@moda-ai/cli 1.22.1 → 1.22.2

package/dist/harness-report.js

@@ -1,1579 +0,0 @@
-import { createHash } from 'node:crypto';
-import { existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync, } from 'node:fs';
-import { basename, dirname, join, relative, resolve } from 'node:path';
-import { confirm } from '@inquirer/prompts';
-import { CliInputError } from './errors.js';
-export const HARNESS_REPORT_SCHEMA_VERSION = 'harness_report.v0.1';
-export const HARNESS_REPORT_VALIDATION_SCHEMA_VERSION = 'harness_report_validation.v0.1';
-export const HARNESS_REPORT_APPROVAL_SCHEMA_VERSION = 'harness_report_approval.v0.1';
-export const HARNESS_REPORT_PATH = join('.moda', 'harness-report.json');
-export const HARNESS_REPORT_MARKDOWN_PATH = join('.moda', 'HARNESS_REPORT.md');
-export const HARNESS_REPORT_VALIDATION_PATH = join('.moda', 'harness-report-validation.json');
-export const HARNESS_REPORT_APPROVAL_PATH = join('.moda', 'harness-report-approval.json');
-const HARNESS_GRAPH_ARRAY_FIELDS = [
-    'agentFamilies',
-    'runtimeAgents',
-    'developerAgentAdapters',
-    'channelAdapters',
-    'artifacts',
-    'identityNamespaces',
-    'environments',
-    'agentFrameworks',
-    'modelProviders',
-    'deployments',
-    'relationships',
-    'unknowns',
-];
-const HARNESS_REPORT_SUMMARY_FIELDS = [
-    'runtimeAgentCount',
-    'agentFamilyCount',
-    'artifactCount',
-    'sharedArtifactCount',
-    'channelAdapterCount',
-    'identityNamespaceCount',
-    'environmentCount',
-    'agentFrameworkCount',
-    'modelProviderCount',
-    'deploymentCount',
-    'relationshipCount',
-    'unknownCount',
-];
-const HARNESS_REPORT_CITATION_TYPES = new Set([
-    'file',
-    'generated_doc',
-    'command_output',
-    'production_evidence',
-]);
-// Raised from 1.5 MB to 12 MB so artifacts can carry their full usable content
-// (prompt bodies, tool signatures/docstrings, guardrail rules) for downstream
-// prompt/tool optimization — not just location metadata.
-const MAX_HARNESS_REPORT_BYTES = 12_000_000;
-const MAX_HARNESS_REPORT_CLAIMS = 250;
-const MAX_HARNESS_REPORT_CITATIONS = 400;
-const MAX_HARNESS_REPORT_SUMMARY_LENGTH = 1_200;
-export function createHarnessReport(options) {
-    const adapter = options.analystAdapter && options.analystAdapter !== 'true'
-        ? options.analystAdapter
-        : 'local-scan';
-    if (adapter !== 'local-scan' && adapter !== 'moda' && adapter !== 'local' && adapter !== 'scripted') {
-        throw new CliInputError(`Analyst adapter '${adapter}' is not implemented in this CLI build yet.`, 'Use `moda harness analyze --analyst=claude|codex|cursor`, or `--analyst=local-scan` for the deterministic fallback.');
-    }
-    const normalizedAdapter = adapter === 'moda' || adapter === 'local' || adapter === 'scripted'
-        ? 'local-scan'
-        : adapter;
-    const citations = [];
-    const citationIndex = new Map();
-    const claimBuilders = [];
-    const citationIdsForEvidence = (evidence) => evidence
-        .map((item) => upsertCitation(citations, citationIndex, item, options.rootDir))
-        .filter((id) => Boolean(id));
-    for (const agent of options.graph.runtimeAgents) {
-        const citationIds = citationIdsForEvidence(agent.evidence);
-        claimBuilders.push({
-            id: stableId('claim', `runtime-agent:${agent.id}`),
-            kind: 'runtime_agent',
-            subjectId: agent.id,
-            title: agent.name,
-            summary: `${agent.name} is a runtime agent rooted at ${agent.root}.`,
-            confidence: agent.confidence,
-            inference: inferenceFromConfidence(agent.confidence),
-            citationIds,
-        });
-    }
-    for (const family of options.graph.agentFamilies) {
-        const citationIds = citationIdsForEvidence(family.evidence);
-        claimBuilders.push({
-            id: stableId('claim', `agent-family:${family.id}`),
-            kind: 'agent_family',
-            subjectId: family.id,
-            title: family.name,
-            summary: `${family.name} groups ${family.runtimeAgentIds.length} runtime agent(s) and ${family.sharedArtifactIds.length} shared artifact(s).`,
-            confidence: family.confidence,
-            inference: inferenceFromConfidence(family.confidence),
-            citationIds,
-        });
-    }
-    for (const artifact of options.graph.artifacts) {
-        const citationIds = citationIdsForEvidence(artifact.evidence);
-        claimBuilders.push({
-            id: stableId('claim', `artifact:${artifact.id}`),
-            kind: 'artifact',
-            subjectId: artifact.id,
-            title: artifact.name,
-            summary: `${artifact.name} is a ${artifact.scope} ${artifact.type} artifact${artifact.sourcePath ? ` at ${artifact.sourcePath}` : ''}.`,
-            confidence: artifact.confidence,
-            inference: inferenceFromConfidence(artifact.confidence),
-            citationIds,
-        });
-    }
-    for (const channel of options.graph.channelAdapters) {
-        const citationIds = citationIdsForEvidence(channel.evidence);
-        claimBuilders.push({
-            id: stableId('claim', `channel:${channel.id}`),
-            kind: 'channel_adapter',
-            subjectId: channel.id,
-            title: channel.name,
-            summary: `${channel.name} is a ${channel.kind} channel adapter.`,
-            confidence: channel.confidence,
-            inference: inferenceFromConfidence(channel.confidence),
-            citationIds,
-        });
-    }
-    for (const adapter of options.graph.developerAgentAdapters) {
-        const citationIds = citationIdsForEvidence(adapter.evidence);
-        claimBuilders.push({
-            id: stableId('claim', `developer-adapter:${adapter.id}`),
-            kind: 'developer_agent_adapter',
-            subjectId: adapter.id,
-            title: adapter.name,
-            summary: `${adapter.name} is developer-agent guidance at ${adapter.sourcePath}.`,
-            confidence: adapter.confidence,
-            inference: inferenceFromConfidence(adapter.confidence),
-            citationIds,
-        });
-    }
-    for (const identity of options.graph.identityNamespaces) {
-        const citationIds = citationIdsForEvidence(identity.evidence);
-        claimBuilders.push({
-            id: stableId('claim', `identity:${identity.id}`),
-            kind: 'identity_namespace',
-            subjectId: identity.id,
-            title: identity.name,
-            summary: `${identity.name} is a ${identity.kind} identity namespace${identity.canonicalId ? ` resolving to ${identity.canonicalId}` : ''}.`,
-            confidence: identity.confidence,
-            inference: inferenceFromConfidence(identity.confidence),
-            citationIds,
-        });
-    }
-    for (const environment of options.graph.environments) {
-        const citationIds = citationIdsForEvidence(environment.evidence);
-        claimBuilders.push({
-            id: stableId('claim', `environment:${environment.id}`),
-            kind: 'environment',
-            subjectId: environment.id,
-            title: environment.name,
-            summary: `${environment.name} is a ${environment.kind} environment.`,
-            confidence: environment.confidence,
-            inference: inferenceFromConfidence(environment.confidence),
-            citationIds,
-        });
-    }
-    for (const framework of options.graph.agentFrameworks) {
-        const citationIds = citationIdsForEvidence(framework.evidence);
-        claimBuilders.push({
-            id: stableId('claim', `framework:${framework.id}`),
-            kind: 'agent_framework',
-            subjectId: framework.id,
-            title: framework.name,
-            summary: `${framework.name} appears to be used as an agent framework.`,
-            confidence: framework.confidence,
-            inference: 'mixed',
-            citationIds,
-        });
-    }
-    for (const provider of options.graph.modelProviders) {
-        const citationIds = citationIdsForEvidence(provider.evidence);
-        claimBuilders.push({
-            id: stableId('claim', `provider:${provider.id}`),
-            kind: 'model_provider',
-            subjectId: provider.id,
-            title: provider.name,
-            summary: `${provider.name} appears to be used as a model provider.`,
-            confidence: provider.confidence,
-            inference: 'mixed',
-            citationIds,
-        });
-    }
-    for (const deployment of options.graph.deployments) {
-        const citationIds = citationIdsForEvidence(deployment.evidence);
-        claimBuilders.push({
-            id: stableId('claim', `deployment:${deployment.id}`),
-            kind: 'deployment',
-            subjectId: deployment.id,
-            title: deployment.name,
-            summary: `${deployment.name} appears to be a deployment or CI artifact.`,
-            confidence: deployment.confidence,
-            inference: inferenceFromConfidence(deployment.confidence),
-            citationIds,
-        });
-    }
-    for (const relationship of options.graph.relationships) {
-        const citationIds = citationIdsForEvidence(relationship.evidence);
-        claimBuilders.push({
-            id: stableId('claim', `relationship:${relationship.type}:${relationship.from}:${relationship.to}:${relationship.artifactId ?? ''}`),
-            kind: 'relationship',
-            subjectId: `${relationship.from}->${relationship.to}`,
-            title: titleFromId(relationship.type),
-            summary: `${relationship.from} ${relationship.type.replace(/_/g, ' ')} ${relationship.to}.`,
-            confidence: citationIds.length > 0 ? 0.76 : 0.4,
-            inference: 'mixed',
-            citationIds,
-        });
-    }
-    const unknowns = options.graph.unknowns.map((unknown) => ({
-        id: unknown.id,
-        question: unknown.question,
-        citationIds: citationIdsForEvidence(unknown.evidence),
-    }));
-    for (const unknown of options.graph.unknowns) {
-        const citationIds = citationIdsForEvidence(unknown.evidence);
-        claimBuilders.push({
-            id: stableId('claim', `unknown:${unknown.id}`),
-            kind: 'unknown',
-            subjectId: unknown.id,
-            title: 'Open Question',
-            summary: unknown.question,
-            confidence: 0.2,
-            inference: 'inferred',
-            citationIds,
-        });
-    }
-    const graphHash = hashStableJson(graphForReport(options.graph));
-    const limitedEvidence = limitReportEvidence(claimBuilders
-        .filter((claim) => claim.citationIds.length > 0)
-        .sort((a, b) => a.id.localeCompare(b.id)), citations.sort((a, b) => a.id.localeCompare(b.id)));
-    const keptCitationIds = new Set(limitedEvidence.citations.map((citation) => citation.id));
-    const limitedUnknowns = unknowns.map((unknown) => ({
-        ...unknown,
-        citationIds: unknown.citationIds.filter((citationId) => keptCitationIds.has(citationId)),
-    }));
-    return {
-        schemaVersion: HARNESS_REPORT_SCHEMA_VERSION,
-        reportId: stableId('hreport', `${options.graph.harnessId}:${graphHash}`),
-        harnessId: options.graph.harnessId,
-        createdAt: new Date().toISOString(),
-        analyst: {
-            id: 'moda-local-scanner',
-            adapter: normalizedAdapter,
-            mode: 'local',
-            version: 'moda-cli',
-        },
-        repo: options.graph.repo,
-        tenant: options.graph.tenant,
-        source: {
-            graphSchemaVersion: options.graph.schemaVersion,
-            graphHash,
-            sourceCommit: options.sourceCommit,
-            readPlan: options.graph.scan.readPlan,
-            deterministicInventory: true,
-        },
-        summary: summarizeGraph(options.graph),
-        graph: options.graph,
-        claims: limitedEvidence.claims,
-        citations: limitedEvidence.citations,
-        syncPlan: {
-            command: `moda harness sync --from-report ${HARNESS_REPORT_PATH}`,
-            dryRunCommand: `moda harness sync --from-report ${HARNESS_REPORT_PATH} --dry-run`,
-            uploads: [
-                'approved harness report',
-                'sanitized harness graph metadata',
-                'citation metadata',
-                'graph and report hashes',
-            ],
-            privacy: [
-                'does not upload broad source content by default',
-                'secret-looking files are rejected as citations',
-                'citations point to local paths and bounded excerpts',
-            ],
-        },
-        unknowns: limitedUnknowns,
-    };
-}
-export function validateHarnessReport(report, rootDir) {
-    const checks = [];
-    const errors = [];
-    const warnings = [];
-    const check = (id, pass, message) => {
-        checks.push({ id, status: pass ? 'pass' : 'fail', message });
-        if (!pass)
-            errors.push(message);
-    };
-    const warn = (id, message) => {
-        checks.push({ id, status: 'warning', message });
-        warnings.push(message);
-    };
-    check('schema_version', report?.schemaVersion === HARNESS_REPORT_SCHEMA_VERSION, `Report schema must be ${HARNESS_REPORT_SCHEMA_VERSION}.`);
-    check('report_id', typeof report?.reportId === 'string' && report.reportId.length > 0, 'Report must include reportId.');
-    check('harness_id', typeof report?.harnessId === 'string' && report.harnessId.length > 0, 'Report must include harnessId.');
-    check('graph_present', Boolean(report?.graph?.schemaVersion), 'Report must include the sanitized harness graph.');
-    check('citations_present', Array.isArray(report?.citations) && report.citations.length > 0, 'Report must include citations.');
-    check('claims_present', Array.isArray(report?.claims) && report.claims.length > 0, 'Report must include claims.');
-    const syncPlan = isRecord(report?.syncPlan) ? report.syncPlan : undefined;
-    check('sync_plan_present', Boolean(syncPlan), 'Report must include syncPlan.');
-    if (syncPlan) {
-        check('sync_plan_command', typeof syncPlan.command === 'string' && syncPlan.command.length > 0, 'Report syncPlan must include command.');
-        check('sync_plan_dry_run_command', typeof syncPlan.dryRunCommand === 'string' && syncPlan.dryRunCommand.length > 0, 'Report syncPlan must include dryRunCommand.');
-        check('sync_plan_uploads', Array.isArray(syncPlan.uploads), 'Report syncPlan uploads must be an array.');
-        check('sync_plan_privacy', Array.isArray(syncPlan.privacy), 'Report syncPlan privacy must be an array.');
-    }
-    const reportBytes = Buffer.byteLength(JSON.stringify(report ?? null), 'utf8');
-    check('report_size_bounded', reportBytes <= MAX_HARNESS_REPORT_BYTES, `Harness report must stay under ${MAX_HARNESS_REPORT_BYTES} bytes; got ${reportBytes}.`);
-    if (Array.isArray(report?.claims)) {
-        check('claim_count_bounded', report.claims.length <= MAX_HARNESS_REPORT_CLAIMS, `Harness report must include at most ${MAX_HARNESS_REPORT_CLAIMS} claims; got ${report.claims.length}.`);
-    }
-    if (Array.isArray(report?.citations)) {
-        check('citation_count_bounded', report.citations.length <= MAX_HARNESS_REPORT_CITATIONS, `Harness report must include at most ${MAX_HARNESS_REPORT_CITATIONS} citations; got ${report.citations.length}.`);
-    }
-    if (report?.graph && typeof report.graph === 'object') {
-        check('graph_schema_version', report.graph.schemaVersion === 'harness.v0.1', 'Graph schemaVersion must be harness.v0.1.');
-        for (const field of HARNESS_GRAPH_ARRAY_FIELDS) {
-            check(`graph_${field}_array`, Array.isArray(report.graph[field]), `Graph field ${field} must be an array.`);
-        }
-        validateGraphItemShapes(report.graph, errors);
-        validateCaptureQuality(report.graph, warn);
-    }
-    if (report?.summary && typeof report.summary === 'object') {
-        for (const field of HARNESS_REPORT_SUMMARY_FIELDS) {
-            check(`summary_${field}_number`, typeof report.summary[field] === 'number', `Report summary field ${field} must be a number.`);
-        }
-        if (report?.graph && typeof report.graph === 'object') {
-            validateSummaryMatchesGraph(report.summary, report.graph, check);
-        }
-    }
-    else {
-        check('summary_present', false, 'Report must include a numeric summary object.');
-    }
-    const citations = Array.isArray(report?.citations) ? report.citations : [];
-    const citationIds = new Set();
-    const requireLineCitations = report?.analyst?.mode === 'agent';
-    for (const [index, citation] of citations.entries()) {
-        const label = citationLabel(citation, index);
-        if (!isRecord(citation)) {
-            errors.push(`Citation ${index + 1} must be an object.`);
-            continue;
-        }
-        if (typeof citation.type !== 'string' || !HARNESS_REPORT_CITATION_TYPES.has(citation.type)) {
-            errors.push(`Citation ${label} has unsupported type ${String(citation.type)}.`);
-        }
-        if (typeof citation.id !== 'string' || citation.id.length === 0) {
-            errors.push(`Citation ${index + 1} must include a string id.`);
-        }
-        else if (citationIds.has(citation.id)) {
-            errors.push(`Duplicate citation id ${citation.id}.`);
-        }
-        else {
-            citationIds.add(citation.id);
-        }
-        if (typeof citation.reason !== 'string' || citation.reason.length === 0) {
-            errors.push(`Citation ${label} must include a reason.`);
-        }
-        if (requiresLocalCitationPath(citation.type) && (typeof citation.path !== 'string' || citation.path.length === 0)) {
-            errors.push(`Citation ${label} must include a file path.`);
-            continue;
-        }
-        validateCitation(citation, rootDir, errors, warnings, { requireLine: requireLineCitations });
-    }
-    const claims = Array.isArray(report?.claims) ? report.claims : [];
-    const claimIds = new Set();
-    for (const [index, claim] of claims.entries()) {
-        const label = claimLabel(claim, index);
-        if (!isRecord(claim)) {
-            errors.push(`Claim ${index + 1} must be an object.`);
-            continue;
-        }
-        if (typeof claim.id !== 'string' || claim.id.length === 0) {
-            errors.push(`Claim ${index + 1} must include a string id.`);
-        }
-        else if (claimIds.has(claim.id)) {
-            errors.push(`Duplicate claim id ${claim.id}.`);
-        }
-        else {
-            claimIds.add(claim.id);
-        }
-        if (typeof claim.kind !== 'string' || claim.kind.length === 0) {
-            errors.push(`Claim ${label} must include kind.`);
-        }
-        else if (!isValidClaimKind(claim.kind)) {
-            errors.push(`Claim ${label} has unsupported kind ${claim.kind}.`);
-        }
-        if (typeof claim.subjectId !== 'string' || claim.subjectId.length === 0) {
-            errors.push(`Claim ${label} must include subjectId.`);
-        }
-        else if (report?.graph && typeof claim.kind === 'string' && isValidClaimKind(claim.kind)) {
-            validateClaimSubjectExists(report.graph, claim, errors, warnings);
-        }
-        if (typeof claim.title !== 'string' || claim.title.length === 0) {
-            errors.push(`Claim ${label} must include title.`);
-        }
-        if (typeof claim.summary !== 'string' || claim.summary.length === 0) {
-            errors.push(`Claim ${label} must include summary.`);
-        }
-        else if (claim.summary.length > MAX_HARNESS_REPORT_SUMMARY_LENGTH) {
-            errors.push(`Claim ${label} summary is too long; keep claims under ${MAX_HARNESS_REPORT_SUMMARY_LENGTH} characters.`);
-        }
-        if (typeof claim.confidence !== 'number' || !Number.isFinite(claim.confidence)) {
-            errors.push(`Claim ${label} confidence must be a number between 0 and 1.`);
-        }
-        else if (claim.confidence < 0 || claim.confidence > 1) {
-            errors.push(`Claim ${label} confidence must be between 0 and 1.`);
-        }
-        if (typeof claim.inference !== 'string' || !['direct', 'inferred', 'mixed'].includes(claim.inference)) {
-            errors.push(`Claim ${label} inference must be direct, inferred, or mixed.`);
-        }
-        else if (typeof claim.confidence === 'number' && claim.confidence >= 0.9 && claim.inference !== 'direct') {
-            errors.push(`Claim ${label} has high confidence but inference=${claim.inference}; high-confidence claims must be directly cited.`);
-        }
-        if (!Array.isArray(claim.citationIds)) {
-            errors.push(`Claim ${label} citationIds must be an array.`);
-            continue;
-        }
-        if (claim.citationIds.length === 0) {
-            errors.push(`Claim ${label} has no citations.`);
-            continue;
-        }
-        const claimCitationIds = new Set();
-        for (const citationId of claim.citationIds) {
-            if (typeof citationId !== 'string') {
-                errors.push(`Claim ${label} references a non-string citation id.`);
-                continue;
-            }
-            if (claimCitationIds.has(citationId)) {
-                errors.push(`Claim ${label} references duplicate citation ${citationId}.`);
-            }
-            claimCitationIds.add(citationId);
-            if (!citationIds.has(citationId)) {
-                errors.push(`Claim ${label} references missing citation ${citationId}.`);
-            }
-        }
-    }
-    validateClaimQuality(claims, report?.graph, warn);
-    if (report.source?.graphHash && report.graph) {
-        const actualGraphHash = hashStableJson(graphForReport(report.graph));
-        check('graph_hash', report.source.graphHash === actualGraphHash, 'Report source graph hash must match the embedded graph.');
-    }
-    const unknowns = Array.isArray(report?.unknowns) ? report.unknowns : [];
-    if (unknowns.length > 0) {
-        warn('unknowns_present', `${unknowns.length} open harness question(s) require human review.`);
-        for (const [index, unknown] of unknowns.entries()) {
-            if (!isRecord(unknown)) {
-                errors.push(`Unknown ${index + 1} must be an object.`);
-                continue;
-            }
-            if (!Array.isArray(unknown.citationIds) || unknown.citationIds.length === 0) {
-                warnings.push(`Unknown ${unknown.id ?? index + 1} has no citations.`);
-                continue;
-            }
-            for (const citationId of unknown.citationIds) {
-                if (typeof citationId === 'string' && !citationIds.has(citationId)) {
-                    errors.push(`Unknown ${unknown.id ?? index + 1} references missing citation ${citationId}.`);
-                }
-            }
-        }
-    }
-    return {
-        schemaVersion: HARNESS_REPORT_VALIDATION_SCHEMA_VERSION,
-        reportId: report?.reportId ?? 'unknown',
-        reportHash: hashHarnessReport(report),
-        status: errors.length === 0 ? 'pass' : 'fail',
-        checkedAt: new Date().toISOString(),
-        checks,
-        errors,
-        warnings,
-    };
-}
-export async function approveHarnessReport(options) {
-    const report = readHarnessReport(options.reportPath);
-    const validation = validateHarnessReport(report, options.rootDir);
-    if (validation.status !== 'pass') {
-        throw new CliInputError('Harness report validation failed; cannot approve.', validation.errors.slice(0, 5).join('\n'));
-    }
-    let approvedBy = '--yes';
-    if (!options.yes) {
-        if (!options.interactive || process.stdin.isTTY !== true) {
-            throw new CliInputError('Harness report approval requires an interactive confirmation or --yes.', 'Review the report, then run `moda harness approve --yes`.');
-        }
-        const approved = await confirm({
-            message: [
-                'Approve this harness report for Moda sync?',
-                `${report.summary.runtimeAgentCount} runtime agent(s), ${report.summary.artifactCount} artifact(s), ${report.claims.length} cited claim(s).`,
-            ].join(' '),
-            default: false,
-        });
-        if (!approved) {
-            throw new CliInputError('Harness report was not approved.', 'No sync approval was written. Run `moda harness analyze --analyst=claude|codex|cursor --summary` to request another analyst pass, or edit the report and rerun `moda harness validate-report`.');
-        }
-        approvedBy = 'local-human';
-    }
-    const approval = {
-        schemaVersion: HARNESS_REPORT_APPROVAL_SCHEMA_VERSION,
-        reportId: report.reportId,
-        reportHash: hashHarnessReport(report),
-        approved: true,
-        approvedAt: new Date().toISOString(),
-        approvedBy,
-        reportPath: normalizePath(relative(options.rootDir, options.reportPath)) || HARNESS_REPORT_PATH,
-    };
-    writeJson(join(options.rootDir, HARNESS_REPORT_APPROVAL_PATH), approval);
-    return { report, validation, approval };
-}
-export function loadHarnessReportForSync(rootDir, reportPath) {
-    const report = readHarnessReport(reportPath);
-    const validation = validateHarnessReport(report, rootDir);
-    if (validation.status !== 'pass') {
-        throw new CliInputError('Harness report validation failed; cannot sync.', validation.errors.slice(0, 5).join('\n'));
-    }
-    const approvalPath = join(rootDir, HARNESS_REPORT_APPROVAL_PATH);
-    const approval = existsSync(approvalPath)
-        ? JSON.parse(readFileSync(approvalPath, 'utf8'))
-        : null;
-    const approved = approval?.schemaVersion === HARNESS_REPORT_APPROVAL_SCHEMA_VERSION &&
-        approval.reportId === report.reportId &&
-        approval.reportHash === hashHarnessReport(report) &&
-        approval.approved === true;
-    return { report, validation, approval, approved };
-}
-export function readHarnessReport(reportPath) {
-    return normalizeHarnessReport(JSON.parse(readFileSync(reportPath, 'utf8')));
-}
-export function normalizeHarnessReport(value) {
-    const report = cloneJson(value);
-    if (!isRecord(report.graph))
-        return report;
-    const graph = report.graph;
-    if (typeof graph.schemaVersion !== 'string' && typeof graph.graphSchemaVersion === 'string') {
-        graph.schemaVersion = graph.graphSchemaVersion;
-    }
-    if (typeof graph.schemaVersion !== 'string' && isRecord(report.source) && typeof report.source.graphSchemaVersion === 'string') {
-        graph.schemaVersion = report.source.graphSchemaVersion;
-    }
-    if (typeof graph.harnessId !== 'string' && typeof report.harnessId === 'string') {
-        graph.harnessId = report.harnessId;
-    }
-    if (!isRecord(graph.repo) && isRecord(report.repo)) {
-        graph.repo = report.repo;
-    }
-    if (!isRecord(graph.tenant) && isRecord(report.tenant)) {
-        graph.tenant = report.tenant;
-    }
-    if (!isRecord(graph.scan)) {
-        const source = isRecord(report.source) ? report.source : {};
-        const readPlan = isRecord(source.readPlan) ? source.readPlan : defaultHarnessReadPlan();
-        graph.scan = {
-            createdAt: typeof report.createdAt === 'string' ? report.createdAt : new Date().toISOString(),
-            scannerVersion: analystAdapter(report),
-            mode: 'permissioned',
-            rootPaths: ['.'],
-            readPlan,
-            skipped: [],
-        };
-    }
-    for (const field of HARNESS_GRAPH_ARRAY_FIELDS) {
-        if (!Array.isArray(graph[field]))
-            graph[field] = [];
-        for (const item of graph[field]) {
-            normalizeConfidenceField(item, requiresGraphItemConfidence(field) ? 0.5 : undefined);
-            normalizeGraphItemFieldAliases(field, item);
-        }
-    }
-    normalizeRelationshipEvidence(graph);
-    if (Array.isArray(report.claims)) {
-        report.claims = report.claims.map((claim) => normalizeHarnessClaim(claim, graph));
-    }
-    normalizeHarnessSyncPlan(report);
-    return report;
-}
-function normalizeHarnessSyncPlan(report) {
-    const syncPlan = isRecord(report.syncPlan) ? report.syncPlan : {};
-    if (typeof syncPlan.command !== 'string' || syncPlan.command.length === 0) {
-        syncPlan.command = `moda harness sync --from-report ${HARNESS_REPORT_PATH}`;
-    }
-    if (typeof syncPlan.dryRunCommand !== 'string' || syncPlan.dryRunCommand.length === 0) {
-        syncPlan.dryRunCommand = `moda harness sync --from-report ${HARNESS_REPORT_PATH} --dry-run`;
-    }
-    if (!Array.isArray(syncPlan.uploads)) {
-        syncPlan.uploads = ['approved harness report', 'sanitized harness graph metadata', 'citation metadata'];
-    }
-    if (!Array.isArray(syncPlan.privacy)) {
-        syncPlan.privacy = [
-            'does not upload broad source content by default',
-            'secret-looking files are rejected as citations',
-            'citations point to local paths and bounded excerpts',
-        ];
-    }
-    report.syncPlan = syncPlan;
-}
-function normalizeRelationshipEvidence(graph) {
-    const relationships = graph.relationships;
-    if (!Array.isArray(relationships))
-        return;
-    const evidenceById = graphEvidenceById(graph);
-    for (const relationship of relationships) {
-        if (!isRecord(relationship))
-            continue;
-        if (Array.isArray(relationship.evidence) && relationship.evidence.length > 0)
-            continue;
-        const inferred = [];
-        for (const key of ['from', 'to', 'artifactId']) {
-            const id = relationship[key];
-            if (typeof id !== 'string')
-                continue;
-            inferred.push(...(evidenceById.get(id) ?? []));
-        }
-        relationship.evidence = dedupeEvidence(inferred).slice(0, 4);
-    }
-}
-function graphEvidenceById(graph) {
-    const byId = new Map();
-    for (const field of HARNESS_GRAPH_ARRAY_FIELDS) {
-        if (field === 'relationships')
-            continue;
-        const collection = graph[field];
-        if (!Array.isArray(collection))
-            continue;
-        for (const item of collection) {
-            if (!isRecord(item) || typeof item.id !== 'string' || !Array.isArray(item.evidence))
-                continue;
-            const evidence = item.evidence
-                .filter((entry) => (isRecord(entry) &&
-                typeof entry.path === 'string' &&
-                typeof entry.reason === 'string'))
-                .map((entry) => normalizeEvidenceEntry(entry));
-            if (evidence.length > 0)
-                byId.set(item.id, evidence);
-        }
-    }
-    return byId;
-}
-function dedupeEvidence(evidence) {
-    const seen = new Set();
-    const deduped = [];
-    for (const item of evidence) {
-        const key = `${item.path}\0${item.reason}`;
-        if (seen.has(key))
-            continue;
-        seen.add(key);
-        deduped.push(normalizeEvidenceEntry(item));
-    }
-    return deduped;
-}
-/** Keep the `{ path, reason }` shape, preserving a valid structured `line`. */
-function normalizeEvidenceEntry(item) {
-    const line = evidenceLine(item);
-    return line ? { path: item.path, reason: item.reason, line } : { path: item.path, reason: item.reason };
-}
-function normalizeHarnessClaim(claim, graph) {
-    if (!isRecord(claim))
-        return claim;
-    if (typeof claim.subjectId !== 'string' && Array.isArray(claim.subjectIds) && typeof claim.subjectIds[0] === 'string') {
-        claim.subjectId = claim.subjectIds[0];
-    }
-    if (typeof claim.subjectId !== 'string' && typeof graph.harnessId === 'string') {
-        claim.subjectId = graph.harnessId;
-    }
-    if (typeof claim.summary !== 'string' && typeof claim.statement === 'string') {
-        claim.summary = claim.statement;
-    }
-    if (typeof claim.title !== 'string') {
-        claim.title = typeof claim.subjectId === 'string' ? titleFromId(claim.subjectId) : claimLabel(claim, 0);
-    }
-    claim.kind = normalizeClaimKind(claim.kind, claim.subjectId, graph);
-    if (typeof claim.id !== 'string' || claim.id.length === 0) {
-        claim.id = stableId('claim', [
-            typeof claim.kind === 'string' ? claim.kind : 'unknown',
-            typeof claim.subjectId === 'string' ? claim.subjectId : '',
-            typeof claim.title === 'string' ? claim.title : '',
-            typeof claim.summary === 'string' ? claim.summary : '',
-        ].join(':'));
-    }
-    if (typeof claim.inference !== 'string' || !isValidClaimInference(claim.inference)) {
-        claim.inference = normalizeClaimInference(claim.inference, claim.confidence);
-    }
-    normalizeConfidenceField(claim, 0.5);
-    return claim;
-}
-function isValidClaimInference(value) {
-    return value === 'direct' || value === 'inferred' || value === 'mixed';
-}
-function normalizeClaimInference(value, confidence) {
-    if (typeof value === 'string') {
-        const normalized = value.toLowerCase();
-        if (normalized.includes('direct'))
-            return 'direct';
-        if (normalized.includes('infer'))
-            return 'inferred';
-        if (normalized.includes('mix'))
-            return 'mixed';
-    }
-    return inferenceFromUnknownConfidence(confidence);
-}
-function validateGraphItemShapes(graph, errors) {
-    if (typeof graph.harnessId !== 'string' || graph.harnessId.length === 0) {
-        errors.push('Graph must include harnessId.');
-    }
-    if (!isRecord(graph.repo)) {
-        errors.push('Graph must include repo metadata.');
-    }
-    if (!isRecord(graph.scan)) {
-        errors.push('Graph must include scan metadata.');
-    }
-    validateGraphCollection(graph, errors, 'runtimeAgents', {
-        strings: ['id', 'name', 'kind', 'root'],
-        arrays: ['entrypointIds', 'channelAdapterIds', 'artifactIds', 'identityNamespaceIds', 'deploymentIds', 'frameworkIds', 'modelProviderIds', 'evidence'],
-        expected: { kind: 'runtime_agent' },
-        confidence: true,
-    });
-    validateGraphCollection(graph, errors, 'agentFamilies', {
-        strings: ['id', 'name'],
-        arrays: ['runtimeAgentIds', 'sharedArtifactIds', 'evidence'],
-        confidence: true,
-    });
-    validateGraphCollection(graph, errors, 'artifacts', {
-        strings: ['id', 'type', 'name', 'scope'],
-        arrays: ['usedByAgentIds', 'evidence'],
-        confidence: true,
-    });
-    validateGraphCollection(graph, errors, 'developerAgentAdapters', {
-        strings: ['id', 'name', 'kind', 'sourcePath'],
-        arrays: ['evidence'],
-        expected: { kind: 'developer_agent_adapter' },
-        confidence: true,
-    });
-    validateGraphCollection(graph, errors, 'channelAdapters', {
-        strings: ['id', 'name', 'kind'],
-        arrays: ['evidence'],
-        confidence: true,
-    });
-    validateGraphCollection(graph, errors, 'identityNamespaces', {
-        strings: ['id', 'name', 'kind'],
-        arrays: ['evidence'],
-        confidence: true,
-    });
-    validateGraphCollection(graph, errors, 'environments', {
-        strings: ['id', 'name', 'kind'],
-        arrays: ['evidence'],
-        confidence: true,
-    });
-    validateGraphCollection(graph, errors, 'agentFrameworks', {
-        strings: ['id', 'name', 'kind'],
-        arrays: ['packageNames', 'runtimeAgentIds', 'evidence'],
-        confidence: true,
-    });
-    validateGraphCollection(graph, errors, 'modelProviders', {
-        strings: ['id', 'name', 'kind'],
-        arrays: ['packageNames', 'runtimeAgentIds', 'envVars', 'modelHints', 'evidence'],
-        confidence: true,
-    });
-    validateGraphCollection(graph, errors, 'deployments', {
-        strings: ['id', 'name'],
-        arrays: ['evidence'],
-        confidence: true,
-    });
-    validateGraphCollection(graph, errors, 'relationships', {
-        strings: ['type', 'from', 'to'],
-        arrays: ['evidence'],
-    });
-    validateGraphCollection(graph, errors, 'unknowns', {
-        strings: ['id', 'question'],
-        arrays: ['candidateIds', 'evidence'],
-    });
-}
-function validateGraphCollection(graph, errors, field, shape) {
-    const collection = graph[field];
-    if (!Array.isArray(collection))
-        return;
-    for (const [index, item] of collection.entries()) {
-        const label = graphItemLabel(field, item, index);
-        if (!isRecord(item)) {
-            errors.push(`Graph ${field} item ${index + 1} must be an object.`);
-            continue;
-        }
-        for (const key of shape.strings) {
-            if (typeof item[key] !== 'string' || item[key].length === 0) {
-                errors.push(`Graph ${label} must include string ${key}.`);
-            }
-        }
-        for (const key of shape.arrays) {
-            if (!Array.isArray(item[key])) {
-                errors.push(`Graph ${label} must include array ${key}.`);
-            }
-        }
-        for (const [key, expected] of Object.entries(shape.expected ?? {})) {
-            if (item[key] !== expected) {
-                errors.push(`Graph ${label} must have ${key}=${expected}.`);
-            }
-        }
-        if (shape.confidence && (typeof item.confidence !== 'number' || !Number.isFinite(item.confidence))) {
-            errors.push(`Graph ${label} confidence must be a number between 0 and 1.`);
-        }
-        else if (shape.confidence && typeof item.confidence === 'number' && (item.confidence < 0 || item.confidence > 1)) {
-            errors.push(`Graph ${label} confidence must be between 0 and 1.`);
-        }
-        if (Array.isArray(item.evidence)) {
-            for (const [evidenceIndex, evidence] of item.evidence.entries()) {
-                if (!isRecord(evidence) || typeof evidence.path !== 'string' || typeof evidence.reason !== 'string') {
-                    errors.push(`Graph ${label} evidence ${evidenceIndex + 1} must include path and reason.`);
-                    continue;
-                }
-                if (evidence.line !== undefined && (typeof evidence.line !== 'number' || !Number.isFinite(evidence.line) || evidence.line <= 0)) {
-                    errors.push(`Graph ${label} evidence ${evidenceIndex + 1} line must be a positive number.`);
-                }
-            }
-        }
-        if (field === 'artifacts' && requiresArtifactEvidenceLine(item.type) && !artifactHasRetrievableLocation(item)) {
-            errors.push(`Graph ${label} is a ${String(item.type)} artifact and must include a numeric evidence line (or a dedicated whole-file source) so its exact text can be retrieved.`);
-        }
-        if (field === 'artifacts' && requiresArtifactBody(item.type) && !artifactHasBody(item)) {
-            errors.push(`Graph ${label} is a ${String(item.type)} artifact and must include a non-empty string body with its usable content.`);
-        }
-    }
-}
-/** prompt/tool artifacts must carry full usable content for downstream optimization. */
-export function requiresArtifactBody(type) {
-    return type === 'prompt' || type === 'tool';
-}
-export function artifactHasBody(item) {
-    return typeof item.body === 'string' && item.body.trim().length > 0;
-}
-/** prompt/tool artifacts must pin an exact source location for downstream retrieval. */
-function requiresArtifactEvidenceLine(type) {
-    return type === 'prompt' || type === 'tool';
-}
-/**
- * A prompt/tool artifact's text is retrievable when either (a) at least one
- * evidence entry carries a resolvable line, or (b) the artifact is a whole
- * dedicated file — its evidence points at the same file named in `sourcePath`,
- * so the entire file IS the artifact and no line is needed.
- */
-function artifactHasRetrievableLocation(item) {
-    if (hasEvidenceLine(item.evidence))
-        return true;
-    return isWholeFileArtifact(item);
-}
-function validateCaptureQuality(graph, warn) {
-    const scan = graph.scan;
-    if (!isRecord(scan))
-        return;
-    if (scan.truncated === true) {
-        const reasons = Array.isArray(scan.truncationReasons) && scan.truncationReasons.length > 0
-            ? scan.truncationReasons.map((reason) => String(reason)).join(', ')
-            : 'scan budget or upload cap reached';
-        warn('scan_truncated', `Harness scan is partial (truncated): ${reasons}. Re-run with --path=<agent-dir> or review skipped files in the report.`);
-    }
-    if (typeof scan.incompleteArtifactCount === 'number' && scan.incompleteArtifactCount > 0) {
-        warn('artifacts_missing_body', `${scan.incompleteArtifactCount} prompt/tool artifact(s) are still missing captured body content after hydration.`);
-    }
-}
-function isWholeFileArtifact(item) {
-    if (typeof item.sourcePath !== 'string' || item.sourcePath.length === 0)
-        return false;
-    if (!Array.isArray(item.evidence))
-        return false;
-    return item.evidence.some((entry) => isRecord(entry) && entry.path === item.sourcePath);
-}
-function hasEvidenceLine(evidence) {
-    if (!Array.isArray(evidence))
-        return false;
-    return evidence.some((entry) => (isRecord(entry) &&
-        typeof entry.path === 'string' &&
-        typeof entry.reason === 'string' &&
-        evidenceLine({
-            path: entry.path,
-            reason: entry.reason,
-            line: typeof entry.line === 'number' ? entry.line : undefined,
-        }) !== undefined));
-}
-function normalizeGraphItemFieldAliases(collection, item) {
-    if (!isRecord(item))
-        return;
-    if (collection === 'developerAgentAdapters') {
-        item.kind = 'developer_agent_adapter';
-        if (typeof item.sourcePath !== 'string')
-            item.sourcePath = firstEvidencePath(item) ?? '.';
-    }
-    if (collection === 'channelAdapters' && typeof item.kind !== 'string')
-        item.kind = 'unknown';
-    if (collection === 'identityNamespaces' && typeof item.kind !== 'string')
-        item.kind = 'unknown';
-    if (collection === 'environments' && typeof item.kind !== 'string')
-        item.kind = 'environment';
-    if (collection === 'agentFrameworks' && typeof item.kind !== 'string')
-        item.kind = 'agent_framework';
-    if (collection === 'modelProviders' && typeof item.kind !== 'string')
-        item.kind = 'model_provider';
-    if (collection === 'relationships') {
-        if (typeof item.from !== 'string') {
-            if (typeof item.fromId === 'string')
-                item.from = item.fromId;
-            else if (typeof item.sourceId === 'string')
-                item.from = item.sourceId;
-            else if (typeof item.source === 'string')
-                item.from = item.source;
-        }
-        if (typeof item.to !== 'string') {
-            if (typeof item.toId === 'string')
-                item.to = item.toId;
-            else if (typeof item.targetId === 'string')
-                item.to = item.targetId;
-            else if (typeof item.target === 'string')
-                item.to = item.target;
-        }
-        // Pre-1.14 analysts (e.g. a hosted container whose baked CLI predates the
-        // rename) emit the relationship type as `kind`. Observed in production:
-        // hosted reports failing validation with "relationships.<id> must include
-        // string type" while carrying the value under `kind`.
-        if (typeof item.type !== 'string' && typeof item.kind === 'string')
-            item.type = item.kind;
-    }
-}
-/** Canonical evidence path for graph items: prefer explicit sourcePath, then evidence. */
-export function firstEvidencePath(item) {
-    if (typeof item.sourcePath === 'string' && item.sourcePath.length > 0)
-        return item.sourcePath;
-    if (!Array.isArray(item.evidence))
-        return undefined;
-    for (const evidence of item.evidence) {
-        if (isRecord(evidence) && typeof evidence.path === 'string' && evidence.path.length > 0) {
-            return evidence.path;
-        }
-    }
-    return undefined;
-}
-/** Stamp remote snapshot truncation onto a validated report graph scan metadata. */
-export function stampRemoteSnapshotTruncation(report) {
-    const scanRecord = isRecord(report.graph.scan) ? report.graph.scan : {};
-    const truncationReasons = Array.isArray(scanRecord.truncationReasons)
-        ? scanRecord.truncationReasons.map(String)
-        : [];
-    return {
-        ...report,
-        graph: {
-            ...report.graph,
-            scan: {
-                ...report.graph.scan,
-                truncated: true,
-                truncationReasons: [
-                    ...truncationReasons,
-                    'remote source snapshot truncated before upload',
-                ],
-            },
-        },
-    };
-}
-function requiresGraphItemConfidence(collection) {
-    return collection !== 'relationships' && collection !== 'unknowns';
-}
-function graphItemLabel(collection, item, index) {
-    if (isRecord(item) && typeof item.id === 'string' && item.id.length > 0)
-        return `${collection}.${item.id}`;
-    return `${collection} item ${index + 1}`;
-}
-function normalizeConfidenceField(value, fallback) {
-    if (!isRecord(value))
-        return;
-    const confidence = confidenceNumberFromUnknown(value.confidence);
-    if (confidence !== undefined)
-        value.confidence = confidence;
-    else if (fallback !== undefined)
-        value.confidence = fallback;
-}
-function confidenceNumberFromUnknown(value) {
-    if (typeof value === 'number' && Number.isFinite(value))
-        return value;
-    if (typeof value !== 'string')
-        return undefined;
-    const normalized = value.trim().toLowerCase();
-    if (normalized === 'high')
-        return 0.85;
-    if (normalized === 'medium' || normalized === 'med')
-        return 0.65;
-    if (normalized === 'low')
-        return 0.35;
-    const parsed = Number(normalized);
-    return Number.isFinite(parsed) ? parsed : undefined;
-}
-function inferenceFromUnknownConfidence(value) {
-    const confidence = confidenceNumberFromUnknown(value);
-    return confidence === undefined ? 'mixed' : inferenceFromConfidence(confidence);
-}
-function inferClaimKind(subjectId, graph) {
-    if (typeof subjectId === 'string') {
-        const collectionKinds = [
-            ['runtimeAgents', 'runtime_agent'],
-            ['agentFamilies', 'agent_family'],
-            ['developerAgentAdapters', 'developer_agent_adapter'],
-            ['artifacts', 'artifact'],
-            ['channelAdapters', 'channel_adapter'],
-            ['identityNamespaces', 'identity_namespace'],
-            ['environments', 'environment'],
-            ['agentFrameworks', 'agent_framework'],
-            ['modelProviders', 'model_provider'],
-            ['deployments', 'deployment'],
-            ['relationships', 'relationship'],
-            ['unknowns', 'unknown'],
-        ];
-        for (const [field, kind] of collectionKinds) {
-            const collection = graph[field];
-            if (Array.isArray(collection) && collection.some((item) => isRecord(item) && item.id === subjectId)) {
-                return kind;
-            }
-        }
-        if (/^(agent|runtime)/i.test(subjectId))
-            return 'runtime_agent';
-        if (/^(family|fam)/i.test(subjectId))
-            return 'agent_family';
-        if (/^(developer|dev|daa)/i.test(subjectId))
-            return 'developer_agent_adapter';
-        if (/^(artifact|prompt|tool|skill|eval|memory|guardrail)/i.test(subjectId))
-            return 'artifact';
-        if (/^(channel|adapter)/i.test(subjectId))
-            return 'channel_adapter';
-        if (/^(identity|user)/i.test(subjectId))
-            return 'identity_namespace';
-        if (/^(environment|env)/i.test(subjectId))
-            return 'environment';
-        if (/^(framework|fw)/i.test(subjectId))
-            return 'agent_framework';
-        if (/^(provider|model)/i.test(subjectId))
-            return 'model_provider';
-        if (/^(deployment|deploy)/i.test(subjectId))
-            return 'deployment';
-    }
-    return 'unknown';
-}
-function normalizeClaimKind(value, subjectId, graph) {
-    const inferred = inferClaimKind(subjectId, graph);
-    if (typeof value === 'string') {
-        const normalized = value
-            .trim()
-            .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
-            .replace(/[\s-]+/g, '_')
-            .toLowerCase();
-        const aliases = {
-            agent: 'runtime_agent',
-            runtime: 'runtime_agent',
-            runtimeagent: 'runtime_agent',
-            runtime_agent: 'runtime_agent',
-            agentfamily: 'agent_family',
-            agent_family: 'agent_family',
-            family: 'agent_family',
-            developeragentadapter: 'developer_agent_adapter',
-            developer_agent_adapter: 'developer_agent_adapter',
-            developer_adapter: 'developer_agent_adapter',
-            dev_agent_adapter: 'developer_agent_adapter',
-            artifact: 'artifact',
-            prompt: 'artifact',
-            tool: 'artifact',
-            skill: 'artifact',
-            channel: 'channel_adapter',
-            channel_adapter: 'channel_adapter',
-            adapter: 'channel_adapter',
-            identity: 'identity_namespace',
-            identity_namespace: 'identity_namespace',
-            environment: 'environment',
-            env: 'environment',
-            framework: 'agent_framework',
-            agent_framework: 'agent_framework',
-            modelprovider: 'model_provider',
-            model_provider: 'model_provider',
-            provider: 'model_provider',
-            deployment: 'deployment',
-            deploy: 'deployment',
-            relationship: 'relationship',
-            unknown: 'unknown',
-            repo: 'unknown',
-            repository: 'unknown',
-            harness: 'unknown',
-        };
-        const aliased = aliases[normalized];
-        if (aliased) {
-            if (aliased === 'channel_adapter' && inferred === 'developer_agent_adapter')
-                return inferred;
-            return aliased;
-        }
-    }
-    return inferred;
-}
-function analystAdapter(report) {
-    const analyst = isRecord(report.analyst) ? report.analyst : {};
-    return typeof analyst.adapter === 'string' ? analyst.adapter : 'external-analyst';
-}
-function defaultHarnessReadPlan() {
-    return {
-        scope: 'broad',
-        rootPaths: ['.'],
-        willRead: [
-            'package manifests',
-            'source files under the selected path',
-            'prompt files',
-            'tool definitions',
-            'skill/rule files',
-            'eval/test files',
-            'deployment and CI config',
-        ],
-        willSkip: [
-            'secret-looking files',
-            'symlinks',
-            'node_modules and build output',
-            '.moda runtime files',
-            'large files over 512KB',
-        ],
-        skipsSecretFiles: true,
-        followsSymlinks: false,
-        uploadsSourceByDefault: false,
-    };
-}
-function cloneJson(value) {
-    return JSON.parse(JSON.stringify(value));
-}
-function limitReportEvidence(claims, citations) {
-    const citationsById = new Map(citations.map((citation) => [citation.id, citation]));
-    const keptClaims = [];
-    const keptCitationIds = new Set();
-    for (const claim of claims) {
-        if (keptClaims.length >= MAX_HARNESS_REPORT_CLAIMS)
-            break;
-        const claimCitationIds = [...new Set(claim.citationIds)].filter((citationId) => citationsById.has(citationId));
-        if (claimCitationIds.length === 0)
-            continue;
-        const nextCitationCount = new Set([...keptCitationIds, ...claimCitationIds]).size;
-        if (nextCitationCount > MAX_HARNESS_REPORT_CITATIONS)
-            continue;
-        keptClaims.push({
-            ...claim,
-            citationIds: claimCitationIds,
-        });
-        for (const citationId of claimCitationIds)
-            keptCitationIds.add(citationId);
-    }
-    return {
-        claims: keptClaims,
-        citations: citations.filter((citation) => keptCitationIds.has(citation.id)),
-    };
-}
-export function resolveHarnessReportPath(rootDir, value) {
-    return resolve(rootDir, value && value !== 'true' ? value : HARNESS_REPORT_PATH);
-}
-export function writeHarnessReportArtifacts(options) {
-    const written = [];
-    writeJson(join(options.rootDir, HARNESS_REPORT_PATH), options.report);
-    written.push(HARNESS_REPORT_PATH);
-    writeJson(join(options.rootDir, HARNESS_REPORT_VALIDATION_PATH), options.validation);
-    written.push(HARNESS_REPORT_VALIDATION_PATH);
-    if (options.markdown) {
-        const markdownPath = join(options.rootDir, HARNESS_REPORT_MARKDOWN_PATH);
-        mkdirSync(dirname(markdownPath), { recursive: true });
-        writeFileSync(markdownPath, renderHarnessReportMarkdown(options.report, options.validation));
-        written.push(HARNESS_REPORT_MARKDOWN_PATH);
-    }
-    return written;
-}
-export function renderHarnessReportMarkdown(report, validation) {
-    const summary = isRecord(report.summary) ? report.summary : {};
-    const citations = Array.isArray(report.citations) ? report.citations : [];
-    const claims = Array.isArray(report.claims) ? report.claims : [];
-    const unknowns = Array.isArray(report.unknowns) ? report.unknowns : [];
-    const lines = [
-        '# Moda Harness Report',
-        '',
-        `Report ID: ${report.reportId}`,
-        `Harness ID: ${report.harnessId}`,
-        `Analyst: ${report.analyst.id} (${report.analyst.adapter})`,
-        `Validation: ${validation.status}`,
-        '',
-        '## Summary',
-        '',
-        `- Runtime agents: ${formatSummaryCount(summary.runtimeAgentCount)}`,
-        `- Agent families: ${formatSummaryCount(summary.agentFamilyCount)}`,
-        `- Artifacts: ${formatSummaryCount(summary.artifactCount)}`,
-        `- Citations: ${citations.length}`,
-        `- Claims: ${claims.length}`,
-        '',
-        '## Claims',
-        '',
-    ];
-    for (const [index, claim] of claims.slice(0, 80).entries()) {
-        const claimRecord = isRecord(claim) ? claim : {};
-        const citationIds = Array.isArray(claimRecord.citationIds) ? claimRecord.citationIds : [];
-        const citedPaths = citationIds
-            .map((id) => citations.find((citation) => citation.id === id))
-            .filter((citation) => Boolean(citation))
-            .map((citation) => `${citation.path ?? citation.id}${citation.line ? `:${citation.line}` : ''}`)
-            .join(', ');
-        lines.push(`### ${typeof claimRecord.title === 'string' ? claimRecord.title : claimLabel(claim, index)}`, '', `- Kind: ${typeof claimRecord.kind === 'string' ? claimRecord.kind : 'unknown'}`, `- Confidence: ${formatConfidence(claimRecord.confidence)}`, `- Evidence: ${citedPaths || 'none'}`, `- Summary: ${typeof claimRecord.summary === 'string' ? claimRecord.summary : 'unknown'}`, '');
-    }
-    if (claims.length > 80) {
-        lines.push(`_Only the first 80 of ${claims.length} claims are shown._`, '');
-    }
-    if (unknowns.length > 0) {
-        lines.push('## Open Questions', '');
-        for (const unknown of unknowns) {
-            lines.push(`- ${isRecord(unknown) && typeof unknown.question === 'string' ? unknown.question : 'Unknown harness question'}`);
-        }
-        lines.push('');
-    }
-    lines.push('## Sync Plan', '', `- Dry run: \`${report.syncPlan.dryRunCommand}\``, `- Sync after approval: \`${report.syncPlan.command}\``, '');
-    return `${lines.join('\n')}\n`;
-}
-function claimLabel(claim, index) {
-    if (isRecord(claim)) {
-        if (typeof claim.id === 'string' && claim.id.length > 0)
-            return claim.id;
-        if (typeof claim.title === 'string' && claim.title.length > 0)
-            return claim.title;
-    }
-    return `claim #${index + 1}`;
-}
-function citationLabel(citation, index) {
-    if (isRecord(citation) && typeof citation.id === 'string' && citation.id.length > 0)
-        return citation.id;
-    return `#${index + 1}`;
-}
-function formatConfidence(value) {
-    return typeof value === 'number' && Number.isFinite(value) ? value.toFixed(2) : 'invalid';
-}
-function formatSummaryCount(value) {
-    return typeof value === 'number' && Number.isFinite(value) ? String(value) : 'unknown';
-}
-export function hashHarnessReport(report) {
-    return hashStableJson(report);
-}
-export function hashStableJson(value) {
-    return createHash('sha256').update(JSON.stringify(sortJson(value))).digest('hex');
-}
-export function graphForReport(graph) {
-    return sortJson({
-        ...graph,
-        scan: {
-            ...graph.scan,
-            createdAt: undefined,
-        },
-    });
-}
-function summarizeGraph(graph) {
-    return {
-        runtimeAgentCount: graph.runtimeAgents.length,
-        agentFamilyCount: graph.agentFamilies.length,
-        artifactCount: graph.artifacts.length,
-        sharedArtifactCount: graph.artifacts.filter((artifact) => artifact.scope === 'shared').length,
-        channelAdapterCount: graph.channelAdapters.length,
-        identityNamespaceCount: graph.identityNamespaces.length,
-        environmentCount: graph.environments.length,
-        agentFrameworkCount: graph.agentFrameworks.length,
-        modelProviderCount: graph.modelProviders.length,
-        deploymentCount: graph.deployments.length,
-        relationshipCount: graph.relationships.length,
-        unknownCount: graph.unknowns.length,
-    };
-}
-function upsertCitation(citations, citationIndex, evidence, rootDir) {
-    if (!evidence.path)
-        return undefined;
-    if (evidence.path === '.')
-        return undefined;
-    const line = evidenceLine(evidence);
-    const key = `${evidence.path}:${line ?? ''}:${evidence.reason}`;
-    const existing = citationIndex.get(key);
-    if (existing)
-        return existing;
-    const id = stableId('cite', key);
-    citations.push({
-        id,
-        type: 'file',
-        path: evidence.path,
-        ...(line ? { line } : {}),
-        reason: evidence.reason,
-        ...citationExcerpt(rootDir, evidence.path, line),
-    });
-    citationIndex.set(key, id);
-    return id;
-}
-function citationExcerpt(rootDir, path, line) {
-    if (isUnsafeCitationPath(path))
-        return {};
-    const absPath = resolve(rootDir, path);
-    if (!isInside(rootDir, absPath) || !existsSync(absPath))
-        return {};
-    try {
-        const stat = lstatSync(absPath);
-        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 128 * 1024)
-            return {};
-        const lines = readFileSync(absPath, 'utf8').split(/\r?\n/);
-        const selected = line ? lines[line - 1] : lines.find((candidate) => candidate.trim().length > 0);
-        if (!selected)
-            return {};
-        return { excerpt: selected.trim().slice(0, 240) };
-    }
-    catch {
-        return {};
-    }
-}
-function validateSummaryMatchesGraph(summary, graph, check) {
-    if (!isRecord(graph))
-        return;
-    const fields = {
-        runtimeAgentCount: safeArrayLength(graph.runtimeAgents),
-        agentFamilyCount: safeArrayLength(graph.agentFamilies),
-        artifactCount: safeArrayLength(graph.artifacts),
-        sharedArtifactCount: Array.isArray(graph.artifacts)
-            ? graph.artifacts.filter((artifact) => isRecord(artifact) && artifact.scope === 'shared').length
-            : 0,
-        channelAdapterCount: safeArrayLength(graph.channelAdapters),
-        identityNamespaceCount: safeArrayLength(graph.identityNamespaces),
-        environmentCount: safeArrayLength(graph.environments),
-        agentFrameworkCount: safeArrayLength(graph.agentFrameworks),
-        modelProviderCount: safeArrayLength(graph.modelProviders),
-        deploymentCount: safeArrayLength(graph.deployments),
-        relationshipCount: safeArrayLength(graph.relationships),
-        unknownCount: safeArrayLength(graph.unknowns),
-    };
-    for (const [field, expected] of Object.entries(fields)) {
-        const actual = summary[field];
-        check(`summary_${field}_matches_graph`, actual === expected, `Report summary ${field} must match graph count ${expected}; got ${String(actual)}.`);
-    }
-}
-function safeArrayLength(value) {
-    return Array.isArray(value) ? value.length : 0;
-}
-function isValidClaimKind(kind) {
-    return [
-        'runtime_agent',
-        'agent_family',
-        'developer_agent_adapter',
-        'artifact',
-        'channel_adapter',
-        'identity_namespace',
-        'environment',
-        'agent_framework',
-        'model_provider',
-        'deployment',
-        'relationship',
-        'unknown',
-    ].includes(kind);
-}
-function validateClaimSubjectExists(graph, claim, errors, warnings) {
-    if (claim.kind === 'relationship')
-        return;
-    const collectionName = collectionNameForClaimKind(claim.kind);
-    if (!collectionName)
-        return;
-    const collection = graph[collectionName];
-    if (!Array.isArray(collection))
-        return;
-    if (collection.some((item) => isRecord(item) && item.id === claim.subjectId))
-        return;
-    const message = `Claim ${claim.id} subject ${claim.subjectId} is not present in graph.${collectionName}.`;
-    if (claim.kind === 'unknown')
-        warnings.push(message);
-    else
-        errors.push(message);
-}
-function validateClaimQuality(claims, graph, warn) {
-    const claimRecords = claims.filter(isRecord);
-    if (claimRecords.length === 0)
-        return;
-    const graphClaimableItems = graph
-        ? safeArrayLength(graph.runtimeAgents) +
-            safeArrayLength(graph.agentFamilies) +
-            safeArrayLength(graph.developerAgentAdapters) +
-            safeArrayLength(graph.artifacts) +
-            safeArrayLength(graph.channelAdapters) +
-            safeArrayLength(graph.identityNamespaces) +
-            safeArrayLength(graph.agentFrameworks) +
-            safeArrayLength(graph.modelProviders) +
-            safeArrayLength(graph.deployments) +
-            safeArrayLength(graph.relationships)
-        : 0;
-    const unknownKindCount = claimRecords.filter((claim) => claim.kind === 'unknown').length;
-    if (graphClaimableItems > 0 && unknownKindCount === claimRecords.length) {
-        warn('claims_all_unknown', 'Every report claim is kind=unknown even though the graph has claimable items; claims should point at graph item ids and kinds.');
-    }
-    const titles = claimRecords
-        .map((claim) => typeof claim.title === 'string' ? claim.title.trim().toLowerCase() : '')
-        .filter(Boolean);
-    const uniqueTitles = new Set(titles);
-    if (titles.length >= 4 && uniqueTitles.size <= 1) {
-        warn('claims_repeated_title', 'Report claims all use the same title; claim titles should identify the specific agent, artifact, provider, adapter, or relationship.');
-    }
-}
-function collectionNameForClaimKind(kind) {
-    switch (kind) {
-        case 'runtime_agent':
-            return 'runtimeAgents';
-        case 'agent_family':
-            return 'agentFamilies';
-        case 'developer_agent_adapter':
-            return 'developerAgentAdapters';
-        case 'artifact':
-            return 'artifacts';
-        case 'channel_adapter':
-            return 'channelAdapters';
-        case 'identity_namespace':
-            return 'identityNamespaces';
-        case 'environment':
-            return 'environments';
-        case 'agent_framework':
-            return 'agentFrameworks';
-        case 'model_provider':
-            return 'modelProviders';
-        case 'deployment':
-            return 'deployments';
-        case 'unknown':
-            return 'unknowns';
-        case 'relationship':
-            return undefined;
-    }
-}
-function requiresLocalCitationPath(type) {
-    return type === 'file' || type === 'generated_doc';
-}
-function citationExcerptMatches(expected, actualLine) {
-    const expectedNormalized = normalizeComparableText(expected);
-    const actualNormalized = normalizeComparableText(actualLine);
-    if (!expectedNormalized || !actualNormalized)
-        return false;
-    return expectedNormalized.includes(actualNormalized) || actualNormalized.includes(expectedNormalized);
-}
-function normalizeComparableText(value) {
-    return value
-        .replace(/\s+/g, ' ')
-        .trim()
-        .slice(0, 240);
-}
-function validateCitation(citation, rootDir, errors, warnings, options) {
-    if (citation.type === 'command_output' || citation.type === 'production_evidence') {
-        if (!citation.excerpt || citation.excerpt.trim().length === 0) {
-            warnings.push(`Citation ${citation.id} is ${citation.type} evidence without an excerpt; reviewers must inspect it manually.`);
-        }
-        return;
-    }
-    if (citation.type !== 'file' && citation.type !== 'generated_doc') {
-        errors.push(`Citation ${citation.id} has unsupported type ${String(citation.type)}.`);
-        return;
-    }
-    if (!citation.path || isUnsafeCitationPath(citation.path)) {
-        errors.push(`Citation ${citation.id} points to an unsafe path.`);
-        return;
-    }
-    const absPath = resolve(rootDir, citation.path);
-    if (!isInside(rootDir, absPath)) {
-        errors.push(`Citation ${citation.id} points outside the harness root.`);
-        return;
-    }
-    if (!existsSync(absPath)) {
-        errors.push(`Citation ${citation.id} file does not exist: ${citation.path}.`);
-        return;
-    }
-    try {
-        const stat = lstatSync(absPath);
-        if (stat.isSymbolicLink())
-            errors.push(`Citation ${citation.id} points to a symlink.`);
-        if (stat.isDirectory()) {
-            warnings.push(`Citation ${citation.id} points to a directory; no excerpt was captured.`);
-            return;
-        }
-        if (!stat.isFile())
-            errors.push(`Citation ${citation.id} does not point to a file.`);
-        const lines = readFileSync(absPath, 'utf8').split(/\r?\n/);
-        if (citation.line !== undefined) {
-            const lineCount = lines.length;
-            if (citation.line < 1 || citation.line > lineCount) {
-                errors.push(`Citation ${citation.id} line ${citation.line} is outside ${citation.path}.`);
-            }
-            else if (citation.excerpt && !citationExcerptMatches(citation.excerpt, lines[citation.line - 1] ?? '')) {
-                errors.push(`Citation ${citation.id} excerpt no longer matches ${citation.path}:${citation.line}.`);
-            }
-        }
-        else if (options.requireLine) {
-            errors.push(`Citation ${citation.id} must include a line number for agent-authored reports.`);
-        }
-        else {
-            warnings.push(`Citation ${citation.id} has no line number; confidence is lower for this evidence.`);
-        }
-        if (citation.line !== undefined && (!citation.excerpt || citation.excerpt.trim().length === 0)) {
-            warnings.push(`Citation ${citation.id} has a line number but no excerpt.`);
-        }
-    }
-    catch (error) {
-        warnings.push(`Citation ${citation.id} could not be fully inspected: ${error instanceof Error ? error.message : String(error)}.`);
-    }
-}
-function lineFromReason(reason) {
-    const match = reason.match(/\bline\s+(\d+)\b/i);
-    if (!match)
-        return undefined;
-    const value = Number(match[1]);
-    return Number.isFinite(value) && value > 0 ? value : undefined;
-}
-/**
- * Resolve the 1-based source line for an evidence entry, preferring the
- * structured `line` field and falling back to a "line N" mention in the reason.
- */
-function evidenceLine(evidence) {
-    if (typeof evidence.line === 'number' && Number.isFinite(evidence.line) && evidence.line > 0) {
-        return Math.trunc(evidence.line);
-    }
-    return lineFromReason(evidence.reason);
-}
-function inferenceFromConfidence(confidence) {
-    if (confidence >= 0.85)
-        return 'direct';
-    if (confidence >= 0.65)
-        return 'mixed';
-    return 'inferred';
-}
-function isUnsafeCitationPath(path) {
-    return path.startsWith('/') ||
-        path.includes('..') ||
-        path.split(/[\\/]/).some((part) => part === '..') ||
-        isSecretishPath(path);
-}
-function isSecretishPath(path) {
-    const name = basename(path).toLowerCase();
-    if (name === '.env.example' ||
-        name === '.env.sample' ||
-        name === '.env.template' ||
-        name === '.env.defaults' ||
-        /^\.env\..*(example|sample|template)$/.test(name)) {
-        return false;
-    }
-    return name === '.env' ||
-        name.startsWith('.env.') ||
-        name.includes('secret') ||
-        name.includes('private-key') ||
-        name.endsWith('.pem');
-}
-function isInside(rootDir, absPath) {
-    const rel = relative(resolve(rootDir), resolve(absPath));
-    return rel === '' || (!rel.startsWith('..') && !rel.startsWith('/'));
-}
-function writeJson(path, value) {
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`);
-}
-function stableId(prefix, input) {
-    const slug = input
-        .toLowerCase()
-        .replace(/[^a-z0-9]+/g, '_')
-        .replace(/^_+|_+$/g, '')
-        .slice(0, 64);
-    const digest = createHash('sha256').update(input).digest('hex').slice(0, 12);
-    if (!slug)
-        return `${prefix}_${digest}`;
-    return slug.length >= 64 ? `${prefix}_${slug.slice(0, 51)}_${digest}` : `${prefix}_${slug}`;
-}
-function titleFromId(id) {
-    return id
-        .replace(/^[a-z]+_/, '')
-        .split(/[_\-/]+/)
-        .filter(Boolean)
-        .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
-        .join(' ') || id;
-}
-function sortJson(value) {
-    if (Array.isArray(value))
-        return value.map((item) => sortJson(item));
-    if (value && typeof value === 'object') {
-        return Object.fromEntries(Object.entries(value)
-            .filter(([, item]) => item !== undefined)
-            .sort(([a], [b]) => a.localeCompare(b))
-            .map(([key, item]) => [key, sortJson(item)]));
-    }
-    return value;
-}
-function isRecord(value) {
-    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
-}
-function normalizePath(path) {
-    return path.replace(/\\/g, '/');
-}
-//# sourceMappingURL=harness-report.js.map