@dailephd/my-dev-kit-lab 0.6.2 → 0.6.3

package/dist/src/mobile/android/advancedSecurity/redaction.js

@@ -1,4 +1,5 @@
-import { createHash } from "node:crypto";
+import { scryptSync } from "node:crypto";
+import path from "node:path";
 import { stripUnsafeControlChars } from "../../../securityValidation/attackScenarios/exploitEvidence.js";
 // ---------------------------------------------------------------------------
 // v0.4.1 Batch 1 — redaction and fingerprint primitives for later Android
@@ -13,8 +14,8 @@ import { stripUnsafeControlChars } from "../../../securityValidation/attackScena
 // payload). Android candidate evidence has a different, narrower need: a
 // human reviewing a static-candidate finding benefits from a short prefix/
 // suffix so they can recognize *which* secret in their own source it is
-// without the full value ever being reconstructable — so this module adds
-// that prefix/suffix-preserving preview and a non-reversible fingerprint on
+// without retaining the full value — so this module adds that
+// prefix/suffix-preserving preview and a one-way fingerprint on
 // top of the shared control-character stripping, instead of creating a
 // second, competing full-redaction implementation.
 // ---------------------------------------------------------------------------
@@ -42,13 +43,21 @@ export function redactedPreviewForCandidate(input, options = {}) {
     const suffix = bounded.slice(-edgeLength);
     return `${prefix}${MASK}${suffix}`;
 }
-// Stable, non-reversible fingerprint for deduplication. Uses Node's built-in
-// sha256 (no new dependency). Distinct from redactedPreviewForCandidate: the
-// fingerprint is stored for dedup, the preview is stored for human review —
-// neither one can be used to recover the raw value.
-export function fingerprintCandidateValue(input) {
+// Deterministic, one-way evidence identity. Scrypt makes guessing more costly
+// than a fast hash, but low-entropy values are not cryptographically
+// unrecoverable. The context salt separates equivalent values at distinct
+// evidence locations without storing a secret salt or the raw value.
+export function fingerprintCandidateValue(input, context) {
     if (input === undefined)
         return "unavailable";
-    const hash = createHash("sha256").update(input, "utf8").digest("hex");
-    return `sha256:${hash}`;
+    const contextSalt = Buffer.from(JSON.stringify([
+        "my-dev-kit-lab/android-candidate-fingerprint/v2",
+        context.ruleId,
+        path.posix.normalize(context.sourcePath.replaceAll("\\", "/")),
+        context.line ?? null,
+        context.column ?? null,
+        context.purpose
+    ]), "utf8");
+    const derived = scryptSync(input, contextSalt, 32, { N: 16384, r: 8, p: 1, maxmem: 64 * 1024 * 1024 });
+    return `scrypt-v1:${derived.toString("hex")}`;
 }

package/dist/src/mobile/android/advancedSecurity/secretCandidates/analyzeSecretCandidates.js

@@ -51,7 +51,6 @@ export function analyzeSecretCandidateFile(targetRoot, file) {
     const fileKind = fileKindFor(file.relativePath);
     for (const block of matchPrivateKeyBlocks(file.content)) {
         const location = buildAndroidSourceLocation(targetRoot, file.absolutePath, { line: block.line });
-        const fingerprint = fingerprintCandidateValue(block.rawBlock);
         if (!block.terminated) {
             candidates.push(makeCandidateEvidence({
                 ruleId: "android-secret-private-key-candidate",
@@ -66,6 +65,12 @@ export function analyzeSecretCandidateFile(targetRoot, file) {
             }));
             continue;
         }
+        const fingerprint = fingerprintCandidateValue(block.rawBlock, {
+            ruleId: "android-secret-private-key-candidate",
+            sourcePath: location.path,
+            line: location.line,
+            purpose: "private-key-finding"
+        });
         findings.push(makeAndroidFinding({
             ruleId: "android-secret-private-key-candidate",
             title: `Private key material found (${block.headerLabel})`,
@@ -98,7 +103,12 @@ export function analyzeSecretCandidateFile(targetRoot, file) {
             }));
             continue;
         }
-        const fingerprint = fingerprintCandidateValue(match.rawValue);
+        const fingerprint = fingerprintCandidateValue(match.rawValue, {
+            ruleId: classification.ruleId,
+            sourcePath: location.path,
+            line: location.line,
+            purpose: `credential-finding:${classification.sensitiveDataCategory}`
+        });
         findings.push(makeAndroidFinding({
             ruleId: classification.ruleId,
             title: `Hardcoded ${match.identifier} literal found`,

package/dist/src/mobile/android/advancedSecurity/signingConfiguration/analyzeSigningConfiguration.js

@@ -149,7 +149,7 @@ export function analyzeModuleSigningConfiguration(targetRoot, gradleModule, buil
     const buildFileRelativePath = gradleModule.buildFilePath ?? modulePath;
     const buildFileAbsolutePath = path.join(targetRoot, buildFileRelativePath);
     const location = loc(targetRoot, buildFileAbsolutePath);
-    const signingConfigs = extractSigningConfigurations(buildFileText);
+    const signingConfigs = extractSigningConfigurations(buildFileText, { sourcePath: location.path });
     const literalCredentialConfigNames = new Set();
     for (const config of signingConfigs) {
         const storePasswordResult = analyzeCredential("storePassword", config.storePassword, config.name, modulePath, location, buildFileRelativePath);

package/dist/src/mobile/android/advancedSecurity/signingConfiguration/extractSigningConfigurations.js

@@ -44,17 +44,17 @@ function extractStoreFileValue(content) {
         return { state: "literal", literalValue: fileWrapped[1] };
     return extractPathValue(content, ["storeFile"]);
 }
-function extractCredentialValue(content, keys) {
+function extractCredentialValue(content, keys, context) {
     const result = extractLiteral(content, keys);
     const state = classifyExpressionState(result);
     if (state === "literal" && result.value !== undefined) {
-        return { state, redactedPreview: redactedPreviewForCandidate(result.value), fingerprint: fingerprintCandidateValue(result.value) };
+        return { state, redactedPreview: redactedPreviewForCandidate(result.value), fingerprint: fingerprintCandidateValue(result.value, context) };
     }
     if (result.raw !== undefined)
         return { state, rawExpression: boundedRawExpression(result.raw) };
     return { state: "missing" };
 }
-function extractSigningConfigEntry(name, content) {
+function extractSigningConfigEntry(name, content, sourcePath) {
     const v1 = extractBooleanLiteral(content, ["enableV1Signing", "v1SigningEnabled"]);
     const v2 = extractBooleanLiteral(content, ["enableV2Signing", "v2SigningEnabled"]);
     const v3 = extractBooleanLiteral(content, ["enableV3Signing", "v3SigningEnabled"]);
@@ -62,9 +62,9 @@ function extractSigningConfigEntry(name, content) {
     return {
         name,
         storeFile: extractStoreFileValue(content),
-        storePassword: extractCredentialValue(content, ["storePassword"]),
+        storePassword: extractCredentialValue(content, ["storePassword"], { ruleId: "android-signing-password-literal", sourcePath, purpose: `signing-credential:${name}:storePassword` }),
         keyAlias: extractPathValue(content, ["keyAlias"]),
-        keyPassword: extractCredentialValue(content, ["keyPassword"]),
+        keyPassword: extractCredentialValue(content, ["keyPassword"], { ruleId: "android-signing-password-literal", sourcePath, purpose: `signing-credential:${name}:keyPassword` }),
         enableV1Signing: v1.value,
         enableV2Signing: v2.value,
         enableV3Signing: v3.value,
@@ -73,9 +73,9 @@ function extractSigningConfigEntry(name, content) {
 }
 // Extracts every named entry inside a module build file's `signingConfigs { }`
 // block. Returns an empty array (never throws) when no such block exists.
-export function extractSigningConfigurations(rawBuildFileText) {
+export function extractSigningConfigurations(rawBuildFileText, context) {
     const text = stripComments(rawBuildFileText);
     return extractNamedSubBlocks(text, "signingConfigs")
-        .map(({ name, content }) => extractSigningConfigEntry(name, content))
+        .map(({ name, content }) => extractSigningConfigEntry(name, content, context.sourcePath))
         .sort((a, b) => a.name.localeCompare(b.name));
 }

package/dist/src/report/experiments/buildIncrementalChangeStalenessPluginReport.js

@@ -0,0 +1,33 @@
+// Dispatches the incremental-change-staleness plugin report by the persisted execution artifact's
+// schemaVersion: V1 artifacts keep the released V1 report semantics untouched (the V1 builder is called
+// as-is), V2 artifacts select the four-treatment V2 model. Historical V1 evidence is never converted.
+import { readFileSync } from "node:fs";
+import { INCREMENTAL_CHANGE_STALENESS_EXECUTION_SCHEMA_VERSION } from "../../experiments/plugins/incrementalChangeStaleness/executionArtifact.js";
+import { INCREMENTAL_CHANGE_STALENESS_EXECUTION_SCHEMA_VERSION_V2 } from "../../experiments/plugins/incrementalChangeStaleness/executionArtifactV2.js";
+import { INCREMENTAL_CHANGE_STALENESS_PLUGIN_ID } from "../../experiments/plugins/incrementalChangeStaleness/plugin.js";
+import { buildIncrementalChangeStalenessReport, readArtifactPath } from "./buildIncrementalChangeStalenessReport.js";
+import { buildIncrementalChangeStalenessReportV2FromArtifact } from "./buildIncrementalChangeStalenessReportV2.js";
+export function buildIncrementalChangeStalenessPluginReport(run) {
+    if (run.pluginId !== INCREMENTAL_CHANGE_STALENESS_PLUGIN_ID)
+        return null;
+    const artifactPath = readArtifactPath(run);
+    if (!artifactPath)
+        return buildIncrementalChangeStalenessReport(run); // throws the established missing-path error
+    let schemaVersion;
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(artifactPath, "utf8"));
+        schemaVersion = parsed?.schemaVersion;
+    }
+    catch {
+        // Unreadable or malformed: the V1 builder owns the established, explicit error messages.
+        return buildIncrementalChangeStalenessReport(run);
+    }
+    if (schemaVersion === INCREMENTAL_CHANGE_STALENESS_EXECUTION_SCHEMA_VERSION_V2) {
+        return buildIncrementalChangeStalenessReportV2FromArtifact(parsed);
+    }
+    if (schemaVersion === INCREMENTAL_CHANGE_STALENESS_EXECUTION_SCHEMA_VERSION) {
+        return buildIncrementalChangeStalenessReport(run);
+    }
+    throw new Error(`Invalid incremental-change-staleness report source: unsupported execution artifact schema version ${String(schemaVersion)}.`);
+}

package/dist/src/report/experiments/buildIncrementalChangeStalenessReport.js

@@ -74,7 +74,7 @@ function toReportScenario(record) {
         comparison: { ...record.comparison, reasonCodes: [...record.comparison.reasonCodes] }
     };
 }
-function readArtifactPath(run) {
+export function readArtifactPath(run) {
     const fromMetadata = run.metadata?.executionArtifactPath;
     if (typeof fromMetadata === "string" && fromMetadata)
         return fromMetadata;

package/dist/src/report/experiments/buildIncrementalChangeStalenessReportV2.js

@@ -0,0 +1,80 @@
+// v0.6.3 -- projects the persisted V2 incremental-change-staleness execution artifact into the V2 report
+// model. A deterministic projection only: no retrieval, fake-agent evaluation, correctness scoring,
+// affected-neighborhood assessment, freshness assessment, refresh-realization or classification
+// recomputation, and no source/index/benchmark reads. The only integrity check is the artifact's own
+// contradiction validator, so a hand-edited or corrupted artifact is rejected rather than presented.
+import { validateIncrementalChangeStalenessScenarioRecordV2 } from "../../experiments/plugins/incrementalChangeStaleness/executionArtifactV2.js";
+import { INCREMENTAL_CHANGE_STALENESS_V2_TREATMENT_IDS } from "../../experiments/plugins/incrementalChangeStaleness/disposableTarget.js";
+import { INCREMENTAL_CHANGE_STALENESS_REPORT_SCHEMA_VERSION_V2 } from "./incrementalChangeStalenessReportModelV2.js";
+// Frozen V2 wording. Every point must appear in report.txt and report.html.
+export const LIMITATIONS_V2 = [
+    "Results are scoped to the executed deterministic benchmark scenarios and the configured upstream my-dev-kit tool.",
+    "Full refresh is a comparison reference, not an asserted optimal strategy.",
+    "A partial treatment that falls back to a full rebuild is not evidence about the requested partial-refresh behavior.",
+    "\"no-observed-regression-relative-to-full\" means only that the executed scenario did not show a regression under the frozen correctness and required-file evidence dimensions. It does not prove general equivalence or safety, and does not show that full refresh is unnecessary.",
+    "Required-file evidence is a bounded answer-key file-presence check, not retrieval precision/recall.",
+    "Correctness remains deterministic fake-agent/harness evidence in v0.6.3.",
+    "Lab affected-neighborhood evidence (changed baseline neighborhood relative to the task) is distinct from upstream refresh execution evidence (what my-dev-kit actually refreshed).",
+    "\"reindexRecommendation\" remains observational evidence; it did not select or trigger any treatment.",
+    "\"changedSymbolCount\" does not mean source-level symbol-diff proof; it retains the released v0.6.1 baseline-symbol-identity definition.",
+    "The experiment does not use graph-diff."
+];
+/** Fixed neutral wording per partial-refresh reference classification. Presentation only. */
+export const PARTIAL_REFERENCE_CLASSIFICATION_EXPLANATIONS = {
+    "observed-regression-relative-to-full": "The persisted comparison observed at least one regression relative to the full-refresh reference under the frozen evidence dimensions: correctness and/or required-file presence.",
+    "no-observed-regression-relative-to-full": "This executed scenario did not show a regression relative to the full-refresh reference under the frozen correctness and required-file evidence dimensions. This does not establish general equivalence or safety, and does not imply that full refresh is unnecessary.",
+    inconclusive: "Available persisted evidence was insufficient to determine whether a regression relative to the full-refresh reference occurred. Inconclusive is not the same as no regression.",
+    "not-comparable-as-partial-refresh": "The requested partial-refresh treatment fell back to a full rebuild, so this run does not provide evidence about the requested partial-refresh behavior."
+};
+/** Presentation order and labels; identity is always resolved by treatment id, never by array position. */
+export const TREATMENT_PRESENTATION = [
+    { id: "stale-index", label: "No Refresh" },
+    { id: "changed-files-refresh", label: "Changed-Files Refresh" },
+    { id: "affected-neighborhood-refresh", label: "Affected-Neighborhood Refresh" },
+    { id: "full-refresh", label: "Full Refresh" }
+];
+export const COMPARISON_PRESENTATION = [
+    { candidate: "stale-index", label: "No Refresh vs Full Refresh" },
+    { candidate: "changed-files-refresh", label: "Changed-Files Refresh vs Full Refresh" },
+    { candidate: "affected-neighborhood-refresh", label: "Affected-Neighborhood Refresh vs Full Refresh" }
+];
+export function findReportTreatment(scenario, treatmentId) {
+    return scenario.treatments.find((treatment) => treatment.treatmentId === treatmentId) ?? null;
+}
+export function findReportComparison(scenario, candidateTreatmentId) {
+    return scenario.referenceComparisons.find((comparison) => comparison.candidateTreatmentId === candidateTreatmentId && comparison.referenceTreatmentId === "full-refresh") ?? null;
+}
+export function buildIncrementalChangeStalenessReportV2FromArtifact(artifact) {
+    for (const scenario of artifact.scenarios)
+        validateIncrementalChangeStalenessScenarioRecordV2(scenario);
+    return {
+        schemaVersion: INCREMENTAL_CHANGE_STALENESS_REPORT_SCHEMA_VERSION_V2,
+        pluginId: artifact.pluginId,
+        summary: { ...artifact.summary },
+        scenarios: artifact.scenarios.map(toReportScenario),
+        limitations: [...LIMITATIONS_V2]
+    };
+}
+function toReportScenario(record) {
+    return {
+        scenarioId: record.scenarioId,
+        category: record.category,
+        benchmarkProjectId: record.benchmarkProjectId,
+        baseCaseId: record.baseCaseId,
+        status: record.status,
+        failureReason: record.failureReason,
+        query: record.query,
+        answerPolicy: record.answerPolicy,
+        expectedFiles: [...record.expectedFiles],
+        expectedSymbols: [...record.expectedSymbols],
+        lifecycle: record.lifecycle ? structuredClone(record.lifecycle) : null,
+        // Persisted order is preserved; consumers resolve identity by id (see findReportTreatment/findReportComparison).
+        treatments: record.treatments.map((treatment) => structuredClone(treatment)),
+        referenceComparisons: record.referenceComparisons.map((comparison) => structuredClone(comparison))
+    };
+}
+/** Kept for callers that need the fixed id list without importing the plugin layer. */
+export const REPORT_TREATMENT_IDS = INCREMENTAL_CHANGE_STALENESS_V2_TREATMENT_IDS;
+export function isV2ReportSection(section) {
+    return section !== null && section.schemaVersion === INCREMENTAL_CHANGE_STALENESS_REPORT_SCHEMA_VERSION_V2;
+}

package/dist/src/report/experiments/buildPluginExperimentReport.js

@@ -1,7 +1,7 @@
 import path from "node:path";
 import { buildContextStrategyComparisonV043Report } from "./buildContextStrategyComparisonV043Report.js";
 import { buildWarmIndexReuseReport } from "./buildWarmIndexReuseReport.js";
-import { buildIncrementalChangeStalenessReport } from "./buildIncrementalChangeStalenessReport.js";
+import { buildIncrementalChangeStalenessPluginReport } from "./buildIncrementalChangeStalenessPluginReport.js";
 const V043_BULK_ARRAY_KEYS = [
     "v043StageContextExecutions",
     "v043StageContextEvaluations",
@@ -12,7 +12,7 @@ export function buildPluginExperimentReport(args) {
     const allOutcomes = args.run.cases.flatMap((experimentCase) => experimentCase.outcomes);
     const contextStrategyComparisonV043 = buildContextStrategyComparisonV043Report(args.run);
     const warmIndexReuse = buildWarmIndexReuseReport(args.run);
-    const incrementalChangeStaleness = buildIncrementalChangeStalenessReport(args.run);
+    const incrementalChangeStaleness = buildIncrementalChangeStalenessPluginReport(args.run);
     const rawRun = { ...args.run, artifacts: relativizeArtifacts(args.run.artifacts, outputRoot) };
     for (const key of V043_BULK_ARRAY_KEYS) {
         delete rawRun[key];

package/dist/src/report/experiments/incrementalChangeStalenessReportModelV2.js

@@ -0,0 +1,3 @@
+// v0.6.3 -- plugin-specific presentation model for the four-treatment V2 execution artifact. Types only:
+// projection lives in buildIncrementalChangeStalenessReportV2.ts, rendering in the text/HTML renderers.
+export const INCREMENTAL_CHANGE_STALENESS_REPORT_SCHEMA_VERSION_V2 = "my-dev-kit-lab-incremental-change-staleness-report-v2";

package/dist/src/report/experiments/incrementalChangeStalenessReportRowsV2.js

@@ -0,0 +1,146 @@
+// v0.6.3 -- shared semantic content for the V2 text and HTML renderers, so both present exactly the same
+// persisted facts. Formatting only: no classification, arithmetic, or recomputation. Unavailable evidence
+// is written as words ("unavailable", "not applicable"), never as zero.
+import { STALE_RISK_CLASSIFICATION_EXPLANATIONS } from "./buildIncrementalChangeStalenessReport.js";
+import { COMPARISON_PRESENTATION, PARTIAL_REFERENCE_CLASSIFICATION_EXPLANATIONS, TREATMENT_PRESENTATION, findReportComparison, findReportTreatment } from "./buildIncrementalChangeStalenessReportV2.js";
+import { REINDEX_RECOMMENDATION_EXPLANATIONS } from "./buildWarmIndexReuseReport.js";
+export function display(value, missing = "unavailable") {
+    return value === null || value === undefined ? missing : String(value);
+}
+export function treatmentBlock(scenario, treatmentId, label) {
+    const treatment = findReportTreatment(scenario, treatmentId);
+    if (!treatment) {
+        return { label, available: false, rows: [], fallbackStatement: null, refreshRows: [], forcedNeighborSample: null, filesRead: [], requiredFiles: [], observedFiles: [], missingFiles: [] };
+    }
+    const retrieval = treatment.retrieval;
+    const correctness = treatment.fakeAgent?.correctness;
+    const refresh = treatment.refreshExecution;
+    const rows = [
+        ["Treatment status", treatment.status],
+        ["Treatment intent", treatment.treatmentIntent],
+        ["Failure reason", display(treatment.failureReason, "not applicable")],
+        ["Active index phase", treatment.activeIndexPhase],
+        ["Baseline freshness", treatment.baselineFreshness.status],
+        ["Refreshed freshness", display(treatment.refreshedFreshness?.status, "not applicable")],
+        ["Retrieval status", retrieval.status],
+        ["Context characters", retrieval.status === "not-run" ? "unavailable" : String(retrieval.totalChars)],
+        ["Estimated context tokens", retrieval.status === "not-run" ? "unavailable" : String(retrieval.totalEstimatedTokens)],
+        ["Retrieval duration (ms)", retrieval.status === "not-run" ? "unavailable" : String(retrieval.durationMs)],
+        ["Fake-agent status", display(treatment.fakeAgent?.status, "not run")],
+        ["Correctness score", correctness && correctness.available && correctness.score !== null ? String(correctness.score) : "unavailable"],
+        ["Required-file evidence", treatment.requiredFileEvidence.status],
+        ["Required-file reason", display(treatment.requiredFileEvidence.reason, "not applicable")],
+        ["Affected-neighborhood relationship", treatment.affectedNeighborhood.relationship],
+        ["Reindex recommendation (observational)", treatment.affectedNeighborhood.reindexRecommendation]
+    ];
+    const refreshRows = [
+        ["Refresh kind", refresh.kind],
+        ["Refresh realization", refresh.realization]
+    ];
+    let fallbackStatement = null;
+    let forcedNeighborSample = null;
+    if (refresh.kind === "incremental") {
+        const upstream = refresh.incrementalRefresh;
+        refreshRows.push(["Requested scope", upstream.requestedScope], ["Applied scope", upstream.appliedScope], ["Selection status", upstream.selectionStatus], ["Fallback reason", display(upstream.fallbackReason, "not applicable")], ["Fresh extraction files", String(upstream.freshExtractionFileCount)], ["Reused files", String(upstream.reusedFileCount)], ["Forced-neighbor reanalysis files", String(upstream.forcedNeighborReanalysisFileCount)], ["Upstream seed files", display(upstream.seedFileCount, "not recorded")], ["Upstream seed symbols", display(upstream.seedSymbolCount, "not recorded")], ["Upstream affected nodes", display(upstream.affectedNodeCount, "not recorded")], ["Upstream affected edges", display(upstream.affectedEdgeCount, "not recorded")]);
+        forcedNeighborSample = [...upstream.forcedNeighborSample];
+        if (refresh.realization === "FALLBACK_FULL") {
+            fallbackStatement = `FALLBACK_FULL: requested ${upstream.requestedScope}, applied ${upstream.appliedScope}, selection status ${upstream.selectionStatus}, reason ${display(upstream.fallbackReason, "not recorded")}. The requested partial refresh was not applied; a full rebuild produced this index.`;
+        }
+    }
+    else {
+        refreshRows.push(["Upstream incremental refresh evidence", "not applicable"]);
+    }
+    return {
+        label,
+        available: true,
+        rows,
+        fallbackStatement,
+        refreshRows,
+        forcedNeighborSample,
+        filesRead: [...retrieval.filesRead],
+        requiredFiles: [...treatment.requiredFileEvidence.requiredFiles],
+        observedFiles: [...treatment.requiredFileEvidence.observedFiles],
+        missingFiles: [...treatment.requiredFileEvidence.missingFiles]
+    };
+}
+export function comparisonBlock(scenario, presentation) {
+    const comparison = findReportComparison(scenario, presentation.candidate);
+    if (!comparison)
+        return { label: presentation.label, available: false, rows: [], reasonCodes: [], explanation: "" };
+    if (comparison.kind === "stale-risk") {
+        const value = comparison.comparison;
+        return {
+            label: presentation.label,
+            available: true,
+            rows: [
+                ["Correctness relation", value.correctnessRelation],
+                ["Required-file evidence relation", value.requiredFileEvidenceRelation],
+                ["Stale-risk classification", value.staleRiskClassification]
+            ],
+            reasonCodes: [...value.reasonCodes],
+            explanation: STALE_RISK_CLASSIFICATION_EXPLANATIONS[value.staleRiskClassification]
+        };
+    }
+    return {
+        label: presentation.label,
+        available: true,
+        rows: [
+            ["Refresh realization", display(comparison.refreshRealization, "not recorded")],
+            ["Candidate correctness relation", comparison.correctnessRelation],
+            ["Candidate required-file relation", comparison.requiredFileEvidenceRelation],
+            ["Reference classification", comparison.classification]
+        ],
+        reasonCodes: [...comparison.reasonCodes],
+        explanation: PARTIAL_REFERENCE_CLASSIFICATION_EXPLANATIONS[comparison.classification]
+    };
+}
+export const TREATMENT_PRESENTATION_ORDER = TREATMENT_PRESENTATION;
+export const COMPARISON_PRESENTATION_ORDER = COMPARISON_PRESENTATION;
+/**
+ * Baseline affected-neighborhood evidence is symmetric by construction of the execution; the report
+ * presents it once only when the persisted relationship and recommendation agree, and otherwise says so.
+ */
+export function affectedNeighborhoodSummary(scenario) {
+    const assessments = TREATMENT_PRESENTATION.map((entry) => findReportTreatment(scenario, entry.id)?.affectedNeighborhood ?? null).filter((assessment) => assessment !== null);
+    if (assessments.length === 0)
+        return { state: "none" };
+    const first = assessments[0];
+    if (assessments.some((a) => a.relationship !== first.relationship || a.reindexRecommendation !== first.reindexRecommendation))
+        return { state: "inconsistent" };
+    const number = (value) => display(value);
+    return {
+        state: "ok",
+        rows: [
+            ["Relationship", first.relationship],
+            ["Reindex recommendation (observational)", first.reindexRecommendation],
+            ["Changed indexed files", number(first.changedFileCount)],
+            ["Changed baseline symbols", number(first.changedSymbolCount)],
+            ["Affected graph nodes", number(first.affectedNodeCount)],
+            ["Affected graph edges", number(first.affectedEdgeCount)],
+            ["Task-overlap nodes", number(first.taskOverlapCount)],
+            ["Task-overlap percent", number(first.taskOverlapPercent)]
+        ],
+        explanation: REINDEX_RECOMMENDATION_EXPLANATIONS[first.reindexRecommendation]
+    };
+}
+export const EVIDENCE_FAMILY_NOTE = "Lab affected-neighborhood evidence describes the baseline graph neighborhood implicated by the controlled change. Upstream refresh evidence describes what my-dev-kit actually refreshed. They are different evidence families.";
+export const SCENARIO_SUMMARY_ROWS = (summary) => [
+    ["Scenarios", String(summary.scenarioCount)],
+    ["Ready", String(summary.readyScenarioCount)],
+    ["Failed", String(summary.failedScenarioCount)],
+    ["No refresh: observed stale regression", String(summary.staleObservedRegressionCount)],
+    ["No refresh: no observed stale regression", String(summary.staleNoObservedRegressionCount)],
+    ["No refresh: inconclusive", String(summary.staleInconclusiveCount)],
+    ["Changed-files: applied partial", String(summary.changedFilesAppliedPartialCount)],
+    ["Changed-files: fallback to full", String(summary.changedFilesFallbackFullCount)],
+    ["Affected-neighborhood: applied partial", String(summary.affectedNeighborhoodAppliedPartialCount)],
+    ["Affected-neighborhood: fallback to full", String(summary.affectedNeighborhoodFallbackFullCount)],
+    ["Changed-files: observed regression relative to full", String(summary.changedFilesObservedRegressionRelativeToFullCount)],
+    ["Changed-files: no observed regression relative to full", String(summary.changedFilesNoObservedRegressionRelativeToFullCount)],
+    ["Changed-files: inconclusive", String(summary.changedFilesInconclusiveCount)],
+    ["Changed-files: not comparable as partial refresh", String(summary.changedFilesNotComparableCount)],
+    ["Affected-neighborhood: observed regression relative to full", String(summary.affectedNeighborhoodObservedRegressionRelativeToFullCount)],
+    ["Affected-neighborhood: no observed regression relative to full", String(summary.affectedNeighborhoodNoObservedRegressionRelativeToFullCount)],
+    ["Affected-neighborhood: inconclusive", String(summary.affectedNeighborhoodInconclusiveCount)],
+    ["Affected-neighborhood: not comparable as partial refresh", String(summary.affectedNeighborhoodNotComparableCount)]
+];

package/dist/src/report/experiments/index.js

@@ -15,5 +15,8 @@ export { renderContextIntegrityJsonReport } from "./renderContextIntegrityJsonRe
 export { renderContextIntegrityText } from "./renderContextIntegrityText.js";
 export { renderContextIntegrityHtml } from "./renderContextIntegrityHtml.js";
 export * from "./incrementalChangeStalenessReportModel.js";
+export * from "./incrementalChangeStalenessReportModelV2.js";
+export { buildIncrementalChangeStalenessPluginReport } from "./buildIncrementalChangeStalenessPluginReport.js";
+export { buildIncrementalChangeStalenessReportV2FromArtifact, findReportTreatment, findReportComparison, LIMITATIONS_V2 } from "./buildIncrementalChangeStalenessReportV2.js";
 export { buildIncrementalChangeStalenessReport, STALE_RISK_CLASSIFICATION_EXPLANATIONS } from "./buildIncrementalChangeStalenessReport.js";
 export { renderIncrementalChangeStalenessHtml } from "./renderIncrementalChangeStalenessHtml.js";

package/dist/src/report/experiments/renderIncrementalChangeStalenessHtml.js

@@ -3,8 +3,12 @@
 // calculation beyond formatting an already-persisted number.
 import { STALE_RISK_CLASSIFICATION_EXPLANATIONS } from "./buildIncrementalChangeStalenessReport.js";
 import { REINDEX_RECOMMENDATION_EXPLANATIONS } from "./buildWarmIndexReuseReport.js";
+import { isV2ReportSection } from "./buildIncrementalChangeStalenessReportV2.js";
+import { renderIncrementalChangeStalenessHtmlV2 } from "./renderIncrementalChangeStalenessHtmlV2.js";
 const MAX_DISPLAY_ITEMS = 20;
 export function renderIncrementalChangeStalenessHtml(section) {
+    if (section !== null && isV2ReportSection(section))
+        return renderIncrementalChangeStalenessHtmlV2(section);
     if (section === null) {
         return `<section>
     <h2>Incremental-Change And Staleness Evidence</h2>

package/dist/src/report/experiments/renderIncrementalChangeStalenessHtmlV2.js

@@ -0,0 +1,111 @@
+// v0.6.3 -- V2 HTML section for the incremental-change-staleness plugin report. Renders the same persisted
+// facts as the text renderer through the shared row builders; every persisted string is HTML-escaped.
+import { COMPARISON_PRESENTATION_ORDER, EVIDENCE_FAMILY_NOTE, SCENARIO_SUMMARY_ROWS, TREATMENT_PRESENTATION_ORDER, affectedNeighborhoodSummary, comparisonBlock, treatmentBlock } from "./incrementalChangeStalenessReportRowsV2.js";
+const MAX_DISPLAY_ITEMS = 20;
+export function renderIncrementalChangeStalenessHtmlV2(section) {
+    return `<section>
+    <h2>Incremental-Change And Staleness Evidence</h2>
+    <p class="muted">Scoped experimental evidence: results are limited to the executed scenarios below. Full refresh is a comparison reference, not a declared best treatment.</p>
+    ${table(["Field", "Value"], SCENARIO_SUMMARY_ROWS(section.summary))}
+    ${section.scenarios.map(renderScenario).join("\n")}
+    <h3>Limitations</h3>
+    ${list(section.limitations)}
+  </section>`;
+}
+function renderScenario(scenario) {
+    const lifecycle = scenario.lifecycle;
+    const affected = affectedNeighborhoodSummary(scenario);
+    return `<h3>Scenario: ${escapeHtml(scenario.scenarioId)}</h3>
+    <h4>Scenario Definition</h4>
+    ${table(["Field", "Value"], [
+        ["Scenario ID", scenario.scenarioId],
+        ["Category", scenario.category],
+        ["Benchmark project", scenario.benchmarkProjectId],
+        ["Base case", scenario.baseCaseId],
+        ["Answer policy", scenario.answerPolicy],
+        ["Query", scenario.query ?? "unavailable"],
+        ["Status", scenario.status],
+        ["Failure reason", scenario.failureReason ?? "not applicable"]
+    ])}
+    <p>Expected files:</p>
+    ${boundedList(scenario.expectedFiles)}
+    <p>Expected symbols:</p>
+    ${boundedList(scenario.expectedSymbols)}
+    <h4>Lifecycle Integrity</h4>
+    ${lifecycle
+        ? `${table(["Field", "Value"], [
+            ["my-dev-kit version", lifecycle.myDevKitVersion ?? "unavailable"],
+            ["Index invocations (total)", String(lifecycle.totalIndexInvocationCount)],
+            ["Freshness assessments (total)", String(lifecycle.totalFreshnessAssessmentCount)],
+            ...Object.entries(lifecycle.preMutationEquivalence).map(([id, result]) => [`Pre-mutation equivalence (${id} vs stale-index reference)`, result]),
+            ...Object.entries(lifecycle.postMutationEquivalence).map(([id, result]) => [`Post-mutation equivalence (${id} vs stale-index reference)`, result])
+        ])}<p>Controlled file paths:</p>${boundedList(lifecycle.controlledFilePaths)}<p>Source roots:</p>${boundedList(lifecycle.sourceRoots)}`
+        : "<p>Not available for this scenario.</p>"}
+    <h4>Affected-Neighborhood Evidence (Changed Baseline Neighborhood Relative To The Task)</h4>
+    ${affected.state === "none"
+        ? "<p>Not available.</p>"
+        : affected.state === "inconsistent"
+            ? "<p>inconsistent persisted evidence</p>"
+            : `${table(["Field", "Value"], affected.rows)}<p>${escapeHtml(affected.explanation)}</p>`}
+    <p class="muted">${escapeHtml(EVIDENCE_FAMILY_NOTE)}</p>
+    ${scenario.treatments.length === 0
+        ? "<h4>Treatments</h4><p>Not produced: the scenario failed before any treatment evidence existed.</p>"
+        : TREATMENT_PRESENTATION_ORDER.map((entry) => renderTreatment(scenario, entry)).join("\n")}
+    <h4>Reference Comparisons (Against The Full-Refresh Reference)</h4>
+    ${COMPARISON_PRESENTATION_ORDER.map((entry) => renderComparison(scenario, entry)).join("\n")}`;
+}
+function renderTreatment(scenario, entry) {
+    const block = treatmentBlock(scenario, entry.id, entry.label);
+    const title = `${block.label} Treatment (${entry.id})`;
+    if (!block.available)
+        return `<h4>${escapeHtml(title)}</h4><p>Not available.</p>`;
+    return `<h4>${escapeHtml(title)}</h4>
+    ${table(["Field", "Value"], block.rows)}
+    <p><strong>Refresh Execution</strong> (upstream evidence of what my-dev-kit actually did)</p>
+    ${table(["Field", "Value"], block.refreshRows)}
+    ${block.fallbackStatement ? `<p class="fallback"><strong>${escapeHtml(block.fallbackStatement)}</strong></p>` : ""}
+    ${block.forcedNeighborSample ? `<p>Forced-neighbor sample:</p>${boundedList(block.forcedNeighborSample)}` : ""}
+    <p>Files read:</p>
+    ${boundedList(block.filesRead)}
+    <p>Required files:</p>
+    ${boundedList(block.requiredFiles)}
+    <p>Observed files:</p>
+    ${boundedList(block.observedFiles)}
+    <p>Missing files:</p>
+    ${boundedList(block.missingFiles)}`;
+}
+function renderComparison(scenario, entry) {
+    const block = comparisonBlock(scenario, entry);
+    if (!block.available)
+        return `<h5>${escapeHtml(block.label)}</h5><p>Not available.</p>`;
+    return `<h5>${escapeHtml(block.label)}</h5>
+    ${table(["Field", "Value"], block.rows)}
+    <p>Reason codes:</p>
+    ${list(block.reasonCodes)}
+    <p>${escapeHtml(block.explanation)}</p>`;
+}
+function boundedList(items) {
+    if (items.length === 0)
+        return "<p>none</p>";
+    const shown = items.slice(0, MAX_DISPLAY_ITEMS);
+    const omitted = items.length - shown.length;
+    return `${list(shown)}${omitted > 0 ? `<p class="muted">... ${omitted} more</p>` : ""}`;
+}
+function list(items) {
+    if (items.length === 0)
+        return "<ul><li>none</li></ul>";
+    return `<ul>${items.map((item) => `<li>${escapeHtml(item)}</li>`).join("")}</ul>`;
+}
+function table(headers, rows) {
+    return `<table><thead><tr>${headers.map((header) => `<th>${escapeHtml(header)}</th>`).join("")}</tr></thead><tbody>${rows
+        .map((row) => `<tr>${row.map((cell) => `<td>${escapeHtml(cell)}</td>`).join("")}</tr>`)
+        .join("")}</tbody></table>`;
+}
+function escapeHtml(value) {
+    return String(value ?? "")
+        .replaceAll("&", "&amp;")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&#39;");
+}