@kirrosh/zond 0.26.0 → 0.27.0

package/src/core/checks/types.ts

@@ -1,305 +0,0 @@
-/**
- * Type contracts for the `zond checks` framework (m-15 ARV-1).
- *
- * A `Check` is a single named conformance/security probe applied to one
- * operation × one HTTP response. The `runner` resolves the spec into
- * operations, generates a request via `core/generator/data-factory`,
- * sends it via `core/runner/send-request`, and feeds each (case,
- * response) pair to every active check.
- *
- * Names mirror schemathesis V4 1-to-1 so benchmarks and findings carry
- * across (see `backlog/milestones/m-15`). New checks register themselves
- * in `checks/index.ts` via `registerCheck`.
- */
-import type { OpenAPIV3 } from "openapi-types";
-import type { EndpointInfo } from "../generator/types.ts";
-import type { SchemaValidator } from "../runner/schema-validator.ts";
-import type { RecommendedAction } from "../diagnostics/failure-hints.ts";
-
-// Severity unified in src/core/severity (ARV-250). Re-exported here for
-// backwards-compatible imports across the checks subsystem; the canonical
-// definition is in core/severity. Adds 'info' tier (previously absent in
-// checks, now needed for hygiene-class findings per m-21 pivot).
-import type { Severity } from "../severity/index.ts";
-import { emptySeverityBuckets } from "../severity/index.ts";
-import type { Category } from "../severity/category.ts";
-import { emptyCategoryBuckets } from "../severity/category.ts";
-export type { Severity, Category };
-
-export type Phase = "examples" | "coverage" | "all";
-
-/** Probe shapes a check may need. ARV-1 shipped only `positive`; ARV-2
- *  adds two more for header/method-rejection checks; ARV-4 will add
- *  `negative_data` for the data-rejection pair. The runner generates a
- *  case for each kind that at least one active check declares. */
-export type CaseKind =
-  | "positive"
-  | "missing_required_header"
-  | "unsupported_method"
-  | "negative_data";
-
-export interface CheckReference {
-  /** CWE / OWASP / RFC identifier — free form, agent-readable. */
-  id: string;
-  /** Optional URL for the human reader. */
-  url?: string;
-}
-
-export interface CheckResponse {
-  status: number;
-  headers: Record<string, string>;
-  body: unknown;
-  duration_ms: number;
-}
-
-export interface CheckCase {
-  /** The operation under test (path + method + parameters). */
-  operation: EndpointInfo;
-  /** Resolved request that produced the response below. */
-  request: {
-    method: string;
-    url: string;
-    headers: Record<string, string>;
-    body?: string;
-  };
-  /** Mode the case was generated under — positive (valid) or negative
-   *  (intentionally invalid). Drives the ARV-7 `--mode` filter. */
-  mode: "positive" | "negative";
-  /** Probe shape — what the case is *built* to exercise. A check only
-   *  runs against a case whose `kind` it declared (or all if it
-   *  declared none — defaults to `positive`). */
-  kind: CaseKind;
-  /** For probe-style cases, an opaque hint the check itself produced
-   *  (e.g. the header name that was dropped, the method that was
-   *  swapped in). Lets a check emit a precise finding without parsing
-   *  the request back out. */
-  meta?: Record<string, unknown>;
-}
-
-/** ARV-179: per-run knobs surfaced from `RunCheckOptions` into the
- *  check itself. Add new fields here when a check needs an opt-in
- *  behaviour that doesn't deserve its own check id. Keep this lean —
- *  most knobs belong upstream in the case-generator, not in the
- *  check's response-side logic. */
-export interface CheckRuntimeOptions {
-  /** ARV-179: require strict 405 for `unsupported_method` (matches
-   *  schemathesis V4 default). Off by default — zond's pragmatic policy
-   *  accepts 401/403/404 as legitimate rejections of an undeclared
-   *  method (common nginx/gateway behaviour). */
-  strict405?: boolean;
-  /** ARV-181: require strict 401 for `ignored_auth` no-auth / bogus-auth
-   *  variants (matches schemathesis V4 default). Off by default — zond's
-   *  pragmatic policy accepts any 4xx as a legitimate auth-reject (403,
-   *  404, 422 are common). With this on, only 401 passes — a 403 on
-   *  no_auth becomes a finding "expected 401, got 403". */
-  strict401?: boolean;
-}
-
-export interface CheckContext {
-  case: CheckCase;
-  response: CheckResponse;
-  /** Pre-built once per run so checks don't pay AJV compile cost
-   *  per-case. Optional so unit tests can stub a context without one. */
-  schemaValidator?: SchemaValidator;
-  /** Original spec doc — checks that need declared headers /
-   *  content-types / status codes look them up here. */
-  doc?: OpenAPIV3.Document;
-  /** ARV-179: per-run knobs (see CheckRuntimeOptions). */
-  options?: CheckRuntimeOptions;
-}
-
-export type CheckOutcome =
-  | { kind: "pass" }
-  | { kind: "skip"; reason: string }
-  | {
-      kind: "fail";
-      message: string;
-      evidence?: Record<string, unknown>;
-      /** ARV-284: per-finding severity override. When set, runner uses
-       *  this in place of `Check.severity` — lets a check emit different
-       *  severities based on context (e.g. `negative_data_rejection`
-       *  with `additionalProperties-violation` evidence → LOW, with
-       *  `pattern-violation` → MEDIUM, with 5xx response → HIGH). The
-       *  declared `Check.severity` stays as the natural fallback /
-       *  documentation tier. The agent re-severitizes from the raw
-       *  evidence downstream. */
-      severity?: Severity;
-      /** ARV-310: attribute the finding to a specific operation instead of
-       *  the CRUD group's canonical create/read op. cursor_boundary_fuzzing
-       *  probes the GET list endpoint — without this the finding lands on the
-       *  POST create and reads as "a create endpoint that doesn't paginate". */
-      operation?: { path: string; method: string; operationId?: string };
-      /** ARV-312: observed HTTP status of the response the check acted on.
-       *  Auth/stateful checks send their own requests, so the runner has no
-       *  response to summarize and otherwise records `status: 0` — a phantom
-       *  that reads as "no response captured". Set this so the finding carries
-       *  the real status (and severity gating can key off it). */
-      responseStatus?: number;
-    };
-
-export interface Check {
-  /** Stable identifier — must match schemathesis name where possible. */
-  id: string;
-  severity: Severity;
-  /** Default expected outcome ("server should NOT 5xx", etc) — surfaced
-   *  by `zond checks list` so an agent can read the contract. */
-  defaultExpected: string;
-  references: CheckReference[];
-  /** Probe shapes this check consumes. Default `["positive"]` — most
-   *  conformance checks just inspect the standard response. ARV-2's
-   *  `missing_required_header` / `unsupported_method` declare their
-   *  own kinds so the runner generates the matching probe case. */
-  caseKinds?: CaseKind[];
-  /** Whether this check is meaningful for the given operation. Used by
-   *  the runner to skip checks that don't apply (e.g. auth-related
-   *  checks on operations with no security requirement). */
-  applies(operation: EndpointInfo): boolean;
-  run(ctx: CheckContext): CheckOutcome;
-}
-
-export interface CheckFinding {
-  check: string;
-  severity: Severity;
-  /** ARV-251: finding category drives per-section roll-up in reports.
-   *  Optional for backwards compat — when absent, downstream code derives
-   *  it via `categoryFor(check)`. Storing it on the finding keeps probe
-   *  emitters and check emitters using the same shape. */
-  category?: Category;
-  operation: { path: string; method: string; operationId?: string };
-  request_signature: string;
-  response_summary: { status: number; content_type?: string };
-  message: string;
-  evidence?: Record<string, unknown>;
-  /** ARV-11 — closed enum so agents can route on it without parsing
-   *  the message. Resolved by `recommendForCheck()` keyed on the
-   *  check id (and response status for `network_error`). Optional
-   *  because synthetic findings (e.g. unit-test fakes) may skip it. */
-  recommended_action?: RecommendedAction;
-  /** Suppression trace — present when a finding was removed from the
-   *  gate counts (today only the deterministic broken-baseline guard,
-   *  ARV-307, marks findings this way). CI summary excludes such findings
-   *  from gate counts via this field's presence; presence of
-   *  `suppressed_by` is the canonical "suppressed" signal. */
-  suppressed_by?: {
-    source: string;
-    rule_index: number;
-    reason: string;
-  };
-}
-
-export interface CheckRunSummary {
-  operations: number;
-  cases: number;
-  checks_run: number;
-  findings: number;
-  by_severity: Record<Severity, number>;
-  /** ARV-251: per-category roll-up — small teams use this to triage
-   *  "0 security, 12 reliability, 40 contract, 200 hygiene" instead of
-   *  reading one flat severity pile. */
-  by_category: Record<Category, number>;
-  /** ARV-26: count of `kind: "skip"` outcomes returned by checks, keyed by
-   *  `"<check_id>: <reason>"`. Surfaces the gap between probe and runtime
-   *  validators — e.g. `response_schema_conformance: no JSON Schema on this
-   *  response branch ×2` tells the user why "0 findings" doesn't mean "all
-   *  green" (probe got 4xx, response schema only declared on 2xx). */
-  skipped_outcomes: Record<string, number>;
-  /** ARV-83: same data as `skipped_outcomes`, but split into `{check, reason,
-   *  count}` so consumers don't have to colon-tokenise a key whose reason
-   *  text may itself contain colons. Sorted by count descending. The legacy
-   *  `skipped_outcomes` field is kept for back-compat with existing parsers
-   *  / NDJSON readers. */
-  skipped_outcomes_grouped: Array<{ check: string; reason: string; count: number }>;
-  /** Count of findings suppressed by the deterministic broken-baseline
-   *  guard (ARV-307). Excluded from `findings`/`by_severity` so CI gates
-   *  ignore them, but surfaced here for audit-trail reconciliation. */
-  suppressed?: number;
-}
-
-/** ARV-60: spec-level rollup of a systemic gap that manifests on N
- *  operations. When ≥80% of a check's applicable operations share the same
- *  root cause (same response status undeclared, same missing-schema skip
- *  reason, or zero cases when a detector finds no pair), the runner emits
- *  a single `SpecFinding` instead of (or in addition to) the N per-op rows.
- *
- *  Consumed by the CLI to print one summary line; surfaced verbatim in the
- *  JSON envelope and as a dedicated `spec_finding` NDJSON event. Per-op
- *  findings are NOT removed from `findings[]` — agents that prefer per-op
- *  triage keep their existing surface; agents that triage by spec hit just
- *  one row per drift. */
-export interface SpecFinding {
-  check: string;
-  /** Classifier so consumers can branch:
-   *  - `status_drift`: response status code clustered across operations
-   *    (status_code_conformance / negative_data_rejection / ignored_auth).
-   *  - `missing_declaration`: every applicable case skipped for the same
-   *    "spec didn't declare X" reason (response_schema_conformance,
-   *    response_headers_conformance).
-   *  - `no_detector`: check is applicable to ≥5 operations but ran 0 cases
-   *    (use_after_free without DELETE+GET pair, cross_call_references
-   *    without followups in scope).
-   *  - `broken_baseline`: ARV-307 — the positive/success baseline was
-   *    degenerate (>90% of positive probes returned non-2xx, e.g. a
-   *    fully auth-rejected scan). The conformance checks' per-op findings
-   *    are baseline artifacts, so they're rolled up into this one row and
-   *    removed from `findings[]` (mirrors the stateful broken-baseline skip).
-   *  - `other`: skip-cluster that doesn't fit the above. */
-  kind: "status_drift" | "missing_declaration" | "no_detector" | "broken_baseline" | "other";
-  /** Severity inherited from the underlying findings (status_drift) or
-   *  fixed to "info" for missing_declaration / no_detector — those signal
-   *  "spec gap, not server bug" so the team knows where to act. */
-  severity: Severity;
-  category?: Category;
-  /** One-line root cause statement — surfaces what zond observed. */
-  reason: string;
-  /** Actionable next step. References a spec edit, a tolerate flag, or
-   *  another zond command. Empty string when no automatic suggestion. */
-  fix_hint: string;
-  /** Operations the rollup covers (path + method). count = length. */
-  affected_operations: Array<{ path: string; method: string; operationId?: string }>;
-  count: number;
-  /** Applicable population the cluster was measured against. ratio =
-   *  count / applicable. Lets consumers re-threshold without re-running. */
-  applicable: number;
-}
-
-export interface CheckRunData {
-  findings: CheckFinding[];
-  summary: CheckRunSummary;
-  /** ARV-60: spec-level rollup, see SpecFinding. Always present (empty
-   *  array when no clusters cross the 80% threshold). */
-  spec_findings: SpecFinding[];
-}
-
-export function emptySummary(): CheckRunSummary {
-  return {
-    operations: 0,
-    cases: 0,
-    checks_run: 0,
-    findings: 0,
-    by_severity: emptySeverityBuckets(),
-    by_category: emptyCategoryBuckets(),
-    skipped_outcomes: {},
-    skipped_outcomes_grouped: [],
-    suppressed: 0,
-  };
-}
-
-/** ARV-83: turn the legacy `<check>: <reason>` keys into a structured
- *  array. The split parses the colon-separator at the first occurrence; if
- *  the reason itself contains colons, only the LEADING `check_id:` is
- *  stripped, preserving the rest verbatim. */
-export function groupSkippedOutcomes(
-  outcomes: Record<string, number>,
-): Array<{ check: string; reason: string; count: number }> {
-  const out: Array<{ check: string; reason: string; count: number }> = [];
-  for (const [key, count] of Object.entries(outcomes)) {
-    const idx = key.indexOf(": ");
-    if (idx > 0) {
-      out.push({ check: key.slice(0, idx), reason: key.slice(idx + 2), count });
-    } else {
-      out.push({ check: key, reason: "", count });
-    }
-  }
-  out.sort((a, b) => b.count - a.count);
-  return out;
-}

package/src/core/checks/zond-extensions.ts

@@ -1,73 +0,0 @@
-/**
- * `x-zond-*` OpenAPI vendor-extension policy (ARV-189, m-21).
- *
- * Lets spec authors declare per-operation rules directly in the spec
- * without a sidecar yaml file. This is the low-friction alternative
- * to `.api-resources.local.yaml` for one-off endpoints — typical
- * cases:
- *   - public route that shouldn't be flagged for missing auth headers
- *   - debugging endpoint whose 500s aren't real bugs
- *   - one-off skip during incident triage
- *
- * Resolution priority (highest first):
- *   1. `.api-resources.local.yaml` overlay (explicit operator override)
- *   2. `x-zond-*` extensions (in-spec policy — this module)
- *   3. `.api-resources.yaml` (auto-generated baseline)
- *   4. built-in defaults
- *
- * Supported extensions in this milestone:
- *   x-zond-skip:    string | string[]  — check ids to skip for this op
- *   x-zond-public:  boolean             — shortcut: skip auth-class checks
- *
- * Deliberately NOT implemented yet (deferred to a follow-up task):
- *   x-zond-resource / x-zond-idempotent / x-zond-lifecycle-field —
- *   these require deeper m-20 overlay wiring (proper integration with
- *   resource-config maps), tracked separately to keep this MVP focused
- *   on the universally-useful skip rules.
- */
-
-import type { EndpointInfo } from "../generator/types.ts";
-
-/** Auth-related check ids that `x-zond-public: true` should suppress.
- *  Kept in sync with the auth-class check registry in mode.ts. */
-const AUTH_CHECK_IDS = new Set<string>([
-  "ignored_auth",
-  "missing_required_header",
-]);
-
-/** True when the endpoint declares the check id should be skipped via
- *  any `x-zond-*` extension. The check id is matched case-sensitively
- *  against `x-zond-skip` entries; `x-zond-public: true` is expanded to
- *  the auth-id set before comparison. */
-export function endpointSkipsCheck(op: EndpointInfo, checkId: string): boolean {
-  const ext = op.extensions;
-  if (!ext) return false;
-
-  // x-zond-public: true → implicit skip for every auth-class check.
-  if (ext["x-zond-public"] === true && AUTH_CHECK_IDS.has(checkId)) {
-    return true;
-  }
-
-  // x-zond-skip: <string> | <string[]>
-  const skip = ext["x-zond-skip"];
-  if (typeof skip === "string") {
-    return skip === checkId;
-  }
-  if (Array.isArray(skip)) {
-    for (const entry of skip) {
-      if (typeof entry === "string" && entry === checkId) return true;
-    }
-  }
-  return false;
-}
-
-/** Reason string surfaced in the skipped-outcomes summary. Mirrors the
- *  `<check>: <reason>` convention used elsewhere in the runner. */
-export function reasonForSkip(op: EndpointInfo, checkId: string): string {
-  const ext = op.extensions;
-  if (!ext) return "x-zond extension"; // shouldn't happen — caller gates on endpointSkipsCheck
-  if (ext["x-zond-public"] === true && AUTH_CHECK_IDS.has(checkId)) {
-    return "x-zond-public: true (auth check suppressed at the spec level)";
-  }
-  return `x-zond-skip listed "${checkId}" at the spec level`;
-}

package/src/core/classifier/recommended-action.ts

@@ -1,251 +0,0 @@
-/**
- * ARV-56: single producer of `recommended_action` across every source
- * that emits findings — run results (`db diagnose`), spec lint
- * (`lint-spec.Issue`), probe-security findings, probe-mass-assignment
- * verdicts, and conformance checks (`zond checks run`).
- *
- * Before this module, "what action does an agent take?" was answered in
- * five different places:
- *   - `recommendedAction` / `recommendedActionForGenerated`     (db-analysis)
- *   - `recommendForCheck`                                       (checks runner)
- *   - `stampRecommendedAction` (mass-assignment) + per-severity policy
- *   - `stampAction`            (security) + per-severity policy
- *   - inline `"fix_spec"` literal                               (lint)
- *
- * Each accumulated branches independently — ARV-11 added per-check
- * actions, ARV-42 added a generator-aware override, TASK-294 layered
- * probe severity mappings, the env-issue detector then overrode the
- * result of all of them. By the time ARV-56 landed, the same logical
- * question — "given this finding, what should the agent do?" — had four
- * different entry points with subtle drift.
- *
- * This file owns that question. Every producer hands the classifier a
- * `ClassifierContext` (a frozen description of the finding) and gets
- * back a `RecommendedAction`. The classifier is **pure** — no I/O, no
- * config reads, no side effects — so it can be table-tested.
- *
- * The thin wrappers (`recommendedAction`, `recommendedActionForGenerated`,
- * `recommendForCheck`, `stampRecommendedAction`, `stampAction`) now
- * delegate here instead of carrying their own switches. Removing a
- * branch means editing one switch in this file.
- */
-
-import type { RecommendedAction } from "../diagnostics/failure-hints.ts";
-import type { RunKind } from "../runner/run-kind.ts";
-
-export type FindingClass =
-  // db-analysis run-result rows ────────────────────────────────────
-  | "test:network_error"
-  | "test:api_error"
-  | "test:assertion_failed"
-
-  // checks/<id>  ────────────────────────────────────────────────────
-  | "check:status_code_conformance"
-  | "check:content_type_conformance"
-  | "check:response_headers_conformance"
-  | "check:response_schema_conformance"
-  | "check:not_a_server_error"
-  | "check:unsupported_method"
-  | "check:positive_data_acceptance"
-  | "check:use_after_free"
-  | "check:ensure_resource_availability"
-  | "check:negative_data_rejection"
-  | "check:missing_required_header"
-  | "check:ignored_auth"
-  | "check:cross_call_references"
-  | "check:idempotency_replay"
-  | "check:pagination_invariants"
-  | "check:lifecycle_transitions"
-  | "check:open_cors_on_sensitive"
-  | "check:cursor_boundary_fuzzing"
-  | "check:rate_limit_headers_absent"
-  | "check:network_error"
-
-  // probe verdicts (severity already classified upstream) ───────────
-  | "probe:mass_assignment"
-  | "probe:security"
-
-  // lint-spec ───────────────────────────────────────────────────────
-  | "lint:issue";
-
-/** Optional severity hint — probe families surface a 5-level enum;
- *  here we only care about the buckets the action mapping branches on. */
-export type FindingSeverity =
-  | "high"
-  | "medium"
-  | "inconclusive-5xx"
-  | "inconclusive-baseline"
-  | "low"
-  | "ok"
-  | "skipped";
-
-export interface ClassifierContext {
-  finding_class: FindingClass;
-  /** HTTP status code observed for the finding, when applicable.
-   *  null/undefined means "unknown / not relevant". */
-  status?: number | null;
-  /** Severity already assigned by the probe layer (mass-assignment /
-   *  security). The classifier reads it instead of re-deriving from
-   *  status — severity captures multi-step reasoning (baseline + attack
-   *  + follow-up GET) that status alone can't recover. */
-  severity?: FindingSeverity;
-  /** Run kind for the finding's parent run — currently informational; the
-   *  classifier may consult it in the future to e.g. downgrade probe-run
-   *  signal. Captured now so the contract is forward-compatible. */
-  run_kind?: RunKind;
-  /** Provenance of the failing test (only relevant for test:* classes). */
-  provenance?: { type?: string; generator?: string } | null;
-  /** Suite path used to detect generator-emitted tests. */
-  suite_path?: string | null;
-  /** When the env-issue detector flagged the suite, it overrides the
-   *  classifier's default. Producers set this *after* clustering. */
-  baseline_status?: number | null;
-  /** ARV-103 (F8): true when at least one assertion on the failing step
-   *  has `kind: "schema"`. Schema violations are real contract bugs — per
-   *  zond/SKILL.md L376-377 they should route to report_backend_bug, not
-   *  fix_test_logic. Producers (db-analysis) set this after walking the
-   *  step's assertions array. */
-  schema_violation?: boolean;
-  /** ARV-324: true when `prepare-fixtures`/`discover` already confirmed
-   *  this exact operation returns a client error / empty list while
-   *  hunting for fixture values (`.fixture-gaps.yaml`) — e.g. an empty
-   *  test account. Same shape of problem `probe:mass_assignment`'s
-   *  `inconclusive-baseline` branch already solves below: a finding
-   *  caused by our own missing test data isn't a backend bug. */
-  unresolved_fixture?: boolean;
-}
-
-/**
- * Decide the action for a finding. Returns `undefined` only for finding
- * classes that intentionally don't carry an action (e.g. severity:low
- * security findings — the producer should leave the field unset rather
- * than coerce a value).
- */
-export function classify(ctx: ClassifierContext): RecommendedAction | undefined {
-  switch (ctx.finding_class) {
-    // ── Run-result rows (db diagnose) ───────────────────────────────
-    case "test:api_error":
-      return "report_backend_bug";
-
-    case "test:network_error":
-      if (ctx.status === 401 || ctx.status === 403) return "fix_auth_config";
-      return "fix_network_config";
-
-    case "test:assertion_failed": {
-      // 401/403 → auth always wins.
-      if (ctx.status === 401 || ctx.status === 403) return "fix_auth_config";
-      // ARV-103 (F8): schema-kind assertions are real contract bugs (the
-      // server returned a body that violates its own spec). Route to
-      // report_backend_bug — same bucket as 5xx. Skill (zond/SKILL.md
-      // L376-377) explicitly says "treat them like 5xx, do not edit the
-      // expectation away". Wins over the generator-aware override below
-      // because regenerate_suite would silently re-emit the same broken
-      // assertion against the same broken response.
-      if (ctx.schema_violation) return "report_backend_bug";
-      // ARV-42: generator-emitted suites get a different default — editing
-      // the YAML gets clobbered on the next `zond audit`.
-      const generated = isGeneratedSource(ctx.provenance, ctx.suite_path);
-      if (generated) {
-        if (ctx.status === 404) return "fix_fixture";
-        if (ctx.status === 400 || ctx.status === 422) return "regenerate_suite";
-      }
-      return "fix_test_logic";
-    }
-
-    // ── checks/<id> ────────────────────────────────────────────────
-    case "check:status_code_conformance":
-    case "check:content_type_conformance":
-    case "check:response_headers_conformance":
-    case "check:response_schema_conformance":
-      return "fix_spec";
-
-    case "check:not_a_server_error":
-      // A 5xx on this operation is worth flagging regardless of fixture
-      // state — even a synthetic/garbage id shouldn't crash the server.
-      return "report_backend_bug";
-
-    case "check:positive_data_acceptance":
-      // ARV-324: a known unresolved fixture gap (garbage path-id → 400)
-      // is our own missing test data, not a backend or spec defect.
-      if (ctx.unresolved_fixture) return "fix_fixture";
-      // ARV-341: otherwise this check fires ONLY when the server rejects a
-      // body *we* generated as valid (400/422). The server is
-      // authoritative — our generated body or the spec was wrong, not the
-      // backend. Route to fix_spec, not report_backend_bug, so 100s of
-      // generator/spec-drift cases don't spam the API owner with false
-      // bug reports.
-      return "fix_spec";
-
-    case "check:unsupported_method":
-    case "check:use_after_free":
-    case "check:ensure_resource_availability":
-    case "check:cross_call_references":
-    case "check:idempotency_replay":
-    case "check:pagination_invariants":
-    case "check:lifecycle_transitions":
-    case "check:cursor_boundary_fuzzing":
-      // ARV-324: same treatment as probe:mass_assignment's
-      // inconclusive-baseline branch below — a finding on an operation
-      // we already know is an unresolved fixture gap isn't new evidence
-      // of a backend defect.
-      if (ctx.unresolved_fixture) return "fix_fixture";
-      return "report_backend_bug";
-
-    case "check:negative_data_rejection":
-      return "tighten_validation";
-
-    case "check:missing_required_header":
-      return "add_required_header";
-
-    case "check:ignored_auth":
-    case "check:open_cors_on_sensitive":
-      return "fix_auth_config";
-
-    case "check:rate_limit_headers_absent":
-      // ARV-304: this is a server-side hygiene gap (RFC-9239 /
-      // OWASP-API-04 expect rate-limit metadata on writes), not a
-      // caller-side auth problem. Agents triaging on `fix_auth_config`
-      // would chase the wrong fix; surface it as a backend-team task.
-      return "report_backend_bug";
-
-    case "check:network_error":
-      if (ctx.status === 401 || ctx.status === 403) return "fix_auth_config";
-      return "fix_network_config";
-
-    // ── Probe verdicts ─────────────────────────────────────────────
-    case "probe:mass_assignment":
-      switch (ctx.severity) {
-        case "high":
-        case "medium":
-        case "inconclusive-5xx":
-          return "report_backend_bug";
-        case "inconclusive-baseline":
-          return "fix_fixture";
-        default:
-          return undefined; // low / ok / skipped: no action
-      }
-
-    case "probe:security":
-      // TASK-294 policy: high/low both routed to backend-bug. Low is
-      // "server returned 2xx without echoing the payload" — still a
-      // surprising acceptance the backend should review.
-      if (ctx.severity === "high" || ctx.severity === "low") {
-        return "report_backend_bug";
-      }
-      return undefined;
-
-    // ── Lint findings ─────────────────────────────────────────────
-    case "lint:issue":
-      return "fix_spec";
-  }
-}
-
-function isGeneratedSource(
-  provenance: ClassifierContext["provenance"],
-  suite_path: ClassifierContext["suite_path"],
-): boolean {
-  if (provenance?.type === "openapi-generated") return true;
-  if (provenance?.generator && provenance.generator.toLowerCase().includes("zond")) return true;
-  if (typeof suite_path === "string" && /(^|\/)apis\/[^/]+\/tests\//.test(suite_path)) return true;
-  return false;
-}

package/src/core/context/current.ts

@@ -1,51 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { findWorkspaceRoot } from "../workspace/root.ts";
-
-/**
- * TASK-290: current-API resolution chain.
- *  - Global --api flag is mirrored into ZOND_API_GLOBAL by program.ts preAction.
- *  - Users can also export ZOND_API in their shell.
- *  - Persisted choice lives in `.zond/current-api` (was `.zond-current`).
- */
-const FILENAME = ".zond/current-api";
-
-export function currentApiPath(cwd?: string): string {
-  const base = cwd ?? findWorkspaceRoot().root;
-  return join(base, FILENAME);
-}
-
-/**
- * Returns the active API name. Resolution order:
- *  1. ZOND_API_GLOBAL  (mirrored from `zond --api <name> ...`)
- *  2. ZOND_API         (user env)
- *  3. `.zond/current-api` file (set by `zond use <name>`)
- */
-export function readCurrentApi(cwd?: string): string | null {
-  const fromGlobalFlag = process.env.ZOND_API_GLOBAL?.trim();
-  if (fromGlobalFlag) return fromGlobalFlag;
-  const fromEnv = process.env.ZOND_API?.trim();
-  if (fromEnv) return fromEnv;
-  const path = currentApiPath(cwd);
-  if (!existsSync(path)) return null;
-  const raw = readFileSync(path, "utf-8").trim();
-  return raw.length > 0 ? raw : null;
-}
-
-/** Writes the API collection name to `.zond/current-api`. Creates the dir if needed. */
-export function writeCurrentApi(name: string, cwd?: string): string {
-  const trimmed = name.trim();
-  if (!trimmed) throw new Error("API name cannot be empty");
-  const path = currentApiPath(cwd);
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, trimmed + "\n", "utf-8");
-  return path;
-}
-
-/** Deletes `.zond/current-api`. Returns true when a file was removed, false when it did not exist. */
-export function clearCurrentApi(cwd?: string): boolean {
-  const path = currentApiPath(cwd);
-  if (!existsSync(path)) return false;
-  unlinkSync(path);
-  return true;
-}