@sun-asterisk/sungen 3.2.35 → 3.3.0-alpha.10

package/src/graph/unit-results-freshness.ts

@@ -0,0 +1,165 @@
+/**
+ * Which run a unit's results come from, and whether they still describe the suite (#942) — so `next`
+ * and the delivery checklist never read a months-old results JSON in silence. Read-only, like the rest
+ * of the graph's facts.
+ *
+ *   run       each result file's run start, as Playwright records it (`stats.startTime`); a file
+ *             without one is dated by its own change time, and says so
+ *   older     an input changed after the results it feeds were recorded:
+ *               per feature   its `.feature` and compiled `<base>.spec.ts` ↔ its `<base>-test-result*.json`
+ *               unit-wide     requirements/spec.md ↔ the oldest result file
+ *             Not contracts.lock.yaml: approving the contract after a run is the normal order, and it
+ *             changes no test — the contract check judges the lock, not the results.
+ *             A file's "change time" is its last commit when git tracks it unchanged, else its file
+ *             time. Results are "recorded" at the later of their run start and their own change time.
+ *             So a fresh checkout (every file the checkout's time) and results committed in the same
+ *             commit as the edit they ran against read fresh; an edit, or a commit, after them does not.
+ *   env       SUNGEN_ENV names an env no result file is for: readers fall back to another env's results
+ * Advisory: it states what it sees and warns; it decides no step and changes no exit code.
+ */
+import { execFileSync } from 'child_process';
+import * as fs from 'fs';
+import * as path from 'path';
+import { catalogIdFromScreenDir, featureFilesFor } from '../harness/unit-paths';
+import { generatedDirs, RESULT_FILE } from './unit-artifact-probes';
+
+export interface ResultsFreshness {
+  files: Array<{ file: string; runAt: string; source: 'run' | 'file' }>;
+  /** The oldest result file's run — what the counts are at least as old as. */
+  oldestRunAt: string;
+  newestRunAt: string;
+  /** How the oldest run is dated: Playwright's run start, or (none recorded) the file's change time. */
+  runAtSource: 'run' | 'file';
+  /** Inputs changed after the results they feed were recorded. */
+  newerInputs: Array<{ file: string; changedAt: string; source: 'commit' | 'file' }>;
+  /** SUNGEN_ENV, when no result file is for it. */
+  missingEnv?: string;
+  /** One line: what makes these results untrustworthy — absent when nothing does. */
+  warning?: string;
+}
+
+type Change = { ms: number; source: 'commit' | 'file' };
+/** `next` also runs inside the Claude Code hooks (10 s budget, the contract's git calls included): a slow git dates by file time instead. */
+const GIT_TIMEOUT_MS = 2_000;
+/** Commit times have one-second resolution: an edit and its results in one commit tie. */
+const TIE_MS = 1_000;
+const posix = (p: string): string => p.split(path.sep).join('/');
+const real = (p: string): string => { try { return fs.realpathSync(p); } catch { return path.resolve(p); } };
+const iso = (ms: number): string => new Date(ms).toISOString();
+
+/** project root → its git work tree (null outside one), asked once per process: `next` reads every unit. */
+const workTrees = new Map<string, string | null>();
+
+function git(cwd: string, args: string[]): string | null {
+  try { return execFileSync('git', args, { cwd, stdio: ['ignore', 'pipe', 'ignore'], timeout: GIT_TIMEOUT_MS, maxBuffer: 16 * 1024 * 1024 }).toString('utf8'); } catch { return null; }
+}
+
+/**
+ * When each file last changed: its last commit when git tracks it and it is unchanged, else its file
+ * time (no git, uncommitted, untracked, ignored, or git failed). Two git calls for the whole set.
+ */
+function changeTimes(projectRoot: string, files: string[]): (abs: string) => Change | null {
+  const mtime = (abs: string): Change | null => { try { return { ms: fs.statSync(abs).mtimeMs, source: 'file' }; } catch { return null; } };
+  if (!workTrees.has(projectRoot)) workTrees.set(projectRoot, git(projectRoot, ['rev-parse', '--show-toplevel'])?.trim() || null);
+  const top = workTrees.get(projectRoot);
+  if (!top) return mtime;
+  const topReal = real(top);
+  const rels = files.map((f) => posix(path.relative(topReal, real(f)))).filter((r) => r && !r.startsWith('..'));
+  if (!rels.length) return mtime;
+  const status = git(topReal, ['status', '--porcelain=v1', '-z', '--untracked-files=all', '--', ...rels]);
+  const log = git(topReal, ['log', '-n', '500', '--format=%x01%ct', '--name-only', '--', ...rels]);
+  if (status === null || log === null) return mtime;
+  const dirty = new Set<string>();
+  const entries = status.split('\0');
+  for (let i = 0; i < entries.length; i++) {
+    const e = entries[i];
+    if (e.length < 4) continue;
+    dirty.add(e.slice(3));
+    if (e[0] === 'R' || e[0] === 'C') i++;   // a rename/copy carries its source path next
+  }
+  const committed = new Map<string, number>();
+  let at = 0;
+  for (const line of log.split('\n')) {
+    if (line.startsWith('\x01')) at = Number(line.slice(1)) * 1000;
+    else if (line.trim() && at && !committed.has(line.trim())) committed.set(line.trim(), at);
+  }
+  return (abs) => {
+    const rel = posix(path.relative(topReal, real(abs)));
+    const t = committed.get(rel);
+    return t !== undefined && !dirty.has(rel) && fs.existsSync(abs) ? { ms: t, source: 'commit' } : mtime(abs);
+  };
+}
+
+function runStartOf(file: string): number | null {
+  try {
+    const t = (JSON.parse(fs.readFileSync(file, 'utf8')) as { stats?: { startTime?: unknown } })?.stats?.startTime;
+    const ms = typeof t === 'string' ? Date.parse(t) : NaN;
+    return Number.isNaN(ms) ? null : ms;
+  } catch { return null; }
+}
+
+/** Every result file of the unit, in the directories its readers look in. */
+function resultFilesOf(projectRoot: string, unitDir: string, unit: string): string[] {
+  const dirs = [...new Set([...generatedDirs(projectRoot, unit), path.join(projectRoot, 'specs', 'generated', catalogIdFromScreenDir(unitDir))])];
+  return dirs.flatMap((d) => { try { return fs.readdirSync(d).filter((f) => RESULT_FILE.test(f)).sort().map((f) => path.join(d, f)); } catch { return []; } });
+}
+
+/** The unit's results, dated, and what they are older than — undefined when the unit has none. */
+export function resultsFreshness(projectRoot: string, unitDir: string, unit: string, env: string | undefined = process.env.SUNGEN_ENV): ResultsFreshness | undefined {
+  const results = resultFilesOf(projectRoot, unitDir, unit);
+  if (!results.length) return undefined;
+  const features = featureFilesFor(unitDir, unit).filter((f) => fs.existsSync(f));
+  const specsOf = (base: string): string[] => [...new Set(results.map((r) => path.join(path.dirname(r), `${base}.spec.ts`)))].filter((f) => fs.existsSync(f));
+  const unitWide = [path.join(unitDir, 'requirements', 'spec.md')].filter((f) => fs.existsSync(f));
+  const baseOf = (f: string): string => path.basename(f).replace(RESULT_FILE, '');
+  const bases = [...new Set(results.map(baseOf))];
+  const changed = changeTimes(projectRoot, [...results, ...features, ...bases.flatMap(specsOf), ...unitWide]);
+  const rel = (f: string): string => posix(path.relative(projectRoot, f));
+
+  const dated = results.map((file) => {
+    const start = runStartOf(file);
+    const own = changed(file)?.ms ?? 0;
+    return { file, base: baseOf(file), runAt: start ?? own, source: (start !== null ? 'run' : 'file') as 'run' | 'file', recordedAt: Math.max(start ?? 0, own) };
+  });
+  const oldest = dated.reduce((a, b) => (b.runAt < a.runAt ? b : a));
+  const newest = dated.reduce((a, b) => (b.runAt > a.runAt ? b : a));
+  const recordedFor = (files: typeof dated): number => Math.min(...files.map((d) => d.recordedAt));
+
+  const newerInputs: ResultsFreshness['newerInputs'] = [];
+  const judge = (input: string, recordedAt: number): void => {
+    const c = changed(input);
+    if (c && c.ms > recordedAt + TIE_MS) newerInputs.push({ file: rel(input), changedAt: iso(c.ms), source: c.source });
+  };
+  for (const base of bases) {
+    const feeds = recordedFor(dated.filter((d) => d.base === base));
+    for (const f of [...features.filter((x) => path.basename(x, '.feature') === base), ...specsOf(base)]) judge(f, feeds);
+  }
+  for (const f of unitWide) judge(f, recordedFor(dated));
+
+  const variants = results.map((f) => path.basename(f).replace(/^.*-test-result\.?/, '').replace(/\.?json$/, ''));
+  const missingEnv = env && !variants.some((v) => v === env || v.endsWith(`.${env}`)) ? env : undefined;
+  const problems = [
+    ...(newerInputs.length ? [`results are older than ${newerInputs.slice(0, 3).map((i) => `${i.file} (changed ${shortDate(i.changedAt)})`).join(', ')}${newerInputs.length > 3 ? ', …' : ''} — re-run the tests before trusting the counts`] : []),
+    ...(missingEnv ? [`no results for SUNGEN_ENV=${missingEnv} — readers fall back to ${rel(oldest.file)}`] : []),
+  ];
+  return {
+    files: dated.map((d) => ({ file: rel(d.file), runAt: iso(d.runAt), source: d.source })),
+    oldestRunAt: iso(oldest.runAt), newestRunAt: iso(newest.runAt), runAtSource: oldest.source,
+    newerInputs, ...(missingEnv ? { missingEnv } : {}), ...(problems.length ? { warning: problems.join('; ') } : {}),
+  };
+}
+
+/** `2026-08-21 03:42Z` */
+export const shortDate = (isoTime: string): string => `${isoTime.slice(0, 16).replace('T', ' ')}Z`;
+
+/** `run 2026-08-21 03:42Z (65 days ago)` — the oldest run, and the newest when they are days apart. */
+export function describeResultsRun(f: ResultsFreshness, now = Date.now()): string {
+  // A file neither the JSON nor the file system could date reads as epoch 0 — "20000 days ago" is noise.
+  if (!(Date.parse(f.oldestRunAt) > 0)) return 'run time unknown (no run start in the JSON, no file time)';
+  const days = Math.floor((now - Date.parse(f.oldestRunAt)) / 86_400_000);
+  const age = days <= 0 ? 'today' : days === 1 ? '1 day ago' : `${days} days ago`;
+  const span = Date.parse(f.newestRunAt) - Date.parse(f.oldestRunAt) >= 86_400_000 ? ` to ${shortDate(f.newestRunAt)}` : '';
+  return f.runAtSource === 'run'
+    ? `run ${shortDate(f.oldestRunAt)} (${age})${span}`
+    : `file time ${shortDate(f.oldestRunAt)} (${age}; the JSON records no run start)${span}`;
+}

package/src/graph/unit-state-facts.ts

@@ -0,0 +1,112 @@
+/**
+ * The facts `readUnitState` adds for the graph's newer nodes — read through the same code the gate,
+ * the delivery and the Claude Code guard use, so `next` cannot disagree with them (red-team #12):
+ *
+ *   readTrustedAudit     audit.json through verifyAuditReport (OES-11.4, DOS-14.0): a stale, invalid
+ *                        or verdict-mismatched report counts as never audited, and says why
+ *   readContractFacts    the contract verdict rebuilt by buildContractVerdict (DOS-14.4) — the
+ *                        function `sungen contract check` and the delivery guard run — as the unit
+ *                        summary plus each case's class (phase 09: the test-case contract nodes)
+ */
+import { buildContractVerdict, ContractVerdict } from '../contract/build-contract-verdict';
+import { LOW_IDENTITY_FINDING } from '../contract/classify-trace-conformance';
+import { GUARD_GIT_TIMEOUT_MS, HeadSnapshot, headSnapshot, posixRel } from '../contract/contract-git';
+import { HARD_CLASSES } from '../contract/contract-schema';
+import { lockPathFor } from '../contract/contracts-lock-file';
+import type { UncommittedEntry } from '../contract/lock-vs-git-head';
+import { auditCounts, verifyAuditReport } from '../harness/gates/audit-report-verification';
+import type { TestCaseContract } from './test-case-state-shape';
+
+/** A report exists but does not count — `next` says "re-audit" exactly as gate and delivery block. */
+export interface AuditNotCounted { state: 'stale' | 'invalid'; reason: string }
+
+export interface ContractSummary {
+  verdict: 'pass' | 'review' | 'fail';
+  /** Scenarios with no approved lock entry (never block). */
+  proposed: number;
+  /** Approved scenarios changed, not weaker (`contract.hash-changed`) — review blocks delivery. */
+  review: number;
+  /** Approved scenarios that got weaker, changed target or lost a check (not `unproven`: no trace is no edit to undo). */
+  hard: number;
+  /** Approved free / impl:code scenarios no admissible trace proves (contract.unproven, hard) — a traced run, not a QA call. */
+  unproven?: number;
+  /** Approved free / impl:code scenarios whose trace is in review: opaque (incl. a low identity) or inconclusive. */
+  traceReview?: number;
+  /** Lock entries that are not what QA approved and committed (`contract.lock-uncommitted`). */
+  uncommitted: number;
+  /**
+   * What is wrong with them, the one to fix first: `tampered` (an entry no longer hashes to its steps),
+   * `untracked` (the lock was never committed), `edited` (a committed lock with uncommitted edits),
+   * `unverified` (no committed contract-approval decision vouches for an entry).
+   */
+  uncommittedKind?: 'tampered' | 'untracked' | 'edited' | 'unverified';
+  /** The first hard scenario, `<id> <class>`. */
+  headline?: string;
+  /** Set when the verdict could not be built (git unavailable with a lock, unreadable lock or feature). */
+  error?: string;
+}
+
+const message = (e: unknown): string => (e instanceof Error ? e.message : String(e)).split('\n')[0];
+
+export function readTrustedAudit(projectRoot: string, unit: string): { report: Record<string, unknown> | null; notCounted?: AuditNotCounted } {
+  try {
+    const v = verifyAuditReport(projectRoot, unit);
+    if (auditCounts(v)) return { report: v.report };
+    if (v.state === 'absent') return { report: null };
+    const reason = v.problems.map((p) => p.message).join('; ') || v.state;
+    return { report: null, notCounted: { state: v.state === 'stale' ? 'stale' : 'invalid', reason } };
+  } catch (e) {
+    return { report: null, notCounted: { state: 'invalid', reason: `the report could not be verified: ${message(e)}` } };
+  }
+}
+
+function uncommittedKindOf(entries: UncommittedEntry[], lockInHead: boolean): ContractSummary['uncommittedKind'] {
+  if (!entries.length) return undefined;
+  if (entries.some((e) => e.change === 'tampered')) return 'tampered';
+  if (entries.some((e) => e.change !== 'unverified')) return lockInHead ? 'edited' : 'untracked';
+  return 'unverified';
+}
+
+/** scenario id → its class, the finding behind it, and whether a low identity or an uncommitted lock entry is behind it. */
+function caseContracts(v: ContractVerdict): Map<string, TestCaseContract> {
+  const out = new Map<string, TestCaseContract>();
+  for (const s of v.scenarios) {
+    const lead = s.findings.find((f) => f.class === s.class) ?? s.findings[0];
+    out.set(s.id, {
+      class: s.class,
+      ...(lead ? { detail: lead.detail } : {}),
+      ...(s.findings.some((f) => f.class === 'opaque' && f.detail.startsWith(LOW_IDENTITY_FINDING)) ? { lowIdentity: true as const } : {}),
+    });
+  }
+  for (const u of v.uncommitted) out.set(u.id, { ...(out.get(u.id) ?? { class: 'match' }), uncommitted: true });
+  return out;
+}
+
+export interface ContractFacts { summary: ContractSummary; cases: Map<string, TestCaseContract> }
+
+export function readContractFacts(projectRoot: string, unit: string, unitDir: string, snapshot?: HeadSnapshot): ContractFacts {
+  try {
+    const snap = snapshot ?? headSnapshot(projectRoot, GUARD_GIT_TIMEOUT_MS);
+    const v = buildContractVerdict(projectRoot, { name: unit, dir: unitDir }, { snapshot: snap });
+    const count = (...classes: string[]): number => v.scenarios.filter((s) => classes.includes(s.class)).length;
+    const hard = v.scenarios.filter((s) => HARD_CLASSES.has(s.class) && s.class !== 'unproven');
+    const kind = uncommittedKindOf(v.uncommitted, Boolean(snap.blobs?.has(posixRel(projectRoot, lockPathFor(unitDir)))));
+    const summary: ContractSummary = {
+      verdict: v.verdict,
+      proposed: count('proposed'),
+      review: count('hash-changed'),
+      hard: hard.length,
+      uncommitted: v.uncommitted.length,
+      unproven: count('unproven'),
+      traceReview: count('opaque', 'inconclusive'),
+      ...(kind ? { uncommittedKind: kind } : {}),
+      ...(hard[0] ? { headline: `${hard[0].id} ${hard[0].class}` } : {}),
+    };
+    return { summary, cases: caseContracts(v) };
+  } catch (e) {
+    return { summary: { verdict: 'fail', proposed: 0, review: 0, hard: 0, uncommitted: 0, error: message(e) }, cases: new Map() };
+  }
+}
+
+export const readContractSummary = (projectRoot: string, unit: string, unitDir: string, snapshot?: HeadSnapshot): ContractSummary =>
+  readContractFacts(projectRoot, unit, unitDir, snapshot).summary;

package/src/harness/audit.ts

@@ -11,7 +11,7 @@ import * as fs from 'fs';
 import { loadUnitScenarios, readUnitFeatureText, parseViewpointOverview, ScenarioInfo, ViewpointEntry } from './parse';
 import { checkViewpointBaseline, ViewpointBaseline } from './viewpoint-baseline';
 import { flowQuality, statefulDepthFor, continuityGaps, flowInventory, misfiledPhases, FlowQualityResult, InventoryResult } from './flow-contract';
-import { featureFilesFor } from './unit-paths';
+import { catalogIdFromScreenDir, featureFilesFor, isScreenUnitId } from './unit-paths';
 import {
   loadCatalog, viewpointGate, assertionDepth, dataThemesFor, depthThresholdFor, coverageBalance, duplicateClusters, scenarioIdReuse, ReusedScenarioId, traceability, claimProof, taxonomyLint,
   automatableManual, flowCoveredThemes, flowRegressionDepth, oracleStrength, declaredPageType,
@@ -35,6 +35,8 @@ import { contextRouter } from '../capabilities/context-router';
 import { readTextFile, readViewpointText } from './read-text';
 import { uiInventoryCoverage, uiInventoryFindings, UiInventoryResult } from './ui-inventory';
 import { defectLinkFindings } from './defects';
+import { auditGateContext, auditGateVerdict, decisionFindings, relevelProvidedDepth } from './gates/audit-gate-verdict';
+import { GateOverrideReport } from './gates/gate-override-report';
 
 export interface AuditReport {
   screen: string;
@@ -98,6 +100,16 @@ export interface AuditReport {
   intent: IntentProfile;        // P3 — the intent profile that drove the thresholds
   provenance: Provenance;       // D1 — sungen version + catalog hash (diagnose cross-user score gaps)
   spec: SpecCoverageResult;     // G2 — spec-clause coverage (FR + validation-trigger matrix)
+  /** OES-11.6 — every gate-override touching this unit (applied / ineffective / rejected). */
+  gateOverrides: GateOverrideReport[];
+  /** OES-11.4 — the decisions this audit was judged under; readers re-audit when it moves. */
+  decisionsHash: string;
+  /** T3 — hash of .feature + spec + viewpoint + decisionsHash; a reader recomputes it. */
+  inputsHash: string;
+  /** T3 — what `sungen audit` exits with for this gateStatus (0 PASS · 2 FAIL). */
+  exitCode: number;
+  /** A capability gate sensor reported an error-level finding — recorded so a reader can re-evaluate the gate. */
+  gateSensorError: boolean;
 }
 
 /**
@@ -117,17 +129,8 @@ export function projectUnitDirs(projectRoot: string): string[] {
   return out;
 }
 
-/** The catalog-resolution id for a unit dir (relative to qa/): screen · flows/<flow> · api/<area> · api/flows/<flow>. */
-export function catalogIdFromScreenDir(screenDir: string): string {
-  const parts = screenDir.split(path.sep);
-  const qa = parts.lastIndexOf('qa');
-  if (qa >= 0) {
-    if (parts[qa + 1] === 'api' && parts[qa + 2] === 'flows' && parts[qa + 3]) return `api/flows/${parts[qa + 3]}`;
-    if (parts[qa + 1] === 'api' && parts[qa + 2]) return `api/${parts[qa + 2]}`;
-    if (parts[qa + 1] === 'flows' && parts[qa + 2]) return `flows/${parts[qa + 2]}`;
-  }
-  return path.basename(screenDir);
-}
+/** The catalog-resolution id for a unit dir — lives in unit-paths.ts (the inputsHash reads it too); kept exported here. */
+export { catalogIdFromScreenDir };
 
 /**
  * The capability that owns SCORING for a unit (AO-1): the first path segment of the unit id when it
@@ -169,6 +172,8 @@ export function runAudit(screenDir: string, screenName: string): AuditReport {
   // `flows/<flow>`, `api/<area>`, `api/flows/<flow>`, else the bare screen. A bare screen matches
   // the old behaviour (so the audit-sample snapshot is unchanged); flows/api now resolve correctly.
   const catalogScreenName = catalogIdFromScreenDir(screenDir);
+  // OES-11.2 — the unit's gate rules: the catalog plus the gate-overrides in force for it.
+  const gates = auditGateContext(screenDir);
 
   const specPath = path.join(screenDir, 'requirements', 'spec.md');
   const featureText = readUnitFeatureText(screenDir, screenName);
@@ -223,14 +228,16 @@ export function runAudit(screenDir: string, screenName: string): AuditReport {
   const isMobile = platform === 'mobile';
   const provided = capGate?.({ scenarios, viewpoints, catalog: gateCatalog, focus: intent.focus, cwd: projectRootFromScreenDir(screenDir), screenName: catalogScreenName, threshold: depthThresholdFor(intent.focus), businessCriticalMethods: intent.businessCriticalMethods, isMobile, viewpointText });
   const gate = provided?.gate ?? viewpointGate(scenarios, viewpoints, gateCatalog, isMobile, viewpointText);
-  const depth = provided?.depth ?? assertionDepth(scenarios, dataThemesFor(gateCatalog, gate.pageType), intent.focus);
+  const depth = provided?.depth
+    ? relevelProvidedDepth(provided.depth, gates.rules)
+    : assertionDepth(scenarios, dataThemesFor(gateCatalog, gate.pageType), intent.focus, gates.rules);
 
   // TQ-4 — deferral-aware coverage credit: an inherently cross-screen theme (cart / detail /
   // filter correctness) belongs in a FLOW, not on the screen. When a flow deeply covers a screen
   // gate gap, credit it to the flow instead of double-counting it as a screen gap. Screens only
   // (a flow/api unit is not credited by sibling flows); mutates the gate before coverage is scored.
   const flowCredits: { theme: string; flow: string }[] = [];
-  const isScreenUnit = !/^(flows|api)\//.test(catalogScreenName);
+  const isScreenUnit = isScreenUnitId(catalogScreenName);
   if (isScreenUnit && gate.gaps.length) {
     const flowScenarios = loadFlowScenarios(projectRootFromScreenDir(screenDir));
     if (flowScenarios.length) {
@@ -246,7 +253,7 @@ export function runAudit(screenDir: string, screenName: string): AuditReport {
       gate.coverageRatio = gate.themesTotal ? gate.themesCovered / gate.themesTotal : 1;
     }
   }
-  const claim = claimProof(scenarios, intent.focus);
+  const claim = claimProof(scenarios, intent.focus, gates.rules);
   const taxonomy = taxonomyLint(scenarios);
   const balance = coverageBalance(scenarios);
   const duplicates = duplicateClusters(scenarios);
@@ -912,9 +919,10 @@ export function runAudit(screenDir: string, screenName: string): AuditReport {
   // taxonomy-match (scenarios must use the project's viewpoint IDs when defined),
   // AND scenario-id uniqueness — a reused id reaches the customer's deliverable as two rows
   // under one testcase id, and has already shipped a never-executed testcase as "Passed" (#694).
-  const gateStatus: 'PASS' | 'FAIL' =
-    gate.gaps.length === 0 && depth.verdict !== 'fail' && claim.verdict !== 'fail' && spec.verdict !== 'fail' && !taxonomyMismatch && !gateSensorError
-    && reusedIds.length === 0 ? 'PASS' : 'FAIL';
+  // The conjunction lives in gates/audit-gate-terms.ts, where the report reader re-evaluates it (OES-11.2).
+  findings.push(...decisionFindings(gates));
+  const verdict = auditGateVerdict(gates, { gate, depth, claim, spec, taxonomyMismatch, gateSensorError, reusedScenarioIds: reusedIds }, screenDir, screenName);
+  const gateStatus = verdict.gateStatus;
 
   return {
     screen: screenName,
@@ -946,5 +954,10 @@ export function runAudit(screenDir: string, screenName: string): AuditReport {
     findings,
     intent,
     provenance: getProvenance(),
+    gateOverrides: verdict.gateOverrides,
+    decisionsHash: verdict.decisionsHash,
+    inputsHash: verdict.inputsHash,
+    exitCode: verdict.exitCode,
+    gateSensorError,
   };
 }