@rigour-labs/core 6.6.4 → 6.6.6

package/dist/gates/frontend-secret-exposure.d.ts

@@ -54,5 +54,5 @@ export declare class FrontendSecretExposureGate extends Gate {
     private isDummyValue;
     private toFailures;
 }
-/** Imports a Node-only module: server code, whatever its path. */
+/** Imports a Node-only module (a built-in, or a package that spawns processes): server code, whatever its path. */
 export declare function importsNodeBuiltins(content: string): boolean;

package/dist/gates/frontend-secret-exposure.js

@@ -66,8 +66,14 @@ export class FrontendSecretExposureGate extends Gate {
                 // Any tool config at the repository root runs in Node, never in a browser bundle.
                 '^[^/]+\\.config\\.[cm]?[jt]s$',
                 '\\.server\\.(?:ts|tsx|js|jsx|mjs|cjs)$',
-                // SvelteKit endpoints (`+server.ts`) are server-only.
+                // SvelteKit endpoints (`+server.ts`) and `src/lib/server/` are server-only.
                 '(^|/)\\+server\\.[cm]?[jt]s$',
+                '(^|/)src/lib/server/',
+                // Serverless functions and workers run on the platform, never in a browser bundle.
+                '(^|/)netlify/(?:functions|edge-functions)/',
+                '(^|/)supabase/functions/',
+                '^api/',
+                '(^|/)(?:functions|lambdas?|workers?|cron|jobs)/',
                 ...(config.server_path_patterns ?? []),
             ],
             allowlist_env_names: config.allowlist_env_names ?? [],
@@ -254,8 +260,8 @@ export class FrontendSecretExposureGate extends Gate {
         return failures;
     }
 }
-const NODE_BUILTINS = /(?:from\s+|require\(\s*|import\(\s*)['"](?:node:[\w/]+|fs|fs\/promises|fs-extra|child_process|os|net|tls|worker_threads|cluster|module)['"]/;
-/** Imports a Node-only module: server code, whatever its path. */
+const NODE_BUILTINS = /(?:from\s+|require\(\s*|import\(\s*)['"](?:node:[\w/]+|fs|fs\/promises|fs-extra|child_process|os|net|tls|worker_threads|cluster|module|execa|cross-spawn)['"]/;
+/** Imports a Node-only module (a built-in, or a package that spawns processes): server code, whatever its path. */
 export function importsNodeBuiltins(content) {
     return NODE_BUILTINS.test(content);
 }

package/dist/gates/frontend-secret-exposure.test.js

@@ -40,15 +40,18 @@ describe('FrontendSecretExposureGate', () => {
     });
     it('treats a file outside frontend paths that imports Node built-ins as server code', async () => {
         const cli = path.join(testDir, 'packages/cli/src/commands/post.ts');
+        const spawner = path.join(testDir, 'packages/core/src/exec.ts');
         const shared = path.join(testDir, 'packages/shared/src/config.ts');
         const component = path.join(testDir, 'src/components/Admin.tsx');
-        for (const file of [cli, shared, component])
+        for (const file of [cli, spawner, shared, component])
             fs.mkdirSync(path.dirname(file), { recursive: true });
         fs.writeFileSync(cli, "import { execFileSync } from 'child_process';\nexport const token = process.env.GITHUB_TOKEN;\n");
+        fs.writeFileSync(spawner, "import { execa } from 'execa';\nexport const env = { GH_TOKEN: process.env.GH_TOKEN };\n");
         fs.writeFileSync(shared, 'export const token = process.env.GITHUB_TOKEN;\n');
         fs.writeFileSync(component, "import fs from 'node:fs';\nexport const key = process.env.STRIPE_SECRET_KEY;\n");
         const files = (await new FrontendSecretExposureGate().run({ cwd: testDir })).flatMap(f => f.files ?? []);
         expect(files).not.toContain('packages/cli/src/commands/post.ts'); // Node-only: never bundled
+        expect(files).not.toContain('packages/core/src/exec.ts'); // a package that spawns processes is Node-only too
         expect(files).toContain('packages/shared/src/config.ts'); // could be bundled: still flagged
         expect(files).toContain('src/components/Admin.tsx'); // a frontend path stays frontend
     });

package/dist/hooks/index.d.ts

@@ -14,6 +14,6 @@ export { recordDLPFeedback, allowLastDLPBlock, writeDLPBlockManifest, getLearned
 export type { DLPFeedbackEntry, DLPFeedbackStore, DLPBlockManifest } from './dlp-feedback.js';
 export { generateDLPHookFiles } from './dlp-templates.js';
 export type { GeneratedDLPHookFile } from './dlp-templates.js';
-export { stopReview, stopMessage, blocksStop, STOP_MAX_ATTEMPTS } from './stop-review.js';
+export { stopReview, stopMessage, STOP_MAX_ATTEMPTS } from './stop-review.js';
 export type { StopDecision } from './stop-review.js';
 export { recordSessionBaseline, sessionBaseline, nextStopAttempt, clearStopAttempts, workFingerprint, alreadyReviewed, recordReviewed } from './session-state.js';

package/dist/hooks/index.js

@@ -10,5 +10,5 @@ export { scanInputForCredentials, formatDLPAlert, createDLPAuditEntry } from './
 export { recordDLPFeedback, allowLastDLPBlock, writeDLPBlockManifest, getLearnedAllowCount, loadDLPFeedbackStore, loadDLPFeedbackStoreSync, fingerprintDetection, } from './dlp-feedback.js';
 export { generateDLPHookFiles } from './dlp-templates.js';
 // Stop review ("before you say done")
-export { stopReview, stopMessage, blocksStop, STOP_MAX_ATTEMPTS } from './stop-review.js';
+export { stopReview, stopMessage, STOP_MAX_ATTEMPTS } from './stop-review.js';
 export { recordSessionBaseline, sessionBaseline, nextStopAttempt, clearStopAttempts, workFingerprint, alreadyReviewed, recordReviewed } from './session-state.js';

package/dist/hooks/stop-review.d.ts

@@ -6,13 +6,12 @@
  * letting it finish. A review with nothing to look at says so; it is never
  * reported as a clean pass.
  *
- * Only findings that deserve it block: critical ones, high ones that are proven
- * (the semantic engine traced them) or security findings, findings the change added that are
- * certain from the code alone (MUST_FIX: dead code, offset paging, an unbounded window, a
- * duplicate function), and on a branch a merge conflict with main or a mention of a file the
- * branch deleted (review/branch-checks.ts).
- * A high heuristic (a regex that sees `fetch` without `.catch`) is not enough to
- * hold an agent back; callers also cap the number of attempts.
+ * What blocks is what the review itself reports (review/quiet.ts `mustFix`: proven, critical, or
+ * high and verified or from a security gate), plus on a branch a merge conflict with main or a
+ * mention of a file the branch deleted (review/branch-checks.ts). The same rule decides the push
+ * gate, so a stop, a review and a push never disagree about a finding. A high heuristic (a regex
+ * that sees `fetch` without `.catch`) is not enough to hold an agent back; callers also cap the
+ * number of attempts.
  */
 import type { Config, Failure } from '../types/index.js';
 import { type ReviewTaskItem } from '../review/review-task.js';
@@ -31,6 +30,4 @@ export interface StopDecision {
 /** `sessionBaseline`: the commit the session started from, used on main (session-state.ts). */
 export declare function stopReview(cwd: string, config: Config, attempt: number, sessionBaseline?: string): Promise<StopDecision>;
 export declare function reviewAckMessage(items: ReviewTaskItem[], attempt: number): string;
-/** Critical; high and either proven by the semantic engine or a security finding; or a certain, local finding the change added (MUST_FIX). */
-export declare function blocksStop(finding: Failure): boolean;
 export declare function stopMessage(findings: Failure[], attempt: number): string;

package/dist/hooks/stop-review.js

@@ -22,7 +22,11 @@ export async function stopReview(cwd, config, attempt, sessionBaseline) {
     const result = await reviewChange({ cwd, config, diff, source });
     const branch = branchBase(cwd);
     const whole = branch && !branch.onMain ? branchFailures(cwd, branch.base, branch.mainRef, config) : [];
-    const blocking = [...result.findings.filter(blocksStop), ...whole];
+    // A check that could not run is never a pass; the attempt cap keeps a broken environment from looping forever.
+    const crashed = result.status === 'ERROR'
+        ? result.gateErrors.map(id => ({ id, title: 'A check could not run', details: id === 'typed-checks-unavailable' && result.typedError ? result.typedError : `${id} crashed instead of running`, severity: 'high', files: [], hint: 'Fix the environment (dependencies, generated config), then try again.' }))
+        : [];
+    const blocking = [...result.findings, ...whole, ...crashed];
     const unreviewed = config.hooks?.require_review_ack ? buildReviewTask(cwd, diff, config.gates.deep?.router).items : [];
     const reviewed = { findings: result.findings, reviewedFiles: Object.keys(result.changedLines), against };
     if (blocking.length === 0 && unreviewed.length === 0)
@@ -41,15 +45,6 @@ export function reviewAckMessage(items, attempt) {
         ...listed,
     ].join('\n');
 }
-/** Certain from the code alone, and quick to fix (each measured with no false alarms before it blocks). */
-const MUST_FIX = new Set(['unused-export', 'orphan-file', 'offset-paging', 'unbounded-window', 'duplicate-function']);
-/** Critical; high and either proven by the semantic engine or a security finding; or a certain, local finding the change added (MUST_FIX). */
-export function blocksStop(finding) {
-    const severity = (finding.severity || 'medium');
-    if (severity === 'critical' || MUST_FIX.has(finding.id))
-        return true;
-    return severity === 'high' && (finding.verified === true || finding.provenance === 'security');
-}
 export function stopMessage(findings, attempt) {
     const listed = findings.slice(0, MAX_LISTED).map(f => {
         const where = `${f.files?.[0] ?? '?'}:${f.line ?? '?'}`;

package/dist/index.d.ts

@@ -15,14 +15,17 @@ export { rigourUserDir, repoStateDir } from './utils/user-state.js';
 export { reviewChange, toReviewFinding, type ReviewInput, type ReviewResult, type ReviewFinding } from './review/review.js';
 export { splitByChangedLines, type ChangedLineSplit } from './review/changed-lines.js';
 export { isControlFile, mergeBaseOf, readStateFile } from './review/trusted-state.js';
-export { dismissFinding, dismissedKeys, findingKey, isProven, quietSplit, DISMISSED_FILE } from './review/quiet.js';
+export { dismissFinding, dismissedKeys, findingKey, isProven, mustFix, quietSplit, DISMISSED_FILE } from './review/quiet.js';
+export { loadLedger, ledgerProblems, runBacktest, backtestPassed, formatBacktest, LEDGER_PATH, type Ledger, type RoundResult } from './review/backtest.js';
+export { scaffoldLedger } from './review/backtest-init.js';
 export { isGeneratedFile } from './review/generated-files.js';
 export { countUsage, durationBucket, flushDailyUsage, isTelemetryEnabled, readTelemetryState, setTelemetryEnabled, shouldAskTelemetry, telemetryToken, trackUsage } from './telemetry/telemetry.js';
 export { buildReviewTask, type ReviewTask, type ReviewTaskItem } from './review/review-task.js';
 export { buildQualityReceipt, receiptReport, type QualityReceipt, type ReceiptGap, type ReceiptOptions } from './review/receipt.js';
 export { runToolchain, type ToolResult, type ToolStatus } from './review/toolchain.js';
 export { branchFailures, mergeConflicts, staleReferences } from './review/branch-checks.js';
-export { runReviewer, reviewerBlocks, type ReviewerResult, type ReviewerVerdict } from './review/reviewer.js';
+export { runReviewer, reviewerBlocks, itemLine, type ReviewerOptions, type ReviewerResult, type ReviewerOutcome, type OpenItem } from './review/reviewer.js';
+export { startBackgroundReview, backgroundReview, reviewStatus, type ReviewStatus } from './review/reviewer/background.js';
 export { branchBase, type BranchBase } from './gates/logic-drift-git-base.js';
 export { acknowledgeReview, type ReviewAck, type AckResult } from './review/review-ack.js';
 export { exportReviewed, readLedger, reviewedKeys, isReviewed, recordReview, REVIEWED_FILE, type LedgerEntry, type ReviewedKey, type ReviewVerdict } from './review/ledger.js';

package/dist/index.js

@@ -15,14 +15,17 @@ export { rigourUserDir, repoStateDir } from './utils/user-state.js';
 export { reviewChange, toReviewFinding } from './review/review.js';
 export { splitByChangedLines } from './review/changed-lines.js';
 export { isControlFile, mergeBaseOf, readStateFile } from './review/trusted-state.js';
-export { dismissFinding, dismissedKeys, findingKey, isProven, quietSplit, DISMISSED_FILE } from './review/quiet.js';
+export { dismissFinding, dismissedKeys, findingKey, isProven, mustFix, quietSplit, DISMISSED_FILE } from './review/quiet.js';
+export { loadLedger, ledgerProblems, runBacktest, backtestPassed, formatBacktest, LEDGER_PATH } from './review/backtest.js';
+export { scaffoldLedger } from './review/backtest-init.js';
 export { isGeneratedFile } from './review/generated-files.js';
 export { countUsage, durationBucket, flushDailyUsage, isTelemetryEnabled, readTelemetryState, setTelemetryEnabled, shouldAskTelemetry, telemetryToken, trackUsage } from './telemetry/telemetry.js';
 export { buildReviewTask } from './review/review-task.js';
 export { buildQualityReceipt, receiptReport } from './review/receipt.js';
 export { runToolchain } from './review/toolchain.js';
 export { branchFailures, mergeConflicts, staleReferences } from './review/branch-checks.js';
-export { runReviewer, reviewerBlocks } from './review/reviewer.js';
+export { runReviewer, reviewerBlocks, itemLine } from './review/reviewer.js';
+export { startBackgroundReview, backgroundReview, reviewStatus } from './review/reviewer/background.js';
 export { branchBase } from './gates/logic-drift-git-base.js';
 export { acknowledgeReview } from './review/review-ack.js';
 export { exportReviewed, readLedger, reviewedKeys, isReviewed, recordReview, REVIEWED_FILE } from './review/ledger.js';

package/dist/review/backtest-init.d.ts

@@ -0,0 +1,8 @@
+import type { Config } from '../types/index.js';
+import { type LedgerRound } from './backtest.js';
+import { type Exec } from './reviewer.js';
+export declare function scaffoldLedger(cwd: string, pr: number, config: Config, exec?: Exec): Promise<{
+    file: string;
+    rounds: LedgerRound[];
+    incomplete: number;
+}>;

package/dist/review/backtest-init.js

@@ -0,0 +1,87 @@
+/**
+ * `rigour backtest init --pr <n>`: a ledger scaffolded from a pull request's human reviews, one
+ * round per review. An inline comment gives a point its file and a line window for free; a point
+ * made in the review's body has neither, so it is written with `needs` set and a person adds the
+ * text pattern once. The base of each round is the main branch as it was when the review was
+ * posted, so a later merge does not change what the round measures.
+ */
+import fs from 'fs';
+import path from 'path';
+import { branchBase } from '../gates/logic-drift-git-base.js';
+import { LEDGER_PATH, LedgerSchema } from './backtest.js';
+import { defaultExec, githubEnv, parseJsonArrays } from './reviewer.js';
+const GH_TIMEOUT_MS = 60_000;
+/** Lines either side of an inline comment that a finding for the same point may land on. */
+const LINE_SLACK = 10;
+const BULLET = /^\s*(?:[-*]|\d+[.)])\s+(.{8,})$/;
+export async function scaffoldLedger(cwd, pr, config, exec = defaultExec) {
+    const env = await githubEnv(cwd, config.review?.github_account ?? process.env.RIGOUR_GITHUB_ACCOUNT, exec);
+    const gh = (args) => exec('gh', args, { cwd, timeoutMs: GH_TIMEOUT_MS, env });
+    const view = await gh(['pr', 'view', String(pr), '--json', 'author', '-q', '.author.login']);
+    if (view.exitCode !== 0)
+        throw new Error(`could not read pull request ${pr}: ${view.stderr.trim() || 'is gh signed in?'}`);
+    const author = view.stdout.trim();
+    const reviews = await gh(['api', `repos/{owner}/{repo}/pulls/${pr}/reviews`, '--paginate']);
+    if (reviews.exitCode !== 0)
+        throw new Error(`could not read the reviews of pull request ${pr}: ${reviews.stderr.trim()}`);
+    const humans = parseJsonArrays(reviews.stdout)
+        .filter((r) => r?.user && r.user.type !== 'Bot' && !/bot/i.test(r.user.login) && r.user.login !== author && (r.body?.trim() || r.state === 'CHANGES_REQUESTED'));
+    if (humans.length === 0)
+        throw new Error(`pull request ${pr} has no review by a person yet`);
+    const mainRef = branchBase(cwd)?.mainRef ?? 'origin/main';
+    const rounds = [];
+    for (const [index, review] of humans.entries()) {
+        const comments = await gh(['api', `repos/{owner}/{repo}/pulls/${pr}/reviews/${review.id}/comments`, '--paginate']);
+        const inline = comments.exitCode === 0 ? parseJsonArrays(comments.stdout) : [];
+        const round = index + 1;
+        const points = inline.map((c, i) => inlinePoint(`R${round}-${i + 1}`, c));
+        for (const [i, line] of bodyPoints(String(review.body ?? '')).entries()) {
+            points.push({ id: `R${round}-B${i + 1}`, point: line, file: '', needs: 'a file pattern and a text pattern (this point was made in the review body, not on a line)' });
+        }
+        const base = await exec('git', ['rev-list', '-1', `--before=${review.submitted_at}`, mainRef], { cwd, timeoutMs: GH_TIMEOUT_MS });
+        rounds.push({
+            id: `pr${pr}-r${round}`,
+            commit: String(review.commit_id),
+            base: base.stdout.trim() || mainRef,
+            reviewed_at: String(review.submitted_at),
+            pr,
+            points,
+            must_not_flag: [],
+        });
+    }
+    const file = path.join(cwd, LEDGER_PATH);
+    const existing = existingLedger(file);
+    const merged = { rounds: [...existing.rounds.filter(r => !rounds.some(n => n.id === r.id)), ...rounds] };
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(merged, null, 2) + '\n');
+    return { file, rounds, incomplete: rounds.flatMap(r => r.points).filter(p => p.needs).length };
+}
+function inlinePoint(id, comment) {
+    const line = Number(comment.line ?? comment.original_line ?? 0);
+    const body = String(comment.body ?? '').trim();
+    return {
+        id,
+        point: firstLine(body),
+        file: escape(String(comment.path ?? '')),
+        ...(line > 0 ? { lines: [Math.max(1, line - LINE_SLACK), line + LINE_SLACK] } : { needs: 'a line window or a text pattern (the comment has no line)' }),
+    };
+}
+/** The bullet and numbered lines of a review body: the points a reviewer makes outside any one line. */
+function bodyPoints(body) {
+    return body.split('\n').map(l => BULLET.exec(l)?.[1]).filter((l) => !!l).map(firstLine);
+}
+function firstLine(text) {
+    const line = text.split('\n').find(l => l.trim())?.replace(/[*_`#]/g, '').trim() ?? '';
+    return line.length > 140 ? `${line.slice(0, 137)}...` : line;
+}
+function escape(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function existingLedger(file) {
+    if (!fs.existsSync(file))
+        return { rounds: [] };
+    const parsed = LedgerSchema.safeParse(JSON.parse(fs.readFileSync(file, 'utf8')));
+    if (!parsed.success)
+        throw new Error(`${LEDGER_PATH} exists but is not a ledger; fix or remove it first`);
+    return parsed.data;
+}

package/dist/review/backtest-init.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/review/backtest-init.test.js

@@ -0,0 +1,74 @@
+import { execFileSync } from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { ConfigSchema } from '../types/index.js';
+import { ledgerProblems, loadLedger, LEDGER_PATH, LedgerSchema } from './backtest.js';
+import { scaffoldLedger } from './backtest-init.js';
+let repo;
+const git = (...args) => execFileSync('git', ['-C', repo, ...args], { encoding: 'utf8' }).trim();
+const config = ConfigSchema.parse({ version: 1 });
+const REVIEWS = [
+    { id: 1, user: { login: 'ci-bot', type: 'Bot' }, body: 'automated', state: 'COMMENTED', submitted_at: '2026-04-12T10:00:00Z', commit_id: 'c1c1c1c1c1' },
+    { id: 2, user: { login: 'senior', type: 'User' }, body: '## Review\n\n- A retry posts the invoice twice.\n- **Quadratic** scan in `latestPayment`.\nlooks good otherwise', state: 'CHANGES_REQUESTED', submitted_at: '2026-04-12T12:00:00Z', commit_id: 'c2c2c2c2c2' },
+];
+const INLINE = [
+    { path: 'src/lib/server/invoices.ts', line: 40, body: 'The export reads every line item for ids.\n\nNarrow it.', created_at: '2026-04-12T12:00:00Z' },
+    { path: 'src/checkout/total.ts', line: null, original_line: null, body: 'Drops the currency', created_at: '2026-04-12T12:00:00Z' },
+];
+function fakeExec(calls) {
+    return async (command, args, options) => {
+        calls.push([command, ...args]);
+        if (command === 'git')
+            return { exitCode: 0, stdout: execFileSync('git', args, { cwd: options.cwd, encoding: 'utf8' }), stderr: '' };
+        if (args[0] === 'auth')
+            return { exitCode: 0, stdout: 'token\n', stderr: '' };
+        if (args[0] === 'pr')
+            return { exitCode: 0, stdout: 'author\n', stderr: '' };
+        if (args[1].endsWith('/reviews'))
+            return { exitCode: 0, stdout: JSON.stringify(REVIEWS), stderr: '' };
+        return { exitCode: 0, stdout: JSON.stringify(INLINE), stderr: '' };
+    };
+}
+beforeEach(() => {
+    repo = fs.mkdtempSync(path.join(os.tmpdir(), 'backtest-init-'));
+    git('init', '-q', '-b', 'main');
+    git('config', 'user.email', 't@example.com');
+    git('config', 'user.name', 't');
+    git('config', 'commit.gpgsign', 'false');
+    fs.writeFileSync(path.join(repo, 'a.ts'), 'export const a = 1;\n');
+    git('add', '-A');
+    execFileSync('git', ['-C', repo, 'commit', '-qm', 'main as of the review'], { env: { ...process.env, GIT_COMMITTER_DATE: '2026-04-12T09:00:00Z', GIT_AUTHOR_DATE: '2026-04-12T09:00:00Z' } });
+});
+afterEach(() => { fs.rmSync(repo, { recursive: true, force: true }); });
+describe('rigour backtest init', () => {
+    it('writes one round per human review: inline comments become file-and-window points, body bullets need a pattern', async () => {
+        const calls = [];
+        const mainAtReview = git('rev-parse', 'HEAD');
+        const { rounds, incomplete } = await scaffoldLedger(repo, 212, config, fakeExec(calls));
+        expect(rounds).toHaveLength(1);
+        expect(rounds[0]).toMatchObject({ id: 'pr212-r1', commit: 'c2c2c2c2c2', base: mainAtReview, reviewed_at: '2026-04-12T12:00:00Z', pr: 212 });
+        expect(rounds[0].points).toEqual([
+            { id: 'R1-1', point: 'The export reads every line item for ids.', file: 'src/lib/server/invoices\\.ts', lines: [30, 50] },
+            { id: 'R1-2', point: 'Drops the currency', file: 'src/checkout/total\\.ts', needs: 'a line window or a text pattern (the comment has no line)' },
+            { id: 'R1-B1', point: 'A retry posts the invoice twice.', file: '', needs: 'a file pattern and a text pattern (this point was made in the review body, not on a line)' },
+            { id: 'R1-B2', point: 'Quadratic scan in latestPayment.', file: '', needs: 'a file pattern and a text pattern (this point was made in the review body, not on a line)' },
+        ]);
+        expect(incomplete).toBe(3);
+        expect(calls.find(c => c[0] === 'gh' && c[1] === 'pr')).toContain('212');
+        const written = LedgerSchema.parse(JSON.parse(fs.readFileSync(path.join(repo, LEDGER_PATH), 'utf8')));
+        expect(ledgerProblems(written)).toHaveLength(3);
+        expect(() => loadLedger(repo)).toThrow('rows a person still has to complete');
+    });
+    it('keeps rounds already in the ledger and replaces its own', async () => {
+        fs.mkdirSync(path.join(repo, '.rigour'));
+        fs.writeFileSync(path.join(repo, LEDGER_PATH), JSON.stringify({ rounds: [
+                { id: 'pr212-r1', commit: 'old0000', base: 'main', points: [], must_not_flag: [] },
+                { id: 'pr7-r1', commit: 'other00', base: 'main', points: [{ id: 'P', point: 'p', file: 'x', text: 'x' }], must_not_flag: [] },
+            ] }));
+        await scaffoldLedger(repo, 212, config, fakeExec([]));
+        const written = LedgerSchema.parse(JSON.parse(fs.readFileSync(path.join(repo, LEDGER_PATH), 'utf8')));
+        expect(written.rounds.map(r => [r.id, r.commit])).toEqual([['pr7-r1', 'other00'], ['pr212-r1', 'c2c2c2c2c2']]);
+    });
+});