@rigour-labs/core 6.5.2 → 6.5.4

package/README.md

@@ -46,7 +46,7 @@ Rigour's deep analysis is not a wrapper around a generic LLM. The model operates
 2. **Interpret** — the model receives structured facts (not raw source), focuses on SOLID, design patterns, language idioms, architecture. Constrained input prevents hallucination.
 3. **Verify** — every LLM finding is cross-referenced against all five signal streams. Wrong line numbers, phantom patterns, non-existent functions → discarded. Only verified findings with confidence scores reach the report.
 
-Both model tiers (lite sidecar + pro code-specialized) are fine-tuned via the [DriftBench RLAIF pipeline](https://github.com/rigour-labs/driftbench) where the five signal streams serve as the teacher signal.
+Deep review is built for frontier models: your own key, or the coding agent's own model. The small local models (lite and deep tiers fine-tuned via the [DriftBench RLAIF pipeline](https://github.com/rigour-labs/driftbench); max is the stock Qwen2.5-Coder-7B) remain available offline but are no longer developed.
 
 ### Temporal Drift Engine (v5.1)
 

package/dist/context/automatic-index.d.ts

@@ -8,6 +8,11 @@ export interface AutomaticIndexStatus {
     updatedAt: string;
 }
 export declare function mergeSemanticEmbeddings(latest: PatternIndex, enriched: PatternIndex): PatternIndex;
+/**
+ * What an explicit `rigour index` (CLI or MCP) chose, so automatic indexing and Studio's health
+ * agree with it: 'disabled' for --no-semantic, else ready or degraded by what was embedded.
+ */
+export declare function recordIndexChoice(cwd: string, index: PatternIndex, semantic: boolean): Promise<void>;
 export declare function getAutomaticIndexStatus(cwd: string): Promise<AutomaticIndexStatus>;
 export declare function ensureAutomaticIndex(cwd: string, options?: {
     backgroundSemantic?: boolean;

package/dist/context/automatic-index.js

@@ -1,6 +1,7 @@
 import fs from 'fs-extra';
 import path from 'path';
 import { PatternIndexer, getDefaultIndexPath, loadPatternIndex, savePatternIndex } from '../pattern-index/indexer.js';
+import { EMBEDDING_TEXT_VERSION } from '../pattern-index/embeddings.js';
 import { affectedDependents, buildDependencyGraph, updateDependencyGraph } from './dependency-graph.js';
 import { syncIndexToContextCache } from './index-bridge.js';
 const enrichmentJobs = new Map();
@@ -33,15 +34,35 @@ async function writeStatus(cwd, status) {
     await fs.ensureDir(path.join(cwd, '.rigour'));
     await fs.writeJson(statusPath(cwd), status, { spaces: 2 });
 }
+/** Embedded, and from the current embedding text (an older one is re-embedded on enrichment). */
+function hasCurrentEmbeddings(index) {
+    return index.embeddingTextVersion === EMBEDDING_TEXT_VERSION
+        && index.patterns.some(pattern => (pattern.embedding?.length ?? 0) > 0);
+}
+/**
+ * What an explicit `rigour index` (CLI or MCP) chose, so automatic indexing and Studio's health
+ * agree with it: 'disabled' for --no-semantic, else ready or degraded by what was embedded.
+ */
+export async function recordIndexChoice(cwd, index, semantic) {
+    const embedded = index.patterns.filter(pattern => (pattern.embedding?.length ?? 0) > 0).length;
+    await writeStatus(cwd, {
+        structural: 'ready',
+        graph: 'ready',
+        semantic: !semantic ? 'disabled' : embedded > 0 ? 'ready' : 'degraded',
+        ...(semantic && embedded === 0 ? { message: 'Local embedding model unavailable; text matching remains active.' } : {}),
+        updatedAt: new Date().toISOString(),
+    });
+}
 export async function getAutomaticIndexStatus(cwd) {
     try {
         return await fs.readJson(statusPath(cwd));
     }
     catch {
+        // No status yet is not an opt-out: only `rigour index --no-semantic` records 'disabled'.
         return {
             structural: 'missing',
             graph: 'missing',
-            semantic: 'disabled',
+            semantic: 'warming',
             updatedAt: new Date().toISOString(),
         };
     }
@@ -97,7 +118,7 @@ export async function ensureAutomaticIndex(cwd, options = {}) {
     if (!(await fs.pathExists(path.join(cwd, '.rigour', 'dependency-graph.json')))) {
         await buildDependencyGraph(cwd, index);
     }
-    const hasEmbeddings = index.patterns.some((pattern) => (pattern.embedding?.length ?? 0) > 0);
+    const hasEmbeddings = hasCurrentEmbeddings(index);
     await writeStatus(cwd, {
         structural: 'ready',
         graph: 'ready',
@@ -130,7 +151,7 @@ export async function updateAutomaticIndexForFiles(cwd, changedFiles) {
         await buildDependencyGraph(cwd, index);
     await writeStatus(cwd, {
         structural: 'ready', graph: 'ready',
-        semantic: index.patterns.some(pattern => (pattern.embedding?.length ?? 0) > 0)
+        semantic: hasCurrentEmbeddings(index)
             ? 'ready'
             : previousStatus.semantic === 'disabled' ? 'disabled' : 'warming',
         message: `${normalizedChangedFiles.length} changed file(s); ${affectedFiles.length} affected file(s) refreshed without a full scan.`,

package/dist/context/index-status.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/context/index-status.test.js

@@ -0,0 +1,26 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { getAutomaticIndexStatus, recordIndexChoice } from './automatic-index.js';
+let cwd;
+beforeEach(() => { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'index-status-')); });
+afterEach(() => fs.rmSync(cwd, { recursive: true, force: true }));
+const index = (embedded) => ({
+    version: '1.0.0', lastUpdated: '', rootDir: cwd, files: [],
+    patterns: [{ id: 'a', type: 'function', name: 'a', file: 'a.ts', line: 1, endLine: 1, signature: '', description: '', keywords: [], hash: 'a', exported: true, usageCount: 0, indexedAt: '', ...(embedded ? { embedding: [0.1] } : {}) }],
+    stats: { totalPatterns: 1, totalFiles: 1, byType: {}, indexDurationMs: 0 },
+});
+describe('semantic index status', () => {
+    it('treats no status yet as warming, not as an opt-out', async () => {
+        expect((await getAutomaticIndexStatus(cwd)).semantic).toBe('warming');
+    });
+    it('records what an explicit index chose, so automatic indexing and Studio agree', async () => {
+        await recordIndexChoice(cwd, index(false), false);
+        expect((await getAutomaticIndexStatus(cwd)).semantic).toBe('disabled');
+        await recordIndexChoice(cwd, index(true), true);
+        expect((await getAutomaticIndexStatus(cwd)).semantic).toBe('ready');
+        await recordIndexChoice(cwd, index(false), true);
+        expect((await getAutomaticIndexStatus(cwd)).semantic).toBe('degraded');
+    });
+});

package/dist/deep/risk.d.ts

@@ -38,4 +38,10 @@ export declare function findFunction(cwd: string, file: string, name: string): {
     start: number;
     end: number;
 } | undefined;
+/**
+ * What a review record is bound to: the function's exact source. Collapsing whitespace once let
+ * `"a  b"` and `"a b"` share a hash, so a string changed after review still counted as reviewed.
+ * Only line endings are normalised (a Windows checkout is the same code); any other change,
+ * formatting included, asks for a new review.
+ */
 export declare function functionHash(text: string): string;

package/dist/deep/risk.js

@@ -92,8 +92,14 @@ export function findFunction(cwd, file, name) {
     visit(sourceFile);
     return found;
 }
+/**
+ * What a review record is bound to: the function's exact source. Collapsing whitespace once let
+ * `"a  b"` and `"a b"` share a hash, so a string changed after review still counted as reviewed.
+ * Only line endings are normalised (a Windows checkout is the same code); any other change,
+ * formatting included, asks for a new review.
+ */
 export function functionHash(text) {
-    return crypto.createHash('sha256').update(text.replace(/\s+/g, ' ').trim()).digest('hex');
+    return crypto.createHash('sha256').update(text.replace(/\r\n/g, '\n')).digest('hex');
 }
 const GUARD = /\b(?:if|else|return|throw|break|continue|catch)\b|\?\?|\?\./g;
 function guards(lines) {

package/dist/deep/risk.test.js

@@ -2,7 +2,7 @@ import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { rankChangedFunctions, scoreRisk } from './risk.js';
+import { functionHash, rankChangedFunctions, scoreRisk } from './risk.js';
 import { routeFiles } from './router.js';
 let dir;
 beforeEach(() => { dir = fs.mkdtempSync(path.join(os.tmpdir(), 'risk-')); });
@@ -61,3 +61,14 @@ describe('routeFiles', () => {
         expect(stale.stats).toMatchObject({ routed: 1, already_reviewed: 0 });
     });
 });
+describe('functionHash', () => {
+    it('changes when anything inside the function changes, strings included', () => {
+        const a = 'function f() { return "a  b"; }';
+        const b = 'function f() { return "a b"; }';
+        expect(functionHash(a)).not.toBe(functionHash(b));
+        expect(functionHash('function f() { return `x ${y}`; }')).not.toBe(functionHash('function f() { return `x  ${y}`; }'));
+    });
+    it('treats a Windows checkout of the same code as the same code', () => {
+        expect(functionHash('function f() {\r\n  return 1;\r\n}')).toBe(functionHash('function f() {\n  return 1;\n}'));
+    });
+});

package/dist/firewall/arbitration-token.d.ts

@@ -1,8 +1,17 @@
 /**
- * One-time arbitration tokens — bind Studio approve/reject to the requesting MCP process.
+ * One-time arbitration tokens — bind a Studio approve/reject to the MCP process that asked.
+ *
+ * The token lives only in the requesting process's memory and in a store outside the workspace
+ * (never in .rigour/ or the event log, which agents write). Studio consumes it once and signs the
+ * decision with it; the requester accepts only a decision whose signature verifies, so appending
+ * a decision line to .rigour/events.jsonl approves nothing.
  */
+export type ArbitrationDecision = 'approve' | 'reject';
 export declare function issueArbitrationToken(cwd: string, requestId: string, ttlMs?: number): Promise<string>;
 /**
- * Consume a one-time token. Returns false if missing, expired, or mismatched.
+ * Studio side: consume the request's token once and sign the human's decision with it.
+ * Null when the request is unknown, expired or already decided.
  */
-export declare function consumeArbitrationToken(cwd: string, requestId: string, token: string | undefined): Promise<boolean>;
+export declare function signArbitrationDecision(cwd: string, requestId: string, decision: ArbitrationDecision): Promise<string | null>;
+/** Requester side: true only for a decision signed with the token this process issued. */
+export declare function verifyArbitrationDecision(token: string, requestId: string, decision: unknown, proof: unknown): boolean;

package/dist/firewall/arbitration-token.js

@@ -1,26 +1,29 @@
 /**
- * One-time arbitration tokens — bind Studio approve/reject to the requesting MCP process.
+ * One-time arbitration tokens — bind a Studio approve/reject to the MCP process that asked.
+ *
+ * The token lives only in the requesting process's memory and in a store outside the workspace
+ * (never in .rigour/ or the event log, which agents write). Studio consumes it once and signs the
+ * decision with it; the requester accepts only a decision whose signature verifies, so appending
+ * a decision line to .rigour/events.jsonl approves nothing.
  */
-import { randomBytes, timingSafeEqual } from 'crypto';
+import { createHmac, randomBytes, timingSafeEqual } from 'crypto';
 import fs from 'fs-extra';
 import path from 'path';
+import { repoStateDir } from '../utils/user-state.js';
 function storePath(cwd) {
-    return path.join(cwd, '.rigour', 'arbitration-tokens.json');
+    return path.join(repoStateDir(cwd), 'arbitration-tokens.json');
 }
 async function readStore(cwd) {
-    const p = storePath(cwd);
-    if (!(await fs.pathExists(p)))
-        return {};
     try {
-        return await fs.readJson(p);
+        return await fs.readJson(storePath(cwd));
     }
     catch {
         return {};
     }
 }
 async function writeStore(cwd, store) {
-    await fs.ensureDir(path.join(cwd, '.rigour'));
-    await fs.writeJson(storePath(cwd), store, { spaces: 2 });
+    await fs.ensureDir(path.dirname(storePath(cwd)), { mode: 0o700 });
+    await fs.writeJson(storePath(cwd), store, { spaces: 2, mode: 0o600 });
 }
 export async function issueArbitrationToken(cwd, requestId, ttlMs = 60_000) {
     const token = randomBytes(24).toString('hex');
@@ -34,25 +37,29 @@ export async function issueArbitrationToken(cwd, requestId, ttlMs = 60_000) {
     await writeStore(cwd, store);
     return token;
 }
+function decisionProof(token, requestId, decision) {
+    return createHmac('sha256', token).update(`${requestId}:${decision}`).digest('hex');
+}
 /**
- * Consume a one-time token. Returns false if missing, expired, or mismatched.
+ * Studio side: consume the request's token once and sign the human's decision with it.
+ * Null when the request is unknown, expired or already decided.
  */
-export async function consumeArbitrationToken(cwd, requestId, token) {
-    if (!token || !requestId)
-        return false;
+export async function signArbitrationDecision(cwd, requestId, decision) {
+    if (!requestId)
+        return null;
     const store = await readStore(cwd);
     const entry = store[requestId];
     if (!entry)
-        return false;
-    if (Date.now() > entry.expiresAt) {
-        delete store[requestId];
-        await writeStore(cwd, store);
-        return false;
-    }
-    const a = Buffer.from(entry.token);
-    const b = Buffer.from(token);
-    const ok = a.length === b.length && timingSafeEqual(a, b);
+        return null;
     delete store[requestId];
     await writeStore(cwd, store);
-    return ok;
+    return Date.now() > entry.expiresAt ? null : decisionProof(entry.token, requestId, decision);
+}
+/** Requester side: true only for a decision signed with the token this process issued. */
+export function verifyArbitrationDecision(token, requestId, decision, proof) {
+    if ((decision !== 'approve' && decision !== 'reject') || typeof proof !== 'string')
+        return false;
+    const expected = Buffer.from(decisionProof(token, requestId, decision));
+    const given = Buffer.from(proof);
+    return expected.length === given.length && timingSafeEqual(expected, given);
 }

package/dist/firewall/attestation.d.ts

@@ -30,9 +30,14 @@ export declare function createAttestation(cwd: string, input: {
 export declare function verifyAttestation(cwd: string, bundle: AttestationBundle): Promise<boolean>;
 export declare function loadLatestAttestation(cwd: string): Promise<AttestationBundle | null>;
 /**
- * CI admission: valid signature, PASS gates, bound commit/tree, fresh, non-workspace-key unless allowed.
+ * CI admission. Admits only a bundle that is signed with a key outside the workspace, records PASS
+ * gates, is fresh, is bound to this checkout (commit or tree, and at least one must be present and
+ * match), whose artifact digest recomputes from the files here, and, when the caller names the
+ * policy it requires, was produced under that policy.
  */
-export declare function admitForCi(cwd: string): Promise<{
+export declare function admitForCi(cwd: string, options?: {
+    policyHash?: string;
+}): Promise<{
     admit: boolean;
     reason: string;
 }>;

package/dist/firewall/attestation.js

@@ -2,18 +2,18 @@
  * Signed attestation bundles for completed transactions.
  * Keys prefer env / home directory — not agent-writable workspace keys for CI admit.
  */
-import { createHash, createHmac, randomBytes } from 'crypto';
+import { createHash, createHmac, randomBytes, timingSafeEqual } from 'crypto';
 import fs from 'fs-extra';
-import os from 'os';
 import path from 'path';
 import { execa } from 'execa';
+import { rigourUserDir } from '../utils/user-state.js';
 const KEY_FILE = 'attestation.key';
 export async function resolveAttestationKey(cwd) {
     const envKey = process.env.RIGOUR_ATTESTATION_KEY;
     if (envKey && envKey.length >= 32) {
         return { key: Buffer.from(envKey, 'utf8'), source: 'env' };
     }
-    const homeKeyPath = path.join(os.homedir(), '.rigour', KEY_FILE);
+    const homeKeyPath = path.join(rigourUserDir(), KEY_FILE);
     if (await fs.pathExists(homeKeyPath)) {
         return { key: await fs.readFile(homeKeyPath), source: 'home' };
     }
@@ -22,7 +22,7 @@ export async function resolveAttestationKey(cwd) {
         return { key: await fs.readFile(workspaceKeyPath), source: 'workspace' };
     }
     // Create home key by default (outside agent workspace)
-    await fs.ensureDir(path.join(os.homedir(), '.rigour'));
+    await fs.ensureDir(rigourUserDir());
     const key = randomBytes(32);
     await fs.writeFile(homeKeyPath, key, { mode: 0o600 });
     return { key, source: 'home' };
@@ -130,10 +130,11 @@ export async function createAttestation(cwd, input) {
 export async function verifyAttestation(cwd, bundle) {
     const { key } = await resolveAttestationKey(cwd);
     const { signature, signedAt, ...rest } = bundle;
-    const expected = createHmac('sha256', key)
+    const expected = Buffer.from(createHmac('sha256', key)
         .update(payloadForSign(rest) + signedAt)
-        .digest('hex');
-    return expected === signature;
+        .digest('hex'));
+    const given = Buffer.from(String(signature ?? ''));
+    return expected.length === given.length && timingSafeEqual(expected, given);
 }
 export async function loadLatestAttestation(cwd) {
     const p = path.join(cwd, '.rigour', 'attestation-latest.json');
@@ -147,9 +148,12 @@ export async function loadLatestAttestation(cwd) {
     }
 }
 /**
- * CI admission: valid signature, PASS gates, bound commit/tree, fresh, non-workspace-key unless allowed.
+ * CI admission. Admits only a bundle that is signed with a key outside the workspace, records PASS
+ * gates, is fresh, is bound to this checkout (commit or tree, and at least one must be present and
+ * match), whose artifact digest recomputes from the files here, and, when the caller names the
+ * policy it requires, was produced under that policy.
  */
-export async function admitForCi(cwd) {
+export async function admitForCi(cwd, options = {}) {
     const { source } = await resolveAttestationKey(cwd);
     if (source === 'workspace' && process.env.RIGOUR_ALLOW_WORKSPACE_ATTESTATION_KEY !== '1') {
         return {
@@ -168,30 +172,47 @@ export async function admitForCi(cwd) {
     if (bundle.gateResults.status !== 'PASS') {
         return { admit: false, reason: `Gates not PASS (${bundle.gateResults.status})` };
     }
-    if (!bundle.treeDigest && (!bundle.filesUsed || bundle.filesUsed.length === 0)) {
-        return { admit: false, reason: 'Attestation missing treeDigest and filesUsed' };
-    }
-    if (!bundle.artifactDigest || bundle.artifactDigest.length < 16) {
-        return { admit: false, reason: 'Attestation artifactDigest missing or trivial' };
+    const requiredPolicy = options.policyHash ?? process.env.RIGOUR_REQUIRED_POLICY_HASH;
+    if (requiredPolicy && bundle.policyHash !== requiredPolicy) {
+        return { admit: false, reason: `Attestation policy ${bundle.policyHash} is not the required ${requiredPolicy}` };
     }
     const maxAgeMs = Number(process.env.RIGOUR_ATTESTATION_MAX_AGE_MS || 24 * 60 * 60 * 1000);
     const age = Date.now() - Date.parse(bundle.signedAt);
     if (!Number.isFinite(age) || age < 0 || age > maxAgeMs) {
         return { admit: false, reason: 'Attestation expired or has invalid signedAt' };
     }
-    const headSha = await getGitCommitSha(cwd);
-    if (bundle.commitSha && headSha && bundle.commitSha !== headSha) {
-        return {
-            admit: false,
-            reason: `Attestation commitSha ${bundle.commitSha.slice(0, 8)}≠ HEAD ${headSha.slice(0, 8)}`,
-        };
+    const binding = await checkBinding(cwd, bundle);
+    if (binding)
+        return { admit: false, reason: binding };
+    if (await recomputeArtifactDigest(cwd, bundle) !== bundle.artifactDigest) {
+        return { admit: false, reason: 'Attestation artifactDigest does not match the files in this checkout' };
     }
-    const headTree = await getGitTreeDigest(cwd);
-    if (bundle.treeDigest && headTree && bundle.treeDigest !== headTree) {
-        return {
-            admit: false,
-            reason: `Attestation treeDigest mismatch vs HEAD tree`,
-        };
-    }
-    return { admit: true, reason: 'Valid attestation with PASS gates and bound tree/commit' };
+    return { admit: true, reason: 'Valid attestation with PASS gates, bound to this checkout, artifacts verified' };
+}
+/** Why the bundle is not bound to this checkout, or null when it is. A bundle bound to nothing is refused. */
+async function checkBinding(cwd, bundle) {
+    if (!bundle.commitSha && !bundle.treeDigest)
+        return 'Attestation is bound to no commit or tree';
+    const [headSha, headTree] = await Promise.all([getGitCommitSha(cwd), getGitTreeDigest(cwd)]);
+    if (bundle.commitSha && bundle.commitSha !== headSha) {
+        return `Attestation commitSha ${bundle.commitSha.slice(0, 8)} is not HEAD ${(headSha ?? 'none').slice(0, 8)}`;
+    }
+    if (bundle.treeDigest && bundle.treeDigest !== headTree)
+        return 'Attestation treeDigest mismatch vs HEAD tree';
+    return null;
+}
+/** The digest createAttestation would compute for this checkout: the named files' contents, or the tree. */
+async function recomputeArtifactDigest(cwd, bundle) {
+    const files = bundle.filesUsed ?? [];
+    if (files.length === 0)
+        return createHash('sha256').update(`tree:${bundle.treeDigest ?? ''}`).digest('hex');
+    const contents = new Map();
+    for (const f of files) {
+        const abs = path.resolve(cwd, f);
+        if (!abs.startsWith(path.resolve(cwd) + path.sep))
+            continue; // never read outside the checkout
+        if (await fs.pathExists(abs))
+            contents.set(f, await fs.readFile(abs, 'utf-8'));
+    }
+    return computeArtifactDigest(files, contents);
 }

package/dist/firewall/trust-boundaries.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/firewall/trust-boundaries.test.js

@@ -0,0 +1,64 @@
+import { execFileSync } from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { issueArbitrationToken, signArbitrationDecision, verifyArbitrationDecision } from './arbitration-token.js';
+import { admitForCi, createAttestation } from './attestation.js';
+let repo;
+const git = (...args) => execFileSync('git', ['-C', repo, ...args], { encoding: 'utf8' });
+beforeEach(() => {
+    repo = fs.mkdtempSync(path.join(os.tmpdir(), 'trust-'));
+    git('init', '-q', '-b', 'main');
+    git('config', 'user.email', 't@example.com');
+    git('config', 'user.name', 't');
+    git('config', 'commit.gpgsign', 'false');
+    fs.writeFileSync(path.join(repo, 'a.ts'), 'export const a = 1;\n');
+    git('add', '-A');
+    git('commit', '-qm', 'init');
+});
+afterEach(() => fs.rmSync(repo, { recursive: true, force: true }));
+describe('human arbitration', () => {
+    it('accepts only a decision signed with the issued token, once', async () => {
+        const token = await issueArbitrationToken(repo, 'r1');
+        expect(fs.existsSync(path.join(repo, '.rigour', 'arbitration-tokens.json'))).toBe(false);
+        // A line any process can append to the event log carries no valid proof.
+        expect(verifyArbitrationDecision(token, 'r1', 'approve', undefined)).toBe(false);
+        expect(verifyArbitrationDecision(token, 'r1', 'approve', 'f'.repeat(64))).toBe(false);
+        const proof = await signArbitrationDecision(repo, 'r1', 'approve');
+        expect(verifyArbitrationDecision(token, 'r1', 'approve', proof)).toBe(true);
+        expect(verifyArbitrationDecision(token, 'r1', 'reject', proof)).toBe(false);
+        expect(await signArbitrationDecision(repo, 'r1', 'approve')).toBeNull();
+    });
+});
+describe('CI admission', () => {
+    const tx = (over = {}) => ({
+        id: 'tx1', agentId: 'agent', scope: ['**/*'], policyHash: 'policy-a', capabilitiesIssued: [], filesChanged: ['a.ts'], ...over,
+    });
+    const pass = { status: 'PASS', failedGates: [] };
+    it('admits a fresh, bound bundle whose files are unchanged', async () => {
+        await createAttestation(repo, { transaction: tx(), gateResults: pass });
+        expect(await admitForCi(repo)).toMatchObject({ admit: true });
+    });
+    it('refuses when an attested file differs from what was signed, even at the same commit', async () => {
+        await createAttestation(repo, { transaction: tx(), gateResults: pass });
+        fs.writeFileSync(path.join(repo, 'a.ts'), 'export const a = 2;\n'); // HEAD and its tree are unchanged
+        expect(await admitForCi(repo)).toMatchObject({ admit: false, reason: expect.stringContaining('artifactDigest') });
+    });
+    it('refuses a bundle produced under another policy than the one required', async () => {
+        await createAttestation(repo, { transaction: tx(), gateResults: pass });
+        expect(await admitForCi(repo, { policyHash: 'policy-b' })).toMatchObject({ admit: false });
+        expect(await admitForCi(repo, { policyHash: 'policy-a' })).toMatchObject({ admit: true });
+    });
+    it('refuses a bundle bound to no commit or tree', async () => {
+        const noRepo = fs.mkdtempSync(path.join(os.tmpdir(), 'trust-norepo-'));
+        try {
+            fs.writeFileSync(path.join(noRepo, 'a.ts'), 'export const a = 1;\n');
+            await createAttestation(noRepo, { transaction: tx(), gateResults: pass });
+            expect(await admitForCi(noRepo)).toMatchObject({ admit: false, reason: 'Attestation is bound to no commit or tree' });
+        }
+        finally {
+            fs.rmSync(noRepo, { recursive: true, force: true });
+        }
+    });
+});

package/dist/gates/dedupe-failures.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/dedupe-failures.test.js

@@ -0,0 +1,12 @@
+import { describe, expect, it } from 'vitest';
+import { dedupeFailures } from './runner.js';
+const finding = (title, line = 3) => ({ id: 'semantic-bugs', title, details: '', severity: 'high', provenance: 'traditional', files: ['src/a.ts'], line });
+describe('dedupeFailures', () => {
+    it('keeps a learned rule that fires on the same line as a built-in rule of the same gate', () => {
+        const kept = dedupeFailures([finding('credential-redirect'), finding('learned-rule: require-option-redirect')]);
+        expect(kept.map(f => f.title)).toEqual(['credential-redirect', 'learned-rule: require-option-redirect']);
+    });
+    it('still drops the same rule reported twice on one line', () => {
+        expect(dedupeFailures([finding('credential-redirect'), finding('credential-redirect'), finding('credential-redirect', 9)])).toHaveLength(2);
+    });
+});

package/dist/gates/deep-analysis.d.ts

@@ -15,6 +15,7 @@ import { Gate, GateContext } from './base.js';
 import { Failure, Provenance, DeepOptions } from '../types/index.js';
 import type { InferenceUsage } from '../inference/types.js';
 import { type RouterPolicy, type RouterStats } from '../deep/router.js';
+import { reviewedKeys } from '../review/ledger.js';
 import { type LessonMode } from '../review-learning/team-lessons.js';
 export interface DeepGateConfig {
     options: DeepOptions;
@@ -88,3 +89,8 @@ export declare class DeepAnalysisGate extends Gate {
 /** Per-call options; unset config falls back to per-provider defaults. */
 /** Per-call inference timeout: a local 7B reads a file with its reference pack far slower than the small tiers. */
 export declare function defaultTimeout(options: DeepOptions): number;
+/**
+ * Functions the router may skip as already reviewed: what agents recorded (the ledger and
+ * reviewed.json), unless the run is independent, as an enforcing check is.
+ */
+export declare function trustedReviews(cwd: string, options: Pick<DeepOptions, 'independent'>): ReturnType<typeof reviewedKeys>;

package/dist/gates/deep-analysis.js

@@ -179,7 +179,7 @@ export class DeepAnalysisGate extends Gate {
         const { options } = this.config;
         if (!isCloud(options) || this.config.router?.enabled === false || !options.focusLines)
             return facts;
-        const routed = routeFiles(cwd, facts.map(f => f.path), options.focusLines, options.removedLines, this.config.router, reviewedKeys(cwd));
+        const routed = routeFiles(cwd, facts.map(f => f.path), options.focusLines, options.removedLines, this.config.router, trustedReviews(cwd, options));
         this.outcome.router = routed.stats;
         if (routed.stats.files_skipped > 0) {
             this.config.onProgress?.(`  Router: ${routed.stats.routed} of ${routed.stats.functions} changed function(s) to the model; ${routed.stats.files_skipped} file(s) left to the gates.`);
@@ -302,3 +302,10 @@ async function withTimeout(promise, ms, message) {
         clearTimeout(timer);
     }
 }
+/**
+ * Functions the router may skip as already reviewed: what agents recorded (the ledger and
+ * reviewed.json), unless the run is independent, as an enforcing check is.
+ */
+export function trustedReviews(cwd, options) {
+    return options.independent ? [] : reviewedKeys(cwd);
+}

package/dist/gates/deprecated-dependencies.d.ts

@@ -0,0 +1,27 @@
+import { Gate, type GateContext } from './base.js';
+import type { Failure } from '../types/index.js';
+export interface DeprecatedDependenciesConfig {
+    enabled?: boolean;
+    registry?: string;
+}
+type Fetch = (url: string, init?: {
+    signal?: AbortSignal;
+}) => Promise<{
+    ok: boolean;
+    json(): Promise<any>;
+}>;
+export declare class DeprecatedDependenciesGate extends Gate {
+    private config;
+    private fetchImpl;
+    constructor(config?: DeprecatedDependenciesConfig, fetchImpl?: Fetch);
+    run(context: GateContext): Promise<Failure[]>;
+    /** Deprecation messages for installed versions, from the day's cache and then the registry. */
+    private deprecations;
+    /** The version's deprecation message, null when it is not deprecated, undefined when the registry did not answer. */
+    private lookup;
+}
+/** Installed versions from package-lock.json, else node_modules; names with neither are left out. */
+export declare function installedVersions(cwd: string, names: string[]): Promise<Map<string, string>>;
+/** The package.json line declaring a dependency, so review can tell whether the change touched it. */
+export declare function lineOfDependency(manifestText: string, name: string): number | undefined;
+export {};