@rigour-labs/core 6.5.2 → 6.5.4

package/dist/review/changed-lines.js

@@ -1,5 +1,5 @@
 import { anchorInChangedFunction } from './changed-function-spans.js';
-export function splitByChangedLines(failures, changedLines, spans = {}) {
+export function splitByChangedLines(failures, changedLines, spans = {}, removed = {}) {
     const split = { findings: [], fileFindings: [], contextFindings: [], unlocated: 0, outside: 0 };
     for (const failure of failures) {
         const files = failure.files ?? [];
@@ -12,7 +12,7 @@ export function splitByChangedLines(failures, changedLines, spans = {}) {
             else
                 split.outside++;
         }
-        else if (files.some(file => changedLines[file]?.has(failure.line))) {
+        else if (files.some(file => changedLines[file]?.has(failure.line) || removedInside(failure, removed[file]))) {
             split.findings.push(failure);
         }
         else if (failure.provenance === 'deep-analysis') {
@@ -37,3 +37,13 @@ function placeDeepFinding(failure, files, changedLines, spans, split) {
     else
         split.outside++;
 }
+/**
+ * Whether the change deleted lines inside a multi-line finding (its line to endLine), such as an
+ * option removed from a call whose first line did not change: that call is part of the change.
+ */
+function removedInside(failure, blocks) {
+    const end = failure.endLine;
+    if (!blocks?.length || end === undefined || failure.line === undefined || end <= failure.line)
+        return false;
+    return blocks.some(block => block.line > failure.line && block.line <= end);
+}

package/dist/review/check-outcomes.d.ts

@@ -0,0 +1,32 @@
+/** Outcomes a check needs before it can be muted, and the posterior mean below which it is. */
+export declare const MUTE_MIN_OUTCOMES = 5;
+export declare const MUTE_BELOW = 0.25;
+export interface CheckOutcome {
+    fixed: number;
+    dismissed: number;
+}
+export interface CheckPrecision extends CheckOutcome {
+    check: string;
+    /** Posterior mean of Beta(fixed + 1, dismissed + 1). */
+    precision: number;
+    muted: boolean;
+}
+/** A check is a gate and the rule within it: `ast` alone would mute complexity and parameter count together. */
+export declare function checkId(finding: {
+    id?: string;
+    rule?: string;
+    title?: string;
+}): string;
+export declare function precisionOf(outcome: CheckOutcome): number;
+export declare function isMuted(outcome: CheckOutcome | undefined): boolean;
+/** Outcomes in the working tree, or at `ref` for an independent review (trusted-state.ts). */
+export declare function readOutcomes(cwd: string, ref?: string): Record<string, CheckOutcome>;
+export declare function recordOutcome(cwd: string, check: string, kind: keyof CheckOutcome): void;
+/** Every check with an outcome, most dismissed first. */
+export declare function checkPrecisions(cwd: string): CheckPrecision[];
+/** Remember which check each reported finding key came from (most recent kept). */
+export declare function rememberReported(cwd: string, entries: Array<{
+    key: string;
+    check: string;
+}>): void;
+export declare function reportedCheck(cwd: string, key: string): string | undefined;

package/dist/review/check-outcomes.js

@@ -0,0 +1,90 @@
+/**
+ * How this repository treats each check: findings fixed versus dismissed.
+ *
+ * Every check gets a Beta(fixed + 1, dismissed + 1) posterior, so its mean is
+ * the chance that a finding from it is worth acting on here, and it starts at
+ * an honest 0.5 with no evidence. Advisory checks the team keeps dismissing are
+ * muted once the evidence is clear; proven checks are never muted, because
+ * quiet must not cost correctness.
+ *
+ * Local files under .rigour/: check-outcomes.json (the counts) and
+ * reported-findings.json (which check each recent finding key came from, so a
+ * dismissal by key can be attributed).
+ */
+import fs from 'fs';
+import path from 'path';
+import { readStateFile } from './trusted-state.js';
+const OUTCOMES_FILE = path.join('.rigour', 'check-outcomes.json');
+const REPORTED_FILE = path.join('.rigour', 'reported-findings.json');
+const MAX_REPORTED = 2000;
+/** Outcomes a check needs before it can be muted, and the posterior mean below which it is. */
+export const MUTE_MIN_OUTCOMES = 5;
+export const MUTE_BELOW = 0.25;
+/** A check is a gate and the rule within it: `ast` alone would mute complexity and parameter count together. */
+export function checkId(finding) {
+    const gate = finding.id ?? finding.rule ?? 'unknown';
+    return finding.title?.trim() ? `${gate}: ${finding.title.trim()}` : gate;
+}
+export function precisionOf(outcome) {
+    return (outcome.fixed + 1) / (outcome.fixed + outcome.dismissed + 2);
+}
+export function isMuted(outcome) {
+    if (!outcome)
+        return false;
+    return outcome.fixed + outcome.dismissed >= MUTE_MIN_OUTCOMES && precisionOf(outcome) < MUTE_BELOW;
+}
+/** Outcomes in the working tree, or at `ref` for an independent review (trusted-state.ts). */
+export function readOutcomes(cwd, ref) {
+    if (!ref)
+        return readJson(path.join(cwd, OUTCOMES_FILE)) ?? {};
+    try {
+        return JSON.parse(readStateFile(cwd, OUTCOMES_FILE, ref) ?? '{}');
+    }
+    catch {
+        return {};
+    }
+}
+export function recordOutcome(cwd, check, kind) {
+    const outcomes = readOutcomes(cwd);
+    const current = outcomes[check] ?? { fixed: 0, dismissed: 0 };
+    outcomes[check] = { ...current, [kind]: current[kind] + 1 };
+    writeJson(path.join(cwd, OUTCOMES_FILE), outcomes);
+}
+/** Every check with an outcome, most dismissed first. */
+export function checkPrecisions(cwd) {
+    return Object.entries(readOutcomes(cwd))
+        .map(([check, outcome]) => ({ check, ...outcome, precision: precisionOf(outcome), muted: isMuted(outcome) }))
+        .sort((a, b) => a.precision - b.precision);
+}
+/** Remember which check each reported finding key came from (most recent kept). */
+export function rememberReported(cwd, entries) {
+    if (entries.length === 0)
+        return;
+    const reported = readJson(path.join(cwd, REPORTED_FILE)) ?? {};
+    for (const { key, check } of entries) {
+        delete reported[key];
+        reported[key] = check;
+    }
+    const kept = Object.entries(reported).slice(-MAX_REPORTED);
+    writeJson(path.join(cwd, REPORTED_FILE), Object.fromEntries(kept));
+}
+export function reportedCheck(cwd, key) {
+    return readJson(path.join(cwd, REPORTED_FILE))?.[key];
+}
+function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+function writeJson(file, value) {
+    try {
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, JSON.stringify(value, null, 2) + '\n');
+    }
+    catch {
+        // Learning is best-effort; a read-only checkout still reviews.
+    }
+}

package/dist/review/check-outcomes.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/review/check-outcomes.test.js

@@ -0,0 +1,56 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { checkId, checkPrecisions, isMuted, precisionOf, readOutcomes, recordOutcome, rememberReported } from './check-outcomes.js';
+import { dismissFinding, findingKey, quietSplit } from './quiet.js';
+import { recordReviewOutcome } from './agent-fixes.js';
+let cwd;
+beforeEach(() => { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'outcomes-')); });
+afterEach(() => fs.rmSync(cwd, { recursive: true, force: true }));
+const finding = (id, title, file = 'src/a.ts', details = `${title} here`) => ({ id, title, details, severity: 'low', provenance: 'traditional', files: [file], line: 1 });
+describe('check precision', () => {
+    it('starts at an honest 0.5 and follows the evidence', () => {
+        expect(precisionOf({ fixed: 0, dismissed: 0 })).toBe(0.5);
+        expect(precisionOf({ fixed: 0, dismissed: 8 })).toBe(0.1);
+        expect(precisionOf({ fixed: 8, dismissed: 0 })).toBe(0.9);
+    });
+    it('mutes only on clear evidence: enough outcomes and a low posterior', () => {
+        expect(isMuted({ fixed: 0, dismissed: 3 })).toBe(false);
+        expect(isMuted({ fixed: 0, dismissed: 5 })).toBe(true);
+        expect(isMuted({ fixed: 2, dismissed: 4 })).toBe(false);
+    });
+    it('names a check by gate and rule, so one rule in a gate never mutes its neighbours', () => {
+        expect(checkId(finding('ast', 'Function too complex'))).toBe('ast: Function too complex');
+        expect(checkId({ rule: 'ast' })).toBe('ast');
+    });
+});
+describe('outcomes from real decisions', () => {
+    it('attributes a dismissal by key to the check review reported it from', () => {
+        const f = finding('ast', 'Too many parameters');
+        rememberReported(cwd, [{ key: findingKey(f), check: checkId(f) }]);
+        expect(dismissFinding(cwd, findingKey(f), 'builder needs these')).toBe(true);
+        expect(dismissFinding(cwd, findingKey(f), 'again')).toBe(true);
+        expect(readOutcomes(cwd)).toEqual({ 'ast: Too many parameters': { fixed: 0, dismissed: 1 } });
+    });
+    it('counts a fix an agent made against the check that reported it', () => {
+        fs.mkdirSync(path.join(cwd, 'src'));
+        fs.writeFileSync(path.join(cwd, 'src/a.ts'), 'before\n');
+        recordReviewOutcome(cwd, [finding('semantic-bugs', 'Unbounded read')], ['src/a.ts']);
+        fs.writeFileSync(path.join(cwd, 'src/a.ts'), 'after\n');
+        recordReviewOutcome(cwd, [], ['src/a.ts']);
+        expect(checkPrecisions(cwd)).toEqual([expect.objectContaining({ check: 'semantic-bugs: Unbounded read', fixed: 1, dismissed: 0 })]);
+    });
+});
+describe('quietSplit with precision', () => {
+    it('mutes an advisory check the team keeps dismissing, but never a proven one', () => {
+        for (let i = 0; i < 5; i++) {
+            recordOutcome(cwd, 'ast: Too many parameters', 'dismissed');
+            recordOutcome(cwd, 'security-patterns: Hard-coded secret', 'dismissed');
+        }
+        const split = quietSplit(cwd, [finding('ast', 'Too many parameters'), finding('ast', 'Function too complex'), finding('security-patterns', 'Hard-coded secret')]);
+        expect(split.muted).toBe(1);
+        expect(split.advisory.map(f => f.title)).toEqual(['Function too complex']);
+        expect(split.speaking.map(f => f.title)).toEqual(['Hard-coded secret']);
+    });
+});

package/dist/review/git-diff.d.ts

@@ -3,6 +3,9 @@ export type DiffSource = {
 } | {
     mode: 'base';
     base: string;
+} | {
+    mode: 'since';
+    commit: string;
 };
 export declare class GitDiffError extends Error {
 }

package/dist/review/git-diff.js

@@ -5,6 +5,8 @@
  *   git does not track yet (what an agent has just written).
  * - base: everything on this branch since it left `base` (the merge-base),
  *   including uncommitted changes (what a pull request contains).
+ * - since: everything after `commit`, committed or not, plus untracked files
+ *   (what an agent session wrote, even if it committed along the way).
  */
 import { spawnSync } from 'child_process';
 export class GitDiffError extends Error {
@@ -14,6 +16,9 @@ export function diffFromGit(cwd, source = { mode: 'working' }) {
         const mergeBase = git(cwd, ['merge-base', source.base, 'HEAD']).trim();
         return git(cwd, ['diff', '--no-color', '--no-ext-diff', mergeBase]);
     }
+    if (source.mode === 'since') {
+        return git(cwd, ['diff', '--no-color', '--no-ext-diff', source.commit]) + untrackedFiles(cwd).map(file => newFileDiff(cwd, file)).join('');
+    }
     const tracked = hasHead(cwd) ? git(cwd, ['diff', '--no-color', '--no-ext-diff', 'HEAD']) : '';
     return tracked + untrackedFiles(cwd).map(file => newFileDiff(cwd, file)).join('');
 }

package/dist/review/migration-order.d.ts

@@ -0,0 +1,5 @@
+import type { Config, Failure } from '../types/index.js';
+import type { DiffSource } from './git-diff.js';
+export declare function migrationOrderFailures(cwd: string, diff: string, source: DiffSource | undefined, config: Config): Failure[];
+/** Files a unified diff creates (`--- /dev/null`). */
+export declare function addedFiles(diff: string): string[];

package/dist/review/migration-order.js

@@ -0,0 +1,70 @@
+/**
+ * Migration out of order: a migration the change adds that sorts before the
+ * newest migration already on the base (the base ref, or HEAD for
+ * uncommitted work).
+ *
+ * The Supabase CLI applies migrations in filename order and `db push` stops
+ * at a local migration older than the last one applied, so a branch that
+ * picked an earlier timestamp than main's newest fails or is skipped on any
+ * database main already reached. Only directories listed in
+ * `gates.migration_order.dirs` are checked (Supabase's by default): runners
+ * that track each migration separately, such as Rails, apply older ones fine.
+ */
+import { spawnSync } from 'child_process';
+import path from 'path';
+import micromatch from 'micromatch';
+const GIT_TIMEOUT_MS = 10_000;
+export function migrationOrderFailures(cwd, diff, source, config) {
+    const settings = config.gates.migration_order;
+    if (!settings?.enabled)
+        return [];
+    const base = source?.mode === 'base' ? source.base : source?.mode === 'since' ? source.commit : 'HEAD';
+    const byDirectory = new Map();
+    for (const file of addedFiles(diff)) {
+        const directory = path.posix.dirname(file);
+        if (!file.endsWith('.sql') || !micromatch.isMatch(directory, settings.dirs))
+            continue;
+        byDirectory.set(directory, [...(byDirectory.get(directory) ?? []), file]);
+    }
+    const failures = [];
+    for (const [directory, added] of byDirectory) {
+        const newest = newestOnBase(cwd, base, directory);
+        if (!newest)
+            continue;
+        for (const file of added) {
+            if (path.posix.basename(file) < newest)
+                failures.push(outOfOrder(file, newest, base));
+        }
+    }
+    return failures;
+}
+/** Files a unified diff creates (`--- /dev/null`). */
+export function addedFiles(diff) {
+    const added = [];
+    const lines = diff.split('\n');
+    for (let i = 0; i < lines.length - 1; i++) {
+        if (lines[i] === '--- /dev/null' && lines[i + 1].startsWith('+++ b/'))
+            added.push(lines[i + 1].slice('+++ b/'.length));
+    }
+    return added;
+}
+/** The last .sql file name in `directory` at `base`, or undefined when git cannot say. */
+function newestOnBase(cwd, base, directory) {
+    const result = spawnSync('git', ['ls-tree', '--name-only', base, `${directory}/`], { cwd, encoding: 'utf8', timeout: GIT_TIMEOUT_MS });
+    if (result.status !== 0)
+        return undefined;
+    const names = result.stdout.split('\n').map(line => path.posix.basename(line.trim())).filter(name => name.endsWith('.sql'));
+    return names.sort().at(-1);
+}
+function outOfOrder(file, newest, base) {
+    return {
+        id: 'migration-order',
+        title: 'Migration out of order',
+        details: `\`${path.posix.basename(file)}\` sorts before \`${newest}\`, the newest migration on \`${base}\`. Migrations apply in filename order, so a database that already ran \`${newest}\` stops at or skips this one.`,
+        severity: 'medium',
+        provenance: 'traditional',
+        files: [file],
+        line: 1,
+        hint: `Rename it with a timestamp after \`${newest}\`.`,
+    };
+}

package/dist/review/migration-order.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/review/migration-order.test.js

@@ -0,0 +1,62 @@
+import { execFileSync } from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { ConfigSchema } from '../types/index.js';
+import { diffFromGit } from './git-diff.js';
+import { addedFiles, migrationOrderFailures } from './migration-order.js';
+let repo;
+const git = (...args) => execFileSync('git', ['-C', repo, ...args], { encoding: 'utf8' });
+const write = (rel, body = 'select 1;\n') => {
+    fs.mkdirSync(path.dirname(path.join(repo, rel)), { recursive: true });
+    fs.writeFileSync(path.join(repo, rel), body);
+};
+const commit = (message) => { git('add', '-A'); git('commit', '-qm', message); };
+const config = (enabled = true) => ConfigSchema.parse({ version: 1, gates: { migration_order: { enabled } } });
+const DIR = 'supabase/migrations';
+beforeEach(() => {
+    repo = fs.mkdtempSync(path.join(os.tmpdir(), 'migration-order-'));
+    git('init', '-q', '-b', 'main');
+    git('config', 'user.email', 't@example.com');
+    git('config', 'user.name', 't');
+    git('config', 'commit.gpgsign', 'false');
+    write(`${DIR}/20260101000000_init.sql`);
+    commit('init');
+});
+afterEach(() => fs.rmSync(repo, { recursive: true, force: true }));
+describe('migrationOrderFailures', () => {
+    it('flags a branch migration dated before one main merged since', () => {
+        git('checkout', '-q', '-b', 'feature');
+        write(`${DIR}/20260107000000_feature.sql`);
+        commit('feature');
+        git('checkout', '-q', 'main');
+        write(`${DIR}/20260110000000_main.sql`);
+        commit('main moved');
+        git('checkout', '-q', 'feature');
+        const source = { mode: 'base', base: 'main' };
+        const failures = migrationOrderFailures(repo, diffFromGit(repo, source), source, config());
+        expect(failures).toEqual([expect.objectContaining({
+                id: 'migration-order', files: [`${DIR}/20260107000000_feature.sql`], line: 1,
+            })]);
+        expect(failures[0].details).toContain('20260110000000_main.sql');
+    });
+    it('passes a migration dated after the newest on the base, and uncommitted work against HEAD', () => {
+        write(`${DIR}/20260201000000_next.sql`);
+        expect(migrationOrderFailures(repo, diffFromGit(repo), { mode: 'working' }, config())).toEqual([]);
+        write(`${DIR}/20251231000000_old.sql`);
+        expect(migrationOrderFailures(repo, diffFromGit(repo), { mode: 'working' }, config()).map(f => f.files)).toEqual([[`${DIR}/20251231000000_old.sql`]]);
+    });
+    it('checks only the configured directories, and only when enabled', () => {
+        write('db/migrations/0001_old.sql');
+        write(`${DIR}/20251231000000_old.sql`);
+        expect(migrationOrderFailures(repo, diffFromGit(repo), { mode: 'working' }, config(false))).toEqual([]);
+        expect(migrationOrderFailures(repo, diffFromGit(repo), { mode: 'working' }, config()).map(f => f.files[0])).toEqual([`${DIR}/20251231000000_old.sql`]);
+    });
+});
+describe('addedFiles', () => {
+    it('lists only files the diff creates', () => {
+        const diff = ['--- /dev/null', '+++ b/new.sql', '@@ -0,0 +1 @@', '+x', '--- a/old.sql', '+++ b/old.sql'].join('\n');
+        expect(addedFiles(diff)).toEqual(['new.sql']);
+    });
+});

package/dist/review/quiet.d.ts

@@ -6,11 +6,14 @@ export declare function findingKey(failure: Failure): string;
 export interface QuietSplit {
     speaking: Failure[];
     advisory: Failure[];
+    /** Advisory findings from checks this repository keeps dismissing (check-outcomes.ts); counted, not listed. */
+    muted: number;
     dismissed: number;
     /** Which gates the dismissed findings came from: where Rigour is wrong for this team. */
     dismissedByGate: Record<string, number>;
 }
-export declare function quietSplit(cwd: string, findings: Failure[], includeHeuristics?: boolean): QuietSplit;
-export declare function dismissedKeys(cwd: string): Set<string>;
+/** `trustedRef`: read dismissals and outcomes as of that commit, not as the change left them. */
+export declare function quietSplit(cwd: string, findings: Failure[], includeHeuristics?: boolean, trustedRef?: string): QuietSplit;
+export declare function dismissedKeys(cwd: string, ref?: string): Set<string>;
 /** Record "not a bug" for a finding key; idempotent. */
 export declare function dismissFinding(cwd: string, key: string, reason: string, at?: string): boolean;

package/dist/review/quiet.js

@@ -11,11 +11,15 @@
  * blocking. A team that wants them back sets review.include_heuristics.
  *
  * A finding a person judged "not a bug" is dismissed by its key and never
- * reported again (.rigour/dismissed.json, meant to be committed).
+ * reported again (.rigour/dismissed.json, meant to be committed). An
+ * independent review reads it from the base (trusted-state.ts), so a change
+ * cannot dismiss its own findings.
  */
 import crypto from 'crypto';
 import fs from 'fs';
 import path from 'path';
+import { checkId, isMuted, readOutcomes, recordOutcome, reportedCheck } from './check-outcomes.js';
+import { readStateFile } from './trusted-state.js';
 const PROVEN_GATES = new Set(['semantic-bugs', 'hallucinated-imports', 'security-patterns', 'deep-analysis', 'diff-tests']);
 export const DISMISSED_FILE = path.join('.rigour', 'dismissed.json');
 export function isProven(failure) {
@@ -25,9 +29,11 @@ export function isProven(failure) {
 export function findingKey(failure) {
     return crypto.createHash('sha256').update(`${failure.id}\u0000${failure.files?.[0] ?? ''}\u0000${failure.details}`).digest('hex').slice(0, 16);
 }
-export function quietSplit(cwd, findings, includeHeuristics = false) {
-    const dismissed = dismissedKeys(cwd);
-    const split = { speaking: [], advisory: [], dismissed: 0, dismissedByGate: {} };
+/** `trustedRef`: read dismissals and outcomes as of that commit, not as the change left them. */
+export function quietSplit(cwd, findings, includeHeuristics = false, trustedRef) {
+    const dismissed = dismissedKeys(cwd, trustedRef);
+    const outcomes = readOutcomes(cwd, trustedRef);
+    const split = { speaking: [], advisory: [], muted: 0, dismissed: 0, dismissedByGate: {} };
     for (const finding of findings) {
         if (dismissed.has(findingKey(finding))) {
             split.dismissed++;
@@ -35,14 +41,16 @@ export function quietSplit(cwd, findings, includeHeuristics = false) {
         }
         else if (includeHeuristics || isProven(finding))
             split.speaking.push(finding);
+        else if (isMuted(outcomes[checkId(finding)]))
+            split.muted++;
         else
             split.advisory.push(finding);
     }
     return split;
 }
-export function dismissedKeys(cwd) {
+export function dismissedKeys(cwd, ref) {
     try {
-        const parsed = JSON.parse(fs.readFileSync(path.join(cwd, DISMISSED_FILE), 'utf8'));
+        const parsed = JSON.parse(readStateFile(cwd, DISMISSED_FILE, ref) ?? '');
         return new Set(Array.isArray(parsed?.entries) ? parsed.entries.map((e) => e?.key).filter((k) => typeof k === 'string') : []);
     }
     catch {
@@ -63,8 +71,13 @@ export function dismissFinding(cwd, key, reason, at = new Date().toISOString())
     catch {
         // First dismissal in this repository.
     }
-    if (!entries.some(e => e.key === key))
-        entries.push({ key, reason: reason.trim(), at });
+    if (entries.some(e => e.key === key))
+        return true;
+    // The check this key came from (remembered when review reported it) feeds its precision.
+    const check = reportedCheck(cwd, key);
+    entries.push({ key, reason: reason.trim(), at, ...(check ? { check } : {}) });
+    if (check)
+        recordOutcome(cwd, check, 'dismissed');
     fs.mkdirSync(path.dirname(file), { recursive: true });
     fs.writeFileSync(file, JSON.stringify({ version: 1, entries }, null, 2) + '\n');
     return true;

package/dist/review/review.d.ts

@@ -12,6 +12,8 @@ export interface ReviewInput {
     diffTests?: boolean;
     /** Deep analysis; `focusLines` and `removedLines` are filled from the diff. */
     deep?: Omit<DeepOptions, 'focusLines' | 'removedLines' | 'diff'>;
+    /** Read dismissals and check outcomes at this commit (the base), not as the change left them. */
+    trustedRef?: string;
 }
 export interface ReviewResult {
     status: 'PASS' | 'FAIL' | 'ERROR';
@@ -21,6 +23,8 @@ export interface ReviewResult {
     contextFindings: Failure[];
     /** Heuristic findings on changed lines: returned on request, never deciding the verdict (quiet.ts). */
     advisory: Failure[];
+    /** Advisory findings from checks this repository keeps dismissing: counted, not listed. */
+    muted: number;
     /** Findings a person dismissed as not a bug, and the gates they came from. */
     dismissed: number;
     dismissedByGate: Record<string, number>;
@@ -31,6 +35,8 @@ export interface ReviewResult {
     deepError?: string;
     /** Gates that crashed instead of running; a proven one makes the result ERROR. */
     gateErrors: string[];
+    /** rigour.yml or .rigour/ files this change edits: they steer the review, so they are called out. */
+    controlFilesChanged: string[];
 }
 export interface ReviewFinding {
     id: string;

package/dist/review/review.js

@@ -15,28 +15,34 @@ import { splitByChangedLines } from './changed-lines.js';
 import { changedFunctionSpans } from './changed-function-spans.js';
 import { withoutGenerated } from './generated-files.js';
 import { findingKey, isProven, quietSplit } from './quiet.js';
+import { checkId, rememberReported } from './check-outcomes.js';
 import { diffFromGit } from './git-diff.js';
 import { diffTestFailures } from './diff-test-findings.js';
+import { migrationOrderFailures } from './migration-order.js';
+import { isControlFile } from './trusted-state.js';
 export async function reviewChange(input) {
     const diff = input.diff ?? diffFromGit(input.cwd, input.source);
     const changedLines = withoutGenerated(input.cwd, parseDiff(diff));
     const targets = input.files?.length ? input.files : Object.keys(changedLines);
     if (targets.length === 0) {
-        return { status: 'PASS', findings: [], fileFindings: [], contextFindings: [], advisory: [], dismissed: 0, dismissedByGate: {}, unlocated: 0, excludedOutsideChangedLines: 0, changedLines, report: null, gateErrors: [] };
+        return { status: 'PASS', findings: [], fileFindings: [], contextFindings: [], advisory: [], muted: 0, dismissed: 0, dismissedByGate: {}, unlocated: 0, excludedOutsideChangedLines: 0, changedLines, report: null, gateErrors: [], controlFilesChanged: controlFiles(diff) };
     }
     const deep = input.deep ? { ...input.deep, focusLines: changedLinesByFile(changedLines), removedLines: removedByFile(diff), diff } : undefined;
     const report = await new GateRunner(input.config).run(input.cwd, await normalizeScopePatterns(input.cwd, targets), deep);
     if (input.diffTests && deep)
         report.failures.push(...await diffTestFailures(input.cwd, input.source, deep));
-    const split = splitByChangedLines(report.failures, changedLines, deep ? changedFunctionSpans(input.cwd, changedLines) : {});
+    report.failures.push(...migrationOrderFailures(input.cwd, diff, input.source, input.config));
+    const split = splitByChangedLines(report.failures, changedLines, deep ? changedFunctionSpans(input.cwd, changedLines) : {}, removedByFile(diff));
     const deepError = deepAnalysisError(report);
-    const quiet = quietSplit(input.cwd, split.findings, input.config.review?.include_heuristics);
+    const quiet = quietSplit(input.cwd, split.findings, input.config.review?.include_heuristics, input.trustedRef);
+    rememberReported(input.cwd, [...quiet.speaking, ...quiet.advisory].map(f => ({ key: findingKey(f), check: checkId(f) })));
     const gateErrors = crashedGates(report);
     const provenCrashed = gateErrors.some(id => isProven({ id }));
     return {
         status: deepError || provenCrashed ? 'ERROR' : quiet.speaking.length > 0 ? 'FAIL' : 'PASS',
         findings: quiet.speaking,
         advisory: quiet.advisory,
+        muted: quiet.muted,
         dismissed: quiet.dismissed,
         dismissedByGate: quiet.dismissedByGate,
         fileFindings: split.fileFindings,
@@ -46,9 +52,20 @@ export async function reviewChange(input) {
         changedLines,
         report,
         gateErrors,
+        controlFilesChanged: controlFiles(diff),
         ...(deepError ? { deepError } : {}),
     };
 }
+/** Every path the diff touches (including deletions, which parseDiff drops) that steers Rigour itself. */
+function controlFiles(diff) {
+    const files = new Set();
+    for (const match of diff.matchAll(/^diff --git a\/(\S+) b\/(\S+)$/gm)) {
+        for (const file of [match[1], match[2]])
+            if (isControlFile(file))
+                files.add(file);
+    }
+    return [...files].sort();
+}
 function crashedGates(report) {
     return Object.entries(report.summary).filter(([, status]) => status === 'ERROR').map(([id]) => id);
 }

package/dist/review/review.test.js

@@ -10,6 +10,7 @@ import { splitByChangedLines } from './changed-lines.js';
 import { anchorInChangedFunction, changedFunctionSpans } from './changed-function-spans.js';
 import { diffFromGit } from './git-diff.js';
 import { reviewChange, toReviewFinding } from './review.js';
+import { findingKey } from './quiet.js';
 const LEAKY = [
     'export async function notify(endpoint: string, signature: string) {',
     "  return fetch(endpoint, { method: 'POST', headers: { 'x-hook-signature': signature } });",
@@ -37,6 +38,17 @@ describe('splitByChangedLines', () => {
         expect(split.contextFindings.map(f => f.line)).toEqual([30]); // elsewhere in a changed file: shown, not blocking
         expect(split.outside).toBe(1); // a rule finding on an unchanged line is pre-existing, as before
     });
+    it('counts a multi-line finding as changed when lines inside it were deleted', () => {
+        // fetch(url, {      <- line 4, unchanged
+        //   redirect: ...   <- deleted, so the removal sits before new line 5
+        // })                <- line 5
+        const call = { ...failure('a.ts', 4), endLine: 5 };
+        const outsideCall = { ...failure('a.ts', 9), endLine: 10 };
+        const removed = { 'a.ts': [{ line: 5, text: ["  redirect: 'manual',"] }] };
+        const split = splitByChangedLines([call, outsideCall, failure('a.ts', 4)], {}, {}, removed);
+        expect(split.findings).toEqual([call]);
+        expect(split.outside).toBe(2);
+    });
 });
 describe('changedFunctionSpans', () => {
     it('spans the outermost function around changed lines, and anchors to the nearest changed line in it', () => {
@@ -103,6 +115,24 @@ describe('git-backed review', () => {
         expect(semantic.map(f => [f.files?.[0], f.line])).toEqual([['src/notify.ts', 2]]);
         expect(toReviewFinding(semantic[0])).toMatchObject({ id: 'semantic-bugs', file: 'src/notify.ts', line: 2, severity: 'high' });
     });
+    it('lets a change dismiss its own finding only when the review trusts the working tree', async () => {
+        write('src/old.ts', 'export const a = 1;\n');
+        write('.gitignore', '.rigour/*\n!.rigour/dismissed.json\n');
+        git('add', '-A');
+        git('commit', '-qm', 'init');
+        git('checkout', '-q', '-b', 'pr');
+        write('src/notify.ts', LEAKY);
+        const config = ConfigSchema.parse({ version: 1, gates: { semantic_bugs: { enabled: true } } });
+        const key = findingKey((await reviewChange({ cwd: repo, config })).findings[0]);
+        write('.rigour/dismissed.json', JSON.stringify({ version: 1, entries: [{ key, reason: 'trust me', at: 'now' }] }));
+        git('add', '-A');
+        git('commit', '-qm', 'pr');
+        const trusting = await reviewChange({ cwd: repo, config, source: { mode: 'base', base: 'main' } });
+        expect([trusting.status, trusting.dismissed]).toEqual(['PASS', 1]);
+        expect(trusting.controlFilesChanged).toEqual(['.rigour/dismissed.json']);
+        const independent = await reviewChange({ cwd: repo, config, source: { mode: 'base', base: 'main' }, trustedRef: 'main' });
+        expect([independent.status, independent.dismissed]).toEqual(['FAIL', 0]);
+    });
     it('runs every gate in a git worktree, where .git is a file', async () => {
         write('src/a.ts', 'export const a = 1;\n');
         git('add', '-A');

package/dist/review/trusted-state.d.ts

@@ -0,0 +1,6 @@
+/** Paths that steer Rigour itself; a change touching them is called out in the review. */
+export declare function isControlFile(file: string): boolean;
+/** A repository file's content at `ref`, or in the working tree when no ref is given; null when absent. */
+export declare function readStateFile(cwd: string, rel: string, ref?: string): string | null;
+/** The commit a branch left `base` at: the state a pull request is judged against. */
+export declare function mergeBaseOf(cwd: string, base: string): string;