branchproof 0.11.1 → 0.12.0

data/lib/branchproof/changed_coverage.rb

@@ -0,0 +1,177 @@
+# frozen_string_literal: true
+
+require_relative "coverage_summary"
+
+# rubocop:disable-next Metrics/ModuleLength, Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
+module Branchproof
+  # Computes informational coverage for the current decisions captured by a changed scope.
+  module ChangedCoverage
+    CRITERIA = {
+      decision: %i[covered_decisions supported_decisions],
+      condition: %i[covered_values required_values],
+      condition_decision: %i[covered_decisions supported_decisions],
+      mcdc: %i[proven_conditions supported_conditions],
+      decision_table: %i[covered_rules required_rules],
+      alternative: %i[covered_alternatives required_alternatives]
+    }.freeze
+    COMPLETENESS_FIELDS = %i[observation attribution analysis].freeze
+
+    module_function
+
+    def call(document:, scope:)
+      ids = Array(value(scope, :decision_ids))
+      scope_status = value(scope, :status)
+      decisions = analysis_decisions(document)
+      by_id = decisions.to_h { |decision| [value(decision, :decision_id), decision] }
+      selected = ids.filter_map { |id| by_id[id] }
+      supported_count = selected.count { |decision| !value(decision, :unsupported) }
+      unsupported_count = selected.length - supported_count
+      reason = unavailable_reason(document, scope, ids, selected)
+      usable = selected.select do |decision|
+        value(decision, :unsupported) || complete_decision_coverage?(decision)
+      end
+      summary = CoverageSummary.call(usable)
+
+      {
+        scope_status: scope_status,
+        status: reason ? "unavailable" : "available",
+        reason: reason,
+        selected_decisions: ids.length,
+        supported_decisions: supported_count,
+        unsupported_decisions: unsupported_count,
+        coverage: coverage_rows(summary, reason)
+      }
+    end
+
+    def unavailable_reason(document, scope, ids, selected)
+      return "invalid_scope" unless scope.is_a?(Hash) && %w[complete empty].include?(value(scope, :status))
+      return "invalid_scope" if (value(scope, :status) == "empty") != ids.empty?
+      return "empty_scope" if ids.empty?
+      return "missing_selected_analysis" unless selected.length == ids.length
+      return "unsupported_only" if selected.all? { |decision| value(decision, :unsupported) }
+      return "missing_selected_coverage" unless selected.all? do |decision|
+        value(decision, :unsupported) || complete_decision_coverage?(decision)
+      end
+      return "baseline_unavailable" unless successful_baseline?(document)
+      return "incomplete_document" unless complete?(value(document, :completeness))
+
+      observations = value(document, :observations) || value(document, :evidence)
+      return "incomplete_observations" if incomplete_section?(observations)
+
+      analysis = value(document, :analysis)
+      return "analysis_unavailable" unless analysis.is_a?(Hash)
+      return "incomplete_analysis" if incomplete_section?(analysis)
+
+      nil
+    end
+    private_class_method :unavailable_reason
+
+    def complete_decision_coverage?(decision)
+      coverage = value(decision, :coverage)
+      return false unless coverage.is_a?(Hash)
+
+      if alternative_decision?(decision)
+        alternative = value(coverage, :alternative)
+        mcdc = value(coverage, :mcdc)
+        return false unless alternative.is_a?(Hash) && integer_count?(value(alternative, :covered_alternatives)) &&
+                            integer_count?(value(alternative, :required_alternatives)) &&
+                            value(mcdc, :status) == "not_applicable"
+
+        value(alternative, :covered_alternatives) <= value(alternative, :required_alternatives)
+      else
+        rows = %i[decision condition condition_decision mcdc decision_table].map { |key| value(coverage, key) }
+        return false unless rows.all?(Hash)
+        return false unless value(value(coverage, :decision), :status).is_a?(String)
+        return false unless value(value(coverage, :condition_decision), :status).is_a?(String)
+        return false unless %i[covered_values condition_count covered_conditions].all? do |key|
+          integer_count?(value(value(coverage, :condition), key))
+        end
+        return false unless integer_count?(value(value(coverage, :mcdc), :proven_conditions))
+
+        condition_count = value(value(coverage, :condition), :condition_count)
+        return false if value(value(coverage, :condition), :covered_values) > condition_count * 2
+        return false if value(value(coverage, :condition), :covered_conditions) > condition_count
+        return false if value(value(coverage, :mcdc), :proven_conditions) > condition_count
+        return false unless value(value(coverage, :decision_table), :status).is_a?(String)
+
+        table = value(decision, :decision_table)
+        return false unless table.is_a?(Hash) && %w[calculated not_calculated].include?(value(table, :status))
+        return true if value(table, :status) == "not_calculated"
+
+        valid_counts = %i[covered_rules required_rules generated_rules impossible_rules].all? do |key|
+          integer_count?(value(table, key))
+        end
+        return false unless valid_counts
+
+        covered = value(table, :covered_rules)
+        required = value(table, :required_rules)
+        generated = value(table, :generated_rules)
+        impossible = value(table, :impossible_rules)
+        covered <= required && required + impossible == generated && value(table, :coverage_status).is_a?(String)
+      end
+    end
+    private_class_method :complete_decision_coverage?
+
+    def alternative_decision?(decision)
+      kind = value(decision, :kind).to_s
+      !kind.empty? && kind != "boolean"
+    end
+    private_class_method :alternative_decision?
+
+    def integer_count?(value)
+      value.is_a?(Integer) && value >= 0
+    end
+    private_class_method :integer_count?
+
+    def coverage_rows(summary, overall_reason)
+      CRITERIA.to_h do |criterion, (numerator_key, denominator_key)|
+        aggregate = value(summary, criterion) || {}
+        numerator = value(aggregate, numerator_key)
+        denominator = value(aggregate, denominator_key)
+        reason = overall_reason
+        reason ||= "decision_table_not_calculated" if criterion == :decision_table &&
+                                                      value(aggregate, :not_calculated_decisions).to_i.positive?
+        reason ||= "zero_denominator" if denominator.to_i.zero?
+        [criterion, { numerator: numerator, denominator: denominator,
+                      percentage: reason ? nil : value(aggregate, :percentage),
+                      status: reason ? "unavailable" : "available", reason: reason }]
+      end
+    end
+    private_class_method :coverage_rows
+
+    def successful_baseline?(document)
+      baseline = value(document, :baseline)
+      value(baseline, :status).to_s.upcase == "PASSED" && value(baseline, :finalized) == true
+    end
+    private_class_method :successful_baseline?
+
+    def complete?(completeness)
+      completeness.is_a?(Hash) && COMPLETENESS_FIELDS.all? { |field| value(completeness, field) == true }
+    end
+    private_class_method :complete?
+
+    def incomplete_section?(section)
+      !section.is_a?(Hash) || !key_present?(section, :completeness) || !complete?(value(section, :completeness))
+    end
+    private_class_method :incomplete_section?
+
+    def analysis_decisions(document)
+      Array(value(value(document, :analysis), :decisions))
+    end
+    private_class_method :analysis_decisions
+
+    def value(hash, key)
+      return nil unless hash.respond_to?(:key?)
+      return hash[key] if hash.key?(key)
+
+      alternate = key.is_a?(Symbol) ? key.to_s : key.to_sym
+      hash[alternate] if hash.key?(alternate)
+    end
+    private_class_method :value
+
+    def key_present?(hash, key)
+      hash.key?(key) || hash.key?(key.to_s) || hash.key?(key.to_sym)
+    end
+    private_class_method :key_present?
+  end
+end

data/lib/branchproof/changed_decision_map.rb

@@ -0,0 +1,359 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Branchproof
+  # Maps changed lines to current decision records using Prism byte locations.
+  # rubocop:disable-next Metrics/ClassLength -- AST ownership rules share the parsed current source and hunk ranges.
+  class ChangedDecisionMap
+    CONTROL_NODES = [Prism::IfNode, Prism::UnlessNode, Prism::WhileNode, Prism::UntilNode].freeze
+
+    # rubocop:disable-next Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity -- Keeps one Prism walk across all supported contexts.
+    def call(bytes:, path:, decisions:, hunks:, old_bytes: "")
+      parsed = Prism.parse(bytes)
+      unless parsed.errors.empty?
+        raise ArgumentError,
+              "cannot map changes in #{path.inspect}: current Ruby source does not parse"
+      end
+
+      return [] if decisions.empty?
+
+      changed = changed_locations(hunks, old_bytes, bytes)
+      return [] if changed.empty?
+
+      selected = []
+      old_body_owners = deleted_old_body_owners(old_bytes, bytes, hunks, changed)
+      decisions.each do |decision|
+        expression = { byte_start: decision[:byte_start],
+                       byte_length: decision[:byte_length] }
+        selected << decision[:id] if range_touched?(expression, changed)
+        instrumentation_range = decision.dig(:instrumentation, :range)
+        selected << decision[:id] if instrumentation_range && range_touched?(instrumentation_range, changed)
+      end
+      # rubocop:disable-next Metrics/BlockLength -- One AST walk keeps ownership mapping consistent across node kinds.
+      walk(parsed.value) do |node|
+        if CONTROL_NODES.any? { |type| node.is_a?(type) }
+          predicate = node.predicate
+          next unless predicate
+
+          predicate = unwrap_predicate(predicate)
+          record = decisions.find do |decision|
+            decision[:kind] == "boolean" && decision[:byte_start] == predicate.location.start_offset &&
+              decision[:byte_length] == predicate.location.length
+          end
+          next unless record
+
+          selected << record[:id] if range_touched?(predicate.location, changed)
+          selected << record[:id] if range_touched?(node.location, changed)
+        elsif node.is_a?(Prism::CaseNode) && node.predicate.nil?
+          case_records = []
+          node.conditions.each do |branch|
+            branch.conditions.each do |condition|
+              records = decisions.select do |decision|
+                decision[:context] == "case_when" && decision[:byte_start] == condition.location.start_offset &&
+                  decision[:byte_length] == condition.location.length
+              end
+              case_records.concat(records)
+              next unless branch_body_touched?(branch, changed) ||
+                          subjectless_body_deleted?(node, branch, old_body_owners)
+
+              selected.concat(records.map { |record| record[:id] })
+            end
+          end
+          else_clause = node.else_clause
+          else_touched = else_clause && (branch_body_touched?(else_clause, changed) ||
+            old_body_owners.include?([:else, node.location.start_offset]))
+          selected.concat(case_records.map { |record| record[:id] }) if else_touched
+        elsif node.is_a?(Prism::CaseNode) || node.is_a?(Prism::CaseMatchNode)
+          record = decisions.find do |decision|
+            decision[:context] == (node.is_a?(Prism::CaseMatchNode) ? "case_in" : "case") &&
+              decision.dig(:instrumentation, :range, :byte_start) == node.location.start_offset
+          end
+          selected << record[:id] if record && body_touched?(node, changed)
+        elsif node.is_a?(Prism::InNode) && (node.pattern.is_a?(Prism::IfNode) || node.pattern.is_a?(Prism::UnlessNode))
+          guard = unwrap_predicate(node.pattern.predicate)
+          record = decisions.find do |decision|
+            decision[:context] == "pattern_guard" && decision[:byte_start] == guard.location.start_offset &&
+              decision[:byte_length] == guard.location.length
+          end
+          body_touched = branch_body_touched?(node, changed) ||
+                         old_body_owners.include?([:in, node.location.start_offset,
+                                                   guard.location.start_offset, guard.location.length])
+          selected << record[:id] if record && body_touched
+        end
+      end
+
+      selected.uniq
+    end
+
+    private
+
+    def unwrap_predicate(node)
+      while node.is_a?(Prism::ParenthesesNode)
+        body = node.body&.body
+        return node unless body&.length == 1
+
+        node = body.first
+      end
+      node
+    end
+
+    # rubocop:disable-next Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity -- Resolves deleted tokens only to surviving branch owners.
+    # rubocop:disable-next Metrics/BlockLength -- Old AST ownership is translated against the same hunk set.
+    def deleted_old_body_owners(old_bytes, current_bytes, hunks, changed)
+      return [] if old_bytes.empty? || changed.none? { |item| item[:old_token_start] }
+
+      parsed = Prism.parse(old_bytes)
+      return [] unless parsed.errors.empty?
+
+      owners = []
+      walk(parsed.value) do |node|
+        if node.is_a?(Prism::CaseNode) && node.predicate.nil?
+          branches = node.conditions
+          branches.each_with_index do |branch, index|
+            next_branch = branches[index + 1]
+            boundary = next_branch && branch_keyword_location(next_branch)&.start_offset
+            boundary ||= node.else_clause&.else_keyword_loc&.start_offset
+            boundary ||= node.end_keyword_loc&.start_offset || node.location.end_offset
+            next unless old_branch_body_touched?(branch, boundary, changed)
+
+            current_case_start = map_old_offset(node.location.start_offset, old_bytes, current_bytes, hunks)
+            branch.conditions.each do |condition|
+              current_condition_start = map_old_offset(condition.location.start_offset, old_bytes, current_bytes, hunks)
+              next unless current_case_start && current_condition_start
+
+              owners << [:when, current_case_start, current_condition_start, condition.location.length]
+            end
+          end
+          else_boundary = node.end_keyword_loc&.start_offset || node.location.end_offset
+          if node.else_clause && old_else_body_touched?(node.else_clause, else_boundary, changed)
+            current_case_start = map_old_offset(node.location.start_offset, old_bytes, current_bytes, hunks)
+            owners << [:else, current_case_start] if current_case_start
+          end
+        elsif node.is_a?(Prism::CaseMatchNode)
+          branches = node.conditions
+          branches.each_with_index do |branch, index|
+            pattern = branch.pattern
+            next unless pattern.is_a?(Prism::IfNode) || pattern.is_a?(Prism::UnlessNode)
+
+            next_branch = branches[index + 1]
+            boundary = next_branch && branch_keyword_location(next_branch)&.start_offset
+            boundary ||= node.else_clause&.else_keyword_loc&.start_offset
+            boundary ||= node.end_keyword_loc&.start_offset || node.location.end_offset
+            next unless old_branch_body_touched?(branch, boundary, changed)
+
+            guard = unwrap_predicate(pattern.predicate)
+            current_branch_start = map_old_offset(branch.location.start_offset, old_bytes, current_bytes, hunks)
+            current_guard_start = map_old_offset(guard.location.start_offset, old_bytes, current_bytes, hunks)
+            next unless current_branch_start && current_guard_start
+
+            owners << [:in, current_branch_start, current_guard_start, guard.location.length]
+          end
+        end
+      end
+      owners
+    end
+
+    def branch_keyword_location(branch)
+      branch.is_a?(Prism::InNode) ? branch.in_loc : branch.keyword_loc
+    end
+
+    # rubocop:disable-next Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity -- Translates unchanged owner byte positions across line hunks.
+    def map_old_offset(offset, old_bytes, current_bytes, hunks)
+      old_line_start = line_offset(old_bytes, offset)
+      old_line = old_bytes.b.byteslice(0, offset).count("\n".b) + 1
+      line_delta = 0
+      Array(hunks).each do |hunk|
+        first = hunk[:old_start]
+        last = first + hunk[:old_count]
+        if hunk[:old_count].zero?
+          line_delta += hunk[:new_count] if old_line > first
+          next
+        end
+        return nil if hunk[:old_count].positive? && old_line >= first && old_line < last
+
+        line_delta += hunk[:new_count] - hunk[:old_count] if old_line >= last
+      end
+      current_line = old_line + line_delta
+      current_line_start = offset_after_line(current_bytes, current_line - 1)
+      column = offset - old_line_start
+      return nil if current_line_start + column > current_bytes.bytesize
+
+      current_line_start + column
+    end
+
+    def line_offset(bytes, offset)
+      newline = bytes.b.byteslice(0, offset).rindex("\n".b)
+      newline ? newline + 1 : 0
+    end
+
+    # rubocop:disable-next Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity -- Checks token ownership within one old branch body.
+    def old_branch_body_touched?(branch, boundary, changed)
+      return false unless boundary
+
+      body_start = branch.statements&.location&.start_offset || branch.location.end_offset
+      body_end = [branch.location.end_offset, boundary].min
+      return false unless body_end > body_start
+
+      changed.any? do |item|
+        item[:old_token_start] && item[:old_token_start] >= body_start && item[:old_token_start] < body_end
+      end
+    end
+
+    def old_else_body_touched?(branch, boundary, changed)
+      body_start = branch.else_keyword_loc.end_offset
+      changed.any? do |item|
+        item[:old_token_start] && item[:old_token_start] >= body_start && item[:old_token_start] < boundary
+      end
+    end
+
+    def subjectless_body_deleted?(case_node, branch, old_body_owners)
+      branch.conditions.any? do |condition|
+        old_body_owners.include?([:when, case_node.location.start_offset,
+                                  condition.location.start_offset, condition.location.length])
+      end
+    end
+
+    # rubocop:disable-next Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity -- Token comparison retains lexer context for heredocs and strings.
+    def changed_locations(hunks, old_bytes, bytes)
+      changed = []
+      old_tokens = Prism.lex(old_bytes).value
+      current_tokens = Prism.lex(bytes).value
+      Array(hunks).each do |hunk|
+        old_range = (hunk[:old_start]...(hunk[:old_start] + hunk[:old_count]))
+        new_range = (hunk[:new_start]...(hunk[:new_start] + hunk[:new_count]))
+        old_hunk_tokens = semantic_tokens(old_tokens, old_range)
+        new_hunk_tokens = semantic_tokens(current_tokens, new_range)
+        next unless meaningful_tokens?(old_hunk_tokens) || meaningful_tokens?(new_hunk_tokens)
+        next if old_hunk_tokens == new_hunk_tokens
+
+        count = hunk[:new_count]
+        start = hunk[:new_start]
+        old_token_start = first_meaningful_token_start(old_tokens, old_range)
+        if count.positive?
+          code_lines = (start...(start + count)).filter_map do |line|
+            line_range(bytes, line).merge(old_token_start: old_token_start) if code_line?(current_tokens, line)
+          end
+          if code_lines.empty?
+            changed << { anchor: offset_after_line(bytes, start - 1), old_token_start: old_token_start }
+          else
+            changed.concat(code_lines)
+          end
+        else
+          changed << { anchor: offset_after_line(bytes, start), old_token_start: old_token_start }
+        end
+      end
+      changed
+    end
+
+    def code_line?(tokens, line)
+      tokens.any? do |token, _state|
+        line.between?(token.location.start_line, token.location.end_line) &&
+          !%i[COMMENT NEWLINE IGNORED_NEWLINE EOF].include?(token.type)
+      end
+    end
+
+    def semantic_tokens(tokens, lines)
+      tokens.filter_map do |token, _state|
+        next unless token.location.start_line < lines.end && token.location.end_line >= lines.begin
+
+        if token.type == :COMMENT
+          next unless token.value.end_with?("\n")
+
+          next [:NEWLINE, "\n"]
+        end
+        next if %i[IGNORED_NEWLINE EOF].include?(token.type)
+
+        [token.type, token.value]
+      end
+    end
+
+    def meaningful_tokens?(tokens)
+      tokens.any? { |type, _value| !%i[COMMENT NEWLINE IGNORED_NEWLINE EOF].include?(type) }
+    end
+
+    # rubocop:disable-next Style/HashEachMethods -- Prism.lex returns token/state pairs in an Array.
+    def first_meaningful_token_start(tokens, lines)
+      tokens.each do |token, _state|
+        next unless token.location.start_line >= lines.begin && token.location.start_line < lines.end
+        next if %i[COMMENT NEWLINE IGNORED_NEWLINE EOF].include?(token.type)
+
+        return token.location.start_offset
+      end
+      nil
+    end
+
+    def offset_after_line(bytes, line)
+      return 0 if line.zero?
+
+      bytes.lines.first(line).sum(&:bytesize)
+    end
+
+    def line_range(bytes, line)
+      start_offset = offset_after_line(bytes, line - 1)
+      line_bytes = bytes.lines[line - 1].to_s
+      { start_offset: start_offset, end_offset: start_offset + line_bytes.bytesize }
+    end
+
+    # rubocop:disable-next Metrics/AbcSize, Metrics/MethodLength -- Handles byte ranges and deletion anchors consistently.
+    def range_touched?(location, changed)
+      if location.is_a?(Hash)
+        start_offset = location[:byte_start]
+        end_offset = start_offset + location[:byte_length]
+      else
+        start_offset = location.start_offset
+        end_offset = location.end_offset
+      end
+      changed.any? do |item|
+        if item.key?(:anchor)
+          item[:anchor] > start_offset && item[:anchor] < end_offset
+        else
+          item[:start_offset] < end_offset && item[:end_offset] > start_offset
+        end
+      end
+    end
+
+    def body_touched?(node, changed)
+      body_locations(node).any? do |location|
+        location && changed.any? do |item|
+          if item.key?(:anchor)
+            item[:anchor] > location.start_offset && item[:anchor] < location.end_offset
+          else
+            item[:start_offset] < location.end_offset && item[:end_offset] > location.start_offset
+          end
+        end
+      end
+    end
+
+    def branch_body_touched?(branch, changed)
+      location = branch.statements&.location
+      return false unless location
+
+      changed.any? do |item|
+        if item.key?(:anchor)
+          item[:anchor] > location.start_offset && item[:anchor] < location.end_offset
+        else
+          item[:start_offset] < location.end_offset && item[:end_offset] > location.start_offset
+        end
+      end
+    end
+
+    # rubocop:disable-next Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity -- Metadata range shapes vary by Prism node family.
+    def body_locations(node)
+      if CONTROL_NODES.any? { |type| node.is_a?(type) }
+        [node.statements&.location, node.subsequent&.statements&.location]
+      elsif node.is_a?(Prism::CaseNode) || node.is_a?(Prism::CaseMatchNode)
+        node.conditions.map { |branch| branch.statements&.location } + [node.else_clause&.statements&.location]
+      else
+        []
+      end
+    end
+
+    def walk(node, &block)
+      return unless node
+
+      yield node
+      node.child_nodes.each { |child| walk(child, &block) if child }
+    end
+  end
+end

data/lib/branchproof/changed_scope.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+require "digest"
+require "pathname"
+require_relative "git_changes"
+require_relative "changed_decision_map"
+
+module Branchproof
+  # Describes tracked files and current decision IDs affected by the direct
+  # commit-to-worktree comparison.
+  class ChangedScope
+    def initialize(root:, ref:)
+      raise ArgumentError, "root must be an absolute path" unless root.is_a?(String) && Pathname.new(root).absolute?
+
+      @root = File.realpath(root)
+      @ref = ref
+    rescue SystemCallError => e
+      raise ArgumentError, "project root is unavailable: #{e.message}"
+    end
+
+    # rubocop:disable-next Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity -- Coordinates Git capture, inventory checks, and ordered membership.
+    def call(inventory:)
+      validate_inventory!(inventory)
+      changes = GitChanges.new(root: @root, ref: @ref).call(include_patch_lines: true)
+      source_units = Array(value(inventory, :source_units))
+      decisions = Array(value(inventory, :decisions))
+      sources_by_path = source_units.to_h { |unit| [value(unit, :relative_path), unit] }
+      selected_ids = []
+      output_files = changes[:files].map do |file|
+        path = file[:path]
+        source = sources_by_path[path]
+        next public_file(file) unless source && file[:status] != "D"
+
+        bytes = current_bytes!(source, path)
+        original_decisions = decisions.select { |decision| decision[:source_id] == source[:source_id] }
+        if file[:status] == "A" || file[:status].start_with?("R")
+          ChangedDecisionMap.new.call(bytes: bytes, path: path, decisions: original_decisions, hunks: file[:hunks],
+                                      old_bytes: file[:old_bytes] || "")
+          selected_ids.concat(original_decisions.map { |decision| decision[:id] })
+        else
+          selected_ids.concat(ChangedDecisionMap.new.call(
+                                bytes: bytes, path: path, decisions: original_decisions, hunks: file[:hunks],
+                                old_bytes: file[:old_bytes] || ""
+                              ))
+        end
+        current_bytes!(source, path)
+        public_file(file)
+      end
+      after_changes = GitChanges.new(root: @root, ref: changes[:base_commit]).call(include_patch_lines: true)
+      unless after_changes[:files] == changes[:files]
+        raise ArgumentError,
+              "tracked Git changes moved while changed scope was being captured; retry with a fresh inventory"
+      end
+
+      selected_ids = decisions.filter_map { |decision| decision[:id] if selected_ids.include?(decision[:id]) }
+      Records.build(**changes.except(:files),
+                    status: selected_ids.empty? ? "empty" : "complete",
+                    files: output_files, decision_ids: selected_ids)
+    end
+
+    private
+
+    def validate_inventory!(inventory)
+      raise ArgumentError, "inventory must be a source inventory record" unless inventory.is_a?(Hash)
+      raise ArgumentError, "inventory root does not match project root" unless File.realpath(value(inventory,
+                                                                                                   :root)) == @root
+    rescue SystemCallError, TypeError
+      raise ArgumentError, "inventory root does not match project root"
+    end
+
+    def current_bytes!(source, path)
+      bytes = value(source, :original_bytes)
+      digest = value(source, :digest)
+      current_path = File.expand_path(path, @root)
+      unless bytes.is_a?(String) && digest.is_a?(String) && Digest::SHA256.hexdigest(bytes) == digest &&
+             File.file?(current_path) && File.binread(current_path) == bytes
+        raise ArgumentError, "inventory source #{path.inspect} is stale; rebuild the current source inventory"
+      end
+
+      bytes
+    end
+
+    def public_file(file)
+      file.merge(hunks: Array(file[:hunks]).map do |hunk|
+        hunk.slice(:old_start, :old_count, :new_start, :new_count)
+      end).except(:old_bytes)
+    end
+
+    def value(hash, key)
+      hash[key] || hash[key.to_s]
+    end
+  end
+end