@tech-leads-club/harness-toolkit 0.2.1

package/src/core/gate/gate.command.ts

@@ -0,0 +1,130 @@
+import { basename } from "node:path";
+import type { AppendFilesMode } from "./gate.types.ts";
+
+const RECIPE_RUNNERS = new Set(["just", "make", "task", "mise", "rake"]);
+
+/**
+ * hazard: `npm` was absent from the no-append set while `missing script:` sat in the resolution-failure patterns —
+ * so the codebase already knew npm invokes a script and still appended file paths to it. Measured on a real install:
+ * `npm test` with `appendFiles: "auto"` had changed files appended, and whether they reach the runner depends on the
+ * package manager and its version. The harness cannot know, so it must not guess
+ * ([/decisions/ad-033.md](/decisions/ad-033.md)).
+ *
+ * why: the reason is the recipe-runner reason. The argument is forwarded to somebody else's script, and what that
+ * script does with a path is not something this process can reason about. `never` and `always` stay available for an
+ * operator who knows their own command.
+ */
+const SCRIPT_RUNNERS = new Set(["npm", "yarn", "pnpm"]);
+
+/**
+ * why: `npx`, `bunx` and `pnpm dlx` are transparent — they run the tool named next, and that tool is what decides
+ * whether a file path narrows the run. Treating them as script runners would refuse to narrow `npx jest <file>`,
+ * which is the shape narrowing exists for.
+ */
+const TRANSPARENT_PREFIXES = new Set(["npx", "bunx", "dlx", "exec"]);
+
+const GLOB_CHARS = /[*?[\]]/;
+
+export type AppendVerdict = { appends: boolean; reason?: string };
+
+const RESOLUTION_FAILURE_PATTERNS = [
+  /does not contain recipe/i,
+  /no rule to make target/i,
+  /unknown recipe/i,
+  /missing script:/i,
+  /task ".*" does not exist/i,
+  /don't know how to build task/i,
+];
+
+/** why: resolves through a transparent prefix to the tool that actually receives the arguments. */
+function effectiveCommand(command: string[]): string[] {
+  let rest = command;
+  while (rest.length > 1 && TRANSPARENT_PREFIXES.has(bareName(rest[0] as string))) {
+    rest = rest.slice(1);
+  }
+  // why: `bun run <script>` and `pnpm dlx <tool>` put the meaningful token one further along.
+  if (rest.length > 2 && bareName(rest[0] as string) === "bun" && rest[1] === "run") {
+    return ["npm", ...rest.slice(1)];
+  }
+  return rest;
+}
+
+function bareName(argv0: string): string {
+  return basename(argv0)
+    .replace(/\.(exe|cmd|bat)$/i, "")
+    .toLowerCase();
+}
+
+/** why: the name of the tool that actually receives the arguments, after resolving any transparent prefix. */
+function executableName(command: string[]): string {
+  return bareName(effectiveCommand(command)[0] ?? "");
+}
+
+/**
+ * A recipe runner takes a target name, not a file list. Appending changed files makes it read the first path
+ * as a second target and abort, so the gate reports a failure that the code cannot cause and the agent cannot
+ * fix. Anything else receives the file list, which keeps per-file runs fast where the runner supports them.
+ */
+export function isRecipeRunner(command: string[]): boolean {
+  return RECIPE_RUNNERS.has(executableName(command));
+}
+
+export function isScriptRunner(command: string[]): boolean {
+  return SCRIPT_RUNNERS.has(executableName(command));
+}
+
+/**
+ * hazard: a command that already carries its own glob cannot be narrowed by appending paths — it walks the glob
+ * regardless. Measured on a real install: an eslint command globbing `src/**` and `test/**` linted the whole tree on
+ * every stop, three times per turn, while `auto` reported itself as narrowing to changed files.
+ *
+ * why: the verdict carries a reason so `doctor` can say why narrowing is not happening. A capability that silently
+ * does nothing is the defect this project keeps finding; one that says why is a configuration choice.
+ */
+export function appendFilesVerdict(command: string[], mode: AppendFilesMode): AppendVerdict {
+  if (command.length === 0) {
+    return { appends: false, reason: "the command is empty" };
+  }
+  if (mode === "always") {
+    return { appends: true };
+  }
+  if (mode === "never") {
+    return { appends: false, reason: "appendFiles is set to never" };
+  }
+  if (isRecipeRunner(command)) {
+    return {
+      appends: false,
+      reason: `\`${executableName(command)}\` takes a target name, so a file path would read as a second target`,
+    };
+  }
+  if (isScriptRunner(command)) {
+    return {
+      appends: false,
+      reason: `\`${executableName(command)}\` invokes a script, and whether a path reaches the runner is not something the harness can know`,
+    };
+  }
+  const glob = command.find((arg) => GLOB_CHARS.test(arg));
+  if (glob !== undefined) {
+    return {
+      appends: false,
+      reason: `the command already scopes itself with \`${glob}\`, so appending files would not narrow the run`,
+    };
+  }
+  return { appends: true };
+}
+
+export function shouldAppendFiles(command: string[], mode: AppendFilesMode): boolean {
+  return appendFilesVerdict(command, mode).appends;
+}
+
+/**
+ * The command never ran: a missing binary (127) or a runner that could not resolve the target. This is a
+ * configuration fault, not a failing assertion, and classifying it as verification sends the agent to edit
+ * healthy tests.
+ */
+export function isCommandResolutionFailure(args: { exitCode: number; output: string }): boolean {
+  if (args.exitCode === 127) {
+    return true;
+  }
+  return RESOLUTION_FAILURE_PATTERNS.some((pattern) => pattern.test(args.output));
+}

package/src/core/gate/gate.findings.ts

@@ -0,0 +1,201 @@
+import type { GateFinding } from "./gate.types.ts";
+
+export type LineRole = "count" | "test" | "assertion" | "other";
+
+const DETAIL_MAX = 500;
+const SUMMARY_MAX = 200;
+
+// why: a tally is composed only of tally clauses. Matching "N fail" alone would swallow
+// `1 fail — runCascade …`, which names the failure and must survive as a finding.
+const TALLY =
+  /\d+\s+(?:tests?|specs?|examples?)?\s*(?:fail(?:ed|ures?)?|pass(?:ed|ing)?|pending|skipped|todo|errors?)\b|(?:failures?|errors?)\s*=\s*\d+/gi;
+const COUNT_LABEL = /^(?:tests?|specs?|failed|failures?|summary|results?)\b[:\s]*/i;
+const COUNT_RESIDUE = /^[\s\d:;,|—–\-()=.✗×✕✖*]*$/;
+
+// why: a structural marker identifies one failing test across frameworks — bun, TAP and `node --test`, go,
+// jest, vitest, mocha. Checked before the weak `✗ name` form so `✗ 4 tests failed` stays a tally.
+const STRONG_TEST = [
+  /^\(fail\)\s*\S/i,
+  /^not ok\s+\d+/i,
+  /^---\s*FAIL:\s*\S/i,
+  /^(?:FAIL|FAILED)\s+(?!\()\S/i,
+];
+const WEAK_TEST = /^[✗×✕✖]\s+\S/;
+
+// hazard: a bare `error:` is NOT an assertion. `error: cannot find module` is a distinct failure, so it must
+// not be folded into a neighbouring test as detail. Assertion vocabulary is the narrower, safer signal.
+const ASSERTION_HINT =
+  /(?:expect\(|toEqual|toBe\b|toMatch|toThrow|AssertionError|assert(?:ion)?\b|deep(?:Strict)?Equal|strictEqual|Expected\b|received\b|actual\b)/i;
+
+function isCountOnly(line: string): boolean {
+  if (!/\d/.test(line) || !/(?:fail|error)/i.test(line)) {
+    return false;
+  }
+  const stripped = line.replace(COUNT_LABEL, " ").replace(TALLY, " ");
+  return COUNT_RESIDUE.test(stripped);
+}
+
+export function classifyLine(line: string): LineRole {
+  if (STRONG_TEST.some((pattern) => pattern.test(line))) {
+    return "test";
+  }
+  if (isCountOnly(line)) {
+    return "count";
+  }
+  if (WEAK_TEST.test(line)) {
+    return "test";
+  }
+  return ASSERTION_HINT.test(line) ? "assertion" : "other";
+}
+
+type Failure = { summary: string; details: string[] };
+
+// why: bun prints the assertion before the test line, TAP and `node --test` after. One walk covers both by
+// buffering assertions seen before any test line and attaching them to the next one opened.
+function groupFailures(lines: string[]): { failures: Failure[]; firstCount: string | null } {
+  const failures: Failure[] = [];
+  const pending: string[] = [];
+  let firstCount: string | null = null;
+  let current: Failure | null = null;
+
+  for (const line of lines) {
+    switch (classifyLine(line)) {
+      case "count":
+        firstCount ??= line;
+        break;
+      case "test": {
+        const failure: Failure = { summary: line, details: pending.splice(0) };
+        failures.push(failure);
+        current = failure;
+        break;
+      }
+      case "assertion":
+        if (current) {
+          current.details.push(line);
+        } else {
+          pending.push(line);
+        }
+        break;
+      default: {
+        // why: an unrecognised hit is a failure in its own right, so unknown formats degrade to today's
+        // behaviour minus the noise rather than to silence. It opens a group so a following assertion
+        // attaches to it instead of starting a second item.
+        const failure: Failure = { summary: line, details: pending.splice(0) };
+        failures.push(failure);
+        current = failure;
+      }
+    }
+  }
+
+  // hazard: an assertion with no test line ever seen is still a real failure. Dropping the buffer here is
+  // how a genuine failure would disappear.
+  if (pending.length > 0) {
+    failures.push({ summary: pending[0] as string, details: pending.slice(1) });
+  }
+  return { failures, firstCount };
+}
+
+function normalize(text: string): string {
+  return text.replace(/\s+/g, " ").trim().toLowerCase();
+}
+
+function dedupe(failures: Failure[]): Failure[] {
+  const byKey = new Map<string, Failure>();
+  for (const failure of failures) {
+    const key = normalize(failure.summary);
+    const seen = byKey.get(key);
+    if (seen) {
+      seen.details.push(...failure.details);
+      continue;
+    }
+    byKey.set(key, { summary: failure.summary, details: [...failure.details] });
+  }
+  return [...byKey.values()];
+}
+
+function toFinding(failure: Failure): GateFinding {
+  const detail = [...new Set(failure.details)].join("\n").slice(0, DETAIL_MAX);
+  return detail
+    ? { summary: failure.summary.slice(0, SUMMARY_MAX), detail }
+    : { summary: failure.summary.slice(0, SUMMARY_MAX) };
+}
+
+/**
+ * One finding per failure. A tally is never a finding, two views of the same failure are one item, and the
+ * assertion that explains a test travels with it as detail rather than as a second problem to fix.
+ *
+ * invariant: never returns an empty list while the gate failed, and never merges two distinct summaries —
+ * the consumer instructs an agent to fix every item, so a lost failure and an invented one are both harmful.
+ */
+export function findingsFromLines(lines: string[], exitCode: number, max: number): GateFinding[] {
+  const { failures, firstCount } = groupFailures(lines);
+  const unique = dedupe(failures);
+
+  if (unique.length === 0) {
+    // why: the gate did fail, so something must be reported. The tally becomes detail instead of being
+    // promoted to a finding of its own.
+    const fallback: GateFinding = { summary: `gate exited with code ${exitCode}` };
+    return firstCount ? [{ ...fallback, detail: firstCount.slice(0, DETAIL_MAX) }] : [fallback];
+  }
+
+  if (unique.length <= max) {
+    return unique.map(toFinding);
+  }
+
+  // hazard: a silent cap reads as "that was everything". The omitted count is part of the finding list.
+  // why: the disclosure costs one slot, so it only appears once there are more failures than slots — which
+  // makes the omitted count always two or more, never one.
+  const kept = unique.slice(0, Math.max(1, max - 1)).map(toFinding);
+  const omitted = unique.length - kept.length;
+  return [...kept, { summary: `…and ${omitted} more failures in the gate output` }];
+}
+
+const SOURCE_EXT = "ts|tsx|mts|cts|js|jsx|mjs|cjs|py|go|rb|rs|java|kt|swift|php|sh|sql";
+// why: the runner prints the file it failed in — `test at src/x.test.ts:12:1`, or a file:// URL inside a stack
+// frame. Those paths are evidence. The changed files from the diff are only context, and were being presented
+// as the thing to fix.
+const PATH_IN_OUTPUT = new RegExp(
+  `(?:file://)?((?:[A-Za-z]:)?[\\w./~@+-]*[\\w-]\\.(?:${SOURCE_EXT}))(?=[:)\\s,'"\`]|$)`,
+  "g",
+);
+
+/**
+ * hazard: a test runner colours its output, and an escape ends `[39m` — the escape character itself does not match
+ * the path pattern but `39m` does, so a coloured `src/x.test.ts` came out as `39msrc/x.test.ts`. The autopilot then
+ * told the agent, by name, to go and fix a file that does not exist. Seen in this repository's own gate output.
+ */
+export function stripAnsi(text: string): string {
+  // why: the escape is built from its char code rather than written literally, so the pattern can name it without
+  // putting a control character in the source — which is what the linter is right to refuse.
+  const esc = String.fromCharCode(27);
+  return text.replaceAll(new RegExp(`${esc}\\[[0-9;]*[A-Za-z]`, "g"), "");
+}
+
+/**
+ * Source files the gate output itself names, in first-appearance order, deduplicated.
+ *
+ * why: `projectDir` is taken so an absolute path inside the repository collapses onto the relative spelling of
+ * the same file. Node prints both forms for one failure — `test at src/x.test.ts:12` and a `file:///…` stack
+ * frame — and without this they would read as two separate places to look.
+ */
+export function filesFromOutput(outputTail: string, projectDir: string): string[] {
+  const seen = new Set<string>();
+  const files: string[] = [];
+  const prefix = `${projectDir.replace(/\/+$/, "")}/`;
+
+  for (const match of stripAnsi(outputTail).matchAll(PATH_IN_OUTPUT)) {
+    const raw = match[1];
+    if (!raw) {
+      continue;
+    }
+    // hazard: a path outside the project stays as printed — the runner named it, so hiding it would lose the
+    // only pointer the reader has.
+    const path = raw.startsWith(prefix) ? raw.slice(prefix.length) : raw;
+    if (seen.has(path)) {
+      continue;
+    }
+    seen.add(path);
+    files.push(path);
+  }
+  return files;
+}

package/src/core/gate/gate.lock.ts

@@ -0,0 +1,283 @@
+import {
+  closeSync,
+  existsSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  statSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { hostname } from "node:os";
+import { dirname, join } from "node:path";
+import { nextDelay } from "../../platform/backoff.ts";
+import { projectStateDir } from "../../platform/paths.ts";
+import type { LockBody } from "./gate.types.ts";
+
+export const GATE_LOCK_WAIT_MS = 120_000;
+export const GATE_LOCK_STALE_MS = 30 * 60 * 1000;
+
+// hazard: tryAcquire creates the file before writing the body, so a legitimate lock is briefly unreadable.
+// The grace window has to outlast that gap by orders of magnitude without approaching the stale threshold —
+// a lock nobody can read has no owner to wait for and no pid to release it.
+export const GATE_LOCK_UNREADABLE_GRACE_MS = 5_000;
+
+export class GateLockTimeoutError extends Error {
+  constructor(message = "gate lock timeout") {
+    super(message);
+    this.name = "GateLockTimeoutError";
+  }
+}
+
+export function gateLockPath(root: string): string {
+  return join(projectStateDir(root), "grind.lock");
+}
+
+function defaultSleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+export function readLockBody(path: string): LockBody | null {
+  if (!existsSync(path)) {
+    return null;
+  }
+  try {
+    return JSON.parse(readFileSync(path, "utf8")) as LockBody;
+  } catch {
+    return null;
+  }
+}
+
+function lockAgeMs(path: string, now: number): number | null {
+  if (!existsSync(path)) {
+    return null;
+  }
+  try {
+    return now - statSync(path).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+
+export function isLockStale(path: string, args: { now: number; staleMs: number }): boolean {
+  const age = lockAgeMs(path, args.now);
+  return age !== null && age >= args.staleMs;
+}
+
+// why: a body that parses but does not carry a holder is as useless as one that does not parse — there is
+// still no provider to name and no pid to release by. Both are "unreadable" for the purpose of reclaiming.
+export function isUsableLockBody(value: unknown): value is LockBody {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const body = value as Partial<LockBody>;
+  return (
+    typeof body.provider === "string" && typeof body.session === "string" && typeof body.pid === "number"
+  );
+}
+
+export function isLockUnreadable(path: string, args: { now: number; graceMs: number }): boolean {
+  const age = lockAgeMs(path, args.now);
+  if (age === null || age < args.graceMs) {
+    return false;
+  }
+  return !isUsableLockBody(readLockBody(path));
+}
+
+/**
+ * Whether the recorded process is provably gone.
+ *
+ * hazard: a pid means nothing on another machine, so this answers `false` unless the lock names this host.
+ * Without that check a shared checkout would let one machine reclaim a lock whose owner is alive on another,
+ * and two gates would run at once — the thing the lock exists to prevent.
+ *
+ * why: `process.kill(pid, 0)` sends no signal, it only asks whether the process exists. `EPERM` means it
+ * exists and belongs to another user, which is alive for our purposes. Anything unexpected is treated as
+ * alive, because the age rule is the safe fallback and reclaiming a live holder is the expensive mistake.
+ */
+/** Asks the OS whether a pid exists. Injected so the ESRCH and EPERM branches are testable on every platform. */
+export type ProcessProbe = (pid: number) => void;
+
+const probeProcess: ProcessProbe = (pid) => {
+  process.kill(pid, 0);
+};
+
+export function isLockOwnerGone(
+  body: unknown,
+  thisHost: string = hostname(),
+  probe: ProcessProbe = probeProcess,
+): boolean {
+  if (!isUsableLockBody(body)) {
+    return false;
+  }
+  const { host, pid } = body;
+  if (typeof host !== "string" || host !== thisHost) {
+    return false;
+  }
+  if (!Number.isInteger(pid) || pid <= 0) {
+    return false;
+  }
+  try {
+    probe(pid);
+    return false;
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === "ESRCH";
+  }
+}
+
+export function isLockReclaimable(
+  path: string,
+  args: { now: number; staleMs: number; graceMs: number },
+): boolean {
+  return (
+    isLockStale(path, { now: args.now, staleMs: args.staleMs }) ||
+    isLockUnreadable(path, { now: args.now, graceMs: args.graceMs }) ||
+    // why: an owner that no longer exists has nothing to wait for. Without this the gate honoured a dead
+    // session's lock for the full stale window — measured at 30 minutes, blocking on a pid `ps` reported gone.
+    isLockOwnerGone(readLockBody(path))
+  );
+}
+
+export type DescribeHolderOptions = {
+  now?: number;
+  staleMs?: number;
+};
+
+// hazard: an abandoned lock must not read as held. Callers short-circuit on this answer before
+// withGateLock can reach stealIfStale, so reporting a stale holder blocks the grind for as long as the
+// file survives — not until the threshold, which is what the threshold exists to bound.
+export function describeHolder(root: string, options: DescribeHolderOptions = {}): string | null {
+  const path = gateLockPath(root);
+  const now = options.now ?? Date.now();
+  const staleMs = options.staleMs ?? GATE_LOCK_STALE_MS;
+  if (isLockStale(path, { now, staleMs })) {
+    return null;
+  }
+  const body = readLockBody(path);
+  if (!isUsableLockBody(body)) {
+    return null;
+  }
+  // hazard: the comment above predicted this exact failure and the code did not implement it. A lock whose
+  // owner is dead but whose file is younger than the threshold was reported as held, and the caller
+  // short-circuited before withGateLock could reclaim it — measured blocking a gate on a pid `ps` said was
+  // gone. Reclaimability and holder reporting have to agree, or the reclaim path is unreachable.
+  if (isLockOwnerGone(body)) {
+    return null;
+  }
+  return `${body.provider} session ${body.session} (pid ${body.pid})`;
+}
+
+function tryAcquire(path: string, body: LockBody): boolean {
+  mkdirSync(dirname(path), { recursive: true });
+  try {
+    const fd = openSync(path, "wx");
+    try {
+      writeFileSync(fd, JSON.stringify(body));
+    } finally {
+      closeSync(fd);
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function stealIfReclaimable(
+  path: string,
+  args: { staleMs: number; graceMs: number; now: number },
+  body: LockBody,
+): { stolen: boolean; previousHolder: LockBody | null } {
+  if (!isLockReclaimable(path, args)) {
+    return { stolen: false, previousHolder: null };
+  }
+  const previousHolder = readLockBody(path);
+  try {
+    unlinkSync(path);
+  } catch {
+    return { stolen: false, previousHolder: null };
+  }
+  return { stolen: tryAcquire(path, body), previousHolder };
+}
+
+export function releaseLock(path: string, pid: number): void {
+  const body = readLockBody(path);
+  if (body && body.pid === pid) {
+    try {
+      unlinkSync(path);
+    } catch {}
+  }
+}
+
+export type WithGateLockOptions = {
+  waitMs?: number;
+  staleMs?: number;
+  unreadableGraceMs?: number;
+  now?: () => number;
+  sleep?: (ms: number) => Promise<void>;
+  random?: () => number;
+  baseMs?: number;
+  capMs?: number;
+  onSteal?: (previousHolder: LockBody) => void;
+};
+
+export async function withGateLock<T>(
+  root: string,
+  provider: string,
+  session: string,
+  fn: () => Promise<T>,
+  options: WithGateLockOptions = {},
+): Promise<T> {
+  const waitMs = options.waitMs ?? GATE_LOCK_WAIT_MS;
+  const staleMs = options.staleMs ?? GATE_LOCK_STALE_MS;
+  const graceMs = options.unreadableGraceMs ?? GATE_LOCK_UNREADABLE_GRACE_MS;
+  const nowFn = options.now ?? Date.now;
+  const sleep = options.sleep ?? defaultSleep;
+  const random = options.random ?? Math.random;
+  const baseMs = options.baseMs ?? 20;
+  const capMs = options.capMs ?? 500;
+  const path = gateLockPath(root);
+  const deadline = nowFn() + waitMs;
+  const pid = process.pid;
+
+  let attempt = 0;
+  while (true) {
+    const now = nowFn();
+    const body: LockBody = {
+      provider,
+      session,
+      pid,
+      acquired_at: new Date(now).toISOString(),
+      host: hostname(),
+    };
+
+    if (tryAcquire(path, body)) {
+      return runUnderLock(path, pid, fn);
+    }
+
+    const steal = stealIfReclaimable(path, { staleMs, graceMs, now }, body);
+    if (steal.stolen) {
+      if (steal.previousHolder) {
+        options.onSteal?.(steal.previousHolder);
+      }
+      return runUnderLock(path, pid, fn);
+    }
+
+    if (nowFn() >= deadline) {
+      const holder = describeHolder(root);
+      throw new GateLockTimeoutError(
+        `gate lock busy at ${path} after ${waitMs}ms${holder ? ` — held by ${holder}` : ""}`,
+      );
+    }
+
+    await sleep(nextDelay({ attempt, baseMs, capMs, random }));
+    attempt += 1;
+  }
+}
+
+async function runUnderLock<T>(path: string, pid: number, fn: () => Promise<T>): Promise<T> {
+  try {
+    return await fn();
+  } finally {
+    releaseLock(path, pid);
+  }
+}

package/src/core/gate/gate.service.ts

@@ -0,0 +1,28 @@
+import { FINDINGS_MAX } from "./gate.artifact.ts";
+import type { FailureCategory, GateGap, LastGateArtifact } from "./gate.types.ts";
+
+export function gapsFromArtifact(args: {
+  artifact: LastGateArtifact;
+  category: FailureCategory;
+  max?: number;
+}): GateGap[] {
+  const max = args.max ?? FINDINGS_MAX;
+  const findings = args.artifact.findings.slice(0, max);
+  if (findings.length === 0) {
+    return [
+      {
+        id: `${args.artifact.gate}-0`,
+        gate: args.artifact.gate,
+        category: args.category,
+        summary: `${args.artifact.gate} failed (exit ${args.artifact.exitCode})`,
+      },
+    ];
+  }
+  return findings.map((finding, index) => ({
+    id: finding.id ?? `${args.artifact.gate}-${index}`,
+    gate: args.artifact.gate,
+    category: args.category,
+    summary: finding.summary,
+    detail: finding.detail,
+  }));
+}