@ngocsangairvds/vsaf 3.2.14 → 3.2.16

package/tools/vds-scripts/audit_orchestrator/src/vds_audit_orchestrator/agents/langgraph_workflow.py

@@ -1,2002 +0,0 @@
-"""LangGraph Workflow for Audit Orchestrator (TSK-050, TSK-073).
-
-This module implements the LangGraph-based workflow for running audits
-with checkpointing, human-in-the-loop approval gates, and parallel agent execution.
-
-Reference: design.md Section 5 (LangGraph Integration), Section 8.2.1
-
-Human-in-the-loop approval gates (TSK-073):
-- Workflow pauses at human_review node when critical findings exist
-- Uses LangGraph interrupt() for durable pause/resume
-- Interrupt payload is persisted in checkpoint for review
-- Resume via Command(resume=...) pattern with approval decision
-"""
-
-from __future__ import annotations
-
-import asyncio
-import inspect
-from collections.abc import Callable
-from pathlib import Path
-from time import monotonic
-from typing import TYPE_CHECKING, Any
-from uuid import uuid4
-
-from langgraph.checkpoint.memory import MemorySaver
-from langgraph.checkpoint.serde.jsonplus import JsonPlusSerializer
-from langgraph.graph import END, StateGraph
-from langgraph.types import Command, interrupt
-from structlog import get_logger
-
-from vds_audit_orchestrator.agents.audit_state import AuditState
-from vds_audit_orchestrator.agents.base import AgentResult
-from vds_audit_orchestrator.agents.synthesis_agent import SynthesisAgent
-from vds_audit_orchestrator.evidence.corpus import (
-    EvidenceCorpus,
-    EvidenceDocument,
-    deserialize_evidence_corpus,
-)
-from vds_audit_orchestrator.evidence.readiness import check_evidence_readiness as _check_evidence_readiness
-from vds_audit_orchestrator.logging_config import audit_otel_span as trace_span
-from vds_audit_orchestrator.logging_config import log_context
-from vds_audit_orchestrator.models.evidence import EvidenceBundle
-from vds_audit_orchestrator.models.task import AuditTask, TaskPriority, TaskQueue, TaskStatus
-from vds_audit_orchestrator.observability import metrics
-
-if TYPE_CHECKING:
-    from langgraph.graph.state import CompiledStateGraph
-
-logger = get_logger()
-
-# Optional PostgresSaver import (lazy-loaded only when postgres checkpointer is requested).
-PostgresSaver = None
-_postgres_saver_import_error: Exception | None = None
-
-StateManifestLoader = Callable[[str], dict[str, object] | None]
-
-
-def _redact_postgres_dsn(dsn: str) -> str:
-    """Redact password in DSN for logs."""
-    # postgresql://user:pass@host:port/db -> postgresql://user:***@host:port/db
-    try:
-        from urllib.parse import urlparse
-
-        u = urlparse(dsn)
-        if not u.username:
-            return dsn
-        netloc = u.hostname or ""
-        if u.port:
-            netloc = f"{netloc}:{u.port}"
-        auth = u.username
-        if u.password is not None:
-            auth = f"{auth}:***"
-        if auth:
-            netloc = f"{auth}@{netloc}"
-        return u._replace(netloc=netloc).geturl()
-    except Exception:
-        return "postgresql://***"
-
-
-def _extract_agent_efficiency_metrics(metadata: dict[str, Any] | None) -> dict[str, Any]:
-    """Extract compact tool/skill efficiency metrics from agent metadata for logs."""
-    if not isinstance(metadata, dict):
-        return {}
-
-    summary: dict[str, Any] = {}
-    tool_efficiency = metadata.get("agentic_tool_efficiency")
-    if not isinstance(tool_efficiency, dict):
-        fallback = metadata.get("tool_efficiency")
-        tool_efficiency = fallback if isinstance(fallback, dict) else {}
-
-    numeric_keys = (
-        "tool_calls_started",
-        "tool_calls_completed",
-        "tool_calls_unique",
-        "tool_calls_repeated",
-        "tool_completion_rate",
-        "tool_repetition_rate",
-        "skill_calls_total",
-        "skill_calls_effective",
-        "skill_effective_rate",
-        "skill_discovery_ratio",
-        "tool_latency_avg_ms",
-        "tool_latency_p95_ms",
-    )
-    for key in numeric_keys:
-        value = tool_efficiency.get(key)
-        if isinstance(value, bool):
-            continue
-        if isinstance(value, int):
-            summary[key] = value
-        elif isinstance(value, float):
-            summary[key] = round(value, 3)
-
-    tool_usage = metadata.get("tool_usage")
-    if isinstance(tool_usage, list):
-        total_calls = len(tool_usage)
-        summary["skill_executor_calls_total"] = total_calls
-        if total_calls > 0:
-            successful_calls = sum(
-                1 for entry in tool_usage if isinstance(entry, dict) and entry.get("success") is True
-            )
-            summary["skill_executor_success_rate"] = round(successful_calls / total_calls, 3)
-    return summary
-
-
-def _serialize_evidence_corpus(corpus: EvidenceCorpus | None) -> dict[str, Any] | None:
-    if not isinstance(corpus, EvidenceCorpus):
-        return None
-    documents: list[dict[str, Any]] = []
-    for doc in corpus.documents:
-        documents.append(
-            {
-                "title": doc.title,
-                "content": doc.content,
-                "source_path": doc.source_path,
-                "doc_type": doc.doc_type,
-                "project_name": doc.project_name,
-                "source_url": doc.source_url,
-                "source_type": doc.source_type,
-                "doc_class": doc.doc_class,
-                "generated_flag": doc.generated_flag,
-                "historical_flag": doc.historical_flag,
-                "role": doc.role,
-                "content_hash": doc.content_hash,
-                "checksum_valid": doc.checksum_valid,
-                "chunk_id": doc.chunk_id,
-                "chunk_ordinal": doc.chunk_ordinal,
-                "heading_path": list(doc.heading_path),
-                "page_id": doc.page_id,
-                "metadata": doc.metadata,
-            }
-        )
-    return {"documents": documents}
-
-
-def _deserialize_evidence_corpus(payload: Any) -> EvidenceCorpus | None:
-    if isinstance(payload, EvidenceCorpus):
-        return payload
-    if not isinstance(payload, dict):
-        return None
-    raw_documents = payload.get("documents")
-    if not isinstance(raw_documents, list):
-        return None
-    corpus = EvidenceCorpus()
-    for item in raw_documents:
-        if not isinstance(item, dict):
-            continue
-        try:
-            corpus.add_document(
-                EvidenceDocument(
-                    title=str(item.get("title") or ""),
-                    content=str(item.get("content") or ""),
-                    source_path=str(item.get("source_path") or ""),
-                    doc_type=str(item.get("doc_type") or "OTHER"),
-                    project_name=str(item.get("project_name") or ""),
-                    source_url=item.get("source_url"),
-                    source_type=str(item.get("source_type") or "confluence"),
-                    doc_class=str(item.get("doc_class") or "canonical_doc"),
-                    generated_flag=bool(item.get("generated_flag", False)),
-                    historical_flag=bool(item.get("historical_flag", False)),
-                    role=(str(item["role"]) if item.get("role") is not None else None),
-                    content_hash=(str(item["content_hash"]) if item.get("content_hash") is not None else None),
-                    checksum_valid=item.get("checksum_valid"),
-                    chunk_id=(str(item["chunk_id"]) if item.get("chunk_id") is not None else None),
-                    chunk_ordinal=item.get("chunk_ordinal"),
-                    heading_path=tuple(item.get("heading_path") or ()),
-                    page_id=(str(item["page_id"]) if item.get("page_id") is not None else None),
-                    metadata=item.get("metadata") if isinstance(item.get("metadata"), dict) else {},
-                )
-            )
-        except Exception:
-            continue
-    return corpus
-
-
-def _resolve_page_id_for_agent_operations(state: AuditState) -> str | None:
-    """Resolve canonical page identity for agent-operation telemetry."""
-    row_state_context = state.get("row_state_context")
-    if isinstance(row_state_context, dict):
-        for key in ("page_id", "project_page_id", "project_id"):
-            raw = row_state_context.get(key)
-            value = str(raw or "").strip()
-            if value:
-                return value
-    for key in ("page_id", "project_page_id", "project_storage_key", "project_id"):
-        raw = state.get(key)
-        value = str(raw or "").strip()
-        if value:
-            return value
-    return None
-
-
-def _build_agent_operation_log_context(
-    state: AuditState,
-    *,
-    operation_scope: str,
-    agent_name: str,
-    task_id: str | None = None,
-) -> dict[str, Any]:
-    """Build stable operation context for structured agent lifecycle logs."""
-    page_id = _resolve_page_id_for_agent_operations(state)
-    context: dict[str, Any] = {
-        "operation_id": uuid4().hex,
-        "operation_scope": operation_scope,
-        "agent": agent_name,
-        "repo_key": state.get("repository"),
-        "repo_storage_key": state.get("repo_storage_key"),
-    }
-    if page_id:
-        context["page_id"] = page_id
-        context["project_page_id"] = page_id
-    project_id = str(state.get("project_id") or "").strip()
-    if project_id:
-        context["project_id"] = project_id
-    if task_id:
-        context["task_id"] = task_id
-    return context
-
-
-def _build_state_context_payload(state: AuditState) -> dict[str, Any]:
-    """Build normalized state_context payload for agent task/analyze handoff."""
-    payload: dict[str, Any] = {
-        "state_dsn": state.get("state_dsn"),
-        "project_id": state.get("project_id"),
-        "project_key": state.get("project_id"),
-        "repo_storage_key": state.get("repo_storage_key"),
-        "repo_key": state.get("repository"),
-    }
-    page_id = _resolve_page_id_for_agent_operations(state)
-    if page_id:
-        payload["page_id"] = page_id
-        payload["project_page_id"] = page_id
-    row_state_context = state.get("row_state_context")
-    if isinstance(row_state_context, dict):
-        payload.update(dict(row_state_context))
-    return payload
-
-
-# =============================================================================
-# State Definition
-# =============================================================================
-
-# AuditState is defined in agents/audit_state.py
-
-
-# =============================================================================
-# Node Functions
-# =============================================================================
-
-
-async def profile_node(state: AuditState) -> dict[str, Any]:
-    """Detect project profile.
-
-    Uses the profile detection system to analyze the repository
-    and determine its characteristics (domain, risk level, etc.).
-
-    Args:
-        state: Current workflow state.
-
-    Returns:
-        State update with detected profile and step marker.
-    """
-    from vds_audit_orchestrator.profiles.detection import resolve_profile_async
-
-    log = logger.bind(step="profile", repo_path=state["repo_path"])
-    log.info("profile_detection_started")
-
-    with trace_span("audit.profile", {"repo": state["repo_path"]}):
-        try:
-            resolution = await resolve_profile_async(
-                repo_path=Path(state["repo_path"]),
-                project_id=state["project_id"],
-                cli_profile=None,
-                profile_map_path=None,
-            )
-            profile_dict = resolution.profile.model_dump()
-            log.info("profile_detection_complete", source=resolution.source)
-            return {"profile": profile_dict, "step": "profile_done"}
-        except Exception as e:
-            log.exception("profile_detection_failed", error=str(e))
-            return {
-                "profile": {},
-                "step": "profile_done",
-                "errors": [f"Profile detection failed: {e}"],
-            }
-
-
-async def evidence_node(
-    state: AuditState,
-    *,
-    state_manifest_loader: StateManifestLoader | None = None,
-) -> dict[str, Any]:
-    """Collect evidence from sources.
-
-    Gathers evidence from git files, Confluence, SonarQube, and other
-    sources based on common requirements.
-
-    Args:
-        state: Current workflow state.
-
-    Returns:
-        State update with collected evidence bundle and step marker.
-    """
-    from vds_audit_orchestrator.collectors.requirements import COMMON_REQUIREMENTS
-    from vds_audit_orchestrator.engine.evidence_collector import EvidenceCollector
-    from vds_audit_orchestrator.evidence.loader import EvidenceManifestLoader
-
-    log = logger.bind(step="evidence", repo_path=state["repo_path"])
-    log.info("evidence_collection_started")
-
-    with trace_span("audit.evidence", {"repo": state["repo_path"]}):
-        try:
-            repo_path = Path(state["repo_path"])
-            collector = EvidenceCollector(repo_path=repo_path)
-            bundle = await collector.collect_all(
-                repository=str(repo_path), requirements=list(COMMON_REQUIREMENTS.values())
-            )
-            log.info(
-                "evidence_collection_complete",
-                total_evidence=bundle.total_evidence,
-                found=bundle.found_count,
-                missing=bundle.missing_count,
-            )
-            evidence_corpus = None
-            state_dsn = state.get("state_dsn")
-            log.info(
-                "evidence_manifest_context",
-                state_dsn_present=bool(isinstance(state_dsn, str) and state_dsn.strip()),
-                state_manifest_loader_present=state_manifest_loader is not None,
-            )
-            if not isinstance(state_dsn, str) or not state_dsn.strip() or state_manifest_loader is None:
-                raise RuntimeError("Centralized state is required for evidence loading.")
-            loader = EvidenceManifestLoader(
-                state_dsn=state_dsn,
-                state_manifest_loader=state_manifest_loader,
-            )
-            project_scope = str(state.get("project_id") or "").strip() or None
-            evidence_corpus = loader.load_runtime_corpus(project_storage_key=project_scope)
-            log.info(
-                "evidence_manifest_loaded",
-                document_count=len(getattr(evidence_corpus, "documents", [])),
-            )
-            # --- Evidence readiness gate (GAP-2) ---
-            try:
-                manifest_payload = loader.last_manifest_payload
-                manifest_diagnostics = manifest_payload if isinstance(manifest_payload, dict) else {}
-                code_chunk_count = manifest_diagnostics.get("code_chunk_count")
-                code_chunk_ready = manifest_diagnostics.get("code_chunk_ready")
-                docs_chunk_count = manifest_diagnostics.get("docs_chunk_count")
-                docs_chunk_ready = manifest_diagnostics.get("docs_chunk_ready")
-                readiness_result = _check_evidence_readiness(
-                    min_docs=1,
-                    min_code_files=0,
-                    manifest_payloads=[manifest_payload] if manifest_payload else None,
-                    evidence_project=project_scope,
-                    evidence_project_key=project_scope,
-                )
-                if not readiness_result.ready:
-                    log.warning(
-                        "evidence_readiness_gate_failed",
-                        missing=readiness_result.missing,
-                        warnings=readiness_result.warnings,
-                    )
-                    return {
-                        "evidence": bundle,
-                        "evidence_corpus": _serialize_evidence_corpus(evidence_corpus),
-                        "step": "evidence_failed",
-                        "errors": [f"Evidence readiness gate failed: {'; '.join(readiness_result.missing)}"],
-                    }
-                log.info(
-                    "evidence_readiness_gate_passed",
-                    confluence_docs=readiness_result.confluence_docs_count,
-                    code_files_checked=False,
-                    code_files=None,
-                    docs_chunk_count=docs_chunk_count,
-                    docs_chunk_ready=docs_chunk_ready,
-                    code_chunk_count=code_chunk_count,
-                    code_chunk_ready=code_chunk_ready,
-                )
-            except Exception as e:
-                log.warning("evidence_readiness_gate_error", error=str(e))
-
-            return {
-                "evidence": bundle,
-                "evidence_corpus": _serialize_evidence_corpus(evidence_corpus),
-                "step": "evidence_done",
-            }
-        except Exception as e:
-            log.exception("evidence_collection_failed", error=str(e))
-            # Create minimal bundle on failure
-            empty_bundle = EvidenceBundle(repository=state.get("repository", "unknown"))
-            return {
-                "evidence": empty_bundle,
-                "evidence_corpus": None,
-                "step": "evidence_done",
-                "errors": [f"Evidence collection failed: {e}"],
-            }
-
-
-def route_after_evidence(state: AuditState) -> str:
-    """Route after evidence node: continue or terminate on readiness failure."""
-    if state.get("step") == "evidence_failed":
-        return "end"
-    return "seed_tasks"
-
-
-async def analyze_node(state: AuditState) -> dict[str, Any]:
-    """Run analysis agents in parallel.
-
-    Executes CodeAnalysisAgent, DocumentationAgent, and SecurityAgent
-    concurrently to analyze the collected evidence.
-
-    Args:
-        state: Current workflow state.
-
-    Returns:
-        State update with accumulated agent results and step marker.
-    """
-    from vds_audit_orchestrator.agents.code_agent import CodeAnalysisAgent
-    from vds_audit_orchestrator.agents.docs_agent import DocumentationAgent
-    from vds_audit_orchestrator.agents.security_agent import SecurityAgent
-    from vds_audit_orchestrator.llm.provider import LLMSettings
-
-    log = logger.bind(step="analyze")
-    log.info("agent_analysis_started")
-
-    with trace_span("audit.analyze", {"repo": state["repo_path"]}):
-        # Load LLM settings from the effective audit config file resolved through the shared VDS path/config layer
-        # This ensures agents use the configured LLM protocol/runtime.
-        llm_settings = LLMSettings.from_config()
-        protocol = getattr(llm_settings, "protocol", None)
-        protocol_value = str(getattr(protocol, "value", protocol) or "").strip()
-        log.debug("llm_settings_loaded", enabled=llm_settings.enabled, protocol=protocol_value)
-
-        # Phase 41: Resolve agentic mode from workflow state or global config.
-        agentic_mode = state.get("agentic_mode", "auto")
-
-        agents = {
-            "code": CodeAnalysisAgent(settings=llm_settings, agentic_mode=agentic_mode),
-            "docs": DocumentationAgent(settings=llm_settings),
-            "security": SecurityAgent(settings=llm_settings),
-        }
-        operation_context_by_agent = {
-            name: _build_agent_operation_log_context(
-                state,
-                operation_scope="analyze_node",
-                agent_name=name,
-            )
-            for name in agents
-        }
-        operation_started_at = {name: monotonic() for name in agents}
-        for name in agents:
-            log.info("agent_operation_started", **operation_context_by_agent[name])
-
-        evidence = state.get("evidence")
-        profile = state.get("profile", {})
-        # Phase 41: Inject repo_path into profile so _get_repo_path can resolve it
-        # for agentic toolset scoping.
-        if "repo_path" not in profile and state.get("repo_path"):
-            profile = {**profile, "repo_path": state["repo_path"]}
-        state_context = _build_state_context_payload(state)
-        payload = {
-            "evidence_bundle": evidence,
-            "profile": profile,
-            "evidence_corpus": _deserialize_evidence_corpus(state.get("evidence_corpus")),
-            "state_context": state_context,
-        }
-        log.info(
-            "analyze_payload_context",
-            evidence_corpus_present=payload["evidence_corpus"] is not None,
-            evidence_corpus_docs=(
-                len(payload["evidence_corpus"].documents) if hasattr(payload["evidence_corpus"], "documents") else 0
-            ),
-            state_dsn_present=bool(isinstance(state.get("state_dsn"), str) and str(state.get("state_dsn")).strip()),
-        )
-
-        # Run agents in parallel
-        tasks = [agents[name].analyze(payload) for name in agents]
-        results = await asyncio.gather(*tasks, return_exceptions=True)
-
-        # Accumulate results
-        agent_results: list[dict[str, Any]] = []
-        errors: list[str] = []
-
-        for name, result in zip(agents.keys(), results, strict=True):
-            operation_context = operation_context_by_agent[name]
-            elapsed_sec = round(max(0.0, monotonic() - operation_started_at[name]), 3)
-            if isinstance(result, BaseException):
-                metrics.count_check_failure(name, state["repository"])
-                log.warning(
-                    "agent_operation_failed",
-                    elapsed_sec=elapsed_sec,
-                    error=str(result),
-                    **operation_context,
-                )
-                log.warning("agent_failed", agent=name, error=str(result))
-                agent_results.append({"agent": name, "error": str(result), "success": False})
-                errors.append(f"Agent {name} failed: {result}")
-            else:
-                # the result is AgentResult here
-                agent_result = result  # type: AgentResult
-                if not agent_result.success:
-                    metrics.count_check_failure(name, state["repository"])
-
-                efficiency_metrics = _extract_agent_efficiency_metrics(agent_result.metadata)
-                operation_event = "agent_operation_complete" if agent_result.success else "agent_operation_failed"
-                operation_log = log.info if agent_result.success else log.warning
-                operation_log(
-                    operation_event,
-                    elapsed_sec=elapsed_sec,
-                    success=agent_result.success,
-                    findings_count=len(agent_result.findings),
-                    **efficiency_metrics,
-                    **operation_context,
-                )
-                log.info(
-                    "agent_complete",
-                    agent=name,
-                    success=agent_result.success,
-                    findings_count=len(agent_result.findings),
-                    **efficiency_metrics,
-                )
-                agent_results.append(
-                    {
-                        "agent": name,
-                        "success": agent_result.success,
-                        "findings": agent_result.findings,
-                        "metadata": agent_result.metadata,
-                    }
-                )
-
-        return {"agent_results": agent_results, "errors": errors, "step": "analyze_done"}
-
-
-# =============================================================================
-# Phase 11: Dynamic Task Orchestration Nodes
-# =============================================================================
-
-
-async def seed_tasks_node(state: AuditState) -> dict[str, Any]:
-    """Seed the initial task list for dynamic orchestration (Phase 11).
-
-    Creates the baseline tasks that previously ran in the static analyze step.
-    Each task carries the evidence bundle and profile for downstream agents.
-
-    Args:
-        state: Current workflow state.
-
-    Returns:
-        State update with seeded tasks and step marker.
-    """
-    log = logger.bind(step="seed_tasks")
-    log.info("task_seed_started")
-
-    evidence = state.get("evidence")
-    profile = state.get("profile", {})
-    row_unified_mode = str(state.get("row_unified_mode", "on")).strip().lower()
-    single_row_targeted = bool(state.get("single_row_targeted", False))
-
-    if evidence is None:
-        log.warning("task_seed_missing_evidence")
-    base_payload = {
-        "evidence_bundle": evidence,
-        "profile": profile,
-        # Keep serialized corpus in task payload so all task-assigned agents
-        # can reconstruct corpus-backed retrieval context during analyze().
-        "evidence_corpus": state.get("evidence_corpus"),
-        "state_context": _build_state_context_payload(state),
-    }
-
-    tasks: list[AuditTask] = []
-    dispatch_skip_reason: str | None = None
-    if row_unified_mode == "on":
-        dispatch_skip_reason = "row_unified_mode"
-        log.info(
-            "task_seed_skipped_for_row_unified_mode",
-            row_unified_mode=row_unified_mode,
-            single_row_targeted=single_row_targeted,
-        )
-    else:
-        tasks = [
-            AuditTask(
-                type="code_analysis",
-                description="Analyze code quality and architecture",
-                assignee="code",
-                input_data=base_payload,
-                priority=TaskPriority.NORMAL.value,
-            ),
-            AuditTask(
-                type="docs_analysis",
-                description="Analyze documentation quality and completeness",
-                assignee="docs",
-                input_data=base_payload,
-                priority=TaskPriority.NORMAL.value,
-            ),
-            AuditTask(
-                type="security_analysis",
-                description="Analyze security posture and vulnerability indicators",
-                assignee="security",
-                input_data=base_payload,
-                priority=TaskPriority.HIGH.value,
-            ),
-        ]
-
-    tasks_dict = {task.id: task.model_dump() for task in tasks}
-
-    log.info("task_seed_complete", total_tasks=len(tasks_dict))
-
-    return {
-        "tasks": tasks_dict,
-        "task_queue": [],
-        "active_workers": {},
-        "dispatch_skip_reason": dispatch_skip_reason,
-        "step": "tasks_seeded",
-    }
-
-
-async def dispatcher_node(state: AuditState) -> dict[str, Any]:
-    """Dispatch runnable tasks to available agents (Phase 11).
-
-    This node evaluates task dependencies, finds runnable tasks (PENDING with
-    all dependencies COMPLETED), prioritizes by task.priority, and assigns
-    tasks to available agents.
-
-    The dispatcher loops until all tasks complete, then routes to synthesis.
-
-    Args:
-        state: Current workflow state containing tasks dict.
-
-    Returns:
-        State update with modified tasks dict, task_queue, and active_workers.
-    """
-    log = logger.bind(step="dispatcher")
-    started_at = monotonic()
-    log.info("dispatcher_started")
-
-    with trace_span("audit.dispatcher", {"repo": state.get("repo_path", "")}):
-        # Get current tasks from state (may be empty on first run)
-        tasks_dict: dict[str, Any] = dict(state.get("tasks", {}))
-        active_workers: dict[str, str] = dict(state.get("active_workers", {}))
-        errors: list[str] = list(state.get("errors", []))
-
-        # Build TaskQueue from state for easier management
-        task_queue = TaskQueue(
-            tasks={tid: (t if isinstance(t, AuditTask) else AuditTask(**t)) for tid, t in tasks_dict.items()},
-            active_workers=active_workers,
-        )
-
-        # Get set of completed task IDs for dependency checking
-        completed_ids = {tid for tid, task in task_queue.tasks.items() if task.status == TaskStatus.COMPLETED}
-
-        # Clear satisfied dependencies so assign_task can mark tasks runnable
-        for task in task_queue.tasks.values():
-            if not task.dependencies:
-                continue
-            for dep_id in list(task.dependencies):
-                if dep_id in completed_ids:
-                    task.unblock(dep_id)
-
-        # Find runnable tasks: PENDING with all dependencies COMPLETED
-        runnable_tasks: list[AuditTask] = []
-        for task in task_queue.tasks.values():
-            if task.status != TaskStatus.PENDING:
-                continue
-            # Check if all dependencies are completed
-            deps_met = all(dep_id in completed_ids for dep_id in task.dependencies)
-            if deps_met:
-                runnable_tasks.append(task)
-
-        # Sort by priority (lower number = higher priority)
-        runnable_tasks.sort(key=lambda t: t.priority)
-
-        log.info(
-            "dispatcher_found_runnable",
-            runnable_count=len(runnable_tasks),
-            total_tasks=len(task_queue.tasks),
-            completed=len(completed_ids),
-            active_workers=len(task_queue.active_workers),
-        )
-
-        # Get list of available agents (not currently working on a task)
-        known_agents = {"code", "docs", "security"}
-        busy_agents = set(task_queue.active_workers.keys())
-        available_agents = list(known_agents - busy_agents)
-
-        # Assign runnable tasks to available agents
-        assigned_count = 0
-        task_queue_ids: list[str] = []
-
-        for task in runnable_tasks:
-            # Check if the task's assigned agent is available
-            if task.assignee in available_agents:
-                # Assign and start the task
-                if task_queue.assign_task(task.id, task.assignee):
-                    available_agents.remove(task.assignee)
-                    assigned_count += 1
-                    log.info(
-                        "task_assigned",
-                        task_id=task.id,
-                        task_type=task.type,
-                        agent=task.assignee,
-                        priority=task.priority,
-                    )
-            else:
-                # Task is runnable but agent is busy - add to queue for next iteration
-                task_queue_ids.append(task.id)
-
-        # Convert tasks back to dict for state update
-        updated_tasks = {tid: task.model_dump() for tid, task in task_queue.tasks.items()}
-
-        log.info(
-            "dispatcher_complete",
-            assigned=assigned_count,
-            queued=len(task_queue_ids),
-            pending=task_queue.pending_count,
-            running=task_queue.running_count,
-            completed=task_queue.completed_count,
-            failed=task_queue.failed_count,
-            elapsed_sec=round(max(0.0, monotonic() - started_at), 3),
-        )
-
-        return {
-            "tasks": updated_tasks,
-            "task_queue": task_queue_ids,
-            "active_workers": dict(task_queue.active_workers),
-            "step": "dispatch_done",
-            "errors": errors,
-        }
-
-
-async def execute_tasks_node(state: AuditState) -> dict[str, Any]:
-    """Execute tasks assigned to agents and capture results (Phase 11)."""
-    from vds_audit_orchestrator.agents.code_agent import CodeAnalysisAgent
-    from vds_audit_orchestrator.agents.docs_agent import DocumentationAgent
-    from vds_audit_orchestrator.agents.security_agent import SecurityAgent
-    from vds_audit_orchestrator.llm.provider import LLMSettings
-
-    log = logger.bind(step="execute_tasks")
-    started_at = monotonic()
-
-    tasks_dict: dict[str, Any] = dict(state.get("tasks", {}))
-    active_workers: dict[str, str] = dict(state.get("active_workers", {}))
-    errors: list[str] = list(state.get("errors", []))
-    agent_results: list[dict[str, Any]] = list(state.get("agent_results", []))
-
-    task_queue = TaskQueue(
-        tasks={tid: (t if isinstance(t, AuditTask) else AuditTask(**t)) for tid, t in tasks_dict.items()},
-        active_workers=active_workers,
-    )
-
-    if not task_queue.active_workers:
-        log.info("tasks_execution_skipped", reason="no_active_workers")
-        runnable_ids = [task.id for task in task_queue.get_runnable_tasks()]
-        return {
-            "tasks": {tid: task.model_dump() for tid, task in task_queue.tasks.items()},
-            "task_queue": runnable_ids,
-            "active_workers": dict(task_queue.active_workers),
-            "agent_results": agent_results,
-            "errors": errors,
-            "step": "tasks_executed",
-        }
-
-    llm_settings = LLMSettings.from_config()
-    agentic_mode = state.get("agentic_mode", "auto")
-    agents = {
-        "code": CodeAnalysisAgent(settings=llm_settings, agentic_mode=agentic_mode),
-        "docs": DocumentationAgent(settings=llm_settings),
-        "security": SecurityAgent(settings=llm_settings),
-    }
-
-    pending_calls: list[tuple[str, str, Any]] = []
-
-    for agent_name, task_id in task_queue.active_workers.items():
-        task = task_queue.get_task(task_id)
-        if task is None:
-            errors.append(f"Active task {task_id} not found")
-            continue
-        agent = agents.get(agent_name)
-        if agent is None:
-            errors.append(f"No agent registered for task {task_id} (assignee={agent_name})")
-            task_queue.fail_task(task_id, f"No agent registered for {agent_name}")
-            continue
-        # Phase 41: Inject repo_path into profile for agentic toolset scoping.
-        task_profile = state.get("profile", {})
-        if "repo_path" not in task_profile and state.get("repo_path"):
-            task_profile = {**task_profile, "repo_path": state["repo_path"]}
-        analyze_kwargs: dict[str, Any] = {"profile": task_profile}
-        analyze_signature = inspect.signature(agent.analyze)
-        if "evidence_corpus" in analyze_signature.parameters:
-            analyze_kwargs["evidence_corpus"] = _deserialize_evidence_corpus(state.get("evidence_corpus"))
-        pending_calls.append((agent_name, task_id, agent.analyze(task, **analyze_kwargs)))
-
-    # Run assigned agent tasks sequentially to reduce provider-side burst 429s.
-    # Quality/stability is prioritized over throughput for audit workflows.
-    for agent_name, task_id, coroutine in pending_calls:
-        operation_started_at = monotonic()
-        operation_context = _build_agent_operation_log_context(
-            state,
-            operation_scope="execute_tasks_node",
-            agent_name=agent_name,
-            task_id=task_id,
-        )
-        log.info("agent_operation_started", **operation_context)
-        try:
-            result = await coroutine
-        except BaseException as exc:
-            result = exc
-
-        if isinstance(result, BaseException):
-            metrics.count_check_failure(agent_name, state["repository"])
-            log.warning(
-                "agent_operation_failed",
-                elapsed_sec=round(max(0.0, monotonic() - operation_started_at), 3),
-                error=str(result),
-                **operation_context,
-            )
-            errors.append(f"Task {task_id} failed: {result}")
-            task_queue.fail_task(task_id, str(result))
-            agent_results.append(
-                {
-                    "agent": agent_name,
-                    "success": False,
-                    "findings": [],
-                    "metadata": {},
-                    "error": str(result),
-                }
-            )
-            continue
-
-        agent_result = result  # type: AgentResult
-        if not agent_result.success:
-            metrics.count_check_failure(agent_name, state["repository"])
-            error_message = str(agent_result.error) if agent_result.error is not None else "Agent reported failure"
-            task_queue.fail_task(task_id, error_message)
-            efficiency_metrics = _extract_agent_efficiency_metrics(agent_result.metadata)
-            log.warning(
-                "agent_operation_failed",
-                elapsed_sec=round(max(0.0, monotonic() - operation_started_at), 3),
-                success=False,
-                error=error_message,
-                findings_count=len(agent_result.findings),
-                **efficiency_metrics,
-                **operation_context,
-            )
-            log.warning(
-                "task_agent_failed",
-                agent=agent_name,
-                task_id=task_id,
-                error=error_message,
-                findings_count=len(agent_result.findings),
-                **efficiency_metrics,
-            )
-        else:
-            task_queue.complete_task(
-                task_id,
-                output={
-                    "findings": agent_result.findings,
-                    "metadata": agent_result.metadata,
-                },
-            )
-            efficiency_metrics = _extract_agent_efficiency_metrics(agent_result.metadata)
-            log.info(
-                "agent_operation_complete",
-                elapsed_sec=round(max(0.0, monotonic() - operation_started_at), 3),
-                success=True,
-                findings_count=len(agent_result.findings),
-                **efficiency_metrics,
-                **operation_context,
-            )
-            log.info(
-                "task_agent_complete",
-                agent=agent_name,
-                task_id=task_id,
-                findings_count=len(agent_result.findings),
-                **efficiency_metrics,
-            )
-
-        agent_results.append(
-            {
-                "agent": agent_name,
-                "success": agent_result.success,
-                "findings": agent_result.findings,
-                "metadata": agent_result.metadata,
-                "error": str(agent_result.error) if agent_result.error is not None else None,
-            }
-        )
-
-        for spawned in agent_result.spawned_tasks:
-            try:
-                dependencies = spawned.get("dependencies") if isinstance(spawned, dict) else None
-                new_task = AuditTask(
-                    type=spawned.get("type") or "unknown",
-                    description=spawned.get("description") or "",
-                    assignee=spawned.get("assignee") or "unassigned",
-                    input_data=spawned.get("input_data") or {},
-                    priority=spawned.get("priority", TaskPriority.NORMAL.value),
-                    created_by=spawned.get("created_by", agent_name),
-                    dependencies=dependencies or [task_id],
-                )
-                task_queue.add_task(new_task)
-            except Exception as exc:
-                errors.append(f"Failed to spawn task from {agent_name}: {exc}")
-
-    runnable_ids = [task.id for task in task_queue.get_runnable_tasks()]
-
-    log.info(
-        "tasks_execution_complete",
-        elapsed_sec=round(max(0.0, monotonic() - started_at), 3),
-        total_tasks=len(task_queue.tasks),
-        active_workers=len(task_queue.active_workers),
-        runnable=len(runnable_ids),
-        completed=task_queue.completed_count,
-        failed=task_queue.failed_count,
-    )
-
-    log.info(
-        "tasks_execution_complete",
-        completed=task_queue.completed_count,
-        failed=task_queue.failed_count,
-        pending=task_queue.pending_count,
-        running=task_queue.running_count,
-        spawned=len(task_queue.tasks) - len(tasks_dict),
-    )
-
-    return {
-        "tasks": {tid: task.model_dump() for tid, task in task_queue.tasks.items()},
-        "task_queue": runnable_ids,
-        "active_workers": dict(task_queue.active_workers),
-        "agent_results": agent_results,
-        "errors": errors,
-        "step": "tasks_executed",
-    }
-
-
-def should_continue_dispatch(state: AuditState) -> str:
-    """Determine if dispatching should continue or move to synthesis.
-
-    Routes to:
-    - "dispatch": If there are pending/running tasks remaining
-    - "synthesize": If all tasks are in terminal states (completed/failed/skipped)
-
-    Args:
-        state: Current workflow state.
-
-    Returns:
-        Route name: "dispatch" or "synthesize".
-    """
-    tasks_dict: dict[str, Any] = state.get("tasks", {})
-
-    # If no tasks exist, go straight to synthesize
-    if not tasks_dict:
-        row_unified_mode = str(state.get("row_unified_mode", "")).strip().lower()
-        single_row_targeted = bool(state.get("single_row_targeted", False))
-        dispatch_skip_reason = str(state.get("dispatch_skip_reason") or "").strip() or None
-        if row_unified_mode == "on":
-            logger.info(
-                "should_continue_dispatch",
-                decision="synthesize",
-                reason=dispatch_skip_reason or "row_unified_mode",
-                row_unified_mode=row_unified_mode,
-                single_row_targeted=single_row_targeted,
-            )
-        else:
-            logger.info("should_continue_dispatch", decision="synthesize", reason="no_tasks")
-        return "synthesize"
-
-    # Count tasks by status
-    pending_count = 0
-    running_count = 0
-    terminal_count = 0
-
-    for task_data in tasks_dict.values():
-        # Handle both AuditTask objects and dicts
-        if isinstance(task_data, AuditTask):
-            status = task_data.status
-        else:
-            status_value = task_data.get("status", "pending")
-            status = TaskStatus(status_value) if isinstance(status_value, str) else status_value
-
-        if status == TaskStatus.PENDING:
-            pending_count += 1
-        elif status == TaskStatus.RUNNING:
-            running_count += 1
-        elif status in (TaskStatus.COMPLETED, TaskStatus.FAILED, TaskStatus.SKIPPED):
-            terminal_count += 1
-
-    total_tasks = len(tasks_dict)
-    has_work_remaining = pending_count > 0 or running_count > 0
-
-    if has_work_remaining:
-        logger.info(
-            "should_continue_dispatch",
-            decision="dispatch",
-            pending=pending_count,
-            running=running_count,
-            terminal=terminal_count,
-            total=total_tasks,
-        )
-        return "dispatch"
-
-    logger.info(
-        "should_continue_dispatch",
-        decision="synthesize",
-        reason="all_tasks_terminal",
-        terminal=terminal_count,
-        total=total_tasks,
-    )
-    return "synthesize"
-
-
-def route_after_execute(state: AuditState) -> str:
-    """Route after executing tasks based on task status and findings."""
-    if should_continue_dispatch(state) == "dispatch":
-        return "dispatch"
-    return should_human_review(state)
-
-
-def _extract_critical_findings(state: AuditState) -> list[dict[str, Any]]:
-    """Extract critical findings from agent results.
-
-    Critical findings are those with:
-    - LLM score < 50 (indicates significant issues)
-    - Type is security_vulnerability
-    - Explicit error in agent result
-
-    Args:
-        state: Current workflow state.
-
-    Returns:
-        List of critical finding dictionaries.
-    """
-    critical_issues: list[dict[str, Any]] = []
-
-    for result in state.get("agent_results", []):
-        # Check for critical issues based on LLM score
-        metadata = result.get("metadata", {})
-        llm_score = metadata.get("llm_score", 100)
-
-        if llm_score < 50:
-            critical_issues.append(
-                {
-                    "agent": result.get("agent"),
-                    "reason": "low_llm_score",
-                    "llm_score": llm_score,
-                    "findings": result.get("findings", []),
-                }
-            )
-
-        # Check for explicit errors
-        if result.get("error"):
-            critical_issues.append(
-                {
-                    "agent": result.get("agent"),
-                    "reason": "agent_error",
-                    "error": result.get("error"),
-                }
-            )
-
-        # Check for security vulnerabilities
-        for finding in result.get("findings", []):
-            if finding.get("type") == "security_vulnerability" and not any(f.get("id") == finding.get("id") for f in critical_issues):
-                    critical_issues.append(
-                        {
-                            "agent": result.get("agent"),
-                            "reason": "security_vulnerability",
-                            "finding": finding,
-                        }
-                    )
-
-    return critical_issues
-
-
-def should_human_review(state: AuditState) -> str:
-    """Determine if human review is needed based on findings.
-
-    Routes to human_review node if critical findings exist that require
-    human judgment before proceeding to synthesis.
-
-    Critical findings criteria:
-    - LLM score < 50 (indicates significant quality/security issues)
-    - Security vulnerabilities detected
-    - Agent execution errors
-
-    Args:
-        state: Current workflow state.
-
-    Returns:
-        Route name: "human_review" or "synthesize".
-    """
-    critical_issues = _extract_critical_findings(state)
-
-    if critical_issues:
-        logger.info(
-            "human_review_required",
-            critical_count=len(critical_issues),
-            reasons=[issue.get("reason") for issue in critical_issues],
-        )
-        return "human_review"
-
-    return "synthesize"
-
-
-def _count_explicit_findings(agent_results: list[Any]) -> int:
-    """Count explicit findings from agent payloads without inferred synthesis artifacts."""
-    total_findings = 0
-    for result in agent_results:
-        if isinstance(result, AgentResult):
-            total_findings += len(result.findings)
-            continue
-        if not isinstance(result, dict):
-            continue
-        findings = result.get("findings")
-        if isinstance(findings, list):
-            total_findings += len(findings)
-    return total_findings
-
-
-_TOOL_ACTIVITY_COUNTER_KEYS: tuple[str, ...] = (
-    "docs_search_count",
-    "docs_read_count",
-    "code_search_count",
-    "code_read_count",
-)
-
-
-def _coerce_non_negative_int(value: Any) -> int:
-    if isinstance(value, bool):
-        return int(value)
-    if isinstance(value, int):
-        return max(0, value)
-    if isinstance(value, float):
-        return max(0, int(value))
-    if isinstance(value, str):
-        try:
-            return max(0, int(float(value.strip())))
-        except ValueError:
-            return 0
-    if isinstance(value, list | tuple | set | dict):
-        return len(value)
-    return 0
-
-
-def _normalize_state_artifact_rows(payload: Any) -> list[dict[str, Any]]:
-    if isinstance(payload, list):
-        return [row for row in payload if isinstance(row, dict)]
-    if isinstance(payload, dict):
-        row_keys = {"row_id", "check_id", "status", "retrieval_trace", "evidence_anchors", "evidence_refs"}
-        if any(key in payload for key in row_keys):
-            return [payload]
-        return [value for value in payload.values() if isinstance(value, dict)]
-    return []
-
-
-def _extract_retrieval_trace_payload(payload: dict[str, Any]) -> dict[str, Any] | None:
-    trace = payload.get("retrieval_trace")
-    if isinstance(trace, dict):
-        return trace
-    return payload if isinstance(payload, dict) else None
-
-
-def _trace_has_tool_activity(trace: dict[str, Any] | None) -> bool:
-    if not isinstance(trace, dict):
-        return False
-    containers: list[dict[str, Any]] = [trace]
-    loop_trace = trace.get("tool_first_loop")
-    if isinstance(loop_trace, dict):
-        containers.append(loop_trace)
-    for container in containers:
-        if any(_coerce_non_negative_int(container.get(key)) > 0 for key in _TOOL_ACTIVITY_COUNTER_KEYS):
-            return True
-    return False
-
-
-def _count_payload_evidence_refs(payload: dict[str, Any]) -> int:
-    refs_count = _coerce_non_negative_int(payload.get("evidence_refs"))
-    refs_count += _coerce_non_negative_int(payload.get("evidence_anchors"))
-    trace = _extract_retrieval_trace_payload(payload)
-    if isinstance(trace, dict):
-        refs_count += _coerce_non_negative_int(trace.get("evidence_refs"))
-        refs_count += _coerce_non_negative_int(trace.get("evidence_anchors"))
-        loop_trace = trace.get("tool_first_loop")
-        if isinstance(loop_trace, dict):
-            refs_count += _coerce_non_negative_int(loop_trace.get("evidence_refs"))
-            refs_count += _coerce_non_negative_int(loop_trace.get("evidence_anchors"))
-    return refs_count
-
-
-def _collect_row_unified_no_task_guard_telemetry(state: AuditState) -> dict[str, int]:
-    row_payloads = _normalize_state_artifact_rows(state.get("row_results"))
-    if not row_payloads:
-        row_payloads = _normalize_state_artifact_rows(state.get("checklist_results"))
-
-    retrieval_trace_rows = _normalize_state_artifact_rows(state.get("retrieval_trace_rows"))
-    rows_evaluated = len(row_payloads)
-    rows_with_tool_activity = 0
-    evidence_refs_count = 0
-
-    for payload in row_payloads:
-        trace = _extract_retrieval_trace_payload(payload)
-        if _trace_has_tool_activity(trace):
-            rows_with_tool_activity += 1
-        evidence_refs_count += _count_payload_evidence_refs(payload)
-
-    if rows_evaluated == 0:
-        for payload in retrieval_trace_rows:
-            trace = _extract_retrieval_trace_payload(payload)
-            if _trace_has_tool_activity(trace):
-                rows_with_tool_activity += 1
-
-    for payload in retrieval_trace_rows:
-        evidence_refs_count += _count_payload_evidence_refs(payload)
-
-    evidence_refs_count += _coerce_non_negative_int(state.get("evidence_refs"))
-    evidence_refs_count += _coerce_non_negative_int(state.get("evidence_anchors"))
-
-    return {
-        "rows_evaluated": rows_evaluated,
-        "rows_with_tool_activity": rows_with_tool_activity,
-        "retrieval_trace_rows": len(retrieval_trace_rows),
-        "evidence_refs_count": evidence_refs_count,
-    }
-
-
-def _is_row_unified_single_row_no_task_state(
-    state: AuditState,
-    *,
-    guard_telemetry: dict[str, int] | None = None,
-) -> bool:
-    """Detect no-task synthesis conditions for row-unified dynamic runs."""
-    row_unified_mode = str(state.get("row_unified_mode", "on")).strip().lower()
-    if row_unified_mode != "on":
-        return False
-    if not bool(state.get("single_row_targeted", False)):
-        return False
-    if state.get("tasks") or state.get("agent_results"):
-        return False
-    # Guard against false no-task synthesis when checklist-driven row evaluation
-    # context or artifacts are already attached to the workflow state.
-    if isinstance(state.get("row_state_context"), dict) and state.get("row_state_context"):
-        return False
-    for artifact_key in (
-        "checklist_rows",
-        "checklist_results",
-        "retrieval_trace",
-        "retrieval_trace_rows",
-        "row_results",
-    ):
-        artifact = state.get(artifact_key)
-        if isinstance(artifact, dict) and artifact:
-            return False
-        if isinstance(artifact, list) and artifact:
-            return False
-    telemetry = guard_telemetry or _collect_row_unified_no_task_guard_telemetry(state)
-    if telemetry.get("rows_evaluated", 0) > 0:
-        return False
-    if telemetry.get("retrieval_trace_rows", 0) > 0:
-        return False
-    return not telemetry.get("evidence_refs_count", 0) > 0
-
-
-async def human_review_node(state: AuditState) -> dict[str, Any]:
-    """Pause for human review and approval (TSK-073).
-
-    This node uses LangGraph's interrupt() mechanism to pause execution
-    when critical findings exist. The interrupt payload is persisted in
-    the checkpoint and can be reviewed via CLI or API.
-
-    Workflow will pause here until human input is provided via:
-    - CLI: vds-audit workflow-resume --thread-id <id> --approve/--reject
-    - API: resume_audit_with_human_input() with approval decision
-
-    The interrupt payload includes:
-    - agent_results: All agent findings
-    - critical_issues: Filtered list of critical findings requiring review
-    - errors: Any errors that occurred during analysis
-    - profile: Project profile information
-
-    Args:
-        state: Current workflow state.
-
-    Returns:
-        State update with awaiting_human step marker.
-        In normal execution, this function calls interrupt() which pauses
-        the workflow. When resumed, the human_approved and human_feedback
-        fields will be set in the state.
-    """
-    with trace_span("audit.human_review"):
-        critical_issues = _extract_critical_findings(state)
-
-        log = logger.bind(
-            step="human_review",
-            repo=state.get("repository"),
-            critical_count=len(critical_issues),
-        )
-        log.info(
-            "human_review_awaiting",
-            critical_issues_count=len(critical_issues),
-            agent_results_count=len(state.get("agent_results", [])),
-        )
-
-        # Prepare the interrupt payload for human review
-        # This payload will be persisted in the checkpoint
-        interrupt_payload: dict[str, Any] = {
-            "question": "Critical findings detected. Approve continuation to synthesis?",
-            "repository": state.get("repository"),
-            "repo_path": state.get("repo_path"),
-            "project_id": state.get("project_id"),
-            "critical_issues": critical_issues,
-            "agent_results": state.get("agent_results", []),
-            "errors": state.get("errors", []),
-            "profile": state.get("profile", {}),
-            "review_instructions": {
-                "cli_approve": "vds-audit workflow-resume --thread-id <THREAD_ID> --approve",
-                "cli_reject": "vds-audit workflow-resume --thread-id <THREAD_ID> --reject",
-                "api_approve": "resume_audit_with_human_input(thread_id=..., human_approved=True)",
-                "api_reject": "resume_audit_with_human_input(thread_id=..., human_approved=False)",
-            },
-        }
-
-        # This call pauses execution and persists the payload
-        # Workflow will resume when human input is provided
-        return interrupt(interrupt_payload)
-
-
-async def synthesize_node(state: AuditState) -> dict[str, Any]:
-    """Synthesize results from all agents.
-
-    Aggregates findings from all analysis agents into a final
-    synthesis with overall scores and recommendations.
-
-    If human review was performed and rejected, synthesis will
-    indicate the rejection and preserve findings for review.
-
-    Args:
-        state: Current workflow state.
-
-    Returns:
-        State update with synthesis results and completion marker.
-    """
-    log = logger.bind(step="synthesize")
-    started_at = monotonic()
-    log.info("synthesis_started")
-
-    with trace_span("audit.synthesize", {"repo": state["repository"]}):
-        agent_results = state.get("agent_results", [])
-        total_findings = _count_explicit_findings(agent_results)
-        no_task_guard_telemetry = _collect_row_unified_no_task_guard_telemetry(state)
-
-        # Check if human rejected the findings
-        human_approved = state.get("human_approved")
-        if human_approved is False:
-            log.info("synthesis_skipped_rejected", human_feedback=state.get("human_feedback"))
-            synthesis = {
-                "repository": state["repository"],
-                "status": "rejected",
-                "human_approved": False,
-                "human_feedback": state.get("human_feedback"),
-                "agent_results": agent_results,
-                "profile": state.get("profile", {}),
-                "rows_evaluated": no_task_guard_telemetry.get("rows_evaluated", 0),
-                "rows_with_tool_activity": no_task_guard_telemetry.get("rows_with_tool_activity", 0),
-                "message": "Audit findings were rejected during human review. "
-                "Review critical findings and address issues before re-running.",
-            }
-            # Record audit as completed (rejected)
-            metrics.count_audit_run("rejected", state["repository"])
-            log.info(
-                "synthesis_complete",
-                status="rejected",
-                elapsed_sec=round(max(0.0, monotonic() - started_at), 3),
-                total_findings=total_findings,
-            )
-            return {"synthesis": synthesis, "step": "complete"}
-
-        if _is_row_unified_single_row_no_task_state(state, guard_telemetry=no_task_guard_telemetry):
-            log.info(
-                "workflow_no_task_synthesis_dynamic_only",
-                row_unified_mode=state.get("row_unified_mode"),
-                single_row_targeted=bool(state.get("single_row_targeted", False)),
-                rows_evaluated=no_task_guard_telemetry.get("rows_evaluated", 0),
-                rows_with_tool_activity=no_task_guard_telemetry.get("rows_with_tool_activity", 0),
-                retrieval_trace_rows=no_task_guard_telemetry.get("retrieval_trace_rows", 0),
-                evidence_refs_count=no_task_guard_telemetry.get("evidence_refs_count", 0),
-            )
-            synthesis = {
-                "repository": state["repository"],
-                "status": "complete",
-                "overall_score": 0.0,
-                "maturity_level": "Critical",
-                "agent_scores": {},
-                "critical_gaps": [],
-                "aligned_practices": [],
-                "recommendations": [],
-                "cross_cutting_concerns": [],
-                "executive_summary": (
-                    "No analysis tasks were executed in row-unified dynamic mode. "
-                    "No agent findings were produced, so this run cannot provide evidence-based "
-                    "recommendations. The score remains 0.0 until explicit analysis tasks and "
-                    "findings are available."
-                ),
-                "total_findings": total_findings,
-                "human_approved": human_approved,
-                "human_feedback": state.get("human_feedback"),
-                "profile": state.get("profile", {}),
-                "rows_evaluated": no_task_guard_telemetry.get("rows_evaluated", 0),
-                "rows_with_tool_activity": no_task_guard_telemetry.get("rows_with_tool_activity", 0),
-                "evidence_selection_history": [],
-                "message": ("No baseline analysis tasks or agent results were available in row-unified dynamic mode."),
-            }
-            metrics.count_audit_run("complete", state["repository"])
-            log.info(
-                "synthesis_complete",
-                status="complete_no_task",
-                elapsed_sec=round(max(0.0, monotonic() - started_at), 3),
-                total_findings=total_findings,
-            )
-            return {"synthesis": synthesis, "step": "complete"}
-
-        # Convert dict results into AgentResult for synthesis
-        agent_result_objects: list[AgentResult] = []
-        for result in agent_results:
-            if isinstance(result, AgentResult):
-                agent_result_objects.append(result)
-                continue
-            if isinstance(result, dict):
-                findings = result.get("findings")
-                metadata = result.get("metadata")
-                agent_result_objects.append(
-                    AgentResult(
-                        agent_name=result.get("agent", "unknown"),
-                        success=bool(result.get("success")),
-                        findings=list(findings) if isinstance(findings, list) else [],
-                        metadata=dict(metadata) if isinstance(metadata, dict) else {},
-                        error=result.get("error"),
-                    )
-                )
-
-        evidence_corpus_obj = deserialize_evidence_corpus(state.get("evidence_corpus"))
-        synthesizer = SynthesisAgent(evidence_corpus=evidence_corpus_obj)
-        synthesis_result = await synthesizer.synthesize(state["repository"], agent_result_objects)
-        synthesis = synthesis_result.to_dict()
-
-        # TSK-169B: Include evidence selection history for debug/reproducibility
-        evidence_corpus = evidence_corpus_obj
-        evidence_selection_history = []
-        if evidence_corpus and hasattr(evidence_corpus, "get_selection_history"):
-            try:
-                evidence_selection_history = evidence_corpus.get_selection_history()
-            except Exception:
-                pass  # Non-critical, don't fail if history unavailable
-
-        synthesis.update(
-            {
-                "repository": state["repository"],
-                "status": "complete",
-                "total_findings": total_findings,
-                "human_approved": human_approved,
-                "human_feedback": state.get("human_feedback"),
-                "profile": state.get("profile", {}),
-                "rows_evaluated": no_task_guard_telemetry.get("rows_evaluated", 0),
-                "rows_with_tool_activity": no_task_guard_telemetry.get("rows_with_tool_activity", 0),
-                "evidence_selection_history": evidence_selection_history,  # TSK-169B
-            }
-        )
-
-        log.info(
-            "synthesis_complete",
-            total_findings=total_findings,
-            critical=len(synthesis.get("critical_gaps", [])),
-            human_reviewed=human_approved,
-            elapsed_sec=round(max(0.0, monotonic() - started_at), 3),
-        )
-
-        # Record successful audit run
-        metrics.count_audit_run("complete", state["repository"])
-
-        return {"synthesis": synthesis, "step": "complete"}
-
-
-# =============================================================================
-# Graph Builder
-# =============================================================================
-
-
-# Valid checkpointer types for strict PostgreSQL enforcement.
-_VALID_CHECKPOINTER_TYPES: frozenset[str] = frozenset({"postgres", "memory"})
-_CHECKPOINTER_ALLOWED_MSGPACK_MODULES: tuple[tuple[str, str], ...] = (
-    ("vds_audit_orchestrator.models.evidence", "EvidenceStatus"),
-    ("vds_audit_orchestrator.models.evidence", "EvidenceBundle"),
-)
-
-
-async def _get_checkpointer(checkpointer: str | None, postgres_dsn: str | None) -> MemorySaver | Any:
-    """Resolve checkpointer instance with async setup for PostgresSaver.
-
-    Args:
-        checkpointer: Type of checkpointer ('memory', 'postgres', or None for default memory)
-        postgres_dsn: PostgreSQL connection string for PostgresSaver
-
-    Returns:
-        Configured checkpointer instance (MemorySaver or PostgresSaver)
-
-    Raises:
-        ValueError: If unknown checkpointer type or postgres requested without DSN
-        RuntimeError: If langgraph-checkpoint-postgres not installed
-    """
-    # Validate checkpointer type to prevent silent fallback on typos.
-    normalized = (checkpointer or "memory").lower()
-    if normalized not in _VALID_CHECKPOINTER_TYPES:
-        raise ValueError(
-            f"Unknown checkpointer type: {checkpointer!r}. Must be one of: {sorted(_VALID_CHECKPOINTER_TYPES)}"
-        )
-    if normalized == "postgres":
-        log = logger.bind(checkpointer="postgres")
-        # Lazy import avoids importing langchain/langgraph postgres deps for non-postgres runs.
-        global PostgresSaver, _postgres_saver_import_error
-        if PostgresSaver is None and _postgres_saver_import_error is None:  # pragma: no branch
-            try:
-                from langgraph.checkpoint.postgres.aio import AsyncPostgresSaver as PostgresSaver
-            except Exception as exc:  # pragma: no cover
-                _postgres_saver_import_error = exc
-
-        if not postgres_dsn:
-            raise ValueError(
-                "postgres checkpointer requires postgres_dsn or VDS_AUDIT_LANGGRAPH__POSTGRES_DSN environment variable"
-            )
-        if PostgresSaver is None:  # pragma: no cover
-            detail = ""
-            if _postgres_saver_import_error is not None:
-                detail = f" (import error: {_postgres_saver_import_error})"
-            raise RuntimeError(
-                "postgres checkpointer requested but PostgresSaver is unavailable. "
-                "Ensure `langgraph-checkpoint-postgres` and `psycopg[binary]` are installed "
-                "(or provide system `libpq`)." + detail
-            )
-        log.info("langgraph_postgres_checkpointer_enabled", dsn=_redact_postgres_dsn(postgres_dsn))
-        serde = JsonPlusSerializer(allowed_msgpack_modules=_CHECKPOINTER_ALLOWED_MSGPACK_MODULES)
-        # Create PostgresSaver from connection string.
-        #
-        # AsyncPostgresSaver.from_conn_string is an @asynccontextmanager that yields a saver.
-        # We need to enter the context and keep it alive for the lifetime of the graph.
-        cm = PostgresSaver.from_conn_string(postgres_dsn, serde=serde)
-        saver = await cm.__aenter__()
-        # Keep the contextmanager alive for the lifetime of the workflow.
-        # If `cm` is GC'd, its finalizer can close the generator -> closed DB connection.
-        saver._vds_audit_async_cm = cm  # type: ignore[attr-defined]
-        # Required: Call .setup() to initialize tables on first use
-        await saver.setup()
-        log.info("langgraph_postgres_checkpointer_ready")
-        # NOTE: We intentionally do not __aexit__ here; the saver must remain usable while
-        # the workflow runs. The process will clean up connections on exit.
-        return saver
-    # Explicit memory checkpointer for local development only.
-    logger.info("langgraph_memory_checkpointer_enabled", note="workflow state is non-durable")
-    return MemorySaver()
-
-
-async def build_audit_graph(
-    *,
-    checkpointer: str | None = None,
-    postgres_dsn: str | None = None,
-    state_manifest_loader: StateManifestLoader | None = None,
-) -> CompiledStateGraph:
-    """Build and compile the audit workflow graph with checkpointing.
-
-    Creates a StateGraph with the following flow:
-    profile -> evidence -> seed_tasks -> dispatcher -> execute_tasks -> (conditional) -> synthesize -> END
-                                                                      |-> human_review -> synthesize -> END
-
-    Args:
-        checkpointer: Type of checkpointer ('memory', 'postgres', or None)
-        postgres_dsn: PostgreSQL connection string (required for postgres checkpointer)
-
-    Returns:
-        Compiled StateGraph with configured checkpointer.
-
-    Note:
-        When using 'postgres' checkpointer, this function is async to handle
-        the required .setup() call for PostgresSaver.
-    """
-    builder: StateGraph = StateGraph(AuditState)
-
-    # Add nodes
-    builder.add_node("profile", profile_node)
-
-    async def _evidence_node_with_state_loader(state: AuditState) -> dict[str, Any]:
-        return await evidence_node(state, state_manifest_loader=state_manifest_loader)
-
-    builder.add_node("evidence", _evidence_node_with_state_loader)
-    builder.add_node("seed_tasks", seed_tasks_node)
-    builder.add_node("dispatcher", dispatcher_node)  # Phase 11: Dynamic task orchestration
-    builder.add_node("execute_tasks", execute_tasks_node)
-    builder.add_node("human_review", human_review_node)
-    builder.add_node("synthesize", synthesize_node)
-
-    # Define edges
-    builder.add_edge("profile", "evidence")
-    builder.add_conditional_edges(
-        "evidence",
-        route_after_evidence,
-        {
-            "seed_tasks": "seed_tasks",
-            "end": END,
-        },
-    )
-    builder.add_edge("seed_tasks", "dispatcher")
-    builder.add_edge("dispatcher", "execute_tasks")
-
-    # Conditional routing after task execution (Phase 11)
-    builder.add_conditional_edges(
-        "execute_tasks",
-        route_after_execute,
-        {
-            "dispatch": "dispatcher",
-            "human_review": "human_review",
-            "synthesize": "synthesize",
-        },
-    )
-
-    builder.add_edge("human_review", "synthesize")
-    builder.add_edge("synthesize", END)
-
-    # Set entry point
-    builder.set_entry_point("profile")
-
-    # Compile with checkpointing (async for PostgresSaver setup)
-    saver = await _get_checkpointer(checkpointer, postgres_dsn)
-    compiled = builder.compile(checkpointer=saver)
-    # Store for later cleanup in the public API functions.
-    compiled._vds_audit_checkpointer = saver  # type: ignore[attr-defined]
-    return compiled
-
-
-async def _maybe_close_checkpointer(graph: Any) -> None:
-    """Best-effort cleanup for Postgres checkpointer context manager."""
-    saver = getattr(graph, "_vds_audit_checkpointer", None)
-    cm = getattr(saver, "_vds_audit_async_cm", None)
-    if cm is None:
-        return
-    # Prevent double-close (e.g. if multiple helpers are called).
-    saver._vds_audit_async_cm = None  # type: ignore[attr-defined]
-    try:
-        await cm.__aexit__(None, None, None)
-    except Exception:  # pragma: no cover - cleanup should never fail the workflow
-        logger.warning("checkpointer_close_failed")
-
-
-# =============================================================================
-# Public API
-# =============================================================================
-
-
-async def run_audit_with_langgraph(
-    repo_path: str,
-    thread_id: str | None = None,
-    project_id: str | None = None,
-    repo_storage_key: str | None = None,
-    state_dsn: str | None = None,
-    *,
-    checkpointer: str | None = None,
-    postgres_dsn: str | None = None,
-    state_manifest_loader: StateManifestLoader | None = None,
-    agentic_mode: str = "auto",
-    row_unified_mode: str = "on",
-    single_row_targeted: bool = False,
-    row_state_context: dict[str, Any] | None = None,
-) -> dict[str, Any]:
-    """Run audit using LangGraph workflow with checkpointing.
-
-    Executes the complete audit workflow including profile detection,
-    evidence collection, agent analysis, optional human review, and synthesis.
-
-    If critical findings are detected, the workflow will pause at the
-    human_review node and await human input. Use resume_audit_with_human_input()
-    to continue the workflow.
-
-    Args:
-        repo_path: Path to the repository to audit.
-        thread_id: Thread ID for checkpointing. Required for durable execution.
-        project_id: Optional project ID. Defaults to repository directory name.
-        repo_storage_key: Optional canonical repository storage key for state-backed retrieval.
-        state_dsn: Optional centralized state DSN for evidence manifest loading.
-        checkpointer: Type of checkpointer ('memory', 'postgres', or None).
-        postgres_dsn: PostgreSQL connection string (required for postgres checkpointer).
-        state_manifest_loader: Optional centralized state manifest loader callback.
-        agentic_mode: Agentic investigation mode for CodeAnalysisAgent (auto/off/on).
-        row_unified_mode: Unified row execution mode (off/on, defaults to on).
-        single_row_targeted: True when workflow is scoped to a single target row.
-        row_state_context: Optional single-row requirement context for requirement-driven routing.
-
-    Returns:
-        Final workflow state values including synthesis results.
-        If workflow is paused for human review, the result will contain
-        the interrupt payload with critical findings.
-
-    Raises:
-        ValueError: If thread_id is not provided.
-
-    Example:
-        >>> result = await run_audit_with_langgraph(
-        ...     "/path/to/repo",
-        ...     thread_id="audit-001",
-        ...     checkpointer="memory"
-        ... )
-        >>> if result.get("step") == "awaiting_human":
-        ...     # Workflow paused for human review
-        ...     print("Critical findings:", result["critical_issues"])
-    """
-    if not thread_id:
-        raise ValueError("thread_id is required for durable execution")
-
-    # Build graph with async checkpointer setup
-    graph = await build_audit_graph(
-        checkpointer=checkpointer,
-        postgres_dsn=postgres_dsn,
-        state_manifest_loader=state_manifest_loader,
-    )
-    try:
-        repo_path_obj = Path(repo_path).resolve()
-
-        config = {"configurable": {"thread_id": thread_id}}
-
-        initial_state: dict[str, Any] = {
-            "repository": repo_path_obj.name,
-            "repo_path": str(repo_path_obj.absolute()),
-            "project_id": project_id or repo_path_obj.name,
-            "repo_storage_key": repo_storage_key,
-            "step": "start",
-            "profile": {},
-            "evidence": None,
-            "evidence_corpus": None,
-            "agent_results": [],
-            "synthesis": None,
-            "errors": [],
-            "human_approved": None,
-            "human_feedback": None,
-            "state_dsn": state_dsn,
-            "tasks": {},
-            "task_queue": [],
-            "active_workers": {},
-            "agentic_mode": agentic_mode,
-            "row_unified_mode": row_unified_mode,
-            "single_row_targeted": single_row_targeted,
-            "row_state_context": dict(row_state_context) if isinstance(row_state_context, dict) else None,
-        }
-        last_known_values: dict[str, Any] = dict(initial_state)
-
-        log = logger.bind(repository=repo_path_obj.name, thread_id=config["configurable"]["thread_id"])
-        log.info("langgraph_audit_started", checkpointer=checkpointer or "memory")
-
-        with log_context(audit_id=thread_id, repo=repo_path_obj.name, phase="workflow"):
-            # Run the graph until completion or interrupt
-            async for event in graph.astream(initial_state, config):  # type: ignore[arg-type]
-                step = None
-                # Extract step from event (event is dict with node name as key)
-                for _node_name, node_output in event.items():
-                    if isinstance(node_output, dict):
-                        # Keep a compact best-effort state snapshot in case checkpoint
-                        # retrieval fails after execution due oversized persisted payload.
-                        last_known_values.update(node_output)
-                        step = node_output.get("step")
-
-                if step:
-                    log.info("workflow_step_complete", step=step)
-
-        final_values: dict[str, Any] = dict(last_known_values)
-        if checkpointer == "postgres":
-            # Avoid a heavy final checkpoint read for large workflows: retrieving
-            # durable state can trigger oversized allocations on some Postgres savers.
-            # We already maintain a compact in-memory last-known snapshot from events.
-            log.info(
-                "workflow_final_state_retrieval_skipped",
-                reason="postgres_checkpoint_payload_guard",
-                fallback="last_known_values",
-            )
-        else:
-            try:
-                # Get final durable state from checkpointer when available.
-                final_state = await graph.aget_state(config)  # type: ignore[arg-type]
-                final_values = dict(final_state.values)
-
-                # Check if workflow is paused for human review
-                if final_state.next:
-                    log.info(
-                        "workflow_paused",
-                        next_nodes=list(final_state.next),
-                        step=final_values.get("step"),
-                    )
-            except Exception as exc:  # pragma: no cover - defensive resilience path
-                log.warning(
-                    "workflow_final_state_retrieval_failed",
-                    error=str(exc),
-                    fallback="last_known_values",
-                )
-                final_values["checkpoint_state_error"] = str(exc)
-
-        log.info("langgraph_audit_complete", step=final_values.get("step"))
-
-        return final_values
-    finally:
-        await _maybe_close_checkpointer(graph)
-
-
-async def resume_audit_with_human_input(
-    thread_id: str,
-    human_approved: bool,
-    human_feedback: str | None = None,
-    *,
-    checkpointer: str | None = None,
-    postgres_dsn: str | None = None,
-) -> dict[str, Any]:
-    """Resume a paused audit with human input (TSK-073).
-
-    Called after human_review_node has paused the workflow with interrupt().
-    Updates the state with human approval decision and feedback, then resumes
-    execution from the paused node.
-
-    If human_approved=False, the synthesis will mark the audit as rejected
-    but still preserve all findings for review.
-
-    Args:
-        thread_id: Thread ID of the paused workflow.
-        human_approved: Whether the human approved the findings.
-        human_feedback: Optional feedback from the human reviewer.
-        checkpointer: Type of checkpointer ('memory', 'postgres', or None).
-        postgres_dsn: PostgreSQL connection string (required for postgres checkpointer).
-
-    Returns:
-        Final workflow state values after resumption.
-
-    Raises:
-        RuntimeError: If the workflow is not paused for human review.
-
-    Example:
-        >>> # Approve and continue
-        >>> result = await resume_audit_with_human_input(
-        ...     thread_id="audit-123",
-        ...     human_approved=True,
-        ...     human_feedback="Findings look correct, proceeding."
-        ... )
-        >>>
-        >>> # Reject and stop
-        >>> result = await resume_audit_with_human_input(
-        ...     thread_id="audit-123",
-        ...     human_approved=False,
-        ...     human_feedback="Security issues must be addressed first."
-        ... )
-    """
-    # Build graph with async checkpointer setup
-    graph = await build_audit_graph(checkpointer=checkpointer, postgres_dsn=postgres_dsn)
-    try:
-        config = {"configurable": {"thread_id": thread_id}}
-
-        log = logger.bind(thread_id=thread_id)
-        log.info("audit_resuming_with_human_input", approved=human_approved)
-
-        # Check current state - verify workflow is paused
-        current_state = await graph.aget_state(config)  # type: ignore[arg-type]
-        if not current_state.next:
-            raise RuntimeError(f"Thread {thread_id} is not paused. Current step: {current_state.values.get('step')}")
-
-        # Use Command(resume=...) pattern to resume with human input
-        # This is the proper LangGraph pattern for human-in-the-loop
-        resume_command = Command(
-            resume={
-                "human_approved": human_approved,
-                "human_feedback": human_feedback,
-            }
-        )
-
-        # Stream the resumption
-        async for event in graph.astream(resume_command, config):  # type: ignore[arg-type]
-            for _node_name, node_output in event.items():
-                if isinstance(node_output, dict):
-                    step = node_output.get("step")
-                    if step:
-                        log.info("workflow_step_complete", step=step)
-
-        # Get final state
-        final_state = await graph.aget_state(config)  # type: ignore[arg-type]
-        final_values = dict(final_state.values)
-
-        log.info(
-            "audit_resumed_complete",
-            step=final_values.get("step"),
-            human_approved=human_approved,
-        )
-
-        return final_values
-    finally:
-        await _maybe_close_checkpointer(graph)
-
-
-async def export_workflow_mermaid(
-    output_path: str | Path,
-    *,
-    checkpointer: str | None = None,
-    postgres_dsn: str | None = None,
-) -> Path:
-    """Export the LangGraph workflow as a Mermaid diagram.
-
-    Args:
-        output_path: Path to save the Mermaid diagram file.
-        checkpointer: Type of checkpointer ('memory', 'postgres', or None).
-        postgres_dsn: PostgreSQL connection string (required for postgres checkpointer).
-
-    Returns:
-        Path to the saved Mermaid diagram file.
-
-    Raises:
-        RuntimeError: If LangGraph mermaid export not available.
-    """
-    graph = await build_audit_graph(checkpointer=checkpointer, postgres_dsn=postgres_dsn)
-    try:
-        compiled = graph.get_graph()
-        if not hasattr(compiled, "draw_mermaid"):
-            raise RuntimeError("LangGraph mermaid export not available in this version")
-        mermaid = compiled.draw_mermaid()
-        output_path = Path(output_path)
-        output_path.write_text(mermaid, encoding="utf-8")
-        return output_path
-    finally:
-        await _maybe_close_checkpointer(graph)
-
-
-async def get_pending_reviews(
-    thread_id: str | None = None,
-    *,
-    checkpointer: str | None = None,
-    postgres_dsn: str | None = None,
-) -> list[dict[str, Any]]:
-    """Get workflows pending human review.
-
-    Lists all paused workflows that are awaiting human approval.
-    Useful for CLI commands that list pending reviews.
-
-    Args:
-        thread_id: Optional specific thread ID to check. If None, returns all pending.
-        checkpointer: Type of checkpointer ('memory', 'postgres', or None).
-        postgres_dsn: PostgreSQL connection string (required for postgres checkpointer).
-
-    Returns:
-        List of pending review info dictionaries with keys:
-        - thread_id: Workflow thread ID
-        - repository: Repository name
-        - step: Current step (should be "awaiting_human")
-        - next_nodes: Next nodes in workflow
-        - critical_count: Number of critical findings (from state)
-        - review_instructions: CLI/API commands for approval/rejection
-
-    Note:
-        For MemorySaver, this only checks the specified thread_id.
-        For PostgresSaver with thread_id=None, this would return all pending reviews
-        (implementation depends on PostgresSaver capabilities).
-    """
-    graph = await build_audit_graph(checkpointer=checkpointer, postgres_dsn=postgres_dsn)
-    try:
-        if thread_id:
-            config = {"configurable": {"thread_id": thread_id}}
-            state = await graph.aget_state(config)  # type: ignore[arg-type]
-
-            if state.next and state.values.get("step") in ("awaiting_human", "human_review"):
-                critical_issues = _extract_critical_findings(state.values)  # type: ignore[arg-type]
-                return [
-                    {
-                        "thread_id": thread_id,
-                        "repository": state.values.get("repository"),
-                        "step": state.values.get("step"),
-                        "next_nodes": list(state.next) if state.next else [],
-                        "critical_count": len(critical_issues),
-                        "review_instructions": {
-                            "cli_approve": f"vds-audit workflow-resume --thread-id {thread_id} --approve",
-                            "cli_reject": f"vds-audit workflow-resume --thread-id {thread_id} --reject",
-                            "api_approve": f"resume_audit_with_human_input(thread_id='{thread_id}', human_approved=True)",
-                            "api_reject": f"resume_audit_with_human_input(thread_id='{thread_id}', human_approved=False)",
-                        },
-                    }
-                ]
-
-        return []
-    finally:
-        await _maybe_close_checkpointer(graph)