@vantageos/backend-doctor 0.2.0 → 0.3.0

package/dist/detectors/oracle-axis2.d.ts

@@ -1,7 +1,13 @@
 import type { Detector } from "../engine-types.js";
 import { type OracleRow } from "../oracle.js";
 import type { RulePredicate } from "./shared.js";
+export declare const JUSTIFICATION_TOKEN_RE: RegExp;
+/** The oracle-row form: reads the row's remediation cell (`rbac_adjustment_needed`). */
 export declare function hasJustificationToken(r: OracleRow): boolean;
+/** The raw-text form — for a SOURCE-scan site with no oracle row: a nearby code
+ * comment window is that site's "remediation cell". Same regex, same word-
+ * boundary/negation guards; never a second matcher. */
+export declare function hasJustificationTokenInText(text: string): boolean;
 export declare const r7: RulePredicate;
 export declare const r8: RulePredicate;
 export interface DivergenceSite {

package/dist/detectors/oracle-axis2.js

@@ -1,4 +1,5 @@
 import { isInventoryRow, oracleLabel, readOracle, refuseWithoutOracle, } from "../oracle.js";
+import { itemCount, withCount } from "../violation-count.js";
 // A written justification token turns a flagged divergence from a DEFECT the
 // author owes into a recorded, accepted divergence. It is the mechanical pole
 // that replaced "a human decides whether the divergence is sound": the control
@@ -7,22 +8,37 @@ import { isInventoryRow, oracleLabel, readOracle, refuseWithoutOracle, } from ".
 // are remediation-owed markers (R-28) — a fix still owed, NOT a justification —
 // so they do not satisfy this predicate; only an explicit JUSTIFIÉ/JUSTIFIED/
 // STATELESS/ACCEPTED token does.
+//
+// Anchored on the DOCUMENTED shape: the standard writes the token with a
+// trailing colon (`JUSTIFIÉ:` / `JUSTIFIED:` / `STATELESS:`), at a word
+// boundary. Two failures a bare substring match let through, both closed here:
+//   • a LEADING-letter negation — "UNJUSTIFIED" contains "JUSTIFIED", so the
+//     leading `(?<![A-Za-zÀ-ÿ-])` (not preceded by a letter OR a hyphen — a
+//     hyphen-joined negation like French `non-justifié:` clears a letter-only
+//     lookbehind, Eta #12 round-2) rejects it; and R-37's own output prints
+//     "N UNJUSTIFIED divergence(s)".
+//   • a token with NO colon — "not justified", "justified by design" — cleared
+//     the guard though the standard requires the colon; the trailing `\s*:`
+//     now rejects it. Only the recorded token form (`TOKEN:`) is a justification.
+// No trailing \b before the colon: an accented final letter (É in JUSTIFIÉ) is
+// not an ASCII word char, so \b would not match after it — the colon is the anchor.
+//
+// ONE regex, shared by every axis (oracle-row remediation cells here, and a
+// source-scan's nearby comment window in the SOURCE_STANDARD_PIN detectors) —
+// task k179jnhx: "Do not write a second token matcher; extract/share the
+// existing one." Two implementations of one predicate is the defect class the
+// fleet keeps filing.
+export const JUSTIFICATION_TOKEN_RE = /(?<![A-Za-zÀ-ÿ-])(JUSTIFI(É|E|ED)|STATELESS|ACCEPT(É|E|ED)|WONTFIX)\s*:/i;
+/** The oracle-row form: reads the row's remediation cell (`rbac_adjustment_needed`). */
 export function hasJustificationToken(r) {
     const cell = (r.by.rbac_adjustment_needed ?? "").trim();
-    // Anchored on the DOCUMENTED shape: the standard writes the token with a
-    // trailing colon (`JUSTIFIÉ:` / `JUSTIFIED:` / `STATELESS:`), at a word
-    // boundary. Two failures a bare substring match let through, both closed here:
-    //   • a LEADING-letter negation — "UNJUSTIFIED" contains "JUSTIFIED", so the
-    //     leading `(?<![A-Za-zÀ-ÿ-])` (not preceded by a letter OR a hyphen — a
-    //     hyphen-joined negation like French `non-justifié:` clears a letter-only
-    //     lookbehind, Eta #12 round-2) rejects it; and R-37's own output prints
-    //     "N UNJUSTIFIED divergence(s)".
-    //   • a token with NO colon — "not justified", "justified by design" — cleared
-    //     the guard though the standard requires the colon; the trailing `\s*:`
-    //     now rejects it. Only the recorded token form (`TOKEN:`) is a justification.
-    // No trailing \b before the colon: an accented final letter (É in JUSTIFIÉ) is
-    // not an ASCII word char, so \b would not match after it — the colon is the anchor.
-    return /(?<![A-Za-zÀ-ÿ-])(JUSTIFI(É|E|ED)|STATELESS|ACCEPT(É|E|ED)|WONTFIX)\s*:/i.test(cell);
+    return JUSTIFICATION_TOKEN_RE.test(cell);
+}
+/** The raw-text form — for a SOURCE-scan site with no oracle row: a nearby code
+ * comment window is that site's "remediation cell". Same regex, same word-
+ * boundary/negation guards; never a second matcher. */
+export function hasJustificationTokenInText(text) {
+    return JUSTIFICATION_TOKEN_RE.test(text);
 }
 // ---- R-7 read/write coherence divergence (INCOHERENT* table-aggregate flag) -
 // §18: "`INCOHERENT*` flag (mechanical); divergence justified (human)". The
@@ -182,12 +198,12 @@ export function makeR37(rowsProvider = readOracle) {
                 .map((s) => `${s.table}.${s.field}: ${s.toolA} "${s.valA.slice(0, 32)}" vs ${s.toolB} "${s.valB.slice(0, 32)}"`)
                 .join("; ");
             const reason = `R-37: ${sites.length} UNJUSTIFIED filled-neighbour divergence(s) across ${tables.size} tables — the mechanical compare names WHICH TWO TOOLS diverge on a shared contract field, and none carries a written per-tool justification token (JUSTIFIÉ:/JUSTIFIED: in rbac_adjustment_needed); each owes a fix or a recorded justification. This IS a violation, not an abstention. ${breakdown} Examples: ${examples}.`;
-            return {
+            return withCount({
                 id: R37_ID,
                 anchor: `${oracleLabel()} table=${sites[0].table}`,
                 state: "non-conforming",
                 verdict: reason,
-            };
+            }, itemCount(sites.length));
         }),
     };
 }

package/dist/detectors/predicates.js

@@ -4,6 +4,7 @@
 // structural.ts (they judge the inventory SCHEMA, not a row).
 import { basename } from "node:path";
 import { WRITER_TIER_NAME, readWriterTier } from "../oracle.js";
+import { hasJustificationToken } from "./oracle-axis2.js";
 import { LIST_VERBS, WRITE_VERBS, isMcpPublic } from "./shared.js";
 // ---- R-1 exposure declared ------------------------------------------------
 // §2 line 32: exposure -> `surface` = `public` (MCP surface) / `internal` /
@@ -181,10 +182,18 @@ export const r5 = {
         // no arg= in the boundary: NOW the identity-evidencing label may confirm.
         if (rbacEvidencesIdentity(r.by.rbac_qui))
             return { kind: "conform" };
-        // maps to a tier but the row evidences NEITHER identity nor arg — abstain, never a silent pass.
+        // maps to a tier but the row evidences NEITHER identity nor arg — flagged.
+        // judgement is retired (task k179jnhx, §23): the disposition is decided by
+        // the written justification token's PRESENCE in the remediation cell, never
+        // by a person's opinion of whether the ambiguity is sound. No token →
+        // non-conforming; a JUSTIFIÉ:/JUSTIFIED: token → present. could-not-judge
+        // is reserved for a row the instrument could not read (never reached here —
+        // this row parsed fine, the disposition is undecided-by-token, not unreadable).
+        if (hasJustificationToken(r))
+            return { kind: "conform" };
         return {
-            kind: "cnj",
-            note: `tier maps to ${tier} but rbac_qui="${r.by.rbac_qui}"/namespace_ou_org="${ns}" do not evidence identity-resolution; R-11 flags the locus`,
+            kind: "violate",
+            note: `tier maps to ${tier} but rbac_qui="${r.by.rbac_qui}"/namespace_ou_org="${ns}" do not evidence identity-resolution, and no written JUSTIFIÉ:/JUSTIFIED: token is recorded in the remediation cell (rbac_adjustment_needed="${(r.by.rbac_adjustment_needed ?? "").trim() || "<empty>"}"); R-11 flags the locus`,
         };
     },
 };

package/dist/detectors/shared.js

@@ -1,4 +1,5 @@
 import { isInventoryRow, oracleLabel, readOracle, refuseWithoutOracle, } from "../oracle.js";
+import { itemCount, withCount } from "../violation-count.js";
 /** Run a predicate over a row set, tallying per-kind. */
 export function tally(spec, rows) {
     const t = { conform: 0, violate: 0, cnj: 0, na: 0, violations: [], unjudged: [] };
@@ -63,12 +64,12 @@ export function evaluate(spec, rows) {
             .slice(0, 3)
             .map((v) => `row#${v.row.n} "${v.row.by.outil || v.row.by.table}" — ${v.note}`)
             .join("; ");
-        return {
+        return withCount({
             id: spec.id,
             anchor: anchorFor(t.violations, oracleLabel()),
             state: "non-conforming",
             verdict: `${spec.ruleId}: ${t.violate} of ${applicable} applicable oracle rows VIOLATE (${spec.check}). ${breakdown} Examples: ${examples}.`,
-        };
+        }, itemCount(t.violate));
     }
     return {
         id: spec.id,

package/dist/detectors/source/_ast.d.ts

@@ -0,0 +1,92 @@
+import * as ts from "typescript";
+import type { Tree } from "../../engine-types.js";
+export type SrcFile = Tree["files"][number];
+export interface Parsed {
+    rel: string;
+    sf: ts.SourceFile;
+}
+export declare function sourceOf(f: SrcFile): string;
+export declare function parseFile(f: SrcFile): Parsed;
+export declare function lineOf(n: ts.Node): number;
+/** Strip `await`, parentheses, `!` non-null, `as`/`satisfies` casts. */
+export declare function unwrap(e: ts.Expression): ts.Expression;
+/** A property read: `x.prop`, or `x["prop"]` (a string-literal element access
+ * is the same read, spelled differently). A computed key is not a read of a
+ * known property and gives undefined. */
+export declare function propRead(e: ts.Node): {
+    obj: ts.Expression;
+    name: string;
+} | undefined;
+/** The initializer of the NEAREST `const <id> = <init>` visible from `id`, or
+ * undefined (a parameter or a `let` in between shadows it, so does a
+ * destructure). Exactly one level: the caller never follows an alias of an
+ * alias. */
+export declare function constInit(id: ts.Identifier): ts.Expression | undefined;
+/** `e` as a property read, one const alias deep: `x.p`, `x["p"]`, or an
+ * identifier declared `const a = x.p` / `const a = x["p"]` (read as `x.p`). */
+export declare function propReadResolved(e: ts.Expression): {
+    obj: ts.Expression;
+    name: string;
+} | undefined;
+/** Visit every descendant of `n` (pre-order), NOT descending into nested
+ * function bodies when `ownOnly` is set. */
+export declare function walk(n: ts.Node, visit: (x: ts.Node) => void, ownOnly?: boolean): void;
+/** `a.b.c` as text, or undefined when the expression is not a dotted chain. */
+export declare function dotted(e: ts.Expression): string | undefined;
+/** The callee's last name: `ctx.db.patch` -> `patch`, `helper` -> `helper`. */
+export declare function calleeName(c: ts.CallExpression): string | undefined;
+export type Builder = "mutation" | "action" | "query" | "internalMutation" | "internalAction" | "internalQuery";
+export interface Registration {
+    name: string;
+    builder: Builder;
+    rel: string;
+    line: number;
+    /** the handler function (`handler: async (ctx, args) => {…}`). */
+    handler: ts.FunctionLikeDeclaration;
+    /** arg name -> referenced table, for `v.id("T")` / `v.optional(v.id("T"))`. */
+    argIdTable: Map<string, string>;
+}
+export declare function idTableOf(text: string): string | undefined;
+/** The ONE table a validator's text references through `v.id("T")` — through
+ * `v.optional`, `v.array`, or a nested `v.object` — or undefined when it names
+ * none or several. */
+export declare function singleIdTable(text: string): string | undefined;
+/** Every `export const NAME = <builder>({ … handler … })` of a file. */
+export declare function registrations(p: Parsed): Registration[];
+export interface FnDef {
+    name: string;
+    rel: string;
+    line: number;
+    fn: ts.FunctionLikeDeclaration;
+}
+/** Every top-level `function f` / `const f = (…) => …` across the parsed files. */
+export declare function indexFunctions(ps: Parsed[]): Map<string, FnDef[]>;
+/** Names of the plain-identifier functions a body calls. */
+export declare function calledNames(fn: ts.Node): Set<string>;
+/** A per-function boolean property closed over the call graph: `own(fn)` holds,
+ * or the function calls (by name) another function for which it holds. */
+export declare function closeOverCalls(idx: Map<string, FnDef[]>, own: (d: FnDef) => boolean): Set<string>;
+/** The tenant columns, as standard 2825122 §4 R-52 lists them:
+ * `orgId`/`tenantId`/`workspaceId`/`orgSlug` (vantage-peers stamps its agents
+ * under `orgSlug: client_org_mapping.clerkOrgSlug`). A `namespace` is NOT in this
+ * set: the standard counts it only when it is "checked against the caller's
+ * allowed prefixes", which is a property of the code around the table, not of
+ * the schema. `readSchema` records it apart (`SchemaTable.namespace`) and R-52
+ * decides it per table (cross-tenant-write.ts `namespaceDecisions`). */
+export declare const TENANT_COLUMNS: ReadonlySet<string>;
+/** The column that is a tenant column only where it is prefix-checked. */
+export declare const NAMESPACE_COLUMN = "namespace";
+export type TenantKind = "required" | "optional" | "none";
+export interface SchemaTable {
+    name: string;
+    /** from the TENANT_COLUMNS alone. */
+    tenant: TenantKind;
+    /** whether a `namespace` column exists and is optional — a tenant column
+     * only where the code checks it against the caller's allowed prefixes. */
+    namespace: TenantKind;
+    fields: string[];
+    /** field -> the table its `v.id("T")` references. */
+    idRef: Map<string, string>;
+}
+/** Read every `name: defineTable({...})` of a schema file. */
+export declare function readSchema(p: Parsed): Map<string, SchemaTable>;

package/dist/detectors/source/_ast.js

@@ -0,0 +1,353 @@
+// Shared TypeScript-AST primitives for the R-52 / R-53 source detectors.
+//
+// Both rules read the SAME delivered material — the schema's tenant columns, every
+// public write handler, and the helper functions a handler calls — and both need
+// the parser rather than a line regex: R-52 traces a selector's provenance across
+// statements, R-53 reads the operands of an admission comparison. One parse per
+// file, one function index per tree; nothing here decides a verdict.
+import * as ts from "typescript";
+export function sourceOf(f) {
+    return f.lines.map((l) => l.raw).join("\n");
+}
+export function parseFile(f) {
+    return {
+        rel: f.rel,
+        sf: ts.createSourceFile(f.rel, sourceOf(f), ts.ScriptTarget.Latest, true, ts.ScriptKind.TS),
+    };
+}
+export function lineOf(n) {
+    const sf = n.getSourceFile();
+    return sf.getLineAndCharacterOfPosition(n.getStart(sf)).line + 1;
+}
+/** Strip `await`, parentheses, `!` non-null, `as`/`satisfies` casts. */
+export function unwrap(e) {
+    let x = e;
+    for (;;) {
+        if (ts.isAwaitExpression(x) ||
+            ts.isParenthesizedExpression(x) ||
+            ts.isNonNullExpression(x) ||
+            ts.isAsExpression(x) ||
+            ts.isSatisfiesExpression(x))
+            x = x.expression;
+        else
+            return x;
+    }
+}
+/** A property read: `x.prop`, or `x["prop"]` (a string-literal element access
+ * is the same read, spelled differently). A computed key is not a read of a
+ * known property and gives undefined. */
+export function propRead(e) {
+    if (ts.isPropertyAccessExpression(e))
+        return { obj: e.expression, name: e.name.text };
+    if (ts.isElementAccessExpression(e) &&
+        ts.isStringLiteralLike(e.argumentExpression))
+        return { obj: e.expression, name: e.argumentExpression.text };
+    return undefined;
+}
+/** The initializer of the NEAREST `const <id> = <init>` visible from `id`, or
+ * undefined (a parameter or a `let` in between shadows it, so does a
+ * destructure). Exactly one level: the caller never follows an alias of an
+ * alias. */
+export function constInit(id) {
+    for (let x = id.parent; x; x = x.parent) {
+        if (ts.isFunctionLike(x) &&
+            x.parameters.some((q) => ts.isIdentifier(q.name) && q.name.text === id.text))
+            return undefined;
+        const stmts = ts.isBlock(x) || ts.isSourceFile(x) || ts.isModuleBlock(x)
+            ? x.statements
+            : ts.isCaseClause(x) || ts.isDefaultClause(x)
+                ? x.statements
+                : undefined;
+        if (!stmts)
+            continue;
+        for (const st of stmts) {
+            if (!ts.isVariableStatement(st))
+                continue;
+            for (const d of st.declarationList.declarations)
+                if (ts.isIdentifier(d.name) && d.name.text === id.text)
+                    return st.declarationList.flags & ts.NodeFlags.Const
+                        ? d.initializer
+                        : undefined;
+        }
+    }
+    return undefined;
+}
+/** `e` as a property read, one const alias deep: `x.p`, `x["p"]`, or an
+ * identifier declared `const a = x.p` / `const a = x["p"]` (read as `x.p`). */
+export function propReadResolved(e) {
+    const u = unwrap(e);
+    const direct = propRead(u);
+    if (direct)
+        return direct;
+    if (!ts.isIdentifier(u))
+        return undefined;
+    const init = constInit(u);
+    return init ? propRead(unwrap(init)) : undefined;
+}
+/** Visit every descendant of `n` (pre-order), NOT descending into nested
+ * function bodies when `ownOnly` is set. */
+export function walk(n, visit, ownOnly = false) {
+    const rec = (x) => {
+        visit(x);
+        if (ownOnly &&
+            x !== n &&
+            (ts.isFunctionDeclaration(x) ||
+                ts.isFunctionExpression(x) ||
+                ts.isArrowFunction(x)))
+            return;
+        ts.forEachChild(x, rec);
+    };
+    rec(n);
+}
+/** `a.b.c` as text, or undefined when the expression is not a dotted chain. */
+export function dotted(e) {
+    const x = unwrap(e);
+    if (ts.isIdentifier(x))
+        return x.text;
+    if (ts.isPropertyAccessExpression(x)) {
+        const head = dotted(x.expression);
+        return head === undefined ? undefined : `${head}.${x.name.text}`;
+    }
+    return undefined;
+}
+/** The callee's last name: `ctx.db.patch` -> `patch`, `helper` -> `helper`. */
+export function calleeName(c) {
+    const e = unwrap(c.expression);
+    if (ts.isIdentifier(e))
+        return e.text;
+    if (ts.isPropertyAccessExpression(e))
+        return e.name.text;
+    return undefined;
+}
+const BUILDERS = new Set([
+    "mutation",
+    "action",
+    "query",
+    "internalMutation",
+    "internalAction",
+    "internalQuery",
+]);
+export function idTableOf(text) {
+    const m = /^\s*(?:v\.optional\(\s*)?v\.id\(\s*["'`]([A-Za-z0-9_]+)["'`]\s*\)/.exec(text);
+    return m?.[1];
+}
+/** The ONE table a validator's text references through `v.id("T")` — through
+ * `v.optional`, `v.array`, or a nested `v.object` — or undefined when it names
+ * none or several. */
+export function singleIdTable(text) {
+    const ts_ = new Set([...text.matchAll(/v\.id\(\s*["'`]([A-Za-z0-9_]+)["'`]\s*\)/g)].map((m) => m[1]));
+    return ts_.size === 1 ? [...ts_][0] : undefined;
+}
+/** The object literal of an `args:` validator: inline, `v.object({…})`, or a
+ * same-file top-level const naming either. */
+function argsObject(p, e0) {
+    const e = unwrap(e0);
+    if (ts.isObjectLiteralExpression(e))
+        return e;
+    if (ts.isCallExpression(e) &&
+        calleeName(e) === "object" &&
+        e.arguments[0] &&
+        ts.isObjectLiteralExpression(unwrap(e.arguments[0])))
+        return unwrap(e.arguments[0]);
+    if (ts.isIdentifier(e)) {
+        for (const st of p.sf.statements) {
+            if (!ts.isVariableStatement(st))
+                continue;
+            for (const d of st.declarationList.declarations)
+                if (ts.isIdentifier(d.name) && d.name.text === e.text && d.initializer)
+                    return argsObject(p, d.initializer);
+        }
+    }
+    return undefined;
+}
+/** Every `export const NAME = <builder>({ … handler … })` of a file. */
+export function registrations(p) {
+    const out = [];
+    for (const st of p.sf.statements) {
+        if (!ts.isVariableStatement(st))
+            continue;
+        for (const d of st.declarationList.declarations) {
+            if (!ts.isIdentifier(d.name) || !d.initializer)
+                continue;
+            const init = unwrap(d.initializer);
+            if (!ts.isCallExpression(init))
+                continue;
+            const b = calleeName(init);
+            if (b === undefined || !BUILDERS.has(b))
+                continue;
+            const cfg = init.arguments[0];
+            if (!cfg || !ts.isObjectLiteralExpression(cfg))
+                continue;
+            let handler;
+            const argIdTable = new Map();
+            for (const prop of cfg.properties) {
+                const key = prop.name && ts.isIdentifier(prop.name) ? prop.name.text : undefined;
+                if (key === "handler") {
+                    if (ts.isMethodDeclaration(prop))
+                        handler = prop;
+                    else if (ts.isPropertyAssignment(prop)) {
+                        const h = unwrap(prop.initializer);
+                        if (ts.isArrowFunction(h) || ts.isFunctionExpression(h))
+                            handler = h;
+                    }
+                }
+                if (key === "args" && ts.isPropertyAssignment(prop)) {
+                    const obj = argsObject(p, prop.initializer);
+                    for (const a of obj?.properties ?? []) {
+                        if (ts.isPropertyAssignment(a) && ts.isIdentifier(a.name)) {
+                            const t = singleIdTable(a.initializer.getText(p.sf));
+                            if (t)
+                                argIdTable.set(a.name.text, t);
+                        }
+                    }
+                }
+            }
+            if (handler === undefined)
+                continue;
+            out.push({
+                name: d.name.text,
+                builder: b,
+                rel: p.rel,
+                line: lineOf(d),
+                handler,
+                argIdTable,
+            });
+        }
+    }
+    return out;
+}
+/** Every top-level `function f` / `const f = (…) => …` across the parsed files. */
+export function indexFunctions(ps) {
+    const idx = new Map();
+    const add = (d) => {
+        const xs = idx.get(d.name) ?? [];
+        xs.push(d);
+        idx.set(d.name, xs);
+    };
+    for (const p of ps) {
+        for (const st of p.sf.statements) {
+            if (ts.isFunctionDeclaration(st) && st.name && st.body)
+                add({ name: st.name.text, rel: p.rel, line: lineOf(st), fn: st });
+            else if (ts.isVariableStatement(st))
+                for (const d of st.declarationList.declarations) {
+                    const init = d.initializer && unwrap(d.initializer);
+                    if (ts.isIdentifier(d.name) &&
+                        init &&
+                        (ts.isArrowFunction(init) || ts.isFunctionExpression(init)))
+                        add({ name: d.name.text, rel: p.rel, line: lineOf(d), fn: init });
+                }
+        }
+    }
+    return idx;
+}
+/** Names of the plain-identifier functions a body calls. */
+export function calledNames(fn) {
+    const out = new Set();
+    walk(fn, (x) => {
+        if (ts.isCallExpression(x)) {
+            const e = unwrap(x.expression);
+            if (ts.isIdentifier(e))
+                out.add(e.text);
+        }
+    });
+    return out;
+}
+/** A per-function boolean property closed over the call graph: `own(fn)` holds,
+ * or the function calls (by name) another function for which it holds. */
+export function closeOverCalls(idx, own) {
+    const holds = new Set();
+    for (const [n, ds] of idx)
+        if (ds.some(own))
+            holds.add(n);
+    let grew = true;
+    while (grew) {
+        grew = false;
+        for (const [n, ds] of idx) {
+            if (holds.has(n))
+                continue;
+            if (ds.some((d) => [...calledNames(d.fn)].some((c) => holds.has(c)))) {
+                holds.add(n);
+                grew = true;
+            }
+        }
+    }
+    return holds;
+}
+// ---- schema ---------------------------------------------------------------
+/** The tenant columns, as standard 2825122 §4 R-52 lists them:
+ * `orgId`/`tenantId`/`workspaceId`/`orgSlug` (vantage-peers stamps its agents
+ * under `orgSlug: client_org_mapping.clerkOrgSlug`). A `namespace` is NOT in this
+ * set: the standard counts it only when it is "checked against the caller's
+ * allowed prefixes", which is a property of the code around the table, not of
+ * the schema. `readSchema` records it apart (`SchemaTable.namespace`) and R-52
+ * decides it per table (cross-tenant-write.ts `namespaceDecisions`). */
+export const TENANT_COLUMNS = new Set([
+    "orgId",
+    "tenantId",
+    "workspaceId",
+    "orgSlug",
+]);
+/** The column that is a tenant column only where it is prefix-checked. */
+export const NAMESPACE_COLUMN = "namespace";
+/** Read every `name: defineTable({...})` of a schema file. */
+export function readSchema(p) {
+    const out = new Map();
+    walk(p.sf, (x) => {
+        if (!ts.isPropertyAssignment(x) || !ts.isIdentifier(x.name))
+            return;
+        // the initializer is `defineTable({...})` possibly chained `.index(...)`.
+        let e = x.initializer;
+        for (;;) {
+            const u = unwrap(e);
+            if (ts.isCallExpression(u) &&
+                ts.isPropertyAccessExpression(u.expression)) {
+                e = u.expression.expression;
+                continue;
+            }
+            e = u;
+            break;
+        }
+        if (!ts.isCallExpression(e) ||
+            calleeName(e) !== "defineTable" ||
+            !e.arguments[0] ||
+            !ts.isObjectLiteralExpression(e.arguments[0]))
+            return;
+        const fields = [];
+        const idRef = new Map();
+        let tenant = "none";
+        let namespace = "none";
+        for (const prop of e.arguments[0].properties) {
+            if (!ts.isPropertyAssignment(prop))
+                continue;
+            const k = ts.isIdentifier(prop.name)
+                ? prop.name.text
+                : ts.isStringLiteral(prop.name)
+                    ? prop.name.text
+                    : undefined;
+            if (k === undefined)
+                continue;
+            fields.push(k);
+            const text = prop.initializer.getText(p.sf);
+            const t = idTableOf(text);
+            if (t)
+                idRef.set(k, t);
+            const opt = /^\s*v\.optional\(/.test(text);
+            if (TENANT_COLUMNS.has(k)) {
+                if (!opt)
+                    tenant = "required";
+                else if (tenant === "none")
+                    tenant = "optional";
+            }
+            if (k === NAMESPACE_COLUMN)
+                namespace = opt ? "optional" : "required";
+        }
+        out.set(x.name.text, {
+            name: x.name.text,
+            tenant,
+            namespace,
+            fields,
+            idRef,
+        });
+    });
+    return out;
+}

package/dist/detectors/source/_scan.js

@@ -1,3 +1,4 @@
+import { siteCount, withCount } from "../../violation-count.js";
 /** The standard both wave-2 files are pinned against (short hash a9d7877b). */
 export const SOURCE_STANDARD_PIN = "analysis/vantagepeers/backend-standard/backend-standard.md @ a9d7877b4947ed8ae61d234433debb2182a2ba44 (elpiarthera/ElPi-Corp) §15";
 export function emptyScan() {
@@ -45,12 +46,12 @@ export function decide(ruleId, id, check, scan, emptyReason) {
         // verdict is otherwise the only one printed without an address (Eta REVISE
         // blocker 1: R-51 CRM could-not-judge=1 was counted but never located). The
         // data is already in scan.cnj; list it under its own label whenever non-empty.
-        return {
+        return withCount({
             id,
             anchor: `${scan.violate[0].rel}:${scan.violate[0].n}`,
             state: "non-conforming",
-            verdict: `${ruleId}: ${nV} site(s) VIOLATE (${check}). ${breakdown} Violations: ${fmt(scan.violate)}.${nC ? ` Conform site(s): ${fmt(scan.conform)}.` : ""}${nJ ? ` could-not-judge sites (human verdict owed): ${fmt(scan.cnj)}.` : ""}`,
-        };
+            verdict: `${ruleId}: ${nV} site(s) VIOLATE (${check}). ${breakdown} Violations: ${fmt(scan.violate)}.${nC ? ` Conform site(s): ${fmt(scan.conform)}.` : ""}${nJ ? ` could-not-judge sites (not decided; each names why): ${fmt(scan.cnj)}.` : ""}`,
+        }, siteCount(scan.violate));
     }
     if (nJ > 0) {
         const reason = `${ruleId}: ${nJ} site(s) could not be judged — ${fmt(scan.cnj)}. This is NOT a clean bill. ${breakdown}`;