@gmickel/gno 1.33.0 → 1.34.0

package/src/core/audit-links.ts

@@ -0,0 +1,222 @@
+/** Deterministic read-only link-integrity audit rules. */
+
+import type {
+  AuditLinkSnapshot,
+  AuditLinkSnapshotDocument,
+} from "../store/sqlite/graph-link-resolver";
+import type { AuditFindingDraft, AuditRuleContribution } from "./audit";
+
+import { compareAuditCodeUnits, compareAuditFindingDrafts } from "./audit";
+
+export const LINK_AUDIT_RULE_VERSION = "1.0" as const;
+export const LINK_AUDIT_MAX_FINDINGS_PER_RULE = 1000;
+
+export interface AuditOrphanPolicy {
+  rootUris: readonly string[];
+  ignorePathPrefixes: readonly string[];
+  /** Mirrored duplicate rows are excluded from orphan claims by default. */
+  ignoreMirrorDuplicates?: boolean;
+}
+
+const boundedFindings = (
+  findings: readonly AuditFindingDraft[]
+): AuditFindingDraft[] =>
+  [...findings]
+    .sort(compareAuditFindingDrafts)
+    .slice(0, LINK_AUDIT_MAX_FINDINGS_PER_RULE);
+
+const lineLocation = (line: number, column: number): string =>
+  `L${line}:C${column}`;
+
+const linkFinding = (
+  link: AuditLinkSnapshot["links"][number]
+): AuditFindingDraft => {
+  const ambiguous = (link.resolved?.matchCount ?? 0) > 1;
+  const target = `${link.targetCollection}:${link.targetRef}`;
+  return {
+    subject: link.sourceUri,
+    location: lineLocation(link.startLine, link.startCol),
+    severity: "warning",
+    message: ambiguous
+      ? `Link target is ambiguous: ${target}`
+      : `${link.linkType === "markdown" ? "Broken" : "Unresolved"} local link: ${target}`,
+    evidence: [
+      {
+        kind: ambiguous ? "ambiguous-target" : "unresolved-target",
+        summary: target,
+        uri: link.sourceUri,
+        path: link.sourceRelPath,
+        detail: JSON.stringify({
+          anchor: link.targetAnchor,
+          endColumn: link.endCol,
+          endLine: link.endLine,
+          linkType: link.linkType,
+          matchCount: link.resolved?.matchCount ?? 0,
+          matchRank: link.resolved?.matchRank ?? null,
+          normalizedTarget: link.targetRefNorm,
+        }),
+      },
+    ],
+    guidance: ambiguous
+      ? ["Use an explicit collection-relative target path"]
+      : ["Create the target or correct the local link"],
+  };
+};
+
+const normalizedPrefixes = (values: readonly string[]): string[] =>
+  [...new Set(values.map((value) => value.normalize("NFC").trim()))]
+    .filter(Boolean)
+    .sort(compareAuditCodeUnits);
+
+const isIgnoredDocument = (
+  document: AuditLinkSnapshotDocument,
+  roots: Set<string>,
+  ignorePrefixes: readonly string[],
+  mirroredIds: Set<number>
+): boolean =>
+  roots.has(document.uri) ||
+  mirroredIds.has(document.id) ||
+  ignorePrefixes.some((prefix) => {
+    const visiblePath = document.recordSourcePath ?? document.relPath;
+    return visiblePath === prefix || visiblePath.startsWith(`${prefix}/`);
+  });
+
+const duplicateMirrorIds = (
+  documents: readonly AuditLinkSnapshotDocument[],
+  ignoreMirrorDuplicates: boolean
+): Set<number> => {
+  if (!ignoreMirrorDuplicates) return new Set<number>();
+  const byMirror = new Map<string, number[]>();
+  for (const document of documents) {
+    if (!document.mirrorHash) continue;
+    const ids = byMirror.get(document.mirrorHash) ?? [];
+    ids.push(document.id);
+    byMirror.set(document.mirrorHash, ids);
+  }
+  const duplicates = new Set<number>();
+  for (const ids of byMirror.values()) {
+    if (ids.length < 2) continue;
+    for (const id of ids) duplicates.add(id);
+  }
+  return duplicates;
+};
+
+/** Evaluate one already captured set-oriented snapshot; never touches storage. */
+export const evaluateLinkAudit = (
+  snapshot: AuditLinkSnapshot,
+  policy: AuditOrphanPolicy
+): AuditRuleContribution[] => {
+  const unresolved: AuditFindingDraft[] = [];
+  const ambiguous: AuditFindingDraft[] = [];
+  const connected = new Set<number>();
+  const auditedDocumentIds = new Set(
+    snapshot.auditedDocumentIds ?? snapshot.documents.map(({ id }) => id)
+  );
+  for (const link of snapshot.links) {
+    const sourceAudited = auditedDocumentIds.has(link.sourceId);
+    if (!link.resolved) {
+      if (sourceAudited) unresolved.push(linkFinding(link));
+      continue;
+    }
+    if (sourceAudited) connected.add(link.sourceId);
+    if (auditedDocumentIds.has(link.resolved.targetId)) {
+      connected.add(link.resolved.targetId);
+    }
+    if (sourceAudited && link.resolved.matchCount > 1) {
+      ambiguous.push(linkFinding(link));
+    }
+  }
+  const roots = new Set(normalizedPrefixes(policy.rootUris));
+  const ignorePrefixes = normalizedPrefixes(policy.ignorePathPrefixes);
+  const mirroredIds = duplicateMirrorIds(
+    snapshot.documents,
+    policy.ignoreMirrorDuplicates ?? true
+  );
+  const orphanFindings = snapshot.documents
+    .filter(
+      (document) =>
+        auditedDocumentIds.has(document.id) &&
+        !connected.has(document.id) &&
+        !isIgnoredDocument(document, roots, ignorePrefixes, mirroredIds)
+    )
+    .sort((left, right) => compareAuditCodeUnits(left.uri, right.uri))
+    .map<AuditFindingDraft>((document) => ({
+      subject: document.uri,
+      location: null,
+      severity: "info",
+      message: "Document is isolated under the configured orphan policy",
+      evidence: [
+        {
+          kind: "orphan-policy",
+          summary: "No resolved incoming or outgoing local links",
+          uri: document.uri,
+          path: document.recordSourcePath ?? document.relPath,
+          detail: JSON.stringify({ root: false, ignored: false }),
+        },
+      ],
+      guidance: [
+        "Link this document or add it to the explicit root/ignore policy",
+      ],
+    }));
+  const partial = snapshot.truncated.documents || snapshot.truncated.links;
+  const statusFor = (findings: readonly AuditFindingDraft[]) =>
+    partial
+      ? ("inconclusive" as const)
+      : findings.length > 0
+        ? ("fail" as const)
+        : ("pass" as const);
+  const common = {
+    examinedCount:
+      snapshot.metrics.documentRowsExamined + snapshot.metrics.linkRowsExamined,
+    durationMs: 0,
+  };
+  return [
+    {
+      ...common,
+      ruleId: "links.local-targets",
+      category: "links",
+      status: statusFor(unresolved),
+      message: partial
+        ? "Local target scan was truncated"
+        : `${unresolved.length} unresolved or broken local links`,
+      findings: boundedFindings(unresolved),
+      findingCount: unresolved.length,
+      skipReason: partial ? "snapshot_truncated" : null,
+    },
+    {
+      ...common,
+      ruleId: "links.ambiguous-targets",
+      category: "links",
+      status: statusFor(ambiguous),
+      message: partial
+        ? "Ambiguous target scan was truncated"
+        : `${ambiguous.length} ambiguous local links`,
+      findings: boundedFindings(ambiguous),
+      findingCount: ambiguous.length,
+      skipReason: partial ? "snapshot_truncated" : null,
+    },
+    {
+      ...common,
+      ruleId: "links.orphans",
+      category: "links",
+      status: statusFor(orphanFindings),
+      message: partial
+        ? "Orphan scan was truncated"
+        : `${orphanFindings.length} policy-defined orphan documents`,
+      findings: boundedFindings(orphanFindings),
+      findingCount: orphanFindings.length,
+      skipReason: partial ? "snapshot_truncated" : null,
+    },
+    {
+      ...common,
+      ruleId: "links.parser-boundary",
+      category: "links",
+      status: "pass",
+      message:
+        "External URLs and parser-excluded malformed references are outside the local target graph",
+      findings: [],
+      findingCount: 0,
+      skipReason: null,
+    },
+  ];
+};

package/src/core/audit-provenance.ts

@@ -0,0 +1,154 @@
+/** Declared-contract provenance completeness audit rules. */
+
+import type { AuditFindingDraft, AuditRuleContribution } from "./audit";
+import type { CaptureSource } from "./capture";
+
+import { compareAuditFindingDrafts } from "./audit";
+import { validateDeclaredCaptureProvenance } from "./capture";
+import {
+  hasDeclaredRecordProvenance,
+  validateDeclaredRecordProvenance,
+} from "./record-metadata";
+
+export const PROVENANCE_AUDIT_MAX_FINDINGS_PER_RULE = 1000;
+
+export interface AuditProvenanceDocument {
+  uri: string;
+  relPath: string;
+  sourceState?: "readable" | "missing" | "unreadable";
+  /** Whether this source format can declare CaptureSource frontmatter. */
+  captureSourceSupported?: boolean;
+  captureSource?: Partial<CaptureSource>;
+  captureSourceDeclared: boolean;
+  record: {
+    recordKey?: string | null;
+    recordSourceLocator?: string | null;
+    converterId?: string | null;
+    converterVersion?: string | null;
+    recordAdapterFingerprint?: string | null;
+  };
+}
+
+const issueFinding = (input: {
+  document: AuditProvenanceDocument;
+  field: string;
+  reason: "missing" | "invalid";
+  contract: string;
+}): AuditFindingDraft => ({
+  subject: input.document.uri,
+  location: input.field,
+  severity: "warning",
+  message: `${input.contract} provenance field is ${input.reason}: ${input.field}`,
+  evidence: [
+    {
+      kind: "declared-provenance-requirement",
+      summary: `${input.contract}:${input.field}:${input.reason}`,
+      uri: input.document.uri,
+      path: input.document.relPath,
+    },
+  ],
+  guidance: [
+    `Supply a valid ${input.field} value or remove the declaring provenance block`,
+  ],
+});
+
+/** Missing provenance is completeness evidence, never a truth judgment. */
+export const evaluateProvenanceAudit = (
+  documents: readonly AuditProvenanceDocument[],
+  options: { truncated?: boolean } = {}
+): AuditRuleContribution[] => {
+  const captureFindings: AuditFindingDraft[] = [];
+  const recordFindings: AuditFindingDraft[] = [];
+  let declaredCaptureDocuments = 0;
+  let declaredRecordDocuments = 0;
+  let unavailableCaptureSources = 0;
+  for (const document of documents) {
+    if (
+      document.captureSourceSupported !== false &&
+      document.sourceState !== undefined &&
+      document.sourceState !== "readable"
+    ) {
+      unavailableCaptureSources += 1;
+    }
+    if (document.captureSourceDeclared) {
+      declaredCaptureDocuments += 1;
+      for (const issue of validateDeclaredCaptureProvenance(
+        document.captureSource ?? {}
+      )) {
+        captureFindings.push(
+          issueFinding({
+            document,
+            field: issue.field,
+            reason: issue.reason,
+            contract: "capture",
+          })
+        );
+      }
+    }
+    const recordIssues = validateDeclaredRecordProvenance(document.record);
+    if (hasDeclaredRecordProvenance(document.record)) {
+      declaredRecordDocuments += 1;
+    }
+    for (const issue of recordIssues) {
+      recordFindings.push(
+        issueFinding({
+          document,
+          field: issue.field,
+          reason: issue.reason,
+          contract: "logical-record",
+        })
+      );
+    }
+  }
+  const truncated = options.truncated === true;
+  const result = (
+    ruleId: string,
+    findings: AuditFindingDraft[],
+    declaredDocuments: number,
+    unavailableDocuments = 0
+  ): AuditRuleContribution => ({
+    ruleId,
+    category: "provenance",
+    status: truncated
+      ? "inconclusive"
+      : unavailableDocuments > 0
+        ? "unavailable"
+        : findings.length > 0
+          ? "fail"
+          : declaredDocuments === 0
+            ? "skip"
+            : "pass",
+    message: truncated
+      ? "Provenance scan was truncated"
+      : unavailableDocuments > 0
+        ? `${unavailableDocuments} source files could not be inspected for declared capture provenance`
+        : declaredDocuments === 0
+          ? "No documents declared this provenance contract"
+          : `${findings.length} declared provenance completeness issues`,
+    findings: [...findings]
+      .sort(compareAuditFindingDrafts)
+      .slice(0, PROVENANCE_AUDIT_MAX_FINDINGS_PER_RULE),
+    findingCount: findings.length,
+    examinedCount: documents.length,
+    skipReason: truncated
+      ? "snapshot_truncated"
+      : unavailableDocuments > 0
+        ? "source_unavailable"
+        : declaredDocuments === 0
+          ? "contract_not_declared"
+          : null,
+  });
+  return [
+    result(
+      "provenance.capture-source",
+      captureFindings,
+      declaredCaptureDocuments,
+      unavailableCaptureSources
+    ),
+    result(
+      "provenance.logical-record",
+      recordFindings,
+      declaredRecordDocuments
+    ),
+  ];
+};

package/src/core/audit-report.ts

@@ -0,0 +1,318 @@
+/** Canonical finding identity, ordering, counts, and report serialization. */
+
+import type {
+  AuditCategory,
+  AuditCounts,
+  AuditEvidence,
+  AuditExitKind,
+  AuditFinding,
+  AuditFindingDraft,
+  AuditReport,
+  AuditReportStatus,
+  AuditRuleResult,
+} from "./audit-contract";
+
+import {
+  AUDIT_CATEGORIES,
+  AUDIT_EXIT_CODES,
+  AUDIT_MAX_EVIDENCE_DETAIL_CHARS,
+  AUDIT_MAX_EVIDENCE_PER_FINDING,
+  AUDIT_MAX_GUIDANCE_CHARS,
+  AUDIT_MAX_GUIDANCE_PER_FINDING,
+  AUDIT_MAX_CODE_CHARS,
+  AUDIT_MAX_IDENTIFIER_CHARS,
+  AUDIT_MAX_MESSAGE_CHARS,
+} from "./audit-contract";
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Canonicalization & stable IDs
+// ─────────────────────────────────────────────────────────────────────────────
+
+export const compareAuditCodeUnits = (left: string, right: string): number =>
+  left < right ? -1 : left > right ? 1 : 0;
+
+export const compareAuditFindingDrafts = (
+  left: AuditFindingDraft,
+  right: AuditFindingDraft
+): number =>
+  compareAuditCodeUnits(left.subject, right.subject) ||
+  compareAuditCodeUnits(left.location ?? "", right.location ?? "") ||
+  compareAuditCodeUnits(left.message, right.message) ||
+  compareAuditCodeUnits(
+    JSON.stringify(left.evidence),
+    JSON.stringify(right.evidence)
+  );
+
+type CanonicalJson =
+  | boolean
+  | null
+  | number
+  | string
+  | CanonicalJson[]
+  | { [key: string]: CanonicalJson };
+
+const canonicalizeJsonValue = (value: unknown): CanonicalJson => {
+  if (
+    value === null ||
+    typeof value === "boolean" ||
+    typeof value === "string"
+  ) {
+    return value;
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new Error("Canonical JSON rejects non-finite numbers");
+    }
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => canonicalizeJsonValue(item));
+  }
+  if (typeof value === "object") {
+    const sorted: Record<string, CanonicalJson> = {};
+    for (const key of Object.keys(value).sort(compareAuditCodeUnits)) {
+      const child = (value as Record<string, unknown>)[key];
+      if (child === undefined) {
+        throw new Error(`Canonical JSON rejects undefined at ${key}`);
+      }
+      sorted[key] = canonicalizeJsonValue(child);
+    }
+    return sorted;
+  }
+  throw new TypeError(`Unsupported canonical JSON value: ${typeof value}`);
+};
+
+/** Key-sorted JSON used for identity hashes and semantic equality. */
+export const canonicalAuditJson = (value: unknown): string =>
+  JSON.stringify(canonicalizeJsonValue(value));
+
+export const hashAuditCanonical = (value: unknown): string =>
+  new Bun.CryptoHasher("sha256")
+    .update(canonicalAuditJson(value))
+    .digest("hex");
+
+export const normalizeAuditText = (value: string): string =>
+  value.normalize("NFC").trim();
+
+export const boundAuditText = (value: string, maxChars: number): string => {
+  const normalized = normalizeAuditText(value);
+  const characters = Array.from(normalized);
+  if (characters.length <= maxChars) return normalized;
+  return characters.slice(0, maxChars).join("");
+};
+
+const boundEvidence = (evidence: readonly AuditEvidence[]): AuditEvidence[] => {
+  const bounded: AuditEvidence[] = [];
+  for (const item of evidence.slice(0, AUDIT_MAX_EVIDENCE_PER_FINDING)) {
+    const next: AuditEvidence = {
+      kind: boundAuditText(item.kind, AUDIT_MAX_CODE_CHARS),
+      summary: boundAuditText(item.summary, AUDIT_MAX_MESSAGE_CHARS),
+    };
+    if (item.uri !== undefined) {
+      next.uri = boundAuditText(item.uri, AUDIT_MAX_IDENTIFIER_CHARS);
+    }
+    if (item.path !== undefined) {
+      next.path = boundAuditText(item.path, AUDIT_MAX_IDENTIFIER_CHARS);
+    }
+    if (item.detail !== undefined) {
+      next.detail = boundAuditText(
+        item.detail,
+        AUDIT_MAX_EVIDENCE_DETAIL_CHARS
+      );
+    }
+    bounded.push(next);
+  }
+  return bounded.sort((left, right) => {
+    const byKind = compareAuditCodeUnits(left.kind, right.kind);
+    if (byKind !== 0) return byKind;
+    const bySummary = compareAuditCodeUnits(left.summary, right.summary);
+    if (bySummary !== 0) return bySummary;
+    return compareAuditCodeUnits(
+      canonicalAuditJson(left),
+      canonicalAuditJson(right)
+    );
+  });
+};
+
+const boundGuidance = (guidance: readonly string[] | undefined): string[] => {
+  if (!guidance || guidance.length === 0) return [];
+  return guidance
+    .slice(0, AUDIT_MAX_GUIDANCE_PER_FINDING)
+    .map((item) => boundAuditText(item, AUDIT_MAX_GUIDANCE_CHARS))
+    .sort(compareAuditCodeUnits);
+};
+
+export const fingerprintAuditEvidence = (
+  evidence: readonly AuditEvidence[]
+): string => hashAuditCanonical(boundEvidence(evidence));
+
+/**
+ * Stable finding identity from rule + normalized subject/location + evidence.
+ * Wall-clock timing is intentionally excluded.
+ */
+export const buildAuditFindingId = (input: {
+  ruleId: string;
+  subject: string;
+  location: string | null;
+  evidenceFingerprint: string;
+}): string =>
+  hashAuditCanonical({
+    evidenceFingerprint: input.evidenceFingerprint,
+    location: input.location,
+    ruleId: normalizeAuditText(input.ruleId),
+    subject: normalizeAuditText(input.subject),
+  });
+
+export const materializeAuditFinding = (
+  ruleId: string,
+  category: AuditCategory,
+  draft: AuditFindingDraft
+): AuditFinding => {
+  const subject = boundAuditText(draft.subject, AUDIT_MAX_IDENTIFIER_CHARS);
+  const location =
+    draft.location === undefined || draft.location === null
+      ? null
+      : boundAuditText(draft.location, AUDIT_MAX_IDENTIFIER_CHARS);
+  const evidence = boundEvidence(draft.evidence);
+  const evidenceFingerprint = fingerprintAuditEvidence(evidence);
+  return {
+    id: buildAuditFindingId({
+      ruleId,
+      subject,
+      location,
+      evidenceFingerprint,
+    }),
+    ruleId: boundAuditText(ruleId, AUDIT_MAX_CODE_CHARS),
+    category,
+    severity: draft.severity,
+    subject,
+    location,
+    message: boundAuditText(draft.message, AUDIT_MAX_MESSAGE_CHARS),
+    evidence,
+    guidance: boundGuidance(draft.guidance),
+    evidenceFingerprint,
+  };
+};
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Ordering, counts, exit taxonomy
+// ─────────────────────────────────────────────────────────────────────────────
+
+export const auditCategoryRank = (category: AuditCategory): number =>
+  AUDIT_CATEGORIES.indexOf(category);
+
+export const compareAuditFindings = (
+  left: AuditFinding,
+  right: AuditFinding
+): number => {
+  const byCategory =
+    auditCategoryRank(left.category) - auditCategoryRank(right.category);
+  if (byCategory !== 0) return byCategory;
+  const byRule = compareAuditCodeUnits(left.ruleId, right.ruleId);
+  if (byRule !== 0) return byRule;
+  const bySubject = compareAuditCodeUnits(left.subject, right.subject);
+  if (bySubject !== 0) return bySubject;
+  const leftLocation = left.location ?? "";
+  const rightLocation = right.location ?? "";
+  const byLocation = compareAuditCodeUnits(leftLocation, rightLocation);
+  if (byLocation !== 0) return byLocation;
+  return compareAuditCodeUnits(left.id, right.id);
+};
+
+export const compareAuditRules = (
+  left: AuditRuleResult,
+  right: AuditRuleResult
+): number => {
+  const byCategory =
+    auditCategoryRank(left.category) - auditCategoryRank(right.category);
+  if (byCategory !== 0) return byCategory;
+  const byRule = compareAuditCodeUnits(left.ruleId, right.ruleId);
+  if (byRule !== 0) return byRule;
+  const semanticRule = ({
+    durationMs: _durationMs,
+    ...rule
+  }: AuditRuleResult) => canonicalAuditJson(rule);
+  return compareAuditCodeUnits(semanticRule(left), semanticRule(right));
+};
+
+const emptyRuleCounts = (): AuditCounts["rules"] => ({
+  pass: 0,
+  fail: 0,
+  skip: 0,
+  unavailable: 0,
+  inconclusive: 0,
+  total: 0,
+});
+
+export const tallyAuditRuleCounts = (
+  rules: readonly AuditRuleResult[]
+): AuditCounts["rules"] => {
+  const counts = emptyRuleCounts();
+  for (const rule of rules) {
+    counts[rule.status] += 1;
+    counts.total += 1;
+  }
+  return counts;
+};
+
+/**
+ * Derive report status from rule outcomes and snapshot consistency.
+ * Unavailable/inconclusive evidence can never yield a clean complete report.
+ */
+export const deriveAuditReportStatus = (input: {
+  rules: readonly AuditRuleResult[];
+  snapshotChanged: boolean;
+  failed?: boolean;
+}): AuditReportStatus => {
+  if (input.failed) return "failed";
+  if (input.snapshotChanged) return "changed_during_audit";
+  const hasHonestGap = input.rules.some(
+    (rule) => rule.status === "unavailable" || rule.status === "inconclusive"
+  );
+  if (hasHonestGap) return "partial";
+  return "complete";
+};
+
+/**
+ * Map a finished report to the frozen exit taxonomy.
+ * Clean requires complete status and zero fail findings.
+ */
+export const deriveAuditExitKind = (report: AuditReport): AuditExitKind => {
+  if (report.status === "failed") return "runtime";
+  if (report.status === "partial" || report.status === "changed_during_audit") {
+    return "partial";
+  }
+  const hasFailFindings = report.findings.some(
+    (finding) => finding.severity === "error" || finding.severity === "warning"
+  );
+  const hasFailRules = report.rules.some((rule) => rule.status === "fail");
+  if (hasFailFindings || hasFailRules) return "findings";
+  return "clean";
+};
+
+export const auditExitCode = (kind: AuditExitKind): number =>
+  AUDIT_EXIT_CODES[kind];
+
+/**
+ * Semantic projection for equality: identical snapshots must match regardless
+ * of wall-clock timing and per-rule duration noise.
+ */
+export const auditSemanticProjection = (report: AuditReport): CanonicalJson => {
+  const {
+    startedAt: _s,
+    completedAt: _c,
+    durationMs: _d,
+    timing: _t,
+    ...rest
+  } = report;
+  return canonicalizeJsonValue({
+    ...rest,
+    rules: report.rules.map(({ durationMs: _durationMs, ...rule }) => rule),
+  });
+};
+
+export const serializeAuditReportSemantic = (report: AuditReport): string =>
+  canonicalAuditJson(auditSemanticProjection(report));
+
+export const serializeAuditReportCanonical = (report: AuditReport): string =>
+  canonicalAuditJson(report);