@onlooker-community/ecosystem 0.43.6 → 0.43.7

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ecosystem",
-  "version": "0.43.6",
+  "version": "0.43.7",
   "description": "Observability substrate for Claude Code. Provides the shared $ONLOOKER_DIR storage root (default $HOME/.onlooker), canonical schema-validated event emission, session and tool tracking hooks, and prompt rules. Required by all other Onlooker plugins.",
   "author": {
     "name": "Onlooker Community",

package/.release-please-manifest.json

@@ -1,9 +1,9 @@
 {
-  ".": "0.43.6",
+  ".": "0.43.7",
   "plugins/archivist": "0.3.2",
   "plugins/tribunal": "1.2.8",
   "plugins/echo": "0.3.2",
-  "plugins/cartographer": "0.6.1",
+  "plugins/cartographer": "0.6.2",
   "plugins/governor": "0.3.3",
   "plugins/compass": "0.4.2",
   "plugins/scribe": "0.4.3",

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.43.7](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.43.6...ecosystem-v0.43.7) (2026-08-23)
+
+
+### Bug Fixes
+
+* **cartographer:** drop a typeless finding instead of hashing it as "unknown" :broom: ([#203](https://github.com/onlooker-community/ecosystem/issues/203)) ([a949d5d](https://github.com/onlooker-community/ecosystem/commit/a949d5d43f3ae3515ac6278b35d1be5cc468cb0e))
+
 ## [0.43.6](https://github.com/onlooker-community/ecosystem/compare/ecosystem-v0.43.5...ecosystem-v0.43.6) (2026-08-22)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onlooker-community/ecosystem",
-  "version": "0.43.6",
+  "version": "0.43.7",
   "description": "Agents, skills, hooks, commands, rules, and MCP configurations that power [Onlooker](https://onlooker.dev)",
   "author": {
     "name": "Onlooker Community",

package/plugins/cartographer/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cartographer",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "Proactive periodic auditor of the persistent instruction layer (CLAUDE.md, AGENTS.md, .claude/rules/). Discovers all instruction files in the repo, extracts semantic maps, and surfaces contradictions, shadowing, gaps, and drift before they cause expensive agent misbehavior. Builds on the Onlooker ecosystem plugin.",
   "author": {
     "name": "Onlooker Community",

package/plugins/cartographer/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to the Cartographer plugin are documented here.
 
+## [0.6.2](https://github.com/onlooker-community/ecosystem/compare/cartographer-v0.6.1...cartographer-v0.6.2) (2026-08-23)
+
+
+### Bug Fixes
+
+* **cartographer:** drop a typeless finding instead of hashing it as "unknown" :broom: ([#203](https://github.com/onlooker-community/ecosystem/issues/203)) ([a949d5d](https://github.com/onlooker-community/ecosystem/commit/a949d5d43f3ae3515ac6278b35d1be5cc468cb0e))
+
 ## [0.6.1](https://github.com/onlooker-community/ecosystem/compare/cartographer-v0.6.0...cartographer-v0.6.1) (2026-08-22)
 
 

package/plugins/cartographer/scripts/run-audit.sh

@@ -247,7 +247,29 @@ run_synthesize() {
 	while IFS= read -r finding; do
 		[[ -z "$finding" ]] && continue
 		local ftype ffile_a fexcerpt_a ffile_b fexcerpt_b
-		ftype=$(printf '%s' "$finding" | jq -r '.type // "unknown"')
+		# `// ""` collapses absent, null and empty into one check, the same way
+		# cartographer_issue_found_payload does — jq's `//` treats "" as
+		# present, so an empty type would otherwise slip past.
+		ftype=$(printf '%s' "$finding" | jq -r '.type // ""')
+
+		# A finding with no type is malformed: every analyzer writes a literal
+		# type, so this means the phase that produced it has a bug. Drop it here
+		# rather than hashing it.
+		#
+		# This used to default to "unknown". The emit path already refused to
+		# announce such a finding (ecosystem-ci0), but the orchestrator stored
+		# it anyway under a hash derived from a type it does not have, and then
+		# touched its dedup sentinel. That sentinel made the silence permanent:
+		# every later audit saw "known", took the refresh path, and emitted
+		# nothing — so the finding sat on disk forever, counted in
+		# new_finding_count, and could never be announced. Dropping it keeps the
+		# stored corpus honest and leaves the hash of every well-formed finding
+		# untouched, so no existing dedup sentinel is orphaned (ecosystem-0ty).
+		if [[ -z "$ftype" ]]; then
+			log "synthesize: dropped a finding that carries no type — the analyzer that produced it has a bug"
+			continue
+		fi
+
 		ffile_a=$(printf '%s' "$finding" | jq -r '.file_a // ""')
 		fexcerpt_a=$(printf '%s' "$finding" | jq -r '.excerpt_a // ""')
 		ffile_b=$(printf '%s' "$finding" | jq -r '.file_b // ""')

package/test/bats/cartographer-run-audit.bats

@@ -268,10 +268,12 @@ _run_audit() {
 	[ "$output" = "session_start_first_run" ]
 }
 
-# A typeless finding must not vanish. The builder refuses it (ecosystem-ci0),
-# but refusing is only half the fix: if the orchestrator discards that refusal
-# the event is still silently absent, one layer further up. The audit log is
-# where an operator would go looking for it.
+# A typeless finding must not vanish. Since ecosystem-0ty the synthesize phase
+# drops it before it is hashed, so this line now comes from there rather than
+# from the emit-phase builder refusal that ecosystem-ci0 added. Both write
+# "carries no type" on purpose: what matters to an operator is that the audit
+# log says a finding was discarded and why, not which layer discarded it. The
+# builder's own refusal is still covered directly in cartographer-events.bats.
 @test "a finding with no type is reported in the audit log" {
 	cat > "${STUB_BIN}/claude" <<'STUB'
 #!/usr/bin/env bash
@@ -286,6 +288,50 @@ STUB
 	grep -q 'carries no type' "$AUDIT_LOG"
 }
 
+# Refusing to announce a typeless finding was only half of ecosystem-ci0. The
+# orchestrator still stored it under a hash computed from a type it does not
+# have, then touched its dedup sentinel — so on every later audit the sentinel
+# said "known", the refresh path ran, and no bus event ever fired again. The
+# finding sat on disk forever, counted in new_finding_count, and was
+# permanently unannounceable. These three assert it is dropped instead
+# (ecosystem-0ty).
+
+_typeless_stub() {
+	cat > "${STUB_BIN}/claude" <<'STUB'
+#!/usr/bin/env bash
+cat >/dev/null
+echo call >> "$CLAUDE_CALL_LOG"
+printf '[{"severity":"warning","file_a":"CLAUDE.md","excerpt_a":"Always prefer tabs.","description":"typeless"}]'
+STUB
+	chmod +x "${STUB_BIN}/claude"
+}
+
+@test "a finding with no type is never written to findings/" {
+	_typeless_stub
+	run _run_audit
+	[ "$status" -eq 0 ] || return 1
+	[ "$(find "${CARTOGRAPHER_DIR}/findings" -name '*.json' 2>/dev/null | wc -l | tr -d ' ')" = "0" ]
+}
+
+@test "a finding with no type leaves no dedup sentinel" {
+	# The sentinel is what made this permanent: with one on disk, a corrected
+	# finding that later hashes the same way would be seen as already known and
+	# silently refreshed instead of announced.
+	_typeless_stub
+	run _run_audit
+	[ "$status" -eq 0 ] || return 1
+	[ "$(find "${CARTOGRAPHER_DIR}/dedup" -type f 2>/dev/null | wc -l | tr -d ' ')" = "0" ]
+}
+
+@test "a finding with no type is not counted as a new finding" {
+	# audit.complete used to report a finding that produced no issue.found,
+	# so a consumer reading only the bus saw counts that its own event stream
+	# could not account for.
+	_typeless_stub
+	_run_audit
+	_last_audit_complete | jq -e '.payload.new_finding_count == 0' >/dev/null
+}
+
 
 # ── Resolution reaching the bus (ecosystem-w2i) ──────────────────────────────
 #