@moda-ai/cli 1.55.27 → 1.55.28

package/dist/cli-cesds766.js

@@ -0,0 +1,1516 @@
+import {
+  CliInputError
+} from "./cli-k4tqwah4.js";
+import {
+  __require
+} from "./cli-0v6na3yp.js";
+
+// src/harness-report.ts
+import { createHash } from "node:crypto";
+import {
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync
+} from "node:fs";
+import { basename, dirname, join, relative, resolve } from "node:path";
+var HARNESS_REPORT_SCHEMA_VERSION = "harness_report.v0.1";
+var HARNESS_REPORT_VALIDATION_SCHEMA_VERSION = "harness_report_validation.v0.1";
+var HARNESS_REPORT_APPROVAL_SCHEMA_VERSION = "harness_report_approval.v0.1";
+var HARNESS_REPORT_PATH = join(".moda", "harness-report.json");
+var HARNESS_REPORT_MARKDOWN_PATH = join(".moda", "HARNESS_REPORT.md");
+var HARNESS_REPORT_VALIDATION_PATH = join(".moda", "harness-report-validation.json");
+var HARNESS_REPORT_APPROVAL_PATH = join(".moda", "harness-report-approval.json");
+var HARNESS_ANALYZE_CONCERNS = ["topology", "tools", "prompts", "evals"];
+var HARNESS_GRAPH_ARRAY_FIELDS = [
+  "agentFamilies",
+  "runtimeAgents",
+  "developerAgentAdapters",
+  "channelAdapters",
+  "artifacts",
+  "identityNamespaces",
+  "environments",
+  "agentFrameworks",
+  "modelProviders",
+  "deployments",
+  "relationships",
+  "unknowns"
+];
+var HARNESS_REPORT_SUMMARY_FIELDS = [
+  "runtimeAgentCount",
+  "agentFamilyCount",
+  "artifactCount",
+  "sharedArtifactCount",
+  "channelAdapterCount",
+  "identityNamespaceCount",
+  "environmentCount",
+  "agentFrameworkCount",
+  "modelProviderCount",
+  "deploymentCount",
+  "relationshipCount",
+  "unknownCount"
+];
+var HARNESS_REPORT_CITATION_TYPES = new Set([
+  "file",
+  "generated_doc",
+  "command_output",
+  "production_evidence"
+]);
+var MAX_HARNESS_REPORT_BYTES = 12000000;
+var MAX_HARNESS_REPORT_CLAIMS = 250;
+var MAX_HARNESS_REPORT_CITATIONS = 400;
+var MAX_HARNESS_REPORT_SUMMARY_LENGTH = 1200;
+function createHarnessReport(options) {
+  const adapter = options.analystAdapter && options.analystAdapter !== "true" ? options.analystAdapter : "local-scan";
+  if (adapter !== "local-scan" && adapter !== "moda" && adapter !== "local" && adapter !== "scripted") {
+    throw new CliInputError(`Analyst adapter '${adapter}' is not implemented in this CLI build yet.`, "Use `moda harness analyze --analyst=claude|codex|cursor`, or `--analyst=local-scan` for the deterministic fallback.");
+  }
+  const normalizedAdapter = adapter === "moda" || adapter === "local" || adapter === "scripted" ? "local-scan" : adapter;
+  const citations = [];
+  const citationIndex = new Map;
+  const claimBuilders = [];
+  const citationIdsForEvidence = (evidence) => evidence.map((item) => upsertCitation(citations, citationIndex, item, options.rootDir)).filter((id) => Boolean(id));
+  for (const agent of options.graph.runtimeAgents) {
+    const citationIds = citationIdsForEvidence(agent.evidence);
+    claimBuilders.push({
+      id: stableId("claim", `runtime-agent:${agent.id}`),
+      kind: "runtime_agent",
+      subjectId: agent.id,
+      title: agent.name,
+      summary: `${agent.name} is a runtime agent rooted at ${agent.root}.`,
+      confidence: agent.confidence,
+      inference: inferenceFromConfidence(agent.confidence),
+      citationIds
+    });
+  }
+  for (const family of options.graph.agentFamilies) {
+    const citationIds = citationIdsForEvidence(family.evidence);
+    claimBuilders.push({
+      id: stableId("claim", `agent-family:${family.id}`),
+      kind: "agent_family",
+      subjectId: family.id,
+      title: family.name,
+      summary: `${family.name} groups ${family.runtimeAgentIds.length} runtime agent(s) and ${family.sharedArtifactIds.length} shared artifact(s).`,
+      confidence: family.confidence,
+      inference: inferenceFromConfidence(family.confidence),
+      citationIds
+    });
+  }
+  for (const artifact of options.graph.artifacts) {
+    const citationIds = citationIdsForEvidence(artifact.evidence);
+    claimBuilders.push({
+      id: stableId("claim", `artifact:${artifact.id}`),
+      kind: "artifact",
+      subjectId: artifact.id,
+      title: artifact.name,
+      summary: `${artifact.name} is a ${artifact.scope} ${artifact.type} artifact${artifact.sourcePath ? ` at ${artifact.sourcePath}` : ""}.`,
+      confidence: artifact.confidence,
+      inference: inferenceFromConfidence(artifact.confidence),
+      citationIds
+    });
+  }
+  for (const channel of options.graph.channelAdapters) {
+    const citationIds = citationIdsForEvidence(channel.evidence);
+    claimBuilders.push({
+      id: stableId("claim", `channel:${channel.id}`),
+      kind: "channel_adapter",
+      subjectId: channel.id,
+      title: channel.name,
+      summary: `${channel.name} is a ${channel.kind} channel adapter.`,
+      confidence: channel.confidence,
+      inference: inferenceFromConfidence(channel.confidence),
+      citationIds
+    });
+  }
+  for (const adapter2 of options.graph.developerAgentAdapters) {
+    const citationIds = citationIdsForEvidence(adapter2.evidence);
+    claimBuilders.push({
+      id: stableId("claim", `developer-adapter:${adapter2.id}`),
+      kind: "developer_agent_adapter",
+      subjectId: adapter2.id,
+      title: adapter2.name,
+      summary: `${adapter2.name} is developer-agent guidance at ${adapter2.sourcePath}.`,
+      confidence: adapter2.confidence,
+      inference: inferenceFromConfidence(adapter2.confidence),
+      citationIds
+    });
+  }
+  for (const identity of options.graph.identityNamespaces) {
+    const citationIds = citationIdsForEvidence(identity.evidence);
+    claimBuilders.push({
+      id: stableId("claim", `identity:${identity.id}`),
+      kind: "identity_namespace",
+      subjectId: identity.id,
+      title: identity.name,
+      summary: `${identity.name} is a ${identity.kind} identity namespace${identity.canonicalId ? ` resolving to ${identity.canonicalId}` : ""}.`,
+      confidence: identity.confidence,
+      inference: inferenceFromConfidence(identity.confidence),
+      citationIds
+    });
+  }
+  for (const environment of options.graph.environments) {
+    const citationIds = citationIdsForEvidence(environment.evidence);
+    claimBuilders.push({
+      id: stableId("claim", `environment:${environment.id}`),
+      kind: "environment",
+      subjectId: environment.id,
+      title: environment.name,
+      summary: `${environment.name} is a ${environment.kind} environment.`,
+      confidence: environment.confidence,
+      inference: inferenceFromConfidence(environment.confidence),
+      citationIds
+    });
+  }
+  for (const framework of options.graph.agentFrameworks) {
+    const citationIds = citationIdsForEvidence(framework.evidence);
+    claimBuilders.push({
+      id: stableId("claim", `framework:${framework.id}`),
+      kind: "agent_framework",
+      subjectId: framework.id,
+      title: framework.name,
+      summary: `${framework.name} appears to be used as an agent framework.`,
+      confidence: framework.confidence,
+      inference: "mixed",
+      citationIds
+    });
+  }
+  for (const provider of options.graph.modelProviders) {
+    const citationIds = citationIdsForEvidence(provider.evidence);
+    claimBuilders.push({
+      id: stableId("claim", `provider:${provider.id}`),
+      kind: "model_provider",
+      subjectId: provider.id,
+      title: provider.name,
+      summary: `${provider.name} appears to be used as a model provider.`,
+      confidence: provider.confidence,
+      inference: "mixed",
+      citationIds
+    });
+  }
+  for (const deployment of options.graph.deployments) {
+    const citationIds = citationIdsForEvidence(deployment.evidence);
+    claimBuilders.push({
+      id: stableId("claim", `deployment:${deployment.id}`),
+      kind: "deployment",
+      subjectId: deployment.id,
+      title: deployment.name,
+      summary: `${deployment.name} appears to be a deployment or CI artifact.`,
+      confidence: deployment.confidence,
+      inference: inferenceFromConfidence(deployment.confidence),
+      citationIds
+    });
+  }
+  for (const relationship of options.graph.relationships) {
+    const citationIds = citationIdsForEvidence(relationship.evidence);
+    claimBuilders.push({
+      id: stableId("claim", `relationship:${relationship.type}:${relationship.from}:${relationship.to}:${relationship.artifactId ?? ""}`),
+      kind: "relationship",
+      subjectId: `${relationship.from}->${relationship.to}`,
+      title: titleFromId(relationship.type),
+      summary: `${relationship.from} ${relationship.type.replace(/_/g, " ")} ${relationship.to}.`,
+      confidence: citationIds.length > 0 ? 0.76 : 0.4,
+      inference: "mixed",
+      citationIds
+    });
+  }
+  const unknowns = options.graph.unknowns.map((unknown) => ({
+    id: unknown.id,
+    question: unknown.question,
+    citationIds: citationIdsForEvidence(unknown.evidence)
+  }));
+  for (const unknown of options.graph.unknowns) {
+    const citationIds = citationIdsForEvidence(unknown.evidence);
+    claimBuilders.push({
+      id: stableId("claim", `unknown:${unknown.id}`),
+      kind: "unknown",
+      subjectId: unknown.id,
+      title: "Open Question",
+      summary: unknown.question,
+      confidence: 0.2,
+      inference: "inferred",
+      citationIds
+    });
+  }
+  const graphHash = hashStableJson(graphForReport(options.graph));
+  const limitedEvidence = limitReportEvidence(claimBuilders.filter((claim) => claim.citationIds.length > 0).sort((a, b) => a.id.localeCompare(b.id)), citations.sort((a, b) => a.id.localeCompare(b.id)));
+  const keptCitationIds = new Set(limitedEvidence.citations.map((citation) => citation.id));
+  const limitedUnknowns = unknowns.map((unknown) => ({
+    ...unknown,
+    citationIds: unknown.citationIds.filter((citationId) => keptCitationIds.has(citationId))
+  }));
+  return {
+    schemaVersion: HARNESS_REPORT_SCHEMA_VERSION,
+    reportId: stableId("hreport", `${options.graph.harnessId}:${graphHash}`),
+    harnessId: options.graph.harnessId,
+    createdAt: new Date().toISOString(),
+    analyst: {
+      id: "moda-local-scanner",
+      adapter: normalizedAdapter,
+      mode: "local",
+      version: "moda-cli"
+    },
+    repo: options.graph.repo,
+    tenant: options.graph.tenant,
+    source: {
+      graphSchemaVersion: options.graph.schemaVersion,
+      graphHash,
+      sourceCommit: options.sourceCommit,
+      readPlan: options.graph.scan.readPlan,
+      deterministicInventory: true
+    },
+    summary: summarizeGraph(options.graph),
+    graph: options.graph,
+    claims: limitedEvidence.claims,
+    citations: limitedEvidence.citations,
+    syncPlan: {
+      command: `moda harness sync --from-report ${HARNESS_REPORT_PATH}`,
+      dryRunCommand: `moda harness sync --from-report ${HARNESS_REPORT_PATH} --dry-run`,
+      uploads: [
+        "approved harness report",
+        "sanitized harness graph metadata",
+        "citation metadata",
+        "graph and report hashes"
+      ],
+      privacy: [
+        "does not upload broad source content by default",
+        "secret-looking files are rejected as citations",
+        "citations point to local paths and bounded excerpts"
+      ]
+    },
+    unknowns: limitedUnknowns
+  };
+}
+function validateHarnessReport(report, rootDir, options) {
+  const checks = [];
+  const errors = [];
+  const warnings = [];
+  const check = (id, pass, message) => {
+    checks.push({ id, status: pass ? "pass" : "fail", message });
+    if (!pass)
+      errors.push(message);
+  };
+  const warn = (id, message) => {
+    checks.push({ id, status: "warning", message });
+    warnings.push(message);
+  };
+  check("schema_version", report?.schemaVersion === HARNESS_REPORT_SCHEMA_VERSION, `Report schema must be ${HARNESS_REPORT_SCHEMA_VERSION}.`);
+  check("report_id", typeof report?.reportId === "string" && report.reportId.length > 0, "Report must include reportId.");
+  check("harness_id", typeof report?.harnessId === "string" && report.harnessId.length > 0, "Report must include harnessId.");
+  check("graph_present", Boolean(report?.graph?.schemaVersion), "Report must include the sanitized harness graph.");
+  check("citations_present", Array.isArray(report?.citations) && report.citations.length > 0, "Report must include citations.");
+  check("claims_present", Array.isArray(report?.claims) && report.claims.length > 0, "Report must include claims.");
+  const syncPlan = isRecord(report?.syncPlan) ? report.syncPlan : undefined;
+  check("sync_plan_present", Boolean(syncPlan), "Report must include syncPlan.");
+  if (syncPlan) {
+    check("sync_plan_command", typeof syncPlan.command === "string" && syncPlan.command.length > 0, "Report syncPlan must include command.");
+    check("sync_plan_dry_run_command", typeof syncPlan.dryRunCommand === "string" && syncPlan.dryRunCommand.length > 0, "Report syncPlan must include dryRunCommand.");
+    check("sync_plan_uploads", Array.isArray(syncPlan.uploads), "Report syncPlan uploads must be an array.");
+    check("sync_plan_privacy", Array.isArray(syncPlan.privacy), "Report syncPlan privacy must be an array.");
+  }
+  const reportBytes = Buffer.byteLength(JSON.stringify(report ?? null), "utf8");
+  check("report_size_bounded", reportBytes <= MAX_HARNESS_REPORT_BYTES, `Harness report must stay under ${MAX_HARNESS_REPORT_BYTES} bytes; got ${reportBytes}.`);
+  if (Array.isArray(report?.claims)) {
+    check("claim_count_bounded", report.claims.length <= MAX_HARNESS_REPORT_CLAIMS, `Harness report must include at most ${MAX_HARNESS_REPORT_CLAIMS} claims; got ${report.claims.length}.`);
+  }
+  if (Array.isArray(report?.citations)) {
+    check("citation_count_bounded", report.citations.length <= MAX_HARNESS_REPORT_CITATIONS, `Harness report must include at most ${MAX_HARNESS_REPORT_CITATIONS} citations; got ${report.citations.length}.`);
+  }
+  if (report?.graph && typeof report.graph === "object") {
+    check("graph_schema_version", report.graph.schemaVersion === "harness.v0.1", "Graph schemaVersion must be harness.v0.1.");
+    for (const field of HARNESS_GRAPH_ARRAY_FIELDS) {
+      check(`graph_${field}_array`, Array.isArray(report.graph[field]), `Graph field ${field} must be an array.`);
+    }
+    validateGraphItemShapes(report.graph, errors);
+    validateCaptureQuality(report.graph, warn);
+  }
+  if (report?.summary && typeof report.summary === "object") {
+    for (const field of HARNESS_REPORT_SUMMARY_FIELDS) {
+      check(`summary_${field}_number`, typeof report.summary[field] === "number", `Report summary field ${field} must be a number.`);
+    }
+    if (report?.graph && typeof report.graph === "object") {
+      validateSummaryMatchesGraph(report.summary, report.graph, check);
+    }
+  } else {
+    check("summary_present", false, "Report must include a numeric summary object.");
+  }
+  const citations = Array.isArray(report?.citations) ? report.citations : [];
+  const citationIds = new Set;
+  const requireLineCitations = report?.analyst?.mode === "agent";
+  for (const [index, citation] of citations.entries()) {
+    const label = citationLabel(citation, index);
+    if (!isRecord(citation)) {
+      errors.push(`Citation ${index + 1} must be an object.`);
+      continue;
+    }
+    if (typeof citation.type !== "string" || !HARNESS_REPORT_CITATION_TYPES.has(citation.type)) {
+      errors.push(`Citation ${label} has unsupported type ${String(citation.type)}.`);
+    }
+    if (typeof citation.id !== "string" || citation.id.length === 0) {
+      errors.push(`Citation ${index + 1} must include a string id.`);
+    } else if (citationIds.has(citation.id)) {
+      errors.push(`Duplicate citation id ${citation.id}.`);
+    } else {
+      citationIds.add(citation.id);
+    }
+    if (typeof citation.reason !== "string" || citation.reason.length === 0) {
+      errors.push(`Citation ${label} must include a reason.`);
+    }
+    if (requiresLocalCitationPath(citation.type) && (typeof citation.path !== "string" || citation.path.length === 0)) {
+      errors.push(`Citation ${label} must include a file path.`);
+      continue;
+    }
+    validateCitation(citation, rootDir, errors, warnings, { requireLine: requireLineCitations });
+  }
+  const claims = Array.isArray(report?.claims) ? report.claims : [];
+  const claimIds = new Set;
+  for (const [index, claim] of claims.entries()) {
+    const label = claimLabel(claim, index);
+    if (!isRecord(claim)) {
+      errors.push(`Claim ${index + 1} must be an object.`);
+      continue;
+    }
+    if (typeof claim.id !== "string" || claim.id.length === 0) {
+      errors.push(`Claim ${index + 1} must include a string id.`);
+    } else if (claimIds.has(claim.id)) {
+      errors.push(`Duplicate claim id ${claim.id}.`);
+    } else {
+      claimIds.add(claim.id);
+    }
+    if (typeof claim.kind !== "string" || claim.kind.length === 0) {
+      errors.push(`Claim ${label} must include kind.`);
+    } else if (!isValidClaimKind(claim.kind)) {
+      errors.push(`Claim ${label} has unsupported kind ${claim.kind}.`);
+    }
+    if (typeof claim.subjectId !== "string" || claim.subjectId.length === 0) {
+      errors.push(`Claim ${label} must include subjectId.`);
+    } else if (report?.graph && typeof claim.kind === "string" && isValidClaimKind(claim.kind)) {
+      validateClaimSubjectExists(report.graph, claim, errors, warnings);
+    }
+    if (typeof claim.title !== "string" || claim.title.length === 0) {
+      errors.push(`Claim ${label} must include title.`);
+    }
+    if (typeof claim.summary !== "string" || claim.summary.length === 0) {
+      errors.push(`Claim ${label} must include summary.`);
+    } else if (claim.summary.length > MAX_HARNESS_REPORT_SUMMARY_LENGTH) {
+      errors.push(`Claim ${label} summary is too long; keep claims under ${MAX_HARNESS_REPORT_SUMMARY_LENGTH} characters.`);
+    }
+    if (typeof claim.confidence !== "number" || !Number.isFinite(claim.confidence)) {
+      errors.push(`Claim ${label} confidence must be a number between 0 and 1.`);
+    } else if (claim.confidence < 0 || claim.confidence > 1) {
+      errors.push(`Claim ${label} confidence must be between 0 and 1.`);
+    }
+    if (typeof claim.inference !== "string" || !["direct", "inferred", "mixed"].includes(claim.inference)) {
+      errors.push(`Claim ${label} inference must be direct, inferred, or mixed.`);
+    } else if (typeof claim.confidence === "number" && claim.confidence >= 0.9 && claim.inference !== "direct") {
+      errors.push(`Claim ${label} has high confidence but inference=${claim.inference}; high-confidence claims must be directly cited.`);
+    }
+    if (!Array.isArray(claim.citationIds)) {
+      errors.push(`Claim ${label} citationIds must be an array.`);
+      continue;
+    }
+    if (claim.citationIds.length === 0) {
+      errors.push(`Claim ${label} has no citations.`);
+      continue;
+    }
+    const claimCitationIds = new Set;
+    for (const citationId of claim.citationIds) {
+      if (typeof citationId !== "string") {
+        errors.push(`Claim ${label} references a non-string citation id.`);
+        continue;
+      }
+      if (claimCitationIds.has(citationId)) {
+        errors.push(`Claim ${label} references duplicate citation ${citationId}.`);
+      }
+      claimCitationIds.add(citationId);
+      if (!citationIds.has(citationId)) {
+        errors.push(`Claim ${label} references missing citation ${citationId}.`);
+      }
+    }
+  }
+  validateClaimQuality(claims, report?.graph, warn);
+  if (report.source?.graphHash && report.graph) {
+    const actualGraphHash = hashStableJson(graphForReport(report.graph));
+    check("graph_hash", report.source.graphHash === actualGraphHash, "Report source graph hash must match the embedded graph.");
+  }
+  const unknowns = Array.isArray(report?.unknowns) ? report.unknowns : [];
+  if (unknowns.length > 0) {
+    warn("unknowns_present", `${unknowns.length} open harness question(s) require human review.`);
+    for (const [index, unknown] of unknowns.entries()) {
+      if (!isRecord(unknown)) {
+        errors.push(`Unknown ${index + 1} must be an object.`);
+        continue;
+      }
+      if (!Array.isArray(unknown.citationIds) || unknown.citationIds.length === 0) {
+        warnings.push(`Unknown ${unknown.id ?? index + 1} has no citations.`);
+        continue;
+      }
+      for (const citationId of unknown.citationIds) {
+        if (typeof citationId === "string" && !citationIds.has(citationId)) {
+          errors.push(`Unknown ${unknown.id ?? index + 1} references missing citation ${citationId}.`);
+        }
+      }
+    }
+  }
+  validateDeterministicFloor(report, options?.deterministicFloor, check, warn, options?.concern);
+  return {
+    schemaVersion: HARNESS_REPORT_VALIDATION_SCHEMA_VERSION,
+    reportId: report?.reportId ?? "unknown",
+    reportHash: hashHarnessReport(report),
+    status: errors.length === 0 ? "pass" : "fail",
+    checkedAt: new Date().toISOString(),
+    checks,
+    errors,
+    warnings
+  };
+}
+function validateDeterministicFloor(report, floor, check, warn, concern) {
+  if (!floor)
+    return;
+  if (process.env.MODA_HARNESS_FLOOR_CHECK === "0")
+    return;
+  const applyToolFloor = concern === undefined || concern === "tools";
+  const applyTopologyFloors = concern === undefined || concern === "topology";
+  const graph = isRecord(report?.graph) ? report.graph : {};
+  const toolArtifactCount = Array.isArray(graph.artifacts) ? graph.artifacts.filter((artifact) => isRecord(artifact) && artifact.type === "tool").length : 0;
+  const providerCount = safeArrayLength(graph.modelProviders);
+  const runtimeAgentCount = safeArrayLength(graph.runtimeAgents);
+  if (applyToolFloor && typeof floor.toolCandidates === "number" && floor.toolCandidates >= 5) {
+    const minimumTools = Math.ceil(0.5 * floor.toolCandidates);
+    check("floor_tools", toolArtifactCount >= minimumTools, `Deterministic scan found ${floor.toolCandidates} high-confidence tool definition candidate(s); the report graph must include at least ${minimumTools} tool artifact(s) but has ${toolArtifactCount}.`);
+  }
+  const providerPackages = Array.isArray(floor.providerPackages) ? floor.providerPackages.filter((name) => typeof name === "string" && name.length > 0) : [];
+  if (applyTopologyFloors && providerPackages.length > 0) {
+    check("floor_providers", providerCount > 0, `Manifest dependencies include model-provider package(s) ${providerPackages.join(", ")}, but the report graph.modelProviders is empty.`);
+  }
+  if (applyTopologyFloors && typeof floor.llmCallSites === "number" && floor.llmCallSites > 0 && runtimeAgentCount === 0) {
+    warn("floor_agents", `Deterministic scan found ${floor.llmCallSites} LLM call site(s) but the report graph.runtimeAgents is empty; sync will be blocked by the zero-agent gate.`);
+  }
+}
+async function approveHarnessReport(options) {
+  const report = readHarnessReport(options.reportPath);
+  const validation = validateHarnessReport(report, options.rootDir);
+  if (validation.status !== "pass") {
+    throw new CliInputError("Harness report validation failed; cannot approve.", validation.errors.slice(0, 5).join(`
+`));
+  }
+  let approvedBy = "--yes";
+  if (!options.yes) {
+    if (!options.interactive || process.stdin.isTTY !== true) {
+      throw new CliInputError("Harness report approval requires an interactive confirmation or --yes.", "Review the report, then run `moda harness approve --yes`.");
+    }
+    const { confirm } = await import("@inquirer/prompts");
+    const approved = await confirm({
+      message: [
+        "Approve this harness report for Moda sync?",
+        `${report.summary.runtimeAgentCount} runtime agent(s), ${report.summary.artifactCount} artifact(s), ${report.claims.length} cited claim(s).`
+      ].join(" "),
+      default: false
+    });
+    if (!approved) {
+      throw new CliInputError("Harness report was not approved.", "No sync approval was written. Run `moda harness analyze --analyst=claude|codex|cursor --summary` to request another analyst pass, or edit the report and rerun `moda harness validate-report`.");
+    }
+    approvedBy = "local-human";
+  }
+  const approval = {
+    schemaVersion: HARNESS_REPORT_APPROVAL_SCHEMA_VERSION,
+    reportId: report.reportId,
+    reportHash: hashHarnessReport(report),
+    approved: true,
+    approvedAt: new Date().toISOString(),
+    approvedBy,
+    reportPath: normalizePath(relative(options.rootDir, options.reportPath)) || HARNESS_REPORT_PATH
+  };
+  writeJson(join(options.rootDir, HARNESS_REPORT_APPROVAL_PATH), approval);
+  return { report, validation, approval };
+}
+function loadHarnessReportForSync(rootDir, reportPath, options) {
+  const report = readHarnessReport(reportPath);
+  const validation = validateHarnessReport(report, rootDir, options);
+  if (validation.status !== "pass") {
+    throw new CliInputError("Harness report validation failed; cannot sync.", validation.errors.slice(0, 5).join(`
+`));
+  }
+  const approvalPath = join(rootDir, HARNESS_REPORT_APPROVAL_PATH);
+  const approval = existsSync(approvalPath) ? JSON.parse(readFileSync(approvalPath, "utf8")) : null;
+  const approved = approval?.schemaVersion === HARNESS_REPORT_APPROVAL_SCHEMA_VERSION && approval.reportId === report.reportId && approval.reportHash === hashHarnessReport(report) && approval.approved === true;
+  return { report, validation, approval, approved };
+}
+function readHarnessReport(reportPath) {
+  return normalizeHarnessReport(JSON.parse(readFileSync(reportPath, "utf8")));
+}
+function normalizeHarnessReport(value) {
+  const report = cloneJson(value);
+  if (!isRecord(report.graph))
+    return report;
+  const graph = report.graph;
+  if (typeof graph.schemaVersion !== "string" && typeof graph.graphSchemaVersion === "string") {
+    graph.schemaVersion = graph.graphSchemaVersion;
+  }
+  if (typeof graph.schemaVersion !== "string" && isRecord(report.source) && typeof report.source.graphSchemaVersion === "string") {
+    graph.schemaVersion = report.source.graphSchemaVersion;
+  }
+  if (typeof graph.harnessId !== "string" && typeof report.harnessId === "string") {
+    graph.harnessId = report.harnessId;
+  }
+  if (!isRecord(graph.repo) && isRecord(report.repo)) {
+    graph.repo = report.repo;
+  }
+  if (!isRecord(graph.tenant) && isRecord(report.tenant)) {
+    graph.tenant = report.tenant;
+  }
+  if (!isRecord(graph.scan)) {
+    const source = isRecord(report.source) ? report.source : {};
+    const readPlan = isRecord(source.readPlan) ? source.readPlan : defaultHarnessReadPlan();
+    graph.scan = {
+      createdAt: typeof report.createdAt === "string" ? report.createdAt : new Date().toISOString(),
+      scannerVersion: analystAdapter(report),
+      mode: "permissioned",
+      rootPaths: ["."],
+      readPlan,
+      skipped: []
+    };
+  }
+  for (const field of HARNESS_GRAPH_ARRAY_FIELDS) {
+    if (!Array.isArray(graph[field]))
+      graph[field] = [];
+    for (const item of graph[field]) {
+      normalizeConfidenceField(item, requiresGraphItemConfidence(field) ? 0.5 : undefined);
+      normalizeGraphItemFieldAliases(field, item);
+    }
+  }
+  normalizeRelationshipEvidence(graph);
+  if (Array.isArray(report.claims)) {
+    report.claims = report.claims.map((claim) => normalizeHarnessClaim(claim, graph));
+  }
+  normalizeHarnessSyncPlan(report);
+  return report;
+}
+function normalizeHarnessSyncPlan(report) {
+  const syncPlan = isRecord(report.syncPlan) ? report.syncPlan : {};
+  if (typeof syncPlan.command !== "string" || syncPlan.command.length === 0) {
+    syncPlan.command = `moda harness sync --from-report ${HARNESS_REPORT_PATH}`;
+  }
+  if (typeof syncPlan.dryRunCommand !== "string" || syncPlan.dryRunCommand.length === 0) {
+    syncPlan.dryRunCommand = `moda harness sync --from-report ${HARNESS_REPORT_PATH} --dry-run`;
+  }
+  if (!Array.isArray(syncPlan.uploads)) {
+    syncPlan.uploads = ["approved harness report", "sanitized harness graph metadata", "citation metadata"];
+  }
+  if (!Array.isArray(syncPlan.privacy)) {
+    syncPlan.privacy = [
+      "does not upload broad source content by default",
+      "secret-looking files are rejected as citations",
+      "citations point to local paths and bounded excerpts"
+    ];
+  }
+  report.syncPlan = syncPlan;
+}
+function normalizeRelationshipEvidence(graph) {
+  const relationships = graph.relationships;
+  if (!Array.isArray(relationships))
+    return;
+  const evidenceById = graphEvidenceById(graph);
+  for (const relationship of relationships) {
+    if (!isRecord(relationship))
+      continue;
+    if (Array.isArray(relationship.evidence) && relationship.evidence.length > 0)
+      continue;
+    const inferred = [];
+    for (const key of ["from", "to", "artifactId"]) {
+      const id = relationship[key];
+      if (typeof id !== "string")
+        continue;
+      inferred.push(...evidenceById.get(id) ?? []);
+    }
+    relationship.evidence = dedupeEvidence(inferred).slice(0, 4);
+  }
+}
+function graphEvidenceById(graph) {
+  const byId = new Map;
+  for (const field of HARNESS_GRAPH_ARRAY_FIELDS) {
+    if (field === "relationships")
+      continue;
+    const collection = graph[field];
+    if (!Array.isArray(collection))
+      continue;
+    for (const item of collection) {
+      if (!isRecord(item) || typeof item.id !== "string" || !Array.isArray(item.evidence))
+        continue;
+      const evidence = item.evidence.filter((entry) => isRecord(entry) && typeof entry.path === "string" && typeof entry.reason === "string").map((entry) => normalizeEvidenceEntry(entry));
+      if (evidence.length > 0)
+        byId.set(item.id, evidence);
+    }
+  }
+  return byId;
+}
+function dedupeEvidence(evidence) {
+  const seen = new Set;
+  const deduped = [];
+  for (const item of evidence) {
+    const key = `${item.path}\x00${item.reason}`;
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    deduped.push(normalizeEvidenceEntry(item));
+  }
+  return deduped;
+}
+function normalizeEvidenceEntry(item) {
+  const line = evidenceLine(item);
+  return line ? { path: item.path, reason: item.reason, line } : { path: item.path, reason: item.reason };
+}
+function normalizeHarnessClaim(claim, graph) {
+  if (!isRecord(claim))
+    return claim;
+  if (typeof claim.subjectId !== "string" && Array.isArray(claim.subjectIds) && typeof claim.subjectIds[0] === "string") {
+    claim.subjectId = claim.subjectIds[0];
+  }
+  if (typeof claim.subjectId !== "string" && typeof graph.harnessId === "string") {
+    claim.subjectId = graph.harnessId;
+  }
+  if (typeof claim.summary !== "string" && typeof claim.statement === "string") {
+    claim.summary = claim.statement;
+  }
+  if (typeof claim.title !== "string") {
+    claim.title = typeof claim.subjectId === "string" ? titleFromId(claim.subjectId) : claimLabel(claim, 0);
+  }
+  claim.kind = normalizeClaimKind(claim.kind, claim.subjectId, graph);
+  if (typeof claim.id !== "string" || claim.id.length === 0) {
+    claim.id = stableId("claim", [
+      typeof claim.kind === "string" ? claim.kind : "unknown",
+      typeof claim.subjectId === "string" ? claim.subjectId : "",
+      typeof claim.title === "string" ? claim.title : "",
+      typeof claim.summary === "string" ? claim.summary : ""
+    ].join(":"));
+  }
+  if (typeof claim.inference !== "string" || !isValidClaimInference(claim.inference)) {
+    claim.inference = normalizeClaimInference(claim.inference, claim.confidence);
+  }
+  normalizeConfidenceField(claim, 0.5);
+  return claim;
+}
+function isValidClaimInference(value) {
+  return value === "direct" || value === "inferred" || value === "mixed";
+}
+function normalizeClaimInference(value, confidence) {
+  if (typeof value === "string") {
+    const normalized = value.toLowerCase();
+    if (normalized.includes("direct"))
+      return "direct";
+    if (normalized.includes("infer"))
+      return "inferred";
+    if (normalized.includes("mix"))
+      return "mixed";
+  }
+  return inferenceFromUnknownConfidence(confidence);
+}
+function validateGraphItemShapes(graph, errors) {
+  if (typeof graph.harnessId !== "string" || graph.harnessId.length === 0) {
+    errors.push("Graph must include harnessId.");
+  }
+  if (!isRecord(graph.repo)) {
+    errors.push("Graph must include repo metadata.");
+  }
+  if (!isRecord(graph.scan)) {
+    errors.push("Graph must include scan metadata.");
+  }
+  validateGraphCollection(graph, errors, "runtimeAgents", {
+    strings: ["id", "name", "kind", "root"],
+    arrays: ["entrypointIds", "channelAdapterIds", "artifactIds", "identityNamespaceIds", "deploymentIds", "frameworkIds", "modelProviderIds", "evidence"],
+    expected: { kind: "runtime_agent" },
+    confidence: true
+  });
+  validateGraphCollection(graph, errors, "agentFamilies", {
+    strings: ["id", "name"],
+    arrays: ["runtimeAgentIds", "sharedArtifactIds", "evidence"],
+    confidence: true
+  });
+  validateGraphCollection(graph, errors, "artifacts", {
+    strings: ["id", "type", "name", "scope"],
+    arrays: ["usedByAgentIds", "evidence"],
+    confidence: true
+  });
+  validateGraphCollection(graph, errors, "developerAgentAdapters", {
+    strings: ["id", "name", "kind", "sourcePath"],
+    arrays: ["evidence"],
+    expected: { kind: "developer_agent_adapter" },
+    confidence: true
+  });
+  validateGraphCollection(graph, errors, "channelAdapters", {
+    strings: ["id", "name", "kind"],
+    arrays: ["evidence"],
+    confidence: true
+  });
+  validateGraphCollection(graph, errors, "identityNamespaces", {
+    strings: ["id", "name", "kind"],
+    arrays: ["evidence"],
+    confidence: true
+  });
+  validateGraphCollection(graph, errors, "environments", {
+    strings: ["id", "name", "kind"],
+    arrays: ["evidence"],
+    confidence: true
+  });
+  validateGraphCollection(graph, errors, "agentFrameworks", {
+    strings: ["id", "name", "kind"],
+    arrays: ["packageNames", "runtimeAgentIds", "evidence"],
+    confidence: true
+  });
+  validateGraphCollection(graph, errors, "modelProviders", {
+    strings: ["id", "name", "kind"],
+    arrays: ["packageNames", "runtimeAgentIds", "envVars", "modelHints", "evidence"],
+    confidence: true
+  });
+  validateGraphCollection(graph, errors, "deployments", {
+    strings: ["id", "name"],
+    arrays: ["evidence"],
+    confidence: true
+  });
+  validateGraphCollection(graph, errors, "relationships", {
+    strings: ["type", "from", "to"],
+    arrays: ["evidence"]
+  });
+  validateGraphCollection(graph, errors, "unknowns", {
+    strings: ["id", "question"],
+    arrays: ["candidateIds", "evidence"]
+  });
+}
+function validateGraphCollection(graph, errors, field, shape) {
+  const collection = graph[field];
+  if (!Array.isArray(collection))
+    return;
+  for (const [index, item] of collection.entries()) {
+    const label = graphItemLabel(field, item, index);
+    if (!isRecord(item)) {
+      errors.push(`Graph ${field} item ${index + 1} must be an object.`);
+      continue;
+    }
+    for (const key of shape.strings) {
+      if (typeof item[key] !== "string" || item[key].length === 0) {
+        errors.push(`Graph ${label} must include string ${key}.`);
+      }
+    }
+    for (const key of shape.arrays) {
+      if (!Array.isArray(item[key])) {
+        errors.push(`Graph ${label} must include array ${key}.`);
+      }
+    }
+    for (const [key, expected] of Object.entries(shape.expected ?? {})) {
+      if (item[key] !== expected) {
+        errors.push(`Graph ${label} must have ${key}=${expected}.`);
+      }
+    }
+    if (shape.confidence && (typeof item.confidence !== "number" || !Number.isFinite(item.confidence))) {
+      errors.push(`Graph ${label} confidence must be a number between 0 and 1.`);
+    } else if (shape.confidence && typeof item.confidence === "number" && (item.confidence < 0 || item.confidence > 1)) {
+      errors.push(`Graph ${label} confidence must be between 0 and 1.`);
+    }
+    if (Array.isArray(item.evidence)) {
+      for (const [evidenceIndex, evidence] of item.evidence.entries()) {
+        if (!isRecord(evidence) || typeof evidence.path !== "string" || typeof evidence.reason !== "string") {
+          errors.push(`Graph ${label} evidence ${evidenceIndex + 1} must include path and reason.`);
+          continue;
+        }
+        if (evidence.line !== undefined && (typeof evidence.line !== "number" || !Number.isFinite(evidence.line) || evidence.line <= 0)) {
+          errors.push(`Graph ${label} evidence ${evidenceIndex + 1} line must be a positive number.`);
+        }
+      }
+    }
+    if (field === "artifacts" && requiresArtifactEvidenceLine(item.type) && !artifactHasRetrievableLocation(item)) {
+      errors.push(`Graph ${label} is a ${String(item.type)} artifact and must include a numeric evidence line (or a dedicated whole-file source) so its exact text can be retrieved.`);
+    }
+    if (field === "artifacts" && requiresArtifactBody(item.type) && !artifactHasBody(item)) {
+      errors.push(`Graph ${label} is a ${String(item.type)} artifact and must include a non-empty string body with its usable content.`);
+    }
+  }
+}
+function requiresArtifactBody(type) {
+  return type === "prompt" || type === "tool";
+}
+function artifactHasBody(item) {
+  return typeof item.body === "string" && item.body.trim().length > 0;
+}
+function requiresArtifactEvidenceLine(type) {
+  return type === "prompt" || type === "tool";
+}
+function artifactHasRetrievableLocation(item) {
+  if (hasEvidenceLine(item.evidence))
+    return true;
+  return isWholeFileArtifact(item);
+}
+function validateCaptureQuality(graph, warn) {
+  const scan = graph.scan;
+  if (!isRecord(scan))
+    return;
+  if (scan.truncated === true) {
+    const reasons = Array.isArray(scan.truncationReasons) && scan.truncationReasons.length > 0 ? scan.truncationReasons.map((reason) => String(reason)).join(", ") : "scan budget or upload cap reached";
+    warn("scan_truncated", `Harness scan is partial (truncated): ${reasons}. Re-run with --path=<agent-dir> or review skipped files in the report.`);
+  }
+  if (typeof scan.incompleteArtifactCount === "number" && scan.incompleteArtifactCount > 0) {
+    warn("artifacts_missing_body", `${scan.incompleteArtifactCount} prompt/tool artifact(s) are still missing captured body content after hydration.`);
+  }
+}
+function isWholeFileArtifact(item) {
+  if (typeof item.sourcePath !== "string" || item.sourcePath.length === 0)
+    return false;
+  if (!Array.isArray(item.evidence))
+    return false;
+  return item.evidence.some((entry) => isRecord(entry) && entry.path === item.sourcePath);
+}
+function hasEvidenceLine(evidence) {
+  if (!Array.isArray(evidence))
+    return false;
+  return evidence.some((entry) => isRecord(entry) && typeof entry.path === "string" && typeof entry.reason === "string" && evidenceLine({
+    path: entry.path,
+    reason: entry.reason,
+    line: typeof entry.line === "number" ? entry.line : undefined
+  }) !== undefined);
+}
+function normalizeGraphItemFieldAliases(collection, item) {
+  if (!isRecord(item))
+    return;
+  if (collection === "developerAgentAdapters") {
+    item.kind = "developer_agent_adapter";
+    if (typeof item.sourcePath !== "string")
+      item.sourcePath = firstEvidencePath(item) ?? ".";
+  }
+  if (collection === "channelAdapters" && typeof item.kind !== "string")
+    item.kind = "unknown";
+  if (collection === "identityNamespaces" && typeof item.kind !== "string")
+    item.kind = "unknown";
+  if (collection === "environments" && typeof item.kind !== "string")
+    item.kind = "environment";
+  if (collection === "agentFrameworks" && typeof item.kind !== "string")
+    item.kind = "agent_framework";
+  if (collection === "modelProviders" && typeof item.kind !== "string")
+    item.kind = "model_provider";
+  if (collection === "relationships") {
+    if (typeof item.from !== "string") {
+      if (typeof item.fromId === "string")
+        item.from = item.fromId;
+      else if (typeof item.sourceId === "string")
+        item.from = item.sourceId;
+      else if (typeof item.source === "string")
+        item.from = item.source;
+    }
+    if (typeof item.to !== "string") {
+      if (typeof item.toId === "string")
+        item.to = item.toId;
+      else if (typeof item.targetId === "string")
+        item.to = item.targetId;
+      else if (typeof item.target === "string")
+        item.to = item.target;
+    }
+    if (typeof item.type !== "string" && typeof item.kind === "string")
+      item.type = item.kind;
+  }
+}
+function firstEvidencePath(item) {
+  if (typeof item.sourcePath === "string" && item.sourcePath.length > 0)
+    return item.sourcePath;
+  if (!Array.isArray(item.evidence))
+    return;
+  for (const evidence of item.evidence) {
+    if (isRecord(evidence) && typeof evidence.path === "string" && evidence.path.length > 0) {
+      return evidence.path;
+    }
+  }
+  return;
+}
+function stampRemoteSnapshotTruncation(report) {
+  const scanRecord = isRecord(report.graph.scan) ? report.graph.scan : {};
+  const truncationReasons = Array.isArray(scanRecord.truncationReasons) ? scanRecord.truncationReasons.map(String) : [];
+  const stamped = {
+    ...report,
+    graph: {
+      ...report.graph,
+      scan: {
+        ...report.graph.scan,
+        truncated: true,
+        truncationReasons: [
+          ...truncationReasons,
+          "remote source snapshot truncated before upload"
+        ]
+      }
+    }
+  };
+  if (stamped.source?.graphHash) {
+    stamped.source = { ...stamped.source, graphHash: hashStableJson(graphForReport(stamped.graph)) };
+  }
+  return stamped;
+}
+function requiresGraphItemConfidence(collection) {
+  return collection !== "relationships" && collection !== "unknowns";
+}
+function graphItemLabel(collection, item, index) {
+  if (isRecord(item) && typeof item.id === "string" && item.id.length > 0)
+    return `${collection}.${item.id}`;
+  return `${collection} item ${index + 1}`;
+}
+function normalizeConfidenceField(value, fallback) {
+  if (!isRecord(value))
+    return;
+  const confidence = confidenceNumberFromUnknown(value.confidence);
+  if (confidence !== undefined)
+    value.confidence = confidence;
+  else if (fallback !== undefined)
+    value.confidence = fallback;
+}
+function confidenceNumberFromUnknown(value) {
+  if (typeof value === "number" && Number.isFinite(value))
+    return value;
+  if (typeof value !== "string")
+    return;
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "high")
+    return 0.85;
+  if (normalized === "medium" || normalized === "med")
+    return 0.65;
+  if (normalized === "low")
+    return 0.35;
+  const parsed = Number(normalized);
+  return Number.isFinite(parsed) ? parsed : undefined;
+}
+function inferenceFromUnknownConfidence(value) {
+  const confidence = confidenceNumberFromUnknown(value);
+  return confidence === undefined ? "mixed" : inferenceFromConfidence(confidence);
+}
+function inferClaimKind(subjectId, graph) {
+  if (typeof subjectId === "string") {
+    const collectionKinds = [
+      ["runtimeAgents", "runtime_agent"],
+      ["agentFamilies", "agent_family"],
+      ["developerAgentAdapters", "developer_agent_adapter"],
+      ["artifacts", "artifact"],
+      ["channelAdapters", "channel_adapter"],
+      ["identityNamespaces", "identity_namespace"],
+      ["environments", "environment"],
+      ["agentFrameworks", "agent_framework"],
+      ["modelProviders", "model_provider"],
+      ["deployments", "deployment"],
+      ["relationships", "relationship"],
+      ["unknowns", "unknown"]
+    ];
+    for (const [field, kind] of collectionKinds) {
+      const collection = graph[field];
+      if (Array.isArray(collection) && collection.some((item) => isRecord(item) && item.id === subjectId)) {
+        return kind;
+      }
+    }
+    if (/^(agent|runtime)/i.test(subjectId))
+      return "runtime_agent";
+    if (/^(family|fam)/i.test(subjectId))
+      return "agent_family";
+    if (/^(developer|dev|daa)/i.test(subjectId))
+      return "developer_agent_adapter";
+    if (/^(artifact|prompt|tool|skill|eval|memory|guardrail)/i.test(subjectId))
+      return "artifact";
+    if (/^(channel|adapter)/i.test(subjectId))
+      return "channel_adapter";
+    if (/^(identity|user)/i.test(subjectId))
+      return "identity_namespace";
+    if (/^(environment|env)/i.test(subjectId))
+      return "environment";
+    if (/^(framework|fw)/i.test(subjectId))
+      return "agent_framework";
+    if (/^(provider|model)/i.test(subjectId))
+      return "model_provider";
+    if (/^(deployment|deploy)/i.test(subjectId))
+      return "deployment";
+  }
+  return "unknown";
+}
+function normalizeClaimKind(value, subjectId, graph) {
+  const inferred = inferClaimKind(subjectId, graph);
+  if (typeof value === "string") {
+    const normalized = value.trim().replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[\s-]+/g, "_").toLowerCase();
+    const aliases = {
+      agent: "runtime_agent",
+      runtime: "runtime_agent",
+      runtimeagent: "runtime_agent",
+      runtime_agent: "runtime_agent",
+      agentfamily: "agent_family",
+      agent_family: "agent_family",
+      family: "agent_family",
+      developeragentadapter: "developer_agent_adapter",
+      developer_agent_adapter: "developer_agent_adapter",
+      developer_adapter: "developer_agent_adapter",
+      dev_agent_adapter: "developer_agent_adapter",
+      artifact: "artifact",
+      prompt: "artifact",
+      tool: "artifact",
+      skill: "artifact",
+      channel: "channel_adapter",
+      channel_adapter: "channel_adapter",
+      adapter: "channel_adapter",
+      identity: "identity_namespace",
+      identity_namespace: "identity_namespace",
+      environment: "environment",
+      env: "environment",
+      framework: "agent_framework",
+      agent_framework: "agent_framework",
+      modelprovider: "model_provider",
+      model_provider: "model_provider",
+      provider: "model_provider",
+      deployment: "deployment",
+      deploy: "deployment",
+      relationship: "relationship",
+      unknown: "unknown",
+      repo: "unknown",
+      repository: "unknown",
+      harness: "unknown"
+    };
+    const aliased = aliases[normalized];
+    if (aliased) {
+      if (aliased === "channel_adapter" && inferred === "developer_agent_adapter")
+        return inferred;
+      return aliased;
+    }
+  }
+  return inferred;
+}
+function analystAdapter(report) {
+  const analyst = isRecord(report.analyst) ? report.analyst : {};
+  return typeof analyst.adapter === "string" ? analyst.adapter : "external-analyst";
+}
+function defaultHarnessReadPlan() {
+  return {
+    scope: "broad",
+    rootPaths: ["."],
+    willRead: [
+      "package manifests",
+      "source files under the selected path",
+      "prompt files",
+      "tool definitions",
+      "skill/rule files",
+      "eval/test files",
+      "deployment and CI config"
+    ],
+    willSkip: [
+      "secret-looking files",
+      "symlinks",
+      "node_modules and build output",
+      ".moda runtime files",
+      "large files over 512KB"
+    ],
+    skipsSecretFiles: true,
+    followsSymlinks: false,
+    uploadsSourceByDefault: false
+  };
+}
+function cloneJson(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+function limitReportEvidence(claims, citations) {
+  const citationsById = new Map(citations.map((citation) => [citation.id, citation]));
+  const keptClaims = [];
+  const keptCitationIds = new Set;
+  for (const claim of claims) {
+    if (keptClaims.length >= MAX_HARNESS_REPORT_CLAIMS)
+      break;
+    const claimCitationIds = [...new Set(claim.citationIds)].filter((citationId) => citationsById.has(citationId));
+    if (claimCitationIds.length === 0)
+      continue;
+    const nextCitationCount = new Set([...keptCitationIds, ...claimCitationIds]).size;
+    if (nextCitationCount > MAX_HARNESS_REPORT_CITATIONS)
+      continue;
+    keptClaims.push({
+      ...claim,
+      citationIds: claimCitationIds
+    });
+    for (const citationId of claimCitationIds)
+      keptCitationIds.add(citationId);
+  }
+  return {
+    claims: keptClaims,
+    citations: citations.filter((citation) => keptCitationIds.has(citation.id))
+  };
+}
+function resolveHarnessReportPath(rootDir, value) {
+  return resolve(rootDir, value && value !== "true" ? value : HARNESS_REPORT_PATH);
+}
+function writeHarnessReportArtifacts(options) {
+  const written = [];
+  writeJson(join(options.rootDir, HARNESS_REPORT_PATH), options.report);
+  written.push(HARNESS_REPORT_PATH);
+  writeJson(join(options.rootDir, HARNESS_REPORT_VALIDATION_PATH), options.validation);
+  written.push(HARNESS_REPORT_VALIDATION_PATH);
+  if (options.markdown) {
+    const markdownPath = join(options.rootDir, HARNESS_REPORT_MARKDOWN_PATH);
+    mkdirSync(dirname(markdownPath), { recursive: true });
+    writeFileSync(markdownPath, renderHarnessReportMarkdown(options.report, options.validation));
+    written.push(HARNESS_REPORT_MARKDOWN_PATH);
+  }
+  return written;
+}
+function renderHarnessReportMarkdown(report, validation) {
+  const summary = isRecord(report.summary) ? report.summary : {};
+  const citations = Array.isArray(report.citations) ? report.citations : [];
+  const claims = Array.isArray(report.claims) ? report.claims : [];
+  const unknowns = Array.isArray(report.unknowns) ? report.unknowns : [];
+  const lines = [
+    "# Moda Harness Report",
+    "",
+    `Report ID: ${report.reportId}`,
+    `Harness ID: ${report.harnessId}`,
+    `Analyst: ${report.analyst.id} (${report.analyst.adapter})`,
+    `Validation: ${validation.status}`,
+    "",
+    "## Summary",
+    "",
+    `- Runtime agents: ${formatSummaryCount(summary.runtimeAgentCount)}`,
+    `- Agent families: ${formatSummaryCount(summary.agentFamilyCount)}`,
+    `- Artifacts: ${formatSummaryCount(summary.artifactCount)}`,
+    `- Citations: ${citations.length}`,
+    `- Claims: ${claims.length}`,
+    "",
+    "## Claims",
+    ""
+  ];
+  for (const [index, claim] of claims.slice(0, 80).entries()) {
+    const claimRecord = isRecord(claim) ? claim : {};
+    const citationIds = Array.isArray(claimRecord.citationIds) ? claimRecord.citationIds : [];
+    const citedPaths = citationIds.map((id) => citations.find((citation) => citation.id === id)).filter((citation) => Boolean(citation)).map((citation) => `${citation.path ?? citation.id}${citation.line ? `:${citation.line}` : ""}`).join(", ");
+    lines.push(`### ${typeof claimRecord.title === "string" ? claimRecord.title : claimLabel(claim, index)}`, "", `- Kind: ${typeof claimRecord.kind === "string" ? claimRecord.kind : "unknown"}`, `- Confidence: ${formatConfidence(claimRecord.confidence)}`, `- Evidence: ${citedPaths || "none"}`, `- Summary: ${typeof claimRecord.summary === "string" ? claimRecord.summary : "unknown"}`, "");
+  }
+  if (claims.length > 80) {
+    lines.push(`_Only the first 80 of ${claims.length} claims are shown._`, "");
+  }
+  if (unknowns.length > 0) {
+    lines.push("## Open Questions", "");
+    for (const unknown of unknowns) {
+      lines.push(`- ${isRecord(unknown) && typeof unknown.question === "string" ? unknown.question : "Unknown harness question"}`);
+    }
+    lines.push("");
+  }
+  lines.push("## Sync Plan", "", `- Dry run: \`${report.syncPlan.dryRunCommand}\``, `- Sync after approval: \`${report.syncPlan.command}\``, "");
+  return `${lines.join(`
+`)}
+`;
+}
+function claimLabel(claim, index) {
+  if (isRecord(claim)) {
+    if (typeof claim.id === "string" && claim.id.length > 0)
+      return claim.id;
+    if (typeof claim.title === "string" && claim.title.length > 0)
+      return claim.title;
+  }
+  return `claim #${index + 1}`;
+}
+function citationLabel(citation, index) {
+  if (isRecord(citation) && typeof citation.id === "string" && citation.id.length > 0)
+    return citation.id;
+  return `#${index + 1}`;
+}
+function formatConfidence(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value.toFixed(2) : "invalid";
+}
+function formatSummaryCount(value) {
+  return typeof value === "number" && Number.isFinite(value) ? String(value) : "unknown";
+}
+function hashHarnessReport(report) {
+  return hashStableJson(report);
+}
+function hashStableJson(value) {
+  return createHash("sha256").update(JSON.stringify(sortJson(value))).digest("hex");
+}
+function graphForReport(graph) {
+  return sortJson({
+    ...graph,
+    scan: {
+      ...graph.scan,
+      createdAt: undefined
+    }
+  });
+}
+function summarizeGraph(graph) {
+  return {
+    runtimeAgentCount: graph.runtimeAgents.length,
+    agentFamilyCount: graph.agentFamilies.length,
+    artifactCount: graph.artifacts.length,
+    sharedArtifactCount: graph.artifacts.filter((artifact) => artifact.scope === "shared").length,
+    channelAdapterCount: graph.channelAdapters.length,
+    identityNamespaceCount: graph.identityNamespaces.length,
+    environmentCount: graph.environments.length,
+    agentFrameworkCount: graph.agentFrameworks.length,
+    modelProviderCount: graph.modelProviders.length,
+    deploymentCount: graph.deployments.length,
+    relationshipCount: graph.relationships.length,
+    unknownCount: graph.unknowns.length
+  };
+}
+function upsertCitation(citations, citationIndex, evidence, rootDir) {
+  if (!evidence.path)
+    return;
+  if (evidence.path === ".")
+    return;
+  const line = evidenceLine(evidence);
+  const key = `${evidence.path}:${line ?? ""}:${evidence.reason}`;
+  const existing = citationIndex.get(key);
+  if (existing)
+    return existing;
+  const id = stableId("cite", key);
+  citations.push({
+    id,
+    type: "file",
+    path: evidence.path,
+    ...line ? { line } : {},
+    reason: evidence.reason,
+    ...citationExcerpt(rootDir, evidence.path, line)
+  });
+  citationIndex.set(key, id);
+  return id;
+}
+function citationExcerpt(rootDir, path, line) {
+  if (isUnsafeCitationPath(path))
+    return {};
+  const absPath = resolve(rootDir, path);
+  if (!isInside(rootDir, absPath) || !existsSync(absPath))
+    return {};
+  try {
+    const stat = lstatSync(absPath);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 131072)
+      return {};
+    const lines = readFileSync(absPath, "utf8").split(/\r?\n/);
+    const selected = line ? lines[line - 1] : lines.find((candidate) => candidate.trim().length > 0);
+    if (!selected)
+      return {};
+    return { excerpt: selected.trim() };
+  } catch {
+    return {};
+  }
+}
+function validateSummaryMatchesGraph(summary, graph, check) {
+  if (!isRecord(graph))
+    return;
+  const fields = {
+    runtimeAgentCount: safeArrayLength(graph.runtimeAgents),
+    agentFamilyCount: safeArrayLength(graph.agentFamilies),
+    artifactCount: safeArrayLength(graph.artifacts),
+    sharedArtifactCount: Array.isArray(graph.artifacts) ? graph.artifacts.filter((artifact) => isRecord(artifact) && artifact.scope === "shared").length : 0,
+    channelAdapterCount: safeArrayLength(graph.channelAdapters),
+    identityNamespaceCount: safeArrayLength(graph.identityNamespaces),
+    environmentCount: safeArrayLength(graph.environments),
+    agentFrameworkCount: safeArrayLength(graph.agentFrameworks),
+    modelProviderCount: safeArrayLength(graph.modelProviders),
+    deploymentCount: safeArrayLength(graph.deployments),
+    relationshipCount: safeArrayLength(graph.relationships),
+    unknownCount: safeArrayLength(graph.unknowns)
+  };
+  for (const [field, expected] of Object.entries(fields)) {
+    const actual = summary[field];
+    check(`summary_${field}_matches_graph`, actual === expected, `Report summary ${field} must match graph count ${expected}; got ${String(actual)}.`);
+  }
+}
+function safeArrayLength(value) {
+  return Array.isArray(value) ? value.length : 0;
+}
+function isValidClaimKind(kind) {
+  return [
+    "runtime_agent",
+    "agent_family",
+    "developer_agent_adapter",
+    "artifact",
+    "channel_adapter",
+    "identity_namespace",
+    "environment",
+    "agent_framework",
+    "model_provider",
+    "deployment",
+    "relationship",
+    "unknown"
+  ].includes(kind);
+}
+function validateClaimSubjectExists(graph, claim, errors, warnings) {
+  if (claim.kind === "relationship")
+    return;
+  const collectionName = collectionNameForClaimKind(claim.kind);
+  if (!collectionName)
+    return;
+  const collection = graph[collectionName];
+  if (!Array.isArray(collection))
+    return;
+  if (collection.some((item) => isRecord(item) && item.id === claim.subjectId))
+    return;
+  const message = `Claim ${claim.id} subject ${claim.subjectId} is not present in graph.${collectionName}.`;
+  if (claim.kind === "unknown")
+    warnings.push(message);
+  else
+    errors.push(message);
+}
+function validateClaimQuality(claims, graph, warn) {
+  const claimRecords = claims.filter(isRecord);
+  if (claimRecords.length === 0)
+    return;
+  const graphClaimableItems = graph ? safeArrayLength(graph.runtimeAgents) + safeArrayLength(graph.agentFamilies) + safeArrayLength(graph.developerAgentAdapters) + safeArrayLength(graph.artifacts) + safeArrayLength(graph.channelAdapters) + safeArrayLength(graph.identityNamespaces) + safeArrayLength(graph.agentFrameworks) + safeArrayLength(graph.modelProviders) + safeArrayLength(graph.deployments) + safeArrayLength(graph.relationships) : 0;
+  const unknownKindCount = claimRecords.filter((claim) => claim.kind === "unknown").length;
+  if (graphClaimableItems > 0 && unknownKindCount === claimRecords.length) {
+    warn("claims_all_unknown", "Every report claim is kind=unknown even though the graph has claimable items; claims should point at graph item ids and kinds.");
+  }
+  const titles = claimRecords.map((claim) => typeof claim.title === "string" ? claim.title.trim().toLowerCase() : "").filter(Boolean);
+  const uniqueTitles = new Set(titles);
+  if (titles.length >= 4 && uniqueTitles.size <= 1) {
+    warn("claims_repeated_title", "Report claims all use the same title; claim titles should identify the specific agent, artifact, provider, adapter, or relationship.");
+  }
+}
+function collectionNameForClaimKind(kind) {
+  switch (kind) {
+    case "runtime_agent":
+      return "runtimeAgents";
+    case "agent_family":
+      return "agentFamilies";
+    case "developer_agent_adapter":
+      return "developerAgentAdapters";
+    case "artifact":
+      return "artifacts";
+    case "channel_adapter":
+      return "channelAdapters";
+    case "identity_namespace":
+      return "identityNamespaces";
+    case "environment":
+      return "environments";
+    case "agent_framework":
+      return "agentFrameworks";
+    case "model_provider":
+      return "modelProviders";
+    case "deployment":
+      return "deployments";
+    case "unknown":
+      return "unknowns";
+    case "relationship":
+      return;
+  }
+}
+function requiresLocalCitationPath(type) {
+  return type === "file" || type === "generated_doc";
+}
+function citationExcerptMatches(expected, actualLine) {
+  const expectedNormalized = normalizeComparableText(expected);
+  const actualNormalized = normalizeComparableText(actualLine);
+  if (!expectedNormalized || !actualNormalized)
+    return false;
+  return expectedNormalized.includes(actualNormalized) || actualNormalized.includes(expectedNormalized);
+}
+function normalizeComparableText(value) {
+  return value.replace(/\s+/g, " ").trim();
+}
+function validateCitation(citation, rootDir, errors, warnings, options) {
+  if (citation.type === "command_output" || citation.type === "production_evidence") {
+    if (!citation.excerpt || citation.excerpt.trim().length === 0) {
+      warnings.push(`Citation ${citation.id} is ${citation.type} evidence without an excerpt; reviewers must inspect it manually.`);
+    }
+    return;
+  }
+  if (citation.type !== "file" && citation.type !== "generated_doc") {
+    errors.push(`Citation ${citation.id} has unsupported type ${String(citation.type)}.`);
+    return;
+  }
+  if (!citation.path || isUnsafeCitationPath(citation.path)) {
+    errors.push(`Citation ${citation.id} points to an unsafe path.`);
+    return;
+  }
+  const absPath = resolve(rootDir, citation.path);
+  if (!isInside(rootDir, absPath)) {
+    errors.push(`Citation ${citation.id} points outside the harness root.`);
+    return;
+  }
+  if (!existsSync(absPath)) {
+    errors.push(`Citation ${citation.id} file does not exist: ${citation.path}.`);
+    return;
+  }
+  try {
+    const stat = lstatSync(absPath);
+    if (stat.isSymbolicLink())
+      errors.push(`Citation ${citation.id} points to a symlink.`);
+    if (stat.isDirectory()) {
+      warnings.push(`Citation ${citation.id} points to a directory; no excerpt was captured.`);
+      return;
+    }
+    if (!stat.isFile())
+      errors.push(`Citation ${citation.id} does not point to a file.`);
+    const lines = readFileSync(absPath, "utf8").split(/\r?\n/);
+    if (citation.line !== undefined) {
+      const lineCount = lines.length;
+      if (citation.line < 1 || citation.line > lineCount) {
+        errors.push(`Citation ${citation.id} line ${citation.line} is outside ${citation.path}.`);
+      } else if (citation.excerpt && !citationExcerptMatches(citation.excerpt, lines[citation.line - 1] ?? "")) {
+        errors.push(`Citation ${citation.id} excerpt no longer matches ${citation.path}:${citation.line}.`);
+      }
+    } else if (options.requireLine) {
+      errors.push(`Citation ${citation.id} must include a line number for agent-authored reports.`);
+    } else {
+      warnings.push(`Citation ${citation.id} has no line number; confidence is lower for this evidence.`);
+    }
+    if (citation.line !== undefined && (!citation.excerpt || citation.excerpt.trim().length === 0)) {
+      warnings.push(`Citation ${citation.id} has a line number but no excerpt.`);
+    }
+  } catch (error) {
+    warnings.push(`Citation ${citation.id} could not be fully inspected: ${error instanceof Error ? error.message : String(error)}.`);
+  }
+}
+function lineFromReason(reason) {
+  const match = reason.match(/\bline\s+(\d+)\b/i);
+  if (!match)
+    return;
+  const value = Number(match[1]);
+  return Number.isFinite(value) && value > 0 ? value : undefined;
+}
+function evidenceLine(evidence) {
+  if (typeof evidence.line === "number" && Number.isFinite(evidence.line) && evidence.line > 0) {
+    return Math.trunc(evidence.line);
+  }
+  return lineFromReason(evidence.reason);
+}
+function inferenceFromConfidence(confidence) {
+  if (confidence >= 0.85)
+    return "direct";
+  if (confidence >= 0.65)
+    return "mixed";
+  return "inferred";
+}
+function isUnsafeCitationPath(path) {
+  return path.startsWith("/") || path.includes("..") || path.split(/[\\/]/).some((part) => part === "..") || isSecretishPath(path);
+}
+function isSecretishPath(path) {
+  const name = basename(path).toLowerCase();
+  if (name === ".env.example" || name === ".env.sample" || name === ".env.template" || name === ".env.defaults" || /^\.env\..*(example|sample|template)$/.test(name)) {
+    return false;
+  }
+  return name === ".env" || name.startsWith(".env.") || name.includes("secret") || name.includes("private-key") || name.endsWith(".pem");
+}
+function isInside(rootDir, absPath) {
+  const rel = relative(resolve(rootDir), resolve(absPath));
+  return rel === "" || !rel.startsWith("..") && !rel.startsWith("/");
+}
+function writeJson(path, value) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}
+`);
+}
+function stableId(prefix, input) {
+  const slug = input.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "").slice(0, 64);
+  const digest = createHash("sha256").update(input).digest("hex").slice(0, 12);
+  if (!slug)
+    return `${prefix}_${digest}`;
+  return slug.length >= 64 ? `${prefix}_${slug.slice(0, 51)}_${digest}` : `${prefix}_${slug}`;
+}
+function titleFromId(id) {
+  return id.replace(/^[a-z]+_/, "").split(/[_\-/]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ") || id;
+}
+function sortJson(value) {
+  if (Array.isArray(value))
+    return value.map((item) => sortJson(item));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== undefined).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, sortJson(item)]));
+  }
+  return value;
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function normalizePath(path) {
+  return path.replace(/\\/g, "/");
+}
+
+export { HARNESS_REPORT_SCHEMA_VERSION, HARNESS_REPORT_VALIDATION_SCHEMA_VERSION, HARNESS_REPORT_APPROVAL_SCHEMA_VERSION, HARNESS_REPORT_PATH, HARNESS_REPORT_MARKDOWN_PATH, HARNESS_REPORT_VALIDATION_PATH, HARNESS_REPORT_APPROVAL_PATH, HARNESS_ANALYZE_CONCERNS, createHarnessReport, validateHarnessReport, approveHarnessReport, loadHarnessReportForSync, readHarnessReport, normalizeHarnessReport, requiresArtifactBody, artifactHasBody, firstEvidencePath, stampRemoteSnapshotTruncation, resolveHarnessReportPath, writeHarnessReportArtifacts, renderHarnessReportMarkdown, hashHarnessReport, hashStableJson, graphForReport };