@bli-cockpit/cli 0.1.19 → 0.1.21

package/dist/adapters/raw-evidence.js

@@ -1,16 +1,15 @@
-import { SECRET_FILE_SEGMENT_PATTERN, SourceScanResultSchema, containsSecretLikeContent, } from "@bli-cockpit/telemetry-core";
-import { execFile } from "node:child_process";
+import { EvidenceCompletenessPayloadSchema, SECRET_FILE_SEGMENT_PATTERN, SourceScanResultSchema, containsSecretLikeContent, } from "@bli-cockpit/telemetry-core";
+import { spawn } from "node:child_process";
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { promisify } from "node:util";
 import { makeSourceAdapterIdentity, } from "./common.js";
 import { collectAgentImageEvidenceFromJsonlFile, } from "./agent-image-evidence.js";
-const execFileAsync = promisify(execFile);
 const DEFAULT_SINCE_MINUTES = 24 * 60;
 const DEFAULT_SESSION_LIMIT = 50;
 const MAX_GIT_DIFF_BYTES = 2 * 1024 * 1024;
+const GIT_DIFF_TIMEOUT_MS = 3_000;
 export const RAW_EVIDENCE_BUCKET = "ambient-raw-evidence";
 export const RAW_EVIDENCE_RETENTION_MODE = "remote_durable";
 // Per-sync upload budgets enforced at COLLECTION time (D7b). With sidecars a
@@ -28,39 +27,97 @@ export async function collectRawEvidencePack(context, options) {
     const filesDir = path.join(evidenceDir, "files");
     const entries = [];
     const skipped = [];
+    const truncated = [];
+    const failed = [];
     const reused = [];
+    const sinceMinutes = options.sinceMinutes ?? DEFAULT_SINCE_MINUTES;
+    const sessionLimit = options.sessionLimit ?? DEFAULT_SESSION_LIMIT;
+    const byteBudget = options.byteBudget ?? RAW_EVIDENCE_DEFAULT_BYTE_BUDGET;
+    const objectBudget = options.objectBudget ?? RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET;
     const collection = {
         context,
         filesDir,
         packId,
         entries,
         skipped,
+        truncated,
+        failed,
         reused,
+        scanned: new Map(),
+        caps: [
+            {
+                source: "raw_evidence",
+                cap_type: "byte_budget",
+                limit: byteBudget,
+                observed: options.budget?.remainingBytes ?? byteBudget,
+                applied: false,
+            },
+            {
+                source: "raw_evidence",
+                cap_type: "object_budget",
+                limit: objectBudget,
+                observed: options.budget?.remainingObjects ?? objectBudget,
+                applied: false,
+            },
+            {
+                source: "git_diff",
+                cap_type: "max_bytes_per_diff",
+                limit: MAX_GIT_DIFF_BYTES,
+                applied: false,
+            },
+            {
+                source: "git_diff",
+                cap_type: "timeout_ms",
+                limit: GIT_DIFF_TIMEOUT_MS,
+                applied: false,
+            },
+            {
+                source: "claude_jsonl",
+                cap_type: "max_file_bytes",
+                limit: CLAUDE_MAX_COLLECT_FILE_BYTES,
+                applied: false,
+            },
+            {
+                source: "claude_jsonl_sidecar",
+                cap_type: "max_file_bytes",
+                limit: CLAUDE_MAX_COLLECT_FILE_BYTES,
+                applied: false,
+            },
+        ],
         skipContentHashes: options.skipContentHashes ?? new Set(),
         budget: options.budget ?? {
-            remainingBytes: options.byteBudget ?? RAW_EVIDENCE_DEFAULT_BYTE_BUDGET,
-            remainingObjects: options.objectBudget ?? RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET,
+            remainingBytes: byteBudget,
+            remainingObjects: objectBudget,
         },
         index: { value: 0 },
     };
     try {
         await ensurePrivateDir(evidenceDir);
         await ensurePrivateDir(filesDir);
+        recordAttributionCompleteness(collection, {
+            codex: options.codexAttributionScan,
+            claude: options.claudeAttributionScan,
+        });
         if (options.includeCodexJsonl !== false) {
             await collectCodexJsonlFiles(collection, {
                 codexSessionFiles: options.codexSessionFiles,
                 sessionsDir: options.sessionsDir,
-                sinceMinutes: options.sinceMinutes ?? DEFAULT_SINCE_MINUTES,
-                limit: options.sessionLimit ?? DEFAULT_SESSION_LIMIT,
+                sinceMinutes,
+                limit: sessionLimit,
             });
         }
         if (options.includeClaudeJsonl !== false && options.claudeSessionFiles) {
             await collectClaudeJsonlFiles(collection, options.claudeSessionFiles);
         }
         await collectGitDiffFiles(collection, options.repoRoot);
-        const deferredByteBudgetCount = skipped.filter((entry) => entry.reason === "deferred_byte_budget").length;
-        const deferredObjectBudgetCount = skipped.filter((entry) => entry.reason === "deferred_object_budget").length;
+        const deferredByteBudgetCount = skipped.filter((entry) => entry.reason === "deferred_byte_budget").reduce((sum, entry) => sum + evidenceEntryCount(entry), 0);
+        const deferredObjectBudgetCount = skipped.filter((entry) => entry.reason === "deferred_object_budget").reduce((sum, entry) => sum + evidenceEntryCount(entry), 0);
         if (entries.length === 0) {
+            const evidenceCompleteness = makeEvidenceCompleteness(collection, {
+                startedAt,
+                finishedAt: context.now.toISOString(),
+                sinceMinutes,
+            });
             const facts = {
                 pack_id: packId,
                 manifest_path: path.join(evidenceDir, "manifest.json"),
@@ -68,11 +125,12 @@ export async function collectRawEvidencePack(context, options) {
                 storage_bucket: RAW_EVIDENCE_BUCKET,
                 file_count: 0,
                 byte_size: 0,
-                skipped_count: skipped.length,
+                skipped_count: countEvidenceEntries(skipped),
                 reused_count: reused.length,
                 deferred_byte_budget_count: deferredByteBudgetCount,
                 deferred_object_budget_count: deferredObjectBudgetCount,
                 content_kinds: [],
+                evidence_completeness: evidenceCompleteness,
                 pointers: [],
                 upload_files: [],
                 reused,
@@ -109,6 +167,11 @@ export async function collectRawEvidencePack(context, options) {
             bytes: manifestBytes,
         });
         entries.push(manifestEntry);
+        const evidenceCompleteness = makeEvidenceCompleteness(collection, {
+            startedAt,
+            finishedAt: context.now.toISOString(),
+            sinceMinutes,
+        });
         const facts = {
             pack_id: packId,
             manifest_path: manifestPath,
@@ -116,11 +179,12 @@ export async function collectRawEvidencePack(context, options) {
             storage_bucket: RAW_EVIDENCE_BUCKET,
             file_count: entries.length,
             byte_size: entries.reduce((sum, entry) => sum + entry.byte_size, 0),
-            skipped_count: skipped.length,
+            skipped_count: countEvidenceEntries(skipped),
             reused_count: reused.length,
             deferred_byte_budget_count: deferredByteBudgetCount,
             deferred_object_budget_count: deferredObjectBudgetCount,
             content_kinds: [...new Set(entries.map((entry) => entry.kind))],
+            evidence_completeness: evidenceCompleteness,
             pointers: entries.map(pointerFromEntry),
             upload_files: entries.map((entry) => ({
                 pointer: pointerFromEntry(entry),
@@ -143,18 +207,46 @@ export async function collectRawEvidencePack(context, options) {
             }),
         };
     }
-    catch (error) {
-        const scan = SourceScanResultSchema.parse({
-            adapter: makeSourceAdapterIdentity("collector_runtime", "raw-evidence-pack"),
-            work_context_id: context.workContextId,
-            status: "failed",
-            started_at: startedAt,
-            finished_at: context.now.toISOString(),
-            diagnostic_labels: [
-                `raw_evidence_failed:${error instanceof Error ? error.message : String(error)}`,
-            ],
+    catch {
+        failed.push({
+            kind: "raw_evidence",
+            reason: "collection_failed",
         });
-        return { scan, facts: null };
+        const evidenceCompleteness = makeEvidenceCompleteness(collection, {
+            startedAt,
+            finishedAt: context.now.toISOString(),
+            sinceMinutes,
+        });
+        const facts = {
+            pack_id: packId,
+            manifest_path: path.join(evidenceDir, "manifest.json"),
+            evidence_dir: evidenceDir,
+            storage_bucket: RAW_EVIDENCE_BUCKET,
+            file_count: 0,
+            byte_size: 0,
+            skipped_count: countEvidenceEntries(skipped),
+            reused_count: reused.length,
+            deferred_byte_budget_count: skipped
+                .filter((entry) => entry.reason === "deferred_byte_budget")
+                .reduce((sum, entry) => sum + evidenceEntryCount(entry), 0),
+            deferred_object_budget_count: skipped
+                .filter((entry) => entry.reason === "deferred_object_budget")
+                .reduce((sum, entry) => sum + evidenceEntryCount(entry), 0),
+            content_kinds: [],
+            evidence_completeness: evidenceCompleteness,
+            pointers: [],
+            upload_files: [],
+            reused,
+        };
+        return {
+            facts,
+            scan: makeRawEvidenceScan({
+                context,
+                startedAt,
+                status: "failed",
+                facts,
+            }),
+        };
     }
 }
 function makeRawEvidenceScan(options) {
@@ -185,20 +277,128 @@ function makeRawEvidenceScan(options) {
             `bytes:${options.facts.byte_size}`,
             `skipped:${options.facts.skipped_count}`,
             `reused:${options.facts.reused_count}`,
+            `completeness:${options.facts.evidence_completeness.status}`,
+            `truncated:${options.facts.evidence_completeness.totals.truncated_count}`,
+            `deferred:${options.facts.evidence_completeness.totals.deferred_count}`,
+            `failed:${options.facts.evidence_completeness.totals.failed_count}`,
             ...options.facts.content_kinds.map((kind) => `kind:${kind}`),
         ],
     });
 }
+function recordAttributionCompleteness(collection, scans) {
+    if (scans.codex)
+        recordCodexAttributionCompleteness(collection, scans.codex);
+    if (scans.claude)
+        recordClaudeAttributionCompleteness(collection, scans.claude);
+}
+function recordCodexAttributionCompleteness(collection, scan) {
+    recordScanned(collection, "codex_attribution", scan.scanned_file_count);
+    collection.caps.push({
+        source: "codex_attribution",
+        cap_type: "scan_window_minutes",
+        limit: scan.since_minutes,
+        observed: scan.since_minutes,
+        applied: false,
+    }, {
+        source: "codex_attribution",
+        cap_type: "session_limit",
+        limit: scan.session_limit,
+        observed: scan.discovered_file_count,
+        applied: scan.session_limit_applied,
+    }, {
+        source: "codex_attribution",
+        cap_type: "max_file_bytes",
+        limit: scan.max_file_bytes,
+        applied: scan.results.some((result) => result.reason === "file_too_large"),
+    });
+    recordSkipCount(collection, "codex_attribution", "session_limit_overflow", Math.max(0, scan.discovered_file_count - scan.scanned_file_count));
+    recordSkipCount(collection, "codex_attribution", "directory_read_failed", scan.directory_read_failed_count);
+    recordSkipCount(collection, "codex_attribution", "file_stat_failed", scan.stat_failed_count);
+    recordSkipCount(collection, "codex_attribution", "secret_like_directory", scan.secret_path_skipped_count);
+    recordAttributionResultSkips(collection, "codex_attribution", scan.results);
+}
+function recordClaudeAttributionCompleteness(collection, scan) {
+    recordScanned(collection, "claude_attribution", scan.scanned_session_count);
+    if (scan.disabled_reason) {
+        recordSkipCount(collection, "claude_attribution", scan.disabled_reason, 1);
+    }
+    collection.caps.push({
+        source: "claude_attribution",
+        cap_type: "scan_window_minutes",
+        limit: scan.since_minutes,
+        observed: scan.since_minutes,
+        applied: false,
+    }, {
+        source: "claude_attribution",
+        cap_type: "session_limit",
+        limit: scan.session_limit,
+        observed: scan.discovered_session_count,
+        applied: scan.session_limit_applied,
+    }, {
+        source: "claude_attribution",
+        cap_type: "max_file_bytes",
+        limit: scan.max_file_bytes,
+        applied: scan.counts.mains_oversized > 0 ||
+            scan.results.some((result) => result.reason === "file_too_large"),
+    }, {
+        source: "claude_attribution",
+        cap_type: "max_sidecar_files",
+        limit: scan.max_sidecar_files,
+        observed: scan.max_sidecar_files + scan.counts.sidecars_capped,
+        applied: scan.counts.sidecars_capped > 0,
+    }, {
+        source: "claude_attribution",
+        cap_type: "max_line_buffer_bytes",
+        limit: scan.max_line_buffer_bytes,
+        applied: scan.counts.oversized_lines_skipped > 0,
+    });
+    recordSkipCount(collection, "claude_attribution", "session_limit_overflow", Math.max(0, scan.discovered_session_count - scan.scanned_session_count));
+    recordSkipCount(collection, "claude_attribution", "secret_like_project_dir", scan.project_dirs_skipped);
+    recordSkipCount(collection, "claude_attribution", "project_dir_read_failed", scan.project_dir_read_failed_count);
+    recordSkipCount(collection, "claude_attribution", "session_stat_failed", scan.session_stat_failed_count);
+    recordSkipCount(collection, "claude_attribution", "sidecar_dir_read_failed", scan.sidecar_dir_read_failed_count);
+    recordSkipCount(collection, "claude_attribution", "sidecar_stat_failed", scan.sidecar_stat_failed_count);
+    recordSkipCount(collection, "claude_attribution", "sidecar_limit_overflow", scan.counts.sidecars_capped);
+    recordTruncationCount(collection, "claude_attribution", "oversized_jsonl_line", scan.counts.oversized_lines_skipped, { max_bytes: scan.max_line_buffer_bytes });
+    recordAttributionResultSkips(collection, "claude_attribution", scan.results);
+    for (const result of scan.results) {
+        for (const sidecar of result.sidecar_files) {
+            if (!sidecar.skipped_reason)
+                continue;
+            recordSkipCount(collection, "claude_attribution", `sidecar_${sidecar.skipped_reason}`, 1);
+        }
+    }
+}
+function recordAttributionResultSkips(collection, source, results) {
+    for (const result of results) {
+        if (result.state === "attributed")
+            continue;
+        const reason = result.state === "skipped"
+            ? result.reason
+            : `attribution_${result.state}:${result.reason}`;
+        recordSkipCount(collection, source, reason, 1);
+    }
+}
 async function collectCodexJsonlFiles(collection, options) {
-    const candidates = options.codexSessionFiles
+    const resolvedCandidates = options.codexSessionFiles
         ? options.codexSessionFiles.map((file) => ({
             filePath: file.local_path,
             codexSessionId: file.codex_session_id,
         }))
         : (await walkJsonlFiles(options.sessionsDir ?? path.join(os.homedir(), ".codex", "sessions"), collection.context.now.getTime() - options.sinceMinutes * 60 * 1000))
-            .slice(0, options.limit)
             .map((filePath) => ({ filePath, codexSessionId: null }));
+    collection.caps.push({
+        source: "codex_jsonl",
+        cap_type: "session_limit",
+        limit: options.limit,
+        observed: resolvedCandidates.length,
+        applied: !options.codexSessionFiles && resolvedCandidates.length > options.limit,
+    });
+    const candidates = options.codexSessionFiles
+        ? resolvedCandidates
+        : resolvedCandidates.slice(0, options.limit);
     for (const candidate of candidates) {
+        recordScanned(collection, "codex_jsonl");
         const codexSessionId = candidate.codexSessionId ?? shortHash(candidate.filePath);
         const transcriptAccepted = await collectOneEvidenceFile(collection, {
             filePath: candidate.filePath,
@@ -220,6 +420,7 @@ async function collectCodexJsonlFiles(collection, options) {
     }
 }
 async function collectClaudeJsonlFiles(collection, sessions) {
+    recordScanned(collection, "claude_jsonl", sessions.reduce((count, session) => count + 1 + session.sidecar_files.length, 0));
     for (const session of sessions) {
         const sessionId = session.claude_session_id;
         if (session.main_file_oversized) {
@@ -300,6 +501,7 @@ async function collectAgentImagesFromTranscript(collection, options) {
         sessionId: options.sessionId,
         sidecarId: options.sidecarId,
     });
+    recordScanned(collection, options.kind, result.images.length + result.skipped.length);
     for (const skipped of result.skipped) {
         collection.skipped.push({
             kind: options.kind,
@@ -336,6 +538,7 @@ async function collectOneAgentImageFile(collection, options) {
     }
     const deferReason = admitToBudget(collection.budget, raw.byteLength);
     if (deferReason) {
+        markBudgetCapApplied(collection, deferReason);
         collection.skipped.push({
             kind: options.kind,
             label: options.image.label,
@@ -392,6 +595,7 @@ async function collectOneEvidenceFile(collection, options) {
         return false;
     }
     if (options.maxFileBytes && raw.byteLength > options.maxFileBytes) {
+        markCapApplied(collection, options.kind, "max_file_bytes");
         collection.skipped.push({
             kind: options.kind,
             label: fileName,
@@ -419,6 +623,7 @@ async function collectOneEvidenceFile(collection, options) {
     }
     const deferReason = admitToBudget(collection.budget, raw.byteLength);
     if (deferReason) {
+        markBudgetCapApplied(collection, deferReason);
         collection.skipped.push({
             kind: options.kind,
             label: fileName,
@@ -465,10 +670,34 @@ async function collectGitDiffFiles(collection, repoRoot) {
         { label: "staged", args: ["diff", "--cached", "--no-ext-diff", "--"] },
     ];
     for (const target of diffTargets) {
-        const diff = await runGitDiff(target.args, repoRoot);
-        if (!diff.trim())
+        recordScanned(collection, "git_diff");
+        let diff;
+        try {
+            diff = await runGitDiff(target.args, repoRoot);
+        }
+        catch {
+            collection.skipped.push({
+                kind: "git_diff",
+                label: target.label,
+                reason: "git_diff_failed",
+            });
+            continue;
+        }
+        if (diff.truncated) {
+            markCapApplied(collection, "git_diff", diff.truncationCapType);
+            collection.truncated.push({
+                kind: "git_diff",
+                reason: diff.truncationReason,
+                ...(diff.truncationCapType === "max_bytes_per_diff"
+                    ? { max_bytes: MAX_GIT_DIFF_BYTES }
+                    : {}),
+                observed_bytes: diff.observedBytes,
+                included_bytes: Buffer.byteLength(diff.stdout, "utf8"),
+            });
+        }
+        if (!diff.stdout.trim())
             continue;
-        if (containsSecretLikeContent(diff)) {
+        if (containsSecretLikeContent(diff.stdout)) {
             collection.skipped.push({
                 kind: "git_diff",
                 label: target.label,
@@ -476,7 +705,7 @@ async function collectGitDiffFiles(collection, repoRoot) {
             });
             continue;
         }
-        const raw = Buffer.from(diff.slice(0, MAX_GIT_DIFF_BYTES), "utf8");
+        const raw = Buffer.from(diff.stdout, "utf8");
         const contentHash = sha256(raw);
         if (collection.skipContentHashes.has(contentHash)) {
             collection.reused.push({
@@ -489,6 +718,7 @@ async function collectGitDiffFiles(collection, repoRoot) {
         }
         const deferReason = admitToBudget(collection.budget, raw.byteLength);
         if (deferReason) {
+            markBudgetCapApplied(collection, deferReason);
             collection.skipped.push({
                 kind: "git_diff",
                 label: target.label,
@@ -507,7 +737,9 @@ async function collectGitDiffFiles(collection, repoRoot) {
             localPath: destination,
             relativePath,
             mediaType: "text/x-diff",
-            redactedSummary: `Raw git ${target.label} diff preserved locally with env/secret paths excluded.`,
+            redactedSummary: diff.truncated
+                ? `Raw git ${target.label} diff truncated to the capture cap and preserved locally with env/secret paths excluded.`
+                : `Raw git ${target.label} diff preserved locally with env/secret paths excluded.`,
             bytes: raw,
             contentAddress: `git-diff/${target.label}-${contentHash.slice(0, 16)}.diff`,
         }));
@@ -526,12 +758,232 @@ async function runGitDiff(args, repoRoot) {
         ":(exclude)**/*.pem",
         ":(exclude)**/*.key",
     ];
-    const { stdout } = await execFileAsync("git", [...args, ...pathspec], {
-        cwd: repoRoot,
-        timeout: 3_000,
-        maxBuffer: MAX_GIT_DIFF_BYTES + 1024,
+    return new Promise((resolve, reject) => {
+        const child = spawn("git", [...args, ...pathspec], {
+            cwd: repoRoot,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        const stdoutChunks = [];
+        const stderrChunks = [];
+        let observedBytes = 0;
+        let includedBytes = 0;
+        let truncated = false;
+        let timedOut = false;
+        const timeout = setTimeout(() => {
+            timedOut = true;
+            truncated = true;
+            child.kill("SIGTERM");
+        }, GIT_DIFF_TIMEOUT_MS);
+        child.stdout.on("data", (chunk) => {
+            observedBytes += chunk.byteLength;
+            if (includedBytes < MAX_GIT_DIFF_BYTES) {
+                const remaining = MAX_GIT_DIFF_BYTES - includedBytes;
+                const next = chunk.subarray(0, remaining);
+                stdoutChunks.push(next);
+                includedBytes += next.byteLength;
+            }
+            if (observedBytes > MAX_GIT_DIFF_BYTES) {
+                truncated = true;
+                child.kill("SIGTERM");
+            }
+        });
+        child.stderr.on("data", (chunk) => {
+            if (stderrChunks.reduce((sum, item) => sum + item.byteLength, 0) < 4096) {
+                stderrChunks.push(chunk.subarray(0, 4096));
+            }
+        });
+        child.on("error", (error) => {
+            clearTimeout(timeout);
+            reject(error);
+        });
+        child.on("close", (code, signal) => {
+            clearTimeout(timeout);
+            if (code === 0 || truncated || signal === "SIGTERM") {
+                resolve({
+                    stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+                    truncated,
+                    observedBytes,
+                    truncationReason: timedOut
+                        ? "git_diff_timeout"
+                        : "max_git_diff_bytes",
+                    truncationCapType: timedOut ? "timeout_ms" : "max_bytes_per_diff",
+                });
+                return;
+            }
+            const stderr = Buffer.concat(stderrChunks).toString("utf8").trim();
+            reject(new Error(stderr || `git diff failed with code ${code ?? signal}`));
+        });
+    });
+}
+function recordScanned(collection, source, count = 1) {
+    collection.scanned.set(source, (collection.scanned.get(source) ?? 0) + count);
+}
+function markBudgetCapApplied(collection, reason) {
+    markCapApplied(collection, "raw_evidence", reason === "deferred_object_budget" ? "object_budget" : "byte_budget");
+}
+function markCapApplied(collection, source, capType) {
+    const cap = collection.caps.find((candidate) => candidate.source === source && candidate.cap_type === capType);
+    if (cap)
+        cap.applied = true;
+}
+function recordSkipCount(collection, source, reason, count) {
+    if (count <= 0)
+        return;
+    collection.skipped.push({
+        kind: source,
+        label: reason,
+        reason,
+        count,
+    });
+}
+function recordTruncationCount(collection, source, reason, count, details = {}) {
+    if (count <= 0)
+        return;
+    collection.truncated.push({
+        kind: source,
+        reason,
+        count,
+        ...details,
+    });
+}
+function evidenceEntryCount(entry) {
+    return entry.count ?? 1;
+}
+function countEvidenceEntries(entries, predicate = () => true) {
+    return entries.reduce((sum, entry) => sum + (predicate(entry) ? evidenceEntryCount(entry) : 0), 0);
+}
+function makeEvidenceCompleteness(collection, options) {
+    const sources = new Set(collection.scanned.keys());
+    for (const entry of collection.entries)
+        sources.add(entry.kind);
+    for (const entry of collection.skipped)
+        sources.add(entry.kind);
+    for (const entry of collection.reused)
+        sources.add(entry.kind);
+    for (const entry of collection.truncated)
+        sources.add(entry.kind);
+    for (const entry of collection.failed)
+        sources.add(entry.kind);
+    const sourceCounts = [...sources].sort().map((source) => {
+        const skipped = collection.skipped.filter((entry) => entry.kind === source);
+        return {
+            source,
+            scanned_count: collection.scanned.get(source) ?? 0,
+            included_count: collection.entries.filter((entry) => entry.kind === source).length,
+            skipped_count: countEvidenceEntries(skipped),
+            truncated_count: countEvidenceEntries(collection.truncated, (entry) => entry.kind === source),
+            deferred_count: countEvidenceEntries(skipped, (entry) => entry.reason.startsWith("deferred_")),
+            reused_count: collection.reused.filter((entry) => entry.kind === source).length,
+            failed_count: countEvidenceEntries(collection.failed, (entry) => entry.kind === source),
+        };
+    });
+    const totals = sourceCounts.reduce((sum, count) => ({
+        scanned_count: sum.scanned_count + count.scanned_count,
+        included_count: sum.included_count + count.included_count,
+        skipped_count: sum.skipped_count + count.skipped_count,
+        truncated_count: sum.truncated_count + count.truncated_count,
+        deferred_count: sum.deferred_count + count.deferred_count,
+        reused_count: sum.reused_count + count.reused_count,
+        failed_count: sum.failed_count + count.failed_count,
+    }), {
+        scanned_count: 0,
+        included_count: 0,
+        skipped_count: 0,
+        truncated_count: 0,
+        deferred_count: 0,
+        reused_count: 0,
+        failed_count: 0,
+    });
+    const skipReasonCounts = new Map();
+    for (const skipped of collection.skipped) {
+        const key = `${skipped.kind}:${skipped.reason}`;
+        const existing = skipReasonCounts.get(key);
+        if (existing) {
+            existing.count += evidenceEntryCount(skipped);
+        }
+        else {
+            skipReasonCounts.set(key, {
+                source: skipped.kind,
+                reason: skipped.reason,
+                count: evidenceEntryCount(skipped),
+            });
+        }
+    }
+    const failureReasonCounts = new Map();
+    for (const failed of collection.failed) {
+        const key = `${failed.kind}:${failed.reason}`;
+        const existing = failureReasonCounts.get(key);
+        if (existing) {
+            existing.count += evidenceEntryCount(failed);
+        }
+        else {
+            failureReasonCounts.set(key, {
+                source: failed.kind,
+                reason: failed.reason,
+                count: evidenceEntryCount(failed),
+            });
+        }
+    }
+    const truncationCounts = new Map();
+    for (const truncated of collection.truncated) {
+        const key = `${truncated.kind}:${truncated.reason}`;
+        const existing = truncationCounts.get(key);
+        if (existing) {
+            existing.count += evidenceEntryCount(truncated);
+            existing.observed_bytes = Math.max(existing.observed_bytes ?? 0, truncated.observed_bytes ?? 0);
+            existing.included_bytes = Math.max(existing.included_bytes ?? 0, truncated.included_bytes ?? 0);
+        }
+        else {
+            truncationCounts.set(key, {
+                source: truncated.kind,
+                reason: truncated.reason,
+                count: evidenceEntryCount(truncated),
+                ...(truncated.max_bytes !== undefined
+                    ? { max_bytes: truncated.max_bytes }
+                    : {}),
+                ...(truncated.observed_bytes !== undefined
+                    ? { observed_bytes: truncated.observed_bytes }
+                    : {}),
+                ...(truncated.included_bytes !== undefined
+                    ? { included_bytes: truncated.included_bytes }
+                    : {}),
+            });
+        }
+    }
+    const hasGaps = totals.skipped_count > 0 ||
+        totals.truncated_count > 0 ||
+        totals.deferred_count > 0 ||
+        totals.failed_count > 0 ||
+        collection.caps.some((cap) => cap.applied);
+    const status = totals.failed_count > 0 &&
+        totals.included_count + totals.reused_count === 0
+        ? "failed"
+        : totals.included_count + totals.reused_count === 0 && !hasGaps
+            ? "empty"
+            : hasGaps
+                ? "partial"
+                : "complete";
+    return EvidenceCompletenessPayloadSchema.parse({
+        schema_version: "evidence-completeness.v1",
+        status,
+        generated_at: options.finishedAt,
+        scan_window: {
+            started_at: options.startedAt,
+            finished_at: options.finishedAt,
+            since_minutes: options.sinceMinutes,
+        },
+        source_counts: sourceCounts,
+        totals,
+        caps: collection.caps,
+        skip_reasons: [...skipReasonCounts.values()].sort((a, b) => `${a.source}:${a.reason}`.localeCompare(`${b.source}:${b.reason}`)),
+        failure_reasons: [...failureReasonCounts.values()].sort((a, b) => `${a.source}:${a.reason}`.localeCompare(`${b.source}:${b.reason}`)),
+        truncation_markers: [...truncationCounts.values()].sort((a, b) => `${a.source}:${a.reason}`.localeCompare(`${b.source}:${b.reason}`)),
+        notes: totals.failed_count > 0
+            ? ["Evidence collection failed; downstream analysis should not infer confidence."]
+            : hasGaps
+                ? ["Evidence is incomplete; downstream analysis should lower confidence."]
+                : [],
     });
-    return stdout;
 }
 async function walkJsonlFiles(dir, cutoffMs) {
     const out = [];