@neurcode-ai/cli 0.10.1 → 0.12.0

package/dist/governance/pipeline/helpers.js

@@ -0,0 +1,112 @@
+"use strict";
+/**
+ * Pipeline execution helpers.
+ *
+ * Compresses the repetitive verify.ts wire-in pattern:
+ *
+ *   const stageResult = await runStage(stage, input, ctx);
+ *   const value = stageResult.output ?? fallback(...);
+ *
+ * into a single named helper, while preserving:
+ *   - the underlying determinism of the wrapped function
+ *   - the staged-pipeline ledger receipt
+ *   - the byte-for-byte fallback semantics on isolated stage failure
+ *
+ * These are explicitly NOT a generic workflow engine. They are minimal,
+ * typed helpers for the four governance-pipeline wire-in patterns we
+ * encountered in verify.ts.
+ *
+ *   - runStageOrFallback        — "stage failed, compute the same thing without staging"
+ *   - runStageWithDegradedFallback — "stage succeeded but output was null; fall back"
+ *   - stageReceiptOrCompute     — "you only want a value; the receipt is bookkeeping"
+ *   - getLastStageOutput        — "read the most recent ledger entry for a stage"
+ *
+ * Replay invariant: when the stage succeeds, the helper returns the stage's
+ * output; the fallback is only used when the stage failed or produced null.
+ * The fallback MUST be byte-equivalent to the stage's execute body — that
+ * way semantics are preserved regardless of which branch ran.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runStageOrFallback = runStageOrFallback;
+exports.runStageOrAsyncFallback = runStageOrAsyncFallback;
+exports.runStageWithReceipt = runStageWithReceipt;
+exports.stageReceiptOrCompute = stageReceiptOrCompute;
+exports.stageDegradedOrFailed = stageDegradedOrFailed;
+exports.enumerateNonSuccessStages = enumerateNonSuccessStages;
+const runtime_1 = require("./runtime");
+/**
+ * Run a stage and unwrap its output. If the stage failed or returned null,
+ * invoke the supplied fallback synchronously and use that value instead.
+ *
+ * The ledger always receives a receipt regardless of outcome — the fallback
+ * does not produce its own receipt (that would double-count).
+ */
+async function runStageOrFallback(stage, input, ctx, fallback) {
+    const result = await (0, runtime_1.runStage)(stage, input, ctx);
+    if (result.output !== null && result.output !== undefined) {
+        return result.output;
+    }
+    return fallback();
+}
+/**
+ * Same as `runStageOrFallback`, but the fallback may be async (e.g. when it
+ * has to re-read from disk or call out to a sibling helper).
+ */
+async function runStageOrAsyncFallback(stage, input, ctx, fallback) {
+    const result = await (0, runtime_1.runStage)(stage, input, ctx);
+    if (result.output !== null && result.output !== undefined) {
+        return result.output;
+    }
+    return fallback();
+}
+/**
+ * Run a stage and return both the unwrapped output AND the full receipt.
+ * Useful when the caller needs to consult the receipt (e.g. for failure
+ * surfacing) but doesn't want to write the unwrap boilerplate.
+ */
+async function runStageWithReceipt(stage, input, ctx, fallback) {
+    const result = await (0, runtime_1.runStage)(stage, input, ctx);
+    const value = result.output !== null && result.output !== undefined
+        ? result.output
+        : fallback();
+    return { value, result };
+}
+/**
+ * If a stage has already run and produced output, return that. Otherwise run
+ * the supplied compute function (and DO NOT append a ledger entry — this is
+ * "look up or compute"). Used when verify.ts has already invoked a stage
+ * elsewhere and a later code path needs the same value without re-emitting.
+ */
+function stageReceiptOrCompute(ctx, stageId, compute) {
+    const prior = (0, runtime_1.getStageResult)(ctx, stageId);
+    if (prior && prior.output !== null && prior.output !== undefined) {
+        return prior.output;
+    }
+    return compute();
+}
+/**
+ * Convenience: did a given stage record any non-success status in the ledger?
+ *
+ * Returns true when the stage ran and its status is `degraded` or `failed`.
+ * Returns false when the stage succeeded OR has not yet run.
+ */
+function stageDegradedOrFailed(ctx, stageId) {
+    const prior = (0, runtime_1.getStageResult)(ctx, stageId);
+    if (!prior)
+        return false;
+    return prior.status === 'degraded' || prior.status === 'failed';
+}
+/**
+ * Convenience: enumerate all stages in the ledger that are NOT 'succeeded'.
+ * Used by computation-trace explainability helpers.
+ */
+function enumerateNonSuccessStages(ctx) {
+    const out = [];
+    for (const entry of ctx.ledger) {
+        if (entry.status !== 'succeeded') {
+            out.push({ stageId: entry.stageId, status: entry.status });
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=helpers.js.map

package/dist/governance/pipeline/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../../src/governance/pipeline/helpers.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;AAmBH,gDAWC;AAMD,0DAWC;AAOD,kDAYC;AAQD,sDAUC;AAQD,sDAOC;AAMD,8DAUC;AAzGD,uCAAqD;AAErD;;;;;;GAMG;AACI,KAAK,UAAU,kBAAkB,CACtC,KAAyC,EACzC,KAAU,EACV,GAA8B,EAC9B,QAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAQ,EAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,QAAQ,EAAE,CAAC;AACpB,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,uBAAuB,CAC3C,KAAyC,EACzC,KAAU,EACV,GAA8B,EAC9B,QAA6B;IAE7B,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAQ,EAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,QAAQ,EAAE,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,mBAAmB,CACvC,KAAyC,EACzC,KAAU,EACV,GAA8B,EAC9B,QAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAQ,EAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACjD,MAAM,KAAK,GACT,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QACnD,CAAC,CAAC,MAAM,CAAC,MAAM;QACf,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CACnC,GAA8B,EAC9B,OAA0B,EAC1B,OAAgB;IAEhB,MAAM,KAAK,GAAG,IAAA,wBAAc,EAAI,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjE,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IACD,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CACnC,GAA8B,EAC9B,OAA0B;IAE1B,MAAM,KAAK,GAAG,IAAA,wBAAc,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CACvC,GAA8B;IAE9B,MAAM,GAAG,GAAqF,EAAE,CAAC;IACjG,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/governance/pipeline/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Canonical Governance Pipeline — public surface.
+ *
+ * The pipeline transforms the verify orchestrator from a monolithic script
+ * into a staged, replayable, explainable runtime. Each stage:
+ *   - has a stable identifier from `GovernanceStageId`
+ *   - declares its determinism classification and boundary policy
+ *   - emits a replay-ready receipt (fingerprints, timings, dependencies)
+ *   - participates in computation-graph lineage via `producedByStage`
+ *
+ * Wire-level types live in `@neurcode-ai/contracts`. CLI-internal types
+ * (context, stage definitions) live alongside this module.
+ */
+export type { GovernancePipelineContext, GovernancePipelineStage, } from './types';
+export { OBSERVABILITY_BOUNDARY, STRICT_REQUIRED_BOUNDARY, } from './types';
+export { createPipelineContext, getStageResult, GovernanceStageAbortedError, runPipeline, runStage, } from './runtime';
+export type { RunStageOptions } from './runtime';
+export { buildPipelineSummary } from './summary';
+export { fingerprintStageSignal, stableStringify, } from './fingerprint';
+export { groupFindingsByStage, stampFindingLineage, } from './lineage';
+export { enumerateNonSuccessStages, runStageOrAsyncFallback, runStageOrFallback, runStageWithReceipt, stageDegradedOrFailed, stageReceiptOrCompute, } from './helpers';
+export { buildComputationTrace, renderComputationTrace, type GovernanceComputationTrace, type GovernanceComputationTraceRow, } from './computation-trace';
+export { buildPolicyOnlyCanonicalPayload, buildVerifyCanonicalPayload, type AiDebtSummaryFragment, type ChangeContractSummaryFragment, type CompiledPolicyMetadataFragment, type GovernancePayloadFragment, type IntentProofSummaryFragment, type PolicyDecisionFragment, type PolicyLockSummaryFragment, type PolicyOnlyCanonicalPayloadInput, type PolicyPackFragment, type RuntimeGuardSummaryFragment, type VerifyCanonicalPayloadInput, } from './envelope-assembly';
+export * from './orchestration';
+export type { PolicyOnlySource } from './shared-types';
+export * from './stages';
+//# sourceMappingURL=index.d.ts.map

package/dist/governance/pipeline/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/governance/pipeline/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,YAAY,EACV,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,2BAA2B,EAC3B,WAAW,EACX,QAAQ,GACT,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,6BAA6B,GACnC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,EACpC,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,GACjC,MAAM,qBAAqB,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,cAAc,UAAU,CAAC"}

package/dist/governance/pipeline/index.js

@@ -0,0 +1,63 @@
+"use strict";
+/**
+ * Canonical Governance Pipeline — public surface.
+ *
+ * The pipeline transforms the verify orchestrator from a monolithic script
+ * into a staged, replayable, explainable runtime. Each stage:
+ *   - has a stable identifier from `GovernanceStageId`
+ *   - declares its determinism classification and boundary policy
+ *   - emits a replay-ready receipt (fingerprints, timings, dependencies)
+ *   - participates in computation-graph lineage via `producedByStage`
+ *
+ * Wire-level types live in `@neurcode-ai/contracts`. CLI-internal types
+ * (context, stage definitions) live alongside this module.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildVerifyCanonicalPayload = exports.buildPolicyOnlyCanonicalPayload = exports.renderComputationTrace = exports.buildComputationTrace = exports.stageReceiptOrCompute = exports.stageDegradedOrFailed = exports.runStageWithReceipt = exports.runStageOrFallback = exports.runStageOrAsyncFallback = exports.enumerateNonSuccessStages = exports.stampFindingLineage = exports.groupFindingsByStage = exports.stableStringify = exports.fingerprintStageSignal = exports.buildPipelineSummary = exports.runStage = exports.runPipeline = exports.GovernanceStageAbortedError = exports.getStageResult = exports.createPipelineContext = exports.STRICT_REQUIRED_BOUNDARY = exports.OBSERVABILITY_BOUNDARY = void 0;
+var types_1 = require("./types");
+Object.defineProperty(exports, "OBSERVABILITY_BOUNDARY", { enumerable: true, get: function () { return types_1.OBSERVABILITY_BOUNDARY; } });
+Object.defineProperty(exports, "STRICT_REQUIRED_BOUNDARY", { enumerable: true, get: function () { return types_1.STRICT_REQUIRED_BOUNDARY; } });
+var runtime_1 = require("./runtime");
+Object.defineProperty(exports, "createPipelineContext", { enumerable: true, get: function () { return runtime_1.createPipelineContext; } });
+Object.defineProperty(exports, "getStageResult", { enumerable: true, get: function () { return runtime_1.getStageResult; } });
+Object.defineProperty(exports, "GovernanceStageAbortedError", { enumerable: true, get: function () { return runtime_1.GovernanceStageAbortedError; } });
+Object.defineProperty(exports, "runPipeline", { enumerable: true, get: function () { return runtime_1.runPipeline; } });
+Object.defineProperty(exports, "runStage", { enumerable: true, get: function () { return runtime_1.runStage; } });
+var summary_1 = require("./summary");
+Object.defineProperty(exports, "buildPipelineSummary", { enumerable: true, get: function () { return summary_1.buildPipelineSummary; } });
+var fingerprint_1 = require("./fingerprint");
+Object.defineProperty(exports, "fingerprintStageSignal", { enumerable: true, get: function () { return fingerprint_1.fingerprintStageSignal; } });
+Object.defineProperty(exports, "stableStringify", { enumerable: true, get: function () { return fingerprint_1.stableStringify; } });
+var lineage_1 = require("./lineage");
+Object.defineProperty(exports, "groupFindingsByStage", { enumerable: true, get: function () { return lineage_1.groupFindingsByStage; } });
+Object.defineProperty(exports, "stampFindingLineage", { enumerable: true, get: function () { return lineage_1.stampFindingLineage; } });
+var helpers_1 = require("./helpers");
+Object.defineProperty(exports, "enumerateNonSuccessStages", { enumerable: true, get: function () { return helpers_1.enumerateNonSuccessStages; } });
+Object.defineProperty(exports, "runStageOrAsyncFallback", { enumerable: true, get: function () { return helpers_1.runStageOrAsyncFallback; } });
+Object.defineProperty(exports, "runStageOrFallback", { enumerable: true, get: function () { return helpers_1.runStageOrFallback; } });
+Object.defineProperty(exports, "runStageWithReceipt", { enumerable: true, get: function () { return helpers_1.runStageWithReceipt; } });
+Object.defineProperty(exports, "stageDegradedOrFailed", { enumerable: true, get: function () { return helpers_1.stageDegradedOrFailed; } });
+Object.defineProperty(exports, "stageReceiptOrCompute", { enumerable: true, get: function () { return helpers_1.stageReceiptOrCompute; } });
+var computation_trace_1 = require("./computation-trace");
+Object.defineProperty(exports, "buildComputationTrace", { enumerable: true, get: function () { return computation_trace_1.buildComputationTrace; } });
+Object.defineProperty(exports, "renderComputationTrace", { enumerable: true, get: function () { return computation_trace_1.renderComputationTrace; } });
+var envelope_assembly_1 = require("./envelope-assembly");
+Object.defineProperty(exports, "buildPolicyOnlyCanonicalPayload", { enumerable: true, get: function () { return envelope_assembly_1.buildPolicyOnlyCanonicalPayload; } });
+Object.defineProperty(exports, "buildVerifyCanonicalPayload", { enumerable: true, get: function () { return envelope_assembly_1.buildVerifyCanonicalPayload; } });
+__exportStar(require("./orchestration"), exports);
+__exportStar(require("./stages"), exports);
+//# sourceMappingURL=index.js.map

package/dist/governance/pipeline/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/governance/pipeline/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;AAMH,iCAGiB;AAFf,+GAAA,sBAAsB,OAAA;AACtB,iHAAA,wBAAwB,OAAA;AAE1B,qCAMmB;AALjB,gHAAA,qBAAqB,OAAA;AACrB,yGAAA,cAAc,OAAA;AACd,sHAAA,2BAA2B,OAAA;AAC3B,sGAAA,WAAW,OAAA;AACX,mGAAA,QAAQ,OAAA;AAGV,qCAAiD;AAAxC,+GAAA,oBAAoB,OAAA;AAC7B,6CAGuB;AAFrB,qHAAA,sBAAsB,OAAA;AACtB,8GAAA,eAAe,OAAA;AAEjB,qCAGmB;AAFjB,+GAAA,oBAAoB,OAAA;AACpB,8GAAA,mBAAmB,OAAA;AAErB,qCAOmB;AANjB,oHAAA,yBAAyB,OAAA;AACzB,kHAAA,uBAAuB,OAAA;AACvB,6GAAA,kBAAkB,OAAA;AAClB,8GAAA,mBAAmB,OAAA;AACnB,gHAAA,qBAAqB,OAAA;AACrB,gHAAA,qBAAqB,OAAA;AAEvB,yDAK6B;AAJ3B,0HAAA,qBAAqB,OAAA;AACrB,2HAAA,sBAAsB,OAAA;AAIxB,yDAc6B;AAb3B,oIAAA,+BAA+B,OAAA;AAC/B,gIAAA,2BAA2B,OAAA;AAa7B,kDAAgC;AAEhC,2CAAyB"}

package/dist/governance/pipeline/lineage.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Governance computation lineage helpers.
+ *
+ * Stamps a `producedByStage` lineage marker onto canonical findings without
+ * mutating their identity (id, severity, evidence) or replay checksum inputs.
+ *
+ * Use case: after a stage has emitted a set of findings, call
+ * `stampFindingLineage(findings, stageId)` to annotate them. This is purely
+ * observability — the canonical pipeline's stripping/sort/dedup logic remains
+ * authoritative for what reaches the envelope.
+ */
+import type { GovernanceFinding, GovernanceStageId } from '@neurcode-ai/contracts';
+/**
+ * Mutates each finding in place to attach `provenanceMetadata.producedByStage`.
+ * If a finding already has a stage stamp from an earlier wrapper, the existing
+ * value is preserved (closest stage wins).
+ *
+ * Returns the same array reference for chaining.
+ */
+export declare function stampFindingLineage(findings: GovernanceFinding[], stageId: GovernanceStageId): GovernanceFinding[];
+/**
+ * Read-only view: group findings by the stage that produced them.
+ * Findings with no lineage stamp are bucketed under '<unattributed>'.
+ */
+export declare function groupFindingsByStage(findings: readonly GovernanceFinding[]): Map<string, GovernanceFinding[]>;
+//# sourceMappingURL=lineage.d.ts.map

package/dist/governance/pipeline/lineage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lineage.d.ts","sourceRoot":"","sources":["../../../src/governance/pipeline/lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,wBAAwB,CAAC;AAEhC;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,iBAAiB,EAAE,EAC7B,OAAO,EAAE,iBAAiB,GACzB,iBAAiB,EAAE,CAWrB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,GACrC,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CASlC"}

package/dist/governance/pipeline/lineage.js

@@ -0,0 +1,51 @@
+"use strict";
+/**
+ * Governance computation lineage helpers.
+ *
+ * Stamps a `producedByStage` lineage marker onto canonical findings without
+ * mutating their identity (id, severity, evidence) or replay checksum inputs.
+ *
+ * Use case: after a stage has emitted a set of findings, call
+ * `stampFindingLineage(findings, stageId)` to annotate them. This is purely
+ * observability — the canonical pipeline's stripping/sort/dedup logic remains
+ * authoritative for what reaches the envelope.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stampFindingLineage = stampFindingLineage;
+exports.groupFindingsByStage = groupFindingsByStage;
+/**
+ * Mutates each finding in place to attach `provenanceMetadata.producedByStage`.
+ * If a finding already has a stage stamp from an earlier wrapper, the existing
+ * value is preserved (closest stage wins).
+ *
+ * Returns the same array reference for chaining.
+ */
+function stampFindingLineage(findings, stageId) {
+    for (const f of findings) {
+        if (!f.provenanceMetadata) {
+            f.provenanceMetadata = { producedByStage: stageId };
+            continue;
+        }
+        if (!f.provenanceMetadata.producedByStage) {
+            f.provenanceMetadata.producedByStage = stageId;
+        }
+    }
+    return findings;
+}
+/**
+ * Read-only view: group findings by the stage that produced them.
+ * Findings with no lineage stamp are bucketed under '<unattributed>'.
+ */
+function groupFindingsByStage(findings) {
+    const map = new Map();
+    for (const f of findings) {
+        const key = f.provenanceMetadata?.producedByStage ?? '<unattributed>';
+        const list = map.get(key);
+        if (list)
+            list.push(f);
+        else
+            map.set(key, [f]);
+    }
+    return map;
+}
+//# sourceMappingURL=lineage.js.map

package/dist/governance/pipeline/lineage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lineage.js","sourceRoot":"","sources":["../../../src/governance/pipeline/lineage.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAcH,kDAcC;AAMD,oDAWC;AAtCD;;;;;;GAMG;AACH,SAAgB,mBAAmB,CACjC,QAA6B,EAC7B,OAA0B;IAE1B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;YAC1B,CAAC,CAAC,kBAAkB,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;YACpD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,eAAe,EAAE,CAAC;YAC1C,CAAC,CAAC,kBAAkB,CAAC,eAAe,GAAG,OAAO,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,QAAsC;IAEtC,MAAM,GAAG,GAAG,IAAI,GAAG,EAA+B,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,CAAC,CAAC,kBAAkB,EAAE,eAAe,IAAI,gBAAgB,CAAC;QACtE,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YAClB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/governance/pipeline/orchestration/advisory-mode-contract.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Advisory-mode auto-contract construction.
+ *
+ * Builds a minimal `ChangeContract` for the advisory-first branch when no
+ * change contract exists. Extracted from `commands/verify.ts:6769` as part of
+ * the advisory-mode orchestration extraction.
+ *
+ * The contract is intentionally permissive (all `enforce*` flags false) — it
+ * captures "what changed" as a baseline so subsequent runs have something
+ * to compare against, without imposing enforcement.
+ */
+import type { DiffFile } from '@neurcode-ai/diff-parser';
+import { createChangeContract } from '../../../utils/change-contract';
+export declare function buildMinimalAdvisoryContractFromDiff(diffFiles: ReadonlyArray<DiffFile>, fallbackPlanId: string): ReturnType<typeof createChangeContract>;
+//# sourceMappingURL=advisory-mode-contract.d.ts.map

package/dist/governance/pipeline/orchestration/advisory-mode-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisory-mode-contract.d.ts","sourceRoot":"","sources":["../../../../src/governance/pipeline/orchestration/advisory-mode-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAMtE,wBAAgB,oCAAoC,CAClD,SAAS,EAAE,aAAa,CAAC,QAAQ,CAAC,EAClC,cAAc,EAAE,MAAM,GACrB,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAyBzC"}

package/dist/governance/pipeline/orchestration/advisory-mode-contract.js

@@ -0,0 +1,44 @@
+"use strict";
+/**
+ * Advisory-mode auto-contract construction.
+ *
+ * Builds a minimal `ChangeContract` for the advisory-first branch when no
+ * change contract exists. Extracted from `commands/verify.ts:6769` as part of
+ * the advisory-mode orchestration extraction.
+ *
+ * The contract is intentionally permissive (all `enforce*` flags false) — it
+ * captures "what changed" as a baseline so subsequent runs have something
+ * to compare against, without imposing enforcement.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildMinimalAdvisoryContractFromDiff = buildMinimalAdvisoryContractFromDiff;
+const change_contract_1 = require("../../../utils/change-contract");
+function toUnixPath(filePath) {
+    return filePath.replace(/\\/g, '/');
+}
+function buildMinimalAdvisoryContractFromDiff(diffFiles, fallbackPlanId) {
+    const expectedFiles = [...new Set(diffFiles.map(file => toUnixPath(file.path)).filter(Boolean))];
+    const planFiles = expectedFiles.map(path => {
+        const entry = diffFiles.find(file => toUnixPath(file.path) === path);
+        const changeType = entry?.changeType;
+        const action = changeType === 'add' ? 'CREATE' : 'MODIFY';
+        return {
+            path,
+            action: action,
+            reason: 'Auto-generated advisory baseline from current diff',
+        };
+    });
+    return (0, change_contract_1.createChangeContract)({
+        planId: fallbackPlanId,
+        intent: 'Advisory baseline generated from current repository diff',
+        expectedFiles,
+        planFiles,
+        options: {
+            enforceExpectedFiles: false,
+            enforceActionMatching: false,
+            enforceExpectedSymbols: false,
+            enforceSymbolActionMatching: false,
+        },
+    });
+}
+//# sourceMappingURL=advisory-mode-contract.js.map

package/dist/governance/pipeline/orchestration/advisory-mode-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisory-mode-contract.js","sourceRoot":"","sources":["../../../../src/governance/pipeline/orchestration/advisory-mode-contract.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AASH,oFA4BC;AAlCD,oEAAsE;AAEtE,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,SAAgB,oCAAoC,CAClD,SAAkC,EAClC,cAAsB;IAEtB,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACzC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QACrE,MAAM,UAAU,GAAG,KAAK,EAAE,UAAU,CAAC;QACrC,MAAM,MAAM,GAAG,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1D,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,MAA6B;YACrC,MAAM,EAAE,oDAAoD;SAC7D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,IAAA,sCAAoB,EAAC;QAC1B,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,0DAA0D;QAClE,aAAa;QACb,SAAS;QACT,OAAO,EAAE;YACP,oBAAoB,EAAE,KAAK;YAC3B,qBAAqB,EAAE,KAAK;YAC5B,sBAAsB,EAAE,KAAK;YAC7B,2BAA2B,EAAE,KAAK;SACnC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/governance/pipeline/orchestration/advisory-mode.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Advisory-Mode Orchestration
+ * ---------------------------
+ * Extracts the no-plan / advisory-first branch previously inlined at
+ * `commands/verify.ts:4161–4321`.
+ *
+ * RESPONSIBILITIES (data-pure):
+ *   - resolve auto-contract path when no change-contract is present
+ *   - evaluate advisory signals (with runtime-pressure gating)
+ *   - run structural rules (via the existing structural-analysis stage)
+ *   - compute verdict / grade / score
+ *   - assemble the advisory canonical payload
+ *
+ * EXPLICITLY NOT RESPONSIBLE FOR:
+ *   - human-readable rendering (caller owns chalk + printFirstRunAdvisoryMessage)
+ *   - emitting verify JSON (caller owns emitVerifyJson + emitCanonicalVerifyJson)
+ *   - recording telemetry verdict (caller owns recordVerifyEvent)
+ *   - calling exitWithEvidence (caller owns process termination)
+ *
+ * SEMANTIC PRESERVATION:
+ *   The output `payload` is byte-equivalent to the prior inline literal at
+ *   line ~4276 (the `emitVerifyJson({...})` call). Field order matches the
+ *   inline implementation so JSON serialization is identical.
+ *
+ * REPLAY INVARIANT:
+ *   - structural-analysis stage call is identical to the prior wire-in
+ *   - advisory signals evaluation is identical to the prior call
+ *   - structural-engine fault swallowing is preserved (try/swallow in compute)
+ */
+import { type AdvisorySignal } from '../../../utils/advisory-signals';
+import { type VerifyRuntimeContext } from '../../../utils/verify-runtime-stability';
+import type { GovernancePipelineContext } from '../types';
+import type { DiffFile } from '@neurcode-ai/diff-parser';
+import type { DiffSummary } from '@neurcode-ai/diff-parser';
+import type { StructuralViolation } from '../../../structural-rules/types';
+/**
+ * Mode-specific subset of `ChangeContractSummary` consumed by this module.
+ * Defined narrowly to avoid coupling to verify.ts's internal interface.
+ *
+ * Field types match the verify.ts `ChangeContractSummary` (notably
+ * `valid: boolean | null` and an optional/loose `coverage` shape) so we can
+ * pass the summary through without explicit casts.
+ */
+export interface AdvisoryChangeContractSummary {
+    path: string;
+    exists: boolean;
+    enforced: boolean;
+    valid: boolean | null;
+    planId: string | null;
+    contractId: string | null;
+    coverage?: Record<string, number> | unknown;
+    signature?: unknown;
+    violations: ReadonlyArray<unknown>;
+}
+export interface AdvisoryModeInput {
+    options: {
+        json?: boolean;
+        changeContract?: string;
+        demo?: boolean;
+    };
+    projectRoot: string;
+    diffFiles: DiffFile[];
+    summary: DiffSummary;
+    runtimeCtx: VerifyRuntimeContext;
+    changeContractRead: {
+        contract: unknown;
+    };
+    changeContractSummary: AdvisoryChangeContractSummary;
+    strictArtifactMode: boolean;
+    pipelineCtx: GovernancePipelineContext;
+}
+export interface AdvisoryModeResult {
+    /** Canonical payload ready to be passed to emitVerifyJson. */
+    payload: Record<string, unknown>;
+    /** Verdict for `recordVerifyEvent`. */
+    telemetry: {
+        verdict: 'WARN' | 'PASS';
+        detail: string;
+        files: string[];
+    };
+    /** Path of auto-generated change contract, when one was written. */
+    autoContractPath: string | null;
+    /** Auto-generated message text shown both in JSON and human modes. */
+    message: string;
+    /** Updated change-contract summary when an auto-contract was written. */
+    updatedChangeContractSummary: AdvisoryChangeContractSummary;
+    /** Advisory signals (forwarded to human render). */
+    advisorySignals: AdvisorySignal[];
+    /** Structural findings (advisory). */
+    advisoryStructuralViolations: StructuralViolation[];
+    /** Count of BLOCKING-severity structural findings in advisory mode. */
+    advisoryStructuralBlockingCount: number;
+    /** True when the advisory-signals layer was skipped due to runtime pressure. */
+    advisorySignalsSkipped: boolean;
+}
+/**
+ * Compute the advisory-mode result. Replaces the inline compute region.
+ *
+ * Does not emit JSON, does not log, does not exit.
+ */
+export declare function runAdvisoryMode(input: AdvisoryModeInput): Promise<AdvisoryModeResult>;
+//# sourceMappingURL=advisory-mode.d.ts.map

package/dist/governance/pipeline/orchestration/advisory-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisory-mode.d.ts","sourceRoot":"","sources":["../../../../src/governance/pipeline/orchestration/advisory-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,EAA2B,KAAK,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAC/F,OAAO,EAA2B,KAAK,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAI7G,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAG3E;;;;;;;GAOG;AACH,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAC5C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,OAAO,EAAE,WAAW,CAAC;IACrB,UAAU,EAAE,oBAAoB,CAAC;IACjC,kBAAkB,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAC1C,qBAAqB,EAAE,6BAA6B,CAAC;IACrD,kBAAkB,EAAE,OAAO,CAAC;IAC5B,WAAW,EAAE,yBAAyB,CAAC;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uCAAuC;IACvC,SAAS,EAAE;QACT,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;IACF,oEAAoE;IACpE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,4BAA4B,EAAE,6BAA6B,CAAC;IAC5D,oDAAoD;IACpD,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,sCAAsC;IACtC,4BAA4B,EAAE,mBAAmB,EAAE,CAAC;IACpD,uEAAuE;IACvE,+BAA+B,EAAE,MAAM,CAAC;IACxC,gFAAgF;IAChF,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAMD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAuI7B"}