok: true, detail: 'disabled' }
+                : staticCompatibilityCheck(sensor, compatibility[name]) ?? checkStructuredCommand(sensor.command, packageRoot, sensor.assets);
+        }
+        return {
+            overall: Object.keys(checks).length > 0 && Object.values(checks).every(check => check.ok) ? 'READY' : 'DEGRADED',
+            pack: manifest.pack, checks,
+            ...projectMetadata(project, 'project-sensors', sourceMeta.reason, { ...sourceMeta }),
+        };
+    }
+    const manifest = parsed.pack;
     const checks = {};
     for (const [name, config] of Object.entries(manifest.sensors ?? {})) {
         if (config.enabled === false) {
@@ -196,14 +241,10 @@ async function computeSensorStatus(cwd = process.cwd()) {
             checks[name] = { ok: false, detail: 'no cmd configured' };
             continue;
         }
-        checks[name] = checkCmd(config.cmd, cwd);
-    }
-    // `Object.values({}).every(...)` is vacuously true — a manifest with zero sensor
-    // entries (the registry had no pack.json for this stack; see init.ts) must not read
-    // as READY just because there was nothing to fail. Same false-green `checkManifest`
-    // guards against in preflight.
-    if (Object.keys(manifest.sensors ?? {}).length === 0) {
-        return { overall: 'DEGRADED', pack: manifest.pack, checks };
+        checks[name] = checkCmd(config.cmd, packageRoot);
     }
-    return { overall: Object.values(checks).every(check => check.ok) ? 'READY' : 'DEGRADED', pack: manifest.pack, checks };
+    return {
+        overall: Object.keys(manifest.sensors ?? {}).length > 0 && Object.values(checks).every(check => check.ok) ? 'READY' : 'DEGRADED',
+        pack: manifest.pack, checks, ...projectMetadata(project, 'project-sensors', 'legacy-v1'),
+    };
 }

package/dist/src/core/currentness/check.js

@@ -10,7 +10,7 @@ const config_1 = require("../../utils/config");
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 const TIMEOUT_MS = 2_000;
 const MAX_OUTPUT_BYTES = 64 * 1024;
-const NPM_SOURCE = `https://registry.npmjs.org/${cli_version_1.CLI_PACKAGE_NAME}`;
+const NPM_SOURCE = `https://registry.npmjs.org/${cli_version_1.CLI_PACKAGE_NAME}/latest`;
 const STRICT_SEMVER = /^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
 function deadline(operation, timeoutMs = TIMEOUT_MS) {
     let timer;
@@ -106,8 +106,7 @@ async function latestCli(fetchImpl) {
         const body = JSON.parse(text);
         if (!body || typeof body !== 'object')
             return null;
-        const tags = body['dist-tags'];
-        const latest = tags && typeof tags === 'object' ? tags.latest : undefined;
+        const latest = body.version;
         return typeof latest === 'string' && parseVersion(latest) ? latest : null;
     }
     catch {
@@ -199,8 +198,8 @@ async function checkCurrentness(cwd, deps = {}) {
     const cli = !parseVersion(installedCli) || !latest || compareStrict(installedCli, latest) === null
         ? unavailable('cli', NPM_SOURCE, checkedAt, parseVersion(installedCli) ? installedCli : null)
         : compareStrict(installedCli, latest) === 0
-            ? { component: 'cli', installed: installedCli, latest, channel: 'stable', source: NPM_SOURCE, checkedAt, status: 'current', detail: 'Installed version equals npm dist-tags.latest.', remedy: 'No action required.' }
-            : { component: 'cli', installed: installedCli, latest, channel: 'stable', source: NPM_SOURCE, checkedAt, status: 'stale', detail: 'Installed version is behind npm dist-tags.latest.', remedy: `npm i -g ${cli_version_1.CLI_PACKAGE_NAME}@latest && rerun in a fresh process` };
+            ? { component: 'cli', installed: installedCli, latest, channel: 'stable', source: NPM_SOURCE, checkedAt, status: 'current', detail: 'Installed version equals the npm latest release.', remedy: 'No action required.' }
+            : { component: 'cli', installed: installedCli, latest, channel: 'stable', source: NPM_SOURCE, checkedAt, status: 'stale', detail: 'Installed version is behind the npm latest release.', remedy: `npm i -g ${cli_version_1.CLI_PACKAGE_NAME}@latest && rerun in a fresh process` };
     const components = [cli];
     let registries;
     try {

package/dist/tests/commands/preflight/preflight.test.js

@@ -718,4 +718,35 @@ describe('preflight', () => {
         // not the old hardcoded 9 — the shorter id's row must carry visible padding.
         expect(lines[0]).toMatch(/host {12,}@@marker/);
     });
+    it.each([
+        ['native-gate', 'CI is the authority.', 'native_gate', 'native-gate-declared'],
+        ['opt-out', 'No local gate is required.', 'ungated', 'opt-out-declared'],
+    ])('exposes stable authority metadata for %s', async (mode, declarationReason, status, reason) => {
+        const dir = make({ manifest: { schemaVersion: 3, mode, reason: declarationReason } });
+        const report = await (0, checks_1.preflight)(dir);
+        expect(report).toMatchObject({
+            status,
+            mode,
+            reason,
+            projectRoot: dir,
+            manifestPath: path_1.default.join(dir, '.awm', 'sensors.json'),
+            remedy: expect.any(String),
+        });
+        expect((0, preflight_1.exitCodeFor)(report)).toBe(1);
+        expect(report.status).not.toBe('ready');
+    });
+    it('derives manifest and tools checks from the same shared authority result', async () => {
+        const dir = make({ manifest: '{not valid json' });
+        const report = await (0, checks_1.preflight)(dir);
+        expect(report).toMatchObject({
+            status: 'degraded',
+            mode: 'invalid',
+            reason: 'manifest-malformed',
+            projectRoot: dir,
+            manifestPath: path_1.default.join(dir, '.awm', 'sensors.json'),
+            remedy: expect.any(String),
+        });
+        expect(check(report, 'manifest').detail).not.toContain('no .awm/sensors.json');
+        expect(check(report, 'tools')).toBeUndefined();
+    });
 });

package/dist/tests/commands/sensors/compatibility/manifest.test.js

@@ -38,6 +38,29 @@ describe('sensor manifest contract', () => {
         expect((0, manifest_1.parseSensorManifest)(manifest, 'sensors.json')).toMatchObject({ kind: 'v2', pack: manifest });
         expect(JSON.parse((0, manifest_1.serializeManifestV2)(manifest))).toEqual(manifest);
     });
+    it('parses the three exact v3 modes without physical registry provenance', () => {
+        const project = {
+            schemaVersion: 3,
+            mode: 'project-sensors',
+            pack: 'js-ts',
+            source: { registry: 'baseline' },
+            packageRoot: 'cli',
+            sensors: validV2Manifest().sensors,
+        };
+        expect((0, manifest_1.parseSensorManifest)(project, 'sensors.json')).toMatchObject({
+            kind: 'v3',
+            pack: { mode: 'project-sensors', source: { registry: 'baseline' }, packageRoot: 'cli' },
+        });
+        expect((0, manifest_1.parseSensorManifest)({ schemaVersion: 3, mode: 'native-gate', reason: 'managed by platform' }, 'sensors.json')).toMatchObject({
+            kind: 'v3', pack: { mode: 'native-gate', reason: 'managed by platform' },
+        });
+        expect((0, manifest_1.parseSensorManifest)({ schemaVersion: 3, mode: 'opt-out', reason: 'not applicable' }, 'sensors.json')).toMatchObject({
+            kind: 'v3', pack: { mode: 'opt-out', reason: 'not applicable' },
+        });
+        expect(() => (0, manifest_1.parseSensorManifest)({ ...project, source: { registry: 'Baseline' } }, 'sensors.json')).toThrow('registry');
+        expect(() => (0, manifest_1.parseSensorManifest)({ schemaVersion: 3, mode: 'native-gate' }, 'sensors.json')).toThrow('reason');
+        expect(() => (0, manifest_1.parseSensorManifest)({ ...project, registryRoot: '/machine/root' }, 'sensors.json')).toThrow('unknown field');
+    });
     it('accepts and serializes a positive v2 project timeout (R3)', () => {
         const manifest = validV2Manifest();
         manifest.sensors.lint.timeout = 45_000;