@mstar-harness/engine 3.10.2 → 3.11.0

package/dist/audit.d.ts

@@ -167,11 +167,47 @@ export type AuditFinding = {
     effort: AuditEffort;
     risk: AuditRisk;
     confidence: AuditConfidence;
-    evidence: readonly string[];
+    /** Free-text string (legacy form, rendered byte-for-byte) or a structured
+     * location. Authored JSON should prefer the structured form. */
+    evidence: readonly (string | AuditEvidence)[];
     priority: AuditPriority;
     fixSketch?: string;
     verification?: string;
     dependsOn?: string;
+    /** Source-derived root-cause identity (audit-finding-contract.md §4).
+     * Optional; never invented by the engine. */
+    fingerprint?: string;
+    /** Entry-point → propagation → sink path (§5). Supplements evidence. */
+    trace?: readonly AuditTraceStep[];
+    /** Author-supplied severity assessment (§6). Never inferred from
+     * priority/risk/confidence. */
+    severity?: AuditSeverity;
+};
+/** One structured evidence location. `file` is a safe repository-relative
+ * POSIX path; `line` is omitted when unknown (never invented). */
+export type AuditEvidence = {
+    file: string;
+    line?: number;
+    description: string;
+};
+/** Trace-step kind (§5): where data enters, how it travels, where it lands. */
+export type AuditTraceKind = "entrypoint" | "propagation" | "sink";
+/** One trace step. `line` is a positive safe integer; `scope` names the
+ * enclosing route/function/module. */
+export type AuditTraceStep = {
+    kind: AuditTraceKind;
+    file: string;
+    line: number;
+    scope: string;
+    description: string;
+};
+/** Severity rank ordinal labels (§6). Harness diagnostic `Severity` is a
+ * DIFFERENT enum (`nit`, no `informational`) — never conflate them. */
+export type AuditSeverityRank = "informational" | "low" | "medium" | "high" | "critical";
+export type AuditSeverity = {
+    likelihood: AuditSeverityRank;
+    impact: AuditSeverityRank;
+    overall: AuditSeverityRank;
 };
 /** Options for `scaffoldAuditPlan`. `plannedAt` defaults to the
  * `repoShortSha` + `date`; `date` defaults to today (YYYY-MM-DD). */
@@ -205,6 +241,21 @@ export type ScaffoldAuditPlanResult = {
     files: string[];
     nextNumber: number;
 };
+/**
+ * Deterministic finding gates (audit-finding-contract.md §§2–6): fingerprint
+ * grammar / exact uniqueness / ordinal ordering of the supplied subsequence,
+ * `severity.overall ≤ severity.impact`, nonempty trace topology, positive
+ * safe-integer trace lines, safe typed paths, visible well-formed text, and
+ * opaque-field credential rejection (a fingerprint or typed location that
+ * `redactSecrets` would alter is REJECTED, never redacted into a different
+ * identity). Contextual judgement (reportability, semantic exclusion,
+ * coverage) stays in skill prose (§2).
+ *
+ * Violation codes are stable `audit.finding.<family>.<rule>`; messages carry
+ * `findings[index].field` paths only — never raw submitted values. Pure:
+ * the input is never mutated and nothing is sorted or repaired.
+ */
+export declare function validateAuditFindingGates(findings: readonly AuditFinding[]): GateResult;
 /**
  * Scaffold an audit plan directory (`{PLAN_DIR}/audit-<date>/` layout,
  * mstar-audit SKILL.md § Plan output (all variants)): numbered `NNN-<slug>.md` plan files from

package/dist/audit.js

@@ -279,7 +279,7 @@ function validatePlanProgress(value, what = "coordination.progress") {
   }
   return violations;
 }
-function validatePlanHandoff(value, what = "coordination.handoff") {
+function validatePlanHandoff(value, what = "coordination.handoff", route = "integration") {
   if (!isPlainObject2(value))
     return [invalid("coordination.row.handoff-shape", `${what} must be an object`)];
   const allowed = [
@@ -419,7 +419,25 @@ function validatePlanHandoff(value, what = "coordination.handoff") {
     }
   }
   if ((value.state === "integrating" || value.state === "merged" || value.state === "completed") && value.integration === undefined) {
-    violations.push(invalid("coordination.row.handoff-field", `${what}.state ${String(value.state)} requires integration`));
+    if (route === "standalone-development" && value.state === "completed") {
+      if (value.completed_at === undefined) {
+        violations.push(invalid("coordination.row.handoff-field", `${what}.state completed requires completed_at for a standalone handoff`));
+      }
+      if (!isNonEmptyString(value.accepted_at)) {
+        violations.push(invalid("coordination.row.handoff-field", `${what}.accepted_at is required for a standalone completed handoff`));
+      }
+      if (!isNonEmptyString(value.accepted_by)) {
+        violations.push(invalid("coordination.row.handoff-field", `${what}.accepted_by is required for a standalone completed handoff`));
+      }
+      if (value.qc === undefined) {
+        violations.push(invalid("coordination.row.handoff-field", `${what}.qc is required for a standalone completed handoff`));
+      }
+      if (value.qa === undefined) {
+        violations.push(invalid("coordination.row.handoff-field", `${what}.qa is required for a standalone completed handoff`));
+      }
+    } else {
+      violations.push(invalid("coordination.row.handoff-field", `${what}.state ${String(value.state)} requires integration`));
+    }
   }
   return violations;
 }
@@ -455,7 +473,7 @@ function validatePreparedCoordination(value, what = "coordination.prepared") {
   }
   return violations;
 }
-function validateRowCoordination(value, what = "coordination") {
+function validateRowCoordination(value, what = "coordination", route = "integration") {
   if (!isPlainObject2(value))
     return [invalid("coordination.row.shape", `${what} must be an object`)];
   const allowed = ["revision", "prepared", "session", "progress", "handoff"];
@@ -474,7 +492,7 @@ function validateRowCoordination(value, what = "coordination") {
   if (value.progress !== undefined)
     violations.push(...validatePlanProgress(value.progress, `${what}.progress`));
   if (value.handoff !== undefined)
-    violations.push(...validatePlanHandoff(value.handoff, `${what}.handoff`));
+    violations.push(...validatePlanHandoff(value.handoff, `${what}.handoff`, route));
   if (value.handoff !== undefined && value.session === undefined) {
     violations.push(invalid("coordination.row.handoff-field", `${what}.handoff requires a bound plan session`));
   }
@@ -797,6 +815,45 @@ var WORKFLOW_TERMINAL_STATUSES = ["completed", "failed", "stopped"];
 var WORKFLOW_LIFECYCLE_TYPES = ["plan", "iteration"];
 var WORKFLOW_DELIVERY_KINDS = ["development", "verification/report-only"];
 var WORKFLOW_COMPOUND_OUTCOMES = ["created", "updated", "skipped"];
+function isStandaloneDevelopmentWorkflow(snapshot) {
+  return snapshot.type === "plan" && snapshot.delivery_kind === "development" && Array.isArray(snapshot.plans) && snapshot.plans.length === 1;
+}
+function rowValidationRoute(snapshot, row) {
+  if (isStandaloneDevelopmentWorkflow(snapshot) && snapshot.plans[0]?.id === row.id) {
+    return "standalone-development";
+  }
+  return "integration";
+}
+function validateStandaloneCompletedCoherence(snapshot, row) {
+  const violations = [];
+  if (!isStandaloneDevelopmentWorkflow(snapshot) || row.id !== snapshot.plans[0]?.id)
+    return violations;
+  const coordination = row.coordination;
+  if (!isPlainObject2(coordination) || !isPlainObject2(coordination.handoff))
+    return violations;
+  const handoff = coordination.handoff;
+  if (handoff.state !== "completed" || handoff.integration !== undefined)
+    return violations;
+  if (row.status !== "Done") {
+    violations.push(violation2("high", "coordination.row.handoff-field", `standalone completed handoff requires row ${String(row.id)} to be Done`));
+  }
+  if (row.execution_lease !== undefined) {
+    violations.push(violation2("high", "coordination.row.handoff-field", `standalone completed handoff requires no execution lease on row ${String(row.id)}`));
+  }
+  if (snapshot.integration_merge_lease !== undefined) {
+    violations.push(violation2("high", "coordination.row.handoff-field", "standalone completed handoff requires no integration_merge_lease on the snapshot"));
+  }
+  const source = snapshot.branch?.source;
+  const target = snapshot.branch?.target;
+  if (!isNonEmptyString(source) || !isNonEmptyString(target)) {
+    violations.push(violation2("high", "coordination.row.handoff-field", "standalone completed handoff requires nonblank branch.source and branch.target"));
+  } else {
+    if (handoff.source_branch !== source) {
+      violations.push(violation2("high", "coordination.row.handoff-field", `standalone completed handoff source_branch ${String(handoff.source_branch)} must equal branch.source ${source}`));
+    }
+  }
+  return violations;
+}
 function stableJson(value) {
   if (Array.isArray(value))
     return `[${value.map(stableJson).join(",")}]`;
@@ -916,13 +973,17 @@ function validateWorkflowSnapshot(doc) {
   } else if (!Array.isArray(doc.plans)) {
     violations.push(violation2("high", "workflow.snapshot.invalid-plans", "plans must be an array of legacy plan rows"));
   } else {
+    const snapshotDoc = doc;
     for (const row of doc.plans) {
       violations.push(...validatePlanRow(row).violations);
       if (isPlainObject2(row) && row.execution_lease !== undefined) {
         violations.push(...validateExecutionLease(row.execution_lease).violations);
       }
       if (isPlainObject2(row) && row.coordination !== undefined) {
-        violations.push(...validateRowCoordination(row.coordination, `plans[${String(row.id)}].coordination`));
+        const planRow = row;
+        const route = rowValidationRoute(snapshotDoc, planRow);
+        violations.push(...validateRowCoordination(row.coordination, `plans[${String(row.id)}].coordination`, route));
+        violations.push(...validateStandaloneCompletedCoherence(snapshotDoc, planRow));
       }
     }
   }
@@ -1883,6 +1944,176 @@ function slugify(title) {
 }
 var escapeCell = (value) => value.replace(/\|/g, "\\|");
 var truncate = (value, max) => value.length > max ? `${value.slice(0, max)}…` : value;
+var collapseEvidenceWs = (value) => value.replace(/\s*[\r\n]\s*/g, " ");
+var evidenceText = (item) => typeof item === "string" ? item : `${item.file}${item.line !== undefined ? `:${item.line}` : ""} — ${item.description}`;
+var hasEnrichedMetadata = (finding) => finding.fingerprint !== undefined || finding.trace !== undefined || finding.severity !== undefined || finding.evidence.some((item) => typeof item !== "string");
+var AUDIT_FINGERPRINT_RE = /^[A-Za-z0-9][A-Za-z0-9._:/@+-]*(?![\s\S])/;
+var AUDIT_SEVERITY_ORDER = { informational: 0, low: 1, medium: 2, high: 3, critical: 4 };
+var DEFAULT_IGNORABLE_RE = /[\u00AD\u034F\u061C\u115F\u1160\u17B4\u17B5\u180B-\u180F\u200B-\u200F\u202A-\u202E\u2060-\u206F\u3164\uFE00-\uFE0F\uFEFF\uFFA0\uFFF0-\uFFF8\u{1BCA0}-\u{1BCA3}\u{1D173}-\u{1D17A}\u{E0000}-\u{E0FFF}]/u;
+var LONE_SURROGATE_RE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+var isPlainObject3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function isVisibleText(value) {
+  if (LONE_SURROGATE_RE.test(value))
+    return false;
+  for (const ch of value) {
+    if (!/\p{White_Space}/u.test(ch) && !DEFAULT_IGNORABLE_RE.test(ch))
+      return true;
+  }
+  return false;
+}
+function safeAuditPath(value) {
+  if (typeof value !== "string")
+    return false;
+  if (value === "")
+    return false;
+  if (value.includes("\\"))
+    return false;
+  if (/[\u0000-\u001F\u007F-\u009F]/.test(value))
+    return false;
+  if (LONE_SURROGATE_RE.test(value))
+    return false;
+  if (value.startsWith("/"))
+    return false;
+  if (/^[A-Za-z]:/.test(value))
+    return false;
+  for (const segment of value.split("/")) {
+    if (segment === "" || segment === "." || segment === "..")
+      return false;
+    if (segment.endsWith(".") || segment.endsWith(" "))
+      return false;
+  }
+  return true;
+}
+function validateAuditFindingGates(findings) {
+  const violations = [];
+  const seen = new Map;
+  let previousFingerprint;
+  if (!Array.isArray(findings)) {
+    violations.push(violation4("high", "audit.finding.shape", "findings — audit.finding.shape"));
+    return { ok: false, violations };
+  }
+  findings.forEach((finding, index) => {
+    const at = (field) => `findings[${index}].${field}`;
+    const push = (code, field) => {
+      violations.push(violation4("high", code, `${at(field)} — ${code}`));
+    };
+    if (!isPlainObject3(finding)) {
+      violations.push(violation4("high", "audit.finding.shape", `findings[${index}] — audit.finding.shape`));
+      return;
+    }
+    if (finding.fingerprint !== undefined) {
+      const fingerprint = finding.fingerprint;
+      if (typeof fingerprint !== "string" || !AUDIT_FINGERPRINT_RE.test(fingerprint))
+        push("audit.finding.fingerprint.grammar", "fingerprint");
+      else if (redactSecrets(fingerprint).text !== fingerprint)
+        push("audit.finding.fingerprint.secret", "fingerprint");
+      else {
+        const firstAt = seen.get(fingerprint);
+        if (firstAt !== undefined)
+          push("audit.finding.fingerprint.duplicate", "fingerprint");
+        else
+          seen.set(fingerprint, index);
+        if (previousFingerprint !== undefined && fingerprint < previousFingerprint) {
+          push("audit.finding.fingerprint.order", "fingerprint");
+        }
+        previousFingerprint = fingerprint;
+      }
+    }
+    if (finding.severity !== undefined) {
+      if (!isPlainObject3(finding.severity)) {
+        push("audit.finding.severity.shape", "severity");
+      } else {
+        const { likelihood, impact, overall } = finding.severity;
+        const rankOf = (r) => AUDIT_SEVERITY_ORDER[r];
+        for (const [field, value] of [
+          ["likelihood", likelihood],
+          ["impact", impact],
+          ["overall", overall]
+        ]) {
+          if (rankOf(value) === undefined)
+            push("audit.finding.severity.rank", `severity.${field}`);
+        }
+        const impactRank = rankOf(impact);
+        const overallRank = rankOf(overall);
+        if (impactRank !== undefined && overallRank !== undefined && overallRank > impactRank) {
+          push("audit.finding.severity.overall-exceeds-impact", "severity.overall");
+        }
+      }
+    }
+    const textViolation = (field, value) => {
+      if (value === undefined)
+        return;
+      if (typeof value !== "string")
+        push("audit.finding.text.type", field);
+      else if (LONE_SURROGATE_RE.test(value))
+        push("audit.finding.text.surrogate", field);
+      else if (!isVisibleText(value))
+        push("audit.finding.text.invisible", field);
+    };
+    if (finding.trace !== undefined) {
+      if (!Array.isArray(finding.trace))
+        push("audit.finding.trace.shape", "trace");
+      else if (finding.trace.length === 0)
+        push("audit.finding.trace.empty", "trace");
+      else {
+        const kinds = finding.trace.map((s) => isPlainObject3(s) ? s.kind : undefined);
+        const topologyOk = finding.trace.length === 1 ? kinds[0] === "entrypoint" || kinds[0] === "sink" : kinds[0] === "entrypoint" && kinds[kinds.length - 1] === "sink" && kinds.slice(1, -1).every((k) => k === "propagation");
+        if (!topologyOk)
+          push("audit.finding.trace.topology", "trace");
+        finding.trace.forEach((step, stepIndex) => {
+          const stepAt = `trace[${stepIndex}]`;
+          if (!isPlainObject3(step)) {
+            push("audit.finding.trace.shape", stepAt);
+            return;
+          }
+          if (typeof step.line !== "number" || !Number.isSafeInteger(step.line) || step.line <= 0) {
+            push("audit.finding.trace.line", `${stepAt}.line`);
+          }
+          const stepFile = step.file;
+          if (typeof stepFile !== "string" || !safeAuditPath(stepFile))
+            push("audit.finding.path.unsafe", `${stepAt}.file`);
+          else if (redactSecrets(stepFile).text !== stepFile)
+            push("audit.finding.path.secret", `${stepAt}.file`);
+          if (step.scope === undefined)
+            push("audit.finding.trace.shape", `${stepAt}.scope`);
+          else
+            textViolation(`${stepAt}.scope`, step.scope);
+          if (step.description === undefined)
+            push("audit.finding.trace.shape", `${stepAt}.description`);
+          else
+            textViolation(`${stepAt}.description`, step.description);
+        });
+      }
+    }
+    if (!Array.isArray(finding.evidence))
+      push("audit.finding.evidence.shape", "evidence");
+    else
+      finding.evidence.forEach((item, itemIndex) => {
+        if (typeof item === "string") {
+          textViolation(`evidence[${itemIndex}]`, item);
+          return;
+        }
+        if (!isPlainObject3(item)) {
+          push("audit.finding.evidence.shape", `evidence[${itemIndex}]`);
+          return;
+        }
+        const itemFile = item.file;
+        if (typeof itemFile !== "string" || !safeAuditPath(itemFile))
+          push("audit.finding.path.unsafe", `evidence[${itemIndex}].file`);
+        else if (redactSecrets(itemFile).text !== itemFile)
+          push("audit.finding.path.secret", `evidence[${itemIndex}].file`);
+        if (item.line !== undefined && (typeof item.line !== "number" || !Number.isSafeInteger(item.line) || item.line <= 0)) {
+          push("audit.finding.evidence.line", `evidence[${itemIndex}].line`);
+        }
+        textViolation(`evidence[${itemIndex}].description`, item.description);
+      });
+    textViolation("title", finding.title);
+    textViolation("impact", finding.impact);
+    textViolation("fixSketch", finding.fixSketch);
+    textViolation("verification", finding.verification);
+  });
+  return { ok: violations.length === 0, violations };
+}
 function renderPlanFile(finding, plannedAt) {
   const sections = [
     `# ${finding.title}`,
@@ -1891,15 +2122,22 @@ function renderPlanFile(finding, plannedAt) {
     `- **Priority**: ${finding.priority}`,
     `- **Effort**: ${finding.effort}`,
     `- **Risk**: ${finding.risk}`,
+    ...finding.confidence !== "MED" || hasEnrichedMetadata(finding) ? [`- **Confidence**: ${finding.confidence}`] : [],
+    ...finding.fingerprint !== undefined ? [`- **Fingerprint**: ${finding.fingerprint}`] : [],
+    ...finding.severity !== undefined ? [`- **Likelihood**: ${finding.severity.likelihood}`, `- **Severity impact**: ${finding.severity.impact}`, `- **Severity**: ${finding.severity.overall}`] : [],
     `- **Depends on**: ${finding.dependsOn ?? "none"}`,
     `- **Category**: ${finding.category}`,
+    ...finding.evidence.length > 0 ? [`- **Evidence**: ${collapseEvidenceWs(evidenceText(finding.evidence[0]))}`] : [],
     `- **Planned at**: commit \`${plannedAt.commit}\`, ${plannedAt.date}`,
     "",
     "## Impact",
     finding.impact
   ];
   if (finding.evidence.length > 0) {
-    sections.push("", "## Evidence", ...finding.evidence.map((e) => `- ${e}`));
+    sections.push("", "## Evidence", ...finding.evidence.map((item) => `- ${evidenceText(item)}`));
+  }
+  if (finding.trace !== undefined) {
+    sections.push("", "## Trace", "", "| Kind | Location | Scope / Description |", "|------|----------|---------------------|", ...finding.trace.map((step) => `| ${escapeCell(step.kind)} | ${escapeCell(`${step.file}:${step.line}`)} | ${escapeCell(`${step.scope} — ${step.description}`).replace(/\r\n|\r|\n/g, "\\n")} |`));
   }
   if (finding.fixSketch !== undefined) {
     sections.push("", "## Fix sketch", finding.fixSketch);
@@ -1919,7 +2157,8 @@ function redactFinding(finding) {
     ...finding,
     title: redactText(finding.title),
     impact: redactText(finding.impact),
-    evidence: finding.evidence.map(redactText),
+    evidence: finding.evidence.map((item) => typeof item === "string" ? redactText(item) : { ...item, description: redactText(item.description) }),
+    ...finding.trace !== undefined ? { trace: finding.trace.map((step) => ({ ...step, scope: redactText(step.scope), description: redactText(step.description) })) } : {},
     ...finding.fixSketch !== undefined ? { fixSketch: redactText(finding.fixSketch) } : {},
     ...finding.verification !== undefined ? { verification: redactText(finding.verification) } : {}
   };
@@ -1941,7 +2180,10 @@ function extractSecurityDispositionSections(text) {
 }
 function renderIndex(params) {
   const { date, repoName, repoShortSha, rows, rejected, needsVerification, hardeningChecked } = params;
-  const findingsRows = rows.map((r) => `| ${r.num} | ${escapeCell(r.title)} | ${r.category} | ${escapeCell(truncate(r.impact, 80))} | ${r.effort} | ${r.risk} | ${r.confidence} | ${escapeCell(truncate(r.evidence, 80))} |`).join(`
+  const showFingerprint = rows.some((r) => r.fingerprint !== undefined);
+  const showSeverity = rows.some((r) => r.likelihood !== undefined || r.severityImpact !== undefined || r.severity !== undefined);
+  const cell = (value) => escapeCell(value ?? "—");
+  const findingsRows = rows.map((r) => `| ${r.num} | ${escapeCell(r.title)} | ${r.category} | ${escapeCell(truncate(r.impact, 80))} | ${r.effort} | ${r.risk} | ${r.confidence} | ${escapeCell(truncate(r.evidence, 80))}` + (showFingerprint ? ` | ${cell(r.fingerprint)}` : "") + (showSeverity ? ` | ${cell(r.likelihood)} | ${cell(r.severityImpact)} | ${cell(r.severity)}` : "") + " |").join(`
 `);
   const directionRows = rows.filter((r) => r.category === "direction").map((r) => `- ${escapeCell(r.title)} — ${escapeCell(truncate(r.impact, 120))}`).join(`
 `);
@@ -1954,8 +2196,8 @@ function renderIndex(params) {
     "",
     "## Findings",
     "",
-    "| # | Finding | Category | Impact | Effort | Risk | Confidence | Evidence |",
-    "|---|---------|----------|--------|--------|------|------------|----------|",
+    "| # | Finding | Category | Impact | Effort | Risk | Confidence | Evidence" + (showFingerprint ? " | Fingerprint" : "") + (showSeverity ? " | Likelihood | Severity impact | Severity" : "") + " |",
+    "|---|---------|----------|--------|--------|------|------------|----------" + (showFingerprint ? "|------------" : "") + (showSeverity ? "|------------|-----------------|----------" : "") + "|",
     findingsRows
   ];
   if (directionRows !== "") {
@@ -1979,6 +2221,11 @@ function renderIndex(params) {
 function scaffoldAuditPlan(outDir, findings, options = {}) {
   const date = options.date ?? new Date().toISOString().slice(0, 10);
   const plannedAt = options.plannedAt ?? { commit: options.repoShortSha ?? "unknown", date };
+  const gate = validateAuditFindingGates(findings);
+  if (!gate.ok) {
+    const first = gate.violations[0];
+    throw new TypeError(`invalid audit findings — ${first.code}: ${first.message}`);
+  }
   mkdirSync5(outDir, { recursive: true });
   const existingReadme = join9(outDir, "README.md");
   const carried = existsSync7(existingReadme) ? extractSecurityDispositionSections(readFileSync7(existingReadme, "utf8")) : { needsVerification: [], hardeningChecked: [] };
@@ -2013,10 +2260,14 @@ function scaffoldAuditPlan(outDir, findings, options = {}) {
       impact: "see plan file",
       effort: fields.get("Effort") ?? "—",
       risk: fields.get("Risk") ?? "—",
-      confidence: "—",
+      confidence: fields.get("Confidence") ?? "—",
       evidence: fields.get("Evidence") ?? "—",
       priority: fields.get("Priority") ?? "—",
-      dependsOn: fields.get("Depends on") ?? "—"
+      dependsOn: fields.get("Depends on") ?? "—",
+      fingerprint: fields.get("Fingerprint"),
+      likelihood: fields.get("Likelihood"),
+      severityImpact: fields.get("Severity impact"),
+      severity: fields.get("Severity")
     };
   });
   const byNum = new Map(rows.map((r) => [r.num, r]));
@@ -2031,9 +2282,13 @@ function scaffoldAuditPlan(outDir, findings, options = {}) {
       row.effort = finding.effort;
       row.risk = finding.risk;
       row.confidence = finding.confidence;
-      row.evidence = finding.evidence[0] ?? "";
+      row.evidence = finding.evidence.length > 0 ? collapseEvidenceWs(evidenceText(finding.evidence[0])) : "";
       row.priority = finding.priority;
       row.dependsOn = finding.dependsOn ?? "none";
+      row.fingerprint = finding.fingerprint;
+      row.likelihood = finding.severity?.likelihood;
+      row.severityImpact = finding.severity?.impact;
+      row.severity = finding.severity?.overall;
     }
   });
   const needsVerificationLines = options.needsVerification !== undefined ? options.needsVerification.map((nv) => `- ${escapeCell(redactText(nv.lead))}: ${escapeCell(redactText(nv.how))}${nv.evidence ? ` (${escapeCell(redactText(nv.evidence))})` : ""}`) : carried.needsVerification;
@@ -2220,5 +2475,6 @@ export {
   scaffoldAuditPlan,
   scanSecrets,
   supplyChainChecks,
+  validateAuditFindingGates,
   validateAuditStatusBlocks
 };

package/dist/coordination-write.d.ts

@@ -1,6 +1,6 @@
 import type { ValidationResult } from "./core.js";
 /** Stable refusal codes of the scoped coordination surface (spec §C4). */
-export declare const COORDINATION_ERROR_CODES: readonly ["coordination.harness-not-found", "coordination.workflow-not-found", "coordination.plan-not-found", "coordination.scope-mismatch", "coordination.path-mismatch", "coordination.assignment-invalid", "coordination.assignment-stale", "coordination.not-prepared", "coordination.duplicate-holder", "coordination.session-mismatch", "coordination.session-not-found", "coordination.session-role", "coordination.version-conflict", "coordination.expected-version-required", "coordination.invalid-transition", "coordination.invalid-input", "coordination.forbidden-field", "coordination.not-in-git", "coordination.git-unavailable", "coordination.git-proof", "coordination.evidence-stale", "coordination.integration-unresolved", "coordination.integration-diverged", "coordination.local-store-required", "coordination.direct-write-refused", "coordination.scoped-writer-required", "coordination.unknown-operation", "coordination.store", "coordination.prepare-amendment.stale", "coordination.prepare-amendment.invalid-patch", "coordination.prepare-amendment.not-prepare", "coordination.prepare-amendment.execution-started", "coordination.prepare-amendment.duplicate-plan", "coordination.prepare-amendment.invalid-plan", "coordination.prepare-amendment.compass-mismatch", "coordination.prepare-amendment.invalid-worktree"];
+export declare const COORDINATION_ERROR_CODES: readonly ["coordination.harness-not-found", "coordination.workflow-not-found", "coordination.plan-not-found", "coordination.scope-mismatch", "coordination.path-mismatch", "coordination.assignment-invalid", "coordination.assignment-stale", "coordination.not-prepared", "coordination.duplicate-holder", "coordination.session-mismatch", "coordination.session-not-found", "coordination.session-role", "coordination.version-conflict", "coordination.expected-version-required", "coordination.invalid-transition", "coordination.invalid-input", "coordination.forbidden-field", "coordination.not-in-git", "coordination.git-unavailable", "coordination.git-proof", "coordination.evidence-stale", "coordination.integration-unresolved", "coordination.integration-diverged", "coordination.local-store-required", "coordination.direct-write-refused", "coordination.scoped-writer-required", "coordination.unknown-operation", "coordination.store", "coordination.prepare-amendment.stale", "coordination.prepare-amendment.invalid-patch", "coordination.prepare-amendment.not-prepare", "coordination.prepare-amendment.execution-started", "coordination.prepare-amendment.duplicate-plan", "coordination.prepare-amendment.invalid-plan", "coordination.prepare-amendment.compass-mismatch", "coordination.prepare-amendment.invalid-worktree", "coordination.delivery-source-repair.unsupported-workflow", "coordination.delivery-source-repair.terminal", "coordination.delivery-source-repair.no-accepted-handoff", "coordination.delivery-source-repair.already-aligned", "coordination.delivery-source-repair.not-legacy-shape", "coordination.delivery-source-repair.pr-conflict"];
 export type CoordinationErrorCode = (typeof COORDINATION_ERROR_CODES)[number];
 /**
  * Stable exception of the coordination surface: `code` is the consumer
@@ -156,12 +156,14 @@ export declare const HANDOFF_STATES: readonly HandoffState[];
 export declare const PLAN_PROGRESS_STATUSES: readonly PlanProgressStatus[];
 /** Validate a stored `PlanProgress` (`status`, `summary`, `evidence_paths`, `track_branches`). */
 export declare function validatePlanProgress(value: unknown, what?: string): ValidationResult[];
+/** Route-aware stored handoff validation (spec A5). Default remains strict integration. */
+export type RowValidationRoute = "integration" | "standalone-development";
 /** Validate a stored `PlanHandoff`, including its state/field coherence. */
-export declare function validatePlanHandoff(value: unknown, what?: string): ValidationResult[];
+export declare function validatePlanHandoff(value: unknown, what?: string, route?: RowValidationRoute): ValidationResult[];
 /** Validate a stored `PreparedCoordination`. */
 export declare function validatePreparedCoordination(value: unknown, what?: string): ValidationResult[];
 /** Validate one plan row's `coordination` object (spec §C2). */
-export declare function validateRowCoordination(value: unknown, what?: string): ValidationResult[];
+export declare function validateRowCoordination(value: unknown, what?: string, route?: RowValidationRoute): ValidationResult[];
 /** Validate a snapshot's top `coordination` block (spec §C2). */
 export declare function validateSnapshotCoordination(value: unknown, what?: string): ValidationResult[];
 /** Hash-pinned evidence reference for an absolute path, read from disk. */

package/dist/coordination.d.ts

@@ -197,6 +197,9 @@ export type PlanCoordinationOperation = {
 } | {
     kind: "complete";
     handoffId: string;
+} | {
+    kind: "repair-delivery-source";
+    handoffId: string;
 } | {
     kind: "reconcile";
     handoffId: string;
@@ -272,6 +275,8 @@ export declare function bindPlanSession(input: BindPlanSessionInput): Promise<Co
  * an unknown key anywhere is rejected before any state is touched.
  */
 export declare function mutatePlanCoordination(request: CoordinationRequest): Promise<CoordinationResult>;
+/** Test-only hook to observe the precheck→mutate gap in standalone complete. */
+export declare function setCompleteStandaloneMutateGapForTest(callback: (() => void) | undefined): void;
 /**
  * Replace a coordinated artifact with an exact-version precondition (spec §B,
  * §C4 line 156). Snapshot replacement goes through the canonical snapshot