agentic-workflow-manager 9.7.1 → 9.9.0

package/dist/tests/commands/sensors/bootstrap.test.js

@@ -10,7 +10,7 @@ jest.mock('../../../src/commands/sensors/compatibility/pack-source', () => ({ li
 jest.mock('../../../src/commands/sensors/compatibility/contract', () => ({ ...jest.requireActual('../../../src/commands/sensors/compatibility/contract'), parseSensorPack: jest.fn() }));
 jest.mock('../../../src/commands/sensors/compatibility/live', () => ({ resolveParsedPackCompatibility: jest.fn() }));
 jest.mock('../../../src/commands/sensors/compatibility/source', () => ({ resolveSensorSource: jest.fn() }));
-jest.mock('../../../src/commands/sensors/migrate', () => ({ planV2Migration: jest.fn(), replaceV2ManifestWithV3: jest.fn() }));
+jest.mock('../../../src/commands/sensors/migrate', () => ({ planV2Migration: jest.fn(), replaceV2ManifestWithV3: jest.fn(), replaceLegacyManifestWithV3: jest.fn() }));
 jest.mock('../../../src/commands/sensors/compatibility/materialize', () => ({ materializePortableSensors: jest.fn() }));
 jest.mock('../../../src/commands/sensors/compatibility/safe-file', () => ({ writeProjectFile: jest.fn(), withProjectLease: jest.fn((_root, operation) => operation()) }));
 const bootstrap_1 = require("../../../src/commands/sensors/bootstrap");
@@ -22,6 +22,7 @@ const live_1 = require("../../../src/commands/sensors/compatibility/live");
 const source_1 = require("../../../src/commands/sensors/compatibility/source");
 const migrate_1 = require("../../../src/commands/sensors/migrate");
 const migrate_2 = require("../../../src/commands/sensors/migrate");
+const migrate_3 = require("../../../src/commands/sensors/migrate");
 const materialize_1 = require("../../../src/commands/sensors/compatibility/materialize");
 const safe_file_1 = require("../../../src/commands/sensors/compatibility/safe-file");
 const fs_1 = __importDefault(require("fs"));
@@ -66,9 +67,27 @@ describe('planSensorBootstrap', () => {
         await expect((0, bootstrap_1.planSensorBootstrap)(root)).resolves.toMatchObject({ kind: 'blocked', reason: 'no-compatible-registry', changes: [] });
         expect(migrate_1.planV2Migration).not.toHaveBeenCalled();
     });
-    it('preserves a legacy v1 manifest and blocks an ambiguous v2 source without writes', async () => {
-        project_1.resolveSensorProject.mockReturnValueOnce({ state: 'configured', projectRoot: root, manifestPath: `${root}/.awm/sensors.json`, packageRoot: root, manifest: { kind: 'legacy', pack: { pack: 'js-ts', sensors: {}, compatibility: {} } } });
-        await expect((0, bootstrap_1.planSensorBootstrap)(root)).resolves.toMatchObject({ kind: 'blocked', reason: 'legacy-v1-preserved', changes: [] });
+    it('requires explicit project-sensors mode before replacing a legacy v1 manifest', async () => {
+        const project = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-bootstrap-legacy-'));
+        const manifestPath = path_1.default.join(project, '.awm', 'sensors.json');
+        const variant = { id: 'eslint-9', command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] }, assets: [] };
+        const pack = { schemaVersion: 2, name: 'js-ts', sensors: { lint: { variants: [variant] } } };
+        try {
+            fs_1.default.mkdirSync(path_1.default.dirname(manifestPath), { recursive: true });
+            fs_1.default.writeFileSync(manifestPath, JSON.stringify({ pack: 'js-ts', sensors: { lint: { cmd: 'npx eslint .' } } }));
+            project_1.resolveSensorProject.mockReturnValue({ state: 'configured', projectRoot: project, manifestPath, packageRoot: project, manifest: { kind: 'legacy', pack: { pack: 'js-ts', sensors: { lint: { cmd: 'npx eslint .' } }, compatibility: {} } } });
+            pack_source_1.listPackSources.mockReturnValue([source]);
+            contract_1.parseSensorPack.mockReturnValue({ kind: 'v2', pack });
+            live_1.resolveParsedPackCompatibility.mockResolvedValue({ pack, sensors: { lint: { state: 'certified', reason: 'ok', variantId: 'eslint-9', toolVersion: '9.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=9 <10', evidence: [] } } });
+            await expect((0, bootstrap_1.planSensorBootstrap)(project)).resolves.toMatchObject({ kind: 'blocked', reason: 'legacy-replacement-requires-project-sensors-mode', changes: [] });
+            await expect((0, bootstrap_1.planSensorBootstrap)(project, { mode: 'project-sensors' })).resolves.toMatchObject({ kind: 'migrate', changes: [{ path: '.awm/sensors.json', action: 'replace' }], migration: { kind: 'legacy-v1' }, source });
+            // A legacy manifest identifies the old pack; it is not an explicit
+            // opt-in to every optional sensor in that pack.
+            expect(live_1.resolveParsedPackCompatibility).toHaveBeenCalledWith(project, pack);
+        }
+        finally {
+            fs_1.default.rmSync(project, { recursive: true, force: true });
+        }
         project_1.resolveSensorProject.mockReturnValueOnce({ state: 'configured', projectRoot: root, manifestPath: `${root}/.awm/sensors.json`, packageRoot: root, manifest: { kind: 'v2', pack: { schemaVersion: 2, pack: 'js-ts', sensors: {} } } });
         source_1.resolveSensorSource.mockReturnValue({ kind: 'source-ambiguous', reason: 'multiple-compatible-registries', remedy: 'configure-one-logical-registry', candidates: ['a', 'b'] });
         await expect((0, bootstrap_1.planSensorBootstrap)(root)).resolves.toMatchObject({ kind: 'blocked', reason: 'multiple-compatible-registries', changes: [] });
@@ -116,6 +135,25 @@ describe('planSensorBootstrap', () => {
         live_1.resolveParsedPackCompatibility.mockResolvedValue({ pack: { schemaVersion: 2, name: 'js-ts', sensors: { lint: { variants: [variant] } } }, sensors: { lint: { variantId: null } } });
         await expect((0, bootstrap_1.planSensorBootstrap)(root, { mode: 'project-sensors' })).resolves.toMatchObject({ kind: 'blocked', reason: 'sensor-variant-unresolvable', changes: [] });
     });
+    it('omits explicit-opt-in sensors that are not applicable while retaining mandatory gates', async () => {
+        const variant = { id: 'main', command: { executable: 'tool', resolution: 'path', args: ['run'] }, assets: [] };
+        const pack = { schemaVersion: 2, name: 'js-ts', sensors: {
+                security: { variants: [variant] }, test: { variants: [variant] },
+                format: { applicability: { kind: 'explicit-opt-in' }, variants: [variant] },
+                mutation: { applicability: { kind: 'explicit-opt-in' }, variants: [variant] },
+            } };
+        pack_source_1.listPackSources.mockReturnValue([source]);
+        contract_1.parseSensorPack.mockReturnValue({ kind: 'v2', pack });
+        live_1.resolveParsedPackCompatibility.mockResolvedValue({ pack, sensors: {
+                security: { state: 'certified', reason: 'range-and-probe', variantId: 'main', toolVersion: '1.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=1', evidence: [] },
+                test: { state: 'certified', reason: 'range-and-probe', variantId: 'main', toolVersion: '1.0.0', runtimeVersion: '24.0.0', certifiedRange: '>=1', evidence: [] },
+                format: { state: 'not-applicable', reason: 'applicability-not-met', variantId: null, toolVersion: null, runtimeVersion: null, certifiedRange: null, evidence: [] },
+                mutation: { state: 'not-applicable', reason: 'applicability-not-met', variantId: null, toolVersion: null, runtimeVersion: null, certifiedRange: null, evidence: [] },
+            } });
+        const plan = await (0, bootstrap_1.planSensorBootstrap)(root, { mode: 'project-sensors' });
+        expect(plan).toMatchObject({ kind: 'create', manifest: { sensors: { security: expect.any(Object), test: expect.any(Object) } } });
+        expect(Object.keys(plan.manifest.sensors)).toEqual(['security', 'test']);
+    });
     it('converts a compatibility probe failure into a stable blocked plan', async () => {
         pack_source_1.listPackSources.mockReturnValue([source]);
         contract_1.parseSensorPack.mockReturnValue({ kind: 'v2', pack: { schemaVersion: 2, name: 'js-ts', sensors: {} } });
@@ -159,6 +197,21 @@ describe('planSensorBootstrap', () => {
             fs_1.default.rmSync(project, { recursive: true, force: true });
         }
     });
+    it('delegates a legacy migration to its fenced CAS replacement', () => {
+        const project = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-bootstrap-legacy-'));
+        const manifestPath = path_1.default.join(project, 'sensors.json');
+        try {
+            const bytes = Buffer.from('{"pack":"js-ts","sensors":{}}\n');
+            fs_1.default.writeFileSync(manifestPath, bytes);
+            const manifest = { schemaVersion: 3, mode: 'project-sensors', pack: 'js-ts', source: { registry: 'baseline' }, sensors: {} };
+            const plan = { kind: 'migrate', projectRoot: project, manifestPath, dryRun: false, changes: [{ path: '.awm/sensors.json', action: 'replace' }], migration: { kind: 'legacy-v1', manifest }, source, originalDigest: (0, crypto_1.createHash)('sha256').update(bytes).digest('hex') };
+            expect((0, bootstrap_1.applySensorBootstrap)(plan)).toBe('migrated');
+            expect(migrate_3.replaceLegacyManifestWithV3).toHaveBeenCalledWith(plan.manifestPath, manifest, source);
+        }
+        finally {
+            fs_1.default.rmSync(project, { recursive: true, force: true });
+        }
+    });
     it('rejects a migration plan whose manifest changed after planning', () => {
         const project = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-bootstrap-stale-'));
         const manifestPath = path_1.default.join(project, 'sensors.json');

package/dist/tests/commands/sensors/compatibility/contract.test.js

@@ -134,6 +134,13 @@ describe('sensor pack v2 contract', () => {
     it('parses a valid versioned pack', () => {
         expect((0, contract_1.parseSensorPack)(validPack(), 'pack.json')).toMatchObject({ kind: 'v2', pack: validPack() });
     });
+    it('accepts the bounded explicit-opt-in applicability contract', () => {
+        const pack = validPack();
+        pack.sensors.lint.applicability = { kind: 'explicit-opt-in' };
+        expect((0, contract_1.parseSensorPack)(pack, 'pack.json')).toMatchObject({
+            kind: 'v2', pack: { sensors: { lint: { applicability: { kind: 'explicit-opt-in' } } } },
+        });
+    });
     it('accepts one standalone files placeholder in changedCommand (R4)', () => {
         const pack = validPack();
         pack.sensors.lint.variants[0].changedCommand = {
@@ -237,8 +244,22 @@ describe('sensor pack v2 contract', () => {
     it('rejects malformed applicability and probe extensions', () => {
         const variant = validPack().sensors.lint.variants[0];
         expect(() => (0, contract_1.parseSensorPack)({ ...validPack(), sensors: { lint: { applicability: { allFiles: [3] }, variants: [variant] } } }, 'pack')).toThrow('allFiles[0]');
+        expect(() => (0, contract_1.parseSensorPack)({ ...validPack(), sensors: { lint: { applicability: { kind: 'invented' }, variants: [variant] } } }, 'pack')).toThrow('applicability.kind');
         expect(() => (0, contract_1.parseSensorPack)({ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [{ ...variant, probe: { kind: 'version', extra: true } }] } } }, 'pack')).toThrow('unknown field');
     });
+    it('preserves historical unnamed probes while validating explicit script names', () => {
+        const variant = { ...validPack().sensors.lint.variants[0], probe: { kind: 'package-script-present', script: 'test' } };
+        expect((0, contract_1.parseSensorPack)({ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [variant] } } }, 'pack'))
+            .toMatchObject({ kind: 'v2', pack: { sensors: { lint: { variants: [{ probe: { kind: 'package-script-present', script: 'test' } }] } } } });
+        expect((0, contract_1.parseSensorPack)({ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [{ ...variant, probe: { kind: 'package-script-present' } }] } } }, 'pack'))
+            .toMatchObject({ kind: 'v2', pack: { sensors: { lint: { variants: [{ probe: { kind: 'package-script-present' } }] } } } });
+        for (const script of ['', null, 'test;echo unsafe', 'test\u0000']) {
+            expect(() => (0, contract_1.parseSensorPack)({ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [{ ...variant, probe: { kind: 'package-script-present', script } }] } } }, 'pack'))
+                .toThrow('probe.script');
+        }
+        expect(() => (0, contract_1.parseSensorPack)({ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [{ ...variant, probe: { kind: 'version', script: 'test' } }] } } }, 'pack'))
+            .toThrow('probe.script');
+    });
     it('preserves config selectors and validates package.json field names', () => {
         const variant = { ...validPack().sensors.lint.variants[0], requirements: { ...validPack().sensors.lint.variants[0].requirements, configFiles: ['eslint.config.js'], packageJsonFields: ['eslintConfig'] } };
         expect((0, contract_1.parseSensorPack)({ ...validPack(), sensors: { lint: { ...validPack().sensors.lint, variants: [variant] } } }, 'pack')).toMatchObject({ kind: 'v2', pack: { sensors: { lint: { variants: [{ requirements: { configFiles: ['eslint.config.js'], packageJsonFields: ['eslintConfig'] } }] } } } });

package/dist/tests/commands/sensors/compatibility/discovery.test.js

@@ -72,6 +72,25 @@ describe('discoverProjectEvidence', () => {
             fs_1.default.rmSync(root, { recursive: true, force: true });
         }
     });
+    it('takes a selected PATH package manager version only from its bounded executable provenance', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-package-manager-discovery-'));
+        const pathToolVersion = jest.fn((tool) => tool === 'npm' ? '10.9.2' : null);
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), JSON.stringify({ packageManager: 'npm@10.9.2', scripts: { test: 'jest' } }));
+            fs_1.default.mkdirSync(path_1.default.join(root, 'node_modules', 'npm'), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(root, 'node_modules', 'npm', 'package.json'), JSON.stringify({ version: '999.0.0' }));
+            const pack = { schemaVersion: 2, name: 'js-ts', detects: ['package.json'], sensors: {
+                    test: { applicability: { allFiles: ['package.json'] }, variants: [{ requirements: { tool: 'npm', runtime: 'node' }, command: { executable: 'npm', resolution: 'path', packageManager: 'npm' } }] },
+                } };
+            const evidence = (0, discovery_1.discoverProjectEvidence)(root, pack, { platform: () => 'darwin', pathToolVersion });
+            expect(pathToolVersion).toHaveBeenCalledWith('npm');
+            expect(evidence.toolVersions.npm).toBe('10.9.2');
+            expect(evidence.toolProvenance.npm).toBe('path');
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
     test.each([
         ['linux', ['.venv', 'lib', 'python3.12', 'site-packages']],
         ['win32', ['.venv', 'Lib', 'site-packages']],

package/dist/tests/commands/sensors/compatibility/probe.test.js

@@ -16,7 +16,7 @@ const evidence = { cwd: process.cwd(), configFiles: ['eslint.config.js'], script
 describe('runCompatibilityProbe', () => {
     beforeEach(() => fakeExecutor.mockClear());
     test.each(['eslint-print-config', 'typescript-show-config', 'semgrep-validate', 'version', 'package-script-present', 'config-present'])('runs the closed probe %s with sanitized output', async (kind) => {
-        const result = await (0, probe_1.runCompatibilityProbe)({ kind }, evidence, fakeExecutor);
+        const result = await (0, probe_1.runCompatibilityProbe)(kind === 'package-script-present' ? { kind, script: 'lint' } : { kind }, evidence, fakeExecutor);
         expect(['matched', 'unverifiable']).toContain(result.status);
         expect(JSON.stringify(result)).not.toContain('SECRET_VALUE');
     });
@@ -26,6 +26,19 @@ describe('runCompatibilityProbe', () => {
         fakeExecutor.mockResolvedValueOnce(execResult({ overflowed: true, stdout: 'ok' }));
         await expect((0, probe_1.runCompatibilityProbe)({ kind: 'version' }, evidence, fakeExecutor)).resolves.toMatchObject({ status: 'unverifiable' });
     });
+    it('matches only the registry-declared package script', async () => {
+        await expect((0, probe_1.runCompatibilityProbe)({ kind: 'package-script-present', script: 'test' }, { ...evidence, scripts: ['lint', 'test:unit'] }, fakeExecutor)).resolves.toMatchObject({ status: 'not-matched', reason: 'package-script' });
+        await expect((0, probe_1.runCompatibilityProbe)({ kind: 'package-script-present', script: 'test' }, { ...evidence, scripts: ['lint', 'test'] }, fakeExecutor)).resolves.toMatchObject({ status: 'matched', reason: 'package-script' });
+        expect(fakeExecutor).not.toHaveBeenCalled();
+    });
+    it('never certifies a historical unnamed package-script probe', async () => {
+        await expect((0, probe_1.runCompatibilityProbe)({ kind: 'package-script-present' }, { ...evidence, scripts: ['lint', 'test', 'test:unit'] }, fakeExecutor)).resolves.toEqual({ status: 'unverifiable', reason: 'package-script-name-required' });
+        expect(fakeExecutor).not.toHaveBeenCalled();
+    });
+    it.each(['', null, 'test;echo unsafe'])('rejects malformed explicit script %j', async (script) => {
+        await expect((0, probe_1.runCompatibilityProbe)({ kind: 'package-script-present', script }, evidence, fakeExecutor)).rejects.toThrow('requires a named package script');
+        expect(fakeExecutor).not.toHaveBeenCalled();
+    });
     it('binds tool probes to the project node_modules executable instead of PATH', async () => {
         await (0, probe_1.runCompatibilityProbe)({ kind: 'eslint-print-config' }, evidence, fakeExecutor);
         expect(fakeExecutor).toHaveBeenCalledWith(expect.objectContaining({ executable: 'eslint', resolution: 'node-modules-bin' }), expect.any(Object));

package/dist/tests/commands/sensors/compatibility/resolve.test.js

@@ -20,6 +20,13 @@ describe('resolveSensorCompatibility', () => {
         const resolved = (0, resolve_1.resolveProjectCompatibility)({ schemaVersion: 2, name: 'generic', sensors: { security: { applicability: { kind: 'explicit-or-supported-language' }, variants: [variant('semgrep')] } } }, evidence({ applicable: undefined, paths: [], packSelection: 'explicit' }));
         expect(resolved.sensors.security.state).not.toBe('not-applicable');
     });
+    it('keeps an explicit-opt-in sensor not-applicable until the project declares it', () => {
+        const optIn = { applicability: { kind: 'explicit-opt-in' }, variants: [variant('prettier')] };
+        expect((0, resolve_1.resolveSensorCompatibility)(optIn, evidence({ applicable: undefined, packSelection: undefined }), { pack: 'js-ts', sensor: 'format' }))
+            .toMatchObject({ state: 'not-applicable', reason: 'applicability-not-met', variantId: null });
+        expect((0, resolve_1.resolveSensorCompatibility)(optIn, evidence({ packSelection: 'explicit' }), { pack: 'js-ts', sensor: 'format' }))
+            .toMatchObject({ state: 'certified', variantId: 'prettier' });
+    });
     test.each([
         ['certified', evidence(), 'eslint-main'],
         ['compatible-unverified', evidence({ toolVersion: '11.0.0' }), 'eslint-main'],
@@ -33,6 +40,16 @@ describe('resolveSensorCompatibility', () => {
     it('preserves legacy behavior without executing a probe', () => {
         expect((0, resolve_1.resolveSensorCompatibility)({ defaultCmd: 'eslint .' }, evidence(), context)).toEqual((0, manifest_1.legacyCompatibility)('legacy pack without schemaVersion'));
     });
+    it('does not certify a PATH package manager from node_modules provenance', () => {
+        const packageManager = variant('npm-script');
+        packageManager.requirements = { tool: 'npm', toolRange: '>=10 <11', runtime: 'node', runtimeRange: '>=20' };
+        packageManager.command = { executable: 'npm', resolution: 'path', args: ['test'], packageManager: 'npm' };
+        const npmSensor = { applicability: { allFiles: ['package.json'] }, variants: [packageManager] };
+        expect((0, resolve_1.resolveSensorCompatibility)(npmSensor, evidence({ toolVersions: { npm: '10.9.2' }, runtimeVersions: { node: '24.0.0' }, toolProvenance: { npm: 'node-modules-bin' } }), context))
+            .toMatchObject({ state: 'missing-tool', reason: 'tool-not-found' });
+        expect((0, resolve_1.resolveSensorCompatibility)(npmSensor, evidence({ toolVersions: { npm: '10.9.2' }, runtimeVersions: { node: '24.0.0' }, toolProvenance: { npm: 'path' }, probe: { status: 'matched' } }), context))
+            .toMatchObject({ state: 'certified', variantId: 'npm-script' });
+    });
     it('fails an equal-precedence match with its pack, sensor, IDs, and ranges', () => {
         expect(() => (0, resolve_1.resolveProjectCompatibility)({ schemaVersion: 2, name: 'js-ts', sensors: { lint: { ...sensor, variants: [variant('one'), variant('two')] } } }, evidence())).toThrow(/js-ts.*lint.*one.*>=9 <12.*two.*>=9 <12/i);
     });

package/dist/tests/commands/sensors/coverage/evidence.test.js

@@ -27,21 +27,57 @@ const detector = {
         files: [{ path: 'eslint.config.js', containsAll: ['no-unreachable'] }],
     },
 };
-const noFollowUnavailableOnNativeWindows = process.platform === 'win32'
-    && typeof fs_1.default.constants.O_NOFOLLOW !== 'number';
-const regularFileStatus = (posixStatus) => noFollowUnavailableOnNativeWindows ? 'unverifiable' : posixStatus;
+function observeWithoutNoFollow(io, project = root) {
+    let result;
+    try {
+        jest.isolateModules(() => {
+            jest.doMock('fs', () => {
+                const actual = jest.requireActual('fs');
+                const constants = { ...actual.constants, O_NOFOLLOW: undefined };
+                return { __esModule: true, default: { ...actual, constants }, ...actual, constants };
+            });
+            const observe = require('../../../../src/commands/sensors/coverage/evidence').observeDetector;
+            result = observe(project, 'style', 0, detector, { cmd: 'eslint --config eslint.config.js' }, io);
+        });
+    }
+    finally {
+        jest.dontMock('fs');
+    }
+    if (!result)
+        throw new Error('portable evidence observer did not return a result');
+    return result;
+}
+test('native anchored evidence remains readable without O_NOFOLLOW', () => {
+    fs_1.default.writeFileSync(path_1.default.join(root, 'eslint.config.js'), 'no-unreachable');
+    expect(observeWithoutNoFollow()).toMatchObject({ status: 'covered' });
+});
+test('missing O_NOFOLLOW never lends native trust to injected IO', () => {
+    fs_1.default.writeFileSync(path_1.default.join(root, 'eslint.config.js'), 'no-unreachable');
+    expect(observeWithoutNoFollow({ lstatSync: fs_1.default.lstatSync })).toMatchObject({ status: 'unverifiable' });
+});
+test.each(['linked-leaf', 'oversize', 'missing-marker'])('native evidence without O_NOFOLLOW rejects %s', kind => {
+    const file = path_1.default.join(root, 'eslint.config.js');
+    if (kind === 'linked-leaf') {
+        const target = path_1.default.join(root, 'target.js');
+        fs_1.default.writeFileSync(target, 'no-unreachable');
+        fs_1.default.symlinkSync(target, file);
+    }
+    else
+        fs_1.default.writeFileSync(file, kind === 'oversize' ? Buffer.alloc(contract_1.MAX_COVERAGE_FILE_BYTES + 1) : 'different-rule');
+    expect(observeWithoutNoFollow().status).toBe(kind === 'missing-marker' ? 'ineffective' : 'unverifiable');
+});
+test('native evidence without O_NOFOLLOW rejects linked ancestors', () => {
+    externalRoot = (0, tmp_1.mkCanonicalTmpDir)('awm-coverage-linked-parent-');
+    fs_1.default.writeFileSync(path_1.default.join(externalRoot, 'eslint.config.js'), 'no-unreachable');
+    const project = path_1.default.join(root, 'linked-project');
+    fs_1.default.symlinkSync(externalRoot, project, process.platform === 'win32' ? 'junction' : 'dir');
+    expect(observeWithoutNoFollow(undefined, project)).toMatchObject({ status: 'unverifiable' });
+});
 test('active matching sensor with all AND evidence is covered (R2.2)', () => {
     fs_1.default.writeFileSync(path_1.default.join(root, 'eslint.config.js'), "rules: { 'no-unreachable': 'error' }");
     const observed = (0, evidence_1.observeDetector)(root, 'style', 0, detector, {
         cmd: 'npx eslint . --config eslint.config.js', enabled: true,
     });
-    if (noFollowUnavailableOnNativeWindows) {
-        expect(observed).toMatchObject({
-            status: 'unverifiable',
-            evidence: expect.arrayContaining([{ kind: 'file', path: 'eslint.config.js', status: 'unverifiable' }]),
-        });
-        return;
-    }
     expect(observed).toEqual({
         classId: 'style',
         detectorIndex: 0,
@@ -60,7 +96,7 @@ test('structured v2 commands supply structural coverage evidence without exposin
         enabled: true,
         command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.', '--config', 'eslint.config.js'] },
     });
-    expect(observed.status).toBe(regularFileStatus('covered'));
+    expect(observed.status).toBe('covered');
     expect(JSON.stringify(observed)).not.toContain('--config');
 });
 test.each([
@@ -93,25 +129,13 @@ test('recognized command plus missing file is ineffective (R2.4)', () => {
 test('recognized command plus missing literal marker is ineffective (R2.4)', () => {
     fs_1.default.writeFileSync(path_1.default.join(root, 'eslint.config.js'), 'export default []');
     const out = (0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'eslint --config eslint.config.js' });
-    expect(out.status).toBe(regularFileStatus('ineffective'));
-    if (noFollowUnavailableOnNativeWindows) {
-        expect(out.evidence).toContainEqual({ kind: 'file', path: 'eslint.config.js', status: 'unverifiable' });
-    }
-    else {
-        expect(out.evidence).toContainEqual({ kind: 'marker', path: 'eslint.config.js', ordinal: 1, status: 'missing' });
-    }
+    expect(out.status).toBe('ineffective');
+    expect(out.evidence).toContainEqual({ kind: 'marker', path: 'eslint.config.js', ordinal: 1, status: 'missing' });
 });
-test('native Windows without no-follow support never certifies regular evidence from its contents', () => {
+test('native platform securely observes regular evidence from its contents', () => {
     fs_1.default.writeFileSync(path_1.default.join(root, 'eslint.config.js'), 'no-unreachable');
     const observed = (0, evidence_1.observeDetector)(root, 'style', 0, detector, { cmd: 'eslint --config eslint.config.js' });
-    if (noFollowUnavailableOnNativeWindows) {
-        expect(observed.status).toBe('unverifiable');
-        expect(observed.status).not.toBe('covered');
-        expect(observed.status).not.toBe('ineffective');
-    }
-    else {
-        expect(observed.status).toBe('covered');
-    }
+    expect(observed.status).toBe('covered');
 });
 test('unverifiable file evidence dominates missing evidence in the detector result (R2.5a)', () => {
     const mixed = {

package/dist/tests/commands/sensors/coverage/resolve.test.js

@@ -7,6 +7,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const tmp_1 = require("../../../support/tmp");
 const resolve_1 = require("../../../../src/commands/sensors/coverage/resolve");
+const coverage_1 = require("../../../../src/commands/sensors/coverage");
 function resolveCoverageWithoutNoFollow(cwd) {
     let resolve;
     jest.isolateModules(() => {
@@ -67,6 +68,15 @@ test('no manifest returns not_configured without reading registries', () => {
         lstat.mockRestore();
     }
 });
+test('a worktree without its own manifest never inherits the parent checkout manifest', () => {
+    writeManifest({ pack: 'js-ts', sensors: {} });
+    configure(['baseline']);
+    writePack('baseline', 'js-ts', { name: 'js-ts', sensors: {}, coverage });
+    const worktree = path_1.default.join(project, '.worktrees', 'feature');
+    fs_1.default.mkdirSync(worktree, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(worktree, '.git'), 'gitdir: ../.git/worktrees/feature');
+    expect((0, resolve_1.resolveCoverageInputs)(worktree)).toEqual({ kind: 'not_configured' });
+});
 test('selects the first configured registry containing the exact pack', () => {
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['first', 'second']);
@@ -91,12 +101,53 @@ test('v3 project-sensors resolves coverage from its declared logical registry',
         registryRoot: path_1.default.join(awmHome, 'registries', 'second'),
     });
 });
+test('v3 monorepo coverage inspects evidence in its declared packageRoot', async () => {
+    const packageRoot = path_1.default.join(project, 'cli');
+    fs_1.default.mkdirSync(packageRoot);
+    fs_1.default.writeFileSync(path_1.default.join(packageRoot, '.dep-cruiser.awm.js'), 'no-circular');
+    writeManifest({
+        schemaVersion: 3, mode: 'project-sensors', pack: 'js-ts', source: { registry: 'baseline' }, packageRoot: 'cli',
+        sensors: { depcheck: {
+                enabled: true, variantId: 'dependency-cruiser',
+                command: { executable: 'depcruise', resolution: 'node-modules-bin', args: ['--config', '.dep-cruiser.awm.js', 'src'] },
+                initializedCompatibility: {
+                    state: 'compatible-unverified', reason: 'fixture', variantId: 'dependency-cruiser',
+                    toolVersion: null, runtimeVersion: null, certifiedRange: null, evidence: [],
+                },
+            } },
+    });
+    configure(['baseline']);
+    writePack('baseline', 'js-ts', { name: 'js-ts', sensors: {}, coverage: { schemaVersion: 1, classes: {
+                'dependency-boundaries': {
+                    description: 'Dependency boundaries',
+                    detectors: [{ sensor: 'depcheck', evidence: { commandIncludes: ['depcruise'], files: [{ path: '.dep-cruiser.awm.js', containsAll: ['no-circular'] }] } }],
+                    remedy: { summary: 'Enable depcheck', command: 'npm run depcheck' },
+                },
+            } } });
+    const live = { state: 'certified', reason: 'fixture', variantId: 'dependency-cruiser',
+        toolVersion: '16.10.4', runtimeVersion: '24.0.0', certifiedRange: '=16.10.4', evidence: [] };
+    const report = await (0, coverage_1.runCoverage)(project, { resolveLive: jest.fn().mockResolvedValue({ sensors: { depcheck: live } }) });
+    expect(report.static.classes[0]).toMatchObject({ status: 'covered', detectors: [{
+                sensor: 'depcheck', status: 'covered', evidence: [
+                    { kind: 'command', status: 'matched' },
+                    { kind: 'file', path: '.dep-cruiser.awm.js', status: 'matched' },
+                    { kind: 'marker', path: '.dep-cruiser.awm.js', ordinal: 1, status: 'matched' },
+                ],
+            }] });
+});
 test('old pack without coverage is no_reference, not covered', () => {
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['baseline']);
     writePack('baseline', 'js-ts', { name: 'js-ts', sensors: {} });
     expect((0, resolve_1.resolveCoverageInputs)(project)).toMatchObject({ kind: 'no_reference', pack: 'js-ts', registry: 'baseline' });
 });
+test('no_reference cannot conceal an invalid declared packageRoot', async () => {
+    writeManifest({ schemaVersion: 3, mode: 'project-sensors', pack: 'js-ts',
+        source: { registry: 'baseline' }, packageRoot: 'missing-package', sensors: {} });
+    configure(['baseline']);
+    writePack('baseline', 'js-ts', { name: 'js-ts', sensors: {} });
+    await expect((0, coverage_1.runCoverage)(project)).rejects.toThrow(/packageRoot/);
+});
 test('normal regular coverage inputs resolve regardless of no-follow availability', () => {
     writeManifest({ pack: 'js-ts', sensors: {} });
     configure(['baseline']);

package/dist/tests/commands/sensors/exec.test.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -6,6 +39,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const platformPaths = __importStar(require("../../../src/core/paths"));
 const exec_1 = require("../../../src/commands/sensors/exec");
 const result_1 = require("../../../src/commands/sensors/result");
 const baseline_1 = require("../../../src/commands/sensors/baseline");
@@ -34,6 +68,28 @@ async function until(fn, budgetMs = 4000) {
     return fn();
 }
 describe('runCommand — exit codes and output', () => {
+    itPosix('prefers the CLI runtime Node directory over an inherited conflicting PATH entry', async () => {
+        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-exec-runtime-path-'));
+        const shadowBin = path_1.default.join(dir, 'bin');
+        const runtimeBin = path_1.default.join(dir, 'runtime-bin');
+        const originalPath = process.env.PATH;
+        const execPathDescriptor = Object.getOwnPropertyDescriptor(process, 'execPath');
+        try {
+            fs_1.default.mkdirSync(shadowBin);
+            fs_1.default.mkdirSync(runtimeBin);
+            fs_1.default.writeFileSync(path_1.default.join(shadowBin, 'node'), "#!/bin/sh\nprintf '%s\\n' shadow-node\n", { mode: 0o755 });
+            fs_1.default.writeFileSync(path_1.default.join(runtimeBin, 'node'), "#!/bin/sh\nprintf '%s\\n' runtime-node\n", { mode: 0o755 });
+            process.env.PATH = `${shadowBin}${path_1.default.delimiter}${originalPath ?? ''}`;
+            Object.defineProperty(process, 'execPath', { value: path_1.default.join(runtimeBin, 'node'), configurable: true });
+            const result = await (0, exec_1.runCommand)("node -e \"process.stdout.write(process.execPath)\"", { timeout: 5_000, cwd: dir });
+            expect(result).toMatchObject({ code: 0, stdout: 'runtime-node\n' });
+        }
+        finally {
+            process.env.PATH = originalPath;
+            Object.defineProperty(process, 'execPath', execPathDescriptor);
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+        }
+    });
     it('records bounded execution evidence on timeout (R3.2,R3.4,R7.1)', async () => {
         const result = await (0, result_1.executePrepared)(sensor({ timeoutMs: 25, timeoutSource: 'project' }));
         expect(result.status).toBe('inconclusive');
@@ -81,6 +137,18 @@ describe('runCommand — exit codes and output', () => {
         const interpreted = (0, result_1.interpretResult)(sensor({ command: { kind: 'structured', value: { executable: 'node', resolution: 'path', args: ['-e', 'process.exit(3)'] } } }), raw);
         expect(interpreted.status).not.toBe('pass');
     });
+    it('treats generic stdout from a successful command as informational', () => {
+        const result = (0, result_1.interpretResult)(sensor(), {
+            code: 0,
+            stdout: 'depcruise: no violations found\n',
+            stderr: '',
+            elapsedMs: 1,
+            signal: null,
+            timedOut: false,
+            overflowed: false,
+        });
+        expect(result).toMatchObject({ status: 'pass', errors: [] });
+    });
     itLinux('keeps structured stderr separate from exit-0 stdout findings', async () => {
         const command = {
             executable: 'perl',
@@ -307,6 +375,50 @@ onPosix('runStructuredCommand — local node_modules binaries', () => {
         }
     });
 });
+describe('runStructuredCommand — Windows local native binaries', () => {
+    let dir;
+    let windows;
+    let savedPathExt;
+    beforeEach(() => {
+        dir = fs_1.default.realpathSync(fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-windows-local-bin-')));
+        fs_1.default.mkdirSync(path_1.default.join(dir, 'node_modules', '.bin'), { recursive: true });
+        windows = jest.spyOn(platformPaths, 'isWindowsNative').mockReturnValue(true);
+        savedPathExt = process.env.PATHEXT;
+        process.env.PATHEXT = '.EXE;.CMD';
+    });
+    afterEach(() => {
+        windows.mockRestore();
+        if (savedPathExt === undefined)
+            delete process.env.PATHEXT;
+        else
+            process.env.PATHEXT = savedPathExt;
+        fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    it('executes a contained native executable with literal shell-sensitive argv', async () => {
+        const executable = path_1.default.join(dir, 'node_modules', '.bin', 'fixture.exe');
+        fs_1.default.copyFileSync(process.execPath, executable);
+        fs_1.default.chmodSync(executable, 0o755);
+        const literal = '&echo injected|more';
+        await expect((0, exec_1.runStructuredCommand)({ executable: 'fixture', resolution: 'node-modules-bin',
+            args: ['-e', 'process.stdout.write(JSON.stringify(process.argv.slice(1)))', '--', literal] }, { cwd: dir, timeout: 5000 }))
+            .resolves.toMatchObject({ code: 0, stdout: JSON.stringify([literal]) });
+    });
+    it.each(['fixture', 'fixture.cmd'])('rejects non-native wrapper %s without executing it', executable => {
+        fs_1.default.writeFileSync(path_1.default.join(dir, 'node_modules', '.bin', executable), 'echo injected');
+        expect(() => (0, exec_1.runStructuredCommand)({ executable, resolution: 'node-modules-bin', args: ['--version'] }, { cwd: dir, timeout: 5000 }))
+            .toThrow(/contained local file|command wrappers/);
+    });
+    it('rejects a native executable escaping through a linked .bin ancestor', () => {
+        const outside = path_1.default.join(dir, 'outside-bin');
+        fs_1.default.mkdirSync(outside);
+        fs_1.default.copyFileSync(process.execPath, path_1.default.join(outside, 'fixture.exe'));
+        const bin = path_1.default.join(dir, 'node_modules', '.bin');
+        fs_1.default.rmdirSync(bin);
+        fs_1.default.symlinkSync(outside, bin, process.platform === 'win32' ? 'junction' : 'dir');
+        expect(() => (0, exec_1.runStructuredCommand)({ executable: 'fixture', resolution: 'node-modules-bin', args: ['--version'] }, { cwd: dir, timeout: 5000 }))
+            .toThrow('node_modules executable is not a contained local file');
+    });
+});
 onPosix('runStructuredCommand — Python environments', () => {
     it.each(['.venv', 'venv'])('rejects a symlinked %s ancestor instead of executing outside the project', environment => {
         const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-python-env-ancestor-'));

package/dist/tests/commands/sensors/run-changed.test.js

@@ -136,6 +136,17 @@ describe('runSensors --changed', () => {
         expect(mockChangedFiles).not.toHaveBeenCalled();
         expect(out.changedScope).toBeUndefined();
     });
+    it('does not certify read-only admission when a sensor changes an ignored .awm file', async () => {
+        dir = project({ lint: LINT });
+        fs_1.default.writeFileSync(path_1.default.join(dir, '.gitignore'), '.awm/transient\\n');
+        mockRunCommand.mockImplementation(async () => {
+            fs_1.default.writeFileSync(path_1.default.join(dir, '.awm', 'transient'), 'sensor side effect');
+            return ok('');
+        });
+        const out = await load().runSensors({ cwd: dir, readOnly: true });
+        expect(out.overall).toBe('not_certified');
+        expect(out.reason).toBe('read-only-mutation-detected');
+    });
     it('passes the requested base through to the scope resolver', async () => {
         dir = project({ lint: LINT });
         mockChangedFiles.mockReturnValue({ files: ['src/a.ts'] });

package/dist/tests/commands/sensors/run.test.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
 const run_1 = require("../../../src/commands/sensors/run");
 const status_1 = require("../../../src/commands/sensors/status");
 const verdict_1 = require("../../../src/commands/sensors/verdict");
@@ -83,6 +84,18 @@ describe('runSensors', () => {
         expect(result.sensors.some((s) => s.name === 'security')).toBe(false);
         expect(result.overall).toBe('not_certified');
     });
+    it('marks sensor evidence non-certifying when a read-only admission run changes the worktree', async () => {
+        (0, child_process_1.execFileSync)('git', ['init', '-q', '-b', 'main'], { cwd: tmpDir });
+        (0, child_process_1.execFileSync)('git', ['add', '.'], { cwd: tmpDir });
+        (0, child_process_1.execFileSync)('git', ['-c', 'user.email=t@t.t', '-c', 'user.name=t', 'commit', '-qm', 'initial'], { cwd: tmpDir });
+        mockRunCommand.mockImplementation(async () => {
+            fs_1.default.writeFileSync(path.join(tmpDir, 'sensor-side-effect.txt'), 'unexpected');
+            return ok();
+        });
+        const { runSensors } = load();
+        const result = await runSensors({ fast: true, cwd: tmpDir, readOnly: true });
+        expect(result).toMatchObject({ overall: 'not_certified', reason: 'read-only-mutation-detected' });
+    });
     it('runs both fast and slow sensors when --fast and --slow are combined', async () => {
         mockRunCommand.mockResolvedValue(ok());
         const { runSensors } = load();
@@ -264,7 +277,7 @@ describe('runSensors v2 lifecycle contract', () => {
             sensors: { lint: { fast: true, applicability: { allFiles: ['package.json'] }, variants: [{
                             id: 'eslint-10', priority: 1, certifiedRange: '>=10 <11',
                             requirements: { tool: 'eslint', toolRange: '>=10 <11', runtime: 'node', runtimeRange: '>=0' },
-                            assets: ['eslint.config.awm.mjs'], formatter: 'generic', probe: { kind: 'package-script-present' },
+                            assets: ['eslint.config.awm.mjs'], formatter: 'generic', probe: { kind: 'package-script-present', script: 'lint' },
                             command: { executable: 'live-eslint', resolution: 'node-modules-bin', args: ['.'] },
                         }] } },
         }));
@@ -470,7 +483,7 @@ describe('runSensors — not_certified + auto-discovery', () => {
                 sensors: { lint: { applicability: { allFiles: ['package.json'] }, variants: [{
                                 id: 'eslint-10', priority: 1, certifiedRange: '>=10 <11',
                                 requirements: { tool: 'eslint', toolRange: '>=10 <11', runtime: 'node', runtimeRange: '>=0' },
-                                assets: [], formatter: 'generic', probe: { kind: 'package-script-present' },
+                                assets: [], formatter: 'generic', probe: { kind: 'package-script-present', script: 'lint' },
                                 command: { executable: 'eslint', resolution: 'node-modules-bin', args: ['.'] },
                             }] } },
             };