@onlooker-community/ecosystem 0.34.0 → 0.43.0

package/test/bats/cartographer-resolve.bats

@@ -0,0 +1,287 @@
+#!/usr/bin/env bats
+
+# Covers the resolution loop: a finding whose drift is gone stops rendering.
+#
+# The record has carried resolved:false since the plugin shipped and nothing
+# ever flipped it, so fixing the drift a finding reported did not retire the
+# finding — it rendered forever (ecosystem-nhi).
+#
+# Absence of a finding from a run is the evidence used, which is only sound when
+# the run looked everywhere. The guard tests below are the substance of this
+# file: getting resolution wrong in the permissive direction silently hides live
+# findings, which is worse than the stale ones being retired.
+
+setup() {
+	source "${BATS_TEST_DIRNAME}/../helpers/setup.bash"
+	setup_test_env
+
+	PLUGIN_ROOT="${REPO_ROOT}/plugins/cartographer"
+	export CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT"
+	# shellcheck disable=SC1091
+	source "${PLUGIN_ROOT}/scripts/lib/cartographer-resolve.sh"
+
+	FINDINGS_DIR="${BATS_TEST_TMPDIR}/findings"
+	mkdir -p "$FINDINGS_DIR"
+
+	# A fixed clock. Real timestamps are epoch seconds, and an audit that starts
+	# and finishes inside one second would otherwise make "before the run" and
+	# "during the run" indistinguishable.
+	AUDIT_START=2000
+
+	# Where the injected emitter records what it was asked to announce. The sweep
+	# runs inside a command substitution in production, so a stub that set a
+	# variable would lose it to the subshell — a file survives, which is exactly
+	# why the real emitter appends to the event log rather than returning.
+	ANNOUNCED="${BATS_TEST_TMPDIR}/announced"
+	: > "$ANNOUNCED"
+}
+
+_announce() { printf '%s\n' "$1" >> "$ANNOUNCED"; }
+
+# Deliberately writes to stdout, which would corrupt the count the sweep prints
+# if the call site did not redirect it.
+_noisy_announce() { printf '%s\n' "$1" >> "$ANNOUNCED"; printf 'NOISE'; }
+
+_announced() { cat "$ANNOUNCED" 2>/dev/null; }
+
+# Seed a finding record in the shape run_emit writes.
+_seed() {
+	local hash="$1" last_seen="$2" resolved="${3:-false}"
+	jq -n --arg h "$hash" --argjson ls "$last_seen" --argjson r "$resolved" \
+		'{finding_hash: $h, type: "undocumented_entity", severity: "warning",
+		  file_a: "CLAUDE.md", file_b: null, description: "d", suggested_fix: "f",
+		  first_seen_at: 1000, last_seen_at: $ls, resolved: $r}' \
+		> "${FINDINGS_DIR}/${hash}.json"
+}
+
+_field() {
+	jq -r ".$2" "${FINDINGS_DIR}/$1.json"
+}
+
+@test "a finding not observed this run is resolved" {
+	_seed stale 1500
+	run cartographer_resolve_absent_findings "$FINDINGS_DIR" "$AUDIT_START" "" 0
+	[ "$output" = "1" ] || return 1
+	[ "$(_field stale resolved)" = "true" ]
+}
+
+@test "a finding observed this run is left open" {
+	_seed fresh 2500
+	run cartographer_resolve_absent_findings "$FINDINGS_DIR" "$AUDIT_START" "" 0
+	[ "$output" = "0" ] || return 1
+	[ "$(_field fresh resolved)" = "false" ]
+}
+
+@test "resolution stamps resolved_at" {
+	_seed stale 1500
+	cartographer_resolve_absent_findings "$FINDINGS_DIR" "$AUDIT_START" "" 0 4242 >/dev/null
+	[ "$(_field stale resolved_at)" = "4242" ]
+}
+
+# Strict <: a record last seen exactly at the cutoff is ambiguous, and the safe
+# reading is that it was observed. A stale finding is visible and correctable;
+# one wrongly retired is silent.
+@test "a finding last seen exactly at the cutoff is left open" {
+	_seed boundary "$AUDIT_START"
+	run cartographer_resolve_absent_findings "$FINDINGS_DIR" "$AUDIT_START" "" 0
+	[ "$output" = "0" ] || return 1
+	[ "$(_field boundary resolved)" = "false" ]
+}
+
+@test "an already-resolved finding is not counted again" {
+	_seed old 1500 true
+	run cartographer_resolve_absent_findings "$FINDINGS_DIR" "$AUDIT_START" "" 0
+	[ "$output" = "0" ]
+}
+
+@test "resolves only the absent findings in a mixed store" {
+	_seed gone 1500
+	_seed here 2500
+	run cartographer_resolve_absent_findings "$FINDINGS_DIR" "$AUDIT_START" "" 0
+	[ "$output" = "1" ] || return 1
+	[ "$(_field gone resolved)" = "true" ] || return 1
+	[ "$(_field here resolved)" = "false" ]
+}
+
+# ── The guards ────────────────────────────────────────────────────────────────
+
+# A targeted post-write audit evaluates one file, so nearly every stored finding
+# is absent for reasons unrelated to being fixed. Without this it would wipe the
+# store on every edit.
+@test "a targeted audit resolves nothing" {
+	_seed stale 1500
+	run cartographer_resolve_absent_findings \
+		"$FINDINGS_DIR" "$AUDIT_START" "/repo/CLAUDE.md" 0
+	[ "$output" = "0" ] || return 1
+	[ "$(_field stale resolved)" = "false" ]
+}
+
+# A phase that timed out contributes no findings, which looks identical to its
+# findings being gone. A partial run is not evidence of resolution.
+@test "a run with a failed phase resolves nothing" {
+	_seed stale 1500
+	run cartographer_resolve_absent_findings "$FINDINGS_DIR" "$AUDIT_START" "" 1
+	[ "$output" = "0" ] || return 1
+	[ "$(_field stale resolved)" = "false" ]
+}
+
+@test "both guards together still resolve nothing" {
+	_seed stale 1500
+	run cartographer_resolve_absent_findings \
+		"$FINDINGS_DIR" "$AUDIT_START" "/repo/CLAUDE.md" 2
+	[ "$output" = "0" ]
+}
+
+# ── Reopening ─────────────────────────────────────────────────────────────────
+
+# The dedup sentinel outlives resolution, so reintroduced drift comes back as a
+# KNOWN finding, not a new one. If refreshing did not clear resolved, the
+# renderer would keep hiding it — live drift, permanently invisible.
+@test "re-observing a resolved finding reopens it" {
+	_seed recurring 1500 true
+	cartographer_refresh_finding "${FINDINGS_DIR}/recurring.json" 3000
+	[ "$(_field recurring resolved)" = "false" ] || return 1
+	[ "$(_field recurring last_seen_at)" = "3000" ]
+}
+
+@test "reopening clears the resolved_at stamp" {
+	_seed recurring 1500
+	cartographer_resolve_absent_findings "$FINDINGS_DIR" "$AUDIT_START" "" 0 4242 >/dev/null
+	[ "$(_field recurring resolved_at)" = "4242" ] || return 1
+	cartographer_refresh_finding "${FINDINGS_DIR}/recurring.json" 5000
+	[ "$(_field recurring resolved_at)" = "null" ]
+}
+
+@test "a reopened finding is resolvable again once the drift goes" {
+	_seed recurring 1500 true
+	cartographer_refresh_finding "${FINDINGS_DIR}/recurring.json" 3000
+	# A later audit that starts after 3000 and does not observe it.
+	run cartographer_resolve_absent_findings "$FINDINGS_DIR" 4000 "" 0
+	[ "$output" = "1" ] || return 1
+	[ "$(_field recurring resolved)" = "true" ]
+}
+
+@test "refresh keeps first_seen_at, so recurrence does not rewrite history" {
+	_seed recurring 1500 true
+	cartographer_refresh_finding "${FINDINGS_DIR}/recurring.json" 3000
+	[ "$(_field recurring first_seen_at)" = "1000" ]
+}
+
+@test "refresh rejects missing arguments and absent files" {
+	run cartographer_refresh_finding "" 3000
+	[ "$status" -ne 0 ] || return 1
+	run cartographer_refresh_finding "${FINDINGS_DIR}/nope.json" 3000
+	[ "$status" -ne 0 ]
+}
+
+# ── Edges ─────────────────────────────────────────────────────────────────────
+
+@test "an empty store resolves nothing" {
+	run cartographer_resolve_absent_findings "$FINDINGS_DIR" "$AUDIT_START" "" 0
+	[ "$output" = "0" ]
+}
+
+@test "a missing findings dir is not an error" {
+	run cartographer_resolve_absent_findings \
+		"${BATS_TEST_TMPDIR}/nope" "$AUDIT_START" "" 0
+	[ "$status" -eq 0 ] || return 1
+	[ "$output" = "0" ]
+}
+
+@test "a record with no last_seen_at is treated as unobserved" {
+	jq -n '{finding_hash: "bare", resolved: false}' > "${FINDINGS_DIR}/bare.json"
+	run cartographer_resolve_absent_findings "$FINDINGS_DIR" "$AUDIT_START" "" 0
+	[ "$output" = "1" ]
+}
+
+@test "unparsable json is skipped rather than fatal" {
+	printf 'not json at all' > "${FINDINGS_DIR}/broken.json"
+	_seed stale 1500
+	run cartographer_resolve_absent_findings "$FINDINGS_DIR" "$AUDIT_START" "" 0
+	[ "$status" -eq 0 ] || return 1
+	[ "$output" = "1" ]
+}
+
+@test "missing required arguments are rejected" {
+	run cartographer_resolve_absent_findings "" "$AUDIT_START" "" 0
+	[ "$status" -ne 0 ] || return 1
+	run cartographer_resolve_absent_findings "$FINDINGS_DIR" "" "" 0
+	[ "$status" -ne 0 ]
+}
+
+@test "the record keeps its other fields when resolved" {
+	_seed stale 1500
+	cartographer_resolve_absent_findings "$FINDINGS_DIR" "$AUDIT_START" "" 0 >/dev/null
+	jq -e '.finding_hash == "stale" and .type == "undocumented_entity"
+	       and .first_seen_at == 1000 and .description == "d"' \
+		"${FINDINGS_DIR}/stale.json" >/dev/null
+}
+
+
+# ── Resolution reaching the bus (ecosystem-w2i) ──────────────────────────────
+
+# The guards are the substance here. A targeted or partial run sees too little
+# to treat absence as evidence, so it must announce nothing at all — announcing
+# a resolution the run did not establish tells every consumer to close a finding
+# that is still live.
+@test "the sound-resolution predicate holds only for a full, complete run" {
+	cartographer_resolution_is_sound "" 0 || return 1
+	! cartographer_resolution_is_sound "CLAUDE.md" 0 || return 1
+	! cartographer_resolution_is_sound "" 1 || return 1
+	! cartographer_resolution_is_sound "CLAUDE.md" 2
+}
+
+@test "a retired finding is announced through the injected emitter" {
+	_seed stale 1500
+	cartographer_resolve_absent_findings "$FINDINGS_DIR" "$AUDIT_START" "" 0 "" _announce >/dev/null
+	[ "$(_announced)" = "stale" ]
+}
+
+@test "every retired finding is announced, not just the first" {
+	_seed one 1500
+	_seed two 1600
+	cartographer_resolve_absent_findings "$FINDINGS_DIR" "$AUDIT_START" "" 0 "" _announce >/dev/null
+	[ "$(_announced | sort | tr '\n' ' ')" = "one two " ]
+}
+
+@test "a targeted audit announces nothing" {
+	_seed stale 1500
+	cartographer_resolve_absent_findings "$FINDINGS_DIR" "$AUDIT_START" "CLAUDE.md" 0 "" _announce >/dev/null
+	[ -z "$(_announced)" ]
+}
+
+@test "a partial run announces nothing" {
+	_seed stale 1500
+	cartographer_resolve_absent_findings "$FINDINGS_DIR" "$AUDIT_START" "" 1 "" _announce >/dev/null
+	[ -z "$(_announced)" ]
+}
+
+@test "a finding still observed this run is not announced" {
+	_seed fresh 2500
+	cartographer_resolve_absent_findings "$FINDINGS_DIR" "$AUDIT_START" "" 0 "" _announce >/dev/null
+	[ -z "$(_announced)" ]
+}
+
+# Delivery is at-least-once but re-announcing a finding that was already retired
+# would report a closure that did not happen this run.
+@test "an already-resolved finding is not announced again" {
+	_seed done 1500 true
+	cartographer_resolve_absent_findings "$FINDINGS_DIR" "$AUDIT_START" "" 0 "" _announce >/dev/null
+	[ -z "$(_announced)" ]
+}
+
+@test "the sweep still works with no emitter injected" {
+	_seed stale 1500
+	run cartographer_resolve_absent_findings "$FINDINGS_DIR" "$AUDIT_START" "" 0
+	[ "$output" = "1" ] || return 1
+	[ "$(_field stale resolved)" = "true" ]
+}
+
+# The sweep returns its count on stdout and the caller reads it through a
+# command substitution, so anything the emitter prints lands in that number.
+@test "a chatty emitter cannot corrupt the count" {
+	_seed one 1500
+	_seed two 1600
+	run cartographer_resolve_absent_findings "$FINDINGS_DIR" "$AUDIT_START" "" 0 "" _noisy_announce
+	[ "$output" = "2" ]
+}

package/test/bats/cartographer-run-audit.bats

@@ -0,0 +1,325 @@
+#!/usr/bin/env bats
+
+# End-to-end coverage of the audit orchestrator.
+#
+# Nothing drove run-audit.sh before this file, and that absence is why two
+# separate defects lived in it undetected: a crash on macOS bash 3.2 whenever
+# the exclude list was empty (ecosystem-3xf), and config never being loaded at
+# all, so every top-level setting was silently ignored (ecosystem-88v). Both are
+# invisible to the unit tests, which exercise the libraries the orchestrator
+# calls rather than the orchestrator itself.
+#
+# The audit shells out to `claude` for its three analysis phases. The stub below
+# returns an empty findings array, which is enough: what is under test here is
+# whether the orchestrator resolves and propagates its own configuration, not
+# what a model says about the corpus.
+
+setup() {
+	source "${BATS_TEST_DIRNAME}/../helpers/setup.bash"
+	setup_test_env
+
+	PLUGIN_ROOT="${REPO_ROOT}/plugins/cartographer"
+	export CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT"
+	AUDIT="${PLUGIN_ROOT}/scripts/run-audit.sh"
+
+	FIXTURE_REPO="${BATS_TEST_TMPDIR}/repo"
+	mkdir -p "${FIXTURE_REPO}/sub" "${FIXTURE_REPO}/.claude"
+	# Path-like tokens and a global counterpart so all three LLM analyzers have
+	# something to chew on. Without them stale_ref and scope_collision
+	# short-circuit before calling the model, and the call counts below could
+	# not tell "skipped by the filter" apart from "had nothing to do".
+	printf '# Root\nAlways read scripts/lib/config-loader.sh first.\nNever use src/legacy/gone.ts.\n' \
+		> "${FIXTURE_REPO}/CLAUDE.md"
+	printf '# Sub\nSee plugins/tribunal/README.md for details.\n' > "${FIXTURE_REPO}/sub/CLAUDE.md"
+	mkdir -p "${CLAUDE_HOME}"
+	printf '# Global\nAlways prefer tabs.\n' > "${CLAUDE_HOME}/CLAUDE.md"
+
+	export CARTOGRAPHER_DIR="${BATS_TEST_TMPDIR}/cartographer"
+	mkdir -p "$CARTOGRAPHER_DIR"
+	AUDIT_LOG="${CARTOGRAPHER_DIR}/audit.log"
+
+	# The stub records each invocation so tests can assert on how many model calls
+	# an audit actually made — the only honest evidence that a filter skipped an
+	# analyzer rather than merely discarding its output.
+	export CLAUDE_CALL_LOG="${BATS_TEST_TMPDIR}/claude-calls"
+	: > "$CLAUDE_CALL_LOG"
+
+	STUB_BIN="${BATS_TEST_TMPDIR}/bin"
+	mkdir -p "$STUB_BIN"
+	cat > "${STUB_BIN}/claude" <<'STUB'
+#!/usr/bin/env bash
+cat >/dev/null
+echo call >> "$CLAUDE_CALL_LOG"
+printf '[]'
+STUB
+	chmod +x "${STUB_BIN}/claude"
+	export PATH="${STUB_BIN}:${PATH}"
+}
+
+EVENTS_LOG_PATH() { printf '%s' "${ONLOOKER_DIR}/logs/onlooker-events.jsonl"; }
+
+# Seed a finding from an earlier run. last_seen_at sits far in the past, so the
+# current audit — whose stub returns no findings — will not observe it.
+_seed_stored_finding() {
+	local hash="$1" last_seen="${2:-1000}"
+	mkdir -p "${CARTOGRAPHER_DIR}/findings"
+	jq -n --arg h "$hash" --argjson ls "$last_seen" \
+		'{finding_hash:$h, type:"undocumented_entity", severity:"warning",
+		  file_a:"CLAUDE.md", file_b:null, description:"d", suggested_fix:"f",
+		  first_seen_at:500, last_seen_at:$ls, resolved:false}' \
+		> "${CARTOGRAPHER_DIR}/findings/${hash}.json"
+}
+
+_resolved_event_count() {
+	local n
+	n=$(grep -c '"event_type":"cartographer.issue.resolved"' "$(EVENTS_LOG_PATH)" 2>/dev/null) || n=0
+	printf '%s' "$n"
+}
+
+_last_audit_complete() {
+	grep '"event_type":"cartographer.audit.complete"' "$(EVENTS_LOG_PATH)" 2>/dev/null | tail -n 1
+}
+
+_llm_calls() {
+	wc -l < "$CLAUDE_CALL_LOG" | tr -d ' '
+}
+
+_settings() {
+	printf '%s' "$1" > "${FIXTURE_REPO}/.claude/settings.json"
+}
+
+_run_audit() {
+	CARTOGRAPHER_REPO_ROOT="$FIXTURE_REPO" bash "$AUDIT"
+}
+
+@test "a full audit completes and records the run" {
+	run _run_audit
+	[ "$status" -eq 0 ] || return 1
+	grep -q 'completed successfully' "$AUDIT_LOG" || return 1
+	[ -f "${CARTOGRAPHER_DIR}/last_audit_at" ]
+}
+
+# ── Config actually reaches the orchestrator ─────────────────────────────────
+
+# exclude_paths is the setting that stings: run_discover hands it straight to
+# cartographer_collect_files, so ignoring it means the discovery walk always
+# used the shipped defaults no matter what the user configured, quietly breaking
+# the replace-not-merge contract in the plugin's own ADR-004.
+@test "repo exclude_paths narrows the discovery walk" {
+	_settings '{"cartographer": {"exclude_paths": ["sub"]}}'
+	_run_audit
+	grep -q 'phase=discover files=1' "$AUDIT_LOG"
+}
+
+@test "without an exclude override both instruction files are discovered" {
+	_run_audit
+	grep -q 'phase=discover files=2' "$AUDIT_LOG"
+}
+
+# The orchestrator warns when total_timeout_seconds cannot cover three phases.
+# The warning only fires if the CONFIGURED phase timeout was read: at the 60s
+# default the shipped 600s total is comfortably sufficient and nothing is
+# logged, so its presence is proof the accessor saw 999 rather than the default.
+@test "phase_timeout_seconds is read from config, not the accessor default" {
+	_settings '{"cartographer": {"phase_timeout_seconds": 999}}'
+	_run_audit
+	grep -q 'total_timeout_seconds=600 is less than 3× phase_timeout_seconds=999' "$AUDIT_LOG"
+}
+
+@test "no warning at the shipped defaults" {
+	_run_audit
+	run grep -c 'is less than 3×' "$AUDIT_LOG"
+	[ "$output" = "0" ]
+}
+
+@test "user-level settings reach the orchestrator too" {
+	mkdir -p "${CLAUDE_HOME}"
+	printf '%s' '{"cartographer": {"exclude_paths": ["sub"]}}' \
+		> "${CLAUDE_HOME}/settings.json"
+	_run_audit
+	grep -q 'phase=discover files=1' "$AUDIT_LOG"
+}
+
+# ── The log stays readable ───────────────────────────────────────────────────
+
+# run-audit.sh never exported PLUGIN_ROOT, so every analysis sub-shell that
+# sourced cartographer-config.sh resolved config-loader.sh against an empty
+# prefix and died, appending three lines of noise per phase to audit.log on
+# every audit. Nobody read it because the analyzers took their settings as
+# parameters and kept working.
+@test "the audit log carries no config-loader errors" {
+	_run_audit
+	run grep -cE 'No such file or directory|command not found' "$AUDIT_LOG"
+	[ "$output" = "0" ]
+}
+
+@test "the audit log carries no unbound variable errors" {
+	_settings '{"cartographer": {"exclude_paths": []}}'
+	_run_audit
+	run grep -c 'unbound variable' "$AUDIT_LOG"
+	[ "$output" = "0" ]
+}
+
+# An empty exclude list is a legitimate configuration, and expanding a genuinely
+# empty array under `set -u` is an unbound-variable error on bash 3.2 — the
+# macOS system bash, and what #!/usr/bin/env bash resolves to there. This is the
+# ecosystem-3xf crash, which Linux CI could never have seen.
+@test "an empty exclude list does not abort the audit" {
+	_settings '{"cartographer": {"exclude_paths": []}}'
+	run _run_audit
+	[ "$status" -eq 0 ] || return 1
+	grep -q 'phase=discover files=2' "$AUDIT_LOG"
+}
+
+# ── Targeted audits ──────────────────────────────────────────────────────────
+
+@test "a targeted audit examines only the named file" {
+	CARTOGRAPHER_TARGET_FILE="${FIXTURE_REPO}/CLAUDE.md" \
+		CARTOGRAPHER_REPO_ROOT="$FIXTURE_REPO" bash "$AUDIT"
+	grep -q 'phase=discover files=1' "$AUDIT_LOG"
+}
+
+# last_audit_at gates the session-start interval check. A targeted run covers
+# one file, so advancing it would let a single edit suppress the next full audit.
+@test "a targeted audit does not advance last_audit_at" {
+	CARTOGRAPHER_TARGET_FILE="${FIXTURE_REPO}/CLAUDE.md" \
+		CARTOGRAPHER_REPO_ROOT="$FIXTURE_REPO" bash "$AUDIT"
+	[ ! -f "${CARTOGRAPHER_DIR}/last_audit_at" ]
+}
+
+# ── --type and --scope ───────────────────────────────────────────────────────
+#
+# SKILL.md documented both flags while run-audit.sh read neither, so passing
+# them silently ran a full audit (ecosystem-9og). These assert on the count of
+# model calls, because that is what distinguishes a genuinely skipped analyzer
+# from one that ran and had its findings thrown away.
+
+@test "an unfiltered audit calls the model once per LLM analyzer" {
+	_run_audit
+	[ "$(_llm_calls)" = "3" ]
+}
+
+@test "a type filter skips the analyzers that cannot produce it" {
+	CARTOGRAPHER_TYPE_FILTER=stale_ref _run_audit
+	[ "$(_llm_calls)" = "1" ]
+}
+
+# undocumented_entity is a grep, not a model call, so narrowing to it should
+# cost nothing at all.
+@test "narrowing to undocumented_entity makes no model calls" {
+	CARTOGRAPHER_TYPE_FILTER=undocumented_entity _run_audit
+	[ "$(_llm_calls)" = "0" ]
+}
+
+# contradiction and dead_rule share one pass, so dead_rule must still run it —
+# skipping would silently return nothing for a legitimate request.
+@test "dead_rule still runs the contradiction analyzer" {
+	CARTOGRAPHER_TYPE_FILTER=dead_rule _run_audit
+	[ "$(_llm_calls)" = "1" ] || return 1
+	grep -q 'phase=relate starting' "$AUDIT_LOG" || return 1
+	run grep -c 'phase=relate skipped by type filter' "$AUDIT_LOG"
+	[ "$output" = "0" ]
+}
+
+@test "a type filter the relate phase cannot serve says so in the log" {
+	CARTOGRAPHER_TYPE_FILTER=scope_collision _run_audit
+	grep -q 'phase=relate skipped by type filter' "$AUDIT_LOG"
+}
+
+# A typo must not read as a clean repo.
+@test "an unknown type aborts instead of auditing nothing" {
+	run env CARTOGRAPHER_TYPE_FILTER=stale_refs CARTOGRAPHER_REPO_ROOT="$FIXTURE_REPO" bash "$AUDIT"
+	[ "$status" -ne 0 ] || return 1
+	grep -q "unknown type filter 'stale_refs'" "$AUDIT_LOG" || return 1
+	[ "$(_llm_calls)" = "0" ]
+}
+
+@test "the active filters are recorded in the log" {
+	CARTOGRAPHER_TYPE_FILTER=stale_ref CARTOGRAPHER_SCOPE_PATH=sub _run_audit
+	grep -q 'filter type=stale_ref' "$AUDIT_LOG" || return 1
+	grep -q 'filter scope=sub' "$AUDIT_LOG"
+}
+
+@test "a scope narrows the corpus without skipping analyzers" {
+	CARTOGRAPHER_SCOPE_PATH=sub _run_audit
+	grep -q 'phase=discover files=1' "$AUDIT_LOG" || return 1
+	[ "$(_llm_calls)" = "3" ]
+}
+
+@test "an absolute scope narrows the same way" {
+	CARTOGRAPHER_SCOPE_PATH="${FIXTURE_REPO}/sub" _run_audit
+	grep -q 'phase=discover files=1' "$AUDIT_LOG"
+}
+
+@test "the two filters compose" {
+	CARTOGRAPHER_TYPE_FILTER=stale_ref CARTOGRAPHER_SCOPE_PATH=sub _run_audit
+	grep -q 'phase=discover files=1' "$AUDIT_LOG" || return 1
+	[ "$(_llm_calls)" = "1" ]
+}
+
+@test "a scope matching nothing still completes cleanly" {
+	CARTOGRAPHER_SCOPE_PATH=does/not/exist run _run_audit
+	grep -q 'phase=discover files=0' "$AUDIT_LOG"
+}
+
+@test "the run record captures the trigger" {
+	CARTOGRAPHER_TRIGGER="session_start_first_run" _run_audit
+	run bash -c "cat '${CARTOGRAPHER_DIR}/runs/'*.json | jq -r '.trigger'"
+	[ "$output" = "session_start_first_run" ]
+}
+
+# A typeless finding must not vanish. The builder refuses it (ecosystem-ci0),
+# but refusing is only half the fix: if the orchestrator discards that refusal
+# the event is still silently absent, one layer further up. The audit log is
+# where an operator would go looking for it.
+@test "a finding with no type is reported in the audit log" {
+	cat > "${STUB_BIN}/claude" <<'STUB'
+#!/usr/bin/env bash
+cat >/dev/null
+echo call >> "$CLAUDE_CALL_LOG"
+printf '[{"severity":"warning","file_a":"CLAUDE.md","excerpt_a":"Always prefer tabs.","description":"typeless"}]'
+STUB
+	chmod +x "${STUB_BIN}/claude"
+
+	run _run_audit
+	[ "$status" -eq 0 ] || return 1
+	grep -q 'carries no type' "$AUDIT_LOG"
+}
+
+
+# ── Resolution reaching the bus (ecosystem-w2i) ──────────────────────────────
+#
+# The resolution loop retired findings on disk but nothing announced it, so a
+# consumer reading only the log — counsel, by design — saw every finding ever
+# opened and none ever closed.
+
+@test "a full audit announces the findings it retired" {
+	_seed_stored_finding gonehash
+	_run_audit
+	grep '"event_type":"cartographer.issue.resolved"' "$(EVENTS_LOG_PATH)" \
+		| jq -e '.payload.finding_hash == "gonehash"' >/dev/null
+}
+
+@test "a completed full audit reports how many findings it retired" {
+	_seed_stored_finding gonehash
+	_run_audit
+	_last_audit_complete | jq -e '.payload.resolved_finding_count == 1' >/dev/null
+}
+
+# A targeted run sees one file, so nearly every stored finding is "unobserved"
+# for reasons unrelated to being fixed. It must neither retire nor announce.
+@test "a targeted audit announces no resolutions" {
+	_seed_stored_finding gonehash
+	CARTOGRAPHER_TARGET_FILE="${FIXTURE_REPO}/CLAUDE.md" \
+		CARTOGRAPHER_REPO_ROOT="$FIXTURE_REPO" bash "$AUDIT"
+	[ "$(_resolved_event_count)" = "0" ]
+}
+
+# Reporting zero would read as "swept, retired nothing". The field is absent
+# instead, because this run never swept.
+@test "a targeted audit reports no resolved count at all" {
+	_seed_stored_finding gonehash
+	CARTOGRAPHER_TARGET_FILE="${FIXTURE_REPO}/CLAUDE.md" \
+		CARTOGRAPHER_REPO_ROOT="$FIXTURE_REPO" bash "$AUDIT"
+	_last_audit_complete | jq -e '.payload | has("resolved_finding_count") | not' >/dev/null
+}

package/test/bats/compass-sanitizer.bats

@@ -24,27 +24,27 @@ setup() {
 @test "prior_assistant_turn delimiter is stripped" {
 	local out
 	out=$(compass_sanitize "evil <prior_assistant_turn> payload" 240)
-	[[ "$out" == *"[STRIPPED]"* ]]
-	[[ "$out" == *"payload"* ]]
+	[[ "$out" == *"[STRIPPED]"* ]] || return 1
+	[[ "$out" == *"payload"* ]] || return 1
 	[[ "$out" != *"<prior_assistant_turn>"* ]]
 }
 
 @test "all four pair-slot delimiters are stripped" {
 	local out
 	out=$(compass_sanitize "<context_excerpt>x</context_excerpt><tool_input>y</tool_input>" 240)
-	[[ "$out" != *"<context_excerpt>"* ]]
-	[[ "$out" != *"</context_excerpt>"* ]]
-	[[ "$out" != *"<tool_input>"* ]]
+	[[ "$out" != *"<context_excerpt>"* ]] || return 1
+	[[ "$out" != *"</context_excerpt>"* ]] || return 1
+	[[ "$out" != *"<tool_input>"* ]] || return 1
 	[[ "$out" != *"</tool_input>"* ]]
 }
 
 @test "non-evaluator delimiters are also stripped" {
 	local out
 	out=$(compass_sanitize "<<SYS>>x<</SYS>> [INST] y [/INST] <| z" 240)
-	[[ "$out" != *"<<SYS>>"* ]]
-	[[ "$out" != *"<</SYS>>"* ]]
-	[[ "$out" != *"[INST]"* ]]
-	[[ "$out" != *"[/INST]"* ]]
+	[[ "$out" != *"<<SYS>>"* ]] || return 1
+	[[ "$out" != *"<</SYS>>"* ]] || return 1
+	[[ "$out" != *"[INST]"* ]] || return 1
+	[[ "$out" != *"[/INST]"* ]] || return 1
 	[[ "$out" != *"<|"* ]]
 }
 
@@ -53,8 +53,8 @@ setup() {
 	input=$(printf 'a\tb\nc\x00d\x01e')
 	local out
 	out=$(compass_sanitize "$input" 240)
-	[[ "$out" == *"a"* && "$out" == *"b"* && "$out" == *"c"* ]]
-	[[ "$out" == *"d"* && "$out" == *"e"* ]]
+	[[ "$out" == *"a"* && "$out" == *"b"* && "$out" == *"c"* ]] || return 1
+	[[ "$out" == *"d"* && "$out" == *"e"* ]] || return 1
 	[ "${out}" = "$(printf 'a\tb\ncde')" ]
 }
 

package/test/bats/compass-transcript.bats

@@ -60,8 +60,8 @@ setup() {
 	EOF
 	local out
 	out=$(compass_read_prior_turn "$t" 800)
-	[[ "$out" == *"[STRIPPED]"* ]]
-	[[ "$out" != *"<prior_assistant_turn>"* ]]
+	[[ "$out" == *"[STRIPPED]"* ]] || return 1
+	[[ "$out" != *"<prior_assistant_turn>"* ]] || return 1
 
 	# Truncation honors max_chars.
 	local short