@kevinrabun/judges 3.38.0 → 3.40.0

package/dist/commands/trace.js

@@ -0,0 +1,246 @@
+// ─── Trace Mode — Show Your Work ─────────────────────────────────────────────
+// Renders a detailed, human-readable trace of exactly how the evaluation
+// pipeline reached its decision for every finding. Each finding's journey
+// through the pipeline is shown: detection → FP filters → dedup → calibration
+// → confidence scoring → final disposition.
+//
+// All data is computed locally from the evaluation result — no external
+// services or data storage involved.
+//
+// Usage:
+//   judges eval src/app.ts --trace            # text trace to stdout
+//   judges eval src/app.ts --trace --format json   # structured trace
+// ──────────────────────────────────────────────────────────────────────────────
+// ─── Trace Builder ──────────────────────────────────────────────────────────
+/**
+ * Build an evaluation trace from a tribunal verdict.
+ *
+ * This reconstructs the pipeline journey from the data available on the
+ * verdict — it does not require runtime hooks in the evaluator. The trace
+ * is approximate but highly informative for understanding why findings
+ * were kept or dropped.
+ */
+export function buildEvaluationTrace(verdict, filePath, language) {
+    const judgeSummaries = verdict.evaluations.map((e) => ({
+        judgeId: e.judgeId,
+        judgeName: e.judgeName,
+        findingsProduced: e.findings.length,
+        durationMs: e.durationMs ?? 0,
+    }));
+    const rawFindingCount = verdict.evaluations.reduce((sum, e) => sum + e.findings.length, 0);
+    // Build per-finding traces from what we can infer
+    const findingTraces = [];
+    // Track what the final set contains
+    const finalRuleIds = new Set(verdict.findings.map((f) => `${f.ruleId}:${f.lineNumbers?.[0] ?? 0}`));
+    // Process each judge's findings
+    for (const evaluation of verdict.evaluations) {
+        for (const finding of evaluation.findings) {
+            const key = `${finding.ruleId}:${finding.lineNumbers?.[0] ?? 0}`;
+            const steps = [];
+            // Step 1: Detection
+            steps.push({
+                stage: "detection",
+                action: "kept",
+                reason: `Detected by ${evaluation.judgeName} (${evaluation.judgeId}) via ${finding.provenance ?? "pattern-match"}`,
+            });
+            // Step 2: Evidence basis
+            if (finding.evidenceBasis) {
+                steps.push({
+                    stage: "confidence-scoring",
+                    action: finding.confidence && finding.confidence >= 0.7 ? "boosted" : "kept",
+                    reason: `Evidence: ${finding.evidenceBasis}`,
+                });
+            }
+            // Step 3: Evidence chain
+            if (finding.evidenceChain) {
+                const chainDesc = finding.evidenceChain.steps
+                    .map((s) => `${s.source}${s.line ? ` L${s.line}` : ""}: ${s.observation}`)
+                    .join(" → ");
+                steps.push({
+                    stage: "evidence-chain",
+                    action: "kept",
+                    reason: chainDesc,
+                });
+            }
+            // Step 4: Absence gating
+            if (finding.isAbsenceBased) {
+                steps.push({
+                    stage: "absence-gating",
+                    action: "demoted",
+                    reason: "Absence-based finding — severity capped at medium, confidence capped at 0.6",
+                });
+            }
+            // Step 5: Confidence tier
+            if (finding.confidenceTier) {
+                steps.push({
+                    stage: "confidence-tiering",
+                    action: "kept",
+                    reason: `Classified as "${finding.confidenceTier}" (confidence: ${((finding.confidence ?? 0.5) * 100).toFixed(0)}%)`,
+                });
+            }
+            // Step 6: Check if it survived to final output
+            const inFinal = finalRuleIds.has(key);
+            if (!inFinal) {
+                // Determine likely suppression reason
+                if (finding.isAbsenceBased) {
+                    steps.push({
+                        stage: "pipeline-filter",
+                        action: "suppressed",
+                        reason: "Suppressed: absence-based finding in single-file mode",
+                    });
+                }
+                else {
+                    steps.push({
+                        stage: "pipeline-filter",
+                        action: "suppressed",
+                        reason: "Suppressed: likely removed by FP heuristics, dedup, or config filter",
+                    });
+                }
+            }
+            // Step 7: OWASP LLM mapping
+            if (finding.owaspLlmTop10) {
+                steps.push({
+                    stage: "ai-risk-mapping",
+                    action: "kept",
+                    reason: `Mapped to ${finding.owaspLlmTop10}`,
+                });
+            }
+            // Step 8: Patch availability
+            if (finding.patch) {
+                steps.push({
+                    stage: "auto-fix",
+                    action: "added",
+                    reason: `Auto-fix available: L${finding.patch.startLine}-${finding.patch.endLine}`,
+                });
+            }
+            const confidenceJourney = finding.evidenceBasis
+                ? {
+                    initial: 0.5,
+                    final: finding.confidence ?? 0.5,
+                    adjustments: finding.evidenceBasis.split(", "),
+                }
+                : undefined;
+            findingTraces.push({
+                ruleId: finding.ruleId,
+                title: finding.title,
+                severity: finding.severity,
+                disposition: inFinal ? "reported" : "suppressed",
+                steps,
+                confidenceJourney,
+            });
+        }
+    }
+    // Add traces for suppressed findings (from inline suppression audit trail)
+    if (verdict.suppressions) {
+        for (const s of verdict.suppressions) {
+            findingTraces.push({
+                ruleId: s.ruleId,
+                title: s.title,
+                severity: s.severity,
+                disposition: "suppressed",
+                steps: [
+                    { stage: "detection", action: "kept", reason: "Detected by pattern match" },
+                    {
+                        stage: "inline-suppression",
+                        action: "suppressed",
+                        reason: `Suppressed by ${s.kind} comment at L${s.commentLine}${s.reason ? `: ${s.reason}` : ""}`,
+                    },
+                ],
+            });
+        }
+    }
+    // Compute suppression summary by stage
+    const suppressionMap = new Map();
+    for (const trace of findingTraces) {
+        if (trace.disposition === "suppressed") {
+            const lastStep = trace.steps[trace.steps.length - 1];
+            const stage = lastStep?.stage ?? "unknown";
+            suppressionMap.set(stage, (suppressionMap.get(stage) ?? 0) + 1);
+        }
+    }
+    const suppressionSummary = [...suppressionMap.entries()]
+        .map(([stage, count]) => ({ stage, count }))
+        .sort((a, b) => b.count - a.count);
+    return {
+        filePath,
+        language: language ?? "unknown",
+        judgesRun: verdict.evaluations.length,
+        rawFindingCount,
+        finalFindingCount: verdict.findings.length,
+        suppressionSummary,
+        findings: findingTraces,
+        judgeSummaries,
+    };
+}
+// ─── Text Formatter ─────────────────────────────────────────────────────────
+/**
+ * Format an evaluation trace as human-readable text output.
+ */
+export function formatTraceText(trace) {
+    const lines = [];
+    lines.push("");
+    lines.push("╔══════════════════════════════════════════════════════════════╗");
+    lines.push("║           Judges Panel — Evaluation Trace                    ║");
+    lines.push("╚══════════════════════════════════════════════════════════════╝");
+    lines.push("");
+    if (trace.filePath)
+        lines.push(`  File      : ${trace.filePath}`);
+    lines.push(`  Language  : ${trace.language}`);
+    lines.push(`  Judges    : ${trace.judgesRun}`);
+    lines.push(`  Raw       : ${trace.rawFindingCount} findings detected`);
+    lines.push(`  Final     : ${trace.finalFindingCount} findings reported`);
+    lines.push(`  Filtered  : ${trace.rawFindingCount - trace.finalFindingCount} findings suppressed`);
+    lines.push("");
+    // Judge timing breakdown
+    lines.push("  ─── Judge Execution ────────────────────────────────────────");
+    lines.push("");
+    for (const j of trace.judgeSummaries) {
+        const icon = j.findingsProduced > 0 ? "🔍" : "✅";
+        lines.push(`  ${icon} ${j.judgeName.padEnd(35)} ${j.findingsProduced} finding(s)  ${j.durationMs}ms`);
+    }
+    lines.push("");
+    // Suppression summary
+    if (trace.suppressionSummary.length > 0) {
+        lines.push("  ─── Suppression Summary ────────────────────────────────────");
+        lines.push("");
+        for (const s of trace.suppressionSummary) {
+            lines.push(`  ⊘ ${s.stage.padEnd(30)} ${s.count} finding(s) removed`);
+        }
+        lines.push("");
+    }
+    // Per-finding traces
+    lines.push("  ─── Finding Decision Traces ────────────────────────────────");
+    lines.push("");
+    for (const f of trace.findings) {
+        const icon = f.disposition === "reported" ? "📋" : f.disposition === "merged" ? "🔀" : "⊘";
+        lines.push(`  ${icon} [${f.severity.toUpperCase().padEnd(8)}] ${f.ruleId}: ${f.title}`);
+        lines.push(`    Disposition: ${f.disposition.toUpperCase()}`);
+        for (const step of f.steps) {
+            const actionIcon = step.action === "kept"
+                ? "  →"
+                : step.action === "suppressed"
+                    ? "  ✗"
+                    : step.action === "demoted"
+                        ? "  ↓"
+                        : step.action === "boosted"
+                            ? "  ↑"
+                            : step.action === "merged"
+                                ? "  ⊕"
+                                : step.action === "added"
+                                    ? "  +"
+                                    : step.action === "capped"
+                                        ? "  ⌐"
+                                        : "  ?";
+            lines.push(`  ${actionIcon} [${step.stage}] ${step.reason}`);
+        }
+        if (f.confidenceJourney) {
+            lines.push(`    Confidence: ${(f.confidenceJourney.initial * 100).toFixed(0)}% → ${(f.confidenceJourney.final * 100).toFixed(0)}%`);
+            for (const adj of f.confidenceJourney.adjustments) {
+                lines.push(`      ${adj.trim()}`);
+            }
+        }
+        lines.push("");
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=trace.js.map

package/dist/commands/trace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace.js","sourceRoot":"","sources":["../../src/commands/trace.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,yEAAyE;AACzE,0EAA0E;AAC1E,8EAA8E;AAC9E,4CAA4C;AAC5C,EAAE;AACF,wEAAwE;AACxE,qCAAqC;AACrC,EAAE;AACF,SAAS;AACT,qEAAqE;AACrE,sEAAsE;AACtE,iFAAiF;AA+CjF,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAwB,EAAE,QAAiB,EAAE,QAAiB;IACjG,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAkB,EAAE,EAAE,CAAC,CAAC;QACtE,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM;QACnC,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC;KAC9B,CAAC,CAAC,CAAC;IAEJ,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,GAAW,EAAE,CAAkB,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAEpH,kDAAkD;IAClD,MAAM,aAAa,GAAmB,EAAE,CAAC;IAEzC,oCAAoC;IACpC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAE7G,gCAAgC;IAChC,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QAC7C,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,MAAM,KAAK,GAAgB,EAAE,CAAC;YAE9B,oBAAoB;YACpB,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK,EAAE,WAAW;gBAClB,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,eAAe,UAAU,CAAC,SAAS,KAAK,UAAU,CAAC,OAAO,SAAS,OAAO,CAAC,UAAU,IAAI,eAAe,EAAE;aACnH,CAAC,CAAC;YAEH,yBAAyB;YACzB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,oBAAoB;oBAC3B,MAAM,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;oBAC5E,MAAM,EAAE,aAAa,OAAO,CAAC,aAAa,EAAE;iBAC7C,CAAC,CAAC;YACL,CAAC;YAED,yBAAyB;YACzB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC1B,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,KAAK;qBAC1C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;qBACzE,IAAI,CAAC,KAAK,CAAC,CAAC;gBACf,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,gBAAgB;oBACvB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,SAAS;iBAClB,CAAC,CAAC;YACL,CAAC;YAED,yBAAyB;YACzB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,gBAAgB;oBACvB,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,6EAA6E;iBACtF,CAAC,CAAC;YACL,CAAC;YAED,0BAA0B;YAC1B,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,oBAAoB;oBAC3B,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,kBAAkB,OAAO,CAAC,cAAc,kBAAkB,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;iBACrH,CAAC,CAAC;YACL,CAAC;YAED,+CAA+C;YAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,sCAAsC;gBACtC,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;oBAC3B,KAAK,CAAC,IAAI,CAAC;wBACT,KAAK,EAAE,iBAAiB;wBACxB,MAAM,EAAE,YAAY;wBACpB,MAAM,EAAE,uDAAuD;qBAChE,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,IAAI,CAAC;wBACT,KAAK,EAAE,iBAAiB;wBACxB,MAAM,EAAE,YAAY;wBACpB,MAAM,EAAE,sEAAsE;qBAC/E,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,4BAA4B;YAC5B,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,iBAAiB;oBACxB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,aAAa,OAAO,CAAC,aAAa,EAAE;iBAC7C,CAAC,CAAC;YACL,CAAC;YAED,6BAA6B;YAC7B,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,UAAU;oBACjB,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,wBAAwB,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE;iBACnF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,aAAa;gBAC7C,CAAC,CAAC;oBACE,OAAO,EAAE,GAAG;oBACZ,KAAK,EAAE,OAAO,CAAC,UAAU,IAAI,GAAG;oBAChC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;iBAC/C;gBACH,CAAC,CAAC,SAAS,CAAC;YAEd,aAAa,CAAC,IAAI,CAAC;gBACjB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY;gBAChD,KAAK;gBACL,iBAAiB;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACrC,aAAa,CAAC,IAAI,CAAC;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,WAAW,EAAE,YAAY;gBACzB,KAAK,EAAE;oBACL,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,2BAA2B,EAAE;oBAC3E;wBACE,KAAK,EAAE,oBAAoB;wBAC3B,MAAM,EAAE,YAAY;wBACpB,MAAM,EAAE,iBAAiB,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;qBACjG;iBACF;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,IAAI,SAAS,CAAC;YAC3C,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,MAAM,kBAAkB,GAAG,CAAC,GAAG,cAAc,CAAC,OAAO,EAAE,CAAC;SACrD,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;SAC3C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAErC,OAAO;QACL,QAAQ;QACR,QAAQ,EAAE,QAAQ,IAAI,SAAS;QAC/B,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,MAAM;QACrC,eAAe;QACf,iBAAiB,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;QAC1C,kBAAkB;QAClB,QAAQ,EAAE,aAAa;QACvB,cAAc;KACf,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,KAAsB;IACpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAC/E,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAC/E,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAC/E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,KAAK,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,eAAe,oBAAoB,CAAC,CAAC;IACvE,KAAK,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,iBAAiB,oBAAoB,CAAC,CAAC;IACzE,KAAK,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC,iBAAiB,sBAAsB,CAAC,CAAC;IACnG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,yBAAyB;IACzB,KAAK,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;IAC7E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,gBAAgB,gBAAgB,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;IACxG,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,sBAAsB;IACtB,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QAC7E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,qBAAqB,CAAC,CAAC;QACxE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,qBAAqB;IACrB,KAAK,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;IAC7E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3F,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACxF,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAE9D,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YAC3B,MAAM,UAAU,GACd,IAAI,CAAC,MAAM,KAAK,MAAM;gBACpB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,YAAY;oBAC5B,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS;wBACzB,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS;4BACzB,CAAC,CAAC,KAAK;4BACP,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ;gCACxB,CAAC,CAAC,KAAK;gCACP,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO;oCACvB,CAAC,CAAC,KAAK;oCACP,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ;wCACxB,CAAC,CAAC,KAAK;wCACP,CAAC,CAAC,KAAK,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,KAAK,UAAU,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,CAAC,iBAAiB,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CACR,mBAAmB,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACxH,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,iBAAiB,CAAC,WAAW,EAAE,CAAC;gBAClD,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/commands/trust-ramp.d.ts

@@ -0,0 +1,30 @@
+/**
+ * `judges trust-ramp` — Generate a graduated trust configuration.
+ *
+ * Produces a phased .judgesrc progression that starts with advisory-only
+ * (no CI gating) and ramps up to full enforcement over 30/60/90 days.
+ * All data stays local — phases are encoded as config files you commit.
+ *
+ * Phases:
+ *   1. Advisory    (days 0-30)  — high+critical only, no fail, baseline created
+ *   2. Selective   (days 30-60) — medium+, fail on critical, auto-fix enabled
+ *   3. Enforcing   (days 60-90) — all severities, fail on findings, score gate
+ *   4. Full trust  (day 90+)    — strict preset, full gating, baseline removed
+ */
+import type { JudgesConfig } from "../types.js";
+export interface TrustPhase {
+    /** Phase number (1-4) */
+    phase: number;
+    /** Human-readable name */
+    name: string;
+    /** Day range description */
+    days: string;
+    /** What this phase enables */
+    description: string;
+    /** The generated .judgesrc config */
+    config: JudgesConfig;
+    /** CI workflow snippet (optional) */
+    ciTip: string;
+}
+export declare function runTrustRamp(argv: string[]): void;
+//# sourceMappingURL=trust-ramp.d.ts.map

package/dist/commands/trust-ramp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-ramp.d.ts","sourceRoot":"","sources":["../../src/commands/trust-ramp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAY,MAAM,aAAa,CAAC;AAI1D,MAAM,WAAW,UAAU;IACzB,yBAAyB;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,qCAAqC;IACrC,MAAM,EAAE,YAAY,CAAC;IACrB,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;CACf;AA2HD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CA+BjD"}

package/dist/commands/trust-ramp.js

@@ -0,0 +1,190 @@
+/**
+ * `judges trust-ramp` — Generate a graduated trust configuration.
+ *
+ * Produces a phased .judgesrc progression that starts with advisory-only
+ * (no CI gating) and ramps up to full enforcement over 30/60/90 days.
+ * All data stays local — phases are encoded as config files you commit.
+ *
+ * Phases:
+ *   1. Advisory    (days 0-30)  — high+critical only, no fail, baseline created
+ *   2. Selective   (days 30-60) — medium+, fail on critical, auto-fix enabled
+ *   3. Enforcing   (days 60-90) — all severities, fail on findings, score gate
+ *   4. Full trust  (day 90+)    — strict preset, full gating, baseline removed
+ */
+import { writeFileSync } from "fs";
+import { join, resolve } from "path";
+function buildPhases(basePreset) {
+    return [
+        {
+            phase: 1,
+            name: "Advisory",
+            days: "Days 0–30",
+            description: "Report only critical and high severity findings. No CI gating. " +
+                "Creates a baseline of existing issues so new introductions are visible.",
+            config: {
+                ...(basePreset ? { preset: basePreset } : {}),
+                minSeverity: "high",
+                failOnFindings: false,
+            },
+            ciTip: "# Phase 1: advisory only — do NOT add --fail-on-findings to CI",
+        },
+        {
+            phase: 2,
+            name: "Selective Enforcement",
+            days: "Days 30–60",
+            description: "Lower threshold to medium severity. Gate CI on critical findings only " +
+                "via failOnScoreBelow. Auto-fix suggestions become available.",
+            config: {
+                ...(basePreset ? { preset: basePreset } : {}),
+                minSeverity: "medium",
+                failOnFindings: false,
+                failOnScoreBelow: 3,
+            },
+            ciTip: "# Phase 2: gate on score — blocks PRs scoring below 3/10",
+        },
+        {
+            phase: 3,
+            name: "Enforcing",
+            days: "Days 60–90",
+            description: "Report all severities. Fail on any findings. Score gate raised to 6. " +
+                "Team should be comfortable with judges output by now.",
+            config: {
+                ...(basePreset ? { preset: basePreset } : {}),
+                minSeverity: "low",
+                failOnFindings: true,
+                failOnScoreBelow: 6,
+            },
+            ciTip: "# Phase 3: enforcing — PR merges blocked on findings or low score",
+        },
+        {
+            phase: 4,
+            name: "Full Trust",
+            days: "Day 90+",
+            description: "Strict mode with all judges and all severities. Full gating enabled. " +
+                "Remove the baseline file — all findings are real.",
+            config: {
+                preset: "strict",
+                failOnFindings: true,
+                failOnScoreBelow: 7,
+            },
+            ciTip: "# Phase 4: full trust — judges is your primary reviewer",
+        },
+    ];
+}
+// ─── Output Formats ─────────────────────────────────────────────────────────
+function formatPhasesText(phases) {
+    const lines = [
+        "╔══════════════════════════════════════════════════════════════╗",
+        "║            Judges — Graduated Trust Ramp Plan               ║",
+        "╚══════════════════════════════════════════════════════════════╝",
+        "",
+    ];
+    for (const p of phases) {
+        lines.push(`── Phase ${p.phase}: ${p.name} (${p.days}) ${"─".repeat(Math.max(0, 40 - p.name.length - p.days.length))}`);
+        lines.push(`   ${p.description}`);
+        lines.push("");
+        lines.push("   .judgesrc:");
+        lines.push(`   ${JSON.stringify(p.config, null, 2).replace(/\n/g, "\n   ")}`);
+        lines.push("");
+        lines.push(`   ${p.ciTip}`);
+        lines.push("");
+    }
+    lines.push("── Getting Started ──────────────────────────────────────────");
+    lines.push("   1. Run: judges trust-ramp --emit phase-1");
+    lines.push("   2. Commit the generated .judgesrc to your repo");
+    lines.push("   3. When ready to advance, run: judges trust-ramp --emit phase-2");
+    lines.push("   4. Repeat until full trust is achieved");
+    lines.push("");
+    return lines.join("\n");
+}
+function formatPhasesJson(phases) {
+    return JSON.stringify(phases.map((p) => ({
+        phase: p.phase,
+        name: p.name,
+        days: p.days,
+        description: p.description,
+        config: p.config,
+    })), null, 2);
+}
+// ─── Emit a Phase Config ─────────────────────────────────────────────────
+function emitPhaseConfig(phase, targetDir) {
+    const configPath = join(targetDir, ".judgesrc");
+    const content = JSON.stringify(phase.config, null, 2);
+    writeFileSync(configPath, content + "\n", "utf-8");
+    return configPath;
+}
+// ─── CLI Entry ──────────────────────────────────────────────────────────────
+export function runTrustRamp(argv) {
+    const args = parseArgs(argv);
+    const phases = buildPhases(args.preset);
+    if (args.emit) {
+        const match = /^phase-?(\d)$/i.exec(args.emit);
+        if (!match) {
+            console.error(`Error: --emit expects "phase-1" through "phase-4", got "${args.emit}"`);
+            process.exit(1);
+        }
+        const num = parseInt(match[1], 10);
+        const phase = phases.find((p) => p.phase === num);
+        if (!phase) {
+            console.error(`Error: no phase ${num}. Valid: 1-4`);
+            process.exit(1);
+        }
+        const dir = resolve(args.dir || ".");
+        const path = emitPhaseConfig(phase, dir);
+        console.log(`✔ Phase ${num} (${phase.name}) config written to ${path}`);
+        console.log(`  ${phase.ciTip}`);
+        return;
+    }
+    // Default: show the plan
+    if (args.format === "json") {
+        console.log(formatPhasesJson(phases));
+    }
+    else {
+        console.log(formatPhasesText(phases));
+    }
+}
+function parseArgs(argv) {
+    const result = { format: "text" };
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === "--emit" && argv[i + 1]) {
+            result.emit = argv[++i];
+        }
+        else if (arg === "--preset" && argv[i + 1]) {
+            result.preset = argv[++i];
+        }
+        else if (arg === "--format" && argv[i + 1]) {
+            const fmt = argv[++i];
+            if (fmt === "json" || fmt === "text")
+                result.format = fmt;
+        }
+        else if (arg === "--dir" && argv[i + 1]) {
+            result.dir = argv[++i];
+        }
+        else if (arg === "--help" || arg === "-h") {
+            printHelp();
+            process.exit(0);
+        }
+    }
+    return result;
+}
+function printHelp() {
+    console.log(`
+judges trust-ramp — Generate a graduated trust configuration
+
+Usage:
+  judges trust-ramp                        Show the 4-phase ramp plan
+  judges trust-ramp --format json          Output plan as JSON
+  judges trust-ramp --emit phase-1         Write Phase 1 .judgesrc to cwd
+  judges trust-ramp --emit phase-2 --dir . Write Phase 2 .judgesrc to dir
+  judges trust-ramp --preset security-only Base phases on a preset
+
+Options:
+  --emit <phase>     Emit a phase config: phase-1, phase-2, phase-3, phase-4
+  --preset <name>    Base the ramp on a named preset (e.g. security-only)
+  --format <fmt>     Output format: text (default), json
+  --dir <path>       Target directory for --emit (default: cwd)
+  -h, --help         Show this help
+`);
+}
+//# sourceMappingURL=trust-ramp.js.map

package/dist/commands/trust-ramp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-ramp.js","sourceRoot":"","sources":["../../src/commands/trust-ramp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAoBrC,SAAS,WAAW,CAAC,UAAmB;IACtC,OAAO;QACL;YACE,KAAK,EAAE,CAAC;YACR,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,WAAW;YACjB,WAAW,EACT,iEAAiE;gBACjE,yEAAyE;YAC3E,MAAM,EAAE;gBACN,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,WAAW,EAAE,MAAkB;gBAC/B,cAAc,EAAE,KAAK;aACtB;YACD,KAAK,EAAE,gEAAgE;SACxE;QACD;YACE,KAAK,EAAE,CAAC;YACR,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,YAAY;YAClB,WAAW,EACT,wEAAwE;gBACxE,8DAA8D;YAChE,MAAM,EAAE;gBACN,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,WAAW,EAAE,QAAoB;gBACjC,cAAc,EAAE,KAAK;gBACrB,gBAAgB,EAAE,CAAC;aACpB;YACD,KAAK,EAAE,0DAA0D;SAClE;QACD;YACE,KAAK,EAAE,CAAC;YACR,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,YAAY;YAClB,WAAW,EACT,uEAAuE;gBACvE,uDAAuD;YACzD,MAAM,EAAE;gBACN,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,WAAW,EAAE,KAAiB;gBAC9B,cAAc,EAAE,IAAI;gBACpB,gBAAgB,EAAE,CAAC;aACpB;YACD,KAAK,EAAE,mEAAmE;SAC3E;QACD;YACE,KAAK,EAAE,CAAC;YACR,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,SAAS;YACf,WAAW,EACT,uEAAuE;gBACvE,mDAAmD;YACrD,MAAM,EAAE;gBACN,MAAM,EAAE,QAAQ;gBAChB,cAAc,EAAE,IAAI;gBACpB,gBAAgB,EAAE,CAAC;aACpB;YACD,KAAK,EAAE,yDAAyD;SACjE;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,gBAAgB,CAAC,MAAoB;IAC5C,MAAM,KAAK,GAAa;QACtB,kEAAkE;QAClE,iEAAiE;QACjE,kEAAkE;QAClE,EAAE;KACH,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,YAAY,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAC5G,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IAC5E,KAAK,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IAChE,KAAK,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;IACjF,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACxD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAoB;IAC5C,OAAO,IAAI,CAAC,SAAS,CACnB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;KACjB,CAAC,CAAC,EACH,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAE5E,SAAS,eAAe,CAAC,KAAiB,EAAE,SAAiB;IAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACtD,aAAa,CAAC,UAAU,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE7B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAExC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,2DAA2D,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;YACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,mBAAmB,GAAG,cAAc,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,KAAK,KAAK,CAAC,IAAI,uBAAuB,IAAI,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,yBAAyB;IACzB,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAWD,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,MAAM,GAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAEjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,GAAG,KAAK,UAAU,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5B,CAAC;aAAM,IAAI,GAAG,KAAK,UAAU,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACtB,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM;gBAAE,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC;QAC5D,CAAC;aAAM,IAAI,GAAG,KAAK,OAAO,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC5C,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;CAgBb,CAAC,CAAC;AACH,CAAC"}

package/dist/config.d.ts

@@ -18,6 +18,11 @@ export declare function discoverCascadingConfigs(startDir: string, rootDir?: str
  * concatenated (union). Scalars (minSeverity, maxFiles, preset, failOnFindings,
  * baseline, format) use the leaf value.
  * ruleOverrides are deep-merged.
+ *
+ * Org-level policy enforcement:
+ * - `lockedRules`: locked rules cannot be added to `disabledRules`
+ * - `lockedJudges`: locked judges cannot be added to `disabledJudges`
+ * - `lockedMinSeverity`: child configs cannot set a more lenient minSeverity
  */
 export declare function mergeConfigs(...configs: JudgesConfig[]): JudgesConfig;
 /**

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAY,eAAe,EAAE,MAAM,YAAY,CAAC;AAS1E;;GAEG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAkQzD;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,YAAY,CAE5C;AAOD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,YAAY,EAAE,CAkC3F;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,OAAO,EAAE,YAAY,EAAE,GAAG,YAAY,CAkDrE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,GAAG,CAAC,MAAM,CAAa,GAC5B,YAAY,CAiCd;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,YAAY,CAIpF;AAID;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,eAAe,CAY3E;AAWD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,gBAAgB,CACpC,gBAAgB,EAAE,MAAM,EAAE,EAC1B,OAAO,CAAC,EAAE,MAAM,EAChB,QAAQ,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAoB,GAC9C,OAAO,CAAC,eAAe,EAAE,CAAC,CAyD5B;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAgBvE;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,CAwB1F;AAsCD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,CASzF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAY,eAAe,EAAE,MAAM,YAAY,CAAC;AAe1E;;GAEG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CA0RzD;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,YAAY,CAE5C;AAOD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,YAAY,EAAE,CAkC3F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,GAAG,OAAO,EAAE,YAAY,EAAE,GAAG,YAAY,CAoFrE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,GAAG,CAAC,MAAM,CAAa,GAC5B,YAAY,CAiCd;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,YAAY,CAIpF;AAID;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,eAAe,CAY3E;AAWD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,gBAAgB,CACpC,gBAAgB,EAAE,MAAM,EAAE,EAC1B,OAAO,CAAC,EAAE,MAAM,EAChB,QAAQ,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAoB,GAC9C,OAAO,CAAC,eAAe,EAAE,CAAC,CAyD5B;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAgBvE;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,CAwB1F;AAsCD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,CASzF"}

package/dist/config.js

@@ -9,6 +9,11 @@ import { ConfigError } from "./errors.js";
 import { normalizeLanguage } from "./language-patterns.js";
 const VALID_SEVERITIES = new Set(["critical", "high", "medium", "low", "info"]);
 const VALID_FORMATS = new Set(["text", "json", "sarif", "markdown", "html", "junit", "codeclimate"]);
+/** Numeric rank for severity comparison (lower = stricter). */
+const SEVERITY_RANK = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+function severityRank(s) {
+    return SEVERITY_RANK[s] ?? 4;
+}
 /**
  * Parse a JSON string into a JudgesConfig, with validation.
  */
@@ -243,6 +248,27 @@ export function parseConfig(jsonStr) {
         }
         config.customRules = obj.customRules;
     }
+    // lockedRules
+    if (obj.lockedRules !== undefined) {
+        if (!Array.isArray(obj.lockedRules) || !obj.lockedRules.every((r) => typeof r === "string")) {
+            throw new ConfigError('Invalid .judgesrc: "lockedRules" must be an array of strings');
+        }
+        config.lockedRules = obj.lockedRules;
+    }
+    // lockedJudges
+    if (obj.lockedJudges !== undefined) {
+        if (!Array.isArray(obj.lockedJudges) || !obj.lockedJudges.every((r) => typeof r === "string")) {
+            throw new ConfigError('Invalid .judgesrc: "lockedJudges" must be an array of strings');
+        }
+        config.lockedJudges = obj.lockedJudges;
+    }
+    // lockedMinSeverity
+    if (obj.lockedMinSeverity !== undefined) {
+        if (typeof obj.lockedMinSeverity !== "string" || !VALID_SEVERITIES.has(obj.lockedMinSeverity)) {
+            throw new ConfigError('Invalid .judgesrc: "lockedMinSeverity" must be one of critical, high, medium, low, info');
+        }
+        config.lockedMinSeverity = obj.lockedMinSeverity;
+    }
     return config;
 }
 /**
@@ -298,10 +324,28 @@ export function discoverCascadingConfigs(startDir, rootDir) {
  * concatenated (union). Scalars (minSeverity, maxFiles, preset, failOnFindings,
  * baseline, format) use the leaf value.
  * ruleOverrides are deep-merged.
+ *
+ * Org-level policy enforcement:
+ * - `lockedRules`: locked rules cannot be added to `disabledRules`
+ * - `lockedJudges`: locked judges cannot be added to `disabledJudges`
+ * - `lockedMinSeverity`: child configs cannot set a more lenient minSeverity
  */
 export function mergeConfigs(...configs) {
     const merged = {};
     for (const cfg of configs) {
+        // Accumulate locked fields (union across all configs — once locked, always locked)
+        if (cfg.lockedRules) {
+            merged.lockedRules = [...new Set([...(merged.lockedRules ?? []), ...cfg.lockedRules])];
+        }
+        if (cfg.lockedJudges) {
+            merged.lockedJudges = [...new Set([...(merged.lockedJudges ?? []), ...cfg.lockedJudges])];
+        }
+        if (cfg.lockedMinSeverity !== undefined) {
+            // Keep the strictest lock (lowest severity index = strictest)
+            if (!merged.lockedMinSeverity || severityRank(cfg.lockedMinSeverity) < severityRank(merged.lockedMinSeverity)) {
+                merged.lockedMinSeverity = cfg.lockedMinSeverity;
+            }
+        }
         // Concatenate arrays (deduplicated)
         if (cfg.disabledRules) {
             merged.disabledRules = [...new Set([...(merged.disabledRules ?? []), ...cfg.disabledRules])];
@@ -349,6 +393,27 @@ export function mergeConfigs(...configs) {
             merged.overrides = [...(merged.overrides ?? []), ...cfg.overrides];
         }
     }
+    // ── Enforce org-level locked policies ──────────────────────────────
+    // Remove locked rules from disabledRules (they must stay enabled)
+    if (merged.lockedRules?.length && merged.disabledRules?.length) {
+        const locked = new Set(merged.lockedRules);
+        merged.disabledRules = merged.disabledRules.filter((r) => !locked.has(r));
+        if (merged.disabledRules.length === 0)
+            delete merged.disabledRules;
+    }
+    // Remove locked judges from disabledJudges (they must stay enabled)
+    if (merged.lockedJudges?.length && merged.disabledJudges?.length) {
+        const locked = new Set(merged.lockedJudges);
+        merged.disabledJudges = merged.disabledJudges.filter((j) => !locked.has(j));
+        if (merged.disabledJudges.length === 0)
+            delete merged.disabledJudges;
+    }
+    // Enforce minSeverity floor — child cannot be more lenient than the lock
+    if (merged.lockedMinSeverity && merged.minSeverity) {
+        if (severityRank(merged.minSeverity) > severityRank(merged.lockedMinSeverity)) {
+            merged.minSeverity = merged.lockedMinSeverity;
+        }
+    }
     return merged;
 }
 /**