rail_verdict 1.0.0

data/lib/rail_verdict/repair/context_assembler.rb

@@ -0,0 +1,301 @@
+# frozen_string_literal: true
+
+require "digest"
+require "json"
+
+module RailVerdict
+  module Repair
+    module ContextAssembler
+      MAX_PACKET_BYTES = 256 * 1024
+
+      class StaleFindingError < RailVerdict::Error; end
+
+      def self.build(outcome:, finding_ref:, repository_root: nil, runner: nil, ai_analysis: nil, clock: Time.now.utc)
+        raise ArgumentError, "outcome required" unless outcome
+        raise ArgumentError, "finding_ref required" if finding_ref.to_s.strip.empty?
+
+        findings = outcome.findings || []
+        target = findings.find { |f| f.id == finding_ref || f.fingerprint == finding_ref }
+        raise StaleFindingError, "finding not found: #{finding_ref}" unless target
+
+        configuration = outcome.configuration
+        result = outcome.result
+        context = outcome.context
+
+        root = repository_root || context&.repository_root || Dir.pwd
+        runner ||= ProcessRunner.new
+
+        blocking = blocking_for(result, target)
+        finding_state = target.state
+
+        analyzer_result = analyzer_result_for(result, target)
+        evidence = build_evidence(target, analyzer_result)
+        git_ctx = build_git_context(result, context, target)
+        rails = build_rails_context(result)
+        source_ctx = build_source_context(root, target)
+        diff = build_diff(root, runner, target, context)
+
+        verification = build_verification(result, configuration)
+        policy = {
+          "mode" => configuration&.mode || "strict",
+          "configuration_digest" => configuration&.digest || Digest::SHA256.hexdigest("")
+        }
+        baseline_state = build_baseline_state(root, configuration)
+        waivers_state = build_waivers_state(root, configuration)
+        boundary = Boundary.snapshot(repository_root: root, configuration: configuration, outcome: outcome)
+        base_for_plan = begin; result&.git&.fetch("base", nil); rescue StandardError; nil; end
+        verification_plan = VerificationPlan.build(outcome: outcome, base_revision: base_for_plan)
+        constraints = Constraints.default
+        instructions = Constraints.instructions
+
+        source_revision = context&.revision
+        base_revision = begin; result&.git&.fetch("base", nil); rescue StandardError; nil; end
+        merge_base = begin; result&.git&.fetch("merge_base", nil); rescue StandardError; nil; end
+
+        analyzer_versions = context&.analyzer_versions || {}
+        baseline_digest = boundary["baseline_digest"]
+        packet_id = Packet.packet_id_for(
+          fingerprint: target.fingerprint,
+          source_revision: source_revision,
+          base_revision: base_revision,
+          configuration_digest: policy["configuration_digest"],
+          baseline_digest: baseline_digest,
+          analyzer_versions: analyzer_versions
+        )
+
+        truncated = source_ctx["truncated"] || diff["truncated"] || rails["truncated"] || false
+        completeness = {
+          "deterministic" => "complete",
+          "repair_context" => truncated ? "partial" : "complete",
+          "truncated" => truncated
+        }
+        gate = result&.gate || "FAIL"
+        success = {
+          "description" => "Target finding no longer blocking and gate is PASS/WARN with complete verification and unchanged boundary.",
+          "gate_must_be" => %w[PASS WARN],
+          "target_must_be_fixed" => true,
+          "completion_must_be" => "complete",
+          "boundary_must_be_unchanged" => true
+        }
+
+        packet_hash = {
+          "schema_version" => Packet::SCHEMA_VERSION,
+          "packet_id" => packet_id,
+          "created_at" => clock.utc.iso8601,
+          "railverdict_version" => RailVerdict::VERSION,
+          "source_revision" => source_revision,
+          "target" => {
+            "finding" => target.to_schema_h,
+            "finding_state" => finding_state,
+            "blocking" => blocking,
+            "severity" => target.severity
+          },
+          "verification" => verification,
+          "evidence" => evidence,
+          "git_context" => git_ctx,
+          "diff_context" => diff,
+          "rails_context" => rails,
+          "source_context" => source_ctx,
+          "policy" => policy,
+          "baseline_state" => baseline_state,
+          "waivers_state" => waivers_state,
+          "verification_plan" => verification_plan,
+          "constraints" => constraints,
+          "instructions" => instructions,
+          "completeness" => completeness,
+          "success_criteria" => success,
+          "boundary" => boundary
+        }
+        packet_hash["base_revision"] = base_revision unless base_revision.nil?
+        packet_hash["merge_base"] = merge_base unless merge_base.nil?
+        packet_hash["ai_analysis"] = ai_analysis.to_h if ai_analysis
+
+        errors = SchemaValidator.validate_repair_packet(packet_hash)
+        raise ArgumentError, "invalid packet: #{errors.join('; ')}" unless errors.empty?
+
+        if JSON.generate(packet_hash).bytesize > MAX_PACKET_BYTES
+          packet_hash["source_context"] = { "snippets" => packet_hash["source_context"]["snippets"].first(1), "truncated" => true }
+          packet_hash["diff_context"] = { "hunk" => packet_hash["diff_context"]["hunk"].byteslice(0, 4096).to_s, "truncated" => true }
+          packet_hash["completeness"] = { "deterministic" => "complete", "repair_context" => "partial", "truncated" => true }
+        end
+
+        Packet.new(
+          packet_id: packet_hash["packet_id"],
+          created_at: packet_hash["created_at"],
+          railverdict_version: packet_hash["railverdict_version"],
+          source_revision: packet_hash["source_revision"],
+          base_revision: packet_hash["base_revision"],
+          merge_base: packet_hash["merge_base"],
+          target: packet_hash["target"],
+          verification: packet_hash["verification"],
+          evidence: packet_hash["evidence"],
+          git_context: packet_hash["git_context"],
+          diff_context: packet_hash["diff_context"],
+          rails_context: packet_hash["rails_context"],
+          source_context: packet_hash["source_context"],
+          policy: packet_hash["policy"],
+          baseline_state: packet_hash["baseline_state"],
+          waivers_state: packet_hash["waivers_state"],
+          ai_analysis: packet_hash["ai_analysis"],
+          verification_plan: packet_hash["verification_plan"],
+          constraints: packet_hash["constraints"],
+          instructions: packet_hash["instructions"],
+          completeness: packet_hash["completeness"],
+          success_criteria: packet_hash["success_criteria"],
+          boundary: packet_hash["boundary"]
+        )
+      end
+
+      def self.blocking_for(result, finding)
+        summary = result&.findings&.find { |f| f["fingerprint"] == finding.fingerprint }
+        return summary["blocking"] unless summary.nil?
+
+        true
+      end
+      private_class_method :blocking_for
+
+      def self.analyzer_result_for(result, finding)
+        (result&.analyzer_results || []).find { |ar| ar.analyzer == finding.analyzer }
+      end
+      private_class_method :analyzer_result_for
+
+      def self.build_evidence(finding, analyzer_result)
+        {
+          "analyzer" => finding.analyzer,
+          "tool_version" => analyzer_result&.tool_version,
+          "rule_id" => finding.rule_id,
+          "location" => finding.location,
+          "message" => finding.message,
+          "evidence_summary" => analyzer_result&.evidence_summary || {}
+        }.compact
+      end
+      private_class_method :build_evidence
+
+      def self.build_verification(result, configuration)
+        {
+          "gate" => result&.gate || "FAIL",
+          "policy_status" => result&.policy_status || "fail",
+          "mode" => configuration&.mode || "strict",
+          "decision_reasons" => result&.decision_reasons || [],
+          "comparison_counts" => result&.comparison&.fetch("counts", {}) || {}
+        }
+      end
+      private_class_method :build_verification
+
+      def self.build_git_context(result, context, finding)
+        git = result&.git || {}
+        path = finding.location["path"]
+        changed_lines = []
+        changed_file = nil
+        rename = nil
+        if context&.git_context
+          gc = context.git_context
+          changed_file = gc.changed_files.find { |f| f.path == path }
+          if changed_file
+            changed_file_h = { "path" => changed_file.path, "status" => changed_file.status.to_s, "score" => changed_file.score }
+            changed_file_h["old_path"] = changed_file.old_path if changed_file.old_path
+            changed_file_h["new_path"] = changed_file.new_path if changed_file.new_path
+            changed_file_h["binary"] = changed_file.binary if changed_file.respond_to?(:binary)
+            changed_file = changed_file_h
+          end
+          changed_lines = (gc.changed_line_set[path] || []).sort
+          if changed_file && changed_file["old_path"]
+            rename = { "new_path" => path, "old_path" => changed_file["old_path"] }
+          end
+        end
+        {
+          "head" => git["head"],
+          "base" => git["base"],
+          "merge_base" => git["merge_base"],
+          "changed_file" => changed_file,
+          "changed_lines_for_target" => changed_lines,
+          "rename" => rename
+        }
+      end
+      private_class_method :build_git_context
+
+      def self.build_rails_context(result)
+        rc = result&.rails_context || {}
+        detected = rc["detected"] || {}
+        entries = rc["entries"] || []
+        truncated = entries.length > 20
+        {
+          "detected" => detected,
+          "entry" => entries.first,
+          "related" => Array(entries.first&.fetch("related", nil)).first(20) || [],
+          "truncated" => truncated
+        }
+      rescue StandardError
+        { "detected" => {}, "entry" => nil, "related" => [], "truncated" => false }
+      end
+      private_class_method :build_rails_context
+
+      def self.build_source_context(root, finding)
+        path = finding.location["path"]
+        line = finding.location["start_line"]
+        snippets = []
+        if path
+          raw = Intelligence::SourceReader.read_snippet(repository_root: root, path: path, target_line: line)
+          if raw
+            content = raw[:content].to_s
+            if Intelligence::SecretDetector.content_secret?(content) || Intelligence::SecretDetector.filename_secret?(path)
+              content = "[REDACTED: probable secret detected]"
+            end
+            content = content.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "?").gsub(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/, "?")
+            snippets << { "path" => raw[:path], "content" => content, "truncated" => raw[:truncated] }
+          end
+        end
+        { "snippets" => snippets, "truncated" => snippets.any? { |s| s["truncated"] } }
+      rescue StandardError
+        { "snippets" => [], "truncated" => false }
+      end
+      private_class_method :build_source_context
+
+      def self.build_diff(root, runner, finding, context)
+        git_ctx = context&.git_context
+        return { "hunk" => "", "truncated" => false } unless git_ctx
+
+        h = DiffContext.build(repository_root: root, runner: runner, finding: finding, git_context: git_ctx)
+        h["hunk"] = h["hunk"].encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "?").gsub(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/, "?") rescue h["hunk"]
+        if Intelligence::SecretDetector.content_secret?(h["hunk"])
+          h["hunk"] = "[REDACTED: probable secret detected]"
+          h["truncated"] = true
+        end
+        h
+      rescue StandardError
+        { "hunk" => "", "truncated" => false }
+      end
+      private_class_method :build_diff
+
+      def self.build_baseline_state(root, configuration)
+        return { "loaded" => false, "path" => nil, "digest" => nil } unless configuration
+
+        path = Baseline.resolve_path(repository_root: root, configuration: configuration)
+        digest = Boundary.file_digest(path) rescue nil
+        loaded = !digest.nil?
+        { "loaded" => loaded, "path" => path, "digest" => digest }
+      rescue StandardError
+        { "loaded" => false, "path" => nil, "digest" => nil }
+      end
+      private_class_method :build_baseline_state
+
+      def self.build_waivers_state(root, configuration)
+        return { "count" => 0, "path" => nil, "digest" => nil } unless configuration
+
+        path = WaiverStore.resolve_path(repository_root: root, configuration: configuration)
+        digest = Boundary.file_digest(path) rescue nil
+        count = 0
+        begin
+          waivers = WaiverStore.read_optional(path)
+          count = waivers.length
+        rescue StandardError
+          count = 0
+        end
+        { "count" => count, "path" => path, "digest" => digest }
+      rescue StandardError
+        { "count" => 0, "path" => nil, "digest" => nil }
+      end
+      private_class_method :build_waivers_state
+    end
+  end
+end

data/lib/rail_verdict/repair/diff_context.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module Repair
+    module DiffContext
+      MAX_BYTES = 16 * 1024
+      CONTEXT_LINES = 15
+
+      def self.build(repository_root:, runner:, finding:, git_context:)
+        hunk = ""
+        truncated = false
+        return { "hunk" => "", "truncated" => false } unless finding && git_context
+
+        path = finding.location["path"] || finding.location[:path]
+        line = finding.location["start_line"] || finding.location[:start_line]
+        return { "hunk" => "", "truncated" => false } unless path
+
+        result = runner.run("git", ["diff", "-U#{CONTEXT_LINES}", git_context.merge_base, git_context.head, "--", path], chdir: repository_root, timeout_seconds: 5.0, max_stdout_bytes: MAX_BYTES + 1024)
+        raw = result.stdout.to_s
+        raw = raw.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "?")
+        raw = raw.gsub(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/, "?")
+        if raw.bytesize > MAX_BYTES
+          raw = raw.byteslice(0, MAX_BYTES)
+          truncated = true
+        end
+        if line
+          hunk = extract_target_hunk(raw, line)
+          hunk = raw if hunk.empty?
+        else
+          hunk = raw
+        end
+        if hunk.bytesize > MAX_BYTES
+          hunk = hunk.byteslice(0, MAX_BYTES)
+          truncated = true
+        end
+        { "hunk" => hunk, "truncated" => truncated }
+      rescue StandardError
+        { "hunk" => "", "truncated" => false }
+      end
+
+      def self.extract_target_hunk(diff, target_line)
+        hunks = diff.split(/^@@.*@@/)
+        hunks.shift
+        hunks.find { |h| h.lines.any? { |l| l.start_with?("+") } } || ""
+      rescue StandardError
+        ""
+      end
+      private_class_method :extract_target_hunk
+    end
+  end
+end

data/lib/rail_verdict/repair/packet.rb

@@ -0,0 +1,158 @@
+# frozen_string_literal: true
+
+require "digest"
+require "json"
+
+module RailVerdict
+  module Repair
+    class Packet
+      SCHEMA_VERSION = "1.0"
+      PACKET_ID_PATTERN = /\Asha256:[0-9a-f]{64}\z/
+
+      def self.packet_id_for(fingerprint:, source_revision:, base_revision:, configuration_digest:, baseline_digest:, analyzer_versions:)
+        payload = {
+          "packet_schema_version" => SCHEMA_VERSION,
+          "fingerprint" => fingerprint,
+          "source_revision" => source_revision,
+          "base_revision" => base_revision,
+          "configuration_digest" => configuration_digest,
+          "baseline_digest" => baseline_digest,
+          "analyzer_versions" => (analyzer_versions || {}).sort.to_h
+        }
+        sorted = payload.keys.sort.to_h { |k| [k, payload[k]] }
+        "sha256:#{Digest::SHA256.hexdigest(JSON.generate(sorted))}"
+      end
+
+      def self.validate_hash(hash)
+        errors = SchemaValidator.validate_repair_packet(hash)
+        raise ArgumentError, "invalid repair packet: #{errors.join('; ')}" unless errors.empty?
+
+        hash
+      end
+
+      attr_reader :packet_id, :created_at, :railverdict_version, :source_revision,
+                  :base_revision, :merge_base, :target, :verification, :evidence,
+                  :git_context, :diff_context, :rails_context, :source_context,
+                  :policy, :baseline_state, :waivers_state, :ai_analysis,
+                  :verification_plan, :constraints, :instructions, :completeness,
+                  :success_criteria, :boundary
+
+      def initialize(**kwargs)
+        @packet_id = kwargs.fetch(:packet_id).dup.freeze
+        @created_at = kwargs.fetch(:created_at).dup.freeze
+        @railverdict_version = kwargs.fetch(:railverdict_version).dup.freeze
+        @source_revision = kwargs[:source_revision]&.dup&.freeze
+        @base_revision = kwargs[:base_revision]&.dup&.freeze
+        @merge_base = kwargs[:merge_base]&.dup&.freeze
+        @target = deep_freeze(kwargs.fetch(:target))
+        @verification = deep_freeze(kwargs.fetch(:verification))
+        @evidence = deep_freeze(kwargs.fetch(:evidence))
+        @git_context = deep_freeze(kwargs.fetch(:git_context))
+        @diff_context = deep_freeze(kwargs.fetch(:diff_context) { { "hunk" => "", "truncated" => false } })
+        @rails_context = deep_freeze(kwargs.fetch(:rails_context))
+        @source_context = deep_freeze(kwargs.fetch(:source_context))
+        @policy = deep_freeze(kwargs.fetch(:policy))
+        @baseline_state = deep_freeze(kwargs.fetch(:baseline_state))
+        @waivers_state = deep_freeze(kwargs.fetch(:waivers_state))
+        @ai_analysis = kwargs[:ai_analysis] ? deep_freeze(kwargs[:ai_analysis]) : nil
+        @verification_plan = deep_freeze(kwargs.fetch(:verification_plan))
+        @constraints = deep_freeze(kwargs.fetch(:constraints))
+        @instructions = (kwargs[:instructions] || []).map(&:dup).map(&:freeze).freeze
+        @completeness = deep_freeze(kwargs.fetch(:completeness))
+        @success_criteria = deep_freeze(kwargs.fetch(:success_criteria))
+        @boundary = deep_freeze(kwargs.fetch(:boundary))
+        validate!
+        freeze
+      end
+
+      def to_h
+        h = {
+          "schema_version" => SCHEMA_VERSION,
+          "packet_id" => packet_id,
+          "created_at" => created_at,
+          "railverdict_version" => railverdict_version,
+          "source_revision" => source_revision,
+          "target" => target,
+          "verification" => verification,
+          "evidence" => evidence,
+          "git_context" => git_context,
+          "rails_context" => rails_context,
+          "source_context" => source_context,
+          "policy" => policy,
+          "baseline_state" => baseline_state,
+          "waivers_state" => waivers_state,
+          "verification_plan" => verification_plan,
+          "constraints" => constraints,
+          "completeness" => completeness,
+          "success_criteria" => success_criteria,
+          "boundary" => boundary
+        }
+        h["base_revision"] = base_revision unless base_revision.nil?
+        h["merge_base"] = merge_base unless merge_base.nil?
+        h["diff_context"] = diff_context if diff_context
+        h["ai_analysis"] = ai_analysis if ai_analysis
+        h["instructions"] = instructions unless instructions.empty?
+        h
+      end
+
+      def to_json(*args)
+        JSON.generate(to_h, *args)
+      end
+
+      private
+
+      def validate!
+        raise ArgumentError, "packet_id invalid" unless packet_id.match?(PACKET_ID_PATTERN)
+
+        errors = SchemaValidator.validate_repair_packet(to_h_without_validation)
+        raise ArgumentError, "invalid repair packet: #{errors.join('; ')}" unless errors.empty?
+      end
+
+      def to_h_without_validation
+        h = {
+          "schema_version" => SCHEMA_VERSION,
+          "packet_id" => packet_id,
+          "created_at" => created_at,
+          "railverdict_version" => railverdict_version,
+          "source_revision" => source_revision,
+          "target" => target,
+          "verification" => verification,
+          "evidence" => evidence,
+          "git_context" => git_context,
+          "rails_context" => rails_context,
+          "source_context" => source_context,
+          "policy" => policy,
+          "baseline_state" => baseline_state,
+          "waivers_state" => waivers_state,
+          "verification_plan" => verification_plan,
+          "constraints" => constraints,
+          "completeness" => completeness,
+          "success_criteria" => success_criteria,
+          "boundary" => boundary
+        }
+        h["base_revision"] = base_revision unless base_revision.nil?
+        h["merge_base"] = merge_base unless merge_base.nil?
+        h["diff_context"] = diff_context if diff_context
+        h["ai_analysis"] = ai_analysis if ai_analysis
+        h["instructions"] = instructions unless instructions.empty?
+        h
+      end
+
+      def deep_freeze(value)
+        case value
+        when Hash
+          value.each { |k, v| k.freeze if k.is_a?(String); deep_freeze(v) }
+          value.freeze
+        when Array
+          value.each { |v| deep_freeze(v) }
+          value.freeze
+        when String
+          value.freeze
+        else
+          value
+        end
+        value
+      end
+    end
+  end
+end

data/lib/rail_verdict/repair/prompt_renderer.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module Repair
+    module PromptRenderer
+      def self.render(packet_hash)
+        trusted = packet_hash["instructions"] || Constraints.instructions
+        plan = packet_hash["verification_plan"] || {}
+        untrusted = {
+          "finding" => packet_hash.dig("target", "finding"),
+          "evidence" => packet_hash["evidence"],
+          "source_context" => packet_hash["source_context"],
+          "diff_context" => packet_hash["diff_context"],
+          "rails_context" => packet_hash["rails_context"]
+        }
+        <<~PROMPT
+          TRUSTED_RAILVERDICT_INSTRUCTIONS:
+          #{trusted.join("\n")}
+          Verification required: #{plan.dig("required", 0, "display") || "bundle exec railverdict check"}
+
+          UNTRUSTED_REPOSITORY_DATA:
+          #{JSON.generate(untrusted)}
+        PROMPT
+      end
+    end
+  end
+end

data/lib/rail_verdict/repair/verification_plan.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module Repair
+    module VerificationPlan
+      def self.build(outcome:, repository_root: nil, base_revision: nil)
+        required = [required_check(base_revision: base_revision)]
+        suggested = suggested_commands(outcome)
+        { "required" => required, "suggested" => suggested }
+      end
+
+      def self.required_check(base_revision: nil)
+        argv = ["exec", "railverdict", "check"]
+        if base_revision && !base_revision.strip.empty?
+          argv += ["--changed", "--base", base_revision.strip]
+        end
+        {
+          "executable" => "bundle",
+          "argv" => argv,
+          "display" => "bundle #{argv.join(' ')}"
+        }
+      end
+
+      def self.suggested_commands(outcome)
+        findings = outcome.findings || []
+        analyzers = findings.map(&:analyzer).uniq.sort
+        analyzers.first(3).map do |analyzer|
+          case analyzer
+          when "rubocop"
+            { "executable" => "bundle", "argv" => ["exec", "rubocop"], "display" => "bundle exec rubocop" }
+          when "minitest"
+            { "executable" => "bundle", "argv" => ["exec", "rake", "test"], "display" => "bundle exec rake test" }
+          when "rspec"
+            { "executable" => "bundle", "argv" => ["exec", "rspec"], "display" => "bundle exec rspec" }
+          when "bundler_audit"
+            { "executable" => "bundle", "argv" => ["exec", "bundler-audit", "check"], "display" => "bundle exec bundler-audit check" }
+          else
+            nil
+          end
+        end.compact
+      end
+      private_class_method :suggested_commands
+    end
+  end
+end

data/lib/rail_verdict/repair/verifier.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module Repair
+    module Verifier
+      Result = Struct.new(:target_status, :gate, :completion_status, :new_blocking_findings, :verification_boundary_changed, :regressed, :overall_status, keyword_init: true) do
+        def overall_status
+          self[:overall_status] || derive_overall
+        end
+
+        private
+
+        def derive_overall
+          return "incomplete" if completion_status == "incomplete" || target_status == "incomplete"
+          return "boundary_changed" if verification_boundary_changed && verification_boundary_changed != false
+          return "successful" if target_status == "fixed" && %w[PASS WARN].include?(gate) && !regressed
+
+          "unsuccessful"
+        end
+      end
+
+      def self.verify(packet:, new_outcome:)
+        packet_hash = packet.is_a?(Packet) ? packet.to_h : packet
+        fingerprint = packet_hash.dig("target", "finding", "fingerprint")
+        new_findings = new_outcome.findings || []
+        new_result = new_outcome.result
+
+        if new_result&.incomplete?
+          return Result.new(
+            target_status: "incomplete",
+            gate: new_result.gate,
+            completion_status: new_result.completion_status,
+            new_blocking_findings: new_result.findings.count { |f| f["blocking"] },
+            verification_boundary_changed: boundary_changed?(packet_hash, new_outcome),
+            regressed: false
+          )
+        end
+
+        target_still = new_findings.find { |f| f.fingerprint == fingerprint }
+        target_status = if target_still.nil?
+                          changed = new_findings.find { |f| f.location["path"] == packet_hash.dig("target", "finding", "location", "path") && f.analyzer == packet_hash.dig("target", "finding", "analyzer") && f.rule_id == packet_hash.dig("target", "finding", "rule_id") }
+                          if changed
+                            changed.message == packet_hash.dig("target", "finding", "message") ? "moved" : "changed"
+                          else
+                            "fixed"
+                          end
+                        else
+                          "still_present"
+                        end
+
+        boundary = boundary_changed?(packet_hash, new_outcome)
+        blocking_now = new_result.findings.count { |f| f["blocking"] }
+        old_blocking = packet_hash.dig("verification", "comparison_counts") || {}
+        regressed = blocking_now > 0 && target_status == "fixed"
+
+        res = Result.new(
+          target_status: target_status,
+          gate: new_result.gate,
+          completion_status: new_result.completion_status,
+          new_blocking_findings: blocking_now,
+          verification_boundary_changed: boundary,
+          regressed: regressed
+        )
+        res[:overall_status] = res.overall_status
+        res
+      end
+
+      def self.boundary_changed?(packet_hash, new_outcome)
+        old = packet_hash["boundary"] || {}
+        root = new_outcome.context&.repository_root || Dir.pwd
+        config = new_outcome.configuration
+        current = Boundary.snapshot(repository_root: root, configuration: config, outcome: new_outcome)
+        changed = {}
+        changed["config"] = true if old["configuration_digest"] && current["configuration_digest"] && old["configuration_digest"] != current["configuration_digest"]
+        changed["baseline"] = true if old["baseline_digest"] != current["baseline_digest"]
+        changed["waivers"] = true if old["waivers_digest"] != current["waivers_digest"]
+        changed["base"] = true if old["base_revision"] != current["base_revision"] && !(old["base_revision"].nil? && current["base_revision"].nil?)
+        changed["source"] = true if old["source_revision"] != current["source_revision"] && !(old["source_revision"].nil? && current["source_revision"].nil?)
+        changed.empty? ? false : changed
+      end
+      private_class_method :boundary_changed?
+    end
+  end
+end