@ngocsangairvds/vsaf 3.2.14 → 3.2.15

package/tools/vds-scripts/audit_orchestrator/tests/test_cli/test_smart_run_selection.py

@@ -1,1562 +0,0 @@
-"""Tests for smart run selection (FR-309) and is_targeted_run metadata (FR-310).
-
-Phase 97 -- Package YY-A: Make ``--from-db-runs`` prefer full-eval runs over
-targeted runs, and persist ``is_targeted_run`` flag in run payloads.
-"""
-
-from __future__ import annotations
-
-import json
-from pathlib import Path
-from types import SimpleNamespace
-from typing import Any
-
-import pytest
-from typer.testing import CliRunner
-from vds_audit_orchestrator import cli, workflow_cmds
-from vds_audit_orchestrator.config import reset_config
-
-runner = CliRunner()
-
-
-# ---------------------------------------------------------------------------
-# Autouse fixtures (adapted from test_workflow_project_db_modes.py)
-# ---------------------------------------------------------------------------
-
-
-@pytest.fixture(autouse=True)
-def _isolate_cli_runtime(monkeypatch: pytest.MonkeyPatch) -> None:
-    reset_config()
-    cli._cli_state.clear()
-    monkeypatch.setattr(
-        cli,
-        "apply_runtime_profile",
-        lambda *_a, **_k: SimpleNamespace(
-            profile_name="test",
-            source="test",
-            profile_path=Path("/tmp/test-profile.yaml"),
-            applied_env_keys=[],
-        ),
-    )
-    monkeypatch.setattr(cli, "load_shared_env", lambda *_a, **_k: {})
-    monkeypatch.setattr("vds_audit_orchestrator.config.load_shared_env", lambda *_a, **_k: {})
-    monkeypatch.setattr(
-        "vds_audit_orchestrator.config.DEFAULT_CONFIG_FILE", Path("/tmp/nonexistent-smart-run-test.yaml")
-    )
-    monkeypatch.setenv("VDS_AUDIT_BOOTSTRAP_HOME", "false")
-    monkeypatch.setenv("VDS_AUDIT_LANGGRAPH__POSTGRES_DSN", "postgresql://localhost/test")
-    monkeypatch.delenv("VDS_AUDIT_PROFILE", raising=False)
-    monkeypatch.delenv("VDS_AUDIT_ACTIVE_PROFILE", raising=False)
-    yield
-    cli._cli_state.clear()
-    reset_config()
-
-
-@pytest.fixture(autouse=True)
-def _stub_typed_run_persistence(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setattr(workflow_cmds, "_persist_typed_run_start", lambda **_kw: None)
-    monkeypatch.setattr(workflow_cmds, "_persist_typed_run_terminal", lambda **_kw: None)
-    monkeypatch.setattr(workflow_cmds, "_persist_checklist_state", lambda **_kw: None)
-
-
-@pytest.fixture(autouse=True)
-def _stub_state_helpers(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setattr(workflow_cmds, "_preflight_workflow_retrieval_snapshot", lambda **_kw: None)
-    monkeypatch.setattr(workflow_cmds, "_preflight_workflow_hierarchy_readiness", lambda **_kw: None)
-    monkeypatch.setattr(workflow_cmds, "_build_retrieval_snapshot_binding", lambda **_kw: {})
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_build_evidence_snapshot_binding",
-        lambda **_kw: {
-            "evidence_snapshot_id": "1",
-            "evidence_snapshot_key": "test:snapshot",
-            "evidence_snapshot_hash": "abc123",
-            "snapshot_persisted": True,
-        },
-    )
-
-
-# ---------------------------------------------------------------------------
-# Helpers
-# ---------------------------------------------------------------------------
-
-
-def _make_manifest(*, repos: list[tuple[str, Path]]) -> dict[str, Any]:
-    """Build a valid manifest payload with the given repos."""
-    return {
-        "projects": [
-            {
-                "project_name": "test-project",
-                "project_storage_key": "88730001",
-                "page_id": "88730001",
-                "page_url": "https://example.com/pages/88730001",
-                "documents": [{"page_id": "1", "title": "Doc"}],
-                "sync_metadata": {
-                    "artifacts": [{"resource_type": "confluence_page", "status": "updated"}],
-                },
-                "bitbucket": [
-                    {
-                        "repo_slug": slug,
-                        "local_code_path": str(path),
-                        "sync_decision": "updated",
-                        "status": "updated",
-                    }
-                    for slug, path in repos
-                ],
-            }
-        ],
-    }
-
-
-def _make_row_result(
-    *,
-    row_key: str,
-    row_index: int,
-    check_id: str,
-    status: str,
-    score: float,
-    finding: str = "",
-    severity: str = "medium",
-) -> dict[str, Any]:
-    return {
-        "row_key": row_key,
-        "row_index": row_index,
-        "check_id": check_id,
-        "status": status,
-        "score": score,
-        "finding": finding,
-        "reason": "",
-        "evidence_refs": [],
-        "provenance": {},
-        "payload": {"severity": severity},
-    }
-
-
-def _make_run(
-    *,
-    run_id: str,
-    project_key: str,
-    repo_key: str,
-    is_targeted: bool = False,
-    target_selector: str | None = None,
-    overall_score: float | None = None,
-) -> dict[str, Any]:
-    """Build a fake run row dict."""
-    payload: dict[str, Any] = {}
-    if is_targeted:
-        payload["is_targeted_run"] = True
-    if target_selector is not None:
-        payload["target_selector"] = target_selector
-    if overall_score is not None:
-        payload["overall_score"] = overall_score
-    return {
-        "id": hash(run_id) % 10000,
-        "run_pk": hash(run_id) % 10000,
-        "thread_id": f"t:{run_id}",
-        "run_id": run_id,
-        "project_key": project_key,
-        "repo_key": repo_key,
-        "status": "completed",
-        "payload": payload,
-        "started_at": "2026-03-01T10:00:00Z",
-        "finished_at": "2026-03-01T10:30:00Z",
-    }
-
-
-def _make_checklist_row_payload(
-    *,
-    row_id: str,
-    row_index: int,
-    check_id: str,
-    status: str,
-    final_score: float,
-    source_run_id: str | None = None,
-    retry_attempted: bool = False,
-    retry_outcome: str | None = None,
-    retry_trigger_reason: str | None = None,
-    retry_guardrail_applied: bool = False,
-    retry_count: int = 0,
-) -> dict[str, Any]:
-    provenance: dict[str, Any] = {
-        "row_llm_mode": "selective",
-        "protocol": "openai-codex",
-        "model": "gpt-5.3-codex",
-        "prompt_version": None,
-        "prompt_hash": None,
-        "instruction_profile": None,
-        "instruction_inputs": None,
-        "instruction_hash": None,
-        "template_hash": "tmplhash",
-        "rubric_version": "4",
-        "evidence_hash": "evhash",
-        "evaluated_at": "2026-03-06T06:00:00Z",
-        "evaluation_duration_ms": 1000,
-        "cache_hit": False,
-    }
-    if source_run_id is not None:
-        provenance["source_run_id"] = source_run_id
-    return {
-        "row_id": row_id,
-        "row_index": row_index,
-        "check_id": check_id,
-        "section_id": "1. Decoupling",
-        "requirement_text": f"Requirement for {check_id}",
-        "requirement_category": "1. Decoupling||Test",
-        "weight_raw": 1.0,
-        "weight_adjusted": 1.0,
-        "weight_adjustment_reason": None,
-        "status": status,
-        "score_breakdown": {
-            "raw_score": final_score,
-            "raw_score_0_10": final_score / 10.0,
-            "score_cap_applied": None,
-            "coverage_factor": 1.0,
-            "confidence_factor": 1.0,
-            "final_score": final_score,
-            "calculation_formula": "test",
-        },
-        "gating_applied": False,
-        "gating_reason": None,
-        "evidence_refs": [],
-        "retrieval_trace": {
-            "retry_count": retry_count,
-            "retry_attempted": retry_attempted,
-            "retry_outcome": retry_outcome,
-            "retry_trigger_reason": retry_trigger_reason,
-            "retry_guardrail_applied": retry_guardrail_applied,
-            "tool_first_loop": {
-                "steps_executed": 1,
-                "docs_search_count": 1,
-                "docs_read_count": 1,
-                "code_search_count": 0,
-                "code_read_count": 0,
-                "evidence_refs_count": 0,
-            },
-        },
-        "reason": f"{check_id} {status}",
-        "reasoning": "",
-        "finding": "" if status == "PASS" else f"Finding for {check_id}",
-        "severity": "medium",
-        "priority": "P2",
-        "effort": "M",
-        "recommendation": None,
-        "provenance": provenance,
-        "probe_results": None,
-        "retry_count": retry_count,
-        "retry_metadata": {
-            "corrective_retry_attempted": retry_attempted,
-            "corrective_retry_count": retry_count,
-            "corrective_retry_outcome": retry_outcome,
-            "corrective_retry_trigger_reason": retry_trigger_reason,
-            "corrective_retry_guardrail_applied": retry_guardrail_applied,
-        },
-        "coverage_requirements": 1.0,
-        "coverage_code": 0.5,
-        "coverage_docs": 0.5,
-        "coverage_confidence": 1.0,
-        "coverage_deterministic_downgrade_flag": False,
-    }
-
-
-def test_resolve_targeted_row_ids_from_artifacts_prefers_selector_when_delta_is_empty(tmp_path: Path) -> None:
-    requirement_mapping_path = tmp_path / "audit-checklist.requirement-mapping.preflight.json"
-    checklist_path = tmp_path / "audit-checklist.json"
-    delta_path = tmp_path / "audit-checklist.delta.json"
-    requirement_mapping_path.write_text(
-        json.dumps(
-            {
-                "rows": [
-                    {"row_id": "R2", "row_index": 1, "check_id": "CL-002", "requirement_text": "Second requirement"},
-                ]
-            }
-        ),
-        encoding="utf-8",
-    )
-    checklist_path.write_text(
-        json.dumps(
-            {
-                "rows": [
-                    {"row_id": "R1", "row_index": 0, "check_id": "CL-001", "requirement_text": "First requirement"},
-                    {"row_id": "R2", "row_index": 1, "check_id": "CL-002", "requirement_text": "Second requirement"},
-                ]
-            }
-        ),
-        encoding="utf-8",
-    )
-    delta_path.write_text(
-        json.dumps({"targeted_run": True, "changed_row_count": 0, "changed_rows": []}),
-        encoding="utf-8",
-    )
-
-    resolved = workflow_cmds._resolve_targeted_row_ids_from_artifacts(
-        requirement_mapping_path=requirement_mapping_path,
-        checklist_path=checklist_path,
-        delta_path=delta_path,
-        target="CL-002",
-    )
-
-    assert resolved == {"R2"}
-
-
-def test_refresh_targeted_merge_artifacts_rewrites_checklist_with_provenance(tmp_path: Path) -> None:
-    report_dir = tmp_path / "report"
-    report_dir.mkdir(parents=True)
-
-    current_payload = {
-        "checklist_version": "1.0.0",
-        "generated_at": "2026-03-06T06:00:00Z",
-        "template_name": "Test Checklist",
-        "template_version": "4",
-        "template_hash": "tmplhash",
-        "template_row_count": 2,
-        "repository": "repo-one",
-        "repository_ref": None,
-        "row_llm_mode": "selective",
-        "evidence_hash": "evhash",
-        "rows": [
-            _make_checklist_row_payload(
-                row_id="R1",
-                row_index=0,
-                check_id="CL-001",
-                status="N/A",
-                final_score=0.0,
-            ),
-            _make_checklist_row_payload(
-                row_id="R2",
-                row_index=1,
-                check_id="CL-002",
-                status="PASS",
-                final_score=95.0,
-            ),
-        ],
-        "stability_flags": [],
-    }
-    (report_dir / "audit-checklist.json").write_text(json.dumps(current_payload), encoding="utf-8")
-    (report_dir / "audit-checklist.delta.json").write_text(
-        json.dumps({"targeted_run": True, "changed_row_count": 1, "changed_rows": [{"row_id": "R2"}]}),
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.meta.json").write_text(
-        json.dumps(
-            {
-                "confluence": {
-                    "page_id": "88722450",
-                    "page_ids": ["88722450"],
-                    "page_title": "Checklist",
-                    "page_version": 1,
-                    "profile_id": "default",
-                    "source_table_index": 0,
-                },
-                "preflight": {
-                    "requirement_mapping": None,
-                    "security_evidence": None,
-                },
-                "profile_resolution": {},
-                "loader_diagnostics": {},
-                "paths": {},
-            }
-        ),
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.retrieval-trace.json").write_text(
-        json.dumps(
-            {
-                "schema": "audit-checklist.retrieval-trace.v1",
-                "generated_at": "2026-03-08T19:40:00Z",
-                "row_count": 2,
-                "rows": [
-                    {
-                        "row_id": "R1",
-                        "check_id": "CL-001",
-                        "status": "PASS",
-                        "score": 80.0,
-                        "route_mode": "hybrid_code_first",
-                        "route_id": "hybrid_code_first_search_read_verify_synthesize",
-                        "route_transition_reasons": ["code_first_requirement"],
-                        "selection_blocked_reason": None,
-                        "docs_search_count": 1,
-                        "docs_read_count": 2,
-                        "code_search_count": 1,
-                        "code_read_count": 3,
-                        "exploratory_ref_count": 8,
-                        "final_cited_ref_count": 2,
-                        "citation_retention_rate": 0.25,
-                    },
-                    {
-                        "row_id": "R2",
-                        "check_id": "CL-002",
-                        "status": "PASS",
-                        "score": 95.0,
-                        "retrieval_trace": {},
-                    },
-                ],
-            }
-        ),
-        encoding="utf-8",
-    )
-
-    merged_rows = [
-        {
-            "row_id": "R1",
-            "row_index": 0,
-            "check_id": "CL-001",
-            "status": "PASS",
-            "score": 80.0,
-            "finding": "",
-            "reason": "CL-001 PASS",
-            "evidence_refs": [],
-            "provenance": {"source_run_id": "run-base"},
-            "payload": _make_checklist_row_payload(
-                row_id="R1",
-                row_index=0,
-                check_id="CL-001",
-                status="PASS",
-                final_score=80.0,
-                source_run_id="run-base",
-            ),
-        },
-        {
-            "row_id": "R2",
-            "row_index": 1,
-            "check_id": "CL-002",
-            "status": "PASS",
-            "score": 95.0,
-            "finding": "",
-            "reason": "CL-002 PASS",
-            "evidence_refs": [],
-            "provenance": {"source_run_id": "run-target"},
-            "payload": _make_checklist_row_payload(
-                row_id="R2",
-                row_index=1,
-                check_id="CL-002",
-                status="PASS",
-                final_score=95.0,
-                source_run_id="run-target",
-                retry_attempted=True,
-                retry_outcome="retry_rejected_no_improvement",
-                retry_trigger_reason="unverified_ref_ratio_threshold",
-                retry_guardrail_applied=True,
-                retry_count=1,
-            ),
-        },
-    ]
-
-    refresh = workflow_cmds._refresh_targeted_merge_artifacts(
-        report_dir=report_dir,
-        merged_rows=merged_rows,
-        current_run_id="run-target",
-        target_selector="CL-002",
-        target_selector_raw=None,
-        prior_run_id="run-base",
-        merge_reason="runtime merge applied",
-    )
-
-    assert refresh["applied"] is True
-
-    rewritten = json.loads((report_dir / "audit-checklist.json").read_text(encoding="utf-8"))
-    assert rewritten["target_selector"] == "CL-002"
-    assert rewritten["is_targeted_run"] is True
-    assert rewritten["prior_run_id"] == "run-base"
-    assert rewritten["pass_count"] == 2
-    assert rewritten["na_count"] == 0
-    assert rewritten["overall_score"] == pytest.approx(87.5, abs=0.01)
-    rows_by_id = {row["row_id"]: row for row in rewritten["rows"]}
-    assert rows_by_id["R1"]["provenance"]["source_run_id"] == "run-base"
-    assert rows_by_id["R2"]["provenance"]["source_run_id"] == "run-target"
-
-    retrieval_trace = json.loads((report_dir / "audit-checklist.retrieval-trace.json").read_text(encoding="utf-8"))
-    assert retrieval_trace["row_count"] == 2
-    trace_rows = {row["row_id"]: row for row in retrieval_trace["rows"]}
-    assert trace_rows["R2"]["retry_count"] == 1
-    assert trace_rows["R2"]["retry_attempted"] is True
-    assert trace_rows["R2"]["retry_outcome"] == "retry_rejected_no_improvement"
-    assert trace_rows["R2"]["retry_trigger_reason"] == "unverified_ref_ratio_threshold"
-    assert trace_rows["R2"]["retry_guardrail_applied"] is True
-    assert trace_rows["R1"]["route_mode"] == "hybrid_code_first"
-    assert trace_rows["R1"]["code_read_count"] == 3
-    assert trace_rows["R1"]["final_cited_ref_count"] == 2
-    assert trace_rows["R1"]["citation_retention_rate"] == pytest.approx(0.25, abs=1e-9)
-
-    meta = json.loads((report_dir / "audit-checklist.meta.json").read_text(encoding="utf-8"))
-    assert meta["delta"]["merge_guardrail"]["action"] == "targeted_merge_applied"
-    delta = json.loads((report_dir / "audit-checklist.delta.json").read_text(encoding="utf-8"))
-    assert delta["rows_changed"] == 1
-    assert delta["rows_unchanged"] == 1
-    assert delta["changed_row_count"] == 1
-    assert delta["changed_rows"][0]["row_id"] == "R2"
-    assert delta["changed_rows"][0]["source_run_id"] == "run-target"
-    assert isinstance(delta["changed_rows"][0]["row_content_hash"], str)
-    assert "audit-checklist.json" in delta["changed_attachments"]
-
-
-# ---------------------------------------------------------------------------
-# Test: FR-309 -- Smart run selection prefers full-eval
-# ---------------------------------------------------------------------------
-
-
-class TestSmartRunSelectionFullEval:
-    """--from-db-runs prefers full-eval runs over targeted runs (FR-309)."""
-
-    def test_from_db_runs_prefers_full_eval_over_targeted(
-        self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-    ) -> None:
-        """When both full-eval and targeted runs exist, pick the full-eval."""
-        repo1 = tmp_path / "repos" / "repo-one"
-        repo1.mkdir(parents=True)
-        report_dir = tmp_path / "reports"
-
-        manifest = _make_manifest(repos=[("repo-one", repo1)])
-        monkeypatch.setattr(workflow_cmds, "_load_manifest_payload_from_state", lambda _dsn: manifest)
-        monkeypatch.setenv("VDS_AUDIT_STATE_DSN", "postgresql://fake/state")
-
-        typed_calls: list[dict[str, Any]] = []
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_persist_typed_run_terminal",
-            lambda **kwargs: typed_calls.append(kwargs),
-        )
-
-        full_run = _make_run(run_id="run-full-1", project_key="88730001", repo_key="88730001-repo-one")
-        targeted_run = _make_run(
-            run_id="run-targeted-1",
-            project_key="88730001",
-            repo_key="88730001-repo-one",
-            is_targeted=True,
-        )
-
-        class _FakeStore:
-            def __init__(self, dsn: str) -> None:
-                pass
-
-            def get_latest_completed_full_eval_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                if "repo-one" in repo_key:
-                    return full_run
-                return None
-
-            def get_latest_completed_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                if "repo-one" in repo_key:
-                    return targeted_run
-                return None
-
-            def list_checklist_row_results(self, *, run_id: str, **_kw: Any) -> list[dict[str, Any]]:
-                if run_id == "run-full-1":
-                    return [
-                        _make_row_result(row_key="R1", row_index=0, check_id="CL-001", status="PASS", score=85.0),
-                        _make_row_result(row_key="R2", row_index=1, check_id="CL-002", status="PASS", score=90.0),
-                    ]
-                return [
-                    _make_row_result(row_key="R1", row_index=0, check_id="CL-001", status="PASS", score=95.0),
-                ]
-
-        monkeypatch.setattr(workflow_cmds, "PostgresStateStore", _FakeStore)
-
-        import vds_audit_orchestrator.agents.langgraph_workflow as wf_mod
-
-        async def _boom(**_kw: Any) -> None:
-            raise AssertionError("Should not be called in --from-db-runs mode")
-
-        monkeypatch.setattr(wf_mod, "run_audit_with_langgraph", _boom)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-project",
-                "--project-storage-key",
-                "88730001",
-                "--thread-id",
-                "smart-full-1",
-                "--report-dir",
-                str(report_dir),
-                "--from-db-runs",
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-
-        aggregate_path = report_dir / "project-aggregate.json"
-        assert aggregate_path.exists()
-        payload = json.loads(aggregate_path.read_text(encoding="utf-8"))
-        assert len(payload["repositories"]) == 1
-        repo = payload["repositories"][0]
-        assert repo["overall_score"] >= 85.0
-
-    def test_from_db_runs_falls_back_to_targeted_when_no_full(
-        self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-    ) -> None:
-        """When only targeted runs exist, use the latest targeted run."""
-        repo1 = tmp_path / "repos" / "repo-one"
-        repo1.mkdir(parents=True)
-        report_dir = tmp_path / "reports"
-
-        manifest = _make_manifest(repos=[("repo-one", repo1)])
-        monkeypatch.setattr(workflow_cmds, "_load_manifest_payload_from_state", lambda _dsn: manifest)
-        monkeypatch.setenv("VDS_AUDIT_STATE_DSN", "postgresql://fake/state")
-
-        targeted_run = _make_run(
-            run_id="run-targeted-only",
-            project_key="88730001",
-            repo_key="88730001-repo-one",
-            is_targeted=True,
-        )
-
-        class _FakeStore:
-            def __init__(self, dsn: str) -> None:
-                pass
-
-            def get_latest_completed_full_eval_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                return None
-
-            def get_latest_completed_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                if "repo-one" in repo_key:
-                    return targeted_run
-                return None
-
-            def list_checklist_row_results(self, *, run_id: str, **_kw: Any) -> list[dict[str, Any]]:
-                return [
-                    _make_row_result(row_key="R1", row_index=0, check_id="CL-001", status="PASS", score=75.0),
-                ]
-
-        monkeypatch.setattr(workflow_cmds, "PostgresStateStore", _FakeStore)
-
-        import vds_audit_orchestrator.agents.langgraph_workflow as wf_mod
-
-        async def _boom(**_kw: Any) -> None:
-            raise AssertionError("Should not be called")
-
-        monkeypatch.setattr(wf_mod, "run_audit_with_langgraph", _boom)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-project",
-                "--project-storage-key",
-                "88730001",
-                "--thread-id",
-                "smart-fallback-1",
-                "--report-dir",
-                str(report_dir),
-                "--from-db-runs",
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        aggregate_path = report_dir / "project-aggregate.json"
-        assert aggregate_path.exists()
-        payload = json.loads(aggregate_path.read_text(encoding="utf-8"))
-        assert len(payload["repositories"]) == 1
-        assert payload["repositories"][0]["overall_score"] == 75.0
-
-
-class TestSmartRunSelectionAutoMerge:
-    """FR-309: Auto-merge targeted + prior full-eval when no full-eval is latest."""
-
-    def test_from_db_runs_auto_merges_targeted_with_prior(
-        self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-    ) -> None:
-        """Targeted run auto-merges with prior full-eval for complete coverage."""
-        repo1 = tmp_path / "repos" / "repo-one"
-        repo1.mkdir(parents=True)
-        report_dir = tmp_path / "reports"
-        checklist_path = tmp_path / "run-targeted-2" / "audit-checklist.json"
-        checklist_path.parent.mkdir(parents=True, exist_ok=True)
-        delta_path = checklist_path.parent / "audit-checklist.delta.json"
-        requirement_mapping_path = checklist_path.parent / "audit-checklist.requirement-mapping.preflight.json"
-        requirement_mapping_path.write_text(
-            json.dumps({"rows": [{"row_id": "R2", "row_index": 1, "check_id": "CL-002"}]}),
-            encoding="utf-8",
-        )
-        checklist_path.write_text(
-            json.dumps(
-                {
-                    "rows": [
-                        {"row_id": "R1", "row_index": 0, "check_id": "CL-001"},
-                        {"row_id": "R2", "row_index": 1, "check_id": "CL-002"},
-                    ]
-                }
-            ),
-            encoding="utf-8",
-        )
-        delta_path.write_text(
-            json.dumps({"targeted_run": True, "changed_row_count": 1, "changed_rows": [{"row_id": "R2"}]}),
-            encoding="utf-8",
-        )
-
-        manifest = _make_manifest(repos=[("repo-one", repo1)])
-        monkeypatch.setattr(workflow_cmds, "_load_manifest_payload_from_state", lambda _dsn: manifest)
-        monkeypatch.setenv("VDS_AUDIT_STATE_DSN", "postgresql://fake/state")
-
-        targeted_run = _make_run(
-            run_id="run-targeted-2",
-            project_key="88730001",
-            repo_key="88730001-repo-one",
-            is_targeted=True,
-            target_selector="CL-002",
-        )
-        prior_full = _make_run(run_id="run-full-prior", project_key="88730001", repo_key="88730001-repo-one")
-
-        class _FakeStore:
-            def __init__(self, dsn: str) -> None:
-                pass
-
-            def get_latest_completed_full_eval_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                if "repo-one" in repo_key:
-                    return prior_full
-                return None
-
-            def get_latest_completed_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                if "repo-one" in repo_key:
-                    return targeted_run
-                return None
-
-            def get_run(self, *, run_id: str) -> dict[str, Any] | None:
-                if run_id == "run-targeted-2":
-                    return targeted_run
-                if run_id == "run-full-prior":
-                    return prior_full
-                return None
-
-            def list_checklist_artifacts(self, *, run_id: str | None = None, **_kw: Any) -> list[dict[str, Any]]:
-                if run_id == "run-targeted-2":
-                    return [
-                        {"artifact_path": str(requirement_mapping_path)},
-                        {"artifact_path": str(checklist_path)},
-                        {"artifact_path": str(delta_path)},
-                    ]
-                return []
-
-            def list_checklist_row_results(self, *, run_id: str, **_kw: Any) -> list[dict[str, Any]]:
-                if run_id == "run-targeted-2":
-                    return [
-                        _make_row_result(row_key="R2", row_index=1, check_id="CL-002", status="PASS", score=95.0),
-                    ]
-                if run_id == "run-full-prior":
-                    return [
-                        _make_row_result(row_key="R1", row_index=0, check_id="CL-001", status="PASS", score=80.0),
-                        _make_row_result(row_key="R2", row_index=1, check_id="CL-002", status="FAIL", score=30.0),
-                    ]
-                return []
-
-        monkeypatch.setattr(workflow_cmds, "PostgresStateStore", _FakeStore)
-
-        import vds_audit_orchestrator.agents.langgraph_workflow as wf_mod
-
-        async def _boom(**_kw: Any) -> None:
-            raise AssertionError("Should not be called")
-
-        monkeypatch.setattr(wf_mod, "run_audit_with_langgraph", _boom)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-project",
-                "--project-storage-key",
-                "88730001",
-                "--thread-id",
-                "smart-merge-1",
-                "--report-dir",
-                str(report_dir),
-                "--from-db-runs",
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        aggregate_path = report_dir / "project-aggregate.json"
-        assert aggregate_path.exists()
-        payload = json.loads(aggregate_path.read_text(encoding="utf-8"))
-        assert len(payload["repositories"]) == 1
-        repo = payload["repositories"][0]
-        # After merge: R1=80 from prior, R2=95 from targeted -> avg ~87.5
-        assert repo["overall_score"] >= 85.0
-
-    def test_from_db_runs_auto_merge_uses_selector_when_targeted_run_persists_full_row_set(
-        self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-    ) -> None:
-        repo1 = tmp_path / "repos" / "repo-one"
-        repo1.mkdir(parents=True)
-        report_dir = tmp_path / "reports"
-
-        manifest = _make_manifest(repos=[("repo-one", repo1)])
-        monkeypatch.setattr(workflow_cmds, "_load_manifest_payload_from_state", lambda _dsn: manifest)
-        monkeypatch.setenv("VDS_AUDIT_STATE_DSN", "postgresql://fake/state")
-
-        checklist_path = tmp_path / "run-targeted-full" / "audit-checklist.json"
-        checklist_path.parent.mkdir(parents=True, exist_ok=True)
-        delta_path = checklist_path.parent / "audit-checklist.delta.json"
-        requirement_mapping_path = checklist_path.parent / "audit-checklist.requirement-mapping.preflight.json"
-        requirement_mapping_path.write_text(
-            json.dumps(
-                {
-                    "rows": [
-                        {"row_id": "R2", "row_index": 1, "check_id": "CL-002", "requirement_text": "Second"},
-                    ]
-                }
-            ),
-            encoding="utf-8",
-        )
-        checklist_path.write_text(
-            json.dumps(
-                {
-                    "rows": [
-                        {"row_id": "R1", "row_index": 0, "check_id": "CL-001", "requirement_text": "First"},
-                        {"row_id": "R2", "row_index": 1, "check_id": "CL-002", "requirement_text": "Second"},
-                    ]
-                }
-            ),
-            encoding="utf-8",
-        )
-        delta_path.write_text(
-            json.dumps(
-                {
-                    "targeted_run": True,
-                    "changed_row_count": 0,
-                    "changed_rows": [],
-                }
-            ),
-            encoding="utf-8",
-        )
-
-        targeted_run = _make_run(
-            run_id="run-targeted-full",
-            project_key="88730001",
-            repo_key="88730001-repo-one",
-            is_targeted=True,
-            target_selector="CL-002",
-        )
-        prior_full = _make_run(run_id="run-full-base", project_key="88730001", repo_key="88730001-repo-one")
-
-        class _FakeStore:
-            def __init__(self, dsn: str) -> None:
-                pass
-
-            def get_latest_completed_full_eval_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                if "repo-one" in repo_key:
-                    return prior_full
-                return None
-
-            def get_latest_completed_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                if "repo-one" in repo_key:
-                    return targeted_run
-                return None
-
-            def get_run(self, *, run_id: str) -> dict[str, Any] | None:
-                if run_id == "run-targeted-full":
-                    return targeted_run
-                if run_id == "run-full-base":
-                    return prior_full
-                return None
-
-            def list_checklist_artifacts(self, *, run_id: str | None = None, **_kw: Any) -> list[dict[str, Any]]:
-                if run_id == "run-targeted-full":
-                    return [
-                        {"artifact_path": str(requirement_mapping_path)},
-                        {"artifact_path": str(checklist_path)},
-                        {"artifact_path": str(delta_path)},
-                    ]
-                return []
-
-            def list_checklist_row_results(self, *, run_id: str, **_kw: Any) -> list[dict[str, Any]]:
-                if run_id == "run-targeted-full":
-                    return [
-                        _make_row_result(row_key="R1", row_index=0, check_id="CL-001", status="N/A", score=0.0),
-                        _make_row_result(row_key="R2", row_index=1, check_id="CL-002", status="PASS", score=95.0),
-                    ]
-                if run_id == "run-full-base":
-                    return [
-                        _make_row_result(row_key="R1", row_index=0, check_id="CL-001", status="PASS", score=80.0),
-                        _make_row_result(row_key="R2", row_index=1, check_id="CL-002", status="FAIL", score=30.0),
-                    ]
-                return []
-
-        monkeypatch.setattr(workflow_cmds, "PostgresStateStore", _FakeStore)
-
-        import vds_audit_orchestrator.agents.langgraph_workflow as wf_mod
-
-        async def _boom(**_kw: Any) -> None:
-            raise AssertionError("Should not be called")
-
-        monkeypatch.setattr(wf_mod, "run_audit_with_langgraph", _boom)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-project",
-                "--project-storage-key",
-                "88730001",
-                "--thread-id",
-                "smart-merge-full-current-state",
-                "--report-dir",
-                str(report_dir),
-                "--from-db-runs",
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        aggregate_path = report_dir / "project-aggregate.json"
-        payload = json.loads(aggregate_path.read_text(encoding="utf-8"))
-        repo = payload["repositories"][0]
-        assert repo["overall_score"] == pytest.approx(87.5, abs=0.01)
-
-
-# ---------------------------------------------------------------------------
-# Test: FR-310 -- is_targeted_run metadata in payload
-# ---------------------------------------------------------------------------
-
-
-class TestIsTargetedRunMetadata:
-    """is_targeted_run is correctly set in run payloads (FR-310)."""
-
-    def test_is_targeted_run_payload_shape(self) -> None:
-        """Verify that payload construction includes is_targeted_run correctly."""
-        payload_targeted = {
-            "kind": "workflow_run",
-            "target_selector": "1,2,3",
-            "target_selector_raw": "1,2,3",
-            "is_targeted_run": "1,2,3" != None,
-        }
-        assert payload_targeted["is_targeted_run"] is True
-
-        payload_full = {
-            "kind": "workflow_run",
-            "target_selector": None,
-            "target_selector_raw": None,
-            "is_targeted_run": None is not None,
-        }
-        assert payload_full["is_targeted_run"] is False
-
-    def test_is_targeted_run_in_history_summary(self) -> None:
-        """is_targeted_run appears in compact run history summary."""
-        from vds_audit_orchestrator.cli_impl import _compact_run_history_summary
-
-        summary_targeted = {
-            "status": "completed",
-            "total_findings": 5,
-            "overall_score": 80.0,
-            "target_selector": "status:ERROR",
-            "is_targeted_run": True,
-            "workflow_status": "completed",
-            "audit_outcome": "findings",
-        }
-        compact = _compact_run_history_summary(summary_targeted)
-        assert compact is not None
-        assert compact["is_targeted_run"] is True
-        assert compact["target_selector"] == "status:ERROR"
-
-        summary_full = {
-            "status": "completed",
-            "total_findings": 10,
-            "overall_score": 75.0,
-            "is_targeted_run": False,
-            "workflow_status": "completed",
-            "audit_outcome": "findings",
-        }
-        compact_full = _compact_run_history_summary(summary_full)
-        assert compact_full is not None
-        assert compact_full["is_targeted_run"] is False
-        assert "target_selector" not in compact_full
-
-    def test_is_targeted_run_not_in_summary_when_absent(self) -> None:
-        """Pre-Phase 97 summaries without is_targeted_run don't break compact."""
-        from vds_audit_orchestrator.cli_impl import _compact_run_history_summary
-
-        summary_legacy = {
-            "status": "completed",
-            "total_findings": 3,
-            "overall_score": 90.0,
-        }
-        compact = _compact_run_history_summary(summary_legacy)
-        assert compact is not None
-        assert "is_targeted_run" not in compact
-
-
-# ---------------------------------------------------------------------------
-# Test: selection_source in repo_run_metadata
-# ---------------------------------------------------------------------------
-
-
-class TestSelectionSourceMetadata:
-    """repo_run_metadata includes selection_source field (FR-309)."""
-
-    def test_from_db_runs_metadata_includes_selection_source(
-        self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-    ) -> None:
-        """repo_run_metadata includes selection_source field."""
-        repo1 = tmp_path / "repos" / "repo-one"
-        repo1.mkdir(parents=True)
-        report_dir = tmp_path / "reports"
-
-        manifest = _make_manifest(repos=[("repo-one", repo1)])
-        monkeypatch.setattr(workflow_cmds, "_load_manifest_payload_from_state", lambda _dsn: manifest)
-        monkeypatch.setenv("VDS_AUDIT_STATE_DSN", "postgresql://fake/state")
-
-        full_run = _make_run(run_id="run-full-meta", project_key="88730001", repo_key="88730001-repo-one")
-
-        class _FakeStore:
-            def __init__(self, dsn: str) -> None:
-                pass
-
-            def get_latest_completed_full_eval_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                if "repo-one" in repo_key:
-                    return full_run
-                return None
-
-            def get_latest_completed_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                if "repo-one" in repo_key:
-                    return full_run
-                return None
-
-            def list_checklist_row_results(self, *, run_id: str, **_kw: Any) -> list[dict[str, Any]]:
-                return [
-                    _make_row_result(row_key="R1", row_index=0, check_id="CL-001", status="PASS", score=90.0),
-                ]
-
-        monkeypatch.setattr(workflow_cmds, "PostgresStateStore", _FakeStore)
-
-        import vds_audit_orchestrator.agents.langgraph_workflow as wf_mod
-
-        async def _boom(**_kw: Any) -> None:
-            raise AssertionError("Should not be called")
-
-        monkeypatch.setattr(wf_mod, "run_audit_with_langgraph", _boom)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-project",
-                "--project-storage-key",
-                "88730001",
-                "--thread-id",
-                "smart-meta-1",
-                "--report-dir",
-                str(report_dir),
-                "--from-db-runs",
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-
-        repo_results_path = report_dir / "project-repo-results.json"
-        assert repo_results_path.exists()
-        repo_results = json.loads(repo_results_path.read_text(encoding="utf-8"))
-        assert len(repo_results) == 1
-        assert repo_results[0]["selection_source"] == "full_eval"
-
-
-# ---------------------------------------------------------------------------
-# Test: Unit-level _load_repo_results_from_db smart selection
-# ---------------------------------------------------------------------------
-
-
-class TestLoadRepoResultsSmartSelection:
-    """Unit tests for _load_repo_results_from_db smart run selection logic."""
-
-    def test_smart_selection_auto_merges_when_both_exist(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """When both full-eval and newer targeted exist, auto-merge them."""
-        full_run = _make_run(run_id="full-1", project_key="proj", repo_key="repo-a")
-        targeted_run = _make_run(
-            run_id="targeted-1",
-            project_key="proj",
-            repo_key="repo-a",
-            is_targeted=True,
-            target_selector="C2",
-        )
-        checklist_path = tmp_path / "targeted-1" / "audit-checklist.json"
-        checklist_path.parent.mkdir(parents=True, exist_ok=True)
-        delta_path = checklist_path.parent / "audit-checklist.delta.json"
-        requirement_mapping_path = checklist_path.parent / "audit-checklist.requirement-mapping.preflight.json"
-        requirement_mapping_path.write_text(
-            json.dumps({"rows": [{"row_id": "R2", "row_index": 1, "check_id": "C2"}]}),
-            encoding="utf-8",
-        )
-        checklist_path.write_text(
-            json.dumps(
-                {
-                    "rows": [
-                        {"row_id": "R1", "row_index": 0, "check_id": "C1"},
-                        {"row_id": "R2", "row_index": 1, "check_id": "C2"},
-                    ]
-                }
-            ),
-            encoding="utf-8",
-        )
-        delta_path.write_text(
-            json.dumps({"targeted_run": True, "changed_row_count": 1, "changed_rows": [{"row_id": "R2"}]}),
-            encoding="utf-8",
-        )
-
-        class _FakeStore:
-            def __init__(self, dsn: str) -> None:
-                pass
-
-            def get_latest_completed_full_eval_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                return full_run
-
-            def get_latest_completed_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                return targeted_run  # Latest overall is targeted (newer)
-
-            def get_run(self, *, run_id: str) -> dict[str, Any] | None:
-                if run_id == "targeted-1":
-                    return targeted_run
-                if run_id == "full-1":
-                    return full_run
-                return None
-
-            def get_checklist_run(self, *, run_id: str) -> dict[str, Any] | None:
-                return self.get_run(run_id=run_id)
-
-            def list_checklist_artifacts(self, *, run_id: str | None = None, **_kw: Any) -> list[dict[str, Any]]:
-                if run_id == "targeted-1":
-                    return [
-                        {"artifact_path": str(requirement_mapping_path)},
-                        {"artifact_path": str(checklist_path)},
-                        {"artifact_path": str(delta_path)},
-                    ]
-                return []
-
-            def list_checklist_row_results(self, *, run_id: str, **_kw: Any) -> list[dict[str, Any]]:
-                if run_id == "full-1":
-                    return [
-                        _make_row_result(row_key="R1", row_index=0, check_id="C1", status="PASS", score=80.0),
-                        _make_row_result(row_key="R2", row_index=1, check_id="C2", status="PASS", score=70.0),
-                    ]
-                # Targeted run re-evaluated R2 with improved score
-                return [
-                    _make_row_result(row_key="R2", row_index=1, check_id="C2", status="PASS", score=99.0),
-                ]
-
-        monkeypatch.setattr(workflow_cmds, "PostgresStateStore", _FakeStore)
-
-        inputs, metadata = workflow_cmds._load_repo_results_from_db(
-            state_dsn="postgresql://fake",
-            project_key="proj",
-            repo_keys=["repo-a"],
-        )
-
-        assert len(inputs) == 1
-        assert len(metadata) == 1
-        # Auto-merge: targeted run id is used, full-eval rows carried forward
-        assert metadata[0]["run_id"] == "targeted-1"
-        assert metadata[0]["selection_source"] == "auto_merged"
-        # After merge: R1=80 from full-eval + R2=99 from targeted = 2 rows
-        assert metadata[0]["row_count"] == 2
-
-    def test_smart_selection_skips_auto_merge_when_targeted_ids_unresolved(
-        self, monkeypatch: pytest.MonkeyPatch
-    ) -> None:
-        """Unresolved targeted selectors must fail closed instead of treating all rows as targeted."""
-        full_run = _make_run(run_id="full-safe", project_key="proj", repo_key="repo-a")
-        targeted_run = _make_run(
-            run_id="targeted-safe",
-            project_key="proj",
-            repo_key="repo-a",
-            is_targeted=True,
-            target_selector="CL-002",
-        )
-
-        class _FakeStore:
-            def __init__(self, dsn: str) -> None:
-                pass
-
-            def get_latest_completed_full_eval_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                return full_run
-
-            def get_latest_completed_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                return targeted_run
-
-            def get_run(self, *, run_id: str) -> dict[str, Any] | None:
-                if run_id == "targeted-safe":
-                    return targeted_run
-                if run_id == "full-safe":
-                    return full_run
-                return None
-
-            def get_checklist_run(self, *, run_id: str) -> dict[str, Any] | None:
-                return self.get_run(run_id=run_id)
-
-            def list_checklist_artifacts(self, *, run_id: str | None = None, **_kw: Any) -> list[dict[str, Any]]:
-                return []
-
-            def list_checklist_row_results(self, *, run_id: str, **_kw: Any) -> list[dict[str, Any]]:
-                if run_id == "full-safe":
-                    return [
-                        _make_row_result(row_key="R1", row_index=0, check_id="C1", status="PASS", score=80.0),
-                        _make_row_result(row_key="R2", row_index=1, check_id="C2", status="PASS", score=70.0),
-                    ]
-                return [
-                    _make_row_result(row_key="R1", row_index=0, check_id="C1", status="FAIL", score=10.0),
-                    _make_row_result(row_key="R2", row_index=1, check_id="C2", status="PASS", score=99.0),
-                ]
-
-        monkeypatch.setattr(workflow_cmds, "PostgresStateStore", _FakeStore)
-
-        inputs, metadata = workflow_cmds._load_repo_results_from_db(
-            state_dsn="postgresql://fake",
-            project_key="proj",
-            repo_keys=["repo-a"],
-        )
-
-        assert len(inputs) == 1
-        assert len(metadata) == 1
-        assert metadata[0]["run_id"] == "full-safe"
-        assert metadata[0]["selection_source"] == "full_eval"
-        assert metadata[0]["row_count"] == 2
-
-    def test_smart_selection_uses_full_eval_when_same_as_latest(self, monkeypatch: pytest.MonkeyPatch) -> None:
-        """When the latest run IS the full-eval, use it directly (no merge)."""
-        full_run = _make_run(run_id="full-same", project_key="proj", repo_key="repo-c")
-
-        class _FakeStore:
-            def __init__(self, dsn: str) -> None:
-                pass
-
-            def get_latest_completed_full_eval_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                return full_run
-
-            def get_latest_completed_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                return full_run  # Same run — latest IS the full-eval
-
-            def list_checklist_row_results(self, *, run_id: str, **_kw: Any) -> list[dict[str, Any]]:
-                return [
-                    _make_row_result(row_key="R1", row_index=0, check_id="C1", status="PASS", score=90.0),
-                ]
-
-        monkeypatch.setattr(workflow_cmds, "PostgresStateStore", _FakeStore)
-
-        inputs, metadata = workflow_cmds._load_repo_results_from_db(
-            state_dsn="postgresql://fake",
-            project_key="proj",
-            repo_keys=["repo-c"],
-        )
-
-        assert len(inputs) == 1
-        assert metadata[0]["run_id"] == "full-same"
-        assert metadata[0]["selection_source"] == "full_eval"
-        assert metadata[0]["row_count"] == 1
-
-    def test_smart_selection_falls_back_to_targeted(self, monkeypatch: pytest.MonkeyPatch) -> None:
-        """When only targeted runs exist, use the targeted run."""
-        targeted_run = _make_run(
-            run_id="targeted-only",
-            project_key="proj",
-            repo_key="repo-b",
-            is_targeted=True,
-            overall_score=20.29,
-        )
-
-        class _FakeStore:
-            def __init__(self, dsn: str) -> None:
-                pass
-
-            def get_latest_completed_full_eval_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                return None
-
-            def get_latest_completed_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                return targeted_run
-
-            def list_checklist_row_results(self, *, run_id: str, **_kw: Any) -> list[dict[str, Any]]:
-                return [
-                    _make_row_result(row_key="R1", row_index=0, check_id="C1", status="PASS", score=60.0),
-                ]
-
-        monkeypatch.setattr(workflow_cmds, "PostgresStateStore", _FakeStore)
-
-        inputs, metadata = workflow_cmds._load_repo_results_from_db(
-            state_dsn="postgresql://fake",
-            project_key="proj",
-            repo_keys=["repo-b"],
-        )
-
-        assert len(inputs) == 1
-        assert metadata[0]["run_id"] == "targeted-only"
-        assert metadata[0]["selection_source"] == "any_latest"
-        assert metadata[0]["overall_score"] == pytest.approx(20.29, abs=0.01)
-        assert inputs[0]["overall_score"] == pytest.approx(20.29, abs=0.01)
-
-    def test_smart_selection_uses_workflow_summary_score_when_run_payload_missing(
-        self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-    ) -> None:
-        """Use workflow-summary artifact score to stay aligned with report/show outputs."""
-        targeted_run = _make_run(
-            run_id="targeted-artifact-score",
-            project_key="proj",
-            repo_key="repo-z",
-            is_targeted=True,
-            overall_score=None,
-        )
-        summary_path = tmp_path / "targeted-artifact-score" / "workflow-summary.json"
-        summary_path.parent.mkdir(parents=True, exist_ok=True)
-        summary_path.write_text(json.dumps({"overall_score": 20.29}), encoding="utf-8")
-
-        class _FakeStore:
-            def __init__(self, dsn: str) -> None:
-                pass
-
-            def get_latest_completed_full_eval_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                return None
-
-            def get_latest_completed_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                return targeted_run
-
-            def list_checklist_artifacts(self, *, run_id: str | None = None, **_kw: Any) -> list[dict[str, Any]]:
-                if run_id == "targeted-artifact-score":
-                    return [{"artifact_path": str(summary_path)}]
-                return []
-
-            def list_checklist_row_results(self, *, run_id: str, **_kw: Any) -> list[dict[str, Any]]:
-                return [
-                    _make_row_result(row_key="R1", row_index=0, check_id="C1", status="PASS", score=99.0),
-                    _make_row_result(row_key="R2", row_index=1, check_id="C2", status="PASS", score=80.0),
-                ]
-
-        monkeypatch.setattr(workflow_cmds, "PostgresStateStore", _FakeStore)
-
-        inputs, metadata = workflow_cmds._load_repo_results_from_db(
-            state_dsn="postgresql://fake",
-            project_key="proj",
-            repo_keys=["repo-z"],
-        )
-
-        assert len(inputs) == 1
-        assert len(metadata) == 1
-        assert metadata[0]["selection_source"] == "any_latest"
-        assert metadata[0]["overall_score"] == pytest.approx(20.29, abs=0.01)
-        assert inputs[0]["overall_score"] == pytest.approx(20.29, abs=0.01)
-
-    def test_smart_selection_uses_checklist_artifact_score_when_summary_artifact_missing(
-        self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-    ) -> None:
-        """Fallback to audit-checklist overall_score when workflow summary is absent."""
-        targeted_run = _make_run(
-            run_id="targeted-checklist-score",
-            project_key="proj",
-            repo_key="repo-y",
-            is_targeted=True,
-            overall_score=None,
-        )
-        checklist_path = tmp_path / "targeted-checklist-score" / "audit-checklist.json"
-        checklist_path.parent.mkdir(parents=True, exist_ok=True)
-        checklist_path.write_text(json.dumps({"overall_score": 20.29}), encoding="utf-8")
-
-        class _FakeStore:
-            def __init__(self, dsn: str) -> None:
-                pass
-
-            def get_latest_completed_full_eval_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                return None
-
-            def get_latest_completed_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                return targeted_run
-
-            def list_checklist_artifacts(self, *, run_id: str | None = None, **_kw: Any) -> list[dict[str, Any]]:
-                if run_id == "targeted-checklist-score":
-                    return [{"artifact_path": str(checklist_path)}]
-                return []
-
-            def list_checklist_row_results(self, *, run_id: str, **_kw: Any) -> list[dict[str, Any]]:
-                return [
-                    _make_row_result(row_key="R1", row_index=0, check_id="C1", status="PASS", score=99.0),
-                    _make_row_result(row_key="R2", row_index=1, check_id="C2", status="PASS", score=80.0),
-                ]
-
-        monkeypatch.setattr(workflow_cmds, "PostgresStateStore", _FakeStore)
-
-        inputs, metadata = workflow_cmds._load_repo_results_from_db(
-            state_dsn="postgresql://fake",
-            project_key="proj",
-            repo_keys=["repo-y"],
-        )
-
-        assert len(inputs) == 1
-        assert len(metadata) == 1
-        assert metadata[0]["selection_source"] == "any_latest"
-        assert metadata[0]["overall_score"] == pytest.approx(20.29, abs=0.01)
-        assert inputs[0]["overall_score"] == pytest.approx(20.29, abs=0.01)
-
-    def test_sync_checklist_run_summary_payload_updates_targeted_score_and_metadata(
-        self, monkeypatch: pytest.MonkeyPatch
-    ) -> None:
-        """Checklist-run payload is updated with canonical summary metrics for DB consumers."""
-        checklist_run = _make_run(run_id="run-1", project_key="proj", repo_key="repo-a")
-        checklist_run["payload"] = {
-            "schema": "audit-checklist.state.v1",
-            "row_count": 59,
-            "artifact_types": ["checklist_json"],
-            "thread_id": "run-1",
-            "dispatch_job_id": "job-123",
-            "origin_profile": "zai-openai",
-            "executed_profile": "alibaba-anthropic",
-            "dispatch_stage": "row_sharded",
-            "run_parameters": {
-                "dispatch_job_id": "job-123",
-                "origin_profile": "zai-openai",
-                "executed_profile": "alibaba-anthropic",
-                "dispatch_stage": "row_sharded",
-            },
-        }
-        updated_payloads: list[dict[str, Any]] = []
-
-        class _FakeStore:
-            def __init__(self, dsn: str) -> None:
-                pass
-
-            def get_checklist_run(
-                self, *, run_id: str | None = None, thread_id: str | None = None
-            ) -> dict[str, Any] | None:
-                return checklist_run if run_id == "run-1" else None
-
-            def update_checklist_run(self, *, run_id: str, payload: dict[str, Any], **_kw: Any) -> dict[str, Any]:
-                updated_payloads.append(payload)
-                checklist_run["payload"] = payload
-                return checklist_run
-
-        monkeypatch.setattr(workflow_cmds, "PostgresStateStore", _FakeStore)
-
-        result = workflow_cmds._sync_checklist_run_summary_payload(
-            state_dsn="postgresql://fake",
-            run_id="run-1",
-            workflow_summary_payload={
-                "overall_score": 20.29,
-                "summary_score_source": "checklist_artifacts_reconciled",
-                "rows_evaluated": 12,
-                "rows_with_tool_activity": 12,
-                "docs_hit_rate": 0.9167,
-                "code_hit_rate": 0.8333,
-                "status": "partial",
-                "total_findings": 11,
-                "workflow_status": "completed",
-                "audit_outcome": "findings",
-                "targeted_merge": {"action": "targeted_merge_applied"},
-            },
-            target_selector="CL-004,CL-001,CL-013",
-            target_selector_raw="CL-004,CL-001,CL-013",
-            prior_run_id="codex-sweep-20260306-090342",
-            is_targeted_run=True,
-        )
-
-        assert result["applied"] is True
-        assert updated_payloads
-        payload = updated_payloads[-1]
-        assert payload["overall_score"] == pytest.approx(20.29, abs=0.01)
-        assert payload["summary_score_source"] == "checklist_artifacts_reconciled"
-        assert payload["rows_evaluated"] == 12
-        assert payload["rows_with_tool_activity"] == 12
-        assert payload["thread_id"] == "run-1"
-        assert payload["dispatch_job_id"] == "job-123"
-        assert payload["origin_profile"] == "zai-openai"
-        assert payload["executed_profile"] == "alibaba-anthropic"
-        assert payload["dispatch_stage"] == "row_sharded"
-        assert payload["run_parameters"]["dispatch_job_id"] == "job-123"
-        assert payload["is_targeted_run"] is True
-        assert payload["target_selector"] == "CL-004,CL-001,CL-013"
-        assert payload["prior_run_id"] == "codex-sweep-20260306-090342"
-        assert payload["targeted_merge"]["action"] == "targeted_merge_applied"
-
-    def test_sync_checklist_run_summary_payload_fails_open_on_store_error(
-        self, monkeypatch: pytest.MonkeyPatch
-    ) -> None:
-        """Late state sync failures must not turn a completed workflow into a hard failure."""
-
-        class _FakeStore:
-            def __init__(self, dsn: str) -> None:
-                pass
-
-            def get_checklist_run(
-                self, *, run_id: str | None = None, thread_id: str | None = None
-            ) -> dict[str, Any] | None:
-                raise RuntimeError("db unavailable")
-
-        monkeypatch.setattr(workflow_cmds, "PostgresStateStore", _FakeStore)
-
-        result = workflow_cmds._sync_checklist_run_summary_payload(
-            state_dsn="postgresql://fake",
-            run_id="run-1",
-            workflow_summary_payload={"overall_score": 20.29},
-            target_selector=None,
-            target_selector_raw=None,
-            prior_run_id=None,
-            is_targeted_run=False,
-        )
-
-        assert result["applied"] is False
-        assert result["reason"] == "checklist_run_summary_sync_failed"
-        assert "db unavailable" in str(result["error"])
-
-    def test_smart_selection_skips_invalid_summary_artifact_and_uses_valid_checklist_score(
-        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-    ) -> None:
-        """Malformed summary artifacts must not block fallback to a valid checklist score."""
-        targeted_run = _make_run(
-            run_id="targeted-invalid-summary",
-            project_key="proj",
-            repo_key="repo-z",
-            is_targeted=True,
-            overall_score=None,
-        )
-        summary_path = tmp_path / "targeted-invalid-summary" / "workflow-summary.json"
-        summary_path.parent.mkdir(parents=True, exist_ok=True)
-        summary_path.write_text("{invalid json", encoding="utf-8")
-        checklist_path = tmp_path / "targeted-invalid-summary" / "audit-checklist.json"
-        checklist_path.write_text(json.dumps({"overall_score": 18.75}), encoding="utf-8")
-
-        class _FakeStore:
-            def __init__(self, dsn: str) -> None:
-                pass
-
-            def get_latest_completed_full_eval_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                return None
-
-            def get_latest_completed_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                return targeted_run
-
-            def list_checklist_artifacts(self, *, run_id: str | None = None, **_kw: Any) -> list[dict[str, Any]]:
-                if run_id == "targeted-invalid-summary":
-                    return [
-                        {"artifact_path": str(summary_path)},
-                        {"artifact_path": str(checklist_path)},
-                    ]
-                return []
-
-            def list_checklist_row_results(self, *, run_id: str, **_kw: Any) -> list[dict[str, Any]]:
-                return [
-                    _make_row_result(row_key="R1", row_index=0, check_id="C1", status="PASS", score=99.0),
-                    _make_row_result(row_key="R2", row_index=1, check_id="C2", status="PASS", score=80.0),
-                ]
-
-        monkeypatch.setattr(workflow_cmds, "PostgresStateStore", _FakeStore)
-
-        inputs, metadata = workflow_cmds._load_repo_results_from_db(
-            state_dsn="postgresql://fake",
-            project_key="proj",
-            repo_keys=["repo-z"],
-        )
-
-        assert len(inputs) == 1
-        assert len(metadata) == 1
-        assert metadata[0]["overall_score"] == pytest.approx(18.75, abs=0.01)
-        assert inputs[0]["overall_score"] == pytest.approx(18.75, abs=0.01)
-
-    def test_smart_selection_skips_missing_repos(self, monkeypatch: pytest.MonkeyPatch) -> None:
-        """Repos with no runs at all are skipped gracefully."""
-
-        class _FakeStore:
-            def __init__(self, dsn: str) -> None:
-                pass
-
-            def get_latest_completed_full_eval_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                return None
-
-            def get_latest_completed_run(self, *, project_key: str, repo_key: str) -> dict[str, Any] | None:
-                return None
-
-            def list_checklist_row_results(self, *, run_id: str, **_kw: Any) -> list[dict[str, Any]]:
-                return []
-
-        monkeypatch.setattr(workflow_cmds, "PostgresStateStore", _FakeStore)
-
-        inputs, metadata = workflow_cmds._load_repo_results_from_db(
-            state_dsn="postgresql://fake",
-            project_key="proj",
-            repo_keys=["missing-repo"],
-        )
-
-        assert len(inputs) == 0
-        assert len(metadata) == 0