@inerrata-corporation/errata 2.0.0-dev.79 → 2.0.0-dev.82

package/consolidate-worker.mjs

@@ -15110,9 +15110,90 @@ var init_zod = __esm({
 });
 
 // ../../packages/shared/src/edge-rules.ts
+function isValidEdge(from, type, to) {
+  const rule = EDGE_RULES[type];
+  if (!rule) return { ok: true };
+  if (from && rule.from && !rule.from.includes(from)) {
+    return {
+      ok: false,
+      reason: `${type} cannot originate from ${from} (allowed: ${rule.from.join(", ")})`
+    };
+  }
+  if (to && rule.to && !rule.to.includes(to)) {
+    return {
+      ok: false,
+      reason: `${type} cannot target ${to} (allowed: ${rule.to.join(", ")})`
+    };
+  }
+  return { ok: true };
+}
+var EDGE_RULES;
 var init_edge_rules = __esm({
   "../../packages/shared/src/edge-rules.ts"() {
     "use strict";
+    EDGE_RULES = {
+      // ── Project anchors (PJ-anchors · PLAN_PROJECT_STORE §6c) ──
+      // ANCHORED_AT is the ONE bridge edge admitted to the cloud, and it exists for
+      // exactly one purpose: point a piece of knowledge at an OPAQUE project `Symbol`
+      // so two teammates' observations about the same function converge on one node.
+      // Constrain it to that purpose — an unconstrained ANCHORED_AT (its state before
+      // this rule, since a missing entry means "anything goes") would let a batch
+      // anchor anything at anything, e.g. at a public `Package`, quietly re-creating
+      // the code↔collective bridge the membrane exists to prevent.
+      ANCHORED_AT: {
+        from: ["Problem", "Solution", "RootCause", "Claim"],
+        to: ["Symbol"]
+      },
+      // ── Security spine (v1 taxonomy.ts SECURITY_FORWARD_ONLY commentary) ──
+      TARGETS: { from: ["Exploit"], to: ["Vulnerability"] },
+      ENABLES: { from: ["AntiPattern"], to: ["Vulnerability"] },
+      MITIGATES: { from: ["Solution"], to: ["Vulnerability"] },
+      PRESENTS: { from: ["Solution"], to: ["Problem", "Vulnerability"] },
+      // SOLVED_BY sources: Vulnerability (v1 comment) + Problem/RootCause
+      // (upstream design-problem.ts + triage.ts mint both).
+      SOLVED_BY: { from: ["Vulnerability", "Problem", "RootCause"], to: ["Solution"] },
+      // FIXED_BY sources mirror SOLVED_BY's (same ailment→fix semantics; live-graph
+      // census 2026-07-14: 512 Problem + 13 RootCause sources, zero others besides
+      // 3 REVERSED Solution→Problem edges the missing `from` let through — the
+      // "Problem solved by Problem" splash bug. A reversed resolution edge is NOT
+      // mechanically flippable (half the sample were PoC-not-fix claims), so the
+      // door rejects rather than repairs; a correct re-emission lands via
+      // recognition-at-the-door.
+      FIXED_BY: { from: ["Vulnerability", "Problem", "RootCause"], to: ["Solution"] },
+      // ── Triage family (upstream castalia.ts: Problem —TRIAGED_BY→ Triage —{INDICATES|CONFIRMS}→ cause) ──
+      // Two-edge differential model (T3-rename): INDICATES = provisional candidate,
+      // CONFIRMS = promoted router (a discriminator exists). Same endpoint matrix.
+      // ROUTES_TO is the deprecated pre-split alias, kept readable during migration.
+      TRIAGED_BY: { from: ["Problem"], to: ["Triage"] },
+      CONFIRMS: { from: ["Triage"], to: ["RootCause", "Problem"] },
+      INDICATES: { from: ["Triage"], to: ["RootCause", "Problem"] },
+      ROUTES_TO: { from: ["Triage"], to: ["RootCause", "Problem"] },
+      // ── Context grounding (v1 taxonomy.ts comments) ──
+      WRITTEN_IN: { from: ["Component", "Package"], to: ["Language"] },
+      OCCURS_IN: { to: ["Language"] },
+      OCCURS_ON: { to: ["OperatingSystem"] },
+      RUNS_ON: { to: ["OperatingSystem"] },
+      OPERATES_ON: { from: ["Algorithm"], to: ["DataStructure"] },
+      INVOLVES: { from: ["Problem", "Solution"], to: ["DataStructure"] },
+      // ── Taxonomy (Track 4 Stream C: MITRE CWE `ChildOf` → `Weakness —IS_A→ Weakness`) ──
+      IS_A: { from: ["Weakness"], to: ["Weakness"] },
+      // ── Conceptual (v1 taxonomy.ts: instance → motif/pattern reference) ──
+      INSTANCE_OF: { to: ["Pattern", "Weakness", "Technique"] },
+      IMPLEMENTS: { from: ["Solution", "Language", "Component"], to: ["Pattern", "Technique"] },
+      MATCHES: { to: ["Pattern"] },
+      // ── Artifact evidence (v1 taxonomy.ts artifact rows) ──
+      PRODUCED: { from: ["Report"], to: ["Artifact"] },
+      MANIFESTED_IN: { from: ["Problem"], to: ["Artifact"] },
+      REVEALED_BY: { from: ["RootCause"], to: ["Artifact"] },
+      // ── Belief / abstraction gradients (upstream castalia.ts) ──
+      CORROBORATES: { from: ["Claim"], to: ["Claim"] },
+      GENERALIZES: { from: ["Claim"] },
+      DERIVED_FROM: { from: ["Claim"] },
+      // ── Decomposition (castalia.ts: a Problem fans out into independent root
+      // problems; §5.1 also attaches SPLIT_INTO to Claim when one conflates two).
+      // `to` left unconstrained — the replacement set's labels vary by case. ──
+      SPLIT_INTO: { from: ["Problem", "Claim"] }
+    };
   }
 });
 
@@ -15274,6 +15355,13 @@ var init_project_symbol = __esm({
   }
 });
 
+// ../../packages/shared/src/lockfile.ts
+var init_lockfile = __esm({
+  "../../packages/shared/src/lockfile.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/shared/src/nlp/canonicalize.ts
 var init_canonicalize = __esm({
   "../../packages/shared/src/nlp/canonicalize.ts"() {
@@ -15310,6 +15398,7 @@ var init_src = __esm({
     init_symbol_intent();
     init_repo_locator();
     init_project_symbol();
+    init_lockfile();
     init_hash();
     init_error_signature();
     init_canonicalize();
@@ -15623,6 +15712,15 @@ import { parentPort } from "node:worker_threads";
 
 // ../../packages/local-graph/src/store.ts
 init_src2();
+init_src();
+var LOCAL_RULE_OVERRIDES = {
+  ANCHORED_AT: {
+    from: EDGE_RULES["ANCHORED_AT"]?.from,
+    to: [...CODE_NODE_LABELS, "Symbol"]
+  },
+  REVEALED_BY: null,
+  PRODUCED: null
+};
 var SCHEMA_VERSION = 5;
 var SCHEMA_SQL = `
 CREATE TABLE IF NOT EXISTS schema_version (
@@ -15772,6 +15870,10 @@ var SqliteGraphStore = class {
    *  every node/edge upsert — code-index and capture alike — so the consolidation
    *  trigger can read "how much changed" without caring what changed it. */
   mutations = 0;
+  /** Edges refused by the local ontology gate (EDGE_RULES) since open — a
+   *  visible counter so a misbehaving extractor shows up in stats instead of
+   *  silently thinning the graph. */
+  rejectedEdgeCount = 0;
   /** Persistent monotonic ingest-sequence high-water (KN-decay-momentum). Loaded
    *  from store_meta on open, advanced once per knowledge ingest event via
    *  nextIngestSeq(). Distinct from `mutations` (in-memory, per-session, bumped by
@@ -16081,6 +16183,12 @@ var SqliteGraphStore = class {
     this.stmts.setCommunity.run({ id, v: community });
   }
   mergeEdge(edge) {
+    const violation = this.edgeRuleViolation(edge);
+    if (violation) {
+      this.rejectedEdgeCount++;
+      console.warn(`[local-graph] rejected edge ${edge.from}-[:${edge.type}]->${edge.to}: ${violation}`);
+      return;
+    }
     this.mutations++;
     this.stmts.insertEdge.run({
       id: edge.id,
@@ -16098,6 +16206,27 @@ var SqliteGraphStore = class {
       attrs_json: JSON.stringify(edge.attrs ?? {})
     });
   }
+  /** EDGE_RULES check against the stored endpoints' labels, with the LOCAL
+   *  overlay consulted first. Returns the reason string on a documented-
+   *  forbidden combination, else null. Point lookups on the id PK — negligible
+   *  next to the insert itself. */
+  edgeRuleViolation(edge) {
+    const fromLabel = this.getNode(edge.from)?.label;
+    const toLabel = this.getNode(edge.to)?.label;
+    if (edge.type in LOCAL_RULE_OVERRIDES) {
+      const rule = LOCAL_RULE_OVERRIDES[edge.type];
+      if (!rule) return null;
+      if (fromLabel && rule.from && !rule.from.includes(fromLabel)) {
+        return `${edge.type} cannot originate from ${fromLabel} locally (allowed: ${rule.from.join(", ")})`;
+      }
+      if (toLabel && rule.to && !rule.to.includes(toLabel)) {
+        return `${edge.type} cannot target ${toLabel} locally (allowed: ${rule.to.join(", ")})`;
+      }
+      return null;
+    }
+    const verdict = isValidEdge(fromLabel, edge.type, toLabel);
+    return verdict.ok ? null : verdict.reason ?? "edge rule violation";
+  }
   updateEdge(id, patch) {
     this.stmts.updateEdge.run({
       id,

package/errata.mjs

@@ -15656,6 +15656,144 @@ var init_project_symbol = __esm({
   }
 });
 
+// ../../packages/shared/src/lockfile.ts
+function npmPurl(name2, version2) {
+  return `pkg:npm/${name2}@${version2}`;
+}
+function component(name2, version2) {
+  return { purl: npmPurl(name2, version2), name: name2, version: version2, ecosystem: "npm" };
+}
+function parsePackageLockJson(jsonText) {
+  let doc;
+  try {
+    doc = JSON.parse(jsonText);
+  } catch {
+    return { components: [], dependencies: [] };
+  }
+  const packages = doc.packages ?? {};
+  const components = [];
+  const hoisted = /* @__PURE__ */ new Map();
+  const byPath = /* @__PURE__ */ new Map();
+  for (const [path2, meta3] of Object.entries(packages)) {
+    if (path2 === "" || meta3.link === true) continue;
+    const ix = path2.lastIndexOf("node_modules/");
+    if (ix === -1) continue;
+    const name2 = path2.slice(ix + "node_modules/".length);
+    const version2 = typeof meta3.version === "string" ? meta3.version : "";
+    if (!name2 || !version2) continue;
+    components.push(component(name2, version2));
+    byPath.set(path2, { name: name2, version: version2 });
+    const depth = path2.split("node_modules/").length;
+    const prev = hoisted.get(name2);
+    if (!prev || depth < prev.depth) hoisted.set(name2, { version: version2, depth });
+  }
+  const dependencies = [];
+  for (const [path2, meta3] of Object.entries(packages)) {
+    const self = byPath.get(path2);
+    if (!self) continue;
+    const deps = meta3.dependencies;
+    if (!deps || typeof deps !== "object") continue;
+    const dependsOn = [];
+    for (const depName of Object.keys(deps)) {
+      const target = hoisted.get(depName);
+      if (target) dependsOn.push(npmPurl(depName, target.version));
+    }
+    if (dependsOn.length > 0)
+      dependencies.push({ ref: npmPurl(self.name, self.version), dependsOn });
+  }
+  return { components, dependencies: dedupeRefs(dependencies) };
+}
+function splitPnpmKey(raw2) {
+  let k = raw2.trim().replace(/^['"]|['"]$/g, "");
+  if (k.startsWith("/")) k = k.slice(1);
+  const paren = k.indexOf("(");
+  if (paren !== -1) k = k.slice(0, paren);
+  if (k.startsWith("link:") || k.startsWith("file:") || k.includes("://")) return null;
+  const at = k.lastIndexOf("@");
+  if (at <= 0) return null;
+  const name2 = k.slice(0, at);
+  const version2 = k.slice(at + 1);
+  if (!name2 || !version2) return null;
+  return { name: name2, version: version2 };
+}
+function parsePnpmLock(text) {
+  const lines = text.split(/\r?\n/);
+  const components = [];
+  const seen = /* @__PURE__ */ new Set();
+  const dependencies = [];
+  let section = null;
+  let currentPkg = null;
+  let inDepsBlock = false;
+  let currentDeps = [];
+  const flushDeps = () => {
+    if (currentPkg && currentDeps.length > 0) {
+      dependencies.push({
+        ref: npmPurl(currentPkg.name, currentPkg.version),
+        dependsOn: currentDeps.slice()
+      });
+    }
+    currentDeps = [];
+  };
+  for (const line of lines) {
+    if (!line.trim() || line.trimStart().startsWith("#")) continue;
+    const indent = line.length - line.trimStart().length;
+    if (indent === 0) {
+      flushDeps();
+      currentPkg = null;
+      inDepsBlock = false;
+      section = line === "packages:" ? "packages" : line === "snapshots:" ? "snapshots" : null;
+      continue;
+    }
+    if (!section) continue;
+    if (indent === 2 && line.trimEnd().endsWith(":")) {
+      flushDeps();
+      inDepsBlock = false;
+      const key = line.trim().slice(0, -1);
+      currentPkg = splitPnpmKey(key);
+      if (currentPkg && section === "packages") {
+        const purl = npmPurl(currentPkg.name, currentPkg.version);
+        if (!seen.has(purl)) {
+          seen.add(purl);
+          components.push(component(currentPkg.name, currentPkg.version));
+        }
+      }
+      continue;
+    }
+    if (!currentPkg) continue;
+    if (indent === 4) {
+      inDepsBlock = line.trim() === "dependencies:";
+      continue;
+    }
+    if (inDepsBlock && indent === 6) {
+      const t = line.trim();
+      const at = t.indexOf(": ");
+      if (at === -1) continue;
+      const depName = t.slice(0, at).replace(/^['"]|['"]$/g, "");
+      let depVersion = t.slice(at + 2).trim().replace(/^['"]|['"]$/g, "");
+      const paren = depVersion.indexOf("(");
+      if (paren !== -1) depVersion = depVersion.slice(0, paren);
+      if (depName && depVersion && !depVersion.startsWith("link:"))
+        currentDeps.push(npmPurl(depName, depVersion));
+    }
+  }
+  flushDeps();
+  return { components, dependencies: dedupeRefs(dependencies) };
+}
+function dedupeRefs(deps) {
+  const byRef = /* @__PURE__ */ new Map();
+  for (const d of deps) {
+    const set2 = byRef.get(d.ref) ?? /* @__PURE__ */ new Set();
+    for (const t of d.dependsOn) set2.add(t);
+    byRef.set(d.ref, set2);
+  }
+  return [...byRef.entries()].map(([ref, set2]) => ({ ref, dependsOn: [...set2] }));
+}
+var init_lockfile = __esm({
+  "../../packages/shared/src/lockfile.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/shared/src/nlp/canonicalize.ts
 function canonicalize(value) {
   return value.normalize("NFC").trim().toLowerCase().replace(/\s+/g, " ");
@@ -15774,9 +15912,12 @@ __export(src_exports, {
   normalizePredicate: () => normalizePredicate,
   normalizeRepoLocator: () => normalizeRepoLocator,
   normalizeSymbolPath: () => normalizeSymbolPath,
+  npmPurl: () => npmPurl,
   packageCanonicalId: () => packageCanonicalId,
   pagerankEdgeTypes: () => pagerankEdgeTypes,
+  parsePackageLockJson: () => parsePackageLockJson,
   parsePackageRef: () => parsePackageRef,
+  parsePnpmLock: () => parsePnpmLock,
   prefilterEntities: () => prefilterEntities,
   problemIdFromError: () => problemIdFromError,
   projectSymbolId: () => projectSymbolId,
@@ -15785,6 +15926,7 @@ __export(src_exports, {
   resolveCanonicalId: () => resolveCanonicalId,
   sha256: () => sha256,
   sha256Short: () => sha256Short,
+  splitPnpmKey: () => splitPnpmKey,
   substituteSymbolSummaries: () => substituteSymbolSummaries,
   summarizeIngestResult: () => summarizeIngestResult,
   summaryRejectionReason: () => summaryRejectionReason,
@@ -15802,6 +15944,7 @@ var init_src = __esm({
     init_symbol_intent();
     init_repo_locator();
     init_project_symbol();
+    init_lockfile();
     init_hash();
     init_error_signature();
     init_canonicalize();
@@ -16188,11 +16331,20 @@ function rowToEdge(r) {
 function openGraphStore(opts) {
   return new SqliteGraphStore(opts);
 }
-var SCHEMA_VERSION, SCHEMA_SQL, TEMPORAL_INDEX_SQL, SqliteGraphStore;
+var LOCAL_RULE_OVERRIDES, SCHEMA_VERSION, SCHEMA_SQL, TEMPORAL_INDEX_SQL, SqliteGraphStore;
 var init_store = __esm({
   "../../packages/local-graph/src/store.ts"() {
     "use strict";
     init_src2();
+    init_src();
+    LOCAL_RULE_OVERRIDES = {
+      ANCHORED_AT: {
+        from: EDGE_RULES["ANCHORED_AT"]?.from,
+        to: [...CODE_NODE_LABELS, "Symbol"]
+      },
+      REVEALED_BY: null,
+      PRODUCED: null
+    };
     SCHEMA_VERSION = 5;
     SCHEMA_SQL = `
 CREATE TABLE IF NOT EXISTS schema_version (
@@ -16285,6 +16437,10 @@ CREATE INDEX IF NOT EXISTS nodes_relpath ON nodes(json_extract(attrs_json, '$.re
        *  every node/edge upsert — code-index and capture alike — so the consolidation
        *  trigger can read "how much changed" without caring what changed it. */
       mutations = 0;
+      /** Edges refused by the local ontology gate (EDGE_RULES) since open — a
+       *  visible counter so a misbehaving extractor shows up in stats instead of
+       *  silently thinning the graph. */
+      rejectedEdgeCount = 0;
       /** Persistent monotonic ingest-sequence high-water (KN-decay-momentum). Loaded
        *  from store_meta on open, advanced once per knowledge ingest event via
        *  nextIngestSeq(). Distinct from `mutations` (in-memory, per-session, bumped by
@@ -16594,6 +16750,12 @@ CREATE INDEX IF NOT EXISTS nodes_relpath ON nodes(json_extract(attrs_json, '$.re
         this.stmts.setCommunity.run({ id, v: community });
       }
       mergeEdge(edge2) {
+        const violation = this.edgeRuleViolation(edge2);
+        if (violation) {
+          this.rejectedEdgeCount++;
+          console.warn(`[local-graph] rejected edge ${edge2.from}-[:${edge2.type}]->${edge2.to}: ${violation}`);
+          return;
+        }
         this.mutations++;
         this.stmts.insertEdge.run({
           id: edge2.id,
@@ -16611,6 +16773,27 @@ CREATE INDEX IF NOT EXISTS nodes_relpath ON nodes(json_extract(attrs_json, '$.re
           attrs_json: JSON.stringify(edge2.attrs ?? {})
         });
       }
+      /** EDGE_RULES check against the stored endpoints' labels, with the LOCAL
+       *  overlay consulted first. Returns the reason string on a documented-
+       *  forbidden combination, else null. Point lookups on the id PK — negligible
+       *  next to the insert itself. */
+      edgeRuleViolation(edge2) {
+        const fromLabel = this.getNode(edge2.from)?.label;
+        const toLabel = this.getNode(edge2.to)?.label;
+        if (edge2.type in LOCAL_RULE_OVERRIDES) {
+          const rule = LOCAL_RULE_OVERRIDES[edge2.type];
+          if (!rule) return null;
+          if (fromLabel && rule.from && !rule.from.includes(fromLabel)) {
+            return `${edge2.type} cannot originate from ${fromLabel} locally (allowed: ${rule.from.join(", ")})`;
+          }
+          if (toLabel && rule.to && !rule.to.includes(toLabel)) {
+            return `${edge2.type} cannot target ${toLabel} locally (allowed: ${rule.to.join(", ")})`;
+          }
+          return null;
+        }
+        const verdict = isValidEdge(fromLabel, edge2.type, toLabel);
+        return verdict.ok ? null : verdict.reason ?? "edge rule violation";
+      }
       updateEdge(id, patch) {
         this.stmts.updateEdge.run({
           id,
@@ -37675,6 +37858,17 @@ async function flushOutbox(paths, client, store) {
       if (res.accepted > 0) uploaded++;
       if (res.rejected > 0) {
         failed++;
+        const rejections = [
+          ...(res.result?.nodes ?? []).filter((n) => n.decision === "rejected"),
+          ...(res.result?.edges ?? []).filter((e) => e.decision === "rejected")
+        ];
+        for (const r of rejections.slice(0, 5)) {
+          const what = "type" in r ? `${r.from}-[:${r.type}]->${r.to}` : r.canonicalId ?? "node";
+          console.warn(`[errata] outbox: cloud rejected ${what}: ${r.reason ?? "no reason given"}`);
+        }
+        if (rejections.length > 5) {
+          console.warn(`[errata] outbox: \u2026and ${rejections.length - 5} more rejections in this batch`);
+        }
         quarantine(abs, `semantic rejection (${res.rejected} item${res.rejected === 1 ? "" : "s"})`);
         continue;
       }
@@ -43328,7 +43522,7 @@ function startLoopLagMonitor(thresholdMs = 1e3) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.0-dev.79" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.0-dev.82" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -44772,6 +44966,7 @@ async function syncPrinciples(store, cloud, opts) {
 init_reconcile();
 
 // src/lockfile-auto.ts
+init_src();
 import { existsSync as existsSync20, readFileSync as readFileSync18 } from "node:fs";
 import { join as join24 } from "node:path";
 
@@ -44898,137 +45093,7 @@ function buildContextIngest(store, profile, daemonVersion, ignorePatterns = [],
 }
 
 // src/lockfile-auto.ts
-function npmPurl(name2, version2) {
-  return `pkg:npm/${name2}@${version2}`;
-}
-function component(name2, version2) {
-  return { purl: npmPurl(name2, version2), name: name2, version: version2, ecosystem: "npm" };
-}
-function parsePackageLockJson(jsonText) {
-  let doc;
-  try {
-    doc = JSON.parse(jsonText);
-  } catch {
-    return { components: [], dependencies: [] };
-  }
-  const packages = doc.packages ?? {};
-  const components = [];
-  const hoisted = /* @__PURE__ */ new Map();
-  const byPath = /* @__PURE__ */ new Map();
-  for (const [path2, meta3] of Object.entries(packages)) {
-    if (path2 === "" || meta3.link === true) continue;
-    const ix = path2.lastIndexOf("node_modules/");
-    if (ix === -1) continue;
-    const name2 = path2.slice(ix + "node_modules/".length);
-    const version2 = typeof meta3.version === "string" ? meta3.version : "";
-    if (!name2 || !version2) continue;
-    components.push(component(name2, version2));
-    byPath.set(path2, { name: name2, version: version2 });
-    const depth = path2.split("node_modules/").length;
-    const prev = hoisted.get(name2);
-    if (!prev || depth < prev.depth) hoisted.set(name2, { version: version2, depth });
-  }
-  const dependencies = [];
-  for (const [path2, meta3] of Object.entries(packages)) {
-    const self = byPath.get(path2);
-    if (!self) continue;
-    const deps = meta3.dependencies;
-    if (!deps || typeof deps !== "object") continue;
-    const dependsOn = [];
-    for (const depName of Object.keys(deps)) {
-      const target = hoisted.get(depName);
-      if (target) dependsOn.push(npmPurl(depName, target.version));
-    }
-    if (dependsOn.length > 0)
-      dependencies.push({ ref: npmPurl(self.name, self.version), dependsOn });
-  }
-  return { components, dependencies: dedupeRefs(dependencies) };
-}
-function splitPnpmKey(raw2) {
-  let k = raw2.trim().replace(/^['"]|['"]$/g, "");
-  if (k.startsWith("/")) k = k.slice(1);
-  const paren = k.indexOf("(");
-  if (paren !== -1) k = k.slice(0, paren);
-  if (k.startsWith("link:") || k.startsWith("file:") || k.includes("://")) return null;
-  const at = k.lastIndexOf("@");
-  if (at <= 0) return null;
-  const name2 = k.slice(0, at);
-  const version2 = k.slice(at + 1);
-  if (!name2 || !version2) return null;
-  return { name: name2, version: version2 };
-}
-function parsePnpmLock(text) {
-  const lines = text.split(/\r?\n/);
-  const components = [];
-  const seen = /* @__PURE__ */ new Set();
-  const dependencies = [];
-  let section = null;
-  let currentPkg = null;
-  let inDepsBlock = false;
-  let currentDeps = [];
-  const flushDeps = () => {
-    if (currentPkg && currentDeps.length > 0) {
-      dependencies.push({
-        ref: npmPurl(currentPkg.name, currentPkg.version),
-        dependsOn: currentDeps.slice()
-      });
-    }
-    currentDeps = [];
-  };
-  for (const line of lines) {
-    if (!line.trim() || line.trimStart().startsWith("#")) continue;
-    const indent = line.length - line.trimStart().length;
-    if (indent === 0) {
-      flushDeps();
-      currentPkg = null;
-      inDepsBlock = false;
-      section = line === "packages:" ? "packages" : line === "snapshots:" ? "snapshots" : null;
-      continue;
-    }
-    if (!section) continue;
-    if (indent === 2 && line.trimEnd().endsWith(":")) {
-      flushDeps();
-      inDepsBlock = false;
-      const key = line.trim().slice(0, -1);
-      currentPkg = splitPnpmKey(key);
-      if (currentPkg && section === "packages") {
-        const purl = npmPurl(currentPkg.name, currentPkg.version);
-        if (!seen.has(purl)) {
-          seen.add(purl);
-          components.push(component(currentPkg.name, currentPkg.version));
-        }
-      }
-      continue;
-    }
-    if (!currentPkg) continue;
-    if (indent === 4) {
-      inDepsBlock = line.trim() === "dependencies:";
-      continue;
-    }
-    if (inDepsBlock && indent === 6) {
-      const t = line.trim();
-      const at = t.indexOf(": ");
-      if (at === -1) continue;
-      const depName = t.slice(0, at).replace(/^['"]|['"]$/g, "");
-      let depVersion = t.slice(at + 2).trim().replace(/^['"]|['"]$/g, "");
-      const paren = depVersion.indexOf("(");
-      if (paren !== -1) depVersion = depVersion.slice(0, paren);
-      if (depName && depVersion && !depVersion.startsWith("link:"))
-        currentDeps.push(npmPurl(depName, depVersion));
-    }
-  }
-  flushDeps();
-  return { components, dependencies: dedupeRefs(dependencies) };
-}
-function dedupeRefs(deps) {
-  const byRef = /* @__PURE__ */ new Map();
-  for (const d of deps) {
-    const set2 = byRef.get(d.ref) ?? /* @__PURE__ */ new Set();
-    for (const t of d.dependsOn) set2.add(t);
-    byRef.set(d.ref, set2);
-  }
-  return [...byRef.entries()].map(([ref, set2]) => ({ ref, dependsOn: [...set2] }));
-}
+init_src();
 function runLockfilePass(opts) {
   const ts = Date.now();
   const languages = mintLanguageNodes(opts.store, opts.languages, opts.workspaceId, ts);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.0-dev.79",
+  "version": "2.0.0-dev.82",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {

package/pass-worker.mjs

@@ -14965,9 +14965,90 @@ var init_zod = __esm({
 });
 
 // ../../packages/shared/src/edge-rules.ts
+function isValidEdge(from, type, to) {
+  const rule = EDGE_RULES[type];
+  if (!rule) return { ok: true };
+  if (from && rule.from && !rule.from.includes(from)) {
+    return {
+      ok: false,
+      reason: `${type} cannot originate from ${from} (allowed: ${rule.from.join(", ")})`
+    };
+  }
+  if (to && rule.to && !rule.to.includes(to)) {
+    return {
+      ok: false,
+      reason: `${type} cannot target ${to} (allowed: ${rule.to.join(", ")})`
+    };
+  }
+  return { ok: true };
+}
+var EDGE_RULES;
 var init_edge_rules = __esm({
   "../../packages/shared/src/edge-rules.ts"() {
     "use strict";
+    EDGE_RULES = {
+      // ── Project anchors (PJ-anchors · PLAN_PROJECT_STORE §6c) ──
+      // ANCHORED_AT is the ONE bridge edge admitted to the cloud, and it exists for
+      // exactly one purpose: point a piece of knowledge at an OPAQUE project `Symbol`
+      // so two teammates' observations about the same function converge on one node.
+      // Constrain it to that purpose — an unconstrained ANCHORED_AT (its state before
+      // this rule, since a missing entry means "anything goes") would let a batch
+      // anchor anything at anything, e.g. at a public `Package`, quietly re-creating
+      // the code↔collective bridge the membrane exists to prevent.
+      ANCHORED_AT: {
+        from: ["Problem", "Solution", "RootCause", "Claim"],
+        to: ["Symbol"]
+      },
+      // ── Security spine (v1 taxonomy.ts SECURITY_FORWARD_ONLY commentary) ──
+      TARGETS: { from: ["Exploit"], to: ["Vulnerability"] },
+      ENABLES: { from: ["AntiPattern"], to: ["Vulnerability"] },
+      MITIGATES: { from: ["Solution"], to: ["Vulnerability"] },
+      PRESENTS: { from: ["Solution"], to: ["Problem", "Vulnerability"] },
+      // SOLVED_BY sources: Vulnerability (v1 comment) + Problem/RootCause
+      // (upstream design-problem.ts + triage.ts mint both).
+      SOLVED_BY: { from: ["Vulnerability", "Problem", "RootCause"], to: ["Solution"] },
+      // FIXED_BY sources mirror SOLVED_BY's (same ailment→fix semantics; live-graph
+      // census 2026-07-14: 512 Problem + 13 RootCause sources, zero others besides
+      // 3 REVERSED Solution→Problem edges the missing `from` let through — the
+      // "Problem solved by Problem" splash bug. A reversed resolution edge is NOT
+      // mechanically flippable (half the sample were PoC-not-fix claims), so the
+      // door rejects rather than repairs; a correct re-emission lands via
+      // recognition-at-the-door.
+      FIXED_BY: { from: ["Vulnerability", "Problem", "RootCause"], to: ["Solution"] },
+      // ── Triage family (upstream castalia.ts: Problem —TRIAGED_BY→ Triage —{INDICATES|CONFIRMS}→ cause) ──
+      // Two-edge differential model (T3-rename): INDICATES = provisional candidate,
+      // CONFIRMS = promoted router (a discriminator exists). Same endpoint matrix.
+      // ROUTES_TO is the deprecated pre-split alias, kept readable during migration.
+      TRIAGED_BY: { from: ["Problem"], to: ["Triage"] },
+      CONFIRMS: { from: ["Triage"], to: ["RootCause", "Problem"] },
+      INDICATES: { from: ["Triage"], to: ["RootCause", "Problem"] },
+      ROUTES_TO: { from: ["Triage"], to: ["RootCause", "Problem"] },
+      // ── Context grounding (v1 taxonomy.ts comments) ──
+      WRITTEN_IN: { from: ["Component", "Package"], to: ["Language"] },
+      OCCURS_IN: { to: ["Language"] },
+      OCCURS_ON: { to: ["OperatingSystem"] },
+      RUNS_ON: { to: ["OperatingSystem"] },
+      OPERATES_ON: { from: ["Algorithm"], to: ["DataStructure"] },
+      INVOLVES: { from: ["Problem", "Solution"], to: ["DataStructure"] },
+      // ── Taxonomy (Track 4 Stream C: MITRE CWE `ChildOf` → `Weakness —IS_A→ Weakness`) ──
+      IS_A: { from: ["Weakness"], to: ["Weakness"] },
+      // ── Conceptual (v1 taxonomy.ts: instance → motif/pattern reference) ──
+      INSTANCE_OF: { to: ["Pattern", "Weakness", "Technique"] },
+      IMPLEMENTS: { from: ["Solution", "Language", "Component"], to: ["Pattern", "Technique"] },
+      MATCHES: { to: ["Pattern"] },
+      // ── Artifact evidence (v1 taxonomy.ts artifact rows) ──
+      PRODUCED: { from: ["Report"], to: ["Artifact"] },
+      MANIFESTED_IN: { from: ["Problem"], to: ["Artifact"] },
+      REVEALED_BY: { from: ["RootCause"], to: ["Artifact"] },
+      // ── Belief / abstraction gradients (upstream castalia.ts) ──
+      CORROBORATES: { from: ["Claim"], to: ["Claim"] },
+      GENERALIZES: { from: ["Claim"] },
+      DERIVED_FROM: { from: ["Claim"] },
+      // ── Decomposition (castalia.ts: a Problem fans out into independent root
+      // problems; §5.1 also attaches SPLIT_INTO to Claim when one conflates two).
+      // `to` left unconstrained — the replacement set's labels vary by case. ──
+      SPLIT_INTO: { from: ["Problem", "Claim"] }
+    };
   }
 });
 
@@ -15129,6 +15210,13 @@ var init_project_symbol = __esm({
   }
 });
 
+// ../../packages/shared/src/lockfile.ts
+var init_lockfile = __esm({
+  "../../packages/shared/src/lockfile.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/shared/src/nlp/canonicalize.ts
 var init_canonicalize = __esm({
   "../../packages/shared/src/nlp/canonicalize.ts"() {
@@ -15155,6 +15243,7 @@ var init_src = __esm({
     init_symbol_intent();
     init_repo_locator();
     init_project_symbol();
+    init_lockfile();
     init_hash();
     init_error_signature();
     init_canonicalize();
@@ -23930,6 +24019,15 @@ import { parentPort, workerData } from "node:worker_threads";
 
 // ../../packages/local-graph/src/store.ts
 init_src2();
+init_src();
+var LOCAL_RULE_OVERRIDES = {
+  ANCHORED_AT: {
+    from: EDGE_RULES["ANCHORED_AT"]?.from,
+    to: [...CODE_NODE_LABELS, "Symbol"]
+  },
+  REVEALED_BY: null,
+  PRODUCED: null
+};
 var SCHEMA_VERSION = 5;
 var SCHEMA_SQL = `
 CREATE TABLE IF NOT EXISTS schema_version (
@@ -24079,6 +24177,10 @@ var SqliteGraphStore = class {
    *  every node/edge upsert — code-index and capture alike — so the consolidation
    *  trigger can read "how much changed" without caring what changed it. */
   mutations = 0;
+  /** Edges refused by the local ontology gate (EDGE_RULES) since open — a
+   *  visible counter so a misbehaving extractor shows up in stats instead of
+   *  silently thinning the graph. */
+  rejectedEdgeCount = 0;
   /** Persistent monotonic ingest-sequence high-water (KN-decay-momentum). Loaded
    *  from store_meta on open, advanced once per knowledge ingest event via
    *  nextIngestSeq(). Distinct from `mutations` (in-memory, per-session, bumped by
@@ -24388,6 +24490,12 @@ var SqliteGraphStore = class {
     this.stmts.setCommunity.run({ id, v: community });
   }
   mergeEdge(edge) {
+    const violation = this.edgeRuleViolation(edge);
+    if (violation) {
+      this.rejectedEdgeCount++;
+      console.warn(`[local-graph] rejected edge ${edge.from}-[:${edge.type}]->${edge.to}: ${violation}`);
+      return;
+    }
     this.mutations++;
     this.stmts.insertEdge.run({
       id: edge.id,
@@ -24405,6 +24513,27 @@ var SqliteGraphStore = class {
       attrs_json: JSON.stringify(edge.attrs ?? {})
     });
   }
+  /** EDGE_RULES check against the stored endpoints' labels, with the LOCAL
+   *  overlay consulted first. Returns the reason string on a documented-
+   *  forbidden combination, else null. Point lookups on the id PK — negligible
+   *  next to the insert itself. */
+  edgeRuleViolation(edge) {
+    const fromLabel = this.getNode(edge.from)?.label;
+    const toLabel = this.getNode(edge.to)?.label;
+    if (edge.type in LOCAL_RULE_OVERRIDES) {
+      const rule = LOCAL_RULE_OVERRIDES[edge.type];
+      if (!rule) return null;
+      if (fromLabel && rule.from && !rule.from.includes(fromLabel)) {
+        return `${edge.type} cannot originate from ${fromLabel} locally (allowed: ${rule.from.join(", ")})`;
+      }
+      if (toLabel && rule.to && !rule.to.includes(toLabel)) {
+        return `${edge.type} cannot target ${toLabel} locally (allowed: ${rule.to.join(", ")})`;
+      }
+      return null;
+    }
+    const verdict = isValidEdge(fromLabel, edge.type, toLabel);
+    return verdict.ok ? null : verdict.reason ?? "edge rule violation";
+  }
   updateEdge(id, patch) {
     this.stmts.updateEdge.run({
       id,