@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/core/mission-context/spec-candidates.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Candidate SPEC document locations, in preference order, built from the KNOWN
+ * LAYOUT only — never from a pointer- or record-supplied sub-path (§5.1c).
+ *
+ * Both real layouts are covered: the per-run directory
+ * (`…/iterate/<run_id>/mini-plan.md`) and the flat file
+ * (`…/iterate/<date-slug>.md`, i.e. the run_id minus its `iterate-` prefix,
+ * which is the shape the `spec` field records).
+ */
+export declare function specCandidates(runId: string, slug: string | null): string[][];
+/**
+ * The `spec` path RECORDED BY THE FRAMEWORK in `iterates/<run_id>.json`,
+ * validated into known-layout segments — or null.
+ *
+ * Why this exists (PROBE, 2026-07-18): measuring the 206 real iterate runs in
+ * this repo, the known-layout candidates resolve 82; 105 have genuinely no
+ * document left on disk; and **19 have a real spec the candidates MISS** —
+ * campaign SUB-ITERATE specs, which live at
+ * `.shipwright/planning/iterate/campaigns/<campaign>/sub-iterates/<ID>-<slug>.md`.
+ * That is this very campaign's own layout, so without this a campaign
+ * sub-iterate would show no Spec artifact at all.
+ *
+ * This is NOT a relaxation of §5.1. That rule forbids trusting a sub-path from
+ * the POINTER — untrusted, out-of-process input. This value comes from the
+ * framework's own agent-doc, and it is still fully constrained here:
+ *   - it must live under `.shipwright/planning/iterate/` (so a recorded
+ *     `01-adopted/spec.md#FR-01.25` — the whole project spec, which would be
+ *     misleading as "the plan for this run" — is rejected along with anything
+ *     outside the iterate tree);
+ *   - any `#fragment` is dropped;
+ *   - every segment must pass the strict id grammar (kills `..`, separators,
+ *     encoded separators and unusual Unicode);
+ *   - it must end in `.md`;
+ * and the caller still runs pathGuard + realPathGuard against the chosen root,
+ * which remains the actual security boundary.
+ */
+export declare function specHintCandidate(hint: string | null | undefined): string[] | null;
+/**
+ * Campaign sub-iterate spec candidates, rebuilt from the NEVER-EVICTED event
+ * facts (`campaign` + `sub_iterate_id` on `work_completed`).
+ *
+ * Why this exists (trg-92c0c36b). `iterates/<run_id>.json` is a bounded 50-entry
+ * recency window (`append_iterate_entry` retention), and for a campaign
+ * sub-iterate its `spec` hint is the ONLY thing that resolves the Spec artifact
+ * — the known-layout candidates cannot name a path they have no campaign slug
+ * for. So today a sub-iterate's Spec silently vanishes the moment its agent-doc
+ * ages out. PROBE, 2026-07-21, this repo: 214 iterate runs in the event log but
+ * only 54 surviving agent-docs (160 evicted, 75%); 14 of the survivors resolve
+ * ONLY via the hint, and 28 runs' specs are reachable from the event facts
+ * where the known layout misses. Rebuilding from the append-only log makes that
+ * resolution survive eviction instead of decaying with it.
+ *
+ * `spec` itself is NOT read from the event log: measured on the same corpus it
+ * is present on 1 of 54 rows, so it is not a substitute source — the campaign
+ * slug (55 rows) and sub-iterate id (54 rows) are.
+ *
+ * Trust model — UNCHANGED from `specHintCandidate`: the two values come from
+ * the framework's own event log, contribute exactly TWO path segments, and the
+ * layout around them is hard-coded here. Both must pass the strict id grammar
+ * (kills `..`, separators, encoded separators, unusual Unicode), the directory
+ * read is `pathGuard`ed, only regular files are offered (a symlink is never a
+ * candidate), and the caller still runs pathGuard + realPathGuard on whatever
+ * it opens — which remains the actual security boundary.
+ */
+export declare function campaignSpecCandidates(root: string, campaign: string | null | undefined, subIterateId: string | null | undefined): string[][];
+//# sourceMappingURL=spec-candidates.d.ts.map

package/server/dist/core/mission-context/spec-candidates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec-candidates.d.ts","sourceRoot":"","sources":["../../../src/core/mission-context/spec-candidates.ts"],"names":[],"mappings":"AA8BA;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,EAAE,EAAE,CAW7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,GAAG,IAAI,CAgBlF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACtC,MAAM,EAAE,EAAE,CAwCZ"}

package/server/dist/core/mission-context/spec-candidates.js

@@ -0,0 +1,164 @@
+/*
+ * core/mission-context/spec-candidates.ts — every candidate PATH at which a
+ * run's spec document may live, in preference order.
+ *
+ * Three builders, in increasing order of how much they trust their input, and
+ * ALL of them emit only known-layout segment arrays — the caller still runs
+ * pathGuard + realPathGuard on whatever it opens, which remains the actual
+ * security boundary (§5.1):
+ *
+ *   1. `specCandidates`         — pure layout, from run_id + slug alone.
+ *   2. `specHintCandidate`      — the `spec` path the framework recorded in
+ *                                 `iterates/<run_id>.json`, grammar-validated.
+ *   3. `campaignSpecCandidates` — a campaign sub-iterate path rebuilt from the
+ *                                 never-evicted `work_completed` event, so it
+ *                                 survives the agent-doc's 50-entry retention
+ *                                 window (trg-92c0c36b).
+ *
+ * Split out of `iterate-record.ts` when (3) pushed that file past the 300-LOC
+ * ceiling; that module keeps the RECORD reads (agent-doc + event lookup), this
+ * one owns PATH construction.
+ */
+import { readdirSync } from "node:fs";
+import { pathGuard } from "../path-guard.js";
+import { isSafeRunId } from "./pointer.js";
+/** Bounds a pathological sub-iterates directory (CONTRACT §11). */
+const MAX_CAMPAIGN_DIR_ENTRIES = 1000;
+/**
+ * Candidate SPEC document locations, in preference order, built from the KNOWN
+ * LAYOUT only — never from a pointer- or record-supplied sub-path (§5.1c).
+ *
+ * Both real layouts are covered: the per-run directory
+ * (`…/iterate/<run_id>/mini-plan.md`) and the flat file
+ * (`…/iterate/<date-slug>.md`, i.e. the run_id minus its `iterate-` prefix,
+ * which is the shape the `spec` field records).
+ */
+export function specCandidates(runId, slug) {
+    const base = [".shipwright", "planning", "iterate"];
+    const dateSlug = runId.startsWith("iterate-") ? runId.slice("iterate-".length) : runId;
+    const candidates = [
+        [...base, runId, "mini-plan.md"],
+        [...base, runId, "adr.md"],
+        [...base, `${runId}.md`],
+        [...base, `${dateSlug}.md`],
+    ];
+    if (slug && slug !== dateSlug)
+        candidates.push([...base, `${slug}.md`]);
+    return candidates;
+}
+/**
+ * The `spec` path RECORDED BY THE FRAMEWORK in `iterates/<run_id>.json`,
+ * validated into known-layout segments — or null.
+ *
+ * Why this exists (PROBE, 2026-07-18): measuring the 206 real iterate runs in
+ * this repo, the known-layout candidates resolve 82; 105 have genuinely no
+ * document left on disk; and **19 have a real spec the candidates MISS** —
+ * campaign SUB-ITERATE specs, which live at
+ * `.shipwright/planning/iterate/campaigns/<campaign>/sub-iterates/<ID>-<slug>.md`.
+ * That is this very campaign's own layout, so without this a campaign
+ * sub-iterate would show no Spec artifact at all.
+ *
+ * This is NOT a relaxation of §5.1. That rule forbids trusting a sub-path from
+ * the POINTER — untrusted, out-of-process input. This value comes from the
+ * framework's own agent-doc, and it is still fully constrained here:
+ *   - it must live under `.shipwright/planning/iterate/` (so a recorded
+ *     `01-adopted/spec.md#FR-01.25` — the whole project spec, which would be
+ *     misleading as "the plan for this run" — is rejected along with anything
+ *     outside the iterate tree);
+ *   - any `#fragment` is dropped;
+ *   - every segment must pass the strict id grammar (kills `..`, separators,
+ *     encoded separators and unusual Unicode);
+ *   - it must end in `.md`;
+ * and the caller still runs pathGuard + realPathGuard against the chosen root,
+ * which remains the actual security boundary.
+ */
+export function specHintCandidate(hint) {
+    if (typeof hint !== "string" || hint.length === 0 || hint.length > 512)
+        return null;
+    const withoutFragment = hint.split("#")[0].trim();
+    if (!withoutFragment.toLowerCase().endsWith(".md"))
+        return null;
+    const parts = withoutFragment.replace(/\\/g, "/").split("/").filter((p) => p.length > 0);
+    const prefix = [".shipwright", "planning", "iterate"];
+    if (parts.length <= prefix.length)
+        return null;
+    for (let i = 0; i < prefix.length; i++) {
+        if (parts[i] !== prefix[i])
+            return null;
+    }
+    // Every remaining segment must be a safe id (the `.md` leaf included).
+    for (const seg of parts.slice(prefix.length)) {
+        if (!isSafeRunId(seg))
+            return null;
+    }
+    return parts;
+}
+/**
+ * Campaign sub-iterate spec candidates, rebuilt from the NEVER-EVICTED event
+ * facts (`campaign` + `sub_iterate_id` on `work_completed`).
+ *
+ * Why this exists (trg-92c0c36b). `iterates/<run_id>.json` is a bounded 50-entry
+ * recency window (`append_iterate_entry` retention), and for a campaign
+ * sub-iterate its `spec` hint is the ONLY thing that resolves the Spec artifact
+ * — the known-layout candidates cannot name a path they have no campaign slug
+ * for. So today a sub-iterate's Spec silently vanishes the moment its agent-doc
+ * ages out. PROBE, 2026-07-21, this repo: 214 iterate runs in the event log but
+ * only 54 surviving agent-docs (160 evicted, 75%); 14 of the survivors resolve
+ * ONLY via the hint, and 28 runs' specs are reachable from the event facts
+ * where the known layout misses. Rebuilding from the append-only log makes that
+ * resolution survive eviction instead of decaying with it.
+ *
+ * `spec` itself is NOT read from the event log: measured on the same corpus it
+ * is present on 1 of 54 rows, so it is not a substitute source — the campaign
+ * slug (55 rows) and sub-iterate id (54 rows) are.
+ *
+ * Trust model — UNCHANGED from `specHintCandidate`: the two values come from
+ * the framework's own event log, contribute exactly TWO path segments, and the
+ * layout around them is hard-coded here. Both must pass the strict id grammar
+ * (kills `..`, separators, encoded separators, unusual Unicode), the directory
+ * read is `pathGuard`ed, only regular files are offered (a symlink is never a
+ * candidate), and the caller still runs pathGuard + realPathGuard on whatever
+ * it opens — which remains the actual security boundary.
+ */
+export function campaignSpecCandidates(root, campaign, subIterateId) {
+    if (!isSafeRunId(campaign) || !isSafeRunId(subIterateId))
+        return [];
+    const rel = [".shipwright", "planning", "iterate", "campaigns", campaign, "sub-iterates"];
+    const guard = pathGuard(root, rel.join("/"));
+    if (!guard.ok)
+        return [];
+    let names;
+    try {
+        names = readdirSync(guard.absolute, { withFileTypes: true })
+            // Bounded, so a pathological directory cannot turn a poll into a stall
+            // (CONTRACT §11). Real sub-iterate directories hold tens of entries.
+            .slice(0, MAX_CAMPAIGN_DIR_ENTRIES)
+            // Regular files ONLY — `isFile()` is false for a symlink, so a link is
+            // never even offered as a candidate.
+            .filter((e) => e.isFile())
+            .map((e) => e.name);
+    }
+    catch {
+        // ENOENT / ENOTDIR / EACCES — this run simply has no campaign spec here.
+        return [];
+    }
+    const exact = `${subIterateId.toLowerCase()}.md`;
+    // The trailing `-` is load-bearing: without it `W1` would also claim `W10-…`.
+    const prefix = `${subIterateId.toLowerCase()}-`;
+    return names
+        .filter((n) => {
+        if (!isSafeRunId(n))
+            return false;
+        const l = n.toLowerCase();
+        return l.endsWith(".md") && (l === exact || l.startsWith(prefix));
+    })
+        // Deterministic order — an exact `<id>.md` outranks a `<id>-<slug>.md`, then
+        // lexicographic. A stable order matters: the caller mints the document id
+        // from the candidate it matched.
+        .sort((a, b) => {
+        const rank = Number(a.toLowerCase() !== exact) - Number(b.toLowerCase() !== exact);
+        return rank !== 0 ? rank : a.localeCompare(b);
+    })
+        .map((n) => [...rel, n]);
+}
+//# sourceMappingURL=spec-candidates.js.map

package/server/dist/core/mission-context/spec-candidates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec-candidates.js","sourceRoot":"","sources":["../../../src/core/mission-context/spec-candidates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEtC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,mEAAmE;AACnE,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAEtC;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,IAAmB;IAC/D,MAAM,IAAI,GAAG,CAAC,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACvF,MAAM,UAAU,GAAe;QAC7B,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC;QAChC,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC;QAC1B,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,KAAK,CAAC;QACxB,CAAC,GAAG,IAAI,EAAE,GAAG,QAAQ,KAAK,CAAC;KAC5B,CAAC;IACF,IAAI,IAAI,IAAI,IAAI,KAAK,QAAQ;QAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC;IACxE,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA+B;IAC/D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACpF,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhE,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,CAAC,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1C,CAAC;IACD,uEAAuE;IACvE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAY,EACZ,QAAmC,EACnC,YAAuC;IAEvC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpE,MAAM,GAAG,GAAG,CAAC,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IAEzB,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;YAC1D,uEAAuE;YACvE,qEAAqE;aACpE,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC;YACnC,uEAAuE;YACvE,qCAAqC;aACpC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC;IACjD,8EAA8E;IAC9E,MAAM,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,GAAG,CAAC;IAEhD,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC;QACF,6EAA6E;QAC7E,0EAA0E;QAC1E,iCAAiC;SAChC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;QACnF,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC"}

package/server/dist/core/mission-context/test-evidence.d.ts

@@ -0,0 +1,14 @@
+export interface TestEvidence {
+    status: "available" | "unavailable";
+    verifiedBehaviors: string[];
+    completeness: {
+        tested: number;
+        testable: number;
+        untestedTestable: number;
+    } | null;
+    note: string | null;
+}
+/** Read only the immutable F5c snapshot for this exact Mission run. */
+export declare function readTestEvidence(projectRoot: string, runId: string): TestEvidence;
+export declare function testEvidencePath(projectRoot: string, runId: string): string;
+//# sourceMappingURL=test-evidence.d.ts.map

package/server/dist/core/mission-context/test-evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-evidence.d.ts","sourceRoot":"","sources":["../../../src/core/mission-context/test-evidence.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,GAAG,aAAa,CAAC;IACpC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,YAAY,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACpF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAID,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,YAAY,CAwCjF;AAED,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3E"}

package/server/dist/core/mission-context/test-evidence.js

@@ -0,0 +1,53 @@
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { readBoundedFile } from "./fs-read.js";
+import { pathGuard } from "../path-guard.js";
+const MAX_BYTES = 1024 * 1024;
+/** Read only the immutable F5c snapshot for this exact Mission run. */
+export function readTestEvidence(projectRoot, runId) {
+    const rel = [".shipwright", "agent_docs", "iterates", `${runId}.test-results.json`].join("/");
+    const guard = pathGuard(projectRoot, rel);
+    if (!guard.ok || !existsSync(guard.absolute)) {
+        return { status: "unavailable", verifiedBehaviors: [], completeness: null, note: "The per-run test evidence is not available." };
+    }
+    const read = readBoundedFile(guard.absolute, MAX_BYTES);
+    if (!read)
+        return { status: "unavailable", verifiedBehaviors: [], completeness: null, note: "The per-run test evidence could not be read." };
+    try {
+        const parsed = JSON.parse(read.text);
+        const latest = parsed.iterate_latest;
+        const completenessRecord = latest?.test_completeness;
+        if (latest?.run_id !== runId || !completenessRecord) {
+            return { status: "unavailable", verifiedBehaviors: [], completeness: null, note: "The per-run test evidence could not be matched to this Mission." };
+        }
+        if (completenessRecord.status === "n/a") {
+            return { status: "available", verifiedBehaviors: [], completeness: null, note: "This run recorded no testable behaviours." };
+        }
+        if (completenessRecord.status !== "complete" || !Array.isArray(completenessRecord.behaviors)) {
+            return { status: "unavailable", verifiedBehaviors: [], completeness: null, note: "The per-run test evidence is incomplete." };
+        }
+        const behaviors = completenessRecord.behaviors;
+        const isBehavior = (entry) => Boolean(entry) && typeof entry === "object" && typeof entry.behavior === "string" && entry.behavior.trim().length > 0 && (entry.disposition === "tested" || entry.disposition === "untestable");
+        if (!behaviors.every(isBehavior)) {
+            return { status: "unavailable", verifiedBehaviors: [], completeness: null, note: "The per-run test evidence contains malformed behaviours." };
+        }
+        const allVerifiedBehaviors = behaviors.filter((entry) => entry.disposition === "tested").map((entry) => entry.behavior);
+        const verifiedBehaviors = allVerifiedBehaviors.slice(0, 12);
+        const counts = completenessRecord.counts;
+        const nonNegativeInteger = (value) => typeof value === "number" && Number.isInteger(value) && value >= 0;
+        const completeness = counts && nonNegativeInteger(counts.tested) && nonNegativeInteger(counts.testable) && nonNegativeInteger(counts.untested_testable) && counts.tested <= counts.testable && counts.tested + counts.untested_testable === counts.testable && counts.tested === allVerifiedBehaviors.length
+            ? { tested: counts.tested, testable: counts.testable, untestedTestable: counts.untested_testable }
+            : null;
+        if (!completeness) {
+            return { status: "unavailable", verifiedBehaviors: [], completeness: null, note: "The per-run test-completeness counts are inconsistent." };
+        }
+        return { status: "available", verifiedBehaviors, completeness, note: null };
+    }
+    catch {
+        return { status: "unavailable", verifiedBehaviors: [], completeness: null, note: "The per-run test evidence is malformed." };
+    }
+}
+export function testEvidencePath(projectRoot, runId) {
+    return path.join(projectRoot, ".shipwright", "agent_docs", "iterates", `${runId}.test-results.json`);
+}
+//# sourceMappingURL=test-evidence.js.map

package/server/dist/core/mission-context/test-evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-evidence.js","sourceRoot":"","sources":["../../../src/core/mission-context/test-evidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAS7C,MAAM,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9B,uEAAuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,KAAa;IACjE,MAAM,GAAG,GAAG,CAAC,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,6CAA6C,EAAE,CAAC;IACnI,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,8CAA8C,EAAE,CAAC;IAC7I,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAA6L,CAAC;QACjO,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC;QACrC,MAAM,kBAAkB,GAAG,MAAM,EAAE,iBAAiB,CAAC;QACrD,IAAI,MAAM,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACpD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,iEAAiE,EAAE,CAAC;QACvJ,CAAC;QACD,IAAI,kBAAkB,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACxC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC;QAC/H,CAAC;QACD,IAAI,kBAAkB,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7F,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,0CAA0C,EAAE,CAAC;QAChI,CAAC;QACD,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,KAAc,EAAuE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAQ,KAAgC,CAAC,QAAQ,KAAK,QAAQ,IAAK,KAA8B,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAE,KAAmC,CAAC,WAAW,KAAK,QAAQ,IAAK,KAAmC,CAAC,WAAW,KAAK,YAAY,CAAC,CAAC;QACha,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,0DAA0D,EAAE,CAAC;QAChJ,CAAC;QACD,MAAM,oBAAoB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxH,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC;QACzC,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACnI,MAAM,YAAY,GAAG,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,iBAAiB,KAAK,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM;YAC1S,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,iBAAiB,EAAE;YAClG,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,wDAAwD,EAAE,CAAC;QAC9I,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,yCAAyC,EAAE,CAAC;IAC/H,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,KAAa;IACjE,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC;AACvG,CAAC"}

package/server/dist/core/mission-context/tests-diff.d.ts

@@ -0,0 +1,68 @@
+import type { GitRunner } from "./worktree-roots.js";
+import type { TestChangeKind } from "./types-slice2.js";
+export interface ChangedTestFile {
+    /** POSIX-style repo-relative path. Display-safe: inside the repo by definition. */
+    path: string;
+    kind: TestChangeKind;
+}
+export type TestsDiff = {
+    status: "ok";
+    files: ChangedTestFile[];
+    truncated: boolean;
+} | {
+    status: "unavailable";
+    reason: "bad_commit" | "git_failed";
+};
+/**
+ * Bound what we KEEP. Beyond this the caller reports truncation honestly.
+ *
+ * CALIBRATED, not guessed (external plan review, HIGH #3). Measured over this
+ * repo's last 60 commits: the median commit touches 0 test files, the 95th
+ * percentile touches 13, and the two largest — both campaign-scale sweeps, incl.
+ * the #289 traceability retrofit that re-tagged every suite — touch 77 and 116.
+ * A cap of 50 would therefore have truncated REAL commits, which is why the
+ * first guess was wrong. 500 leaves >4x headroom over the largest observed
+ * commit while keeping the response bounded (~100 KB worst case), so a
+ * paginated endpoint would add an access-controlled surface for a case the
+ * history does not contain. Truncation is still REPORTED if it ever happens.
+ */
+export declare const MAX_TEST_FILES = 500;
+/**
+ * Is this path a test file? Deliberately conservative — a false positive would
+ * put a production file in the Tests artifact and misreport the run.
+ *
+ * Covers this repo's two real conventions: co-located `*.test.ts(x)` (vitest)
+ * and `client/e2e/**\/*.spec.ts` (Playwright).
+ */
+export declare function isTestFile(p: string): boolean;
+/**
+ * Layer for a file the manifest does not know (the `removed` case always lands
+ * here — the entry is gone). Returns null rather than guessing when the path
+ * carries no signal: an honest unknown beats an invented layer.
+ */
+export declare function inferLayer(p: string): string | null;
+/**
+ * Parse `git show --name-status -z` output into changed TEST files only.
+ *
+ * NUL-DELIMITED, not line-based (external plan review, MEDIUM #6). A git path
+ * may contain a tab, a quote, a newline or arbitrary Unicode; with `-z` git
+ * emits the RAW bytes as `<status>NUL<path>NUL…` and performs no quoting, so
+ * splitting on NUL is exact. Line-splitting would mis-parse such a path — and
+ * silently, which is the worst way for a test-reporting feature to fail.
+ *
+ * Exported for direct unit testing: the parser is where the real logic lives,
+ * and testing it through a git double would only test the double.
+ */
+export declare function parseNameStatus(out: string): {
+    files: ChangedTestFile[];
+    truncated: boolean;
+};
+/**
+ * Which test files this run's commit changed.
+ *
+ * `unavailable` is returned when git could not answer — NEVER an empty `ok`.
+ * Reporting "no tests changed" because git failed is precisely the false
+ * negative this feature must not produce.
+ */
+export declare function readChangedTestFiles(projectRoot: string, commit: string | null, git: GitRunner): Promise<TestsDiff>;
+//# sourceMappingURL=tests-diff.d.ts.map

package/server/dist/core/mission-context/tests-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tests-diff.d.ts","sourceRoot":"","sources":["../../../src/core/mission-context/tests-diff.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,cAAc,CAAC;CACtB;AAED,MAAM,MAAM,SAAS,GACjB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,eAAe,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GAC9D;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAAA;CAAE,CAAC;AAKnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,MAAM,CAAC;AAKlC;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAK7C;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKnD;AAYD;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAqC7F;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,SAAS,CAAC,CAkBpB"}

package/server/dist/core/mission-context/tests-diff.js

@@ -0,0 +1,151 @@
+/*
+ * core/mission-context/tests-diff.ts — the Tests BASELINE-DIFF (CONTRACT
+ * §10 Slice-2, campaign 2026-07-18-mission-artifacts).
+ *
+ * The contract asks for "the manifest at iterate start vs. finalize (and/or the
+ * git diff of test files)". The WebUI is a read-only OBSERVER (Architecture
+ * rule 4, DO-NOT #1) — it is never running when an iterate starts, so it cannot
+ * capture a start-of-run snapshot. The git diff of the run's own commit IS the
+ * baseline diff, and it is authoritative rather than reconstructed:
+ *
+ *   git show --name-status <commit>   →  A / M / D per file
+ *
+ * `D` is exactly the AC2 case — "its manifest entry no longer exists". A removed
+ * test cannot be found by inspecting the current manifest (that is the whole
+ * point of a removal), so the diff is the ONLY source that can classify it.
+ *
+ * git runs as an ARGUMENT ARRAY with `shell: false` (never a command string),
+ * and the commit is hex-validated BEFORE it becomes an argument, so a recorded
+ * sha cannot smuggle a flag (`--upload-pack=…`) or a pathspec.
+ */
+/** Bound a pathological commit — a tree-wide rewrite must not be unbounded. */
+const MAX_DIFF_TOKENS = 40_000;
+/**
+ * Bound what we KEEP. Beyond this the caller reports truncation honestly.
+ *
+ * CALIBRATED, not guessed (external plan review, HIGH #3). Measured over this
+ * repo's last 60 commits: the median commit touches 0 test files, the 95th
+ * percentile touches 13, and the two largest — both campaign-scale sweeps, incl.
+ * the #289 traceability retrofit that re-tagged every suite — touch 77 and 116.
+ * A cap of 50 would therefore have truncated REAL commits, which is why the
+ * first guess was wrong. 500 leaves >4x headroom over the largest observed
+ * commit while keeping the response bounded (~100 KB worst case), so a
+ * paginated endpoint would add an access-controlled surface for a case the
+ * history does not contain. Truncation is still REPORTED if it ever happens.
+ */
+export const MAX_TEST_FILES = 500;
+/** A recorded sha is untrusted input until it matches this. */
+const SHA_RE = /^[0-9a-f]{7,40}$/i;
+/**
+ * Is this path a test file? Deliberately conservative — a false positive would
+ * put a production file in the Tests artifact and misreport the run.
+ *
+ * Covers this repo's two real conventions: co-located `*.test.ts(x)` (vitest)
+ * and `client/e2e/**\/*.spec.ts` (Playwright).
+ */
+export function isTestFile(p) {
+    const f = p.toLowerCase();
+    if (/\.(test|spec)\.(ts|tsx|js|jsx|mts|cts)$/.test(f))
+        return true;
+    // A helper/fixture inside an e2e tree is part of the test surface too.
+    return /(^|\/)e2e\//.test(f) && /\.(ts|tsx)$/.test(f);
+}
+/**
+ * Layer for a file the manifest does not know (the `removed` case always lands
+ * here — the entry is gone). Returns null rather than guessing when the path
+ * carries no signal: an honest unknown beats an invented layer.
+ */
+export function inferLayer(p) {
+    const f = p.toLowerCase();
+    if (/(^|\/)e2e\//.test(f) || /\.spec\.(ts|tsx|js|jsx)$/.test(f))
+        return "e2e";
+    if (/\.test\.(ts|tsx|js|jsx|mts|cts)$/.test(f))
+        return "unit";
+    return null;
+}
+function classify(status) {
+    const c = status[0]?.toUpperCase();
+    if (c === "A")
+        return "added";
+    if (c === "D")
+        return "removed";
+    // M (modified), T (type change), and — with `--no-renames` off, defensively —
+    // R/C are all "this file changed" from a reader's point of view.
+    if (c === "M" || c === "T" || c === "R" || c === "C")
+        return "modified";
+    return null;
+}
+/**
+ * Parse `git show --name-status -z` output into changed TEST files only.
+ *
+ * NUL-DELIMITED, not line-based (external plan review, MEDIUM #6). A git path
+ * may contain a tab, a quote, a newline or arbitrary Unicode; with `-z` git
+ * emits the RAW bytes as `<status>NUL<path>NUL…` and performs no quoting, so
+ * splitting on NUL is exact. Line-splitting would mis-parse such a path — and
+ * silently, which is the worst way for a test-reporting feature to fail.
+ *
+ * Exported for direct unit testing: the parser is where the real logic lives,
+ * and testing it through a git double would only test the double.
+ */
+export function parseNameStatus(out) {
+    const files = [];
+    const seen = new Set();
+    const tokens = out.split("\0");
+    let truncated = false;
+    for (let i = 0; i + 1 < tokens.length; i += 2) {
+        if (i >= MAX_DIFF_TOKENS) {
+            truncated = true;
+            break;
+        }
+        // Tokens alternate status, path. A stray empty token (trailing NUL) is
+        // skipped by re-syncing on the next non-empty status token.
+        const status = tokens[i];
+        if (!status) {
+            i -= 1; // re-align: consume one token instead of two
+            continue;
+        }
+        const kind = classify(status);
+        // The token is used VERBATIM. Folding `\` to `/` or trimming would partly
+        // undo the `-z` hardening two lines up: git always reports POSIX paths, so
+        // a backslash here is a literal character in a legitimate filename, and
+        // leading/trailing whitespace is likewise part of the name. Either edit
+        // silently breaks the manifest join. (The backslash fold belongs to
+        // manifest ids, which may be Windows-shaped — `traceability.ts` does it
+        // there, where it is correct.)
+        const p = tokens[i + 1];
+        if (!kind || !p || !isTestFile(p) || seen.has(p))
+            continue;
+        if (files.length >= MAX_TEST_FILES) {
+            truncated = true;
+            break;
+        }
+        seen.add(p);
+        files.push({ path: p, kind });
+    }
+    return { files, truncated };
+}
+/**
+ * Which test files this run's commit changed.
+ *
+ * `unavailable` is returned when git could not answer — NEVER an empty `ok`.
+ * Reporting "no tests changed" because git failed is precisely the false
+ * negative this feature must not produce.
+ */
+export async function readChangedTestFiles(projectRoot, commit, git) {
+    if (!commit || !SHA_RE.test(commit))
+        return { status: "unavailable", reason: "bad_commit" };
+    let out;
+    try {
+        out = await git(
+        // `-z` — raw NUL-delimited paths, so a path containing a tab/newline/
+        // quote cannot be mis-parsed. `--first-parent` keeps a merge commit
+        // meaningful instead of silently empty.
+        ["show", "--name-status", "--format=", "--no-renames", "--first-parent", "-z", commit, "--"], projectRoot);
+    }
+    catch {
+        // Commit not in this repo (a sibling clone's sha), git missing, timeout.
+        return { status: "unavailable", reason: "git_failed" };
+    }
+    return { status: "ok", ...parseNameStatus(out) };
+}
+//# sourceMappingURL=tests-diff.js.map

package/server/dist/core/mission-context/tests-diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tests-diff.js","sourceRoot":"","sources":["../../../src/core/mission-context/tests-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAeH,+EAA+E;AAC/E,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAElC,+DAA+D;AAC/D,MAAM,MAAM,GAAG,mBAAmB,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1B,IAAI,yCAAyC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,uEAAuE;IACvE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1B,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,IAAI,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,CAAC;IAC9B,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IAChC,8EAA8E;IAC9E,iEAAiE;IACjE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,UAAU,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,eAAe,EAAE,CAAC;YACzB,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM;QACR,CAAC;QACD,uEAAuE;QACvE,4DAA4D;QAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,CAAC,IAAI,CAAC,CAAC,CAAC,6CAA6C;YACrD,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,wEAAwE;QACxE,+BAA+B;QAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC3D,IAAI,KAAK,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;YACnC,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM;QACR,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAmB,EACnB,MAAqB,EACrB,GAAc;IAEd,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAE5F,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,GAAG;QACb,sEAAsE;QACtE,oEAAoE;QACpE,wCAAwC;QACxC,CAAC,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAC5F,WAAW,CACZ,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACzD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AACnD,CAAC"}

package/server/dist/core/mission-context/traceability.d.ts

@@ -0,0 +1,58 @@
+import type { TestFrRef } from "./types-slice2.js";
+export declare const TRACEABILITY_REL = ".shipwright/compliance/test-traceability.json";
+/**
+ * Cap on indexed test entries. A pathological manifest cannot make this loop
+ * (or the resulting Map) unbounded. Real: 1038.
+ */
+export declare const MAX_TEST_ENTRIES = 50000;
+export interface TraceabilityFileEntry {
+    /** Distinct layers this file's tests are recorded under (`unit`, `e2e`, …). */
+    layers: string[];
+    /**
+     * Distinct requirement links, deduped by `frId`. `mappedFrom` carries the
+     * fold provenance — the FOLDED id the source tag named, when the manifest
+     * resolved it to a surviving parent (AC2).
+     */
+    frs: TestFrRef[];
+    /** How many individual test cases the manifest records for this file. */
+    caseCount: number;
+}
+export type TraceabilityIndex = {
+    status: "ok";
+    byFile: Map<string, TraceabilityFileEntry>;
+    generatedAt: string | null;
+    /**
+     * The entry cap was hit, so the index is PARTIAL.
+     *
+     * This must be reported (external code review, MEDIUM): a changed test
+     * whose manifest entry fell after the cap would otherwise render with no
+     * requirement links while the UI claimed the manifest was fine — a false
+     * negative dressed as a clean answer, which is the exact failure this
+     * whole slice exists to prevent.
+     */
+    truncated: boolean;
+} | {
+    status: "unavailable";
+    reason: "missing" | "too_large" | "corrupt" | "denied";
+};
+/** Absolute path to the manifest — used for `sourceRev` probing. */
+export declare function traceabilityPath(projectRoot: string): string;
+/**
+ * A manifest test `id` is `<file path>::<test name>`. Only the FILE half joins
+ * against a git diff, so split on the FIRST `::` and normalise separators —
+ * git reports POSIX paths, the manifest may carry either.
+ */
+export declare function testIdToFile(id: string): string | null;
+/**
+ * Read + invert the manifest. Never throws: every defect becomes a typed
+ * `unavailable` the caller renders honestly.
+ */
+export declare function readTraceabilityIndex(projectRoot: string, 
+/**
+ * Entry cap. Overridable ONLY so the truncation branch below has a direct
+ * test: a 50k-entry fixture would be absurd, and asserting the cap through a
+ * hand-built `{truncated: true}` downstream would still pass if this producer
+ * never set the flag (internal code review, FIX-IF-CHEAP).
+ */
+maxEntries?: number): TraceabilityIndex;
+//# sourceMappingURL=traceability.d.ts.map

package/server/dist/core/mission-context/traceability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"traceability.d.ts","sourceRoot":"","sources":["../../../src/core/mission-context/traceability.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,eAAO,MAAM,gBAAgB,kDAAkD,CAAC;AAKhF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QAAS,CAAC;AAEvC,MAAM,WAAW,qBAAqB;IACpC,+EAA+E;IAC/E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;;OAIG;IACH,GAAG,EAAE,SAAS,EAAE,CAAC;IACjB,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,iBAAiB,GACzB;IACE,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC3C,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;;;;OAQG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB,GACD;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAA;CAAE,CAAC;AAEtF,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMtD;AAcD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM;AACnB;;;;;GAKG;AACH,UAAU,GAAE,MAAyB,GACpC,iBAAiB,CAwFnB"}