@vantageos/backend-doctor 0.1.7 → 0.1.8

package/dist/detectors/source/isolation.js

@@ -120,7 +120,9 @@ function discoverBuilders(files) {
 function definitionOpener(raw, set) {
     // longest builder names first so `authedQuery` wins over a `query` substring.
     const names = [...set].sort((a, z) => z.length - a.length);
-    const alt = names.map((n) => n.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+    const alt = names
+        .map((n) => n.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+        .join("|");
     const re = new RegExp(`(?:export\\s+)?const\\s+([A-Za-z0-9_]+)\\s*=\\s*(${alt})\\s*\\(`);
     const m = re.exec(raw);
     return m ? { name: m[1], builder: m[2] } : null;
@@ -234,6 +236,12 @@ export function scanR50(files) {
     // Pass 1: discover the tree's query/mutation builders so a customQuery wrapper
     // (authedQuery, orgQuery, …) is recognised, not just the bare `query` base.
     const builders = discoverBuilders(files);
+    // Public queries that matched a definition opener but exhibit NO org-throw, NO
+    // fail-closed resolver, and NO isolation-contract marker. Not gated subjects, so
+    // historically SKIPPED — which, when EVERY public query is such a bare read,
+    // produced a false "no public query matched" abstain. Recorded for the
+    // otherwise-empty branch below.
+    const ungated = [];
     // A customQuery wrapper whose base is neither query nor internalQuery leaves the
     // public-query surface unknowable — REFUSE (could-not-judge), never a silent green.
     for (const a of builders.ambiguous) {
@@ -321,16 +329,21 @@ export function scanR50(files) {
             // so a commented-out throw does not count). The contract marker is, by
             // definition, a COMMENT — so it is read from the full block text INCLUDING
             // comment lines, not the code-only blockText.
-            const blockTextWithComments = block.lines
-                .map((l) => l.raw)
-                .join("\n");
+            const blockTextWithComments = block.lines.map((l) => l.raw).join("\n");
             const throwsOnNoOrg = ORG_THROW.test(blockText) || ORG_THROW_HELPER.test(blockText);
             const hasResolver = SAFE_RESOLVER.test(blockText);
             const hasMarker = CONTRACT_MARKER.test(blockTextWithComments);
             if (!throwsOnNoOrg && !hasResolver && !hasMarker) {
                 // query does neither org-isolation throw nor fail-closed resolve nor
                 // declare a contract — not R-50's subject (too ambiguous to judge
-                // mechanically; never a violation).
+                // mechanically; never a violation). Recorded so a tree whose ENTIRE
+                // public-read surface is bare is judged (CNJ-with-sites) rather than
+                // falsely abstained as "no public query matched".
+                ungated.push({
+                    rel: f.rel,
+                    n: block.lines[0].n,
+                    note: `${fn}: public query with no org-throw, no fail-closed resolver, and no isolation-contract marker — no org-isolation handling is visible in convex/, and whether a subscribing client can reach it before an org exists is not statically decidable; a reviewer must confirm this read isolates by org (never a silent clean bill)`,
+                });
                 continue;
             }
             // PRECEDENCE (Eta #13 REVISE seam): the THROW wins over a fail-closed
@@ -390,6 +403,18 @@ export function scanR50(files) {
             }
         }
     }
+    // A tree whose ENTIRE public-read surface is ungated (no throw / resolver / marker
+    // on ANY query) leaves the scan otherwise empty. The legacy abstain then claimed
+    // "no public query matched" — FALSE when bare public queries exist, and a silent
+    // pass over a fully-ungated backend. Surface those reads as could-not-judge sites
+    // so the verdict is CNJ-with-sites, not a misleading empty abstain. Gated on "scan
+    // otherwise empty" so a tree that already produced subjects (VP: 20 conform) is
+    // byte-for-byte unchanged.
+    if (scan.conform.length + scan.violate.length + scan.cnj.length === 0 &&
+        ungated.length > 0) {
+        for (const u of ungated)
+            scan.cnj.push(u);
+    }
     return scan;
 }
 export const R50 = srcDetector("R-50", "R-50 org isolation on a reactively-subscribed read returns a typed empty/unauthorized result, never an uncaught throw", "a public query that resolves org via a fail-closed non-throwing path or documents its client contract — it never throws on the missing-org path a subscribing client cannot catch", scanR50, "R-50: no public query matched in the scanned tree — no reactive read to certify. NOT a clean bill.");

package/dist/detectors/source/write-isolation.js

@@ -141,7 +141,9 @@ function discoverWriteBuilders(files) {
 }
 function definitionOpener(raw, set) {
     const names = [...set].sort((a, z) => z.length - a.length);
-    const alt = names.map((n) => n.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+    const alt = names
+        .map((n) => n.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+        .join("|");
     const re = new RegExp(`(?:export\\s+)?const\\s+([A-Za-z0-9_]+)\\s*=\\s*(${alt})\\s*\\(`);
     const m = re.exec(raw);
     return m ? { name: m[1], builder: m[2] } : null;
@@ -169,6 +171,13 @@ function mutationBlock(lines, i) {
 export function scanR51(files) {
     const scan = emptyScan();
     const builders = discoverWriteBuilders(files);
+    // Public writes that matched a definition opener but exhibit NO org-throw, NO
+    // typed-unauthorized return, and NO write-contract marker. They are not gated
+    // subjects, so they were historically SKIPPED — which, when EVERY public write
+    // in the tree is such a bare write, produced a false "no public mutation
+    // matched" abstain (a silent pass over a fully-ungated public-write surface).
+    // Recorded here so the otherwise-empty branch below can surface them.
+    const ungated = [];
     for (const a of builders.ambiguous) {
         scan.cnj.push({
             rel: a.rel,
@@ -236,8 +245,17 @@ export function scanR51(files) {
             const throwsOnNoOrg = ORG_THROW.test(blockText) || WRITE_GATE_HELPER.test(blockText);
             const typedUnauth = TYPED_UNAUTH_RETURN.test(blockText);
             const hasMarker = CONTRACT_MARKER.test(blockAll);
-            if (!throwsOnNoOrg && !typedUnauth && !hasMarker)
-                continue; // not a subject
+            if (!throwsOnNoOrg && !typedUnauth && !hasMarker) {
+                // A bare public write with no visible org isolation. Not a gated
+                // subject — but recorded so a tree whose ENTIRE public-write surface
+                // is bare is judged (CNJ-with-sites) rather than falsely abstained.
+                ungated.push({
+                    rel: f.rel,
+                    n: block.lines[0].n,
+                    note: `${fn}: public mutation with no org-throw, no typed-unauthorized return, and no write-contract marker — no org-isolation handling is visible in convex/, and whether a client can reach it before an org exists is not statically decidable; a reviewer must confirm this write isolates by org (never a silent clean bill)`,
+                });
+                continue; // not a gated subject
+            }
             if (typedUnauth) {
                 // The write returns a shape on the no-org path — a pre-org client can render
                 // it, not an uncaught Server Error. Green.
@@ -295,6 +313,19 @@ export function scanR51(files) {
             }
         }
     }
+    // A tree whose ENTIRE public-write surface is ungated (no throw / typed-unauth /
+    // marker on ANY write) leaves the scan otherwise empty. The legacy abstain then
+    // claimed "no public mutation matched" — FALSE when bare public writes exist, and
+    // a silent pass over a fully-ungated backend. Surface those writes as
+    // could-not-judge sites so the verdict is CNJ-with-sites, not a misleading empty
+    // abstain. Gated on "scan otherwise empty" so a tree that already produced
+    // subjects (VP: 7 marker CNJ) is byte-for-byte unchanged — the bare-write
+    // disposition in a mixed tree is out of this fix's scope.
+    if (scan.conform.length + scan.violate.length + scan.cnj.length === 0 &&
+        ungated.length > 0) {
+        for (const u of ungated)
+            scan.cnj.push(u);
+    }
     return scan;
 }
 export const R51 = srcDetector("R-51", "R-51 a public mutation returns a typed unauthorized result on the no-org path, never an uncaught throw a pre-org client shell cannot render", "a public write either returns a typed unauthorized result / documents its client contract, or a human confirms a pre-org client cannot reach it — it never throws NO_ORG on a path an ordinary render can hit", scanR51, "R-51: no public mutation matched in the scanned tree — no write to certify. NOT a clean bill.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/backend-doctor",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "A conformance instrument that measures the VantagePeers backend against the pinned backend standard. The THIRD doctor built ON the @vantageos/mcp-doctor engine — never a third engine. It consumes runDoctor/renderTable and adds only detectors.",
   "type": "module",
   "main": "./dist/cli.js",