@ryuenn3123/agentic-senior-core 4.4.0 → 5.1.0

package/scripts/validate/audits/caching-scope-hygiene.mjs

@@ -1,235 +0,0 @@
-#!/usr/bin/env node
-// @ts-check
-
-/**
- * audit-caching-scope-hygiene.mjs
- *
- * Phase 5 drift catcher. Scans user-facing surfaces (README, AGENTS.md, FAQ,
- * integration playbook, CHANGELOG) for caching numerical claims and verifies
- * that each claim is integration-scoped per `docs/architecture/decisions-foundation.md`
- * D4 "Per-Tool Caching Scope Matrix".
- *
- * Boundary: this audit covers PUBLIC-PROSE hygiene only (preventing
- * universal "X% caching saving" claims that mix integration modes). For the
- * technical provider/fixture/result-JSON contract see
- * audit-cache-layer-contract.mjs.
- *
- * The rule: never publish a single universal "X% caching saving" figure that
- * mixes integration modes. Every numerical caching saving claim on a public
- * surface must either:
- *   1. be in a clearly-scoped paragraph that names the integration mode
- *      (direct API, Claude Code SDK programmatic, Cursor, Windsurf, Codex CLI,
- *      Kiro, IDE wrapper) within +/- 600 characters of the figure, OR
- *   2. live in a documented exempt context (Phase 1 aggregate-cap CHANGELOG
- *      rationale, archived plan files under docs/archive/, benchmark JSON
- *      under benchmarks/results/, the canonical D4 matrix itself).
- */
-
-import { existsSync, readFileSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const SCRIPT_FILE_PATH = fileURLToPath(import.meta.url);
-const REPOSITORY_ROOT = resolve(dirname(SCRIPT_FILE_PATH), '../../..');
-const ARGS = new Set(process.argv.slice(2));
-const JSON_ONLY = ARGS.has('--json');
-
-const PUBLIC_SURFACES = [
-  'README.md',
-  'AGENTS.md',
-  'docs/faq.md',
-  'docs/integration-playbook.md',
-  'docs/doc-index.md',
-  'CHANGELOG.md',
-];
-
-// Numerical caching saving claims this audit scans for. Pattern is intentionally
-// strict: a digit-prefixed percent paired with an action verb or saving noun,
-// or a bare 89.31%-style figure within a cache-keyword window.
-const SAVING_CLAIM_PATTERNS = [
-  // "X% reduction|saving|off|cheaper"
-  /\b(\d{1,3}(?:\.\d+)?)\s*%\s*(?:effective[- ]token\s+)?(?:reduction|saving|savings|off|cheaper)\b/gi,
-  // "saves|cuts|reduces|delivers up to X%" (cache context check applied below)
-  /\b(?:save[sd]?|cut[s]?|reduce[sd]?|deliver[sd]?)\s+(?:up\s+to\s+)?(\d{1,3}(?:\.\d+)?)\s*%/gi,
-  // "up to X% ... cache"
-  /\b(?:up to|approximately|about|~)\s*(\d{1,3}(?:\.\d+)?)\s*%[^.\n]{0,80}(?:cach|warm|prompt[- ]cach)/gi,
-  // "cache ... X% reduction|saving"
-  /\bcach[a-z]*[^.\n]{0,80}\b(\d{1,3}(?:\.\d+)?)\s*%\s*(?:reduction|saving|savings|off)/gi,
-  // bare two-decimal figures like 89.31% (cache context check applied below)
-  /\b(\d{2,3}\.\d{2})\s*%/g,
-];
-
-// Patterns at these indices apply a cache-context window check before counting.
-const CONTEXT_GATED_PATTERN_INDEXES = new Set([1, 4]);
-
-const INTEGRATION_MODE_KEYWORDS = [
-  'direct provider api',
-  'direct api',
-  'direct anthropic',
-  'direct openai',
-  'direct gemini',
-  'claude code sdk',
-  'claude code cli',
-  'cursor',
-  'windsurf',
-  'codex cli',
-  'codex / openai',
-  'kiro',
-  'ide wrapper',
-  'ide wrappers',
-  'integration mode',
-  'integration_mode',
-  'per-tool caching',
-  'per-integration',
-  'per integration',
-  'cache_control',
-];
-
-const CACHE_CONTEXT_KEYWORDS = [
-  'cach',
-  'warm',
-  'prompt-cach',
-  'prompt cach',
-  'cache_control',
-];
-
-const CONTEXT_WINDOW_RADIUS = 600;
-
-function readSurface(rootDir, relativePath, sourceOverrides) {
-  if (sourceOverrides && Object.prototype.hasOwnProperty.call(sourceOverrides, relativePath)) {
-    return String(sourceOverrides[relativePath]);
-  }
-  const absolutePath = join(rootDir, relativePath);
-  if (!existsSync(absolutePath)) {
-    return null;
-  }
-  return readFileSync(absolutePath, 'utf8');
-}
-
-function findCachingClaimMatches(sourceText) {
-  /** @type {{index: number, matchedText: string, percent: string}[]} */
-  const matches = [];
-  for (let patternIndex = 0; patternIndex < SAVING_CLAIM_PATTERNS.length; patternIndex += 1) {
-    const pattern = SAVING_CLAIM_PATTERNS[patternIndex];
-    pattern.lastIndex = 0;
-    let result;
-    // eslint-disable-next-line no-cond-assign
-    while ((result = pattern.exec(sourceText)) !== null) {
-      const matchedText = result[0];
-      const percent = result[1] || '';
-      const index = result.index;
-
-      // For context-gated patterns, confirm there is a cache keyword within
-      // the context window before counting this as a caching claim.
-      if (CONTEXT_GATED_PATTERN_INDEXES.has(patternIndex)) {
-        const start = Math.max(0, index - CONTEXT_WINDOW_RADIUS);
-        const end = Math.min(sourceText.length, index + matchedText.length + CONTEXT_WINDOW_RADIUS);
-        const window = sourceText.slice(start, end).toLowerCase();
-        const hasCacheContext = CACHE_CONTEXT_KEYWORDS.some((keyword) => window.includes(keyword));
-        if (!hasCacheContext) {
-          continue;
-        }
-      }
-
-      matches.push({ index, matchedText, percent });
-    }
-  }
-
-  // Deduplicate overlapping matches (same percent within a few chars).
-  matches.sort((a, b) => a.index - b.index);
-  /** @type {{index: number, matchedText: string, percent: string}[]} */
-  const deduped = [];
-  for (const match of matches) {
-    const last = deduped[deduped.length - 1];
-    if (last && Math.abs(last.index - match.index) <= 8 && last.percent === match.percent) {
-      continue;
-    }
-    deduped.push(match);
-  }
-  return deduped;
-}
-
-function extractContextWindow(sourceText, index, matchLength) {
-  const start = Math.max(0, index - CONTEXT_WINDOW_RADIUS);
-  const end = Math.min(sourceText.length, index + matchLength + CONTEXT_WINDOW_RADIUS);
-  return sourceText.slice(start, end);
-}
-
-function hasIntegrationModeMarker(contextWindow) {
-  const normalized = contextWindow.toLowerCase();
-  return INTEGRATION_MODE_KEYWORDS.some((keyword) => normalized.includes(keyword));
-}
-
-function lineNumberFromIndex(sourceText, charIndex) {
-  let line = 1;
-  for (let i = 0; i < charIndex && i < sourceText.length; i += 1) {
-    if (sourceText[i] === '\n') {
-      line += 1;
-    }
-  }
-  return line;
-}
-
-export function runCachingScopeHygieneAudit(options = {}) {
-  const rootDir = options.rootDir ? resolve(String(options.rootDir)) : REPOSITORY_ROOT;
-  const sourceOverrides = options.sourceOverrides || null;
-  const surfaceList = options.surfaceList || PUBLIC_SURFACES;
-  const violations = [];
-  const surfaceReports = [];
-  let totalClaims = 0;
-
-  for (const surfacePath of surfaceList) {
-    const sourceText = readSurface(rootDir, surfacePath, sourceOverrides);
-    if (sourceText === null) {
-      continue;
-    }
-
-    const claims = findCachingClaimMatches(sourceText);
-    totalClaims += claims.length;
-    /** @type {{percent: string, line: number, scoped: boolean}[]} */
-    const claimReports = [];
-
-    for (const claim of claims) {
-      const contextWindow = extractContextWindow(sourceText, claim.index, claim.matchedText.length);
-      const scoped = hasIntegrationModeMarker(contextWindow);
-      const lineNumber = lineNumberFromIndex(sourceText, claim.index);
-
-      claimReports.push({
-        percent: claim.percent,
-        line: lineNumber,
-        scoped,
-      });
-
-      if (!scoped) {
-        violations.push({
-          file: surfacePath,
-          line: lineNumber,
-          kind: 'caching-claim.missing-integration-scope',
-          detail: `Caching saving claim "${claim.matchedText.trim()}" lacks an integration-mode marker within +/- ${CONTEXT_WINDOW_RADIUS} chars. Add a per-tool / direct-API / IDE-wrapper label, or move the figure under a clearly-scoped paragraph. Source of truth: docs/architecture/decisions-foundation.md D4.`,
-        });
-      }
-    }
-
-    surfaceReports.push({
-      path: surfacePath,
-      claimCount: claims.length,
-      scopedCount: claimReports.filter((claim) => claim.scoped).length,
-      unscopedCount: claimReports.filter((claim) => !claim.scoped).length,
-      claims: claimReports,
-    });
-  }
-
-  return {
-    auditName: 'audit-caching-scope-hygiene',
-    reportVersion: '1.0.0',
-    generatedAt: new Date().toISOString(),
-    surfaceCount: surfaceReports.length,
-    totalClaimCount: totalClaims,
-    violationCount: violations.length,
-    passed: violations.length === 0,
-    surfaces: surfaceReports,
-    violations,
-  };
-}
-
-

package/scripts/validate/audits/file-size.mjs

@@ -1,158 +0,0 @@
-#!/usr/bin/env node
-// @ts-check
-
-/**
- * audit-file-size.mjs
- *
- * Enforces the 500 LOC threshold on production source files. Files that exceed
- * the threshold are hard failures unless they declare a justified exception
- * with a `// @file-size-exception: <reason>` marker in their first 5 lines.
- *
- * Scope:
- *   lib/     all .mjs/.js files
- *   scripts/ all .mjs/.js files
- *   bin/     all .js/.mjs files
- *
- * Excluded:
- *   *.test.mjs / *.test.js (test files have different size economics)
- *
- * Usage:
- *   node scripts/audit-file-size.mjs            (human-readable + machine line)
- *   node scripts/audit-file-size.mjs --json     (JSON only)
- *
- * Exit codes:
- *   0 — all files within budget (or covered by exception)
- *   1 — at least one file exceeded the threshold without an exception marker
- */
-
-import { readdirSync, readFileSync, statSync } from 'node:fs';
-import { dirname, join, relative, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const SCRIPT_FILE_PATH = fileURLToPath(import.meta.url);
-const REPOSITORY_ROOT = resolve(dirname(SCRIPT_FILE_PATH), '../../..');
-
-export const DEFAULT_LOC_THRESHOLD = 500;
-const EXCEPTION_MARKER_PATTERN = /^\s*(?:\/\/|\*)\s*@file-size-exception:\s*(.+?)\s*(?:\*\/\s*)?$/;
-const EXCEPTION_MARKER_LOOKAHEAD_LINES = 5;
-const SCAN_ROOTS = ['lib', 'scripts', 'bin'];
-const SCAN_EXTENSIONS = new Set(['.mjs', '.js']);
-const SKIP_DIRECTORY_NAMES = new Set(['node_modules', '.git', '.agentic-backup', '.benchmarks']);
-
-const ARGS = new Set(process.argv.slice(2));
-const JSON_ONLY = ARGS.has('--json');
-
-function isTestFile(filePath) {
-  const baseName = filePath.split(/[\\/]/).pop();
-  return /\.test\.(mjs|js)$/.test(baseName);
-}
-
-function collectSourceFiles(scanRootName) {
-  const collected = [];
-  const scanRootAbsolutePath = join(REPOSITORY_ROOT, scanRootName);
-
-  function walk(currentPath) {
-    let entries;
-    try {
-      entries = readdirSync(currentPath, { withFileTypes: true });
-    } catch {
-      return;
-    }
-
-    for (const entry of entries) {
-      if (SKIP_DIRECTORY_NAMES.has(entry.name)) {
-        continue;
-      }
-
-      const entryAbsolute = join(currentPath, entry.name);
-      if (entry.isDirectory()) {
-        walk(entryAbsolute);
-        continue;
-      }
-
-      if (!entry.isFile()) {
-        continue;
-      }
-
-      const dotIndex = entry.name.lastIndexOf('.');
-      const extension = dotIndex >= 0 ? entry.name.slice(dotIndex) : '';
-      if (!SCAN_EXTENSIONS.has(extension)) {
-        continue;
-      }
-
-      if (isTestFile(entryAbsolute)) {
-        continue;
-      }
-
-      collected.push(entryAbsolute);
-    }
-  }
-
-  try {
-    statSync(scanRootAbsolutePath);
-  } catch {
-    return collected;
-  }
-
-  walk(scanRootAbsolutePath);
-  return collected;
-}
-
-function detectExceptionMarker(sourceLines) {
-  const lookahead = sourceLines.slice(0, EXCEPTION_MARKER_LOOKAHEAD_LINES);
-  for (const line of lookahead) {
-    const match = line.match(EXCEPTION_MARKER_PATTERN);
-    if (match) {
-      return match[1].trim();
-    }
-  }
-  return null;
-}
-
-function inspectFile(filePath, threshold) {
-  const sourceText = readFileSync(filePath, 'utf8');
-  const lines = sourceText.split(/\r?\n/);
-  const lineCount = lines.length;
-  const overThreshold = lineCount > threshold;
-  const exceptionReason = overThreshold ? detectExceptionMarker(lines) : null;
-  const passed = !overThreshold || Boolean(exceptionReason);
-
-  return {
-    filePath: relative(REPOSITORY_ROOT, filePath).replace(/\\/g, '/'),
-    lineCount,
-    threshold,
-    overThreshold,
-    exceptionReason,
-    passed,
-  };
-}
-
-export function runAuditFileSize({ threshold = DEFAULT_LOC_THRESHOLD } = {}) {
-  const scannedFiles = SCAN_ROOTS.flatMap((scanRootName) => collectSourceFiles(scanRootName));
-  const inspections = scannedFiles.map((filePath) => inspectFile(filePath, threshold));
-  const violations = inspections.filter((entry) => entry.overThreshold && !entry.exceptionReason);
-  const exemptedFiles = inspections.filter((entry) => entry.overThreshold && entry.exceptionReason);
-
-  return {
-    auditName: 'audit-file-size',
-    reportVersion: '1.0.0',
-    generatedAt: new Date().toISOString(),
-    threshold,
-    scannedFileCount: inspections.length,
-    overThresholdCount: inspections.filter((entry) => entry.overThreshold).length,
-    violationCount: violations.length,
-    exemptedCount: exemptedFiles.length,
-    violations: violations.map((entry) => ({
-      filePath: entry.filePath,
-      lineCount: entry.lineCount,
-    })),
-    exemptedFiles: exemptedFiles.map((entry) => ({
-      filePath: entry.filePath,
-      lineCount: entry.lineCount,
-      reason: entry.exceptionReason,
-    })),
-    passed: violations.length === 0,
-  };
-}
-
-

package/scripts/validate/audits/reflection-citations.mjs

@@ -1,130 +0,0 @@
-#!/usr/bin/env node
-// @ts-check
-
-import { existsSync, readFileSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { runRuleIdUniquenessAudit } from './rule-id-uniqueness.mjs';
-
-const SCRIPT_FILE_PATH = fileURLToPath(import.meta.url);
-const REPOSITORY_ROOT = resolve(dirname(SCRIPT_FILE_PATH), '../../..');
-const ARGS = new Set(process.argv.slice(2));
-const JSON_ONLY = ARGS.has('--json');
-const RULE_ID_PATTERN = /\b[A-Z]+-\d{3,4}(?:-[A-Z])?\b/g;
-
-const REQUIRED_REFLECTION_SURFACES = [
-  {
-    path: 'AGENTS.md',
-    requiredSnippets: [
-      '## Bounded Reflection',
-      'REFLECTION',
-      'Rules:',
-      'Risk:',
-      'Action:',
-      'valid rule IDs',
-      'hidden chain-of-thought',
-    ],
-  },
-  {
-    path: '.agent-context/review-checklists/pr-checklist.md',
-    requiredSnippets: [
-      'Bounded Reflection',
-      'valid rule IDs',
-      'hidden chain-of-thought',
-    ],
-  },
-];
-
-function readSource(rootDir, relativePath, sourceOverrides) {
-  if (sourceOverrides && Object.prototype.hasOwnProperty.call(sourceOverrides, relativePath)) {
-    return String(sourceOverrides[relativePath]);
-  }
-
-  const absolutePath = join(rootDir, relativePath);
-  if (!existsSync(absolutePath)) {
-    return null;
-  }
-
-  return readFileSync(absolutePath, 'utf8');
-}
-
-function collectKnownRuleIds() {
-  const ruleIdAudit = runRuleIdUniquenessAudit();
-  const knownRuleIds = new Set();
-
-  for (const fileEntry of ruleIdAudit.perFile || []) {
-    for (const ruleId of fileEntry.knownSectionIdsInFile || []) {
-      knownRuleIds.add(ruleId);
-    }
-  }
-
-  return {
-    ruleIdAudit,
-    knownRuleIds,
-  };
-}
-
-function collectRuleIdsFromSource(sourceText) {
-  return Array.from(new Set(sourceText.match(RULE_ID_PATTERN) || [])).sort();
-}
-
-export function runReflectionCitationAudit(options = {}) {
-  const rootDir = options.rootDir ? resolve(String(options.rootDir)) : REPOSITORY_ROOT;
-  const sourceOverrides = options.sourceOverrides || null;
-  const { ruleIdAudit, knownRuleIds } = collectKnownRuleIds();
-  const violations = [];
-  const surfaceReports = [];
-
-  for (const surface of REQUIRED_REFLECTION_SURFACES) {
-    const sourceText = readSource(rootDir, surface.path, sourceOverrides);
-    if (sourceText === null) {
-      violations.push({
-        file: surface.path,
-        kind: 'surface.missing',
-        detail: 'Required reflection citation surface is missing.',
-      });
-      continue;
-    }
-
-    const missingSnippets = surface.requiredSnippets.filter((snippet) => !sourceText.includes(snippet));
-    for (const missingSnippet of missingSnippets) {
-      violations.push({
-        file: surface.path,
-        kind: 'reflection.snippet-missing',
-        detail: `Missing required reflection snippet: ${missingSnippet}`,
-      });
-    }
-
-    const citedRuleIds = collectRuleIdsFromSource(sourceText);
-    const unknownRuleIds = citedRuleIds.filter((ruleId) => !knownRuleIds.has(ruleId));
-    for (const unknownRuleId of unknownRuleIds) {
-      violations.push({
-        file: surface.path,
-        kind: 'rule-id.unknown',
-        detail: `Rule ID ${unknownRuleId} does not resolve to any canonical rule section.`,
-      });
-    }
-
-    surfaceReports.push({
-      path: surface.path,
-      missingSnippetCount: missingSnippets.length,
-      citedRuleIds,
-      unknownRuleIds,
-    });
-  }
-
-  return {
-    auditName: 'audit-reflection-citations',
-    reportVersion: '1.0.0',
-    generatedAt: new Date().toISOString(),
-    surfaceCount: REQUIRED_REFLECTION_SURFACES.length,
-    knownRuleIdCount: knownRuleIds.size,
-    ruleIdAuditPassed: ruleIdAudit.passed,
-    violationCount: violations.length,
-    passed: violations.length === 0,
-    surfaces: surfaceReports,
-    violations,
-  };
-}
-
-

package/scripts/validate/audits/release-bundle.mjs

@@ -1,135 +0,0 @@
-#!/usr/bin/env node
-// @ts-check
-
-/**
- * audit-release-bundle.mjs
- *
- * Phase 5 Task 5.4 integrity gate. Validates that
- * benchmarks/results/release-bundle-4.0.0.json exists, references real source
- * artifacts, and that each recorded SHA-256 hash still matches the current
- * file content. Wired into npm run validate.
- */
-
-import { createHash } from 'node:crypto';
-import { existsSync, readFileSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const SCRIPT_FILE_PATH = fileURLToPath(import.meta.url);
-const REPOSITORY_ROOT = resolve(dirname(SCRIPT_FILE_PATH), '../../..');
-const ARGS = new Set(process.argv.slice(2));
-const JSON_ONLY = ARGS.has('--json');
-
-const DEFAULT_BUNDLE_PATH = join(REPOSITORY_ROOT, 'benchmarks', 'results', 'release-bundle-4.0.0.json');
-
-function sha256Hex(buffer) {
-  // Normalize CRLF -> LF before hashing so bundle integrity is reproducible
-  // across platforms (Windows working tree may be CRLF; CI checkouts are LF).
-  const normalized = buffer.toString('utf8').replace(/\r\n/g, '\n');
-  const hash = createHash('sha256');
-  hash.update(normalized, 'utf8');
-  return hash.digest('hex');
-}
-
-export function runReleaseBundleAudit(options = {}) {
-  const rootDir = options.rootDir ? resolve(String(options.rootDir)) : REPOSITORY_ROOT;
-  const bundlePath = options.bundlePath ? resolve(String(options.bundlePath)) : DEFAULT_BUNDLE_PATH;
-  const violations = [];
-
-  if (!existsSync(bundlePath)) {
-    violations.push({
-      kind: 'bundle.missing',
-      detail: `Release bundle is missing at ${bundlePath}. Run scripts/build-release-benchmark-bundle.mjs to regenerate.`,
-    });
-    return finalizeReport(violations, { bundlePath, artifactCount: 0 });
-  }
-
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync(bundlePath, 'utf8'));
-  } catch (error) {
-    violations.push({
-      kind: 'bundle.invalid-json',
-      detail: `Release bundle is not valid JSON: ${error?.message || error}`,
-    });
-    return finalizeReport(violations, { bundlePath, artifactCount: 0 });
-  }
-
-  if (!Array.isArray(parsed.artifacts) || parsed.artifacts.length === 0) {
-    violations.push({
-      kind: 'bundle.empty',
-      detail: 'Release bundle artifacts array must be non-empty.',
-    });
-    return finalizeReport(violations, { bundlePath, artifactCount: 0 });
-  }
-
-  if (parsed.integrity?.hash_algorithm !== 'SHA-256') {
-    violations.push({
-      kind: 'bundle.unexpected-hash-algorithm',
-      detail: `Expected hash_algorithm "SHA-256", got "${parsed.integrity?.hash_algorithm}".`,
-    });
-  }
-
-  if (parsed.release_status !== 'release-candidate-unpublished' && parsed.release_status !== 'released') {
-    violations.push({
-      kind: 'bundle.invalid-release-status',
-      detail: `release_status must be either "release-candidate-unpublished" or "released"; got "${parsed.release_status}".`,
-    });
-  }
-
-  for (const artifact of parsed.artifacts) {
-    if (!artifact.relative_path || typeof artifact.relative_path !== 'string') {
-      violations.push({
-        kind: 'artifact.missing-relative-path',
-        detail: `Artifact "${artifact.artifact_id}" missing relative_path.`,
-      });
-      continue;
-    }
-
-    const absolutePath = join(rootDir, artifact.relative_path);
-    if (!existsSync(absolutePath)) {
-      violations.push({
-        kind: 'artifact.missing-file',
-        detail: `Artifact "${artifact.artifact_id}" references missing file at ${artifact.relative_path}.`,
-      });
-      continue;
-    }
-
-    if (!artifact.sha256 || typeof artifact.sha256 !== 'string') {
-      violations.push({
-        kind: 'artifact.missing-sha256',
-        detail: `Artifact "${artifact.artifact_id}" missing sha256 hash.`,
-      });
-      continue;
-    }
-
-    const currentHash = sha256Hex(readFileSync(absolutePath));
-    if (currentHash !== artifact.sha256) {
-      violations.push({
-        kind: 'artifact.hash-mismatch',
-        detail: `Artifact "${artifact.artifact_id}" sha256 drift: bundle records ${artifact.sha256}, current file is ${currentHash}. Regenerate the bundle via scripts/build-release-benchmark-bundle.mjs.`,
-      });
-    }
-  }
-
-  return finalizeReport(violations, {
-    bundlePath,
-    artifactCount: parsed.artifacts.length,
-    releaseTarget: parsed.release_target || null,
-    releaseStatus: parsed.release_status || null,
-  });
-}
-
-function finalizeReport(violations, extras) {
-  return {
-    auditName: 'audit-release-bundle',
-    reportVersion: '1.0.0',
-    generatedAt: new Date().toISOString(),
-    violationCount: violations.length,
-    passed: violations.length === 0,
-    violations,
-    ...extras,
-  };
-}
-
-