agentic-workflow-manager 9.4.1 → 9.6.0

package/dist/src/commands/sensors/migrate.js

@@ -0,0 +1,209 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.planV2Migration = planV2Migration;
+exports.replaceV2ManifestWithV3 = replaceV2ManifestWithV3;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const contract_1 = require("./compatibility/contract");
+const manifest_1 = require("./compatibility/manifest");
+const safe_file_1 = require("./compatibility/safe-file");
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function sameSensorField(v2, v3, pick) {
+    const names = Object.keys(v2.sensors);
+    return names.length === Object.keys(v3.sensors).length
+        && names.every(name => name in v3.sensors && JSON.stringify(pick(v2.sensors[name])) === JSON.stringify(pick(v3.sensors[name])));
+}
+function compareV2Semantics(v2, v3, registry) {
+    return Object.freeze({
+        pack: v2.pack === v3.pack && v2.packSelection === v3.packSelection,
+        enabledDisabled: sameSensorField(v2, v3, sensor => sensor.enabled),
+        structuredCommands: sameSensorField(v2, v3, sensor => sensor.command),
+        assets: sameSensorField(v2, v3, sensor => sensor.assets),
+        timeouts: sameSensorField(v2, v3, sensor => sensor.timeout),
+        fast: sameSensorField(v2, v3, sensor => sensor.fast),
+        variants: sameSensorField(v2, v3, sensor => sensor.variantId),
+        policies: sameSensorField(v2, v3, sensor => sensor.policyRef),
+        sensorIdentityAndOrder: JSON.stringify(Object.keys(v2.sensors)) === JSON.stringify(Object.keys(v3.sensors)),
+        concurrency: v2.concurrency === v3.concurrency,
+        compatibilityEvidence: sameSensorField(v2, v3, sensor => sensor.initializedCompatibility),
+        packageRoot: v2.packageRoot === v3.packageRoot,
+        logicalSourceBinding: v3.source.registry === registry,
+    });
+}
+function allEquivalent(report) {
+    return Object.values(report).every(value => value === true);
+}
+function exactLogicalSource(input, pack) {
+    if (!isRecord(input))
+        throw new Error('v2 migration source is required');
+    if (input.kind === 'source-unavailable')
+        throw new Error('v2 migration source is unavailable');
+    if (input.kind === 'source-ambiguous')
+        throw new Error('v2 migration source is ambiguous');
+    if ((input.kind !== 'logical' && input.kind !== 'legacy-rebound') || !isRecord(input.source))
+        throw new Error('v2 migration source must be a unique logical resolution');
+    const source = input.source;
+    if (Object.keys(source).some(key => !['path', 'content', 'registry'].includes(key))
+        || typeof source.path !== 'string' || typeof source.content !== 'string' || !isRecord(source.registry)) {
+        throw new Error('v2 migration source must contain an exact resolved pack');
+    }
+    const registry = source.registry;
+    if (Object.keys(registry).some(key => !['name', 'remote', 'contentRoot'].includes(key))
+        || typeof registry.name !== 'string' || !/^[a-z][a-z0-9-]*$/.test(registry.name)
+        || typeof registry.remote !== 'string' || registry.remote.trim() === '' || /[\0\r\n]/.test(registry.remote)
+        || typeof registry.contentRoot !== 'string' || !path_1.default.isAbsolute(registry.contentRoot) || path_1.default.normalize(registry.contentRoot) !== registry.contentRoot) {
+        throw new Error('v2 migration source registry must be a stable logical registry');
+    }
+    // `resolveSensorSource` already selected and read this exact source. The
+    // migration planner consumes that immutable snapshot; re-canonicalizing its
+    // host directory would make a no-write plan depend on later filesystem state.
+    const expectedPath = path_1.default.join(registry.contentRoot, 'sensor-packs', pack, 'pack.json');
+    if (source.path !== expectedPath)
+        throw new Error('v2 migration source must contain an exact resolved pack');
+    let parsedSource;
+    try {
+        parsedSource = (0, contract_1.parseSensorPack)(JSON.parse(source.content), 'v2 migration resolved source');
+    }
+    catch {
+        throw new Error('v2 migration source exact v2 pack is invalid');
+    }
+    if (parsedSource.kind !== 'v2' || parsedSource.pack.name !== pack)
+        throw new Error('v2 migration source must contain the exact v2 pack');
+    return source;
+}
+function assertSourceCompatibleWithManifest(source, manifest) {
+    let parsedSource;
+    try {
+        parsedSource = (0, contract_1.parseSensorPack)(JSON.parse(source.content), 'v2 migration resolved source');
+    }
+    catch {
+        throw new Error('v2 migration source exact v2 pack is invalid');
+    }
+    if (parsedSource.kind !== 'v2' || parsedSource.pack.name !== manifest.pack) {
+        throw new Error('v2 migration source must contain the exact v2 pack');
+    }
+    for (const [name, sensor] of Object.entries(manifest.sensors)) {
+        const selected = parsedSource.pack.sensors[name];
+        if (!selected || !selected.variants.some(variant => variant.id === sensor.variantId)) {
+            throw new Error('v2 migration source is not compatible with selected manifest sensors');
+        }
+    }
+}
+function hasPhysicalSensorPath(value, registryRoots) {
+    if (typeof value === 'string') {
+        const normalized = path_1.default.posix.normalize(value.replace(/\\/g, '/')).toLowerCase();
+        const withoutWebUrls = value.replace(/https?:\/\/[^\s"']+/gi, '');
+        const roots = registryRoots
+            .filter((root) => typeof root === 'string' && root.length > 0)
+            .map(root => path_1.default.posix.normalize(root.replace(/\\/g, '/')).toLowerCase());
+        const hasAbsolutePathAtTokenBoundary = /(?:^|[^A-Za-z0-9_.~\/\\-])["']?(?:\/|\\|[A-Za-z]:|\/\/)/.test(withoutWebUrls);
+        return roots.some(root => normalized.includes(root))
+            || hasAbsolutePathAtTokenBoundary;
+    }
+    return Array.isArray(value) ? value.some(item => hasPhysicalSensorPath(item, registryRoots))
+        : isRecord(value) && Object.values(value).some(item => hasPhysicalSensorPath(item, registryRoots));
+}
+function inspectManifest(manifestPath, failure) {
+    let stat;
+    try {
+        stat = fs_1.default.lstatSync(manifestPath, { bigint: true });
+    }
+    catch {
+        throw failure('open');
+    }
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw failure('regular');
+    return { stat, ...(0, safe_file_1.readInspectedBoundedFileWithIdentity)(manifestPath, stat, 1024 * 1024, failure) };
+}
+function assertManifestUnchanged(manifestPath, original) {
+    const changed = () => new Error('v2 migration original manifest changed before commit');
+    const current = inspectManifest(manifestPath, () => changed());
+    if (current.stat.dev !== original.stat.dev || current.stat.ino !== original.stat.ino
+        || current.stat.size !== original.stat.size || !current.content.equals(original.content)) {
+        throw changed();
+    }
+}
+/** Build, but never persist, a portable v3 replacement for a validated v2 manifest. */
+function planV2Migration(input) {
+    if (!input || typeof input !== 'object')
+        throw new Error('v2 migration input is required');
+    const parsed = (0, manifest_1.parseSensorManifest)(input.manifest, 'v2 migration manifest');
+    if (parsed.kind !== 'v2')
+        throw new Error('v2 migration requires a v2 project-sensors manifest');
+    const source = exactLogicalSource(input.source, parsed.pack.pack);
+    assertSourceCompatibleWithManifest(source, parsed.pack);
+    if (hasPhysicalSensorPath(parsed.pack.sensors, [parsed.pack.registryRoot, source.registry.contentRoot])
+        || hasPhysicalSensorPath(parsed.pack.packageRoot, []))
+        throw new Error('v2 migration sensor semantics contain a physical path');
+    const candidate = {
+        schemaVersion: 3,
+        mode: 'project-sensors',
+        pack: parsed.pack.pack,
+        ...(parsed.pack.packSelection === 'explicit' ? { packSelection: 'explicit' } : {}),
+        source: { registry: source.registry.name },
+        ...(parsed.pack.packageRoot ? { packageRoot: parsed.pack.packageRoot } : {}),
+        sensors: parsed.pack.sensors,
+        ...(parsed.pack.concurrency ? { concurrency: parsed.pack.concurrency } : {}),
+    };
+    const validated = (0, manifest_1.parseSensorManifest)(candidate, 'v2 migration candidate');
+    if (validated.kind !== 'v3' || validated.pack.mode !== 'project-sensors') {
+        throw new Error('v2 migration candidate semantic mismatch');
+    }
+    const equivalence = compareV2Semantics(parsed.pack, validated.pack, source.registry.name);
+    if (!allEquivalent(equivalence))
+        throw new Error('v2 migration candidate semantic mismatch');
+    return { candidate: validated.pack, equivalent: true, equivalence };
+}
+/** Validate the old and new durable contracts, then atomically replace only the manifest. */
+function replaceV2ManifestWithV3(manifestPath, candidate, source) {
+    if (typeof manifestPath !== 'string' || !path_1.default.isAbsolute(manifestPath) || path_1.default.normalize(manifestPath) !== manifestPath
+        || manifestPath.includes('\0') || path_1.default.basename(manifestPath) !== 'sensors.json'
+        || path_1.default.basename(path_1.default.dirname(manifestPath)) !== '.awm') {
+        throw new Error('v2 migration manifest path must be the canonical project manifest <project>/.awm/sensors.json');
+    }
+    const manifestDirectory = path_1.default.dirname(manifestPath);
+    const projectRoot = path_1.default.dirname(manifestDirectory);
+    const destination = '.awm/sensors.json';
+    (0, safe_file_1.withProjectLease)(projectRoot, () => {
+        const originalFailure = (_reason) => new Error('v2 migration original manifest must be readable JSON');
+        let inspected;
+        let original;
+        try {
+            inspected = inspectManifest(manifestPath, originalFailure);
+            original = JSON.parse(inspected.content.toString('utf8'));
+        }
+        catch {
+            throw new Error('v2 migration original manifest must be readable JSON');
+        }
+        const before = (0, manifest_1.parseSensorManifest)(original, manifestPath);
+        const after = (0, manifest_1.parseSensorManifest)(candidate, 'v2 migration candidate');
+        if (before.kind !== 'v2' || after.kind !== 'v3' || after.pack.mode !== 'project-sensors') {
+            throw new Error('v2 migration candidate semantic mismatch');
+        }
+        const logicalSource = exactLogicalSource(source, before.pack.pack);
+        assertSourceCompatibleWithManifest(logicalSource, before.pack);
+        if (after.pack.source.registry !== logicalSource.registry.name) {
+            throw new Error('v2 migration candidate semantic mismatch');
+        }
+        if (hasPhysicalSensorPath(before.pack.sensors, [before.pack.registryRoot, logicalSource.registry.contentRoot])
+            || hasPhysicalSensorPath(after.pack.sensors, [before.pack.registryRoot, logicalSource.registry.contentRoot])
+            || hasPhysicalSensorPath(before.pack.packageRoot, []) || hasPhysicalSensorPath(after.pack.packageRoot, [])) {
+            throw new Error('v2 migration candidate contains a physical path');
+        }
+        if (!allEquivalent(compareV2Semantics(before.pack, after.pack, logicalSource.registry.name))) {
+            throw new Error('v2 migration candidate semantic mismatch');
+        }
+        // The native implementation reopens every ancestor without following links,
+        // verifies these exact bytes at the publication fence, and preserves a
+        // competing target instead of replacing it.
+        assertManifestUnchanged(manifestPath, inspected);
+        (0, safe_file_1.writeProjectFile)(projectRoot, destination, Buffer.from((0, manifest_1.serializeManifestV3)(after.pack), 'utf8'), {
+            mode: 'replace', expected: inspected.content, expectedIdentity: inspected.identity, createParents: false,
+        });
+    });
+}

package/dist/src/commands/sensors/project.js

@@ -0,0 +1,107 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSensorProject = resolveSensorProject;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const util_1 = require("util");
+const manifest_1 = require("./compatibility/manifest");
+function regularManifest(manifestPath) {
+    try {
+        const stat = fs_1.default.lstatSync(manifestPath);
+        return stat.isFile() && !stat.isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+function gitMarker(directory) {
+    try {
+        const stat = fs_1.default.lstatSync(path_1.default.join(directory, '.git'));
+        return stat.isDirectory() || stat.isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function manifestResolution(projectRoot) {
+    const manifestPath = path_1.default.join(projectRoot, '.awm', 'sensors.json');
+    try {
+        fs_1.default.lstatSync(manifestPath);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { state: 'missing', projectRoot, manifestPath };
+        return { state: 'invalid', projectRoot, manifestPath, reason: 'sensor manifest cannot be inspected' };
+    }
+    if (!regularManifest(manifestPath))
+        return { state: 'invalid', projectRoot, manifestPath, reason: 'sensor manifest must be a regular file' };
+    try {
+        let text;
+        try {
+            text = new util_1.TextDecoder('utf-8', { fatal: true }).decode(fs_1.default.readFileSync(manifestPath));
+        }
+        catch {
+            return { state: 'invalid', projectRoot, manifestPath, reason: 'sensor manifest must be valid UTF-8' };
+        }
+        const manifest = (0, manifest_1.parseSensorManifest)(JSON.parse(text), manifestPath);
+        let configuredPackageRoot;
+        if (manifest.kind === 'v2')
+            configuredPackageRoot = manifest.pack.packageRoot;
+        if (manifest.kind === 'v3' && manifest.pack.mode === 'project-sensors')
+            configuredPackageRoot = manifest.pack.packageRoot;
+        const packageRoot = configuredPackageRoot ? path_1.default.resolve(projectRoot, configuredPackageRoot) : projectRoot;
+        if (!fs_1.default.existsSync(packageRoot) || !fs_1.default.statSync(packageRoot).isDirectory()) {
+            return { state: 'invalid', projectRoot, manifestPath, reason: 'packageRoot must name an existing directory' };
+        }
+        const realProjectRoot = fs_1.default.realpathSync(projectRoot);
+        const realPackageRoot = fs_1.default.realpathSync(packageRoot);
+        const relative = path_1.default.relative(realProjectRoot, realPackageRoot);
+        if (relative === '..' || relative.startsWith(`..${path_1.default.sep}`) || path_1.default.isAbsolute(relative)) {
+            return { state: 'invalid', projectRoot, manifestPath, reason: 'packageRoot escapes the manifest directory' };
+        }
+        return { state: 'configured', projectRoot, manifestPath, packageRoot, manifest };
+    }
+    catch (error) {
+        return { state: 'invalid', projectRoot, manifestPath, reason: error instanceof Error ? error.message : 'sensor manifest could not be parsed' };
+    }
+}
+/** Resolves one manifest authority, never crossing a Git worktree boundary. */
+function resolveSensorProject(startCwd) {
+    if (typeof startCwd !== 'string' || startCwd.length === 0)
+        throw new Error('startCwd must be a nonempty directory path');
+    let directory;
+    try {
+        directory = fs_1.default.realpathSync(path_1.default.resolve(startCwd));
+    }
+    catch {
+        throw new Error(`startCwd does not exist: ${startCwd}`);
+    }
+    if (!fs_1.default.statSync(directory).isDirectory())
+        throw new Error(`startCwd is not a directory: ${startCwd}`);
+    let boundary = null;
+    let probe = directory;
+    while (true) {
+        if (gitMarker(probe)) {
+            boundary = probe;
+            break;
+        }
+        const parent = path_1.default.dirname(probe);
+        if (parent === probe)
+            break;
+        probe = parent;
+    }
+    if (boundary === null)
+        return manifestResolution(directory);
+    let current = directory;
+    while (true) {
+        const resolved = manifestResolution(current);
+        if (resolved.state !== 'missing')
+            return resolved;
+        if (current === boundary)
+            return resolved;
+        current = path_1.default.dirname(current);
+    }
+}

package/dist/src/commands/sensors/run.js

@@ -4,11 +4,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.applyBaseline = void 0;
-exports.detectPackDrift = detectPackDrift;
 exports.findManifestDir = findManifestDir;
+exports.detectPackDrift = detectPackDrift;
 exports.resolveConcurrency = resolveConcurrency;
 exports.runSensors = runSensors;
-const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const baseline_1 = require("./baseline");
@@ -17,25 +16,36 @@ Object.defineProperty(exports, "applyBaseline", { enumerable: true, get: functio
 const changed_1 = require("./changed");
 // Solo `detectStack` (puro, lee el arbol) — NO `initSensors`, que escribe. `run` es un
 // verbo de lectura: no debe tener a mano ninguna funcion capaz de mutar el proyecto.
-const init_1 = require("./init");
-const manifest_1 = require("./compatibility/manifest");
+const detection_1 = require("./detection");
 const live_1 = require("./compatibility/live");
+const contract_1 = require("./compatibility/contract");
+const source_1 = require("./compatibility/source");
+const registries_1 = require("../../core/registries");
 const prepare_1 = require("./prepare");
 const verdict_1 = require("./verdict");
-const MANIFEST_FILE = '.awm/sensors.json';
-const DEFAULT_FAST_TIMEOUT = 10_000;
-const DEFAULT_SLOW_TIMEOUT = 120_000;
+const project_1 = require("./project");
 // Sensor JSON output can be several MB on large repos (e.g. `eslint --format json`
 // with thousands of findings). A 1MB cap killed the child with SIGTERM when
 // exceeded — which previously surfaced as a false "timeout".
 const MAX_BUFFER = 64 * 1024 * 1024;
 /** Hard ceiling on parallel sensors: past this, they only contend for the same cores. */
 const MAX_CONCURRENCY = 4;
-async function resolveLiveV2(cwd, manifest) {
-    if (manifest.kind !== 'v2')
+async function resolveLiveFromSource(cwd, source, packSelection) {
+    try {
+        const parsed = (0, contract_1.parseSensorPack)(JSON.parse(source.content), source.path);
+        if (parsed.kind !== 'v2')
+            return null;
+        return await (0, live_1.resolveParsedPackCompatibility)(cwd, parsed.pack, { packSelection });
+    }
+    catch {
         return null;
+    }
+}
+/** Compatibility adapter retained for the baseline command; authority selection is shared. */
+function findManifestDir(startCwd) {
     try {
-        return await (0, live_1.resolveLiveCompatibility)(cwd, manifest.pack.pack, manifest.pack.registryRoot, { packSelection: manifest.pack.packSelection });
+        const project = (0, project_1.resolveSensorProject)(startCwd);
+        return project.state === 'configured' ? project.projectRoot : null;
     }
     catch {
         return null;
@@ -57,7 +67,7 @@ async function resolveLiveV2(cwd, manifest) {
  * and failed on by preflight's `pack` check.
  */
 function detectPackDrift(manifestDir, manifest) {
-    const detection = (0, init_1.detectStack)(manifestDir);
+    const detection = (0, detection_1.detectStack)(manifestDir);
     if (manifest.pack !== 'generic' || detection.pack === 'generic')
         return { detection };
     return {
@@ -69,26 +79,6 @@ function detectPackDrift(manifestDir, manifest) {
         },
     };
 }
-/**
- * Walk up from `startCwd` looking for the nearest ancestor that contains
- * `.awm/sensors.json` (git/.git pattern). Returns that directory, or null
- * if none is found before the filesystem root.
- */
-function findManifestDir(startCwd) {
-    let dir = path_1.default.resolve(startCwd);
-    while (true) {
-        if (fs_1.default.existsSync(path_1.default.join(dir, MANIFEST_FILE)))
-            return dir;
-        // Temp directories are test/scratch boundaries, never project ancestors.
-        // This prevents an unrelated /tmp/.awm from being adopted by a fresh project.
-        if (dir === path_1.default.resolve(os_1.default.tmpdir()))
-            return null;
-        const parent = path_1.default.dirname(dir);
-        if (parent === dir)
-            return null; // reached filesystem root
-        dir = parent;
-    }
-}
 function shouldRun(isFast, opts) {
     if (opts.all)
         return true;
@@ -135,15 +125,38 @@ async function pooled(tasks, limit) {
  */
 async function runSensors(opts = {}) {
     (0, prepare_1.validateRunOptions)(opts);
-    const manifestDir = findManifestDir(opts.cwd ?? process.cwd());
-    if (!manifestDir)
-        return { sensors: [], overall: 'not_certified' };
-    let parsed;
+    let project;
     try {
-        parsed = (0, manifest_1.parseSensorManifest)(JSON.parse(fs_1.default.readFileSync(path_1.default.join(manifestDir, MANIFEST_FILE), 'utf8')), path_1.default.join(manifestDir, MANIFEST_FILE));
+        project = (0, project_1.resolveSensorProject)(opts.cwd ?? process.cwd());
     }
     catch {
-        return { sensors: [], overall: 'not_certified' };
+        const root = typeof opts.cwd === 'string' && opts.cwd.trim() !== '' ? path_1.default.resolve(opts.cwd) : process.cwd();
+        return { sensors: [], overall: 'not_certified', mode: 'invalid', reason: 'invalid-start-cwd', projectRoot: root, manifestPath: path_1.default.join(root, '.awm', 'sensors.json'), remedy: 'provide-an-existing-project-directory' };
+    }
+    if (project.state === 'missing') {
+        return { sensors: [], overall: 'not_certified', mode: 'missing', reason: 'manifest-absent', projectRoot: project.projectRoot, manifestPath: project.manifestPath, remedy: 'run-awm-sensors-bootstrap' };
+    }
+    if (project.state === 'invalid') {
+        const reason = project.reason.includes('unsupported manifest schemaVersion') ? 'schema-unsupported' : 'manifest-malformed';
+        return { sensors: [], overall: 'not_certified', mode: 'invalid', reason, projectRoot: project.projectRoot, manifestPath: project.manifestPath, remedy: 'repair-sensor-manifest' };
+    }
+    const manifestDir = project.projectRoot;
+    const parsed = project.manifest;
+    const authority = { projectRoot: project.projectRoot, manifestPath: project.manifestPath };
+    if (parsed.kind === 'v3' && (parsed.pack.mode === 'native-gate' || parsed.pack.mode === 'opt-out')) {
+        return { sensors: [], overall: 'not_certified', ...authority, mode: parsed.pack.mode, reason: `${parsed.pack.mode}-declared`, declarationReason: parsed.pack.reason };
+    }
+    let resolvedSource;
+    if (parsed.kind === 'v2' || parsed.kind === 'v3') {
+        try {
+            resolvedSource = (0, source_1.resolveSensorSource)(parsed, { registries: (0, registries_1.listRegistries)() });
+        }
+        catch {
+            return { sensors: [], overall: 'not_certified', ...authority, mode: 'invalid', reason: 'sensor-source-invalid', remedy: 'repair-or-run-awm-update' };
+        }
+        if (resolvedSource.kind === 'source-unavailable' || resolvedSource.kind === 'source-ambiguous') {
+            return { sensors: [], overall: 'not_certified', ...authority, mode: resolvedSource.kind, reason: resolvedSource.reason, remedy: resolvedSource.remedy, source: { kind: resolvedSource.kind, candidates: resolvedSource.kind === 'source-ambiguous' ? resolvedSource.candidates : undefined } };
+        }
     }
     const baseline = opts.ignoreBaseline ? null : (0, baseline_1.readBaseline)(manifestDir);
     const changed = opts.changed ? (0, changed_1.changedFiles)(manifestDir, opts.base ?? 'HEAD') : null;
@@ -159,22 +172,23 @@ async function runSensors(opts = {}) {
     // manifest itself stays discoverable at the repo root via findManifestDir.
     // Legacy manifests never carry this field — manifestDir is always correct
     // for them, unchanged.
-    const projectCwd = parsed.kind === 'v2' && parsed.pack.packageRoot
-        ? path_1.default.resolve(manifestDir, parsed.pack.packageRoot)
-        : manifestDir;
-    const live = parsed.kind === 'v2' ? await resolveLiveV2(projectCwd, parsed) : null;
+    const projectCwd = project.packageRoot;
+    const live = parsed.kind !== 'legacy' && resolvedSource && 'source' in resolvedSource
+        ? await resolveLiveFromSource(projectCwd, resolvedSource.source, 'packSelection' in parsed.pack ? parsed.pack.packSelection : undefined)
+        : null;
     const drift = parsed.kind === 'legacy' ? detectPackDrift(manifestDir, parsed.pack) : undefined;
     const requestedScope = opts.changed ? 'changed' : 'full';
     const prepared = [];
-    for (const [name, sensor] of Object.entries(parsed.pack.sensors)) {
-        const liveSensor = parsed.kind === 'v2' ? live?.pack.sensors[name] : undefined;
-        const fast = parsed.kind === 'v2'
+    const activeManifest = parsed.pack;
+    for (const [name, sensor] of Object.entries(activeManifest.sensors)) {
+        const liveSensor = parsed.kind !== 'legacy' ? live?.pack.sensors[name] : undefined;
+        const fast = parsed.kind !== 'legacy'
             ? sensor.fast ?? liveSensor?.fast ?? false
             : sensor.fast ?? false;
         if (!shouldRun(fast, opts))
             continue;
-        const execution = parsed.kind === 'v2'
-            ? (0, prepare_1.prepareV2Sensor)({ name, sensor, liveSensor, liveState: live?.sensors[name], requestedScope, changed: changed ?? undefined })
+        const execution = parsed.kind !== 'legacy'
+            ? (0, prepare_1.prepareV2Sensor)({ name, sensor: sensor, liveSensor, liveState: live?.sensors[name], requestedScope, changed: changed ?? undefined })
             : (0, prepare_1.prepareLegacySensor)({ name, config: sensor, requestedScope, changed: changed ?? undefined });
         prepared.push(sensor.enabled === false
             ? { ...execution, command: undefined, syntheticStatus: 'skipped', syntheticReason: 'disabled' }
@@ -183,7 +197,7 @@ async function runSensors(opts = {}) {
     const results = await pooled(prepared.map(entry => async () => {
         const result = await (0, result_1.executePrepared)(entry, projectCwd);
         return baseline ? (0, result_1.applyBaseline)(result, baseline[entry.name]) : result;
-    }), resolveConcurrency(parsed.pack, prepared.length));
+    }), resolveConcurrency(activeManifest, prepared.length));
     let overall = (0, verdict_1.reduceVerdict)(results);
     // Legacy commands retain operational compatibility but their shell-backed
     // contract cannot certify a green run.
@@ -194,6 +208,11 @@ async function runSensors(opts = {}) {
     return {
         sensors: results,
         overall,
+        ...authority,
+        mode: 'project-sensors',
+        reason: parsed.kind === 'legacy' ? 'legacy-v1' : resolvedSource?.kind === 'logical' ? 'configured-v3' : resolvedSource?.kind,
+        ...(parsed.kind !== 'legacy' && resolvedSource && 'source' in resolvedSource
+            ? { source: { kind: resolvedSource.kind, registry: resolvedSource.source.registry.name } } : {}),
         ...(drift?.drift ? { packDrift: drift.drift } : {}),
         ...(changed ? { changedScope: { files: changed.files.length, ...(changed.error ? { error: changed.error } : {}) } } : {}),
     };