@nimiplatform/nimi-coding 0.3.0 → 0.4.0

package/cli/lib/authority/graph.mjs

@@ -0,0 +1,351 @@
+import { Buffer } from "node:buffer";
+import { stat } from "node:fs/promises";
+import path from "node:path";
+
+import { compileAuthorityPath } from "./compile.mjs";
+import { compareText, makeDiagnostic, portablePath } from "./diagnostics.mjs";
+
+const GRAPH_FORMAT = "nimicoding.authority-graph/v1";
+
+async function inputLocation(inputPath) {
+  const absolute = path.resolve(inputPath);
+  const info = await stat(absolute);
+  return {
+    basePath: info.isDirectory() ? absolute : path.dirname(absolute),
+    label: info.isDirectory() ? "." : path.basename(absolute),
+  };
+}
+
+function portableLocation(mapped, basePath) {
+  return {
+    file: portablePath(mapped.file, basePath),
+    range: mapped.range,
+    sourcePointer: mapped.sourcePointer,
+  };
+}
+
+function diagnostic(location, code, id, reason, repair, mapped = null) {
+  return makeDiagnostic({
+    code,
+    file: mapped ? portablePath(mapped.file, location.basePath) : location.label,
+    range: mapped?.range ?? { start: { line: 1, column: 1 }, end: { line: 1, column: 1 } },
+    pointer: mapped?.sourcePointer ?? "/id",
+    reason: `${reason}: ${id}`,
+    repair,
+  });
+}
+
+function failedResult(compiled, diagnostics = compiled.diagnostics) {
+  return {
+    ok: false,
+    diagnostics,
+    fileCount: compiled.fileCount,
+    unitCount: 0,
+    graphBytes: 0,
+    graph: null,
+    partial: false,
+  };
+}
+
+function edgeKey(edge) {
+  return `${edge.source}\u0000${edge.type}\u0000${edge.target}`;
+}
+
+function compareEdge(left, right) {
+  return compareText(left.source, right.source)
+    || compareText(left.type, right.type)
+    || compareText(left.target, right.target);
+}
+
+function compareStep(left, right) {
+  return compareText(left.type, right.type)
+    || compareText(left.traversal, right.traversal)
+    || compareText(left.source, right.source)
+    || compareText(left.target, right.target);
+}
+
+function compareStepSequences(left, right) {
+  for (let index = 0; index < Math.min(left.length, right.length); index += 1) {
+    const compared = compareStep(left[index], right[index]);
+    if (compared !== 0) return compared;
+  }
+  return left.length - right.length;
+}
+
+export function buildAuthorityGraphSnapshot(compiled, basePath, relations) {
+  const selectedTypes = new Set(relations);
+  const byId = new Map();
+  const outgoing = new Map();
+  const incoming = new Map();
+  const edges = [];
+
+  compiled.ir.units.forEach((unit, unitIndex) => {
+    const idMap = compiled.sourceMap.fields[`/units/${unitIndex}/id`];
+    const node = {
+      id: unit.id,
+      kind: unit.kind,
+      owner: unit.owner,
+      lifecycle: unit.lifecycle,
+      scope: unit.lifecycle === "active" && unit.kind === "rule" ? [...unit.semantic.scope] : [],
+      location: portableLocation(idMap, basePath),
+    };
+    byId.set(unit.id, { unit, unitIndex, idMap, node });
+    outgoing.set(unit.id, []);
+    incoming.set(unit.id, []);
+  });
+
+  compiled.ir.units.forEach((unit, unitIndex) => {
+    unit.relations.forEach((relation, relationIndex) => {
+      if (!selectedTypes.has(relation.type)) return;
+      const target = byId.get(relation.target);
+      const value = {
+        source: unit.id,
+        type: relation.type,
+        target: relation.target,
+        sourceLocation: portableLocation(compiled.sourceMap.fields[`/units/${unitIndex}/id`], basePath),
+        relationLocation: portableLocation(compiled.sourceMap.fields[`/units/${unitIndex}/relations/${relationIndex}/target`], basePath),
+        targetLocation: target.node.location,
+      };
+      edges.push(value);
+      outgoing.get(value.source).push(value);
+      incoming.get(value.target).push(value);
+    });
+  });
+  edges.sort(compareEdge);
+  for (const adjacency of [...outgoing.values(), ...incoming.values()]) adjacency.sort(compareEdge);
+  return { byId, outgoing, incoming, edges };
+}
+
+function adjacent(snapshot, id, direction) {
+  const values = [];
+  if (direction === "outgoing" || direction === "both") {
+    for (const edge of snapshot.outgoing.get(id)) values.push({ edge, next: edge.target, traversal: "forward" });
+  }
+  if (direction === "incoming" || direction === "both") {
+    for (const edge of snapshot.incoming.get(id)) values.push({ edge, next: edge.source, traversal: "reverse" });
+  }
+  const deduplicated = new Map();
+  for (const value of values) deduplicated.set(`${edgeKey(value.edge)}\u0000${value.traversal}`, value);
+  return [...deduplicated.values()].sort((left, right) => compareStep(
+    { ...left.edge, traversal: left.traversal },
+    { ...right.edge, traversal: right.traversal },
+  ));
+}
+
+function graphBase(operation, query, nodes, edges, policy, counts, budgets, extra = {}) {
+  return {
+    format: GRAPH_FORMAT,
+    operation,
+    query,
+    complete: true,
+    ...extra,
+    nodes: [...nodes].sort((left, right) => compareText(left.id, right.id)),
+    edges: [...edges].sort(compareEdge),
+    policy,
+    counts,
+    budgets,
+  };
+}
+
+function budgetFailure(compiled, location, id, reason, mapped) {
+  return failedResult(compiled, [diagnostic(
+    location,
+    "AUTH_GRAPH_BUDGET",
+    id,
+    reason,
+    "increase the explicit graph budget; partial graph results are forbidden",
+    mapped,
+  )]);
+}
+
+function finish(compiled, graph, location, root, traversal) {
+  const { maxUnits, maxEdges, maxBytes } = graph.budgets;
+  if (traversal.units > maxUnits) return budgetFailure(
+    compiled,
+    location,
+    root.unit.id,
+    `complete graph proof requires ${traversal.units} units but max-units is ${maxUnits}`,
+    root.idMap,
+  );
+  if (traversal.edges > maxEdges) return budgetFailure(
+    compiled,
+    location,
+    root.unit.id,
+    `complete graph proof requires ${traversal.edges} authored edges but max-edges is ${maxEdges}`,
+    root.idMap,
+  );
+  const graphBytes = Buffer.byteLength(JSON.stringify(graph), "utf8");
+  if (graphBytes > maxBytes) return budgetFailure(
+    compiled,
+    location,
+    root.unit.id,
+    `complete graph requires ${graphBytes} UTF-8 bytes but max-bytes is ${maxBytes}`,
+    root.idMap,
+  );
+  return {
+    ok: true,
+    diagnostics: [],
+    fileCount: compiled.fileCount,
+    unitCount: graph.nodes.length,
+    graphBytes,
+    graph,
+    partial: false,
+  };
+}
+
+async function admittedGraph(inputPath, ids, relations) {
+  const compiled = await compileAuthorityPath(inputPath);
+  if (!compiled.ok) return { result: failedResult(compiled) };
+  const location = await inputLocation(inputPath);
+  const snapshot = buildAuthorityGraphSnapshot(compiled, location.basePath, relations);
+  for (const [role, id] of ids) {
+    if (!snapshot.byId.has(id)) return { result: failedResult(compiled, [diagnostic(
+      location,
+      "AUTH_QUERY_NOT_FOUND",
+      id,
+      `${role} authority identity does not resolve`,
+      "use an exact admitted authority ID; do not infer a near match",
+    )]) };
+  }
+  return { compiled, location, snapshot };
+}
+
+export async function refsAuthorityPath(inputPath, id, { direction, relations, maxUnits, maxEdges, maxBytes }) {
+  const admitted = await admittedGraph(inputPath, [["reference root", id]], relations);
+  if (admitted.result) return admitted.result;
+  const { compiled, location, snapshot } = admitted;
+  const root = snapshot.byId.get(id);
+  const selected = new Map();
+  for (const value of adjacent(snapshot, id, direction)) selected.set(edgeKey(value.edge), value.edge);
+  const edges = [...selected.values()];
+  const nodeIds = new Set([id]);
+  for (const edge of edges) { nodeIds.add(edge.source); nodeIds.add(edge.target); }
+  const nodes = [...nodeIds].map((nodeId) => snapshot.byId.get(nodeId).node);
+  const traversal = { units: nodes.length, edges: edges.length };
+  const budgets = { maxUnits, maxEdges, maxBytes };
+  const graph = graphBase("refs", { id, direction, relations }, nodes, edges, {
+    edgeRepresentation: "canonical_authored_source_to_target",
+    selection: "direct_only",
+    duplicateEdges: "suppressed",
+    ordering: { nodes: "id", edges: ["source", "type", "target"] },
+  }, {
+    returned: { units: nodes.length, edges: edges.length },
+    traversal,
+  }, budgets);
+  return finish(compiled, graph, location, root, traversal);
+}
+
+function pathAdjacency(snapshot, id, traversal) {
+  return adjacent(snapshot, id, traversal === "directed" ? "outgoing" : "both");
+}
+
+export async function pathAuthorityPath(inputPath, fromId, toId, { traversal: traversalMode, relations, maxHops, maxUnits, maxEdges, maxBytes }) {
+  const admitted = await admittedGraph(inputPath, [["path source", fromId], ["path target", toId]], relations);
+  if (admitted.result) return admitted.result;
+  const { compiled, location, snapshot } = admitted;
+  const root = snapshot.byId.get(fromId);
+  const visitedDepth = new Map([[fromId, 0]]);
+  const proofEdges = new Set();
+  let layer = new Map([[fromId, []]]);
+  let witness = fromId === toId ? [] : null;
+  let exhausted = false;
+
+  for (let depth = 0; witness === null && depth < maxHops && layer.size > 0; depth += 1) {
+    const next = new Map();
+    for (const id of [...layer.keys()].sort(compareText)) {
+      const prefix = layer.get(id);
+      for (const value of pathAdjacency(snapshot, id, traversalMode)) {
+        proofEdges.add(edgeKey(value.edge));
+        const priorDepth = visitedDepth.get(value.next);
+        if (priorDepth !== undefined && priorDepth < depth + 1) continue;
+        const candidate = [...prefix, { source: value.edge.source, type: value.edge.type, target: value.edge.target, traversal: value.traversal }];
+        const prior = next.get(value.next);
+        if (!prior || compareStepSequences(candidate, prior) < 0) next.set(value.next, candidate);
+        if (priorDepth === undefined) visitedDepth.set(value.next, depth + 1);
+      }
+    }
+    if (next.has(toId)) witness = next.get(toId);
+    if (next.size === 0) exhausted = true;
+    layer = next;
+  }
+
+  if (witness === null && !exhausted && layer.size > 0) {
+    let unchecked = false;
+    for (const id of [...layer.keys()].sort(compareText)) {
+      for (const value of pathAdjacency(snapshot, id, traversalMode)) {
+        proofEdges.add(edgeKey(value.edge));
+        if (!visitedDepth.has(value.next)) unchecked = true;
+      }
+    }
+    if (unchecked) return budgetFailure(
+      compiled,
+      location,
+      fromId,
+      `complete path result requires traversing beyond max-hops ${maxHops}`,
+      root.idMap,
+    );
+  }
+
+  const found = witness !== null;
+  const pathEdgeKeys = new Set((witness ?? []).map((step) => `${step.source}\u0000${step.type}\u0000${step.target}`));
+  const edges = snapshot.edges.filter((edge) => pathEdgeKeys.has(edgeKey(edge)));
+  const pathNodeIds = found
+    ? [fromId, ...(witness ?? []).map((step) => step.traversal === "forward" ? step.target : step.source)]
+    : [fromId, toId];
+  const nodes = [...new Set(pathNodeIds)].map((id) => snapshot.byId.get(id).node);
+  const traversal = { units: new Set([...visitedDepth.keys(), toId]).size, edges: proofEdges.size };
+  const budgets = { maxHops, maxUnits, maxEdges, maxBytes };
+  const graph = graphBase("path", { fromId, toId, traversal: traversalMode, relations }, nodes, edges, {
+    edgeRepresentation: "canonical_authored_source_to_target",
+    traversal: traversalMode === "directed" ? "authored_forward_only" : "incidence_forward_or_reverse",
+    reverseStepClaim: "topology_incidence_only_not_semantic_dependency",
+    selection: "shortest_hops_then_lexical_minimum_complete_step_tuple_sequence",
+    stepTuple: ["type", "traversal", "authored_source", "authored_target"],
+    ordering: { nodes: "id", edges: ["source", "type", "target"] },
+  }, {
+    returned: { units: nodes.length, edges: edges.length, hops: witness?.length ?? 0 },
+    traversal,
+  }, budgets, { found, steps: witness ?? [] });
+  return finish(compiled, graph, location, root, traversal);
+}
+
+export async function subgraphAuthorityPath(inputPath, id, { direction, relations, depth, maxUnits, maxEdges, maxBytes }) {
+  const admitted = await admittedGraph(inputPath, [["subgraph root", id]], relations);
+  if (admitted.result) return admitted.result;
+  const { compiled, location, snapshot } = admitted;
+  const root = snapshot.byId.get(id);
+  const distances = new Map([[id, 0]]);
+  const proofEdges = new Set();
+  let layer = [id];
+  for (let currentDepth = 0; currentDepth < depth && layer.length > 0; currentDepth += 1) {
+    const next = new Set();
+    for (const current of [...layer].sort(compareText)) {
+      for (const value of adjacent(snapshot, current, direction)) {
+        proofEdges.add(edgeKey(value.edge));
+        if (!distances.has(value.next)) {
+          distances.set(value.next, currentDepth + 1);
+          next.add(value.next);
+        }
+      }
+    }
+    layer = [...next].sort(compareText);
+  }
+  const nodeIds = new Set(distances.keys());
+  const edges = snapshot.edges.filter((edge) => nodeIds.has(edge.source) && nodeIds.has(edge.target));
+  for (const edge of edges) proofEdges.add(edgeKey(edge));
+  const nodes = [...nodeIds].map((nodeId) => snapshot.byId.get(nodeId).node);
+  const traversal = { units: nodes.length, edges: proofEdges.size };
+  const budgets = { depth, maxUnits, maxEdges, maxBytes };
+  const graph = graphBase("subgraph", { id, direction, relations, depth }, nodes, edges, {
+    edgeRepresentation: "canonical_authored_source_to_target",
+    traversal: "deterministic_breadth_first",
+    selection: "complete_selected_graph_within_depth",
+    duplicateNodesAndEdges: "suppressed",
+    cycleSafe: true,
+    ordering: { nodes: "id", edges: ["source", "type", "target"] },
+  }, {
+    returned: { units: nodes.length, edges: edges.length },
+    traversal,
+  }, budgets);
+  return finish(compiled, graph, location, root, traversal);
+}

package/cli/lib/authority/impact.mjs

@@ -0,0 +1,252 @@
+import { Buffer } from "node:buffer";
+import { lstat, readFile, stat } from "node:fs/promises";
+import path from "node:path";
+import YAML from "yaml";
+
+import { compareText, makeDiagnostic, portablePath, sortDiagnostics } from "./diagnostics.mjs";
+import { diffAuthorityPaths } from "./diff.mjs";
+
+const contractUrl = new URL("../../../contracts/authority-impact-dispositions.schema.yaml", import.meta.url);
+const IMPACT_FORMAT = "nimicoding.authority-impact/v1";
+const IMPACT_RELATIONS = new Set(["applies_to", "supersedes"]);
+
+async function rootFor(inputPath) {
+  const absolute = path.resolve(inputPath);
+  const info = await stat(absolute);
+  return info.isDirectory() ? absolute : path.dirname(absolute);
+}
+
+function impactBudgetDiagnostic(requiredBytes, maxBytes) {
+  return makeDiagnostic({
+    code: "AUTH_IMPACT_BUDGET",
+    file: ".",
+    range: { start: { line: 1, column: 1 }, end: { line: 1, column: 1 } },
+    pointer: "",
+    reason: `complete semantic impact payload requires ${requiredBytes} UTF-8 bytes but max-bytes is ${maxBytes}`,
+    repair: "increase the explicit byte budget; partial diff or impact output is forbidden",
+  });
+}
+
+export function canonicalImpactBytes(diff, impact) {
+  return Buffer.byteLength(JSON.stringify({ diff, impact }), "utf8");
+}
+
+function overBudget(diffResult, impact, maxBytes) {
+  const payloadBytes = canonicalImpactBytes(diffResult.diff, impact);
+  if (maxBytes === null || payloadBytes <= maxBytes) return { payloadBytes, failure: null };
+  return {
+    payloadBytes,
+    failure: {
+      ok: false,
+      diagnostics: [impactBudgetDiagnostic(payloadBytes, maxBytes)],
+      fileCount: diffResult.fileCount,
+      unitCount: 0,
+      payloadBytes,
+      diff: null,
+      impact: null,
+    },
+  };
+}
+
+function invalidDisposition(file, reason) {
+  return makeDiagnostic({
+    code: "AUTH_IMPACT_DISPOSITION_INVALID",
+    file: path.basename(file),
+    range: { start: { line: 1, column: 1 }, end: { line: 1, column: 1 } },
+    pointer: "",
+    reason,
+    repair: "declare each exact impacted rule consumer and test disposition with addressed status and explicit evidence",
+  });
+}
+
+function exactObject(value, fields) {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    && Object.keys(value).every((key) => fields.includes(key));
+}
+
+async function loadDispositions(file, label = file) {
+  const absolute = path.resolve(file);
+  let bytes;
+  try {
+    const info = await lstat(absolute);
+    if (info.isSymbolicLink() || !info.isFile()) {
+      return { ok: false, diagnostics: [invalidDisposition(label, "dispositions must be one regular non-symlink YAML file")] };
+    }
+    bytes = await readFile(absolute);
+  } catch (error) {
+    return { ok: false, diagnostics: [invalidDisposition(label, `disposition file is not readable: ${error.message}`)] };
+  }
+  const contractText = await readFile(contractUrl, "utf8");
+  let text;
+  try {
+    text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    return { ok: false, diagnostics: [invalidDisposition(label, "disposition bytes are not valid UTF-8")] };
+  }
+  const document = YAML.parseDocument(text, { uniqueKeys: true, version: "1.2" });
+  if (document.errors.length > 0) return { ok: false, diagnostics: [invalidDisposition(label, document.errors[0].message)] };
+  let data;
+  try {
+    data = document.toJS({ maxAliasCount: 0 });
+  } catch (error) {
+    return { ok: false, diagnostics: [invalidDisposition(label, error.message)] };
+  }
+  const contract = YAML.parse(contractText);
+  if (!exactObject(data, contract.fields.top) || data.format !== contract.format || !Array.isArray(data.rules)) {
+    return { ok: false, diagnostics: [invalidDisposition(label, "dispositions require the exact format and rules list")] };
+  }
+  const entries = new Map();
+  const ruleIds = new Set();
+  const identifier = new RegExp(contract.identifier_pattern);
+  for (const rule of data.rules) {
+    if (!exactObject(rule, contract.fields.rule) || !identifier.test(rule.id) || !Array.isArray(rule.consumers) || !exactObject(rule.test, contract.fields.test)) {
+      return { ok: false, diagnostics: [invalidDisposition(label, "each rule requires exact id, consumers, and test fields")] };
+    }
+    if (ruleIds.has(rule.id)) return { ok: false, diagnostics: [invalidDisposition(label, `duplicate rule disposition: ${rule.id}`)] };
+    ruleIds.add(rule.id);
+    for (const consumer of rule.consumers) {
+      if (!exactObject(consumer, contract.fields.consumer) || !identifier.test(consumer.scope) || consumer.status !== contract.status || typeof consumer.evidence !== "string" || consumer.evidence.trim() !== consumer.evidence || consumer.evidence.length === 0) {
+        return { ok: false, diagnostics: [invalidDisposition(label, `invalid consumer disposition for ${rule.id}`)] };
+      }
+      const key = `${rule.id}\0consumer\0${consumer.scope}`;
+      if (entries.has(key)) return { ok: false, diagnostics: [invalidDisposition(label, `duplicate disposition for ${rule.id} consumer ${consumer.scope}`)] };
+      entries.set(key, { ruleId: rule.id, type: "consumer", target: consumer.scope, status: consumer.status, evidence: consumer.evidence });
+    }
+    if (rule.test.status !== contract.status || typeof rule.test.evidence !== "string" || rule.test.evidence.trim() !== rule.test.evidence || rule.test.evidence.length === 0) {
+      return { ok: false, diagnostics: [invalidDisposition(label, `invalid test disposition for ${rule.id}`)] };
+    }
+    const testKey = `${rule.id}\0test\0${rule.id}`;
+    if (entries.has(testKey)) return { ok: false, diagnostics: [invalidDisposition(label, `duplicate rule disposition: ${rule.id}`)] };
+    entries.set(testKey, { ruleId: rule.id, type: "test", target: rule.id, status: rule.test.status, evidence: rule.test.evidence });
+  }
+  return { ok: true, diagnostics: [], entries };
+}
+
+function allUnits(diffResult) {
+  const units = new Map();
+  for (const compiled of [diffResult.before, diffResult.after]) {
+    for (const unit of compiled.ir.units) units.set(unit.id, unit);
+  }
+  return units;
+}
+
+function incomingGraph(diffResult) {
+  const incoming = new Map();
+  for (const compiled of [diffResult.before, diffResult.after]) {
+    for (const unit of compiled.ir.units) {
+      for (const relation of unit.relations) {
+        if (!IMPACT_RELATIONS.has(relation.type)) continue;
+        const sources = incoming.get(relation.target) ?? new Set();
+        sources.add(unit.id);
+        incoming.set(relation.target, sources);
+      }
+    }
+  }
+  return incoming;
+}
+
+function impactingChanges(diffResult) {
+  return diffResult.diff.changes.filter((change) => !change.pointer.startsWith("/metadata/"));
+}
+
+function impactedIds(diffResult) {
+  const incoming = incomingGraph(diffResult);
+  const selected = new Set();
+  const pending = [...new Set(impactingChanges(diffResult).map((change) => change.unitId))].sort(compareText);
+  while (pending.length > 0) {
+    const id = pending.shift();
+    if (selected.has(id)) continue;
+    selected.add(id);
+    for (const dependent of [...(incoming.get(id) ?? [])].sort(compareText)) if (!selected.has(dependent)) pending.push(dependent);
+  }
+  return [...selected].sort(compareText);
+}
+
+function requiredObligations(diffResult, impacted) {
+  const before = new Map(diffResult.before.ir.units.map((unit) => [unit.id, unit]));
+  const after = new Map(diffResult.after.ir.units.map((unit) => [unit.id, unit]));
+  const obligations = [];
+  for (const id of impacted) {
+    const candidates = [before.get(id), after.get(id)].filter(Boolean);
+    if (!candidates.some((unit) => unit.kind === "rule" && unit.lifecycle === "active")) continue;
+    const scopes = new Set(candidates.flatMap((unit) => unit.semantic?.scope ?? []));
+    for (const scope of [...scopes].sort(compareText)) obligations.push({ ruleId: id, type: "consumer", target: scope });
+    obligations.push({ ruleId: id, type: "test", target: id });
+  }
+  return obligations;
+}
+
+async function unitLocation(diffResult, id) {
+  for (const [compiled, inputPath] of [[diffResult.after, diffResult.afterPath], [diffResult.before, diffResult.beforePath]]) {
+    const index = compiled.ir.units.findIndex((unit) => unit.id === id);
+    if (index < 0) continue;
+    const mapped = compiled.sourceMap.fields[`/units/${index}/id`];
+    return { ...mapped, file: portablePath(mapped.file, await rootFor(inputPath)) };
+  }
+  return { file: ".", range: { start: { line: 1, column: 1 }, end: { line: 1, column: 1 } }, sourcePointer: "/id" };
+}
+
+export async function impactAuthorityPaths(beforePath, afterPath, dispositionsPath, { maxBytes = null, dispositionLabel = null } = {}) {
+  const diffResult = await diffAuthorityPaths(beforePath, afterPath);
+  if (!diffResult.ok) return { ...diffResult, impact: null };
+  diffResult.beforePath = beforePath;
+  diffResult.afterPath = afterPath;
+  const parsed = await loadDispositions(dispositionsPath, dispositionLabel ?? dispositionsPath);
+  if (!parsed.ok) {
+    const budget = overBudget(diffResult, null, maxBytes);
+    if (budget.failure) return budget.failure;
+    return {
+      ok: false,
+      diagnostics: parsed.diagnostics,
+      fileCount: diffResult.fileCount,
+      unitCount: 0,
+      payloadBytes: budget.payloadBytes,
+      diff: diffResult.diff,
+      impact: null,
+    };
+  }
+  const impacted = impactedIds(diffResult);
+  const units = allUnits(diffResult);
+  const required = requiredObligations(diffResult, impacted);
+  const requiredKeys = new Set(required.map((item) => `${item.ruleId}\0${item.type}\0${item.target}`));
+  const diagnostics = [];
+  for (const obligation of required) {
+    const key = `${obligation.ruleId}\0${obligation.type}\0${obligation.target}`;
+    if (parsed.entries.has(key)) continue;
+    const mapped = await unitLocation(diffResult, obligation.ruleId);
+    diagnostics.push(makeDiagnostic({
+      code: "AUTH_IMPACT_UNDISPOSED",
+      file: mapped.file,
+      range: mapped.range,
+      pointer: mapped.sourcePointer,
+      reason: `${obligation.type} obligation is not disposed for ${obligation.ruleId}: ${obligation.target}`,
+      repair: "add an addressed disposition with explicit evidence; do not infer completion",
+    }));
+  }
+  for (const [key, disposition] of parsed.entries) {
+    if (requiredKeys.has(key)) continue;
+    diagnostics.push(invalidDisposition(dispositionLabel ?? dispositionsPath, `disposition does not match a required impact obligation: ${disposition.ruleId} ${disposition.type} ${disposition.target}`));
+  }
+  const disposed = required.map((obligation) => ({
+    ...obligation,
+    disposition: parsed.entries.get(`${obligation.ruleId}\0${obligation.type}\0${obligation.target}`) ?? null,
+  }));
+  const impact = {
+    format: IMPACT_FORMAT,
+    changedUnits: [...new Set(impactingChanges(diffResult).map((change) => change.unitId))].sort(compareText),
+    impactedUnits: impacted.map((id) => ({ id, kind: units.get(id)?.kind ?? null })),
+    obligations: disposed,
+    complete: diagnostics.length === 0,
+  };
+  const budget = overBudget(diffResult, impact, maxBytes);
+  if (budget.failure) return budget.failure;
+  return {
+    ok: diagnostics.length === 0,
+    diagnostics: sortDiagnostics(diagnostics),
+    fileCount: diffResult.fileCount,
+    unitCount: impacted.length,
+    payloadBytes: budget.payloadBytes,
+    diff: diffResult.diff,
+    impact,
+  };
+}

package/cli/lib/authority/lexicon.mjs

@@ -0,0 +1,55 @@
+// Shared lexical constants for the report products that read authority text.
+//
+// These lived as per-product copies until an audit found the copies had
+// drifted apart: the embedded-path extractor built segments from one
+// character set but tested the left boundary against a narrower one, and
+// closed-sets scanned two of the four normative fields that anchors scanned.
+// Both products now derive from this module so a change lands once.
+
+// A path segment as the embedded-path (class C) grammar admits it. Anything
+// in this set appearing immediately before a match means the match started
+// mid-segment and is not a path of its own.
+export const SEGMENT_CHARACTERS = "A-Za-z0-9_.-";
+export const SEGMENT_PATTERN = `[${SEGMENT_CHARACTERS}]+`;
+const SEGMENT_CHARACTER = new RegExp(`[${SEGMENT_CHARACTERS}]`, "u");
+const PATH_SEPARATOR = new RegExp("[/\\\\]", "u");
+
+// True when the match starting at `index` is not a path of its own, because
+// what precedes it either continues a segment or makes it the tail of a longer
+// path. A leading "./" or "../" is a relative prefix rather than a longer path,
+// so it does not disqualify the match; a leading separator with no relative
+// prefix reads as an absolute path, which the grammar does not admit.
+export function continuesPathToken(text, index) {
+  if (index === 0) return false;
+  const preceding = text[index - 1];
+  if (SEGMENT_CHARACTER.test(preceding)) return true;
+  if (!PATH_SEPARATOR.test(preceding)) return false;
+  let start = index - 1;
+  while (start > 0 && SEGMENT_CHARACTER.test(text[start - 1])) start -= 1;
+  const run = text.slice(start, index - 1);
+  return run !== "." && run !== "..";
+}
+
+// A candidate ending before another segment character or separator is only a
+// prefix of the path token, so accepting it could turn a dead coordinate into
+// an unrelated live one.
+export function continuesPathTokenAfter(text, index) {
+  if (index >= text.length) return false;
+  return SEGMENT_CHARACTER.test(text[index]) || PATH_SEPARATOR.test(text[index]);
+}
+
+export const CODE_EXTENSIONS = [
+  "mjs", "js", "ts", "tsx", "rs", "go", "yaml", "yml", "md", "json", "proto", "ps1",
+];
+
+// The normative text of a unit: what the product actually asserts, excluding
+// metadata such as title and reason. Every product that scans authority prose
+// for machine-checkable content uses exactly this set.
+export const DEFINITION_NORMATIVE_FIELDS = ["meaning"];
+export const RULE_NORMATIVE_FIELDS = ["statement", "condition", "failure"];
+
+export function normativeFields(unitKind) {
+  return unitKind === "definition" ? DEFINITION_NORMATIVE_FIELDS : RULE_NORMATIVE_FIELDS;
+}
+
+export const NORMATIVE_FIELD_HELP = "statement, condition, failure, and meaning";