@neurcode-ai/cli 0.9.65 → 0.10.0

package/dist/daemon/shaping.js

@@ -0,0 +1,240 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildGovernanceEnvelope = buildGovernanceEnvelope;
+exports.buildExecutionResponseMeta = buildExecutionResponseMeta;
+exports.normalizeVerifyPayloadForLegacyClients = normalizeVerifyPayloadForLegacyClients;
+exports.normalizeFixPayloadForLegacyClients = normalizeFixPayloadForLegacyClients;
+const node_crypto_1 = require("node:crypto");
+const execution_actions_1 = require("../utils/execution-actions");
+function firstString(...values) {
+    for (const value of values) {
+        if (typeof value !== 'string')
+            continue;
+        const trimmed = value.trim();
+        if (trimmed.length > 0)
+            return trimmed;
+    }
+    return null;
+}
+function collectReceiptIds(payload) {
+    const receipts = [];
+    const patch = asObjectRecord(payload?.patch);
+    const directReceipt = asObjectRecord(payload?.receipt) || asObjectRecord(patch?.receipt);
+    const directId = firstString(payload?.receiptId, patch?.receiptId, directReceipt?.id, directReceipt?.receiptId, directReceipt?.transactionId);
+    if (directId)
+        receipts.push(directId);
+    return [...new Set(receipts)].sort();
+}
+function buildGovernanceEnvelope(run, options = {}) {
+    const semantics = (0, execution_actions_1.getExecutionActionSemantics)(run.execution.type);
+    const primaryPayload = run.primaryPayload;
+    const verificationPayload = run.verificationPayload;
+    const primaryGovernance = asObjectRecord(primaryPayload?.governanceVerification);
+    const verificationGovernance = asObjectRecord(verificationPayload?.governanceVerification);
+    const primaryReplayIntegrity = asObjectRecord(primaryPayload?.replayIntegrity)
+        || asObjectRecord(primaryGovernance?.replayIntegrity);
+    const verificationReplayIntegrity = asObjectRecord(verificationPayload?.replayIntegrity)
+        || asObjectRecord(verificationGovernance?.replayIntegrity);
+    const compatibilityBoundary = options.compatibilityBoundary || (semantics.class === 'compatibility-mutation'
+        ? {
+            routeScope: 'compatibility-mutation',
+            actionClass: semantics.class,
+            compatibilityAction: true,
+            compatibilityQuarantined: true,
+            canonicalRuntime: false,
+        }
+        : null);
+    const executionBoundary = options.executionBoundary || compatibilityBoundary || {
+        routeScope: semantics.class === 'canonical-governance' ? 'canonical-governance' : 'runtime-operation',
+        actionClass: semantics.class,
+        compatibilityAction: false,
+        canonicalRuntime: semantics.class === 'canonical-governance',
+    };
+    return {
+        schemaVersion: 'neurcode.governance-envelope.v1',
+        identity: {
+            executionId: run.execution.id,
+            executionType: run.execution.type,
+            fingerprint: run.execution.fingerprint,
+            source: run.execution.source,
+            actor: run.execution.actor,
+            target: run.execution.target,
+            createdAt: run.execution.createdAt,
+            completedAt: run.execution.completedAt,
+        },
+        boundary: {
+            actionClass: semantics.class,
+            runtimeBoundary: semantics.class === 'compatibility-mutation'
+                ? 'compatibility-mutation'
+                : semantics.class,
+            mutatesCode: semantics.mutatesCode,
+            compatibilityAction: (0, execution_actions_1.isCompatibilityExecutionActionType)(run.execution.type),
+            executionBoundary,
+            compatibilityBoundary,
+        },
+        custody: {
+            evidence: {
+                generated: run.execution.evidence.generated,
+                references: run.execution.evidence.references,
+                retentionLimit: run.execution.evidence.retentionLimit,
+            },
+            replay: {
+                checksum: firstString(primaryPayload?.replayChecksum, verificationPayload?.replayChecksum, primaryGovernance?.replayChecksum, verificationGovernance?.replayChecksum),
+                mode: firstString(primaryPayload?.replayMode, verificationPayload?.replayMode, primaryGovernance?.replayMode, verificationGovernance?.replayMode),
+                integrity: verificationReplayIntegrity || primaryReplayIntegrity || null,
+            },
+            provenance: {
+                runId: firstString(primaryPayload?.provenanceRunId, verificationPayload?.provenanceRunId, primaryGovernance?.provenanceRunId, verificationGovernance?.provenanceRunId),
+                generatedAt: firstString(primaryPayload?.provenanceRunAt, verificationPayload?.provenanceRunAt, primaryGovernance?.provenanceRunAt, verificationGovernance?.provenanceRunAt),
+            },
+            policy: {
+                policyLockFingerprint: firstString(primaryPayload?.policyLockFingerprint, verificationPayload?.policyLockFingerprint, primaryGovernance?.policyLockFingerprint, verificationGovernance?.policyLockFingerprint),
+                compiledPolicyFingerprint: firstString(primaryPayload?.compiledPolicyFingerprint, verificationPayload?.compiledPolicyFingerprint, primaryGovernance?.compiledPolicyFingerprint, verificationGovernance?.compiledPolicyFingerprint),
+            },
+            receipts: {
+                ids: collectReceiptIds(primaryPayload),
+            },
+        },
+        lineage: {
+            verificationTrend: run.execution.verification.diff.trend,
+            beforeCounts: run.execution.verification.diff.before,
+            afterCounts: run.execution.verification.diff.after,
+            blockingDelta: run.execution.verification.diff.blockingDelta,
+            advisoryDelta: run.execution.verification.diff.advisoryDelta,
+            stageCount: run.execution.events.length,
+        },
+    };
+}
+function buildExecutionResponseMeta(run, options = {}) {
+    const semantics = (0, execution_actions_1.getExecutionActionSemantics)(run.execution.type);
+    const governanceEnvelope = buildGovernanceEnvelope(run, options);
+    return {
+        id: run.execution.id,
+        type: run.execution.type,
+        actionClass: semantics.class,
+        compatibilityAction: (0, execution_actions_1.isCompatibilityExecutionActionType)(run.execution.type),
+        mutatesCode: semantics.mutatesCode,
+        defaultReverify: semantics.defaultReverify,
+        runtimeBoundary: semantics.class === 'compatibility-mutation'
+            ? 'compatibility-mutation'
+            : semantics.class,
+        source: run.execution.source,
+        actor: run.execution.actor,
+        status: run.execution.status,
+        trend: run.execution.verification.diff.trend,
+        evidence: run.execution.evidence.references,
+        durationMs: run.execution.durationMs,
+        governanceEnvelope,
+    };
+}
+function asObjectRecord(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    return value;
+}
+function asObjectArray(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value
+        .map((entry) => asObjectRecord(entry))
+        .filter((entry) => entry !== null);
+}
+function toLegacyViolation(entry, fallbackSeverity) {
+    const file = typeof entry.file === 'string' && entry.file.trim().length > 0
+        ? entry.file.trim()
+        : '';
+    const message = typeof entry.message === 'string' && entry.message.trim().length > 0
+        ? entry.message.trim()
+        : '';
+    if (!file || !message)
+        return null;
+    const severity = typeof entry.severity === 'string' && entry.severity.trim().length > 0
+        ? entry.severity.trim()
+        : fallbackSeverity;
+    const rule = typeof entry.rule === 'string' && entry.rule.trim().length > 0
+        ? entry.rule.trim()
+        : typeof entry.policy === 'string' && entry.policy.trim().length > 0
+            ? entry.policy.trim()
+            : '';
+    return { file, message, severity, rule };
+}
+function normalizeVerifyPayloadForLegacyClients(payload) {
+    if (!payload)
+        return null;
+    const existingViolations = asObjectArray(payload.violations)
+        .map((entry) => toLegacyViolation(entry, 'warn'))
+        .filter((entry) => entry !== null);
+    const blockingItems = asObjectArray(payload.blockingItems)
+        .map((entry) => toLegacyViolation(entry, 'block'))
+        .filter((entry) => entry !== null);
+    const advisoryItems = asObjectArray(payload.advisoryItems)
+        .map((entry) => toLegacyViolation(entry, 'warn'))
+        .filter((entry) => entry !== null);
+    const warnings = asObjectArray(payload.warnings)
+        .map((entry) => toLegacyViolation(entry, 'warn'))
+        .filter((entry) => entry !== null);
+    const merged = [...existingViolations];
+    const canonicalSeverity = (value) => {
+        const normalized = value.trim().toLowerCase();
+        if (normalized === 'block' || normalized === 'critical' || normalized === 'high')
+            return 'block';
+        if (normalized === 'warn' || normalized === 'warning' || normalized === 'advisory' || normalized === 'medium' || normalized === 'low')
+            return 'warn';
+        return normalized;
+    };
+    const canonicalKey = (entry) => `${entry.file}::${entry.rule}::${entry.message}::${canonicalSeverity(entry.severity)}`;
+    const seen = new Set(merged.map((entry) => canonicalKey(entry)));
+    for (const item of [...blockingItems, ...advisoryItems, ...warnings]) {
+        const key = canonicalKey(item);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        merged.push(item);
+    }
+    if (merged.length === 0)
+        return payload;
+    return {
+        ...payload,
+        violations: merged,
+    };
+}
+function normalizeFixPayloadForLegacyClients(payload) {
+    if (!payload)
+        return null;
+    const suggestions = asObjectArray(payload.suggestions);
+    if (suggestions.length === 0)
+        return payload;
+    const deduped = [];
+    const seen = new Set();
+    for (const suggestion of suggestions) {
+        const file = typeof suggestion.file === 'string' ? suggestion.file.trim() : '';
+        const line = typeof suggestion.line === 'number' && Number.isFinite(suggestion.line)
+            ? String(Math.floor(suggestion.line))
+            : '';
+        const message = typeof suggestion.message === 'string' ? suggestion.message.trim() : '';
+        const rule = typeof suggestion.rule === 'string'
+            ? suggestion.rule.trim()
+            : typeof suggestion.policy === 'string'
+                ? suggestion.policy.trim()
+                : '';
+        const confidence = typeof suggestion.confidence === 'string' ? suggestion.confidence.trim().toLowerCase() : '';
+        const patch = asObjectRecord(suggestion.patch);
+        const patchDiff = patch && typeof patch.diff === 'string' ? patch.diff : '';
+        const key = `${file}::${line}::${rule}::${message}::${confidence}::${(0, node_crypto_1.createHash)('sha1').update(patchDiff).digest('hex')}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        deduped.push(suggestion);
+    }
+    if (deduped.length === suggestions.length)
+        return payload;
+    return {
+        ...payload,
+        suggestions: deduped,
+        _normalization: {
+            ...(asObjectRecord(payload._normalization) || {}),
+            suggestionsDeduped: suggestions.length - deduped.length,
+        },
+    };
+}
+//# sourceMappingURL=shaping.js.map

package/dist/daemon/shaping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shaping.js","sourceRoot":"","sources":["../../src/daemon/shaping.ts"],"names":[],"mappings":";;AAoCA,0DAmHC;AAED,gEAwBC;AAsCD,wFA0CC;AAED,kFAuCC;AA1SD,6CAAyC;AAEzC,kEAGoC;AAOpC,SAAS,WAAW,CAAC,GAAG,MAAiB;IACvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuC;IAChE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,WAAW,CAC1B,OAAO,EAAE,SAAS,EAClB,KAAK,EAAE,SAAS,EAChB,aAAa,EAAE,EAAE,EACjB,aAAa,EAAE,SAAS,EACxB,aAAa,EAAE,aAAa,CAC7B,CAAC;IACF,IAAI,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,SAAgB,uBAAuB,CACrC,GAAuB,EACvB,UAAqC,EAAE;IAEvC,MAAM,SAAS,GAAG,IAAA,+CAA2B,EAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,GAAG,CAAC,cAAc,CAAC;IAC1C,MAAM,mBAAmB,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACpD,MAAM,iBAAiB,GAAG,cAAc,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC;IACjF,MAAM,sBAAsB,GAAG,cAAc,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAC;IAC3F,MAAM,sBAAsB,GAAG,cAAc,CAAC,cAAc,EAAE,eAAe,CAAC;WACzE,cAAc,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;IACxD,MAAM,2BAA2B,GAAG,cAAc,CAAC,mBAAmB,EAAE,eAAe,CAAC;WACnF,cAAc,CAAC,sBAAsB,EAAE,eAAe,CAAC,CAAC;IAC7D,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,CAC7D,SAAS,CAAC,KAAK,KAAK,wBAAwB;QAC1C,CAAC,CAAC;YACE,UAAU,EAAE,wBAAwB;YACpC,WAAW,EAAE,SAAS,CAAC,KAAK;YAC5B,mBAAmB,EAAE,IAAI;YACzB,wBAAwB,EAAE,IAAI;YAC9B,gBAAgB,EAAE,KAAK;SACxB;QACH,CAAC,CAAC,IAAI,CACT,CAAC;IACF,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,qBAAqB,IAAI;QAC9E,UAAU,EAAE,SAAS,CAAC,KAAK,KAAK,sBAAsB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,mBAAmB;QACrG,WAAW,EAAE,SAAS,CAAC,KAAK;QAC5B,mBAAmB,EAAE,KAAK;QAC1B,gBAAgB,EAAE,SAAS,CAAC,KAAK,KAAK,sBAAsB;KAC7D,CAAC;IAEF,OAAO;QACL,aAAa,EAAE,iCAAiC;QAChD,QAAQ,EAAE;YACR,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE;YAC7B,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI;YACjC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW;YACtC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM;YAC5B,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,KAAK;YAC1B,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM;YAC5B,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,SAAS;YAClC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW;SACvC;QACD,QAAQ,EAAE;YACR,WAAW,EAAE,SAAS,CAAC,KAAK;YAC5B,eAAe,EAAE,SAAS,CAAC,KAAK,KAAK,wBAAwB;gBAC3D,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,SAAS,CAAC,KAAK;YACnB,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,mBAAmB,EAAE,IAAA,sDAAkC,EAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;YAC3E,iBAAiB;YACjB,qBAAqB;SACtB;QACD,OAAO,EAAE;YACP,QAAQ,EAAE;gBACR,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS;gBAC3C,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU;gBAC7C,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc;aACtD;YACD,MAAM,EAAE;gBACN,QAAQ,EAAE,WAAW,CACnB,cAAc,EAAE,cAAc,EAC9B,mBAAmB,EAAE,cAAc,EACnC,iBAAiB,EAAE,cAAc,EACjC,sBAAsB,EAAE,cAAc,CACvC;gBACD,IAAI,EAAE,WAAW,CACf,cAAc,EAAE,UAAU,EAC1B,mBAAmB,EAAE,UAAU,EAC/B,iBAAiB,EAAE,UAAU,EAC7B,sBAAsB,EAAE,UAAU,CACnC;gBACD,SAAS,EAAE,2BAA2B,IAAI,sBAAsB,IAAI,IAAI;aACzE;YACD,UAAU,EAAE;gBACV,KAAK,EAAE,WAAW,CAChB,cAAc,EAAE,eAAe,EAC/B,mBAAmB,EAAE,eAAe,EACpC,iBAAiB,EAAE,eAAe,EAClC,sBAAsB,EAAE,eAAe,CACxC;gBACD,WAAW,EAAE,WAAW,CACtB,cAAc,EAAE,eAAe,EAC/B,mBAAmB,EAAE,eAAe,EACpC,iBAAiB,EAAE,eAAe,EAClC,sBAAsB,EAAE,eAAe,CACxC;aACF;YACD,MAAM,EAAE;gBACN,qBAAqB,EAAE,WAAW,CAChC,cAAc,EAAE,qBAAqB,EACrC,mBAAmB,EAAE,qBAAqB,EAC1C,iBAAiB,EAAE,qBAAqB,EACxC,sBAAsB,EAAE,qBAAqB,CAC9C;gBACD,yBAAyB,EAAE,WAAW,CACpC,cAAc,EAAE,yBAAyB,EACzC,mBAAmB,EAAE,yBAAyB,EAC9C,iBAAiB,EAAE,yBAAyB,EAC5C,sBAAsB,EAAE,yBAAyB,CAClD;aACF;YACD,QAAQ,EAAE;gBACR,GAAG,EAAE,iBAAiB,CAAC,cAAc,CAAC;aACvC;SACF;QACD,OAAO,EAAE;YACP,iBAAiB,EAAE,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK;YACxD,YAAY,EAAE,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM;YACpD,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK;YAClD,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa;YAC5D,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa;YAC5D,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM;SACxC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,0BAA0B,CACxC,GAAuB,EACvB,UAAqC,EAAE;IAEvC,MAAM,SAAS,GAAG,IAAA,+CAA2B,EAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjE,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE;QACpB,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI;QACxB,WAAW,EAAE,SAAS,CAAC,KAAK;QAC5B,mBAAmB,EAAE,IAAA,sDAAkC,EAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;QAC3E,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,eAAe,EAAE,SAAS,CAAC,KAAK,KAAK,wBAAwB;YAC3D,CAAC,CAAC,wBAAwB;YAC1B,CAAC,CAAC,SAAS,CAAC,KAAK;QACnB,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM;QAC5B,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,KAAK;QAC1B,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM;QAC5B,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK;QAC5C,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU;QAC3C,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,UAAU;QACpC,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;SACrC,MAAM,CAAC,CAAC,KAAK,EAAoC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,iBAAiB,CACxB,KAA8B,EAC9B,gBAAkC;IAElC,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACzE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;QACnB,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAClF,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;QACtB,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACrF,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE;QACvB,CAAC,CAAC,gBAAgB,CAAC;IACrB,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACzE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;QACnB,CAAC,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAClE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE;YACrB,CAAC,CAAC,EAAE,CAAC;IAET,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,SAAgB,sCAAsC,CACpD,OAAuC;IAEvC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,kBAAkB,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;SACzD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;SAChD,MAAM,CAAC,CAAC,KAAK,EAA8E,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IAEjH,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC;SACvD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;SACjD,MAAM,CAAC,CAAC,KAAK,EAA8E,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IACjH,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC;SACvD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;SAChD,MAAM,CAAC,CAAC,KAAK,EAA8E,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IACjH,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC;SAC7C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;SAChD,MAAM,CAAC,CAAC,KAAK,EAA8E,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IAEjH,MAAM,MAAM,GAAG,CAAC,GAAG,kBAAkB,CAAC,CAAC;IACvC,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAU,EAAE;QAClD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,UAAU,IAAI,UAAU,KAAK,MAAM;YAAE,OAAO,OAAO,CAAC;QACjG,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,UAAU,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC;QACrJ,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,KAAwE,EAAU,EAAE,CACxG,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,KAAK,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;IAEzF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjE,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,aAAa,EAAE,GAAG,aAAa,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;QACrE,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,OAAO;QACL,GAAG,OAAO;QACV,UAAU,EAAE,MAAM;KACnB,CAAC;AACJ,CAAC;AAED,SAAgB,mCAAmC,CACjD,OAAuC;IAEvC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAE7C,MAAM,OAAO,GAAmC,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,GAAG,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;YAClF,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,OAAO,GAAG,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,GAAG,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ;YAC9C,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE;YACxB,CAAC,CAAC,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ;gBACrC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE;gBAC1B,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/G,MAAM,KAAK,GAAG,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,GAAG,GAAG,GAAG,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,OAAO,KAAK,UAAU,KAAK,IAAA,wBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1H,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC1D,OAAO;QACL,GAAG,OAAO;QACV,WAAW,EAAE,OAAO;QACpB,cAAc,EAAE;YACd,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YACjD,kBAAkB,EAAE,WAAW,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM;SACxD;KACF,CAAC;AACJ,CAAC"}

package/dist/governance/canonical-invariants.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Canonical Finding Invariants (Phase 1 + Phase 3)
+ *
+ * Two responsibilities:
+ *
+ * 1. Architectural invariant enforcement (Phase 1):
+ *    - Assert that policyViolations never contain structural:* rows
+ *    - If violated, emit a deterministic console warning (never throw)
+ *    - This guards against regressions where future code re-introduces the merge
+ *
+ * 2. Replay determinism (Phase 3):
+ *    - computeCanonicalFindingChecksum(): deterministic SHA-256 over finding set
+ *    - sortFindingsDeterministically(): canonical sort order for stable checksums
+ *
+ * Both functions are pure and dependency-free (only Node 'crypto').
+ */
+import type { GovernanceFinding } from '@neurcode-ai/contracts';
+import type { RuleViolation } from '@neurcode-ai/policy-engine';
+/**
+ * Assert that the policyViolations array contains no structural:* prefixed rows.
+ *
+ * Structural violations MUST flow only through `payload.structuralViolations`
+ * into the canonical pipeline. Structural rows in policyViolations cause
+ * cross-source duplicate GovernanceFinding objects.
+ *
+ * This guard emits a console.warn if violated — it NEVER throws. The intention
+ * is observability and regression detection, not hard failure. The pipeline's
+ * stripStructuralPolicyRows() provides the actual cleanup.
+ *
+ * @param violations  The policyViolations array before it reaches the pipeline
+ * @param context     Caller label for the warning message (e.g. 'verify:policy-only')
+ * @returns           Count of structural rows found (0 = invariant holds)
+ */
+export declare function assertNoStructuralPolicyRows(violations: RuleViolation[], context: string): number;
+/**
+ * Sort findings into a canonical deterministic order.
+ *
+ * Sort key (descending priority):
+ *   1. determinismClassification rank (descending — structural first)
+ *   2. severity rank (descending — BLOCKING first)
+ *   3. filePath (ascending — lexicographic)
+ *   4. line number (ascending)
+ *   5. id (ascending — stable tiebreaker)
+ *
+ * This order is stable across multiple runs on the same input, enabling
+ * reliable replay checksum comparison.
+ *
+ * NEVER mutates the input array — returns a new sorted array.
+ */
+export declare function sortFindingsDeterministically(findings: GovernanceFinding[]): GovernanceFinding[];
+/**
+ * Compute a deterministic SHA-256 checksum over the canonical finding set.
+ *
+ * Checksum input is built from sorted findings:
+ *   for each finding (in canonical sort order):
+ *     id + '\x1e' + severity + '\x1e' + determinismClassification +
+ *     '\x1e' + filePath + '\x1e' + line
+ *   joined with '\x00'
+ *
+ * This checksum:
+ *   - Changes if any finding is added, removed, or has severity/determinism changed
+ *   - Changes if canonical ordering changes (sort key must be stable)
+ *   - Is stable across process restarts on the same input
+ *   - Is used to detect replay drift (same commit + diff + rules → same checksum)
+ *
+ * @param findings  Raw findings from the canonical pipeline (NOT pre-sorted)
+ * @returns         hex SHA-256 string (64 chars)
+ */
+export declare function computeCanonicalFindingChecksum(findings: GovernanceFinding[]): string;
+/**
+ * Compare two sets of findings for replay equivalence.
+ *
+ * Returns a structured comparison result:
+ *   - 'exact': checksums match — identical governance output
+ *   - 'drift-detected': checksums differ — replay divergence
+ *
+ * @param baseline  Findings from the baseline (e.g. cached) run
+ * @param replay    Findings from the current run
+ */
+export declare function compareForReplayEquivalence(baseline: GovernanceFinding[], replay: GovernanceFinding[]): {
+    status: 'exact' | 'drift-detected';
+    baselineChecksum: string;
+    replayChecksum: string;
+    baselineCount: number;
+    replayCount: number;
+    driftDetails?: string;
+};
+//# sourceMappingURL=canonical-invariants.d.ts.map

package/dist/governance/canonical-invariants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-invariants.d.ts","sourceRoot":"","sources":["../../src/governance/canonical-invariants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAIhE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAC1C,UAAU,EAAE,aAAa,EAAE,EAC3B,OAAO,EAAE,MAAM,GACd,MAAM,CAYR;AA4BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,iBAAiB,EAAE,CAyBhG;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAgBrF;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,iBAAiB,EAAE,EAC7B,MAAM,EAAE,iBAAiB,EAAE,GAC1B;IACD,MAAM,EAAE,OAAO,GAAG,gBAAgB,CAAC;IACnC,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CA2CA"}

package/dist/governance/canonical-invariants.js

@@ -0,0 +1,197 @@
+"use strict";
+/**
+ * Canonical Finding Invariants (Phase 1 + Phase 3)
+ *
+ * Two responsibilities:
+ *
+ * 1. Architectural invariant enforcement (Phase 1):
+ *    - Assert that policyViolations never contain structural:* rows
+ *    - If violated, emit a deterministic console warning (never throw)
+ *    - This guards against regressions where future code re-introduces the merge
+ *
+ * 2. Replay determinism (Phase 3):
+ *    - computeCanonicalFindingChecksum(): deterministic SHA-256 over finding set
+ *    - sortFindingsDeterministically(): canonical sort order for stable checksums
+ *
+ * Both functions are pure and dependency-free (only Node 'crypto').
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertNoStructuralPolicyRows = assertNoStructuralPolicyRows;
+exports.sortFindingsDeterministically = sortFindingsDeterministically;
+exports.computeCanonicalFindingChecksum = computeCanonicalFindingChecksum;
+exports.compareForReplayEquivalence = compareForReplayEquivalence;
+const crypto_1 = require("crypto");
+// ── Phase 1: Architectural invariant guard ────────────────────────────────────
+/**
+ * Assert that the policyViolations array contains no structural:* prefixed rows.
+ *
+ * Structural violations MUST flow only through `payload.structuralViolations`
+ * into the canonical pipeline. Structural rows in policyViolations cause
+ * cross-source duplicate GovernanceFinding objects.
+ *
+ * This guard emits a console.warn if violated — it NEVER throws. The intention
+ * is observability and regression detection, not hard failure. The pipeline's
+ * stripStructuralPolicyRows() provides the actual cleanup.
+ *
+ * @param violations  The policyViolations array before it reaches the pipeline
+ * @param context     Caller label for the warning message (e.g. 'verify:policy-only')
+ * @returns           Count of structural rows found (0 = invariant holds)
+ */
+function assertNoStructuralPolicyRows(violations, context) {
+    const leaked = violations.filter(v => String(v.rule ?? '').startsWith('structural:'));
+    if (leaked.length > 0) {
+        console.warn(`[neurcode/canonical-invariant] VIOLATION in ${context}: ` +
+            `${leaked.length} structural:* row(s) found in policyViolations. ` +
+            `These should flow exclusively through payload.structuralViolations. ` +
+            `Rows: ${leaked.map(v => v.rule).join(', ')}. ` +
+            `The canonical pipeline will strip them, but this represents a source-level duplication bug.`);
+    }
+    return leaked.length;
+}
+// ── Phase 3: Replay determinism ───────────────────────────────────────────────
+/**
+ * Determinism rank for sorting (higher = more deterministic = sorted first).
+ * Identical to rankDeterminism in canonical-pipeline.ts — kept separate to
+ * avoid circular import.
+ */
+function rankDeterminism(d) {
+    switch (d) {
+        case 'deterministic-structural': return 4;
+        case 'deterministic-semantic': return 3;
+        case 'heuristic-advisory': return 2;
+        case 'llm-assisted-planning': return 1;
+        default: return 0;
+    }
+}
+function rankSeverity(s) {
+    switch (s) {
+        case 'BLOCKING': return 3;
+        case 'ADVISORY': return 2;
+        case 'INFO': return 1;
+        default: return 0;
+    }
+}
+/**
+ * Sort findings into a canonical deterministic order.
+ *
+ * Sort key (descending priority):
+ *   1. determinismClassification rank (descending — structural first)
+ *   2. severity rank (descending — BLOCKING first)
+ *   3. filePath (ascending — lexicographic)
+ *   4. line number (ascending)
+ *   5. id (ascending — stable tiebreaker)
+ *
+ * This order is stable across multiple runs on the same input, enabling
+ * reliable replay checksum comparison.
+ *
+ * NEVER mutates the input array — returns a new sorted array.
+ */
+function sortFindingsDeterministically(findings) {
+    return [...findings].sort((a, b) => {
+        // 1. Determinism rank descending
+        const dA = rankDeterminism(a.determinismClassification);
+        const dB = rankDeterminism(b.determinismClassification);
+        if (dA !== dB)
+            return dB - dA;
+        // 2. Severity descending
+        const sA = rankSeverity(a.severity);
+        const sB = rankSeverity(b.severity);
+        if (sA !== sB)
+            return sB - sA;
+        // 3. File path ascending
+        const fA = a.evidence?.filePath ?? '';
+        const fB = b.evidence?.filePath ?? '';
+        if (fA !== fB)
+            return fA < fB ? -1 : 1;
+        // 4. Line number ascending
+        const lA = a.evidence?.line ?? 0;
+        const lB = b.evidence?.line ?? 0;
+        if (lA !== lB)
+            return lA - lB;
+        // 5. ID ascending (stable tiebreaker)
+        return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
+    });
+}
+/**
+ * Compute a deterministic SHA-256 checksum over the canonical finding set.
+ *
+ * Checksum input is built from sorted findings:
+ *   for each finding (in canonical sort order):
+ *     id + '\x1e' + severity + '\x1e' + determinismClassification +
+ *     '\x1e' + filePath + '\x1e' + line
+ *   joined with '\x00'
+ *
+ * This checksum:
+ *   - Changes if any finding is added, removed, or has severity/determinism changed
+ *   - Changes if canonical ordering changes (sort key must be stable)
+ *   - Is stable across process restarts on the same input
+ *   - Is used to detect replay drift (same commit + diff + rules → same checksum)
+ *
+ * @param findings  Raw findings from the canonical pipeline (NOT pre-sorted)
+ * @returns         hex SHA-256 string (64 chars)
+ */
+function computeCanonicalFindingChecksum(findings) {
+    const sorted = sortFindingsDeterministically(findings);
+    const input = sorted
+        .map(f => [
+        f.id,
+        f.severity,
+        f.determinismClassification,
+        f.evidence?.filePath ?? '',
+        String(f.evidence?.line ?? 0),
+    ].join('\x1e'))
+        .join('\x00');
+    return (0, crypto_1.createHash)('sha256').update(input, 'utf-8').digest('hex');
+}
+/**
+ * Compare two sets of findings for replay equivalence.
+ *
+ * Returns a structured comparison result:
+ *   - 'exact': checksums match — identical governance output
+ *   - 'drift-detected': checksums differ — replay divergence
+ *
+ * @param baseline  Findings from the baseline (e.g. cached) run
+ * @param replay    Findings from the current run
+ */
+function compareForReplayEquivalence(baseline, replay) {
+    const baselineChecksum = computeCanonicalFindingChecksum(baseline);
+    const replayChecksum = computeCanonicalFindingChecksum(replay);
+    if (baselineChecksum === replayChecksum) {
+        return {
+            status: 'exact',
+            baselineChecksum,
+            replayChecksum,
+            baselineCount: baseline.length,
+            replayCount: replay.length,
+        };
+    }
+    // Drift detected — build detailed explanation
+    const baselineIds = new Set(baseline.map(f => f.id));
+    const replayIds = new Set(replay.map(f => f.id));
+    const added = replay.filter(f => !baselineIds.has(f.id)).map(f => f.id);
+    const removed = baseline.filter(f => !replayIds.has(f.id)).map(f => f.id);
+    // Findings present in both but with changed severity or determinism
+    const changed = [];
+    for (const bf of baseline) {
+        const rf = replay.find(f => f.id === bf.id);
+        if (rf && (rf.severity !== bf.severity || rf.determinismClassification !== bf.determinismClassification)) {
+            changed.push(`${bf.id}(sev:${bf.severity}→${rf.severity},det:${bf.determinismClassification}→${rf.determinismClassification})`);
+        }
+    }
+    const parts = [];
+    if (added.length > 0)
+        parts.push(`added=${added.length}[${added.slice(0, 3).join(',')}${added.length > 3 ? '...' : ''}]`);
+    if (removed.length > 0)
+        parts.push(`removed=${removed.length}[${removed.slice(0, 3).join(',')}${removed.length > 3 ? '...' : ''}]`);
+    if (changed.length > 0)
+        parts.push(`changed=${changed.length}[${changed.slice(0, 3).join(',')}${changed.length > 3 ? '...' : ''}]`);
+    return {
+        status: 'drift-detected',
+        baselineChecksum,
+        replayChecksum,
+        baselineCount: baseline.length,
+        replayCount: replay.length,
+        driftDetails: parts.join('; ') || 'checksum mismatch (unknown cause)',
+    };
+}
+//# sourceMappingURL=canonical-invariants.js.map

package/dist/governance/canonical-invariants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-invariants.js","sourceRoot":"","sources":["../../src/governance/canonical-invariants.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;AAuBH,oEAeC;AA2CD,sEAyBC;AAoBD,0EAgBC;AAYD,kEAqDC;AA7MD,mCAAoC;AAIpC,iFAAiF;AAEjF;;;;;;;;;;;;;;GAcG;AACH,SAAgB,4BAA4B,CAC1C,UAA2B,EAC3B,OAAe;IAEf,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CACV,+CAA+C,OAAO,IAAI;YAC1D,GAAG,MAAM,CAAC,MAAM,kDAAkD;YAClE,sEAAsE;YACtE,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC/C,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,SAAS,eAAe,CAAC,CAAS;IAChC,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,0BAA0B,CAAC,CAAE,OAAO,CAAC,CAAC;QAC3C,KAAK,wBAAwB,CAAC,CAAI,OAAO,CAAC,CAAC;QAC3C,KAAK,oBAAoB,CAAC,CAAQ,OAAO,CAAC,CAAC;QAC3C,KAAK,uBAAuB,CAAC,CAAK,OAAO,CAAC,CAAC;QAC3C,OAAO,CAAC,CAA0B,OAAO,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,UAAU,CAAC,CAAE,OAAO,CAAC,CAAC;QAC3B,KAAK,UAAU,CAAC,CAAE,OAAO,CAAC,CAAC;QAC3B,KAAK,MAAM,CAAC,CAAM,OAAO,CAAC,CAAC;QAC3B,OAAO,CAAC,CAAU,OAAO,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,6BAA6B,CAAC,QAA6B;IACzE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjC,iCAAiC;QACjC,MAAM,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC;QACxD,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAE9B,yBAAyB;QACzB,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAE9B,yBAAyB;QACzB,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC;QACtC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEvC,2BAA2B;QAC3B,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC;QACjC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAE9B,sCAAsC;QACtC,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,+BAA+B,CAAC,QAA6B;IAC3E,MAAM,MAAM,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IAEvD,MAAM,KAAK,GAAG,MAAM;SACjB,GAAG,CAAC,CAAC,CAAC,EAAE,CACP;QACE,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,yBAAyB;QAC3B,CAAC,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE;QAC1B,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC;KAC9B,CAAC,IAAI,CAAC,MAAM,CAAC,CACf;SACA,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhB,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,2BAA2B,CACzC,QAA6B,EAC7B,MAA2B;IAS3B,MAAM,gBAAgB,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACnE,MAAM,cAAc,GAAK,+BAA+B,CAAC,MAAM,CAAC,CAAC;IAEjE,IAAI,gBAAgB,KAAK,cAAc,EAAE,CAAC;QACxC,OAAO;YACL,MAAM,EAAE,OAAO;YACf,gBAAgB;YAChB,cAAc;YACd,aAAa,EAAE,QAAQ,CAAC,MAAM;YAC9B,WAAW,EAAE,MAAM,CAAC,MAAM;SAC3B,CAAC;IACJ,CAAC;IAED,8CAA8C;IAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,MAAM,SAAS,GAAK,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEnD,MAAM,KAAK,GAAK,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAE1E,oEAAoE;IACpE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,KAAK,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,yBAAyB,KAAK,EAAE,CAAC,yBAAyB,CAAC,EAAE,CAAC;YACzG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,QAAQ,EAAE,CAAC,yBAAyB,IAAI,EAAE,CAAC,yBAAyB,GAAG,CAAC,CAAC;QAClI,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAI,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5H,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpI,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAEpI,OAAO;QACL,MAAM,EAAE,gBAAgB;QACxB,gBAAgB;QAChB,cAAc;QACd,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,WAAW,EAAE,MAAM,CAAC,MAAM;QAC1B,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mCAAmC;KACtE,CAAC;AACJ,CAAC"}

package/dist/governance/canonical-ordering.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Canonical Deterministic Ordering (Phase 1 — Canonical Deterministic Ordering)
+ *
+ * Single source of truth for finding sort order across:
+ *   - replayChecksum generation
+ *   - provenance serialization
+ *   - governance envelope emission
+ *   - telemetry harvesting
+ *
+ * INVARIANT:
+ *   Any two invocations on the same logical finding set MUST produce
+ *   the same ordered array, regardless of:
+ *   - filesystem traversal order
+ *   - async execution timing
+ *   - insertion order
+ *   - Map iteration order
+ *   - Object.keys() order
+ *
+ * Canonical sort key (evaluated in priority order):
+ *   1. severity          (BLOCKING > ADVISORY > INFO > unknown)
+ *   2. determinismClassification (deterministic-structural > deterministic-semantic
+ *                                 > heuristic-advisory > llm-assisted-planning > unknown)
+ *   3. ruleId            (ascending lexicographic)
+ *   4. filePath          (ascending lexicographic, normalized to forward slashes)
+ *   5. line              (ascending numeric, missing = 0)
+ *   6. column            (ascending numeric, missing = 0)
+ *   7. findingId         (ascending lexicographic — stable tiebreaker, always unique)
+ *
+ * These rules ensure a total order: no two distinct findings can be equal on
+ * all 7 keys simultaneously (findingId is always unique by construction).
+ */
+import type { GovernanceFinding } from '@neurcode-ai/contracts';
+/**
+ * Compute the canonical ordering key for a single finding.
+ *
+ * Returns a tuple whose elements, compared left-to-right, produce the
+ * canonical ordering defined above. Useful for inspection and testing.
+ *
+ * Format: [severityRank, determinismRank, ruleId, filePath, line, column, id]
+ */
+export declare function canonicalFindingOrderingKey(f: GovernanceFinding): readonly [
+    number,
+    number,
+    string,
+    string,
+    number,
+    number,
+    string
+];
+/**
+ * Sort findings into the canonical deterministic order.
+ *
+ * Properties:
+ *   - Pure function — NEVER mutates the input array
+ *   - Stable across process restarts for identical inputs
+ *   - Independent of insertion order, Map iteration, filesystem traversal
+ *   - Total order — no two distinct findings can compare as equal
+ *
+ * @param findings  Any array of GovernanceFinding (may be in any order)
+ * @returns         New sorted array (input is not mutated)
+ */
+export declare function sortCanonicalFindingsStable(findings: GovernanceFinding[]): GovernanceFinding[];
+/**
+ * Validate that a finding array is already in canonical order.
+ *
+ * Returns the index of the first out-of-order finding pair, or -1 if
+ * the array is already sorted. Used for invariant checking.
+ *
+ * Emits a console.warn if ordering drift is detected.
+ *
+ * @param findings  Array to validate (not mutated)
+ * @param context   Caller label for the warning (e.g. 'envelope-emit')
+ * @returns         Index of first violation, or -1 if canonical
+ */
+export declare function validateCanonicalOrder(findings: GovernanceFinding[], context: string): number;
+//# sourceMappingURL=canonical-ordering.d.ts.map

package/dist/governance/canonical-ordering.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-ordering.d.ts","sourceRoot":"","sources":["../../src/governance/canonical-ordering.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAsChE;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,iBAAiB,GAAG,SAAS;IAC1E,MAAM;IAAE,MAAM;IAAE,MAAM;IAAE,MAAM;IAAE,MAAM;IAAE,MAAM;IAAE,MAAM;CACvD,CAUA;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,iBAAiB,EAAE,CAmC9F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,iBAAiB,EAAE,EAC7B,OAAO,EAAE,MAAM,GACd,MAAM,CA2CR"}