@lsctech/polaris 0.5.0 → 0.5.3

package/dist/qc/orchestration.js

@@ -0,0 +1,150 @@
+"use strict";
+/**
+ * QC trigger orchestration.
+ *
+ * Wires QC providers into the Polaris lifecycle at:
+ *   - completed-cluster (after all children done, before final delivery)
+ *   - pr (after a PR is created, for providers that require a PR URL)
+ *   - child (selected at dispatch time for high-risk scopes)
+ *
+ * The orchestrator is passive/dry-run by default; only configured providers
+ * are invoked, and only blocking policy stops the loop/finalize flow.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runQcAtTrigger = runQcAtTrigger;
+const store_js_1 = require("../cluster-state/store.js");
+const policy_js_1 = require("./policy.js");
+const runner_js_1 = require("./runner.js");
+const triggers_js_1 = require("./triggers.js");
+const attribution_js_1 = require("./attribution.js");
+const autofix_js_1 = require("./autofix.js");
+const routing_js_1 = require("./routing.js");
+function buildAttributionContext(options) {
+    const { repoRoot, clusterId, branch, state } = options;
+    const dispatchRecords = {};
+    if (state?.open_children_meta) {
+        for (const [childId, meta] of Object.entries(state.open_children_meta)) {
+            if (meta?.dispatch_record) {
+                dispatchRecords[childId] = meta.dispatch_record;
+            }
+        }
+    }
+    return {
+        repoRoot,
+        baseBranch: branch ?? state?.branch ?? "main",
+        completedResults: state?.completed_children_results,
+        dispatchRecords,
+        clusterState: repoRoot ? ((0, store_js_1.readClusterStateSync)(clusterId, repoRoot) ?? undefined) : undefined,
+    };
+}
+function applyAttributionAndRouting(result, config, context, ownership, routeName) {
+    const updatedFindings = result.findings.map((finding) => {
+        const attribution = (0, attribution_js_1.resolveAttributionWithOwnership)(finding, context, ownership);
+        const autofix = (0, autofix_js_1.isAutofixEligible)(finding, config, {
+            provider: result.provider,
+            routeName,
+        });
+        const routing = (0, routing_js_1.decideRepairRouting)({ ...finding, attribution, autofixEligible: autofix.eligible }, config, autofix.eligible, { routeName });
+        return {
+            ...finding,
+            attribution,
+            autofixEligible: autofix.eligible,
+            routingDecision: routing,
+        };
+    });
+    const updatedResult = {
+        ...result,
+        findings: updatedFindings,
+        policyDecision: (0, policy_js_1.computeQcPolicyDecision)({ ...result, findings: updatedFindings }, config),
+    };
+    return updatedResult;
+}
+/**
+ * Run QC for the given lifecycle trigger when configured.
+ *
+ * Returns a no-op "pass" result when QC is disabled, no providers are configured
+ * for the trigger, or all providers run successfully without findings that
+ * match a blocking/follow-up policy.
+ */
+async function runQcAtTrigger(options) {
+    const { config, registry, trigger, prUrl, repoRoot, runId, clusterId, branch, telemetryFile, timeoutMs, state, routeName, } = options;
+    if (!config.enabled) {
+        return {
+            trigger,
+            results: [],
+            action: "pass",
+            summary: "QC disabled by configuration",
+        };
+    }
+    const providers = (0, triggers_js_1.activeProvidersForTrigger)(config, trigger);
+    if (providers.length === 0) {
+        return {
+            trigger,
+            results: [],
+            action: "pass",
+            summary: `No QC providers configured for trigger "${trigger}"`,
+        };
+    }
+    const attributionContext = buildAttributionContext(options);
+    const ownership = (0, attribution_js_1.buildChangedFileOwnership)(attributionContext);
+    const results = [];
+    const errors = [];
+    for (const [name, providerConfig] of providers) {
+        const provider = registry.get(name);
+        if (!provider) {
+            errors.push(`Unknown QC provider "${name}"`);
+            continue;
+        }
+        const scope = {
+            clusterId,
+            runId,
+            ...(trigger === "pr" ? { prUrl } : { branch }),
+        };
+        try {
+            const rawResult = await (0, runner_js_1.executeQcProvider)(provider, scope, {
+                repoRoot,
+                runId,
+                clusterId,
+                branch,
+                telemetryFile,
+                timeoutMs,
+            });
+            const result = applyAttributionAndRouting(rawResult, config, attributionContext, ownership, routeName);
+            try {
+                await (0, store_js_1.recordQcRun)(clusterId, result, repoRoot);
+            }
+            catch (err) {
+                errors.push(`Failed to record QC run ${result.qcRunId}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            results.push(result);
+        }
+        catch (err) {
+            errors.push(`QC provider "${name}" execution error: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    let action = "pass";
+    for (const result of results) {
+        const a = (0, policy_js_1.decideQcAction)(result, config);
+        if (a === "block") {
+            action = "block";
+            break;
+        }
+        if (a === "follow-up" && action === "pass") {
+            action = "follow-up";
+        }
+    }
+    const successfulRuns = results.filter((result) => result.status !== "failed");
+    if (action === "pass" && successfulRuns.length === 0 && (results.length > 0 || errors.length > 0)) {
+        action = "block";
+    }
+    const summaryParts = results.map((r) => `${r.provider}: ${r.status} (${r.findings.length} findings)`);
+    if (errors.length > 0) {
+        summaryParts.push(`errors: ${errors.join(", ")}`);
+    }
+    return {
+        trigger,
+        results,
+        action,
+        summary: summaryParts.join("; ") || "No QC providers produced results",
+    };
+}

package/dist/qc/policy.js

@@ -0,0 +1,70 @@
+"use strict";
+/**
+ * QC policy decision logic.
+ *
+ * Translates a normalized QC result and the Polaris QC configuration into an
+ * explicit action for the loop/finalize lifecycle. Findings with routing
+ * decisions applied are used to determine whether delivery should block,
+ * require operator review, or be routed to repair.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decideQcAction = decideQcAction;
+exports.computeQcPolicyDecision = computeQcPolicyDecision;
+const severity_js_1 = require("./severity.js");
+/**
+ * Decide what the runtime should do with a QC result.
+ *
+ * Rules:
+ *   - passed / skipped  -> pass (no effect on delivery)
+ *   - repairRouting: "block"  -> block finalize/delivery
+ *   - repairRouting: "log"    -> pass (passive report only)
+ *   - repairRouting: "route" / "follow-up" -> create follow-up work, but high/critical
+ *     findings still block according to severity thresholds.
+ *
+ * Timeouts are surfaced as failed results and follow the same routing policy.
+ */
+function decideQcAction(result, config) {
+    if (result.status === "passed" || result.status === "skipped") {
+        return "pass";
+    }
+    const routing = config.repairRouting ?? "route";
+    if (routing === "block") {
+        return "block";
+    }
+    if (routing === "log") {
+        return "pass";
+    }
+    const blockThreshold = config.severityThresholds?.block ?? "high";
+    const hasBlockingFinding = result.findings.some((f) => (0, severity_js_1.compareSeverity)(f.severity, blockThreshold) >= 0);
+    if (hasBlockingFinding) {
+        return "block";
+    }
+    return "follow-up";
+}
+/**
+ * Compute the detailed policy decision for a QC result after attribution and
+ * repair routing have been applied.
+ */
+function computeQcPolicyDecision(result, config) {
+    const blockThreshold = config.severityThresholds?.block ?? "high";
+    const blocksDelivery = result.findings.some((f) => (0, severity_js_1.compareSeverity)(f.severity, blockThreshold) >= 0 &&
+        (f.routingDecision === "operator-review" || f.routingDecision === undefined));
+    const requiresOperatorReview = result.status === "failed" ||
+        result.status === "blocked" ||
+        result.findings.some((f) => f.routingDecision === "operator-review");
+    const routedToRepair = result.findings.some((f) => f.routingDecision === "original-worker" || f.routingDecision === "repair-worker");
+    const summaryParts = [];
+    summaryParts.push(`${result.findings.length} findings`);
+    if (requiresOperatorReview) {
+        summaryParts.push("operator review required");
+    }
+    if (routedToRepair) {
+        summaryParts.push("routed to repair");
+    }
+    return {
+        blocksDelivery,
+        requiresOperatorReview,
+        routedToRepair,
+        summary: summaryParts.join("; "),
+    };
+}

package/dist/qc/provider.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.QcProviderRegistry = void 0;
+/**
+ * Registry of configured QC providers. The registry is keyed by provider name.
+ */
+class QcProviderRegistry {
+    providers = new Map();
+    register(provider) {
+        this.providers.set(provider.name, provider);
+    }
+    get(name) {
+        return this.providers.get(name);
+    }
+    has(name) {
+        return this.providers.has(name);
+    }
+    list() {
+        return Array.from(this.providers.values());
+    }
+    /**
+     * Return providers that can review the given scope, ordered by registration.
+     */
+    candidatesFor(scope) {
+        return this.list().filter((provider) => provider.canReview(scope));
+    }
+}
+exports.QcProviderRegistry = QcProviderRegistry;

package/dist/qc/providers/coderabbit.js

@@ -0,0 +1,214 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CodeRabbitQcProvider = void 0;
+const severity_js_1 = require("../severity.js");
+function coerceNumber(value) {
+    if (value === null || value === undefined)
+        return undefined;
+    const n = Number(value);
+    return Number.isFinite(n) ? n : undefined;
+}
+function pickString(...candidates) {
+    for (const candidate of candidates) {
+        if (typeof candidate === "string" && candidate.trim().length > 0) {
+            return candidate.trim();
+        }
+    }
+    return undefined;
+}
+function buildRange(raw) {
+    const startLine = coerceNumber(raw.startLine ?? raw.line) ?? 1;
+    const endLine = coerceNumber(raw.endLine);
+    const startColumn = coerceNumber(raw.startColumn ?? raw.column);
+    const endColumn = coerceNumber(raw.endColumn);
+    if (!endLine && startColumn === undefined && endColumn === undefined) {
+        return { startLine };
+    }
+    return {
+        startLine,
+        ...(startColumn !== undefined ? { startColumn } : {}),
+        ...(endLine !== undefined ? { endLine } : {}),
+        ...(endColumn !== undefined ? { endColumn } : {}),
+    };
+}
+function parseFindingsFromPayload(payload) {
+    if (!payload || typeof payload !== "object") {
+        return [];
+    }
+    const record = payload;
+    if (Array.isArray(record.findings)) {
+        return record.findings;
+    }
+    if (Array.isArray(record.issues)) {
+        return record.issues;
+    }
+    if (Array.isArray(record.results)) {
+        return record.results;
+    }
+    // Single finding wrapped in an object
+    if (record.severity !== undefined ||
+        record.message !== undefined ||
+        record.title !== undefined) {
+        return [record];
+    }
+    return [];
+}
+function parseReport(output) {
+    const text = "stdout" in output && typeof output.stdout === "string" ? output.stdout : "";
+    const data = "data" in output ? output.data : undefined;
+    if (data !== undefined && typeof data === "object" && data !== null) {
+        const findings = parseFindingsFromPayload(data);
+        const record = data;
+        return {
+            findings,
+            ...(typeof record.prUrl === "string" ? { prUrl: record.prUrl } : {}),
+        };
+    }
+    if (text.trim().startsWith("{") || text.trim().startsWith("[")) {
+        try {
+            const parsed = JSON.parse(text);
+            if (Array.isArray(parsed)) {
+                return { findings: parsed };
+            }
+            return {
+                findings: parseFindingsFromPayload(parsed),
+                ...(typeof parsed?.prUrl === "string"
+                    ? { prUrl: parsed.prUrl }
+                    : {}),
+            };
+        }
+        catch {
+            // Fall through to line scanning.
+        }
+    }
+    // Try JSONL: one finding per line
+    const lines = text.split("\n").filter((line) => line.trim().length > 0);
+    const lineFindings = [];
+    for (const line of lines) {
+        try {
+            const parsed = JSON.parse(line);
+            lineFindings.push(parsed);
+        }
+        catch {
+            // Ignore unparseable lines.
+        }
+    }
+    if (lineFindings.length > 0) {
+        return { findings: lineFindings };
+    }
+    return null;
+}
+function normalizeFinding(raw, index) {
+    const severityLabel = pickString(raw.severity, raw.level) ?? "info";
+    const severity = (0, severity_js_1.normalizeSeverity)(severityLabel);
+    const title = pickString(raw.title, raw.summary, raw.rule, raw.type, raw.category) ?? `Finding #${index + 1}`;
+    const message = pickString(raw.message, raw.description, raw.body);
+    const filePath = pickString(raw.file, raw.filePath, raw.path);
+    const suggestedAction = pickString(raw.suggestion, raw.suggestedAction, raw.fix);
+    const providerFindingId = pickString(raw.providerFindingId, raw.id, raw.findingId);
+    const confidence = coerceNumber(raw.confidence);
+    const attribution = {
+        confidence: "unattributed",
+        reason: "provider-uncertain",
+        filePath,
+    };
+    const fixAvailable = raw.fixAvailable === true || raw.autofixEligible === true || Boolean(raw.fix);
+    return {
+        findingId: `coderabbit-${index + 1}-${Date.now()}`,
+        ...(providerFindingId ? { providerFindingId } : {}),
+        severity,
+        ...(pickString(raw.category, raw.type, raw.rule) ? { category: pickString(raw.category, raw.type, raw.rule) } : {}),
+        title,
+        ...(message ? { message } : {}),
+        ...(filePath ? { filePath } : {}),
+        range: filePath ? buildRange(raw) : undefined,
+        ...(confidence !== undefined ? { confidence } : {}),
+        ...(suggestedAction ? { suggestedAction } : {}),
+        fixAvailable,
+        autofixEligible: raw.autofixEligible === true || fixAvailable,
+        attribution,
+        status: "open",
+    };
+}
+function computeResultStatus(findings, providerFailed) {
+    if (findings.length === 0) {
+        return providerFailed ? "failed" : "passed";
+    }
+    const highestSeverity = findings.reduce((max, finding) => (0, severity_js_1.maxSeverity)(max, finding.severity), findings[0].severity);
+    if (highestSeverity === "critical") {
+        return "blocked";
+    }
+    if (highestSeverity === "info") {
+        return "passed";
+    }
+    return "findings";
+}
+function buildResultFromReport(report, output, mode, providerFailed = false) {
+    const now = new Date().toISOString();
+    const rawFindings = report?.findings ?? [];
+    const findings = rawFindings.map(normalizeFinding);
+    return {
+        schemaVersion: "1.0",
+        qcRunId: `${output.provider}-${Date.now()}`,
+        runId: "unknown",
+        clusterId: "unknown",
+        trigger: "completed-cluster",
+        provider: output.provider,
+        providerMode: mode,
+        prUrl: report?.prUrl,
+        startedAt: now,
+        completedAt: now,
+        status: computeResultStatus(findings, providerFailed),
+        findings,
+        rawArtifactPaths: "artifactPath" in output && output.artifactPath ? [output.artifactPath] : [],
+        parserVersion: "coderabbit-1.0",
+        policyDecision: {
+            blocksDelivery: findings.some((f) => f.severity === "critical"),
+            requiresOperatorReview: findings.some((f) => f.severity === "high" || f.severity === "critical"),
+            routedToRepair: findings.some((f) => f.severity === "medium" || f.severity === "high" || f.severity === "critical"),
+            summary: findings.length === 0
+                ? "CodeRabbit review returned no findings."
+                : `CodeRabbit review returned ${findings.length} finding(s).`,
+        },
+    };
+}
+/**
+ * CodeRabbit-style QC adapter.
+ *
+ * Parses JSON, JSONL, and metrics payloads into normalized Polaris findings.
+ * No external network calls are made here.
+ */
+class CodeRabbitQcProvider {
+    name = "coderabbit";
+    supportedModes = ["local", "pr", "metrics-import"];
+    capabilities = [
+        "diff-review",
+        "pr-review",
+        "result-parsing",
+        "auto-fix",
+        "metrics-import",
+    ];
+    canReview(scope) {
+        if (scope.prUrl)
+            return true;
+        return Boolean(scope.branch);
+    }
+    buildReviewCommand(scope) {
+        if (scope.prUrl) {
+            return { command: "coderabbit", args: ["review", "--agent", "--pr-url", scope.prUrl] };
+        }
+        return {
+            command: "coderabbit",
+            args: ["review", "--agent", "--branch", scope.branch ?? "HEAD"],
+        };
+    }
+    parse(output) {
+        const report = parseReport(output);
+        return buildResultFromReport(report, output, "local", output.exitCode !== 0);
+    }
+    importMetrics(payload) {
+        const report = parseReport(payload);
+        return buildResultFromReport(report, payload, "metrics-import");
+    }
+}
+exports.CodeRabbitQcProvider = CodeRabbitQcProvider;

package/dist/qc/providers/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CodeRabbitQcProvider = void 0;
+var coderabbit_js_1 = require("./coderabbit.js");
+Object.defineProperty(exports, "CodeRabbitQcProvider", { enumerable: true, get: function () { return coderabbit_js_1.CodeRabbitQcProvider; } });

package/dist/qc/registry.js

@@ -0,0 +1,16 @@
+"use strict";
+/**
+ * Default QC provider registry.
+ *
+ * Registers all built-in QC adapters. In the future this can be extended to
+ * discover providers from configuration or installed plugins.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDefaultQcRegistry = createDefaultQcRegistry;
+const provider_js_1 = require("./provider.js");
+const coderabbit_js_1 = require("./providers/coderabbit.js");
+function createDefaultQcRegistry() {
+    const registry = new provider_js_1.QcProviderRegistry();
+    registry.register(new coderabbit_js_1.CodeRabbitQcProvider());
+    return registry;
+}

package/dist/qc/routing.js

@@ -0,0 +1,55 @@
+"use strict";
+/**
+ * QC repair routing.
+ *
+ * Maps an attributed finding to one of four repair paths:
+ *   - original-worker: hand back to the child that owns the change.
+ *   - repair-worker: hand to a Medic-style repair worker (shared/unclear ownership).
+ *   - follow-up: create a tracker follow-up issue (low severity, non-security).
+ *   - operator-review: escalate to a human (high/critical, security, blocked auto-fix).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decideRepairRouting = decideRepairRouting;
+const security_category_js_1 = require("./security-category.js");
+const severity_js_1 = require("./severity.js");
+function getBlockThreshold(config, context) {
+    const route = context.routeName ? config.routes?.[context.routeName] : undefined;
+    return route?.blockThreshold ?? config.severityThresholds?.block ?? "high";
+}
+/**
+ * Decide the repair path for a finding.
+ *
+ * Rules (in order):
+ *   1. High/critical findings or security-sensitive findings -> operator-review.
+ *   2. Auto-fix eligible findings with clear attribution -> original-worker.
+ *   3. Low severity -> follow-up issue.
+ *   4. Shared ownership -> repair-worker.
+ *   5. Unclear/weak attribution -> operator-review for medium+, follow-up for low/info.
+ */
+function decideRepairRouting(finding, config, autofixEligible, context = {}) {
+    const blockThreshold = getBlockThreshold(config, context);
+    if ((0, severity_js_1.compareSeverity)(finding.severity, blockThreshold) >= 0) {
+        return "operator-review";
+    }
+    if ((0, security_category_js_1.isSecurityCategory)(finding.category)) {
+        return "operator-review";
+    }
+    const attribution = finding.attribution;
+    const clearAttribution = attribution.confidence === "high" || attribution.confidence === "medium";
+    if (autofixEligible && clearAttribution && attribution.childId) {
+        return "original-worker";
+    }
+    if ((0, severity_js_1.compareSeverity)(finding.severity, "low") <= 0) {
+        return "follow-up";
+    }
+    if (attribution.reason === "shared-file") {
+        return "repair-worker";
+    }
+    if (attribution.confidence === "low" && attribution.reason === "provider-uncertain") {
+        return attribution.childId ? "repair-worker" : "operator-review";
+    }
+    if (attribution.confidence === "unattributed") {
+        return "operator-review";
+    }
+    return "repair-worker";
+}

package/dist/qc/runner.js

@@ -0,0 +1,137 @@
+"use strict";
+/**
+ * QC provider execution runner.
+ *
+ * Runs a provider-specific review command, handles timeouts, and normalizes
+ * the raw output into a Polaris QcResult with runtime fields populated.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.executeQcProvider = executeQcProvider;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+function makeSyntheticResult(provider, scope, startedAt, status, summary) {
+    const completedAt = new Date().toISOString();
+    return {
+        schemaVersion: "1.0",
+        qcRunId: `${provider.name}-${Date.now()}`,
+        runId: scope.runId,
+        clusterId: scope.clusterId,
+        trigger: scope.prUrl ? "pr" : "completed-cluster",
+        provider: provider.name,
+        providerMode: scope.prUrl ? "pr" : "local",
+        prUrl: scope.prUrl,
+        startedAt,
+        completedAt,
+        status,
+        findings: [],
+        rawArtifactPaths: [],
+        parserVersion: `${provider.name}-synthetic`,
+        policyDecision: {
+            blocksDelivery: false,
+            requiresOperatorReview: status !== "passed",
+            routedToRepair: false,
+            summary,
+        },
+    };
+}
+function appendTelemetry(telemetryFile, event) {
+    if (!telemetryFile)
+        return;
+    try {
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(telemetryFile), { recursive: true });
+        (0, node_fs_1.appendFileSync)(telemetryFile, JSON.stringify(event) + "\n", "utf-8");
+    }
+    catch {
+        // Telemetry is best-effort.
+    }
+}
+function resolveExecutionFailure(provider, scope, options, startedAt, output, reason) {
+    const result = makeSyntheticResult(provider, scope, startedAt, "failed", reason);
+    appendTelemetry(options.telemetryFile, {
+        event: "qc-provider-execution-failed",
+        run_id: scope.runId,
+        cluster_id: scope.clusterId,
+        provider: provider.name,
+        exit_code: output.exitCode,
+        reason,
+        timestamp: result.completedAt,
+    });
+    return result;
+}
+/**
+ * Execute a provider review command for the given scope.
+ *
+ * Timeouts produce a synthetic "failed" result so that policy logic downstream
+ * can decide whether to block, follow-up, or report passively.
+ */
+async function executeQcProvider(provider, scope, options) {
+    const startedAt = new Date().toISOString();
+    const command = provider.buildReviewCommand(scope);
+    const execFn = options.execFileImpl ?? node_child_process_1.execFile;
+    const timeoutMs = options.timeoutMs ?? 300_000; // 5 minutes default
+    return new Promise((resolve) => {
+        let stdout = "";
+        let stderr = "";
+        const child = execFn(command.command, command.args, {
+            cwd: options.repoRoot,
+            timeout: timeoutMs,
+            encoding: "utf-8",
+            maxBuffer: 50 * 1024 * 1024,
+        }, (error, out, err) => {
+            stdout = out ?? "";
+            stderr = err ?? "";
+            // Detect timeout: execFile kills with SIGTERM on timeout.
+            if (error && error.killed && error.signal === "SIGTERM") {
+                const result = makeSyntheticResult(provider, scope, startedAt, "failed", `QC provider ${provider.name} timed out after ${timeoutMs}ms`);
+                appendTelemetry(options.telemetryFile, {
+                    event: "qc-provider-timeout",
+                    run_id: scope.runId,
+                    cluster_id: scope.clusterId,
+                    provider: provider.name,
+                    timeout_ms: timeoutMs,
+                    timestamp: new Date().toISOString(),
+                });
+                resolve(result);
+                return;
+            }
+            const output = {
+                provider: provider.name,
+                stdout,
+                stderr,
+                exitCode: error ? (typeof error.code === "number" ? error.code : 1) : 0,
+            };
+            try {
+                const parsed = provider.parse(output);
+                const completedAt = new Date().toISOString();
+                const result = {
+                    ...parsed,
+                    qcRunId: `${provider.name}-${Date.now()}`,
+                    runId: scope.runId,
+                    clusterId: scope.clusterId,
+                    trigger: scope.prUrl ? "pr" : scope.branch ? "completed-cluster" : "child",
+                    provider: provider.name,
+                    providerMode: scope.prUrl ? "pr" : "local",
+                    prUrl: scope.prUrl,
+                    startedAt,
+                    completedAt,
+                };
+                appendTelemetry(options.telemetryFile, {
+                    event: "qc-provider-executed",
+                    run_id: scope.runId,
+                    cluster_id: scope.clusterId,
+                    provider: provider.name,
+                    trigger: result.trigger,
+                    status: result.status,
+                    findings_count: result.findings.length,
+                    exit_code: output.exitCode,
+                    timestamp: completedAt,
+                });
+                resolve(result);
+            }
+            catch (parseError) {
+                resolve(resolveExecutionFailure(provider, scope, options, startedAt, output, `QC provider ${provider.name} parse failed: ${parseError instanceof Error ? parseError.message : String(parseError)}`));
+            }
+        });
+    });
+}