@scalequality/check 0.4.0 → 0.5.1

package/bin/durability/GitDurabilityEngine.mjs

@@ -0,0 +1,225 @@
+import { readCommits, listHeadFiles, blameFile } from "./GitReader.mjs";
+import { classifyCommit } from "./OriginClassifier.mjs";
+const DEFAULT_CHURN_DAYS = 14;
+const DEFAULT_MAX_BLAME_FILES = 500;
+const HIGH_VELOCITY_LOC_PER_WEEK = 1500; // "AI-like" cadence threshold
+const DAY_MS = 24 * 60 * 60 * 1000;
+const sum = (xs) => xs.reduce((a, b) => a + b, 0);
+function assembleSurvival(introduced, surviving) {
+    const out = {};
+    for (const key of new Set([...Object.keys(introduced), ...Object.keys(surviving)])) {
+        const intro = introduced[key] ?? 0;
+        const surv = surviving[key] ?? 0;
+        out[key] = {
+            linesIntroduced: intro,
+            linesSurviving: Math.min(surv, intro),
+            survivalRate: intro > 0 ? Math.min(1, Math.round((surv / intro) * 1000) / 1000) : 0,
+        };
+    }
+    return out;
+}
+const FIX_RE = /\b(fix|bug|hotfix|patch|revert|broke|regression)\b/i;
+const REVERT_RE = /\brevert(s|ed|ing)?\b|this reverts commit/i;
+function isRevert(c) {
+    return REVERT_RE.test(c.body);
+}
+/** Churn: a file touched again within churnDays of a prior touch. */
+function computeChurn(commits, churnDays) {
+    const fileTouches = new Map();
+    for (const c of commits) {
+        const t = Date.parse(c.date);
+        const perFile = c.files.length > 0 ? (c.additions + c.deletions) / c.files.length : 0;
+        for (const f of c.files) {
+            if (!fileTouches.has(f))
+                fileTouches.set(f, []);
+            fileTouches.get(f).push({ t, addDel: perFile });
+        }
+    }
+    let churnLinesAffected = 0;
+    let churnEvents = 0;
+    let filesWithNew = 0;
+    let filesReChurned2w = 0;
+    const TWO_WEEKS = 14 * DAY_MS;
+    for (const touches of fileTouches.values()) {
+        touches.sort((a, b) => a.t - b.t);
+        filesWithNew++;
+        let reChurned2w = false;
+        for (let i = 1; i < touches.length; i++) {
+            const gap = Math.abs(touches[i].t - touches[i - 1].t);
+            if (gap <= churnDays * DAY_MS) {
+                churnEvents++;
+                churnLinesAffected += Math.round(touches[i].addDel);
+            }
+            if (touches[i].t - touches[0].t <= TWO_WEEKS)
+                reChurned2w = true;
+        }
+        if (reChurned2w)
+            filesReChurned2w++;
+    }
+    const newCodeChurn2w = filesWithNew > 0 ? Math.round((filesReChurned2w / filesWithNew) * 1000) / 1000 : 0;
+    return { churnLinesAffected, churnEvents, newCodeChurn2w };
+}
+/** Cascade: fix-commits that closely follow a prior commit on shared files. */
+function computeCascadeRate(commits, churnDays) {
+    if (commits.length === 0)
+        return 0;
+    const sorted = [...commits].sort((a, b) => Date.parse(a.date) - Date.parse(b.date));
+    let cascades = 0;
+    for (let i = 0; i < sorted.length; i++) {
+        if (!FIX_RE.test(sorted[i].body))
+            continue;
+        const ti = Date.parse(sorted[i].date);
+        const fi = new Set(sorted[i].files);
+        for (let j = i - 1; j >= 0; j--) {
+            if (ti - Date.parse(sorted[j].date) > churnDays * DAY_MS)
+                break;
+            if (sorted[j].files.some((f) => fi.has(f))) {
+                cascades++;
+                break;
+            }
+        }
+    }
+    return Math.round((cascades / sorted.length) * 1000) / 1000;
+}
+/** Stabilization: share of touched files touched exactly once (settled). */
+function computeStabilization(commits) {
+    const counts = new Map();
+    for (const c of commits)
+        for (const f of c.files)
+            counts.set(f, (counts.get(f) ?? 0) + 1);
+    if (counts.size === 0)
+        return 0;
+    let stabilized = 0;
+    for (const n of counts.values())
+        if (n === 1)
+            stabilized++;
+    return Math.round((stabilized / counts.size) * 1000) / 1000;
+}
+/**
+ * Attribution gap (directional): authors writing at AI-like velocity
+ * (>threshold loc/week) but with low AI attribution → suspected
+ * unattributed AI. Never falsely re-classifies a commit; this is a flag.
+ */
+function computeAttributionGap(commits, windowDays) {
+    const weeks = Math.max(1, windowDays / 7);
+    const byAuthor = new Map();
+    for (const c of commits) {
+        if (c.origin === "BOT")
+            continue;
+        const a = byAuthor.get(c.email) ?? { total: 0, ai: 0, loc: 0 };
+        a.total++;
+        if (c.origin === "AI_ATTRIBUTED")
+            a.ai++;
+        a.loc += c.additions + c.deletions;
+        byAuthor.set(c.email, a);
+    }
+    let suspected = 0;
+    let total = 0;
+    for (const a of byAuthor.values()) {
+        total += a.total;
+        const aiPct = a.total > 0 ? a.ai / a.total : 0;
+        const locPerWeek = a.loc / weeks;
+        if (locPerWeek > HIGH_VELOCITY_LOC_PER_WEEK && aiPct < 0.5) {
+            suspected += a.total * (1 - aiPct); // the non-attributed share
+        }
+    }
+    const pct = total > 0 ? Math.round((suspected / total) * 100) : 0;
+    const confidence = "LOW";
+    return { suspectedAttributionGapPct: pct, attributionConfidence: confidence };
+}
+/**
+ * Native durability engine. Analyses a cloned repo's git history (log +
+ * blame) and returns durability/origin/churn/attribution metrics by
+ * origin and tool. Deterministic, no LLM, no external engine.
+ */
+export async function analyzeDurability(repoPath, opts) {
+    const churnDays = opts.churnDays ?? DEFAULT_CHURN_DAYS;
+    const maxBlame = opts.maxBlameFiles ?? DEFAULT_MAX_BLAME_FILES;
+    const log = opts.onLog ?? (() => { });
+    const endDaysAgo = opts.endDaysAgo ?? 0;
+    const settleDays = opts.settleDays ?? 0;
+    const raw = await readCommits(repoPath, opts.windowDays + endDaysAgo, endDaysAgo);
+    const commits = raw.map((c) => ({ ...c, ...classifyCommit(c) }));
+    log(`commits in window: ${commits.length}`);
+    // Survival is measured ONLY on commits old enough to have settled (older than
+    // settleDays). Code written in the last settleDays is right-censored — it
+    // hasn't had time to be reverted, so counting it would inflate survival.
+    // Churn, revert, cascade and attribution stay on the full window.
+    const settleCutoff = Date.now() - settleDays * DAY_MS;
+    const measureCommits = settleDays > 0
+        ? commits.filter((c) => Date.parse(c.date) <= settleCutoff)
+        : commits;
+    const measureShas = new Map(measureCommits.map((c) => [c.sha, c]));
+    const introducedByOrigin = {};
+    const introducedByTool = {};
+    for (const c of measureCommits) {
+        introducedByOrigin[c.origin] = (introducedByOrigin[c.origin] ?? 0) + c.additions;
+        if (c.tool)
+            introducedByTool[c.tool] = (introducedByTool[c.tool] ?? 0) + c.additions;
+    }
+    const headFiles = await listHeadFiles(repoPath);
+    const touched = new Set();
+    for (const c of commits)
+        for (const f of c.files)
+            if (headFiles.has(f))
+                touched.add(f);
+    let files = [...touched];
+    if (files.length > maxBlame) {
+        log(`blame capped: ${maxBlame}/${files.length} files (perf)`);
+        files = files.slice(0, maxBlame);
+    }
+    log(`blaming ${files.length} files...`);
+    const survivingByOrigin = {};
+    const survivingByTool = {};
+    for (const f of files) {
+        const counts = await blameFile(repoPath, f);
+        for (const [sha, n] of counts) {
+            const c = measureShas.get(sha);
+            if (!c)
+                continue; // line introduced outside the settled measurement window
+            survivingByOrigin[c.origin] = (survivingByOrigin[c.origin] ?? 0) + n;
+            if (c.tool)
+                survivingByTool[c.tool] = (survivingByTool[c.tool] ?? 0) + n;
+        }
+    }
+    const byOrigin = assembleSurvival(introducedByOrigin, survivingByOrigin);
+    const byTool = assembleSurvival(introducedByTool, survivingByTool);
+    const linesIntroduced = sum(Object.values(introducedByOrigin));
+    // Clamp: a surviving line was, by definition, introduced — survival
+    // can't exceed 100% (guards against any blame/window edge).
+    const linesSurviving = Math.min(sum(Object.values(survivingByOrigin)), linesIntroduced);
+    const survivalRate = linesIntroduced > 0 ? linesSurviving / linesIntroduced : 0;
+    const { churnLinesAffected, newCodeChurn2w } = computeChurn(commits, churnDays);
+    const cascadeRate = computeCascadeRate(commits, churnDays);
+    const stabilizationRatio = computeStabilization(commits);
+    const revertCount = commits.filter(isRevert).length;
+    const revertRate = commits.length > 0 ? revertCount / commits.length : 0;
+    const aiCommits = commits.filter((c) => c.origin === "AI_ATTRIBUTED").length;
+    const nonBot = commits.filter((c) => c.origin !== "BOT").length;
+    const aiDetectionCoveragePct = nonBot > 0 ? Math.round((aiCommits / nonBot) * 100) : 0;
+    const { suspectedAttributionGapPct, attributionConfidence } = computeAttributionGap(commits, opts.windowDays);
+    const durablePct = Math.round(survivalRate * 100);
+    const revertPct = Math.round(revertRate * 100);
+    const churnPct = Math.max(0, 100 - durablePct - revertPct);
+    const signalToNoise = churnLinesAffected > 0 ? Math.round((linesSurviving / churnLinesAffected) * 100) / 100 : null;
+    return {
+        commitsTotal: commits.length,
+        linesIntroduced,
+        linesSurviving,
+        survivalRate: Math.round(survivalRate * 1000) / 1000,
+        stabilizationRatio,
+        churnLinesAffected,
+        revertRate: Math.round(revertRate * 1000) / 1000,
+        newCodeChurn2w,
+        cascadeRate,
+        aiDetectionCoveragePct,
+        durablePct,
+        churnPct,
+        revertPct,
+        signalToNoise,
+        suspectedAttributionGapPct,
+        attributionConfidence,
+        byOrigin,
+        byTool,
+    };
+}

package/bin/durability/GitReader.mjs

@@ -0,0 +1,121 @@
+import { runGit as git, runGitLines, isFatalGitError, GitMeasurementError } from "./runtime.mjs";
+const US = "\x1f"; // unit separator (field)
+const RS = "\x1e"; // record separator (commit)
+const CO_AUTHOR_RE = /co-authored-by:\s*(.*?)\s*<([^>]+)>/gi;
+function parseCoAuthors(body) {
+    const out = [];
+    let m;
+    CO_AUTHOR_RE.lastIndex = 0;
+    while ((m = CO_AUTHOR_RE.exec(body)) !== null) {
+        out.push({ name: m[1].trim(), email: m[2].trim().toLowerCase() });
+    }
+    return out;
+}
+/**
+ * Reads commits in the window (metadata + co-authors via one log call,
+ * file stats via a second --numstat call) and merges them. Two calls so
+ * the multi-line commit body can't corrupt numstat line parsing.
+ */
+export async function readCommits(repoPath, sinceDays, untilDays = 0) {
+    const since = `${sinceDays} days ago`;
+    // untilDays > 0 bounds the window's END in the past (point-in-time backfill).
+    const untilArgs = untilDays > 0 ? [`--until=${untilDays} days ago`] : [];
+    // Pass 1: metadata + body (for co-author trailers).
+    const metaFmt = ["%H", "%an", "%ae", "%cI", "%B"].join(US) + RS;
+    const metaOut = await git(repoPath, [
+        "log",
+        `--since=${since}`,
+        ...untilArgs,
+        "--no-merges",
+        `--pretty=format:${metaFmt}`,
+    ]);
+    const bySha = new Map();
+    for (const rec of metaOut.split(RS)) {
+        const trimmed = rec.replace(/^\n+/, "");
+        if (!trimmed.trim())
+            continue;
+        const parts = trimmed.split(US);
+        if (parts.length < 5)
+            continue;
+        const [sha, author, email, date, body] = parts;
+        bySha.set(sha, {
+            sha,
+            author,
+            email: email.toLowerCase(),
+            date,
+            body,
+            coAuthors: parseCoAuthors(body),
+            additions: 0,
+            deletions: 0,
+            files: [],
+        });
+    }
+    // Pass 2: per-commit numstat.
+    const statOut = await git(repoPath, [
+        "log",
+        `--since=${since}`,
+        ...untilArgs,
+        "--no-merges",
+        "--numstat",
+        `--pretty=format:${RS}%H`,
+    ]);
+    for (const block of statOut.split(RS)) {
+        if (!block.trim())
+            continue;
+        const lines = block.split("\n").filter((l) => l.length > 0);
+        const sha = lines.shift()?.trim();
+        if (!sha)
+            continue;
+        const rec = bySha.get(sha);
+        if (!rec)
+            continue;
+        for (const line of lines) {
+            const cols = line.split("\t");
+            if (cols.length < 3)
+                continue;
+            const add = Number.parseInt(cols[0], 10); // "-" (binary) → NaN
+            const del = Number.parseInt(cols[1], 10);
+            rec.additions += Number.isFinite(add) ? add : 0;
+            rec.deletions += Number.isFinite(del) ? del : 0;
+            rec.files.push(cols.slice(2).join("\t"));
+        }
+    }
+    return [...bySha.values()];
+}
+/** Files that currently exist at HEAD (tracked). */
+export async function listHeadFiles(repoPath) {
+    const out = await git(repoPath, ["ls-tree", "-r", "--name-only", "HEAD"]);
+    return new Set(out.split("\n").map((l) => l.trim()).filter(Boolean));
+}
+const BLAME_GROUP = /^([0-9a-f]{40}) [1-9][0-9]* [1-9][0-9]* ([1-9][0-9]*)$/;
+/**
+ * Blames a file at HEAD and returns, per introducing commit sha, how many
+ * CURRENT lines it owns. Incremental output describes identical attribution
+ * in groups, without source lines or repeated per-line commit metadata.
+ * Stream those groups so large output does not require a large buffer.
+ * Ordinary per-file failures return no counts; resource/history errors abort.
+ */
+export async function blameFile(repoPath, file) {
+    const counts = new Map();
+    try {
+        await runGitLines(repoPath, [
+            "blame",
+            "--incremental",
+            "HEAD",
+            "--",
+            file,
+        ], line => {
+            const m = BLAME_GROUP.exec(line);
+            if (!m) return;
+            const total = (counts.get(m[1]) ?? 0) + Number(m[2]);
+            if (!Number.isSafeInteger(total)) throw new GitMeasurementError('Git blame line count exceeded the numeric limit');
+            counts.set(m[1], total);
+        });
+    }
+    catch (error) {
+        if (isFatalGitError(error)) throw error;
+        // deleted at HEAD / binary / unreadable → no surviving lines counted
+        counts.clear();
+    }
+    return counts;
+}

package/bin/durability/OriginClassifier.mjs

@@ -0,0 +1,48 @@
+/**
+ * Native origin classifier (our own). Deterministic, confidence-aware.
+ *
+ * Signals (high confidence): Co-Authored-By trailers + author identity
+ * matching known AI tools / bots. NO content analysis, NO false
+ * attribution — a commit without an AI signal is HUMAN. Unattributed-but-
+ * likely-AI is surfaced separately by AttributionGapAnalyzer (SUSPECTED),
+ * never silently classified here.
+ */
+const AI_TOOL_PATTERNS = [
+    [/copilot|github-copilot/i, "Copilot"],
+    [/claude|anthropic/i, "Claude"],
+    [/cursor/i, "Cursor"],
+    [/codeium/i, "Codeium"],
+    [/tabnine/i, "Tabnine"],
+    [/amazon[-\s]?q/i, "Amazon Q"],
+    [/gemini/i, "Gemini"],
+    [/windsurf/i, "Windsurf"],
+    [/devin/i, "Devin"],
+    [/aider/i, "Aider"],
+];
+const BOT_PATTERN = /\[bot\]|-bot\b|\bbot@|dependabot|renovate|github-actions|mergify|snyk-bot|copilot-autofix/i;
+function matchTool(haystack) {
+    for (const [re, tool] of AI_TOOL_PATTERNS) {
+        if (re.test(haystack))
+            return tool;
+    }
+    return null;
+}
+export function classifyCommit(c) {
+    // 1. Co-author trailers → strongest AI signal.
+    for (const ca of c.coAuthors) {
+        const tool = matchTool(`${ca.email} ${ca.name}`);
+        if (tool)
+            return { origin: "AI_ATTRIBUTED", tool, confidence: "HIGH" };
+    }
+    // 2. Author identity is itself an AI tool (e.g. copilot@github.com).
+    const authorTool = matchTool(`${c.email} ${c.author}`);
+    if (authorTool && !BOT_PATTERN.test(`${c.author} ${c.email}`)) {
+        return { origin: "AI_ATTRIBUTED", tool: authorTool, confidence: "HIGH" };
+    }
+    // 3. Bot.
+    if (BOT_PATTERN.test(`${c.author} ${c.email}`)) {
+        return { origin: "BOT", tool: null, confidence: "HIGH" };
+    }
+    // 4. Default human.
+    return { origin: "HUMAN", tool: null, confidence: "HIGH" };
+}

package/bin/durability/PROVENANCE.md

@@ -0,0 +1,42 @@
+# Bundled local Git measurement
+
+The four generated modules come from `scalequality-ai-governance-service` commit
+`35a9ac72e2a131c108b40c9d2477f58a90deb4c1`, under
+`src/application/services/durability/`. `provenance.json` records original SHA-256
+hashes, compiler settings, generated hashes, and the source-manifest digest exported
+by `../durability.mjs`.
+
+To regenerate, extract the four named TypeScript files from that exact Git commit
+into a temporary directory. Compile with TypeScript 5.9.3, target/module ES2022,
+moduleResolution node, strict true, esModuleInterop true, skipLibCheck true, and
+Node type declarations. No dependencies are needed by the resulting runtime.
+Rename the generated files to `.mjs` and give their relative imports `.mjs`
+extensions. The engine's calculations and classifier remain unchanged. In the
+reader, replace its promisified `execFile` wrapper with `runtime.mjs`'s `runGit`.
+For blame, use `runGitLines` with `--incremental` and sum each group's line count
+instead of counting individual `--line-porcelain` headers. Attribution is unchanged;
+source text and repeated per-line metadata are not emitted or retained. Rethrow
+`isFatalGitError(error)` in the per-file blame catch. Discard partial streamed
+counts on ordinary per-file failures, retaining the native empty-map behavior.
+Recompute provenance hashes and run the
+parity and cancellation tests. The reference modules under
+`test/native-durability-reference/` preserve the original reader for small fixture
+comparisons only; they are excluded from the published package.
+
+The runtime keeps the native 90-day window, 14-day settlement and churn settings,
+and native maximum of 500 blamed files. A native cap warning is logged; this does
+not certify that every tracked file was blamed. Tracked dependency files remain
+part of native Git measurement even if archive exclusions omit those directories.
+
+No clone, fetch, checkout or Git write is performed. Shallow or partial histories,
+missing objects, changing HEAD and invalid reports produce no measurement.
+The separate worker has a 120-second total budget and 512 MiB V8 heap ceiling;
+each Git command has at most 30 seconds. Buffered commands retain at most 16 MiB
+of output. Incremental blame streams stdout, retaining one line (at most 16 MiB)
+and at most 16 MiB of stderr, rather than limiting total streamed output. The complete HEAD
+object inventory uses this same limit, so sufficiently large object inventories
+can be unavailable even when the 90-day change window is small. Limit failures
+are reported as unavailable, never converted into successful zero measurements.
+Only the measurement worker's own process group and Git children are cleaned up
+on cancellation or parent IPC disconnection. Git command output, author details,
+credentials and customer environment tokens are not logged or sent to the worker.

package/bin/durability/provenance.json

@@ -0,0 +1,53 @@
+{
+  "engineCommit": "35a9ac72e2a131c108b40c9d2477f58a90deb4c1",
+  "sourceRepository": "scalequality-ai-governance-service",
+  "sourceFiles": [
+    {
+      "file": "src/application/services/durability/GitDurabilityEngine.ts",
+      "sha256": "4210aba0a7dbfa6ca62178ff434dcaef81b0ca77c72a8fa488ae48f03c734105"
+    },
+    {
+      "file": "src/application/services/durability/GitReader.ts",
+      "sha256": "bc6ca21db40bbdadebdccfbfb7f3dcab3125eeed96d2199a6bd309c949410e9b"
+    },
+    {
+      "file": "src/application/services/durability/OriginClassifier.ts",
+      "sha256": "ac58ba1684b63ee34c168b39574f777087fadebe9ce80e2c1da8948f7bb3bd62"
+    },
+    {
+      "file": "src/application/services/durability/types.ts",
+      "sha256": "f102fabbeb0a3eee09ca0be64bb7777f12c553c91ebd615340132e674ea66026"
+    }
+  ],
+  "sourceManifestSha256": "bc7a01ce93df3aad2f80da281934868ba7327a1a04fad840f35ecc8b422c74cf",
+  "compiler": {
+    "version": "5.9.3",
+    "target": "ES2022",
+    "module": "ES2022",
+    "strictTypecheckPassed": true
+  },
+  "runtimeChanges": [
+    "ESM relative import extensions only in engine/classifier",
+    "GitReader process wrapper replaced by bounded local-only runner",
+    "GitReader blame catch rethrows resource/incomplete-history failures; ordinary per-file errors retain native handling",
+    "GitReader blame streams incremental groups and sums their line counts with exact native attribution; bounded lines and stderr preserve resource limits without capping total streamed stdout"
+  ],
+  "generatedFiles": [
+    {
+      "file": "GitDurabilityEngine.mjs",
+      "sha256": "7aee834f36a2737f1e7dd459ed067653c264a5d46ce5d602ed3fbba24ae1cc8a"
+    },
+    {
+      "file": "GitReader.mjs",
+      "sha256": "727cc9dd9278ac29dd18d5d482918c20ee7c7550356376614051566ca2f4abd0"
+    },
+    {
+      "file": "OriginClassifier.mjs",
+      "sha256": "f1da36019423b8e60ad9c9c69b690c55fde4333de27dd3ee08a95ec97f09d7b7"
+    },
+    {
+      "file": "types.mjs",
+      "sha256": "50401f50b011535140ddc298f3b532cc931a0039247b96e64e7352c04c022723"
+    }
+  ]
+}

package/bin/durability/runtime.mjs

@@ -0,0 +1,120 @@
+import { execFile, spawn } from 'node:child_process'
+
+export const MAX_GIT_BUFFER = 16 * 1024 * 1024
+export const MAX_GIT_TIME_MS = 30_000
+let deadline = 0
+const children = new Set()
+
+export class GitMeasurementError extends Error {
+  constructor(reason) { super(reason); this.reason = reason; this.fatalMeasurement = true }
+}
+export const isFatalGitError = (error) => error?.fatalMeasurement === true
+export function setDeadline(value) { deadline = value }
+export function remainingTime() {
+  const remaining = deadline - Date.now()
+  if (remaining <= 0) throw new GitMeasurementError('time budget exceeded')
+  return remaining
+}
+export function stopGitChildren() {
+  for (const child of children) { try { child.kill('SIGKILL') } catch {} }
+}
+
+export function localGitEnvironment() {
+  const env = {}
+  for (const name of ['PATH', 'HOME', 'USERPROFILE', 'SystemRoot', 'WINDIR', 'TMPDIR', 'TMP', 'TEMP']) {
+    if (process.env[name] !== undefined) env[name] = process.env[name]
+  }
+  return { ...env, LC_ALL: 'C', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: process.platform === 'win32' ? 'NUL' : '/dev/null', GIT_TERMINAL_PROMPT: '0', GIT_OPTIONAL_LOCKS: '0', GIT_NO_LAZY_FETCH: '1' }
+}
+
+function gitArgs(repoPath, args) {
+  return [
+    '--no-pager', '-c', 'core.fsmonitor=false', '-c', 'core.hooksPath=' + (process.platform === 'win32' ? 'NUL' : '/dev/null'),
+    '-c', 'credential.helper=', '-c', 'protocol.allow=never', '-c', 'protocol.file.allow=never',
+    '-C', repoPath, ...args,
+  ]
+}
+
+function gitError(error, stderr) {
+  if (error.code === 'ENOENT') return new GitMeasurementError('Git is unavailable')
+  if (error.code === 'ERR_CHILD_PROCESS_STDIO_MAXBUFFER' || error.code === 'ENOBUFS') return new GitMeasurementError('Git output exceeded the 16 MiB resource limit')
+  if (error.killed || error.signal || error.code === 'ETIMEDOUT') return new GitMeasurementError('Git command exceeded the time budget')
+  if (/missing (?:blob|tree|commit|object)|bad object|unable to read|could not read|object .*corrupt|object file .*empty|invalid object|promisor|transport .*not allowed/i.test(stderr || '')) {
+    return new GitMeasurementError('Git history is incomplete or unavailable locally')
+  }
+  // Never propagate command output, author identities or credentials to logs.
+  const safeError = new Error('Git command failed')
+  safeError.code = error.code
+  return safeError
+}
+
+export async function runGit(repoPath, args, { allowMissingConfig = false } = {}) {
+  const timeout = Math.min(MAX_GIT_TIME_MS, remainingTime())
+  return new Promise((resolve, reject) => {
+    const child = execFile('git', gitArgs(repoPath, args), { encoding: 'utf8', maxBuffer: MAX_GIT_BUFFER, timeout, killSignal: 'SIGKILL', windowsHide: true, env: localGitEnvironment() }, (error, stdout, stderr) => {
+      children.delete(child)
+      if (!error) { try { remainingTime(); resolve(stdout) } catch (e) { reject(e) }; return }
+      if (allowMissingConfig && error.code === 1) { resolve(''); return }
+      reject(gitError(error, stderr))
+    })
+    children.add(child)
+  })
+}
+
+/** Consume stdout a line at a time; retain at most one bounded line, not the full output. */
+export async function runGitLines(repoPath, args, onLine) {
+  const timeout = Math.min(MAX_GIT_TIME_MS, remainingTime())
+  return new Promise((resolve, reject) => {
+    let pending = ''
+    let stderr = ''
+    let failure
+    const child = spawn('git', gitArgs(repoPath, args), {
+      stdio: ['ignore', 'pipe', 'pipe'], timeout, killSignal: 'SIGKILL', windowsHide: true, env: localGitEnvironment(),
+    })
+    children.add(child)
+    const fail = error => {
+      failure ??= error
+      child.kill('SIGKILL')
+    }
+    const emit = line => {
+      if (Buffer.byteLength(line) > MAX_GIT_BUFFER) throw gitError({ code: 'ENOBUFS' })
+      onLine(line)
+    }
+    child.stdout.setEncoding('utf8')
+    child.stdout.on('data', chunk => {
+      if (failure) return
+      try {
+        remainingTime()
+        const text = pending + chunk
+        let start = 0
+        for (let end = text.indexOf('\n'); end !== -1; end = text.indexOf('\n', start)) {
+          emit(text.slice(start, end))
+          start = end + 1
+        }
+        pending = text.slice(start)
+        if (Buffer.byteLength(pending) > MAX_GIT_BUFFER) throw gitError({ code: 'ENOBUFS' })
+      } catch (error) {
+        fail(isFatalGitError(error) ? error : new GitMeasurementError('Git output could not be parsed'))
+      }
+    })
+    child.stderr.setEncoding('utf8')
+    child.stderr.on('data', chunk => {
+      if (failure) return
+      if (Buffer.byteLength(stderr) + Buffer.byteLength(chunk) > MAX_GIT_BUFFER) fail(gitError({ code: 'ENOBUFS' }))
+      else stderr += chunk
+    })
+    child.on('error', error => { failure ??= gitError(error, stderr) })
+    child.on('close', (code, signal) => {
+      children.delete(child)
+      if (failure) { reject(failure); return }
+      if (code !== 0 || signal) { reject(gitError({ code, signal, killed: child.killed }, stderr)); return }
+      try {
+        remainingTime()
+        if (pending) emit(pending)
+        resolve()
+      } catch (error) {
+        reject(isFatalGitError(error) ? error : new GitMeasurementError('Git output could not be parsed'))
+      }
+    })
+  })
+}

package/bin/durability/types.mjs

@@ -0,0 +1,5 @@
+/**
+ * Native durability engine — domain types. Our own reimplementation of
+ * git-history durability analysis (no external engine dependency).
+ */
+export {};

package/bin/durability/validate.mjs

@@ -0,0 +1,31 @@
+export const ENGINE_COMMIT = '35a9ac72e2a131c108b40c9d2477f58a90deb4c1'
+const COUNTS = ['commitsTotal', 'linesIntroduced', 'linesSurviving', 'churnLinesAffected']
+const RATIOS = ['survivalRate', 'stabilizationRatio', 'revertRate', 'newCodeChurn2w', 'cascadeRate']
+const PCTS = ['aiDetectionCoveragePct', 'durablePct', 'churnPct', 'revertPct', 'suspectedAttributionGapPct']
+const TOOLS = ['Copilot', 'Claude', 'Cursor', 'Codeium', 'Tabnine', 'Amazon Q', 'Gemini', 'Windsurf', 'Devin', 'Aider']
+const object = (v) => v !== null && typeof v === 'object' && !Array.isArray(v)
+const keys = (v, names) => object(v) && Object.keys(v).length === names.length && Object.keys(v).every(k => names.includes(k))
+const count = (v) => Number.isSafeInteger(v) && v >= 0
+const ratio = (v) => Number.isFinite(v) && v >= 0 && v <= 1
+const roundedRatio = (surviving, introduced) => introduced > 0 ? Math.round(surviving / introduced * 1000) / 1000 : 0
+function survivalMap(map, allowed) {
+  return object(map) && Object.entries(map).every(([key, v]) => allowed.includes(key) && keys(v, ['linesIntroduced', 'linesSurviving', 'survivalRate']) && count(v.linesIntroduced) && count(v.linesSurviving) && ratio(v.survivalRate) && v.linesSurviving <= v.linesIntroduced && v.survivalRate === roundedRatio(v.linesSurviving, v.linesIntroduced))
+}
+export function validateReport(report, now = Date.now()) {
+  try {
+    if (!keys(report, ['version', 'source', 'engineCommit', 'windowDays', 'settleDays', 'headSha', 'measuredAt', 'result'])) return false
+    if (report.version !== 1 || report.source !== 'ci' || report.engineCommit !== ENGINE_COMMIT || report.windowDays !== 90 || report.settleDays !== 14 || !/^[0-9a-f]{40}$/.test(report.headSha)) return false
+    if (typeof report.measuredAt !== 'string' || !Number.isFinite(Date.parse(report.measuredAt)) || Math.abs(now - Date.parse(report.measuredAt)) > 86_400_000) return false
+    const r = report.result
+    if (!keys(r, [...COUNTS, ...RATIOS, ...PCTS, 'signalToNoise', 'attributionConfidence', 'byOrigin', 'byTool'])) return false
+    if (!COUNTS.every(k => count(r[k])) || !RATIOS.every(k => ratio(r[k])) || !PCTS.every(k => count(r[k]) && r[k] <= 100)) return false
+    if (!(r.signalToNoise === null || (Number.isFinite(r.signalToNoise) && r.signalToNoise >= 0)) || r.attributionConfidence !== 'LOW') return false
+    if (!survivalMap(r.byOrigin, ['AI_ATTRIBUTED', 'BOT', 'HUMAN']) || !survivalMap(r.byTool, TOOLS)) return false
+    const sum = (map, key) => Object.values(map).reduce((n, v) => n + v[key], 0)
+    if (sum(r.byOrigin, 'linesIntroduced') !== r.linesIntroduced || sum(r.byOrigin, 'linesSurviving') > r.linesSurviving || r.linesSurviving > r.linesIntroduced || r.survivalRate !== roundedRatio(r.linesSurviving, r.linesIntroduced)) return false
+    if (r.durablePct !== (r.linesIntroduced > 0 ? Math.round(r.linesSurviving / r.linesIntroduced * 100) : 0) || Math.abs(r.revertPct - r.revertRate * 100) > 0.55 || r.churnPct !== Math.max(0, 100 - r.durablePct - r.revertPct)) return false
+    if (sum(r.byTool, 'linesIntroduced') !== (r.byOrigin.AI_ATTRIBUTED?.linesIntroduced ?? 0) || sum(r.byTool, 'linesSurviving') > (r.byOrigin.AI_ATTRIBUTED?.linesSurviving ?? 0)) return false
+    if (r.signalToNoise !== (r.churnLinesAffected > 0 ? Math.round(r.linesSurviving / r.churnLinesAffected * 100) / 100 : null)) return false
+    return Buffer.byteLength(JSON.stringify(report)) <= 1024 * 1024
+  } catch { return false }
+}