@enwithai/product-check 0.1.0-alpha.0 → 0.2.0

package/dist/dashboard/render.js

@@ -3,8 +3,8 @@
 /**
  * Renders the local dashboard: one self-contained HTML file generated entirely from a results document. Every
  * number is read from (or recomputed from) the JSON; the integrity check runs first and a failure is shown as a
- * banner. Views: Executive Readiness, Scan Explorer, Validation Workbench, Blueprint & Remediation, Assurance
- * History. A small inline script (allowed by a hash-based CSP) adds tabs, filters and a theme toggle; without it
+ * banner. Views: Executive Readiness, Scan Explorer, Validation Workbench, Blueprint & Remediation, As-built Spec,
+ * Assurance History. A small inline script (allowed by a hash-based CSP) adds tabs, filters and a theme toggle; without it
  * every view is still readable. No external requests.
  */
 import { createHash } from "node:crypto";
@@ -176,6 +176,109 @@ function evidenceList(r, ids) {
     })
         .join("")}</ul></details>`;
 }
+/**
+ * Converts an as-built statement (Markdown built in src/spec/build.ts: code spans for repository-derived names,
+ * backslash escapes elsewhere) to HTML. Every segment is HTML-escaped; only `<code>` is produced.
+ */
+export function statementHtml(statement) {
+    const out = [];
+    let rest = statement;
+    for (;;) {
+        const m = /(`+)( ?)([\s\S]*?)\2\1(?!`)/.exec(rest);
+        if (!m)
+            break;
+        out.push(html(unescapeMd(rest.slice(0, m.index))));
+        out.push(`<code>${html((m[3] ?? "").replace(/\\\|/g, "|"))}</code>`);
+        rest = rest.slice(m.index + m[0].length);
+    }
+    out.push(html(unescapeMd(rest)));
+    return out.join("");
+}
+/** Undoes the Markdown escaping of `md()` for plain-text display (the result is HTML-escaped afterwards). */
+function unescapeMd(text) {
+    return text
+        .replace(/\\([\\`*_[\]<>|~#+=-])/g, "$1")
+        .replace(/&amp;/g, "&")
+        .replace(/@\u200b/g, "@");
+}
+const CERTAINTY_TONE = { observed: "good", inferred: "warning", hypothesis: "unknown" };
+const CERTAINTY_LABEL = {
+    observed: "observed",
+    inferred: "inferred",
+    hypothesis: "needs confirmation",
+};
+/** The As-built Spec view: the reverse-engineered specification carried in the blueprint. */
+function asBuiltView(r) {
+    const head = `<section class="view" id="as-built" aria-labelledby="h-as-built"><h2 id="h-as-built">As-built spec</h2>`;
+    const built = r.blueprint.as_is.as_built;
+    if (!built)
+        return `${head}<p class="muted">No as-built spec: the repository was not inspected in this run.</p></section>`;
+    const byId = new Map(built.surface.map((s) => [s.id, s]));
+    const count = (k) => built.surface.filter((s) => s.kind === k).length;
+    const where = (s) => `<code>${html(`${s.location.path}${s.location.line ? `:${s.location.line}` : ""}`)}</code>`;
+    // Findings whose traceability names an as-built requirement ("As-built FR-001, FR-007; requirement …").
+    const findingsFor = new Map();
+    for (const t of r.blueprint.traceability) {
+        const ids = /^As-built ([^;]+);/.exec(t.journey_or_requirement)?.[1]?.split(", ") ?? [];
+        for (const id of ids)
+            findingsFor.set(id, [...(findingsFor.get(id) ?? []), t.finding_id]);
+    }
+    const openIds = new Set(r.findings.filter((f) => f.status === "OPEN" || f.status === "UNVERIFIED").map((f) => f.id));
+    const reqRow = (q, kind) => {
+        const sources = q.surface_ids.map((id) => byId.get(id)).filter((s) => s !== undefined);
+        const linked = findingsFor.get(q.id) ?? [];
+        const open = linked.filter((id) => openIds.has(id));
+        return `<tr data-kind="${kind}" data-certainty="${q.certainty}"><td class="id"><code>${html(q.id)}</code></td><td>${statementHtml(q.statement)}</td><td>${chip(CERTAINTY_LABEL[q.certainty] ?? q.certainty, CERTAINTY_TONE[q.certainty] ?? "neutral")}</td><td class="small">${sources.slice(0, 4).map(where).join("<br>") || "—"}${sources.length > 4 ? `<br><span class="muted">and ${sources.length - 4} more</span>` : ""}</td><td class="small">${linked.length ? `${open.length ? chip(`${open.length} open`, "critical") : chip("none open", "good")}<br>${linked.length > 3 ? `<details><summary>${linked.length} finding(s)</summary><code>${html(linked.join(", "))}</code></details>` : `<code>${html(linked.join(", "))}</code>`}` : "—"}</td><td class="small">${evidenceList(r, q.evidence_ids)}</td></tr>`;
+    };
+    const surfaceTable = (title, kind, cols, cells) => {
+        const rows = built.surface.filter((s) => s.kind === kind);
+        if (rows.length === 0)
+            return "";
+        return `<details class="card" style="margin-bottom:8px"><summary>${html(title)} (${rows.length})</summary><div class="scroll"><table><thead><tr>${cols.map((c) => `<th>${html(c)}</th>`).join("")}</tr></thead><tbody>${rows
+            .map((s) => `<tr>${cells(s)
+            .map((c) => `<td class="small">${c}</td>`)
+            .join("")}</tr>`)
+            .join("")}</tbody></table></div></details>`;
+    };
+    const auth = (s) => (s.auth_hint ? chip("auth helper (inferred)", "warning") : "—");
+    return `${head}
+<p class="muted small">Reverse-engineered from the repository's structure; nothing was executed. <em>Observed</em> statements point at a file and line, <em>inferred</em> ones interpret what was found, and anything the code cannot tell us needs a person to confirm. The same spec is written as <code>specs/000-as-built/spec.md</code> (Spec Kit layout, lint it with Spec Check) and <code>as-built-spec.json</code>.</p>
+<div class="grid kpis">${[
+        ["Pages", count("page")],
+        ["Endpoints", count("endpoint")],
+        ["Data entities", count("entity")],
+        ["Integrations", count("integration")],
+        ["Config names", count("config")],
+        ["Open questions", built.clarifications.length],
+    ]
+        .map(([k, v]) => `<div class="card kpi"><div class="label">${html(k)}</div><div class="value">${v}</div></div>`)
+        .join("")}</div>
+${built.clarifications.length ? `<h3>Questions only a person can answer</h3><ul>${built.clarifications.map((c) => `<li>${html(c)}</li>`).join("")}</ul>` : ""}
+<h3>User stories</h3>${built.stories
+        .map((s) => `<details class="card" style="margin-bottom:8px"><summary>${html(s.id)} ${html(s.title)} ${s.critical_journey ? chip(`critical journey: ${s.critical_journey}`, "neutral") : ""}</summary><p class="small"><strong>Requirements:</strong> <code>${html(s.requirement_ids.join(", ") || "—")}</code></p>${s.test_behaviours.length ? `<p class="small"><strong>Behaviour described by tests</strong> (inferred)</p><ul class="small">${s.test_behaviours.map((t) => `<li>${html(t)}</li>`).join("")}</ul>` : `<p class="small muted">No test titles mention this area.</p>`}</details>`)
+        .join("") ||
+        `<p class="muted">No pages or endpoints were recognised, so no user stories could be derived.</p>`}
+<h3>Requirements</h3>
+<div class="filters" data-filter-table="as-built-table"><label>Type<select data-key="kind"><option value="">All</option><option value="functional">Functional</option><option value="non-functional">Non-functional</option><option value="success">Success criteria</option><option value="edge">Edge cases</option></select></label>
+<label>Certainty<select data-key="certainty"><option value="">All</option><option value="observed">Observed</option><option value="inferred">Inferred</option><option value="hypothesis">Needs confirmation</option></select></label>
+<label>Search<input type="search" data-key="text" placeholder="ID, route, entity, path"></label><span class="small muted" data-count style="align-self:end"></span></div>
+<div class="scroll"><table id="as-built-table"><thead><tr><th>ID</th><th>Statement</th><th>Certainty</th><th>Source</th><th>Linked findings</th><th>Evidence</th></tr></thead><tbody>${[
+        ...built.requirements.map((q) => reqRow(q, "functional")),
+        ...built.non_functional.map((q) => reqRow(q, "non-functional")),
+        ...built.success_criteria.map((q) => reqRow(q, "success")),
+        ...built.edge_cases.map((q) => reqRow(q, "edge")),
+    ].join("")}</tbody></table></div>
+<h3>Discovered surface</h3>
+${surfaceTable("Pages", "page", ["Route", "Kind", "Source", "Auth"], (s) => [`<code>${html(s.name)}</code>`, html(s.detail), where(s), auth(s)])}
+${surfaceTable("Endpoints", "endpoint", ["Method", "Path", "Kind", "Source", "Auth"], (s) => [`<code>${html(s.method ?? "ANY")}</code>`, `<code>${html(s.name)}</code>`, html(s.detail), where(s), auth(s)])}
+${surfaceTable("Data entities", "entity", ["Entity", "Detail", "Source"], (s) => [`<code>${html(s.name)}</code>`, html(s.detail), where(s)])}
+${surfaceTable("Integrations", "integration", ["Package", "Category", "Declared in"], (s) => [`<code>${html(s.name)}</code>`, html(s.detail), where(s)])}
+${surfaceTable("Configuration (names only; values never read)", "config", ["Variable", "Use", "First reference"], (s) => [`<code>${html(s.name)}</code>`, html(s.detail), where(s)])}
+${surfaceTable("Authentication boundaries", "auth-boundary", ["Boundary", "Detail", "Source"], (s) => [`<code>${html(s.name)}</code>`, html(s.detail), where(s)])}
+${surfaceTable("Test titles", "test", ["Title", "Area", "Source"], (s) => [html(s.name), html(s.area), where(s)])}
+<h3>Uncertainties</h3><ul class="small">${built.uncertainties.map((u) => `<li>${html(u)}</li>`).join("")}</ul>
+</section>`;
+}
 /** Validation table row. */
 function validationRow(r, v) {
     return `<tr data-pillar="${v.pillar}" data-status="${v.status}">
@@ -328,12 +431,13 @@ ${c
 <div class="wrap">
 <header class="top"><div><h1>Product Check: ${html(r.contract.target.name)}</h1><div class="meta">Run ${html(r.run.run_id)} · ${html(r.run.finished_at)} · ${html(r.run.status)}</div></div><button class="theme-toggle" type="button" hidden>Theme: auto</button></header>
 ${banners}
-<nav class="tabs" aria-label="Dashboard views"><a href="#readiness" aria-current="page">Executive readiness</a><a href="#scan">Scan explorer</a><a href="#workbench">Validation workbench</a><a href="#blueprint">Blueprint &amp; remediation</a><a href="#history">Assurance history</a></nav>
+<nav class="tabs" aria-label="Dashboard views"><a href="#readiness" aria-current="page">Executive readiness</a><a href="#scan">Scan explorer</a><a href="#workbench">Validation workbench</a><a href="#blueprint">Blueprint &amp; remediation</a><a href="#as-built">As-built spec</a><a href="#history">Assurance history</a></nav>
 <main>
 ${exec}
 ${scan}
 ${work}
 ${bp}
+${asBuiltView(r)}
 ${hist}
 </main>
 <footer>Generated from <code>product-check-results.json</code> (schema ${html(r.schema_version)}); every figure is derived from that file${integrity.errors.length === 0 ? " and its scorecard and verdict recompute from the validations" : ""}. Evidence-bounded readiness, not a penetration test, certification or guarantee.${options.branding ? " Product Check is an EnWithAI Engineering Commons tool." : ""}</footer>

package/dist/discovery/pops.d.ts

@@ -16,6 +16,8 @@ export interface PopInput {
     auditImported: boolean;
     specImported: boolean;
     outcomeImported: boolean;
+    /** OpenSLO, alert rules or a service graph was imported (CT-T4). */
+    operationalImported: boolean;
     aiInScope: boolean;
     tier: Tier;
     now: string;

package/dist/discovery/pops.js

@@ -217,14 +217,16 @@ export function buildPops(input) {
         id: "observability",
         category: "operations",
         name: "Production telemetry (logs, metrics, traces, alerts)",
-        status: postLaunch ? "BLOCKED" : "NOT_APPLICABLE",
+        status: postLaunch ? (input.operationalImported ? "AVAILABLE" : "BLOCKED") : "NOT_APPLICABLE",
         relevant: postLaunch,
         scope: null,
-        provenance: "none",
+        provenance: postLaunch && input.operationalImported ? "imported" : "none",
         limitations: [
-            postLaunch
-                ? "No telemetry adapter in this release; production signals were not read."
-                : "Not required before launch tiers (CT-T4+).",
+            !postLaunch
+                ? "Not required before launch tiers (CT-T4+)."
+                : input.operationalImported
+                    ? "Read from exported files (OpenSLO, alert rules, service graph); nothing was queried live, and a service graph covers only its time window."
+                    : "No operational files were imported (--openslo, --alert-rules, --service-graph); production signals were not read.",
         ],
     }));
     pops.push(input.aiInScope

package/dist/importers/operational.d.ts

@@ -0,0 +1,56 @@
+/** The parsed documents of one input file. */
+export interface InputDocs {
+    source: string;
+    docs: unknown[];
+}
+/** One OpenSLO SLO. */
+export interface SloInfo {
+    name: string;
+    service: string | null;
+    /** Missing parts: "service", "time window", "objective target", "indicator". Empty when complete. */
+    missing: string[];
+    has_alert_policy: boolean;
+    dangling_policy_refs: string[];
+}
+/** Summary of the imported OpenSLO files. */
+export interface OpenSloSummary {
+    slos: SloInfo[];
+    slis: number;
+    alert_policies: number;
+    /** Documents with another OpenSLO apiVersion (v1alpha, v2alpha). */
+    unsupported: number;
+    /** openslo/v1 documents of kinds that are not read (Service, DataSource, AlertCondition, …). */
+    other: number;
+}
+/** Parses OpenSLO v1 files; references resolve across all of them by metadata.name. */
+export declare function parseOpenSlo(files: InputDocs[]): OpenSloSummary;
+/** An alerting rule. `expr` is used for matching only and never written to results. */
+export interface AlertRule {
+    name: string;
+    expr: string;
+    labels: Record<string, string>;
+}
+/** Summary of the imported alert rules. */
+export interface AlertRulesSummary {
+    alerting: AlertRule[];
+    recording: number;
+}
+/** Parses Prometheus/Mimir rule files, PrometheusRule resources and /api/v1/rules exports. */
+export declare function parseAlertRules(files: InputDocs[]): AlertRulesSummary;
+/** A rule matches an SLO by a label value or a label matcher in its expression (name-based: an inference). */
+export declare function sloMatchesRule(slo: string, rule: AlertRule): boolean;
+/** One runtime edge. */
+export interface ServiceEdge {
+    client: string;
+    server: string;
+    count: number;
+}
+/** Summary of a service-graph export. */
+export interface ServiceGraphSummary {
+    format: "jaeger" | "prometheus";
+    edges: ServiceEdge[];
+    /** Distinct peers that look like hosts (not named in results, never matched). */
+    external_peers: number;
+}
+/** Parses a Jaeger /api/dependencies export or a service-graph metrics query result. */
+export declare function parseServiceGraph(data: unknown, source: string): ServiceGraphSummary;

package/dist/importers/operational.js

@@ -0,0 +1,217 @@
+// SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: 2026 EnWithAI Technologies
+/**
+ * Operational importers for CT-T4 (docs/operational-imports.md): OpenSLO v1 documents, Prometheus/Mimir alert rules
+ * and service-graph exports (Jaeger dependencies, `traces_service_graph_request_total` query results). Each reads only
+ * the documented fields it needs and rejects inputs it does not recognize instead of guessing. Rule expressions are
+ * kept in memory for matching and never written to results.
+ */
+import { inputError } from "../errors.js";
+const isObj = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const str = (v) => (typeof v === "string" && v.trim() !== "" ? v.trim() : null);
+const byName = (a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0;
+const OPENSLO_V1 = "openslo/v1";
+/** Parses OpenSLO v1 files; references resolve across all of them by metadata.name. */
+export function parseOpenSlo(files) {
+    const slos = [];
+    const slis = new Set();
+    const policies = new Set();
+    let unsupported = 0;
+    let other = 0;
+    for (const file of files) {
+        let v1 = 0;
+        for (const doc of file.docs) {
+            if (!isObj(doc))
+                continue;
+            const api = doc["apiVersion"];
+            if (typeof api === "string" && api.startsWith("openslo/") && api !== OPENSLO_V1) {
+                unsupported++;
+                continue;
+            }
+            if (api !== OPENSLO_V1)
+                continue;
+            v1++;
+            const name = isObj(doc["metadata"]) ? str(doc["metadata"]["name"]) : null;
+            const kind = doc["kind"];
+            if (kind === "SLO")
+                slos.push({
+                    name: name ?? `(unnamed SLO ${slos.length + 1})`,
+                    spec: isObj(doc["spec"]) ? doc["spec"] : {},
+                });
+            else if (kind === "SLI" && name !== null)
+                slis.add(name);
+            else if (kind === "AlertPolicy" && name !== null)
+                policies.add(name);
+            else
+                other++;
+        }
+        if (v1 === 0)
+            throw inputError(`${file.source} contains no OpenSLO v1 document (apiVersion: ${OPENSLO_V1}).`, "Pass OpenSLO v1 files (SLO, SLI, AlertPolicy) to --openslo.");
+    }
+    const infos = slos.map(({ name, spec }) => {
+        const missing = [];
+        const service = str(spec["service"]);
+        if (service === null)
+            missing.push("service");
+        const window = spec["timeWindow"];
+        if (!Array.isArray(window) ||
+            window.length !== 1 ||
+            !isObj(window[0]) ||
+            str(window[0]["duration"]) === null)
+            missing.push("time window");
+        const objectives = Array.isArray(spec["objectives"]) ? spec["objectives"].filter(isObj) : [];
+        if (!objectives.some((o) => typeof o["target"] === "number" || typeof o["targetPercent"] === "number"))
+            missing.push("objective target");
+        const ref = str(spec["indicatorRef"]);
+        if (!isObj(spec["indicator"]) && (ref === null || !slis.has(ref)))
+            missing.push("indicator");
+        const entries = Array.isArray(spec["alertPolicies"]) ? spec["alertPolicies"] : [];
+        const dangling = [];
+        let resolved = 0;
+        for (const entry of entries) {
+            if (!isObj(entry))
+                continue;
+            const policyRef = str(entry["alertPolicyRef"]);
+            if (policyRef !== null) {
+                if (policies.has(policyRef))
+                    resolved++;
+                else
+                    dangling.push(policyRef);
+            }
+            else if (entry["kind"] === "AlertPolicy")
+                resolved++;
+        }
+        return {
+            name,
+            service,
+            missing,
+            has_alert_policy: entries.length > 0 && resolved === entries.length,
+            dangling_policy_refs: [...new Set(dangling)].sort(),
+        };
+    });
+    return {
+        slos: infos.sort(byName),
+        slis: slis.size,
+        alert_policies: policies.size,
+        unsupported,
+        other,
+    };
+}
+/** The rule groups of one document, in any of the three accepted shapes; null when it has none. */
+function groupsOf(doc) {
+    if (!isObj(doc))
+        return null;
+    if (Array.isArray(doc["groups"]))
+        return doc["groups"];
+    if (isObj(doc["spec"]) && Array.isArray(doc["spec"]["groups"]))
+        return doc["spec"]["groups"];
+    if (isObj(doc["data"]) && Array.isArray(doc["data"]["groups"]))
+        return doc["data"]["groups"];
+    return null;
+}
+/** Parses Prometheus/Mimir rule files, PrometheusRule resources and /api/v1/rules exports. */
+export function parseAlertRules(files) {
+    const alerting = [];
+    let recording = 0;
+    for (const file of files) {
+        const groups = file.docs.map(groupsOf).filter((g) => g !== null);
+        if (groups.length === 0)
+            throw inputError(`${file.source} has no rule groups (groups, spec.groups or data.groups).`, "Pass a Prometheus/Mimir rule file, a PrometheusRule resource or the /api/v1/rules JSON export to --alert-rules.");
+        for (const group of groups.flat()) {
+            if (!isObj(group) || !Array.isArray(group["rules"]))
+                continue;
+            for (const rule of group["rules"]) {
+                if (!isObj(rule))
+                    continue;
+                const name = str(rule["alert"]) ?? (rule["type"] === "alerting" ? str(rule["name"]) : null);
+                if (name === null) {
+                    if (str(rule["record"]) !== null || rule["type"] === "recording")
+                        recording++;
+                    continue;
+                }
+                const labels = {};
+                if (isObj(rule["labels"]))
+                    for (const [k, v] of Object.entries(rule["labels"]))
+                        if (typeof v === "string")
+                            labels[k] = v;
+                alerting.push({ name, expr: String(rule["expr"] ?? rule["query"] ?? ""), labels });
+            }
+        }
+    }
+    return { alerting: alerting.sort(byName), recording };
+}
+/** A rule matches an SLO by a label value or a label matcher in its expression (name-based: an inference). */
+export function sloMatchesRule(slo, rule) {
+    if (Object.values(rule.labels).includes(slo))
+        return true;
+    const quoted = slo.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return new RegExp(`[A-Za-z_][A-Za-z0-9_]*\\s*=~?\\s*"${quoted}"`).test(rule.expr);
+}
+/** A peer that looks like a host: contains ':' or a dot, or is an IPv4 address. */
+const hostLike = (name) => name.includes(":") || name.includes(".");
+/** Parses a Jaeger /api/dependencies export or a service-graph metrics query result. */
+export function parseServiceGraph(data, source) {
+    const bad = () => {
+        throw inputError(`${source} is not a service graph export (Jaeger /api/dependencies, or a traces_service_graph_request_total query result).`, "Export it from Jaeger, Tempo or Prometheus as JSON and pass it to --service-graph.");
+    };
+    const raw = [];
+    let format;
+    if (isObj(data) && Array.isArray(data["data"])) {
+        format = "jaeger";
+        for (const link of data["data"]) {
+            if (!isObj(link))
+                continue;
+            const client = str(link["parent"]);
+            const server = str(link["child"]);
+            const count = link["callCount"];
+            if (client === null || server === null || typeof count !== "number")
+                return bad();
+            raw.push({ client, server, count });
+        }
+    }
+    else if (isObj(data) &&
+        data["status"] === "success" &&
+        isObj(data["data"]) &&
+        Array.isArray(data["data"]["result"])) {
+        format = "prometheus";
+        for (const series of data["data"]["result"]) {
+            if (!isObj(series) || !isObj(series["metric"]))
+                return bad();
+            const metric = series["metric"];
+            const name = metric["__name__"];
+            if (typeof name === "string" && !name.endsWith("service_graph_request_total"))
+                return bad();
+            const client = str(metric["client"]);
+            const server = str(metric["server"]);
+            const sample = Array.isArray(series["value"])
+                ? series["value"]
+                : Array.isArray(series["values"])
+                    ? series["values"].at(-1)
+                    : null;
+            const count = Array.isArray(sample) ? Number(sample[1]) : NaN;
+            if (client === null || server === null || !Number.isFinite(count))
+                return bad();
+            raw.push({ client, server, count });
+        }
+    }
+    else
+        return bad();
+    const external = new Set();
+    const sums = new Map();
+    for (const e of raw) {
+        if (e.count <= 0)
+            continue;
+        if (hostLike(e.client) || hostLike(e.server)) {
+            for (const peer of [e.client, e.server])
+                if (hostLike(peer))
+                    external.add(peer);
+            continue;
+        }
+        const key = `${e.client}\u0000${e.server}`;
+        const edge = sums.get(key) ?? { client: e.client, server: e.server, count: 0 };
+        edge.count += e.count;
+        sums.set(key, edge);
+    }
+    const edges = [...sums.values()].sort((a, b) => a.client === b.client ? (a.server < b.server ? -1 : 1) : a.client < b.client ? -1 : 1);
+    return { format, edges, external_peers: external.size };
+}

package/dist/importers/reports.d.ts

@@ -36,3 +36,27 @@ export interface OutcomeCheckSummary {
 }
 /** Parses an Outcome Check report (schema 1.0); reads the all-PR segment of two metrics. */
 export declare function parseOutcomeCheck(data: unknown, source: string): OutcomeCheckSummary;
+/** Summary of an Architecture Check report. */
+export interface ArchitectureCheckSummary {
+    schema_version: string;
+    model_path: string | null;
+    model_format: string | null;
+    model_usable: boolean;
+    complete_mapping: boolean;
+    findings: number;
+    /** Verified static facts of high or medium severity. */
+    verified_drift: number;
+    verified_rules: string[];
+    hypotheses: number;
+    unknown: number;
+    /** Declared relationships with no static evidence (`relationship-unobserved`), as declared IDs. */
+    unobserved: {
+        from: string;
+        to: string;
+    }[];
+}
+/**
+ * Parses an Architecture Check `analyze`/`check` report (schema 1.0 or 1.1; 1.1 only adds enum values). A `derive`
+ * report has no declared model and describes no drift, so it is rejected.
+ */
+export declare function parseArchitectureCheck(data: unknown, source: string): ArchitectureCheckSummary;

package/dist/importers/reports.js

@@ -2,7 +2,8 @@
 // SPDX-FileCopyrightText: 2026 EnWithAI Technologies
 /**
  * Optional importers for artifacts produced by other tools: `npm audit --json`, and the JSON reports of the
- * sibling Engineering Commons tools (Spec Check 1.0, Impact Check 2.0, Outcome Check 1.0). Each importer reads
+ * sibling Engineering Commons tools (Spec Check 1.0, Impact Check 2.0, Outcome Check 1.0, Architecture Check 1.0/1.1).
+ * Each importer reads
  * only the documented fields it needs and rejects unknown schema versions instead of guessing.
  */
 import { inputError } from "../errors.js";
@@ -82,3 +83,38 @@ export function parseOutcomeCheck(data, source) {
         reverted_prs: reverts && typeof reverts["numerator"] === "number" ? reverts["numerator"] : null,
     };
 }
+/**
+ * Parses an Architecture Check `analyze`/`check` report (schema 1.0 or 1.1; 1.1 only adds enum values). A `derive`
+ * report has no declared model and describes no drift, so it is rejected.
+ */
+export function parseArchitectureCheck(data, source) {
+    if (!isObj(data) ||
+        data["kind"] !== "architecture-check-report" ||
+        (data["schema_version"] !== "1.0" && data["schema_version"] !== "1.1") ||
+        !Array.isArray(data["findings"]) ||
+        !isObj(data["declared_model"])) {
+        throw inputError(`${source} is not an Architecture Check report with a declared model (schema 1.0 or 1.1).`, "Produce it with `architecture-check check --format json` (or `analyze`); `derive` output has no drift to import.");
+    }
+    const model = data["declared_model"];
+    const findings = data["findings"].filter(isObj);
+    const drift = findings.filter((f) => f["status"] === "verified_static_fact" && (f["severity"] === "high" || f["severity"] === "medium"));
+    const str = (v) => (typeof v === "string" ? v : null);
+    return {
+        schema_version: data["schema_version"],
+        model_path: str(model["path"]),
+        model_format: str(model["format"]),
+        model_usable: model["usable"] === true,
+        complete_mapping: data["complete_mapping"] === true,
+        findings: findings.length,
+        verified_drift: drift.length,
+        verified_rules: [...new Set(drift.map((f) => String(f["rule_id"])))].sort(),
+        hypotheses: findings.filter((f) => f["status"] === "hypothesis").length,
+        unknown: findings.filter((f) => f["status"] === "unknown").length,
+        unobserved: findings
+            .filter((f) => f["rule_id"] === "relationship-unobserved" && typeof f["subject"] === "string")
+            .map((f) => /^(\S+) -> (\S+)$/.exec(f["subject"]))
+            .filter((m) => m !== null)
+            .map((m) => ({ from: m[1], to: m[2] }))
+            .sort((a, b) => (`${a.from} ${a.to}` < `${b.from} ${b.to}` ? -1 : 1)),
+    };
+}

package/dist/inspectors/source/surface.d.ts

@@ -0,0 +1,30 @@
+import { type RepoFacts } from "./facts.js";
+export type SurfaceKind = "page" | "endpoint" | "entity" | "config" | "integration" | "auth-boundary" | "test";
+/** One element of the product surface. */
+export interface SurfaceItem {
+    kind: SurfaceKind;
+    /** Route path, entity name, variable name, package name or test title. */
+    name: string;
+    /** HTTP method for endpoints (`ANY` when the handler dispatches on method itself); null otherwise. */
+    method: string | null;
+    /** Grouping area: first meaningful route segment, or the entity/integration category. */
+    area: string;
+    /** Short human-readable detail (fields, category, matcher, how it was recognised). */
+    detail: string;
+    path: string;
+    line: number | null;
+    excerpt: string | null;
+    certainty: "observed" | "inferred";
+    /** Endpoints and pages whose source references a session or auth helper (inference). */
+    auth_hint: boolean;
+}
+/** Everything derived about the surface. */
+export interface ProductSurface {
+    items: SurfaceItem[];
+    /** Notes about what could not be determined (for the spec's uncertainties). */
+    notes: string[];
+}
+/** The grouping area of a URL path: first static segment after an optional `api` prefix. */
+export declare function areaOf(route: string): string;
+/** Derives the product surface. */
+export declare function deriveSurface(facts: RepoFacts): ProductSurface;