@mmnto/cli 1.96.0 → 1.98.0

package/README.md

@@ -1,6 +1,6 @@
 # @mmnto/cli
 
-Command-line interface for [Totem](https://github.com/mmnto-ai/totem), a persistent memory and context layer for AI coding agents. Installs the `totem` binary.
+Command-line interface for [Totem](https://github.com/mmnto-ai/totem) — a local-first, file-anchored substrate that makes AI-agent work queryable, enforceable, and derivable in your codebase. Installs the `totem` binary.
 
 ## Install
 

package/dist/commands/doctor-compliance.d.ts

@@ -0,0 +1,137 @@
+/**
+ * Recall-compliance sensor for `totem doctor --compliance` (ADR-029 minimal
+ * slice, mmnto-ai/totem#2362).
+ *
+ * ADR-029 § 1 "Passive Log Analysis" specifies the telemetry pair by design:
+ * `.totem/.search-log.jsonl` (produced by the MCP `search_knowledge` tool) +
+ * git commit timestamps — write interception was explicitly rejected as too
+ * intrusive. The Compliance Rate (§ 3) is the % of coding sessions in which a
+ * `search_knowledge` call preceded the session's first commit.
+ *
+ * Commit-granularity caveat (§ 1, ruled in on #2362): a search landing between
+ * a file write and its commit still counts as compliant. That is inherent to
+ * the ADR's chosen design and acceptable for a warning-threshold sensor
+ * (Tenet 13) — it is a caveat on the readout, not a rename of the metric.
+ *
+ * Sensor-not-gate (Tenet 13): this command is a pure readout. It never throws,
+ * never sets a non-zero exit code, and is not part of the gating `--strict`
+ * suite — it only ever reports.
+ *
+ * Session model (ADR-029 § 2, verbatim): a coding session is "contiguous
+ * `search_knowledge` calls and git commits occurring within a rolling 2-hour
+ * window" — ONE merged event stream. An intervening commit extends a session
+ * exactly like a search does; search-only clusters with window-attached commits
+ * are NOT equivalent and were reworked out (2026-07-15 panel fold, codex
+ * architecture lens, verified against the ADR text).
+ *
+ * Why the rate is repo-wide only (same fold): commits carry no seat identity —
+ * SHA + timestamp — so a per-seat Compliance Rate would have to guess which
+ * seat's search "owns" a commit, fabricating attribution (Tenet 4).
+ * `agent_source` renders as an attribution-coverage diagnostic (entry counts
+ * per seat; `unattributed` = the ~420 pre-schema entries + hookless sessions),
+ * explicitly not a per-seat rate. The per-seat rate activates when a
+ * commit-side identity primitive exists (ADR-078 boundary / commit-stamped
+ * session ids). `session_id` is stamped by the producer for that same forward
+ * join and is deliberately unused in this windowing — there is nothing
+ * commit-side to join it against yet.
+ *
+ * Known precision limit: a later `git rebase` rewrites commit timestamps, which
+ * retroactively shifts the 2-hour windows a past run computed against — so a
+ * historical Compliance Rate is only as stable as the commit timestamps it read.
+ * This is inherent to the passive-log design (§ 1) and is not corrected here.
+ */
+/** A parsed `.search-log.jsonl` entry — only the fields the metric needs. */
+export interface ComplianceLogEntry {
+    timestamp: string;
+    agent_source: string | null;
+    session_id: string | null;
+}
+/**
+ * The git-history SEAM: a commit's sha + ISO timestamp. The doctor section
+ * supplies this from real git via `readCommitRecords`; tests supply literal
+ * arrays (no git spawn, no temp dirs).
+ */
+export interface CommitRecord {
+    sha: string;
+    timestamp: string;
+}
+/** Rate numerator/denominator. */
+export interface RateStat {
+    /** Counted sessions (coding sessions — windows containing ≥1 commit). */
+    n: number;
+    /** Of `n`, how many had a search precede the window's first commit. */
+    compliant: number;
+}
+export interface ComplianceReport {
+    /** Repo-wide Compliance Rate over merged-stream § 2 windows. */
+    overall: RateStat;
+    /**
+     * Attribution coverage — entry counts per `agent_source` bucket, sorted by
+     * name (`unattributed` = null/pre-schema). A diagnostic, NOT compliance:
+     * commits carry no seat identity, so per-seat rates are non-identifiable
+     * until a commit-side join primitive exists.
+     */
+    coverage: Array<{
+        bucket: string;
+        entries: number;
+    }>;
+    /**
+     * Windows that searched but never committed. Not a coding session per
+     * ADR-029 § 3, so excluded from the denominator — but surfaced so a
+     * search-heavy/commit-light stretch is visible, not hidden.
+     */
+    searchOnlySessions: number;
+    /** Raw count of parsed entries with no `agent_source` (the unattributed backlog). */
+    unattributedEntries: number;
+}
+export interface ParseResult {
+    entries: ComplianceLogEntry[];
+    /** Lines that were non-empty but failed JSON.parse or timestamp validation. */
+    malformedCount: number;
+}
+/**
+ * Parse the raw `.search-log.jsonl` contents. A malformed/corrupt line (bad
+ * JSON, or a missing/unparseable timestamp) is skipped and counted — the
+ * command never crashes on a partial write or a hand-edit (Tenet 13 sensor
+ * pattern: record + continue).
+ */
+export declare function parseSearchLog(content: string): ParseResult;
+/**
+ * Compute the Compliance Rate report from parsed log entries + the commit seam.
+ *
+ * 1. Merge searches + commits into ONE repo-wide event timeline (§ 2 verbatim:
+ *    sessions are contiguous searches AND commits in a rolling 2-hour window —
+ *    an intervening commit extends a session exactly like a search does).
+ * 2. Roll windows: a new session starts when the gap from the previous event
+ *    exceeds 2 hours.
+ * 3. Score each window containing ≥1 commit: compliant iff its earliest search
+ *    precedes its earliest commit (a commit-only window is non-compliant by
+ *    construction). Search-only windows are excluded from the denominator (not
+ *    coding sessions per § 3) but surfaced.
+ * 4. Coverage: entry counts per `agent_source` — a diagnostic, never a rate
+ *    (commits carry no seat identity; see the header).
+ */
+export declare function computeCompliance(entries: ComplianceLogEntry[], commits: CommitRecord[]): ComplianceReport;
+/**
+ * Format a rate for display. Below `MIN_SESSIONS_FOR_RATE` counted sessions
+ * (including n=0), a percentage is meaningless — render the honest
+ * "insufficient data (n=x)" instead (ruled in on #2362: keep the metric name
+ * "Compliance Rate", surface low-n honestly rather than an over-precise %).
+ */
+export declare function formatRate(stat: RateStat): string;
+export interface ComplianceCliOptions {
+    /** Test seam — production callers omit and the command uses `process.cwd()`. */
+    cwdForTest?: string;
+    /** Test seam — inject raw log contents instead of reading `.search-log.jsonl`. */
+    logContentForTest?: string;
+    /** Test seam — inject commits instead of spawning git. */
+    commitsForTest?: CommitRecord[];
+}
+/**
+ * CLI entry — renders the Compliance Rate readout. Pure sensor: never throws
+ * for a compliance verdict, never sets a non-zero exit code (Tenet 13). Absent
+ * log file → the doctor `skip` idiom pointing at the MCP wiring, NOT a fail and
+ * NOT 0%.
+ */
+export declare function doctorComplianceCliCommand(options?: ComplianceCliOptions): Promise<void>;
+//# sourceMappingURL=doctor-compliance.d.ts.map

package/dist/commands/doctor-compliance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-compliance.d.ts","sourceRoot":"","sources":["../../src/commands/doctor-compliance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAqBH,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,kCAAkC;AAClC,MAAM,WAAW,QAAQ;IACvB,yEAAyE;IACzE,CAAC,EAAE,MAAM,CAAC;IACV,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,OAAO,EAAE,QAAQ,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrD;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qFAAqF;IACrF,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,+EAA+E;IAC/E,cAAc,EAAE,MAAM,CAAC;CACxB;AAID;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,CAkC3D;AAUD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,YAAY,EAAE,GACtB,gBAAgB,CAuDlB;AAID;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAIjD;AAmCD,MAAM,WAAW,oBAAoB;IACnC,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0DAA0D;IAC1D,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,IAAI,CAAC,CA6Ef"}

package/dist/commands/doctor-compliance.js

@@ -0,0 +1,286 @@
+/**
+ * Recall-compliance sensor for `totem doctor --compliance` (ADR-029 minimal
+ * slice, mmnto-ai/totem#2362).
+ *
+ * ADR-029 § 1 "Passive Log Analysis" specifies the telemetry pair by design:
+ * `.totem/.search-log.jsonl` (produced by the MCP `search_knowledge` tool) +
+ * git commit timestamps — write interception was explicitly rejected as too
+ * intrusive. The Compliance Rate (§ 3) is the % of coding sessions in which a
+ * `search_knowledge` call preceded the session's first commit.
+ *
+ * Commit-granularity caveat (§ 1, ruled in on #2362): a search landing between
+ * a file write and its commit still counts as compliant. That is inherent to
+ * the ADR's chosen design and acceptable for a warning-threshold sensor
+ * (Tenet 13) — it is a caveat on the readout, not a rename of the metric.
+ *
+ * Sensor-not-gate (Tenet 13): this command is a pure readout. It never throws,
+ * never sets a non-zero exit code, and is not part of the gating `--strict`
+ * suite — it only ever reports.
+ *
+ * Session model (ADR-029 § 2, verbatim): a coding session is "contiguous
+ * `search_knowledge` calls and git commits occurring within a rolling 2-hour
+ * window" — ONE merged event stream. An intervening commit extends a session
+ * exactly like a search does; search-only clusters with window-attached commits
+ * are NOT equivalent and were reworked out (2026-07-15 panel fold, codex
+ * architecture lens, verified against the ADR text).
+ *
+ * Why the rate is repo-wide only (same fold): commits carry no seat identity —
+ * SHA + timestamp — so a per-seat Compliance Rate would have to guess which
+ * seat's search "owns" a commit, fabricating attribution (Tenet 4).
+ * `agent_source` renders as an attribution-coverage diagnostic (entry counts
+ * per seat; `unattributed` = the ~420 pre-schema entries + hookless sessions),
+ * explicitly not a per-seat rate. The per-seat rate activates when a
+ * commit-side identity primitive exists (ADR-078 boundary / commit-stamped
+ * session ids). `session_id` is stamped by the producer for that same forward
+ * join and is deliberately unused in this windowing — there is nothing
+ * commit-side to join it against yet.
+ *
+ * Known precision limit: a later `git rebase` rewrites commit timestamps, which
+ * retroactively shifts the 2-hour windows a past run computed against — so a
+ * historical Compliance Rate is only as stable as the commit timestamps it read.
+ * This is inherent to the passive-log design (§ 1) and is not corrected here.
+ */
+const TAG = 'Compliance';
+/** ADR-029 § 2 rolling session window. */
+const WINDOW_MS = 2 * 60 * 60 * 1000;
+/**
+ * Below this many counted sessions in a bucket, a percentage is statistically
+ * meaningless — render "insufficient data (n=x)" instead of a rate.
+ */
+const MIN_SESSIONS_FOR_RATE = 5;
+/** How far back to read commit history for the metric (bounded to keep the git read cheap). */
+const MAX_COMMITS = 2000;
+/** Bucket name for events with no `agent_source` (legacy + hookless). */
+const UNATTRIBUTED = 'unattributed';
+// ─── Pure: parse ────────────────────────────────────────
+/**
+ * Parse the raw `.search-log.jsonl` contents. A malformed/corrupt line (bad
+ * JSON, or a missing/unparseable timestamp) is skipped and counted — the
+ * command never crashes on a partial write or a hand-edit (Tenet 13 sensor
+ * pattern: record + continue).
+ */
+export function parseSearchLog(content) {
+    const entries = [];
+    let malformedCount = 0;
+    for (const raw of content.split('\n')) {
+        const line = raw.trim();
+        if (line.length === 0)
+            continue;
+        let obj;
+        try {
+            obj = JSON.parse(line);
+            // totem-context: intentional malformed-line tolerance — a corrupt/partial JSONL line is counted (malformedCount surfaces it in the readout) and skipped; the sensor records + continues (Tenet 13), and crashing the doctor on one torn append would be the real degradation.
+        }
+        catch {
+            malformedCount++;
+            continue;
+        }
+        if (typeof obj !== 'object' || obj === null) {
+            malformedCount++;
+            continue;
+        }
+        const rec = obj;
+        const timestamp = rec.timestamp;
+        if (typeof timestamp !== 'string' || !Number.isFinite(Date.parse(timestamp))) {
+            malformedCount++;
+            continue;
+        }
+        entries.push({
+            timestamp,
+            // Absent / non-string / explicit null all normalize to the unattributed bucket.
+            agent_source: typeof rec.agent_source === 'string' ? rec.agent_source : null,
+            session_id: typeof rec.session_id === 'string' ? rec.session_id : null,
+        });
+    }
+    return { entries, malformedCount };
+}
+/**
+ * Compute the Compliance Rate report from parsed log entries + the commit seam.
+ *
+ * 1. Merge searches + commits into ONE repo-wide event timeline (§ 2 verbatim:
+ *    sessions are contiguous searches AND commits in a rolling 2-hour window —
+ *    an intervening commit extends a session exactly like a search does).
+ * 2. Roll windows: a new session starts when the gap from the previous event
+ *    exceeds 2 hours.
+ * 3. Score each window containing ≥1 commit: compliant iff its earliest search
+ *    precedes its earliest commit (a commit-only window is non-compliant by
+ *    construction). Search-only windows are excluded from the denominator (not
+ *    coding sessions per § 3) but surfaced.
+ * 4. Coverage: entry counts per `agent_source` — a diagnostic, never a rate
+ *    (commits carry no seat identity; see the header).
+ */
+export function computeCompliance(entries, commits) {
+    // Coverage diagnostic (per-seat entry counts; null → unattributed).
+    const coverageMap = new Map();
+    let unattributedEntries = 0;
+    for (const e of entries) {
+        const bucket = e.agent_source ?? UNATTRIBUTED;
+        if (e.agent_source === null)
+            unattributedEntries++;
+        coverageMap.set(bucket, (coverageMap.get(bucket) ?? 0) + 1);
+    }
+    // Merged § 2 timeline. Entry timestamps are parse-validated finite; commit
+    // timestamps come from the seam and are filtered here.
+    const events = entries.map((e) => ({
+        ms: Date.parse(e.timestamp),
+        kind: 'search',
+    }));
+    for (const c of commits) {
+        const ms = Date.parse(c.timestamp);
+        if (Number.isFinite(ms))
+            events.push({ ms, kind: 'commit' });
+    }
+    events.sort((a, b) => a.ms - b.ms);
+    // Rolling windows + scoring.
+    const overall = { n: 0, compliant: 0 };
+    let searchOnlySessions = 0;
+    const scoreWindow = (window) => {
+        if (window.length === 0)
+            return;
+        const firstCommit = window.find((ev) => ev.kind === 'commit');
+        if (firstCommit === undefined) {
+            // Searched, never committed — not a coding session (§ 3).
+            searchOnlySessions++;
+            return;
+        }
+        const firstSearch = window.find((ev) => ev.kind === 'search');
+        overall.n++;
+        // Strictly before: § 3 says "preceded" — an equal-timestamp tie does not
+        // demonstrate the search informed the commit, so it does not credit.
+        if (firstSearch !== undefined && firstSearch.ms < firstCommit.ms)
+            overall.compliant++;
+    };
+    let window = [];
+    for (const ev of events) {
+        if (window.length === 0 || ev.ms - window[window.length - 1].ms <= WINDOW_MS) {
+            window.push(ev);
+        }
+        else {
+            scoreWindow(window);
+            window = [ev];
+        }
+    }
+    scoreWindow(window);
+    const coverage = [...coverageMap.entries()]
+        .map(([bucket, count]) => ({ bucket, entries: count }))
+        .sort((a, b) => a.bucket.localeCompare(b.bucket));
+    return { overall, coverage, searchOnlySessions, unattributedEntries };
+}
+// ─── Pure: render helper ────────────────────────────────
+/**
+ * Format a rate for display. Below `MIN_SESSIONS_FOR_RATE` counted sessions
+ * (including n=0), a percentage is meaningless — render the honest
+ * "insufficient data (n=x)" instead (ruled in on #2362: keep the metric name
+ * "Compliance Rate", surface low-n honestly rather than an over-precise %).
+ */
+export function formatRate(stat) {
+    if (stat.n < MIN_SESSIONS_FOR_RATE)
+        return `insufficient data (n=${stat.n})`;
+    const pct = ((stat.compliant / stat.n) * 100).toFixed(0);
+    return `${pct}% (n=${stat.n})`;
+}
+// ─── Git supplier (impure — the seam's production source) ───
+/**
+ * Read recent commits as `(sha, timestamp)[]` for the metric. Best-effort:
+ * any git failure (no repo, no commits, git absent) degrades to an empty array
+ * so the sensor renders "insufficient data" rather than crashing. `%cI` is the
+ * committer date in strict ISO-8601 — the same instant the compliance windows
+ * compare against.
+ */
+async function readCommitRecords(cwd) {
+    const { safeExec } = await import('@mmnto/totem');
+    try {
+        const out = safeExec('git', ['log', `--max-count=${MAX_COMMITS}`, '--format=%H %cI'], {
+            cwd,
+            maxBuffer: 10 * 1024 * 1024,
+        });
+        const records = [];
+        for (const line of out.split('\n')) {
+            const trimmed = line.trim();
+            if (trimmed.length === 0)
+                continue;
+            const sp = trimmed.indexOf(' ');
+            if (sp === -1)
+                continue;
+            records.push({ sha: trimmed.slice(0, sp), timestamp: trimmed.slice(sp + 1).trim() });
+        }
+        return records;
+        // totem-context: best-effort git read — an empty array is the documented "no history / git unavailable" surface for this sensor (Tenet 13), never a crash of the doctor pipeline.
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * CLI entry — renders the Compliance Rate readout. Pure sensor: never throws
+ * for a compliance verdict, never sets a non-zero exit code (Tenet 13). Absent
+ * log file → the doctor `skip` idiom pointing at the MCP wiring, NOT a fail and
+ * NOT 0%.
+ */
+export async function doctorComplianceCliCommand(options = {}) {
+    const fs = await import('node:fs');
+    const path = await import('node:path');
+    const { sanitizeForTerminal } = await import('@mmnto/totem');
+    const { bold, log } = await import('../ui.js');
+    const cwd = options.cwdForTest ?? process.cwd();
+    // Resolve the totemDir from config best-effort; default to `.totem` (mirrors
+    // the other doctor checks, which never hard-fail on a config-less repo).
+    let totemDir = '.totem';
+    try {
+        const { loadConfig, resolveConfigPath } = await import('../utils.js');
+        const config = await loadConfig(resolveConfigPath(cwd));
+        totemDir = config.totemDir;
+        // totem-context: a missing/corrupt config is the honest-absent path (default `.totem`), not a sensor failure — the doctor runs against config-less repos by design.
+    }
+    catch (err) {
+        if (err instanceof Error && err.message.length === 0)
+            throw err;
+    }
+    const logPath = path.join(cwd, totemDir, '.search-log.jsonl');
+    // totemDir is repo-controlled config — sanitize before it reaches a terminal.
+    const displayLogPath = sanitizeForTerminal(path.join(totemDir, '.search-log.jsonl'));
+    let content;
+    if (options.logContentForTest !== undefined) {
+        content = options.logContentForTest;
+    }
+    else if (!fs.existsSync(logPath)) {
+        // Absent log file → skip idiom (NOT a fail, NOT 0%). Point at the producer.
+        log.dim(TAG, `SKIP — no ${displayLogPath} found. The log is produced by the MCP search_knowledge tool; wire the MCP server (.mcp.json) and run some search_knowledge calls, then re-run totem doctor --compliance.`);
+        return;
+    }
+    else {
+        try {
+            content = fs.readFileSync(logPath, 'utf-8');
+            // totem-context: an unreadable search-log is the honest-absent path for this cosmetic sensor — degrade to the skip idiom, never crash the doctor pipeline.
+        }
+        catch {
+            log.dim(TAG, `SKIP — ${displayLogPath} present but unreadable.`);
+            return;
+        }
+    }
+    const { entries, malformedCount } = parseSearchLog(content);
+    const commits = options.commitsForTest ?? (await readCommitRecords(cwd));
+    const report = computeCompliance(entries, commits);
+    // ── Render ──
+    log.info(TAG, bold('Compliance Rate'));
+    log.info(TAG, `repo-wide: ${formatRate(report.overall)}`);
+    // Caveat line (ruled in on #2362) — a caveat, never a rename.
+    log.dim(TAG, 'commit-granularity per ADR-029 § 1');
+    // Coverage is a diagnostic, never a per-seat rate: commits carry no seat
+    // identity, so a seat-partitioned Compliance Rate would fabricate commit
+    // ownership (2026-07-15 panel fold; see the header).
+    if (report.coverage.length > 0) {
+        log.dim(TAG, 'search attribution coverage (diagnostic — not compliance):');
+        for (const { bucket, entries } of report.coverage) {
+            const legacyNote = bucket === UNATTRIBUTED ? ' (legacy / hookless — no agent_source)' : '';
+            log.dim(TAG, `  ${sanitizeForTerminal(bucket)}: ${entries} entr${entries === 1 ? 'y' : 'ies'}${legacyNote}`);
+        }
+    }
+    if (report.searchOnlySessions > 0) {
+        log.dim(TAG, `${report.searchOnlySessions} search-only session(s) excluded (searched, no commit — not a coding session)`);
+    }
+    if (malformedCount > 0) {
+        log.warn(TAG, `${malformedCount} malformed log line(s) skipped`);
+    }
+}
+//# sourceMappingURL=doctor-compliance.js.map

package/dist/commands/doctor-compliance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-compliance.js","sourceRoot":"","sources":["../../src/commands/doctor-compliance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,MAAM,GAAG,GAAG,YAAY,CAAC;AAEzB,0CAA0C;AAC1C,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAErC;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC,+FAA+F;AAC/F,MAAM,WAAW,GAAG,IAAI,CAAC;AAEzB,yEAAyE;AACzE,MAAM,YAAY,GAAG,cAAc,CAAC;AAuDpC,2DAA2D;AAE3D;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvB,8QAA8Q;QAChR,CAAC;QAAC,MAAM,CAAC;YACP,cAAc,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC5C,cAAc,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,GAA8B,CAAC;QAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QAChC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAC7E,cAAc,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,SAAS;YACT,gFAAgF;YAChF,YAAY,EAAE,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;YAC5E,UAAU,EAAE,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;SACvE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AACrC,CAAC;AAUD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA6B,EAC7B,OAAuB;IAEvB,oEAAoE;IACpE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,IAAI,YAAY,CAAC;QAC9C,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI;YAAE,mBAAmB,EAAE,CAAC;QACnD,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,2EAA2E;IAC3E,uDAAuD;IACvD,MAAM,MAAM,GAAkB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChD,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3B,IAAI,EAAE,QAAiB;KACxB,CAAC,CAAC,CAAC;IACJ,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAEnC,6BAA6B;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACjD,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,MAAM,WAAW,GAAG,CAAC,MAAqB,EAAQ,EAAE;QAClD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAC9D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,0DAA0D;YAC1D,kBAAkB,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC,EAAE,CAAC;QACZ,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,EAAE,GAAG,WAAW,CAAC,EAAE;YAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IACxF,CAAC,CAAC;IACF,IAAI,MAAM,GAAkB,EAAE,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,EAAE,IAAI,SAAS,EAAE,CAAC;YAC9E,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,MAAM,CAAC,CAAC;YACpB,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,WAAW,CAAC,MAAM,CAAC,CAAC;IAEpB,MAAM,QAAQ,GAAG,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;SACxC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;SACtD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAEpD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAAC;AACxE,CAAC;AAED,2DAA2D;AAE3D;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,IAAI,IAAI,CAAC,CAAC,GAAG,qBAAqB;QAAE,OAAO,wBAAwB,IAAI,CAAC,CAAC,GAAG,CAAC;IAC7E,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACzD,OAAO,GAAG,GAAG,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC;AACjC,CAAC;AAED,+DAA+D;AAE/D;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAAC,GAAW;IAC1C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,eAAe,WAAW,EAAE,EAAE,iBAAiB,CAAC,EAAE;YACpF,GAAG;YACH,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC;QACH,MAAM,OAAO,GAAmB,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACnC,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAAE,SAAS;YACxB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,OAAO,CAAC;QACf,kLAAkL;IACpL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAaD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,UAAgC,EAAE;IAElC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAE/C,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEhD,6EAA6E;IAC7E,yEAAyE;IACzE,IAAI,QAAQ,GAAG,QAAQ,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,oKAAoK;IACtK,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC9D,8EAA8E;IAC9E,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAErF,IAAI,OAAe,CAAC;IACpB,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACtC,CAAC;SAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,4EAA4E;QAC5E,GAAG,CAAC,GAAG,CACL,GAAG,EACH,aAAa,cAAc,2KAA2K,CACvM,CAAC;QACF,OAAO;IACT,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5C,2JAA2J;QAC7J,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,cAAc,0BAA0B,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEnD,eAAe;IACf,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACvC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAE1D,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAC;IAEnD,yEAAyE;IACzE,yEAAyE;IACzE,qDAAqD;IACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,4DAA4D,CAAC,CAAC;QAC3E,KAAK,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClD,MAAM,UAAU,GAAG,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,GAAG,CACL,GAAG,EACH,KAAK,mBAAmB,CAAC,MAAM,CAAC,KAAK,OAAO,QAAQ,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,UAAU,EAAE,CAC/F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,kBAAkB,GAAG,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,GAAG,CACL,GAAG,EACH,GAAG,MAAM,CAAC,kBAAkB,+EAA+E,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,gCAAgC,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}

package/dist/commands/doctor-compliance.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=doctor-compliance.test.d.ts.map

package/dist/commands/doctor-compliance.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-compliance.test.d.ts","sourceRoot":"","sources":["../../src/commands/doctor-compliance.test.ts"],"names":[],"mappings":""}

package/dist/commands/doctor-compliance.test.js

@@ -0,0 +1,197 @@
+import { describe, expect, it } from 'vitest';
+import { computeCompliance, formatRate, parseSearchLog, } from './doctor-compliance.js';
+// ─── Fixture helpers (pure — no fs, no git, no temp dirs) ───
+const H = 60 * 60 * 1000;
+const MIN = 60 * 1000;
+const BASE = Date.parse('2026-07-15T10:00:00.000Z');
+const iso = (ms) => new Date(ms).toISOString();
+function entry(offsetMs, agent_source = null, session_id = null) {
+    return { timestamp: iso(BASE + offsetMs), agent_source, session_id };
+}
+function commit(offsetMs, sha = `sha-${offsetMs}`) {
+    return { sha, timestamp: iso(BASE + offsetMs) };
+}
+/** Coverage entry-count for a bucket (undefined when the bucket is absent). */
+function coverage(report, name) {
+    return report.coverage.find((c) => c.bucket === name)?.entries;
+}
+/** Raw overall rate for the algebraic invariants (compliant / n). */
+function rate(report) {
+    return report.overall.n === 0 ? 0 : report.overall.compliant / report.overall.n;
+}
+/** Invariant: the overall stat satisfies 0 ≤ compliant ≤ n (⇒ 0 ≤ rate ≤ 1). */
+function assertRateBounds(report) {
+    expect(report.overall.n).toBeGreaterThanOrEqual(0);
+    expect(report.overall.compliant).toBeGreaterThanOrEqual(0);
+    expect(report.overall.compliant).toBeLessThanOrEqual(report.overall.n);
+}
+// ─── parseSearchLog ─────────────────────────────────────
+describe('parseSearchLog', () => {
+    it('empty log → no entries, no malformed', () => {
+        expect(parseSearchLog('')).toEqual({ entries: [], malformedCount: 0 });
+    });
+    it('single-entry log parses one entry', () => {
+        const line = JSON.stringify({ timestamp: iso(BASE), agent_source: 'claude' });
+        const result = parseSearchLog(line);
+        expect(result.entries).toHaveLength(1);
+        expect(result.entries[0].agent_source).toBe('claude');
+        expect(result.malformedCount).toBe(0);
+    });
+    it('skips a corrupt JSONL line with a warn count, still parses the rest', () => {
+        const good1 = JSON.stringify({ timestamp: iso(BASE), agent_source: 'claude' });
+        const good2 = JSON.stringify({ timestamp: iso(BASE + H), agent_source: 'gemini' });
+        const content = [good1, '{ this is not valid json', good2].join('\n');
+        const result = parseSearchLog(content);
+        expect(result.entries).toHaveLength(2);
+        expect(result.malformedCount).toBe(1);
+    });
+    it('treats a line with a missing/unparseable timestamp as malformed', () => {
+        const noTs = JSON.stringify({ agent_source: 'claude' });
+        const badTs = JSON.stringify({ timestamp: 'not-a-date', agent_source: 'claude' });
+        const result = parseSearchLog([noTs, badTs].join('\n'));
+        expect(result.entries).toHaveLength(0);
+        expect(result.malformedCount).toBe(2);
+    });
+    it('absent agent_source normalizes to null (→ unattributed at compute time)', () => {
+        const line = JSON.stringify({ timestamp: iso(BASE) });
+        const result = parseSearchLog(line);
+        expect(result.entries[0].agent_source).toBeNull();
+    });
+});
+// ─── computeCompliance — the merged-stream § 2 lock set ─
+describe('computeCompliance', () => {
+    it('search-only window (no commits) → excluded from the rate, surfaced', () => {
+        const report = computeCompliance([entry(0, 'claude')], []);
+        expect(report.overall.n).toBe(0);
+        expect(report.searchOnlySessions).toBe(1);
+        assertRateBounds(report);
+    });
+    it('commits with no preceding search → one non-compliant window', () => {
+        const report = computeCompliance([], [commit(0), commit(30 * MIN)]);
+        // Two commits 30m apart roll into one commit-only window.
+        expect(report.overall).toEqual({ n: 1, compliant: 0 });
+        assertRateBounds(report);
+    });
+    it('search before commit in one window → compliant', () => {
+        const report = computeCompliance([entry(0, 'claude')], [commit(30 * MIN)]);
+        expect(report.overall).toEqual({ n: 1, compliant: 1 });
+        assertRateBounds(report);
+    });
+    it('clock skew (commit precedes the search in the same window) → non-compliant', () => {
+        const report = computeCompliance([entry(0, 'claude')], [commit(-1 * H)]);
+        expect(report.overall).toEqual({ n: 1, compliant: 0 });
+        assertRateBounds(report);
+    });
+    it('equal search/commit timestamps do NOT credit ("preceded" per § 3 is strict)', () => {
+        const report = computeCompliance([entry(0, 'claude')], [commit(0)]);
+        expect(report.overall).toEqual({ n: 1, compliant: 0 });
+        assertRateBounds(report);
+    });
+    it('§ 2 merged stream: an intervening commit EXTENDS the session', () => {
+        // search t0 · commit +1.5h · commit +3h — each gap ≤ 2h through the merged
+        // stream, so this is ONE session and the t0 search covers it (compliant).
+        // Under search-only clustering with window-attach this would split; this
+        // test locks the merged § 2 semantics (2026-07-15 panel fold).
+        const report = computeCompliance([entry(0, 'claude')], [commit(90 * MIN), commit(180 * MIN)]);
+        expect(report.overall).toEqual({ n: 1, compliant: 1 });
+        expect(report.searchOnlySessions).toBe(0);
+        assertRateBounds(report);
+    });
+    it('the same events WITHOUT the bridging commit split at the 2h gap', () => {
+        // search t0 · commit +3h — the 3h gap splits the stream: a search-only
+        // window plus a non-compliant commit-only window.
+        const report = computeCompliance([entry(0, 'claude')], [commit(180 * MIN)]);
+        expect(report.overall).toEqual({ n: 1, compliant: 0 });
+        expect(report.searchOnlySessions).toBe(1);
+        assertRateBounds(report);
+    });
+    it('UTC/ISO parsing discipline — offset and Z timestamps compare on the same instant', () => {
+        const offsetSearch = {
+            timestamp: '2026-07-15T12:00:00+02:00', // = 10:00Z
+            agent_source: 'claude',
+            session_id: null,
+        };
+        const zCommit = { sha: 'z', timestamp: '2026-07-15T10:30:00Z' };
+        const report = computeCompliance([offsetSearch], [zCommit]);
+        expect(report.overall).toEqual({ n: 1, compliant: 1 });
+        assertRateBounds(report);
+    });
+    it('empty log + no commits → nothing counted', () => {
+        const report = computeCompliance([], []);
+        expect(report.overall).toEqual({ n: 0, compliant: 0 });
+        expect(report.coverage).toEqual([]);
+        assertRateBounds(report);
+    });
+    it('attribution does NOT change the repo-wide rate (identical timelines, different seats)', () => {
+        // Commits carry no seat identity, so seat labels must be rate-inert: the
+        // same instants produce the same overall stat whether entries are
+        // attributed, mixed, or all unattributed.
+        const times = [
+            [0, 'claude'],
+            [10 * MIN, 'gemini'],
+            [15 * MIN, 'claude'],
+            [130 * MIN, null],
+        ];
+        const commits = [commit(30 * MIN), commit(180 * MIN)];
+        const attributed = computeCompliance(times.map(([ms, seat]) => entry(ms, seat)), commits);
+        const unattributed = computeCompliance(times.map(([ms]) => entry(ms, null)), commits);
+        expect(attributed.overall).toEqual(unattributed.overall);
+        expect(attributed.searchOnlySessions).toBe(unattributed.searchOnlySessions);
+        assertRateBounds(attributed);
+    });
+    it('coverage counts entries per seat; null lands in the unattributed bucket', () => {
+        const report = computeCompliance([entry(0, 'totem-claude'), entry(5 * MIN, 'totem-claude'), entry(10 * MIN, null)], [commit(30 * MIN)]);
+        expect(coverage(report, 'totem-claude')).toBe(2);
+        expect(coverage(report, 'unattributed')).toBe(1);
+        expect(report.unattributedEntries).toBe(1);
+        // Sorted by bucket name.
+        expect(report.coverage.map((c) => c.bucket)).toEqual(['totem-claude', 'unattributed']);
+    });
+    it('session_id is deliberately inert in the windowing (no commit-side join exists)', () => {
+        // Two searches sharing a session_id 5h apart do NOT bridge the 2h gap:
+        // the stamp is a forward primitive for the commit-side join, not a
+        // windowing input in the minimal slice (see the module header).
+        const report = computeCompliance([entry(0, 'claude', 'sid-1'), entry(5 * H, 'claude', 'sid-1')], [commit(30 * MIN)]);
+        expect(report.overall).toEqual({ n: 1, compliant: 1 }); // first window: search+commit
+        expect(report.searchOnlySessions).toBe(1); // the 5h-later search stands alone
+        assertRateBounds(report);
+    });
+});
+// ─── Algebraic invariants ───────────────────────────────
+describe('algebraic invariants', () => {
+    it('rate always sits in [0, 1] across a mixed fixture', () => {
+        const entries = [
+            entry(0, 'claude'),
+            entry(5 * H, 'claude'),
+            entry(0, 'gemini'),
+        ];
+        const commits = [commit(30 * MIN), commit(4 * H), commit(10 * MIN)];
+        assertRateBounds(computeCompliance(entries, commits));
+    });
+    it('adding a compliant session never lowers the rate', () => {
+        // Base: one compliant window + one non-compliant commit-only window.
+        const baseEntries = [entry(0, 'claude')];
+        const baseCommits = [commit(30 * MIN), commit(6 * H)];
+        const before = computeCompliance(baseEntries, baseCommits);
+        expect(rate(before)).toBeCloseTo(0.5, 5);
+        // Add one clearly-compliant far-future window (search then commit).
+        const afterEntries = [...baseEntries, entry(20 * H, 'claude')];
+        const afterCommits = [...baseCommits, commit(20 * H + 30 * MIN)];
+        const after = computeCompliance(afterEntries, afterCommits);
+        expect(rate(after)).toBeGreaterThanOrEqual(rate(before));
+        assertRateBounds(after);
+    });
+});
+// ─── formatRate ─────────────────────────────────────────
+describe('formatRate', () => {
+    it('renders "insufficient data (n=x)" below the sample floor', () => {
+        expect(formatRate({ n: 0, compliant: 0 })).toBe('insufficient data (n=0)');
+        expect(formatRate({ n: 4, compliant: 4 })).toBe('insufficient data (n=4)');
+    });
+    it('renders a percentage at or above the sample floor (name stays "Compliance Rate")', () => {
+        expect(formatRate({ n: 5, compliant: 4 })).toBe('80% (n=5)');
+        expect(formatRate({ n: 10, compliant: 10 })).toBe('100% (n=10)');
+        expect(formatRate({ n: 8, compliant: 0 })).toBe('0% (n=8)');
+    });
+});
+//# sourceMappingURL=doctor-compliance.test.js.map