@sdd-method/author-cli 0.0.0-stage → 0.1.0

package/dist/lib/catalogue/service-architecture-parser.js

@@ -0,0 +1,193 @@
+// Shared parser for per-service `repos/<id>/docs/service-architecture.md`.
+//
+// Extracted from builders/services.ts so two callers can share it:
+//   - the per-SDD services builder (buildServices), and
+//   - the aggregator's federated reverse-metadata enrichment pass
+//     (ADR 0163 P2), which reaches member SDDs' arch docs that the
+//     platform-root's own build never sees.
+//
+// The metadata is read faithfully — not inferred — from three blocks:
+//   - `## Runtime / Build Shape` table `Primary runtime` → runtime_type
+//     (+ a derived language token).
+//   - `## Operational Status` table `Classification` → status,
+//     `Confidence` → confidence (emitted out-of-band by an adopter's
+//     derive-operational-evidence script).
+//   - `## Purpose` lead paragraph → description.
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+const REPOS_DIR_REL = "repos";
+const SERVICE_ARCHITECTURE_REL = join("docs", "service-architecture.md");
+export const EMPTY_METADATA = {
+    runtime_type: "",
+    language: "",
+    status: "",
+    confidence: "",
+    description: "",
+};
+/**
+ * Walk `<sddPath>/repos/` and index every service-architecture.md by its
+ * repo slug — the directory name immediately above `docs/`. Handles both
+ * the flat (`repos/<repo>/docs/`) and grouped (`repos/<group>/<repo>/docs/`)
+ * layouts. First match wins (deterministic via readdir + walk order).
+ */
+export async function indexServiceArchitectures(sddPath) {
+    const index = new Map();
+    const reposDir = join(sddPath, REPOS_DIR_REL);
+    async function walk(dir) {
+        let entries;
+        try {
+            entries = await readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            const child = join(dir, entry.name);
+            const archPath = join(child, SERVICE_ARCHITECTURE_REL);
+            try {
+                const docs = await readdir(join(child, "docs"));
+                if (docs.includes("service-architecture.md")) {
+                    if (!index.has(entry.name))
+                        index.set(entry.name, archPath);
+                }
+            }
+            catch {
+                // no docs/ here — keep descending for the grouped layout.
+            }
+            await walk(child);
+        }
+    }
+    await walk(reposDir);
+    return index;
+}
+/** Read and parse a service-architecture.md from disk. */
+export async function readServiceMetadata(archPath) {
+    let text;
+    try {
+        text = await readFile(archPath, "utf-8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return EMPTY_METADATA;
+        throw err;
+    }
+    return parseServiceArchitecture(text);
+}
+/** Parse the three metadata blocks out of service-architecture.md text. */
+export function parseServiceArchitecture(text) {
+    const buildShape = parseKeyValueTable(text, /^##\s+Runtime\s*\/\s*Build Shape\b/i);
+    const opsStatus = parseKeyValueTable(text, /^##\s+Operational Status\b/i);
+    const primaryRuntime = buildShape.get("primary runtime") ?? "";
+    return {
+        runtime_type: primaryRuntime,
+        language: deriveLanguage(primaryRuntime),
+        // Strip markdown bold from the classification cell (e.g. **library**).
+        status: stripEmphasis(opsStatus.get("classification") ?? ""),
+        confidence: stripEmphasis(opsStatus.get("confidence") ?? ""),
+        description: parseLeadParagraph(text, /^##\s+Purpose\b/i),
+    };
+}
+/**
+ * Parse a two-column markdown table (`| key | value |`) that follows the
+ * first heading matching `headingRe`, returning a lowercased-key → value
+ * map. Header and separator rows are skipped. Stops at the next heading or
+ * the end of the table block.
+ */
+function parseKeyValueTable(text, headingRe) {
+    const out = new Map();
+    const lines = text.split(/\r?\n/);
+    let inSection = false;
+    let seenTable = false;
+    for (const line of lines) {
+        const t = line.trim();
+        if (!inSection) {
+            if (headingRe.test(t))
+                inSection = true;
+            continue;
+        }
+        if (t.startsWith("#"))
+            break; // next heading ends the section
+        const isRow = t.startsWith("|") && t.endsWith("|");
+        if (!isRow) {
+            if (seenTable)
+                break; // table block ended
+            continue;
+        }
+        seenTable = true;
+        const cells = t
+            .slice(1, -1)
+            .split("|")
+            .map((c) => c.trim());
+        if (cells.length < 2)
+            continue;
+        const key = cells[0].toLowerCase();
+        // Skip header row ("aspect"/"field") and separator row (---).
+        if (key === "" || /^:?-+:?$/.test(key) || key === "aspect" || key === "field") {
+            continue;
+        }
+        out.set(key, cells[1]);
+    }
+    return out;
+}
+/**
+ * First non-empty paragraph block after the heading matching `headingRe`,
+ * lines joined with single spaces. "" when the heading is absent.
+ */
+function parseLeadParagraph(text, headingRe) {
+    const lines = text.split(/\r?\n/);
+    let inSection = false;
+    const paragraph = [];
+    for (const line of lines) {
+        const t = line.trim();
+        if (!inSection) {
+            if (headingRe.test(t))
+                inSection = true;
+            continue;
+        }
+        if (t.startsWith("#"))
+            break;
+        if (t === "") {
+            if (paragraph.length > 0)
+                break;
+            continue;
+        }
+        paragraph.push(t);
+    }
+    return paragraph.join(" ");
+}
+function stripEmphasis(s) {
+    return s.replace(/\*\*/g, "").replace(/^_+|_+$/g, "").trim();
+}
+/**
+ * Derive a language token from a "Primary runtime" value such as
+ * "Java 8", "Node.js 18 / AWS Lambda", "Terraform ~> 1.3",
+ * "Vue 3 / TypeScript". Returns "" when nothing recognisable matches.
+ */
+function deriveLanguage(primaryRuntime) {
+    const s = primaryRuntime.toLowerCase();
+    if (s === "")
+        return "";
+    // Order matters: more specific signals first.
+    if (/\btypescript\b/.test(s))
+        return "TypeScript";
+    if (/\bvue\b/.test(s))
+        return "TypeScript";
+    if (/\bnode(\.js)?\b/.test(s))
+        return "JavaScript";
+    if (/\bjava\b/.test(s))
+        return "Java";
+    if (/\bkotlin\b/.test(s))
+        return "Kotlin";
+    if (/\bterraform\b/.test(s))
+        return "HCL";
+    if (/\bpython\b|\bsynapse\b/.test(s))
+        return "Python";
+    if (/\bgo(lang)?\b/.test(s))
+        return "Go";
+    if (/\.net\b|\bc#\b|\bdotnet\b/.test(s))
+        return "C#";
+    return "";
+}
+//# sourceMappingURL=service-architecture-parser.js.map

package/dist/lib/catalogue/service-contract-aliases-loader.js

@@ -0,0 +1,109 @@
+/**
+ * Loader for the optional `.sdd/service-contract-aliases.yaml` config.
+ *
+ * Adopters use this map to translate outbound interface display text
+ * (as it appears in service-architecture.md External Interfaces tables)
+ * into canonical contract names that resolve against contracts.csv.
+ *
+ * File shape:
+ *
+ *     interface_aliases:
+ *       # Case-insensitive exact match on the Interface column text.
+ *       Example service: example-oauth-api
+ *       Gateway: example-gateway-api
+ *       Legacy gateway: example-gateway-api
+ *
+ *     interface_contains:
+ *       # Case-insensitive substring match. The longest key wins on
+ *       # ties; ordering in the file otherwise matters only when keys
+ *       # overlap. Use when adopter interface text has many qualified
+ *       # variants ("Example API", "Example `/token`", etc.).
+ *       Example: example-oauth-api
+ *       Legacy gateway: example-gateway-api
+ *
+ *     skip_callers:
+ *       # Repo names to skip entirely (postman collections, smoke tests,
+ *       # legacy folders inside a federated SDD that aren't runtime
+ *       # services). Use when the federated SDD lacks a services.csv to
+ *       # gate emission and consumes rows would otherwise dangle at the
+ *       # aggregator with unresolved service_id.
+ *       - postman-tacho
+ *       - smoke-tests
+ *
+ *     same_product_inference:
+ *       # Maps generic interface text (case-insensitive exact) to a
+ *       # contract-name template. `{prefix}` is substituted with the
+ *       # caller's service_id minus a known suffix (-api, -bff, -ui,
+ *       # -consumer, -web). The builder then looks up the resolved name
+ *       # in contracts.csv.
+ *       Private API: "{prefix}-private-api"
+ *       Private API Gateway: "{prefix}-private-api"
+ *
+ * Either block is optional. Empty / missing file = no aliases.
+ */
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parse as parseYaml } from "yaml";
+const ALIASES_FILENAME = join(".sdd", "service-contract-aliases.yaml");
+export async function loadServiceContractAliases(sddPath) {
+    const full = join(sddPath, ALIASES_FILENAME);
+    let text;
+    try {
+        text = await readFile(full, "utf-8");
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT")
+            return null;
+        throw err;
+    }
+    const raw = parseYaml(text);
+    if (raw === null || typeof raw !== "object") {
+        throw new Error(`${ALIASES_FILENAME}: expected a mapping at the document root`);
+    }
+    return {
+        interfaceAliases: toLowerKeyMap(raw.interface_aliases),
+        interfaceContains: toContainsList(raw.interface_contains),
+        sameProductTemplates: toLowerKeyMap(raw.same_product_inference),
+        skipCallers: toStringSet(raw.skip_callers),
+        relPath: ALIASES_FILENAME,
+    };
+}
+function toStringSet(raw) {
+    const out = new Set();
+    if (Array.isArray(raw)) {
+        for (const item of raw) {
+            if (typeof item === "string" && item !== "")
+                out.add(item);
+        }
+    }
+    return out;
+}
+function toContainsList(raw) {
+    const out = [];
+    if (raw === null || raw === undefined)
+        return out;
+    if (typeof raw !== "object" || Array.isArray(raw))
+        return out;
+    for (const [k, v] of Object.entries(raw)) {
+        if (typeof v === "string" && v !== "") {
+            out.push([k.toLowerCase().trim(), v]);
+        }
+    }
+    // Sort longest-key-first so the most specific substring wins.
+    out.sort((a, b) => b[0].length - a[0].length);
+    return out;
+}
+function toLowerKeyMap(raw) {
+    const out = new Map();
+    if (raw === null || raw === undefined)
+        return out;
+    if (typeof raw !== "object" || Array.isArray(raw))
+        return out;
+    for (const [k, v] of Object.entries(raw)) {
+        if (typeof v === "string" && v !== "")
+            out.set(k.toLowerCase().trim(), v);
+    }
+    return out;
+}
+//# sourceMappingURL=service-contract-aliases-loader.js.map

package/dist/lib/catalogue/staleness-verdicts.js

@@ -0,0 +1,345 @@
+// Staleness VERDICTS — the second half of M-ADR 0205 §4.5's staleness scope
+// (ledger §3o): "staleness meaning corpus_ref older than the target's last
+// content change". The scores-coverage predicate computes each row's BASIS;
+// this module computes the VERDICT the basis supports. A stale score is worse
+// than a missing one, because it reads as coverage — the predicate otherwise
+// counts a score written against a corpus that has since moved as fully
+// covering its target.
+//
+// Verdict rules, per basis:
+//   corpus_ref + target_path — PRECISE, and a CONTENT test: the target is stale
+//       iff its blob at HEAD differs from its blob at the anchor. An anchor the
+//       repo does not know is UNKNOWN-ANCHOR (never guessed); an anchor with
+//       no target_path cannot support a per-target verdict and is counted as
+//       such rather than compared against repo HEAD (which would mark a row
+//       stale whenever ANYTHING in the repo moved — alarm, not measurement).
+//
+//       WHY CONTENT AND NOT `git log`: the previous test asked whether any
+//       commit touched the path since the anchor, which fires on a PURE RENAME
+//       — so a portability rename restarts the staleness treadmill for every
+//       anchored score in the corpus, and the estate is told to re-review
+//       hundreds of artefacts whose text never changed. Measured instance: one
+//       score reported stale-by-hours was byte-IDENTICAL to its assessed state,
+//       caught only by comparing blobs by hand. A test that cannot tell "moved"
+//       from "changed" produces re-review debt out of nothing.
+//
+//       Renames are exempt BY CONSTRUCTION, not by a special case: where the
+//       path does not exist at the anchor, git's own rename detection over
+//       <anchor>..HEAD supplies the pre-rename name and the blob is compared
+//       across it. Where that also fails the row is PATH-ABSENT-AT-ANCHOR —
+//       reported as its own outcome rather than guessed either way.
+//
+//   TARGET-MISSING (any basis): the target_path does not exist at HEAD. A
+//       deleted artefact cannot be re-reviewed, so folding it into `stale`
+//       prescribes a remedy that cannot be performed (M-ADR 0199 §4.4). It is
+//       counted and reported on its own, and its remedy is to withdraw or
+//       re-point the score.
+//   scored_at + target_path — COARSE: last content change of the path
+//       (committer date) after scored_at ⇒ stale. A path git does not track
+//       is UNKNOWN-ANCHOR.
+//   none — already reported by scores-coverage as unknown currency; not
+//       re-reported here.
+//
+// MEMBER TIER ONLY, stated not silent: the aggregate tier reads sibling
+// catalogues whose target files and git histories are not local, so a verdict
+// there would be a guess. Reporting-only (`coverage` class) like the rest of
+// the scores family — promotion to gate-acting is a later, deliberate act.
+import { execFile as execFileCb } from "node:child_process";
+import { access } from "node:fs/promises";
+import { join } from "node:path";
+import { promisify } from "node:util";
+const execFile = promisify(execFileCb);
+const NO_RUN = {
+    assessed: 0,
+    stale: [],
+    current: 0,
+    unknownAnchor: 0,
+    anchorWithoutPath: 0,
+    targetMissing: [],
+    pathAbsentAtAnchor: 0,
+    directoryTargets: 0,
+};
+async function git(sddRoot, args) {
+    try {
+        const { stdout } = await execFile("git", [...args], {
+            cwd: sddRoot,
+            encoding: "utf8",
+            maxBuffer: 4 * 1024 * 1024,
+        });
+        return { ok: true, stdout: stdout.trim() };
+    }
+    catch {
+        return { ok: false, stdout: "" };
+    }
+}
+/**
+ * Is the target genuinely GONE, or merely not committed?
+ *
+ * `git rev-parse HEAD:<path>` fails for both a deleted file and an untracked
+ * one that is sitting on disk. Treating the second as deleted would tell an
+ * author to withdraw a score for an artefact they can see in front of them —
+ * so absence from the HEAD tree is confirmed against the working tree before
+ * it is called missing. (Caught by this module's own untracked-path control,
+ * which is what it was there for.)
+ */
+async function existsOnDisk(sddRoot, path) {
+    try {
+        await access(join(sddRoot, path));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * DIRECTORY TARGETS are a real and different case, raised by the reverse estate
+ * from its own pre-cut data: 18 of its 84 stale rows name a whole-domain
+ * directory rather than a file.
+ *
+ * `git rev-parse <rev>:<path>` returns a TREE oid for a directory and a BLOB oid
+ * for a file, so the comparison below works for both — but it does not mean the
+ * same thing. A file is stale when its own bytes changed; a directory is stale
+ * when ANYTHING beneath it changed, which for a whole-domain tree is close to
+ * unconditional. That is a wider test, and it is defensible (a score over a tree
+ * really is invalidated by movement inside it) — but it must be SAID, because a
+ * number that is near-unconditional by construction reads exactly like a number
+ * that is measuring something.
+ *
+ * Git's rename detection also does not apply: a tree has no rename pair. A moved
+ * directory therefore lands in `pathAbsentAtAnchor` rather than being exempted.
+ */
+async function objectTypeAt(sddRoot, rev, path) {
+    const oid = await git(sddRoot, ["rev-parse", `${rev}:${path}`]);
+    if (!oid.ok || oid.stdout === "")
+        return null;
+    const t = await git(sddRoot, ["cat-file", "-t", oid.stdout]);
+    if (!t.ok)
+        return null;
+    return t.stdout === "tree" ? "tree" : "blob";
+}
+/** Blob (or tree — see `objectTypeAt`) id of `<rev>:<path>`, else null. */
+async function blobAt(sddRoot, rev, path) {
+    const r = await git(sddRoot, ["rev-parse", `${rev}:${path}`]);
+    return r.ok && r.stdout !== "" ? r.stdout : null;
+}
+/**
+ * new-path -> pre-rename path, from git's OWN rename detection over
+ * `<anchor>..HEAD`. One call per distinct anchor, not per row: anchors are few
+ * and this walk is the expensive part.
+ *
+ * Using git's detector rather than a heuristic matters — a basename match would
+ * pair unrelated files that happen to share a name, which is precisely the
+ * shared-token failure this corpus keeps producing.
+ */
+async function renameMap(sddRoot, anchor) {
+    const map = new Map();
+    const r = await git(sddRoot, ["diff", "--name-status", "-M", anchor, "HEAD"]);
+    if (!r.ok)
+        return map;
+    for (const line of r.stdout.split("\n")) {
+        if (!line.startsWith("R"))
+            continue;
+        const parts = line.split("\t");
+        if (parts.length < 3)
+            continue;
+        map.set(parts[2], parts[1]);
+    }
+    return map;
+}
+export async function runStalenessVerdicts(session, options) {
+    if (!options.available.has("quality_scores"))
+        return { ...NO_RUN };
+    if (options.tier !== "member") {
+        return {
+            ...NO_RUN,
+            skipped: "aggregate tier cannot reach member repos' files or git histories — staleness verdicts are member-tier",
+        };
+    }
+    const inRepo = await git(options.sddRoot, ["rev-parse", "--git-dir"]);
+    if (!inRepo.ok) {
+        return {
+            ...NO_RUN,
+            skipped: `${options.sddRoot} is not a git repository — no anchor can be compared, verdicts UNATTEMPTED (not fresh)`,
+        };
+    }
+    const asStr = (v) => v === null || v === undefined ? "" : String(v).trim();
+    const reader = await session.conn.runAndReadAll(`SELECT rubric_id, target_ref, target_path, corpus_ref, scored_at, staleness_basis
+     FROM "quality_scores"
+     WHERE staleness_basis IN ('corpus_ref', 'scored_at');`);
+    const rows = reader.getRows();
+    const stale = [];
+    let current = 0;
+    let unknownAnchor = 0;
+    let anchorWithoutPath = 0;
+    let pathAbsentAtAnchor = 0;
+    let directoryTargets = 0;
+    const targetMissing = [];
+    const anchorKnown = new Map();
+    const renamesByAnchor = new Map();
+    for (const [rubricIdRaw, targetRefRaw, targetPathRaw, corpusRefRaw, scoredAtRaw, basisRaw] of rows) {
+        const rubricId = asStr(rubricIdRaw);
+        const targetRef = asStr(targetRefRaw);
+        const basis = asStr(basisRaw);
+        // Counted for BOTH bases, before the branch. The first cut of this counter
+        // sat inside the corpus_ref branch only, so it was blind to every
+        // scored_at row — and the estate that ASKED for this count has all 18 of
+        // its directory targets on the scored_at basis, so the metric it requested
+        // read zero for it. The controls passed because they were written with
+        // corpus_ref fixtures: a control that exercises one branch says nothing
+        // about the other.
+        {
+            const p = asStr(targetPathRaw);
+            if (p !== "" && (await objectTypeAt(options.sddRoot, "HEAD", p)) === "tree") {
+                directoryTargets += 1;
+            }
+        }
+        if (basis === "corpus_ref") {
+            const anchor = asStr(corpusRefRaw);
+            const path = asStr(targetPathRaw);
+            if (path === "") {
+                anchorWithoutPath += 1;
+                continue;
+            }
+            let known = anchorKnown.get(anchor);
+            if (known === undefined) {
+                known = (await git(options.sddRoot, ["cat-file", "-e", `${anchor}^{commit}`])).ok;
+                anchorKnown.set(anchor, known);
+            }
+            if (!known) {
+                unknownAnchor += 1;
+                continue;
+            }
+            const headBlob = await blobAt(options.sddRoot, "HEAD", path);
+            if (headBlob === null) {
+                if (await existsOnDisk(options.sddRoot, path)) {
+                    // Present but uncommitted: no blob to compare against, and nothing
+                    // deleted. Unknown, which is not fresh.
+                    unknownAnchor += 1;
+                }
+                else {
+                    targetMissing.push({ rubricId, targetRef, targetPath: path });
+                }
+                continue;
+            }
+            let anchorBlob = await blobAt(options.sddRoot, anchor, path);
+            if (anchorBlob === null) {
+                // The path did not exist at the anchor under this name. Ask git whether
+                // it was renamed there rather than concluding anything.
+                let renames = renamesByAnchor.get(anchor);
+                if (renames === undefined) {
+                    renames = await renameMap(options.sddRoot, anchor);
+                    renamesByAnchor.set(anchor, renames);
+                }
+                const oldPath = renames.get(path);
+                if (oldPath !== undefined) {
+                    anchorBlob = await blobAt(options.sddRoot, anchor, oldPath);
+                }
+            }
+            if (anchorBlob === null) {
+                pathAbsentAtAnchor += 1;
+                continue;
+            }
+            if (anchorBlob === headBlob) {
+                // Byte-identical to its assessed state — including across a rename,
+                // which is the whole point of testing content instead of touches.
+                current += 1;
+            }
+            else {
+                stale.push({
+                    rubricId,
+                    targetRef,
+                    basis: "corpus_ref",
+                    detail: "target CONTENT differs from its state at the anchor",
+                });
+            }
+        }
+        else {
+            const path = asStr(targetPathRaw);
+            const at = asStr(scoredAtRaw);
+            if (path === "" || at === "") {
+                // basis says scored_at, but the row cannot actually support it —
+                // count as unknown rather than trusting the label over the data.
+                unknownAnchor += 1;
+                continue;
+            }
+            if ((await blobAt(options.sddRoot, "HEAD", path)) === null &&
+                !(await existsOnDisk(options.sddRoot, path))) {
+                targetMissing.push({ rubricId, targetRef, targetPath: path });
+                continue;
+            }
+            const last = await git(options.sddRoot, ["log", "-1", "--format=%cI", "--", path]);
+            if (!last.ok || last.stdout === "") {
+                unknownAnchor += 1;
+                continue;
+            }
+            const reviewedMs = Date.parse(at);
+            if (Number.isNaN(reviewedMs)) {
+                unknownAnchor += 1;
+                continue;
+            }
+            if (Date.parse(last.stdout) > reviewedMs) {
+                stale.push({
+                    rubricId,
+                    targetRef,
+                    basis: "scored_at",
+                    detail: `target last changed ${last.stdout.slice(0, 10)}, after the review of ${at.slice(0, 10)}`,
+                });
+            }
+            else {
+                current += 1;
+            }
+        }
+    }
+    return {
+        assessed: rows.length,
+        stale,
+        current,
+        unknownAnchor,
+        anchorWithoutPath,
+        targetMissing,
+        pathAbsentAtAnchor,
+        directoryTargets,
+    };
+}
+export function renderStalenessVerdicts(res, tier) {
+    const out = [];
+    if (res.skipped !== undefined) {
+        out.push(`[metric] scores_staleness (${tier}): n/a — ${res.skipped}`);
+        return out;
+    }
+    if (res.assessed === 0)
+        return out;
+    for (const s of res.stale) {
+        out.push(`[finding] coverage: ${s.rubricId} score for '${s.targetRef}' is STALE — ` +
+            `${s.detail}; the assessment predates the artefact it reads as covering — ` +
+            `re-review it or record why the change does not invalidate the score`);
+    }
+    if (res.pathAbsentAtAnchor > 0) {
+        // Counted AND said. A bucket that only ever appears as a number in a metric
+        // line is a state nobody acts on, and this one means an assessment cannot
+        // be verified at all.
+        out.push(`[finding] coverage: ${res.pathAbsentAtAnchor} score(s) have a target that DID NOT EXIST ` +
+            `AT THE ANCHOR under any name git can pair — the assessment cannot be verified ` +
+            `against its own corpus_ref; re-anchor the score, or re-review and re-anchor together`);
+    }
+    for (const t of res.targetMissing) {
+        // Remedy deliberately differs from STALE's. M-ADR 0199 §4.4 binds a remedy
+        // to be performable at the tier that emitted it, and "re-review it" cannot
+        // be performed on an artefact that no longer exists.
+        out.push(`[finding] coverage: ${t.rubricId} score for '${t.targetRef}' has a TARGET THAT NO LONGER ` +
+            `EXISTS — '${t.targetPath}' is absent at HEAD; the assessment cannot be re-reviewed, ` +
+            `so withdraw the score or re-point it at the successor artefact`);
+    }
+    out.push(`[metric] scores_staleness (${tier}): ${res.assessed} verdict-capable score(s) — ` +
+        `${res.stale.length} stale / ${res.current} current / ` +
+        `${res.targetMissing.length} target-missing / ` +
+        `${res.unknownAnchor} unknown-anchor / ${res.anchorWithoutPath} anchor-without-path / ` +
+        `${res.pathAbsentAtAnchor} path-absent-at-anchor` +
+        (res.directoryTargets > 0
+            ? ` (of which ${res.directoryTargets} target a DIRECTORY — stale there means anything beneath it changed, a wider test than a file's and near-unconditional over a large tree)`
+            : "") +
+        ` (staleness is a CONTENT test — a rename is not a change; unknown is not fresh;` +
+        ` reporting-only per M-ADR 0205 §4.5)`);
+    return out;
+}
+//# sourceMappingURL=staleness-verdicts.js.map