@codyswann/lisa 2.300.7 → 2.300.9

package/typescript/copy-overwrite/scripts/check-threshold-ratchet.mjs

@@ -12,8 +12,11 @@
  * Tier 1 — designed tunables: vitest/jest/simplecov/e2e thresholds
  * (minimums) and eslint/rubocop thresholds (maximums). Tier 2 — stryker's
  * break score and k6 expression bounds. Tier 3 — exemption additions
- * (audit-ignore entries, stryker mutate exclusions, thresholdRatchet.allow
- * entries) which weaken a gate without touching a number.
+ * (stryker mutate exclusions, thresholdRatchet.allow entries) which weaken
+ * a gate without touching a number. Audit ignore lists are deliberately NOT
+ * watched: the security-audit-handling ladder authorizes agents to add
+ * documented entries autonomously, and doctor readiness (B5) audits that
+ * every entry carries a written decision.
  *
  * Human override: `.lisa.config.json` → `thresholdRatchet.allow` entries
  * ({ file, key, reason }). Honored ONLY from the baseline side (HEAD /

package/typescript/copy-overwrite/scripts/threshold-ratchet-compare.mjs

@@ -8,7 +8,6 @@
  */
 import {
   extractAllowEntries,
-  extractExemptionEntries,
   extractK6Constraints,
   extractNumericLeaves,
   extractRubocopThresholds,
@@ -20,7 +19,7 @@ import {
 
 /** Finding type: a numeric bound or boolean gate moved the weakening way. */
 const TYPE_WEAKENED = "weakened";
-/** Finding type: an exemption entry was added (Tier 3). */
+/** Finding type: a gate-shrinking exemption was added (Tier 3). */
 const TYPE_EXEMPTION_ADDED = "exemption-added";
 /** Family kind for .lisa.config.json (the thresholdRatchet.allow carrier). */
 const KIND_ALLOW_LIST = "allow-list";
@@ -160,29 +159,6 @@ function compareK6(relPath, base, current) {
   return findings;
 }
 
-/**
- * Compare an exemption-list pair (audit ignore files): report added entries.
- * @param {string} relPath Repo-relative path
- * @param {unknown} base Parsed baseline list
- * @param {unknown} current Parsed current list
- * @returns {Finding[]} One finding per newly added ignore entry
- */
-function compareExemptions(relPath, base, current) {
-  const baseEntries = extractExemptionEntries(base);
-  const findings = [];
-  for (const entry of extractExemptionEntries(current)) {
-    if (!baseEntries.has(entry)) {
-      findings.push({
-        file: relPath,
-        key: entry,
-        type: TYPE_EXEMPTION_ADDED,
-        message: `${relPath}: new security-audit ignore entry "${entry}" — ignoring a finding weakens the gate and needs a human's sign-off.`,
-      });
-    }
-  }
-  return findings;
-}
-
 /**
  * Compare .lisa.config.json allow lists: report added exception entries so a
  * change can never grant itself an exception.
@@ -258,8 +234,6 @@ export function compareFile(relPath, baselineText, currentText) {
       return compareStryker(relPath, base, current);
     case "k6":
       return compareK6(relPath, base, current);
-    case "exemption-list":
-      return compareExemptions(relPath, base, current);
     case KIND_ALLOW_LIST:
       return compareAllowList(relPath, base, current);
     default:

package/typescript/copy-overwrite/scripts/threshold-ratchet-families.mjs

@@ -48,11 +48,6 @@ export const FAMILIES = [
     match: /(^|\/)\.github\/k6\/thresholds\/[^/]+\.json$/,
     kind: "k6",
   },
-  {
-    id: "audit-ignore",
-    match: /(^|\/)audit\.ignore\.(config|local)\.json$/,
-    kind: "exemption-list",
-  },
   {
     id: "lisa-config",
     match: /(^|\/)\.lisa\.config\.json$/,
@@ -251,35 +246,6 @@ export function extractK6Constraints(conf) {
   return { numeric, booleans };
 }
 
-/**
- * Flatten an exemption file (audit ignore list) into a set of entry tokens.
- * Arrays contribute their string items; objects contribute their keys.
- * @param {unknown} conf Parsed JSON
- * @returns {Set<string>} One token per exemption entry
- */
-export function extractExemptionEntries(conf) {
-  const out = new Set();
-  if (Array.isArray(conf)) {
-    for (const item of conf) {
-      if (typeof item === "string") out.add(item);
-      else if (item && typeof item === "object") out.add(JSON.stringify(item));
-    }
-  } else if (conf && typeof conf === "object") {
-    for (const [key, value] of Object.entries(conf)) {
-      if (Array.isArray(value)) {
-        for (const item of value) {
-          out.add(
-            `${key}:${typeof item === "string" ? item : JSON.stringify(item)}`
-          );
-        }
-      } else {
-        out.add(key);
-      }
-    }
-  }
-  return out;
-}
-
 /**
  * Extract thresholdRatchet.allow entries from parsed .lisa.config.json.
  * @param {unknown} config Parsed config (may be undefined)