@oscharko-dev/keiko 0.2.0-beta.3 → 0.2.0-beta.5

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/retention.d.ts

@@ -22,17 +22,20 @@ export type QualityIntelligenceDeletionStatus = "deleted" | "absent";
 export interface QualityIntelligenceDeletionReceipt {
     readonly runId: string;
     readonly status: QualityIntelligenceDeletionStatus;
+    readonly removedCompanionSuffixes: readonly string[];
     readonly auditEvent: QualityIntelligenceRunDeletedEvent;
 }
 export interface QualityIntelligenceRunDeletedEvent {
     readonly type: "qi:run:deleted";
     readonly runId: string;
     readonly status: QualityIntelligenceDeletionStatus;
+    readonly removedCompanionSuffixes: readonly string[];
     readonly at: string;
 }
 export interface QualityIntelligenceDeleteOptions extends QualityIntelligenceLoadOptions {
     readonly now?: (() => number) | undefined;
     readonly sideFileRoot?: string | undefined;
+    readonly companionSuffixes?: readonly string[] | undefined;
 }
 export declare function deleteQualityIntelligenceRun(runId: string, options?: QualityIntelligenceDeleteOptions): QualityIntelligenceDeletionReceipt;
 export interface QualityIntelligenceQuarantineOptions {

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/retention.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retention.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/retention.ts"],"names":[],"mappings":"AAmBA,OAAO,EAGL,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EACnC,MAAM,YAAY,CAAC;AAIpB,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAGvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,yCAAyC;IACxD,QAAQ,CAAC,QAAQ,EAAE,SAAS,mCAAmC,EAAE,CAAC;IAElE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,gBAAgB,CAAC;CACpD;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,SAAS,oCAAoC,EAAE,CAAC;CACrE;AAoED,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,yCAAyC,GAC/C,kCAAkC,CAapC;AAID,MAAM,MAAM,iCAAiC,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErE,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,kCAAkC,CAAC;CACzD;AAKD,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IAEnD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gCAAiC,SAAQ,8BAA8B;IAEtF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;IAM1C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C;AAkCD,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,gCAAqC,GAC7C,kCAAkC,CAcpC;AAaD,MAAM,WAAW,oCAAoC;IAEnD,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,QAAQ,CAAC;CAC3C;AAED,wBAAgB,4CAA4C,CAC1D,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,oCAAyC,GACjD,oCAAoC,CAYtC;AAUD,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,wBAAgB,0CAA0C,CACxD,KAAK,EAAE,6BAA6B,GACnC,mCAAmC,CAYrC"}
+{"version":3,"file":"retention.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/retention.ts"],"names":[],"mappings":"AAuBA,OAAO,EAGL,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EACnC,MAAM,YAAY,CAAC;AAcpB,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAGvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,yCAAyC;IACxD,QAAQ,CAAC,QAAQ,EAAE,SAAS,mCAAmC,EAAE,CAAC;IAElE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,gBAAgB,CAAC;CACpD;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,SAAS,oCAAoC,EAAE,CAAC;CACrE;AAoED,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,yCAAyC,GAC/C,kCAAkC,CAapC;AAID,MAAM,MAAM,iCAAiC,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErE,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IAGnD,QAAQ,CAAC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,kCAAkC,CAAC;CACzD;AAKD,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IAGnD,QAAQ,CAAC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;IAErD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gCAAiC,SAAQ,8BAA8B;IAEtF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;IAM1C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAO3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC5D;AA+DD,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,gCAAqC,GAC7C,kCAAkC,CAqBpC;AAaD,MAAM,WAAW,oCAAoC;IAEnD,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,QAAQ,CAAC;CAC3C;AAED,wBAAgB,4CAA4C,CAC1D,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,oCAAyC,GACjD,oCAAoC,CAYtC;AAUD,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,wBAAgB,0CAA0C,CACxD,KAAK,EAAE,6BAA6B,GACnC,mCAAmC,CAYrC"}

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/retention.js

@@ -2,18 +2,31 @@
 //
 // Pure decision function (`applyQualityIntelligenceRetention`) consumed by the orchestrator with
 // the current store snapshot; the orchestrator does the side effects. Idempotent deletion
-// (`deleteQualityIntelligenceRun`) removes the manifest and emits a typed deletion-receipt
-// audit event without throwing on a missing run.
+// (`deleteQualityIntelligenceRun`) removes the manifest AND its companion artifacts
+// (`.candidates.json` plus any caller-supplied server-owned suffixes) so a deleted run leaves no
+// orphaned customer-derived content, and emits a typed deletion-receipt audit event without
+// throwing on a missing run.
 //
 // Restart recovery is enforced at the WRITE seam: every persist is atomic O_EXCL temp + rename,
 // so an unclean shutdown leaves at most one `.tmp` (or nothing). The list/load surfaces filter on
 // the `.qi.json` suffix, so a half-written run is never surfaced. There is no recovery procedure
 // to call — recovery IS the absence of a code path that surfaces partials.
 import { lstatSync, renameSync, rmSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve, sep } from "node:path";
 import { assertValidRunId } from "@oscharko-dev/keiko-security";
+import { CANDIDATES_SUFFIX } from "./candidatesArtifact.js";
+import { deleteQualityIntelligenceCompanionArtifact } from "./companionStore.js";
 import { getQualityIntelligenceRetentionProfile, } from "./retentionPolicy.js";
 import { createNodeQualityIntelligenceLocalStore, QI_SUBDIR, } from "./store.js";
+// Companion artifacts that `keiko-evidence` OWNS and writes alongside the run manifest under
+// `qi/`, keyed by `<runId>`. They are swept by default on deletion so a "deleted" run never leaves
+// customer-derived generated content (`.candidates.json`) orphaned on disk (Issue #274 AC4).
+// Higher layers that own their own companions (e.g. keiko-server's `.review.json`, the figma
+// route companions) pass their suffixes via `QualityIntelligenceDeleteOptions.companionSuffixes`;
+// keiko-evidence MUST NOT hard-code suffixes it does not own (layering). The figma-snapshot
+// companion + its `figma-snapshots/<runId>/` side-files are deliberately EXCLUDED here — they have
+// their own retention seam (`enforceFigmaSnapshotRetention`) and are cleaned by that subsystem.
+const QI_EVIDENCE_OWNED_COMPANION_SUFFIXES = Object.freeze([CANDIDATES_SUFFIX]);
 const MS_PER_DAY = 24 * 60 * 60 * 1000;
 function profileForEntry(entry) {
     return { entry, profile: getQualityIntelligenceRetentionProfile(entry.retentionPolicyId) };
@@ -93,7 +106,16 @@ function resolveDeleteStore(options) {
 // A symlink at the run-dir path is refused (defence against a planted symlink redirecting the
 // rm into an unrelated tree).
 function removeSideFileDirIfPresent(runId, sideFileRoot) {
-    const runDir = join(sideFileRoot, runId);
+    const root = resolve(sideFileRoot);
+    const runDir = join(root, runId);
+    // Defence-in-depth: runId is already `assertValidRunId`-checked (no separators, no `..`, no
+    // leading dot) before this is reached, so `runDir` cannot escape `root`. Assert it lexically so
+    // a future refactor that relaxes the validation order fails loudly here instead of `rm`-ing an
+    // unrelated tree — the one #274 FS op that did not previously route through the containment
+    // discipline used by the manifest/companion stores.
+    if (!runDir.startsWith(root + sep)) {
+        throw new Error(`QI side-file dir escapes the side-file root, refusing to delete: ${runDir}`);
+    }
     const stat = lstatSync(runDir, { throwIfNoEntry: false });
     if (stat === undefined) {
         return;
@@ -103,6 +125,21 @@ function removeSideFileDirIfPresent(runId, sideFileRoot) {
     }
     rmSync(runDir, { recursive: true, force: true });
 }
+// Sweep the run's companion artifacts (evidence-owned + caller-supplied) from the contained `qi/`
+// dir. Exact-suffix, idempotent: a companion that does not exist is skipped. Returns the suffixes
+// that were actually removed so the deletion receipt/audit event can attest completeness.
+function removeRunCompanions(evidenceDir, runId, extraSuffixes) {
+    const suffixes = [
+        ...new Set([...QI_EVIDENCE_OWNED_COMPANION_SUFFIXES, ...(extraSuffixes ?? [])]),
+    ];
+    const removed = [];
+    for (const suffix of suffixes) {
+        if (deleteQualityIntelligenceCompanionArtifact(evidenceDir, runId, suffix)) {
+            removed.push(suffix);
+        }
+    }
+    return removed.sort();
+}
 // Idempotent removal of a single QI run's local state. Returns a structured receipt rather than
 // throwing on a missing run — callers (UI, retention orchestrator) need to distinguish "deleted"
 // from "absent" without try/catch noise. When options.sideFileRoot is set, also removes
@@ -112,6 +149,11 @@ export function deleteQualityIntelligenceRun(runId, options = {}) {
     assertValidRunId(runId);
     const store = resolveDeleteStore(options);
     const removed = store.delete(runId);
+    // Sweep companion artifacts so a deleted run leaves no orphaned customer-derived content on disk
+    // (Issue #274 AC4). On-disk only — skipped when just an in-memory store is supplied.
+    const removedCompanionSuffixes = options.evidenceDir === undefined
+        ? []
+        : removeRunCompanions(options.evidenceDir, runId, options.companionSuffixes);
     if (options.sideFileRoot !== undefined) {
         removeSideFileDirIfPresent(runId, options.sideFileRoot);
     }
@@ -120,7 +162,8 @@ export function deleteQualityIntelligenceRun(runId, options = {}) {
     return {
         runId,
         status,
-        auditEvent: { type: "qi:run:deleted", runId, status, at },
+        removedCompanionSuffixes,
+        auditEvent: { type: "qi:run:deleted", runId, status, removedCompanionSuffixes, at },
     };
 }
 export function quarantineCorruptQualityIntelligenceManifest(evidenceDir, runId, options = {}) {

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/store.d.ts

@@ -53,6 +53,39 @@ export interface QualityIntelligenceRecordResult {
     readonly location: string;
 }
 export declare function recordQualityIntelligenceRun(input: QualityIntelligenceRecordInput, options?: QualityIntelligenceRecordOptions): QualityIntelligenceRecordResult;
+export interface QualityIntelligenceExportEvidenceInput {
+    readonly runId: string;
+    /** The export row to append: target adapter, artifact id, integrity hash, attestation, mode. */
+    readonly export: QualityIntelligenceEvidenceManifest["exports"][number];
+}
+/**
+ * Append one export-evidence row to an already-recorded run manifest (Issue #283, AC4 — "export
+ * evidence records target type, artifact IDs, mapping profile, and result without leaking secrets";
+ * Audit Addendum — "audit evidence for every export action").
+ *
+ * Every QI export action — a local serialisation download, a binary PDF/ZIP bundle, or a dry-run
+ * preview — emits one audit row recording WHAT was exported (`targetAdapter`), the artifact id, its
+ * integrity hash, the redaction attestation, and whether it was a dry-run. The disabled external-TMS
+ * write path produces no artifact and therefore records nothing.
+ *
+ * Rows are deduplicated by `(id, dryRun)` so re-exporting the same adapter in the same mode is
+ * idempotent — the audit captures each distinct (artifact, mode) once rather than once per click,
+ * which also bounds manifest growth.
+ *
+ * Invariants preserved (mirrors {@link recordQualityIntelligenceRun}):
+ *  - the new row's string leaves pass the persist redactor before assembly (the row carries only
+ *    ids / an enum / a sha-256 hash / booleans, so this is a no-op in practice, but the persist
+ *    redactor is applied unconditionally to keep the fail-closed contract uniform);
+ *  - `integrityHashes.exports` is recomputed over the full new collection; the other hash groups are
+ *    carried over unchanged because their collections did not change;
+ *  - `totals.exports` stays equal to `exports.length` (asserted on read);
+ *  - the counts-only `redactionSummary` folds in the new row's scan;
+ *  - the manifest is rewritten through the same atomic O_EXCL temp + rename path.
+ *
+ * Throws `EvidenceReadError` when the run manifest does not exist (an export cannot precede its run)
+ * and `EvidenceWriteError` when neither `store` nor `evidenceDir` is supplied or the write fails.
+ */
+export declare function appendQualityIntelligenceExportRow(input: QualityIntelligenceExportEvidenceInput, options?: QualityIntelligenceRecordOptions): QualityIntelligenceRecordResult;
 export interface QualityIntelligenceLoadOptions {
     readonly store?: QualityIntelligenceLocalStore | undefined;
     readonly evidenceDir?: string | undefined;

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/store.ts"],"names":[],"mappings":"AAoCA,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EAGL,KAAK,mCAAmC,EACxC,KAAK,qCAAqC,EAE1C,KAAK,uCAAuC,EAC7C,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,KAAK,mCAAmC,EACzC,MAAM,gBAAgB,CAAC;AAIxB,eAAO,MAAM,SAAS,OAAO,CAAC;AAU9B,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,mCAAmC,KAAK,MAAM,CAAC;IAC3E,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,mCAAmC,GAAG,SAAS,CAAC;IAClF,QAAQ,CAAC,IAAI,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CAC7C;AAID,wBAAgB,2CAA2C,IAAI,6BAA6B,CAsB3F;AAkQD,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;CACtC;AAMD,wBAAgB,uCAAuC,CACrD,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,mCAAwC,GAChD,6BAA6B,CAgB/B;AAID,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC/D,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC/D,QAAQ,CAAC,QAAQ,EAAE,mCAAmC,CAAC,UAAU,CAAC,CAAC;IACnE,QAAQ,CAAC,OAAO,EAAE,mCAAmC,CAAC,SAAS,CAAC,CAAC;IACjE,QAAQ,CAAC,YAAY,EAAE,mCAAmC,CAAC,cAAc,CAAC,CAAC;IAC3E,QAAQ,CAAC,cAAc,EAAE,mCAAmC,CAAC,gBAAgB,CAAC,CAAC;IAC/E,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,CAAC,EAAE,mCAAmC,CAAC,gBAAgB,CAAC,CAAC;IAChF,oIAAoI;IACpI,QAAQ,CAAC,YAAY,CAAC,EAAE,mCAAmC,CAAC,cAAc,CAAC,CAAC;IAC5E,kFAAkF;IAClF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,uCAAuC,EAAE,CAAC;IACjF,yFAAyF;IACzF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,qCAAqC,EAAE,CAAC;IAC7E,mEAAmE;IACnE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,mCAAmC,GAAG,SAAS,CAAC;CACtE;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,mCAAmC,CAAC;IACvD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AA0HD,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,8BAA8B,EACrC,OAAO,GAAE,gCAAqC,GAC7C,+BAA+B,CAkCjC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,8BAAmC,GAC3C,mCAAmC,GAAG,SAAS,CAGjD;AAED,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,8BAAmC,GAC3C,SAAS,MAAM,EAAE,CAGnB"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/store.ts"],"names":[],"mappings":"AAoCA,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EAGL,KAAK,mCAAmC,EACxC,KAAK,qCAAqC,EAE1C,KAAK,uCAAuC,EAC7C,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,KAAK,mCAAmC,EACzC,MAAM,gBAAgB,CAAC;AAIxB,eAAO,MAAM,SAAS,OAAO,CAAC;AAU9B,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,mCAAmC,KAAK,MAAM,CAAC;IAC3E,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,mCAAmC,GAAG,SAAS,CAAC;IAClF,QAAQ,CAAC,IAAI,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CAC7C;AAID,wBAAgB,2CAA2C,IAAI,6BAA6B,CAsB3F;AA4QD,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;CACtC;AAMD,wBAAgB,uCAAuC,CACrD,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,mCAAwC,GAChD,6BAA6B,CAgB/B;AAID,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC/D,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC/D,QAAQ,CAAC,QAAQ,EAAE,mCAAmC,CAAC,UAAU,CAAC,CAAC;IACnE,QAAQ,CAAC,OAAO,EAAE,mCAAmC,CAAC,SAAS,CAAC,CAAC;IACjE,QAAQ,CAAC,YAAY,EAAE,mCAAmC,CAAC,cAAc,CAAC,CAAC;IAC3E,QAAQ,CAAC,cAAc,EAAE,mCAAmC,CAAC,gBAAgB,CAAC,CAAC;IAC/E,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,CAAC,EAAE,mCAAmC,CAAC,gBAAgB,CAAC,CAAC;IAChF,oIAAoI;IACpI,QAAQ,CAAC,YAAY,CAAC,EAAE,mCAAmC,CAAC,cAAc,CAAC,CAAC;IAC5E,kFAAkF;IAClF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,uCAAuC,EAAE,CAAC;IACjF,yFAAyF;IACzF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,qCAAqC,EAAE,CAAC;IAC7E,mEAAmE;IACnE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,mCAAmC,GAAG,SAAS,CAAC;CACtE;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,mCAAmC,CAAC;IACvD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AA0ID,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,8BAA8B,EACrC,OAAO,GAAE,gCAAqC,GAC7C,+BAA+B,CA2CjC;AAID,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gGAAgG;IAChG,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;CACzE;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,sCAAsC,EAC7C,OAAO,GAAE,gCAAqC,GAC7C,+BAA+B,CAoCjC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,8BAAmC,GAC3C,mCAAmC,GAAG,SAAS,CAGjD;AAED,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,8BAAmC,GAC3C,SAAS,MAAM,EAAE,CAGnB"}

package/node_modules/@oscharko-dev/keiko-evidence/dist/qualityIntelligence/store.js

@@ -202,6 +202,16 @@ function assertIntegrityHashesMatch(manifest) {
     assertOptionalHashMatches("coverageMatrix", manifest.coverageMatrix, manifest.integrityHashes.coverageMatrix);
     assertOptionalHashMatches("sourceFingerprints", manifest.sourceFingerprints, manifest.integrityHashes.sourceFingerprints);
 }
+// Integrity scope (be precise — this is the on-read tamper-detection contract): we verify the
+// (totals ↔ collection-length) invariant for findings/exports AND the per-group SHA-256 hashes for
+// findings / exports / evidenceRefs / atomFingerprints (+ coverageMatrix / sourceFingerprints when
+// their stored hash is present). We do NOT hash the run-level scalars (`status`, `totals.candidates`,
+// `provenanceRefs`, `qualityScore`, `modelId`, `modelParameters`, `seedUsed`, `planAt`/`completedAt`,
+// `retentionPolicyId`, `policyProfileIds`, `modelGatewayCallCount`, `redactionSummary`): a local
+// on-disk edit of those passes load. This is an accepted limitation of the local-state threat model
+// (the operator owns the disk); extending coverage to a scalar `meta` group is tracked as a #274
+// follow-up (see ADR-0023 D8). The schema gate already rejects unknown/missing top-level keys and a
+// bad status enum, so a scalar edit cannot change the manifest SHAPE — only a value.
 function assertManifestIntegrity(manifest) {
     if (manifest.totals.findings !== manifest.findings.length) {
         throw new EvidenceReadError(`QI manifest totals.findings (${String(manifest.totals.findings)}) does not match findings.length (${String(manifest.findings.length)})`);
@@ -311,27 +321,25 @@ function resolveStore(options) {
     }
     return undefined;
 }
-// Persist a QI run record. Runs the QI redactor over the input FIRST (every string leaf), then
-// computes per-group SHA-256 integrity hashes over the redacted collections, then validates the
-// (totals, collection-length) invariant, then writes the assembled manifest atomically.
-//
-// The store is wired via options.store (explicit, e.g. in-memory for tests) or options.evidenceDir
-// (resolve to a node adapter). Either MUST be supplied.
 /** Optional manifest fields that are only present when supplied (exactOptionalPropertyTypes). */
-function optionalManifestFields(input) {
+function optionalManifestFields(input, redacted) {
     return {
-        ...(input.coverageMatrix !== undefined ? { coverageMatrix: input.coverageMatrix } : {}),
+        // coverageMatrix + modelParameters are taken from the redacted set; the remaining optionals are
+        // ids / sha-256 hashes / numbers that carry no free text and need no persist-time scrub.
+        ...(redacted.coverageMatrix !== undefined ? { coverageMatrix: redacted.coverageMatrix } : {}),
         ...(input.qualityScore !== undefined ? { qualityScore: input.qualityScore } : {}),
         ...(input.sourceFingerprints !== undefined
             ? { sourceFingerprints: input.sourceFingerprints }
             : {}),
         ...(input.atomFingerprints !== undefined ? { atomFingerprints: input.atomFingerprints } : {}),
         ...(input.modelId !== undefined ? { modelId: input.modelId } : {}),
-        ...(input.modelParameters !== undefined ? { modelParameters: input.modelParameters } : {}),
+        ...(redacted.modelParameters !== undefined
+            ? { modelParameters: redacted.modelParameters }
+            : {}),
         ...(input.seedUsed !== undefined ? { seedUsed: input.seedUsed } : {}),
     };
 }
-function buildRunManifest(input, redacted, summary, integrityHashes) {
+function buildRunManifest(input, redacted, summary, integrityHashes, redactedOptionals) {
     return {
         qiEvidenceSchemaVersion: QUALITY_INTELLIGENCE_EVIDENCE_SCHEMA_VERSION,
         runId: input.runId,
@@ -348,7 +356,7 @@ function buildRunManifest(input, redacted, summary, integrityHashes) {
         provenanceRefs: redacted.provenanceRefs,
         redactionSummary: summary,
         integrityHashes,
-        ...optionalManifestFields(input),
+        ...optionalManifestFields(input, redactedOptionals),
     };
 }
 export function recordQualityIntelligenceRun(input, options = {}) {
@@ -369,9 +377,87 @@ export function recordQualityIntelligenceRun(input, options = {}) {
         exports: input.exports,
         evidenceRefs: input.evidenceRefs,
         provenanceRefs: input.provenanceRefs,
+        // coverageMatrix carries requirementExcerptRedacted (derived from raw source text) and
+        // modelParameters is a free-shaped Record; both are string-bearing leaves that must pass the
+        // persist redactor — not just their build-time scrub — so audit storage keeps the same
+        // fail-closed backstop as findings/evidenceRefs (#273 audit — AC#3 audit-storage safety).
+        coverageMatrix: input.coverageMatrix,
+        modelParameters: input.modelParameters,
     }, options.redaction ?? {});
-    const integrityHashes = buildIntegrityHashes(redacted.findings, redacted.exports, redacted.evidenceRefs, input.atomFingerprints, input.coverageMatrix, input.sourceFingerprints);
-    const manifest = buildRunManifest(input, redacted, summary, integrityHashes);
+    const integrityHashes = buildIntegrityHashes(redacted.findings, redacted.exports, redacted.evidenceRefs, input.atomFingerprints, redacted.coverageMatrix, input.sourceFingerprints);
+    const manifest = buildRunManifest(input, redacted, summary, integrityHashes, {
+        coverageMatrix: redacted.coverageMatrix,
+        modelParameters: redacted.modelParameters,
+    });
+    return { manifest, location: store.record(manifest) };
+}
+// Fold a second redaction summary into a base one so the manifest's counts-only redaction summary
+// stays internally consistent after an export row is appended (the run summary + the row's scan).
+function foldRedactionSummary(base, add) {
+    const patternsMatched = { ...base.patternsMatched };
+    for (const [key, count] of Object.entries(add.patternsMatched)) {
+        patternsMatched[key] = (patternsMatched[key] ?? 0) + count;
+    }
+    return {
+        totalStringsScanned: base.totalStringsScanned + add.totalStringsScanned,
+        stringsRedacted: base.stringsRedacted + add.stringsRedacted,
+        patternsMatched,
+    };
+}
+/**
+ * Append one export-evidence row to an already-recorded run manifest (Issue #283, AC4 — "export
+ * evidence records target type, artifact IDs, mapping profile, and result without leaking secrets";
+ * Audit Addendum — "audit evidence for every export action").
+ *
+ * Every QI export action — a local serialisation download, a binary PDF/ZIP bundle, or a dry-run
+ * preview — emits one audit row recording WHAT was exported (`targetAdapter`), the artifact id, its
+ * integrity hash, the redaction attestation, and whether it was a dry-run. The disabled external-TMS
+ * write path produces no artifact and therefore records nothing.
+ *
+ * Rows are deduplicated by `(id, dryRun)` so re-exporting the same adapter in the same mode is
+ * idempotent — the audit captures each distinct (artifact, mode) once rather than once per click,
+ * which also bounds manifest growth.
+ *
+ * Invariants preserved (mirrors {@link recordQualityIntelligenceRun}):
+ *  - the new row's string leaves pass the persist redactor before assembly (the row carries only
+ *    ids / an enum / a sha-256 hash / booleans, so this is a no-op in practice, but the persist
+ *    redactor is applied unconditionally to keep the fail-closed contract uniform);
+ *  - `integrityHashes.exports` is recomputed over the full new collection; the other hash groups are
+ *    carried over unchanged because their collections did not change;
+ *  - `totals.exports` stays equal to `exports.length` (asserted on read);
+ *  - the counts-only `redactionSummary` folds in the new row's scan;
+ *  - the manifest is rewritten through the same atomic O_EXCL temp + rename path.
+ *
+ * Throws `EvidenceReadError` when the run manifest does not exist (an export cannot precede its run)
+ * and `EvidenceWriteError` when neither `store` nor `evidenceDir` is supplied or the write fails.
+ */
+export function appendQualityIntelligenceExportRow(input, options = {}) {
+    assertValidRunId(input.runId);
+    const store = resolveStore(options);
+    if (store === undefined) {
+        throw new EvidenceWriteError("appendQualityIntelligenceExportRow requires options.store or options.evidenceDir");
+    }
+    const existing = store.load(input.runId);
+    if (existing === undefined) {
+        throw new EvidenceReadError(`cannot append export evidence: QI run "${input.runId}" was not found`);
+    }
+    const { redacted: redactedRow, summary: rowSummary } = redactQualityIntelligenceEvidence(input.export, options.redaction ?? {});
+    const isSameRow = (row) => row.id === redactedRow.id && (row.dryRun ?? false) === (redactedRow.dryRun ?? false);
+    if (existing.exports.some(isSameRow)) {
+        return { manifest: existing, location: store.location(input.runId) };
+    }
+    const exports = [...existing.exports, redactedRow];
+    const integrityHashes = {
+        ...existing.integrityHashes,
+        exports: sha256OfJson(exports),
+    };
+    const manifest = {
+        ...existing,
+        exports,
+        totals: { ...existing.totals, exports: exports.length },
+        integrityHashes,
+        redactionSummary: foldRedactionSummary(existing.redactionSummary, rowSummary),
+    };
     return { manifest, location: store.record(manifest) };
 }
 export function loadQualityIntelligenceRun(runId, options = {}) {

package/node_modules/@oscharko-dev/keiko-evidence/dist/types.d.ts

@@ -1,3 +1,3 @@
-export type { EvidenceRunIdentity, EvidenceModel, EvidenceUsageTotals, EvidenceStateTransition, EvidenceToolCall, EvidenceCommandExecution, EvidenceSandboxConfiguration, EvidenceVerificationResult, EvidencePatch, EvidenceReasoningEntry, EvidenceFailure, EvidenceTaskType, EvidenceBrowserViewportPx, EvidenceBrowserEventType, EvidenceBrowserEvent, EvidenceBrowserScreenshot, EvidenceBrowserContentCapture, EvidenceBrowserCapture, EvidenceConnectedContextScope, EvidenceConnectedContextQuery, EvidenceConnectedContextExcerpt, EvidenceConnectedContextFile, EvidenceConnectedContextOmitted, EvidenceConnectedContextUncertainty, EvidenceConnectedContextAudit, EvidenceManifest, AuditRedactionConfig, RetentionPolicy, BuildOptions, EvidenceBuildInput, EvidenceDeps, EvidenceStore, } from "@oscharko-dev/keiko-contracts";
+export type { EvidenceRunIdentity, EvidenceModel, EvidenceUsageTotals, EvidenceStateTransition, EvidenceToolCall, EvidenceCommandExecution, EvidenceSandboxConfiguration, EvidenceVerificationResult, EvidencePatch, EvidenceReasoningEntry, EvidenceFailure, EvidenceTaskType, EvidenceBrowserViewportPx, EvidenceBrowserEventType, EvidenceBrowserEvent, EvidenceBrowserScreenshot, EvidenceBrowserContentCapture, EvidenceBrowserCapture, EvidenceConnectedContextScope, EvidenceConnectedContextQuery, EvidenceConnectedContextExcerpt, EvidenceConnectedContextFile, EvidenceConnectedContextOmitted, EvidenceConnectedContextUncertainty, EvidenceConnectedContextPlan, EvidenceConnectedContextAudit, EvidenceManifest, AuditRedactionConfig, RetentionPolicy, BuildOptions, EvidenceBuildInput, EvidenceDeps, EvidenceStore, } from "@oscharko-dev/keiko-contracts";
 export { EVIDENCE_SCHEMA_VERSION, DEFAULT_RETENTION } from "@oscharko-dev/keiko-contracts";
 //# sourceMappingURL=types.d.ts.map

package/node_modules/@oscharko-dev/keiko-evidence/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAKA,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAC1B,aAAa,EACb,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,EACzB,6BAA6B,EAC7B,sBAAsB,EACtB,6BAA6B,EAC7B,6BAA6B,EAC7B,+BAA+B,EAC/B,4BAA4B,EAC5B,+BAA+B,EAC/B,mCAAmC,EACnC,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAKA,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAC1B,aAAa,EACb,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,EACzB,6BAA6B,EAC7B,sBAAsB,EACtB,6BAA6B,EAC7B,6BAA6B,EAC7B,+BAA+B,EAC/B,4BAA4B,EAC5B,+BAA+B,EAC/B,mCAAmC,EACnC,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC"}

package/node_modules/@oscharko-dev/keiko-evidence/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oscharko-dev/keiko-evidence",
-  "version": "0.2.0-beta.3",
+  "version": "0.2.0-beta.5",
   "private": true,
   "type": "module",
   "license": "Apache-2.0",
@@ -15,7 +15,7 @@
   },
   "scripts": {
     "build": "tsc -b tsconfig.json",
-    "typecheck": "tsc -b tsconfig.json --noEmit",
+    "typecheck": "tsc -b tsconfig.json",
     "test": "vitest run"
   },
   "files": [