@zxyycom/vibe-check 0.0.1 → 0.0.3

package/src/package-checks/command-check/options.ts

@@ -0,0 +1,331 @@
+import {
+  snapshotClosedArray,
+  snapshotClosedPolicyRecord,
+  snapshotClosedRecord,
+  snapshotExactClosedRecord
+} from "../../data-boundary/closed-values.ts";
+import { isNonEmptyString, isPositiveSafeInteger } from "../../data-boundary/value-shapes.ts";
+import type {
+  AfterCommand,
+  CommandEnvironmentResolver,
+  ResolvedCommandCheckOptions
+} from "./contract.ts";
+
+const COMMAND_INPUT_OPTIONAL_KEYS = [
+  "admissionPriority",
+  "afterCommand",
+  "arguments",
+  "checks",
+  "dependsOn",
+  "enabledByFlags",
+  "environment",
+  "maxParallel",
+  "mutex",
+  "observes",
+  "omitQuietPassedRow",
+  "output",
+  "resourceClaims",
+  "resolveEnvironment",
+  "workingDirectory"
+] as const;
+const COMMAND_INPUT_REQUIRED_KEYS = [
+  "checkId",
+  "displayName",
+  "executable",
+  "outputByteLimit",
+  "timeoutMs"
+] as const;
+const RESOLVED_OPTION_KEYS = [
+  "arguments",
+  "environment",
+  "executable",
+  "output",
+  "outputByteLimit",
+  "timeoutMs",
+  "workingDirectory"
+] as const;
+
+/** Snapshots one closed constructor input and materializes every command-owned omission. */
+export function resolveCommandCheckInput(input: unknown):
+  | Readonly<{
+      readonly afterCommand: AfterCommand | undefined;
+      readonly options: ResolvedCommandCheckOptions;
+      readonly resolveEnvironment: CommandEnvironmentResolver | undefined;
+    }>
+  | undefined {
+  const snapshot = snapshotClosedPolicyRecord(input, {
+    optional: COMMAND_INPUT_OPTIONAL_KEYS,
+    required: COMMAND_INPUT_REQUIRED_KEYS
+  });
+  if (snapshot === undefined) return undefined;
+  const afterCommand = resolveAfterCommand(snapshot.afterCommand);
+  const environmentResolver = resolveEnvironmentResolver(snapshot.resolveEnvironment);
+  if (
+    (snapshot.afterCommand !== undefined && afterCommand === undefined) ||
+    (snapshot.resolveEnvironment !== undefined && environmentResolver === undefined) ||
+    (snapshot.environment !== undefined && snapshot.resolveEnvironment !== undefined)
+  ) {
+    return undefined;
+  }
+  const options = resolveCommandOptions(snapshot);
+  return options === undefined
+    ? undefined
+    : Object.freeze({
+        afterCommand,
+        options,
+        resolveEnvironment: environmentResolver
+      });
+}
+
+/** Resolves one callback-produced environment to the same complete closed shape as static input. */
+export function resolveCommandCheckEnvironment(
+  value: unknown
+): ResolvedCommandCheckOptions["environment"] | undefined {
+  if (value === undefined) return undefined;
+  return resolveEnvironment(value);
+}
+
+/** Revalidates the complete resolved shape before execution. */
+export function isValidResolvedCommandCheckOptions(
+  value: unknown
+): value is ResolvedCommandCheckOptions {
+  const options = snapshotExactClosedRecord(value, RESOLVED_OPTION_KEYS);
+  return (
+    options !== undefined &&
+    validCommandText(options.executable) &&
+    validArguments(options.arguments) &&
+    validWorkingDirectory(options.workingDirectory) &&
+    validEnvironment(options.environment) &&
+    validOutput(options.output) &&
+    isPositiveSafeInteger(options.timeoutMs) &&
+    isPositiveSafeInteger(options.outputByteLimit)
+  );
+}
+
+function resolveCommandOptions(
+  input: Readonly<Record<string, unknown>>
+): ResolvedCommandCheckOptions | undefined {
+  if (!isNonEmptyString(input.checkId) || !isNonEmptyString(input.displayName)) return undefined;
+  const options = resolveCommandExecutionOptions(input);
+  if (options === undefined) return undefined;
+  return isValidResolvedCommandCheckOptions(options) ? options : undefined;
+}
+
+function resolveAfterCommand(value: unknown): AfterCommand | undefined {
+  if (value === undefined) return undefined;
+  const afterCommand = snapshotClosedPolicyRecord(value, {
+    optional: ["parseData"],
+    required: ["execute"]
+  });
+  if (afterCommand === undefined || !isAfterCommandExecution(afterCommand.execute))
+    return undefined;
+  if (afterCommand.parseData !== undefined && !isCheckDataParser(afterCommand.parseData)) {
+    return undefined;
+  }
+  return Object.freeze({
+    execute: afterCommand.execute,
+    ...(afterCommand.parseData === undefined ? {} : { parseData: afterCommand.parseData })
+  });
+}
+
+function resolveEnvironmentResolver(value: unknown): CommandEnvironmentResolver | undefined {
+  return isCommandEnvironmentResolver(value) ? value : undefined;
+}
+
+function isAfterCommandExecution(value: unknown): value is AfterCommand["execute"] {
+  return typeof value === "function";
+}
+
+function isCheckDataParser(value: unknown): value is NonNullable<AfterCommand["parseData"]> {
+  return typeof value === "function";
+}
+
+function isCommandEnvironmentResolver(value: unknown): value is CommandEnvironmentResolver {
+  return typeof value === "function";
+}
+
+/** Resolves command-owned execution fields after the ordinary Check identity is known valid. */
+function resolveCommandExecutionOptions(
+  input: Readonly<Record<string, unknown>>
+): ResolvedCommandCheckOptions | undefined {
+  const argumentsSnapshot = resolveArguments(input.arguments);
+  const environment = resolveEnvironment(input.environment);
+  const output = resolveOutput(input.output);
+  const workingDirectory = resolveWorkingDirectory(input.workingDirectory);
+  if (
+    !validCommandText(input.executable) ||
+    argumentsSnapshot === undefined ||
+    environment === undefined ||
+    output === undefined ||
+    workingDirectory === undefined ||
+    !isPositiveSafeInteger(input.timeoutMs) ||
+    !isPositiveSafeInteger(input.outputByteLimit)
+  ) {
+    return undefined;
+  }
+  return Object.freeze({
+    arguments: argumentsSnapshot,
+    environment,
+    executable: input.executable,
+    output,
+    outputByteLimit: input.outputByteLimit,
+    timeoutMs: input.timeoutMs,
+    workingDirectory
+  });
+}
+
+function resolveArguments(value: unknown): readonly string[] | undefined {
+  if (value === undefined) return Object.freeze([]);
+  const argumentsSnapshot = snapshotClosedArray(value);
+  if (argumentsSnapshot === undefined) return undefined;
+  const argumentsCopy: string[] = [];
+  for (const argument of argumentsSnapshot) {
+    if (!validArgument(argument)) return undefined;
+    argumentsCopy.push(argument);
+  }
+  return Object.freeze(argumentsCopy);
+}
+
+function validArguments(value: unknown): boolean {
+  const argumentsSnapshot = snapshotClosedArray(value);
+  return argumentsSnapshot?.every(validArgument) === true;
+}
+
+function validArgument(value: unknown): value is string {
+  return typeof value === "string" && !value.includes("\0");
+}
+
+function resolveWorkingDirectory(value: unknown): string | null | undefined {
+  if (value === undefined) return null;
+  return validCommandText(value) ? value : undefined;
+}
+
+function validWorkingDirectory(value: unknown): value is string | null {
+  return value === null || validCommandText(value);
+}
+
+function validCommandText(value: unknown): value is string {
+  return isNonEmptyString(value) && !value.includes("\0");
+}
+
+function resolveEnvironment(
+  value: unknown
+): ResolvedCommandCheckOptions["environment"] | undefined {
+  if (value === undefined) return Object.freeze({ mode: "exact", variables: Object.freeze({}) });
+  const environment = snapshotClosedRecord(value);
+  if (environment === undefined || typeof environment.mode !== "string") return undefined;
+  if (environment.mode === "exact") return resolveExactEnvironment(environment);
+  if (environment.mode === "inherit") return resolveInheritedEnvironment(environment);
+  return undefined;
+}
+
+function resolveExactEnvironment(
+  environment: Readonly<Record<string, unknown>>
+): ResolvedCommandCheckOptions["environment"] | undefined {
+  const exact = snapshotClosedPolicyRecord(environment, {
+    optional: ["variables"],
+    required: ["mode"]
+  });
+  if (exact === undefined) return undefined;
+  const variables = Object.hasOwn(exact, "variables")
+    ? resolveExactVariables(exact.variables)
+    : Object.freeze({});
+  if (variables === undefined) return undefined;
+  return Object.freeze({ mode: "exact", variables });
+}
+
+function resolveInheritedEnvironment(
+  environment: Readonly<Record<string, unknown>>
+): ResolvedCommandCheckOptions["environment"] | undefined {
+  const inherited = snapshotClosedPolicyRecord(environment, {
+    optional: ["overrides"],
+    required: ["mode"]
+  });
+  if (inherited === undefined) return undefined;
+  const overrides = Object.hasOwn(inherited, "overrides")
+    ? resolveOverrides(inherited.overrides)
+    : Object.freeze({});
+  if (overrides === undefined) return undefined;
+  return Object.freeze({ mode: "inherit", overrides });
+}
+
+function validEnvironment(value: unknown): boolean {
+  const environment = snapshotClosedRecord(value);
+  if (environment === undefined || typeof environment.mode !== "string") return false;
+  if (environment.mode === "exact") {
+    const exact = snapshotExactClosedRecord(environment, ["mode", "variables"]);
+    return exact !== undefined && validVariableMap(exact.variables, false);
+  }
+  if (environment.mode === "inherit") {
+    const inherited = snapshotExactClosedRecord(environment, ["mode", "overrides"]);
+    return inherited !== undefined && validVariableMap(inherited.overrides, true);
+  }
+  return false;
+}
+
+function resolveExactVariables(value: unknown): Readonly<Record<string, string>> | undefined {
+  const variables = snapshotClosedRecord(value);
+  if (variables === undefined) return undefined;
+  const copied: Record<string, string> = {};
+  for (const [name, variable] of Object.entries(variables)) {
+    if (name.includes("\0") || typeof variable !== "string" || variable.includes("\0"))
+      return undefined;
+    Object.defineProperty(copied, name, {
+      configurable: false,
+      enumerable: true,
+      value: variable,
+      writable: false
+    });
+  }
+  return Object.freeze(copied);
+}
+
+function resolveOverrides(value: unknown): Readonly<Record<string, string | null>> | undefined {
+  const overrides = snapshotClosedRecord(value);
+  if (overrides === undefined) return undefined;
+  const copied: Record<string, string | null> = {};
+  for (const [name, override] of Object.entries(overrides)) {
+    if (
+      name.includes("\0") ||
+      (override !== null && (typeof override !== "string" || override.includes("\0")))
+    ) {
+      return undefined;
+    }
+    Object.defineProperty(copied, name, {
+      configurable: false,
+      enumerable: true,
+      value: override,
+      writable: false
+    });
+  }
+  return Object.freeze(copied);
+}
+
+function validVariableMap(value: unknown, acceptsNull: boolean): boolean {
+  const variables = snapshotClosedRecord(value);
+  return variables !== undefined && validVariableEntries(variables, acceptsNull);
+}
+
+function validVariableEntries(
+  variables: Readonly<Record<string, unknown>>,
+  acceptsNull: boolean
+): boolean {
+  return Object.entries(variables).every(
+    ([name, variable]) =>
+      !name.includes("\0") &&
+      (typeof variable === "string" ? !variable.includes("\0") : acceptsNull && variable === null)
+  );
+}
+
+function resolveOutput(value: unknown): ResolvedCommandCheckOptions["output"] | undefined {
+  if (value === undefined) return Object.freeze({ mode: "discard" });
+  const output = snapshotExactClosedRecord(value, ["mode"]);
+  if (output === undefined) return undefined;
+  if (output.mode !== "discard" && output.mode !== "transcript") return undefined;
+  return Object.freeze({ mode: output.mode });
+}
+
+function validOutput(value: unknown): boolean {
+  const output = snapshotExactClosedRecord(value, ["mode"]);
+  return output !== undefined && (output.mode === "discard" || output.mode === "transcript");
+}

package/src/package-checks/command-check/transcript.ts

@@ -0,0 +1,35 @@
+import { randomUUID } from "node:crypto";
+import { promises as fs } from "node:fs";
+import { join } from "node:path";
+
+const TRANSCRIPT_FILE_NAME = "process.log";
+
+/** Atomically replaces this Check-local fixed transcript without exposing command inputs or native errors. */
+export async function writeCommandTranscript(
+  artifactDirectory: string,
+  contents: string
+): Promise<boolean> {
+  const targetPath = join(artifactDirectory, TRANSCRIPT_FILE_NAME);
+  const temporaryPath = join(artifactDirectory, `.process-${randomUUID()}.tmp`);
+  try {
+    await fs.mkdir(artifactDirectory, { recursive: true });
+    await fs.writeFile(temporaryPath, contents, { encoding: "utf8", flag: "wx" });
+    await fs.rename(temporaryPath, targetPath);
+    return true;
+  } catch {
+    await fs.rm(temporaryPath, { force: true }).catch(() => undefined);
+    return false;
+  }
+}
+
+export function runningTranscript(): string {
+  return "status=running\n";
+}
+
+export function closedTranscript(input: {
+  readonly status: "passed" | "failed" | "unavailable";
+  readonly stderr: string;
+  readonly stdout: string;
+}): string {
+  return `status=${input.status}\nstdout:\n${input.stdout}\nstderr:\n${input.stderr}`;
+}

package/src/package-checks/duplicate-detection/area-policy.ts

@@ -11,13 +11,16 @@ type PathPolicy = Readonly<{
   minimumTokens: number;
 }>;
 
-type AnnotatedFragment = Readonly<{
-  fragment: DuplicateCodeFragment;
-  requiredMinimumLines: number;
-  requiredMinimumTokens: number;
-}>;
+type FragmentAnnotation =
+  | Readonly<{
+      fragment: DuplicateCodeFragment;
+      kind: "comparable";
+      requiredMinimumLines: number;
+      requiredMinimumTokens: number;
+    }>
+  | Readonly<{ kind: "outside-common-area" }>;
 
-/** Restores every matching code area and applies the strictest involved policy. */
+/** Retains fragments whose locations share an area and applies its strictest policy. */
 export function applyDuplicateAreaPolicy(
   fragments: readonly DuplicateCodeFragment[],
   areas: readonly DuplicateDetectionAreaInput[]
@@ -28,6 +31,7 @@ export function applyDuplicateAreaPolicy(
     if (!isValidDuplicateFragment(fragment)) return undefined;
     const annotated = annotateFragment(fragment, policiesByPath);
     if (annotated === undefined) return undefined;
+    if (annotated.kind === "outside-common-area") continue;
     if (
       annotated.fragment.lineCount >= annotated.requiredMinimumLines &&
       annotated.fragment.tokenCount >= annotated.requiredMinimumTokens
@@ -63,9 +67,9 @@ function buildPathPolicies(
 function annotateFragment(
   fragment: DuplicateCodeFragment,
   policiesByPath: ReadonlyMap<string, readonly PathPolicy[]>
-): AnnotatedFragment | undefined {
+): FragmentAnnotation | undefined {
   const locations: DuplicateCodeLocation[] = [];
-  const involvedPolicies: PathPolicy[] = [];
+  let commonPolicies: readonly PathPolicy[] | undefined;
   for (const location of fragment.locations) {
     const pathPolicies = policiesByPath.get(location.path);
     if (pathPolicies === undefined || pathPolicies.length === 0) return undefined;
@@ -76,19 +80,26 @@ function annotateFragment(
         startLine: location.startLine
       })
     );
-    involvedPolicies.push(...pathPolicies);
+    commonPolicies =
+      commonPolicies === undefined
+        ? pathPolicies
+        : commonPolicies.filter((policy) =>
+            pathPolicies.some((candidate) => candidate.codeArea === policy.codeArea)
+          );
   }
-  if (involvedPolicies.length === 0) return undefined;
+  if (commonPolicies === undefined) return undefined;
+  if (commonPolicies.length === 0) return Object.freeze({ kind: "outside-common-area" });
 
   const annotatedFragment = Object.freeze({
     ...fragment,
-    codeAreas: Object.freeze(uniqueSorted(involvedPolicies.map((policy) => policy.codeArea))),
+    codeAreas: Object.freeze(uniqueSorted(commonPolicies.map((policy) => policy.codeArea))),
     locations: Object.freeze(locations)
   });
   return Object.freeze({
     fragment: annotatedFragment,
-    requiredMinimumLines: Math.max(...involvedPolicies.map((policy) => policy.minimumLines)),
-    requiredMinimumTokens: Math.max(...involvedPolicies.map((policy) => policy.minimumTokens))
+    kind: "comparable",
+    requiredMinimumLines: Math.max(...commonPolicies.map((policy) => policy.minimumLines)),
+    requiredMinimumTokens: Math.max(...commonPolicies.map((policy) => policy.minimumTokens))
   });
 }
 

package/src/package-checks/duplicate-detection/cache/identity.ts

@@ -6,7 +6,7 @@ import type {
   DuplicateScannerCacheConfiguration
 } from "./cache-contract.ts";
 
-const RAW_SCAN_CONFIGURATION_VERSION = "3";
+const RAW_SCAN_CONFIGURATION_VERSION = "4";
 
 interface DuplicateScanCacheIdentityInput {
   readonly dependency: ResolvedDuplicateDetectionScannerOptions;

package/src/package-checks/duplicate-detection/default-check.ts

@@ -1,4 +1,8 @@
 import { defineCheck, type TypedCheckWithOptions } from "../../check/check.ts";
+import {
+  resolvePackageCheckAuthoringInput,
+  type PackageCheckIdentityInput
+} from "../check-authoring.ts";
 import { DUPLICATE_DETECTION_CHECK_DEFINITION, executeDuplicateDetection } from "./execution.ts";
 import { parseDuplicateDetectionData } from "./final-data.ts";
 import type { DuplicateDetectionOptions, ResolvedDuplicateDetectionOptions } from "./options.ts";
@@ -9,27 +13,54 @@ import { validResolvedDuplicateDetectionOptions } from "./options-validation.ts"
  * 使用可省略的区域、cache 与 scanner policy 构造一个完整 duplicate-detection Check。
  *
  * @param options - 省略字段由 package 补齐；显式 files 数组作为对应字段的完整替换值。
- * @returns 固定 `duplicate-detection` identity、完整冻结 options、preflight 与 execution。
+ * @returns 固定 `duplicate-detection` identity、完整冻结 options、preparation 与 execution。
  * @throws {TypeError} input 含未知字段、空 area、非法阈值、非法 cache 或 scanner policy 时抛出。
  */
 export function duplicateDetection(
-  options: DuplicateDetectionOptions = {}
+  options?: DuplicateDetectionOptions<"duplicate-detection">
 ): TypedCheckWithOptions<
   "duplicate-detection",
   ResolvedDuplicateDetectionOptions,
   typeof parseDuplicateDetectionData
+>;
+export function duplicateDetection<const Id extends string>(
+  options: DuplicateDetectionOptions<Id> & PackageCheckIdentityInput<Id>
+): TypedCheckWithOptions<Id, ResolvedDuplicateDetectionOptions, typeof parseDuplicateDetectionData>;
+export function duplicateDetection(
+  options: DuplicateDetectionOptions
+): TypedCheckWithOptions<
+  string,
+  ResolvedDuplicateDetectionOptions,
+  typeof parseDuplicateDetectionData
+>;
+export function duplicateDetection(
+  options: DuplicateDetectionOptions = {}
+): TypedCheckWithOptions<
+  string,
+  ResolvedDuplicateDetectionOptions,
+  typeof parseDuplicateDetectionData
 > {
-  const resolvedOptions = resolveDuplicateDetectionOptions(options);
+  const input = resolvePackageCheckAuthoringInput(
+    options,
+    ["codeAreas", "cache", "findingPolicy", "findingWaivers", "scanner"],
+    DUPLICATE_DETECTION_CHECK_DEFINITION
+  );
+  if (input === undefined) {
+    throw new TypeError(
+      "duplicateDetection options are invalid; use the documented closed constructor policy including exact finding waivers"
+    );
+  }
+  const resolvedOptions = resolveDuplicateDetectionOptions(input.domainOptions);
   if (resolvedOptions === undefined) {
     throw new TypeError(
-      "duplicateDetection options are invalid; use the documented closed constructor policy"
+      "duplicateDetection options are invalid; use the documented closed constructor policy including exact finding waivers"
     );
   }
   return defineCheck({
-    ...DUPLICATE_DETECTION_CHECK_DEFINITION,
-    execution: executeDuplicateDetection,
+    ...input.definition,
+    execute: executeDuplicateDetection,
     parseData: parseDuplicateDetectionData,
-    preflight: (preparedOptions) =>
+    prepare: (preparedOptions) =>
       validResolvedDuplicateDetectionOptions(preparedOptions)
         ? { status: "success", preparedOptions }
         : {

package/src/package-checks/duplicate-detection/execution.ts

@@ -1,18 +1,36 @@
 import { resolve } from "node:path";
 
 import type { CheckExecutionContext, CheckResult } from "../../check/check.ts";
+import {
+  reconcileFindingWaivers,
+  type FindingWaiverReconciliation
+} from "../../package-tools/finding-waivers/reconciliation.ts";
 import { collectProjectFileSets, requireProjectFileSet } from "../project-files/collection.ts";
 import { fingerprintProjectFiles } from "../project-files/file-fingerprint.ts";
 import { settleFindings } from "../code-quality-findings/policy.ts";
+import {
+  reportFindingWaiverAudits,
+  reportReconciledCodeQualityFindingRecords
+} from "../code-quality-findings/finding-waiver-evidence.ts";
+import { appendCheckMessages } from "../../package-tools/finding-presentation/finding-presentation.ts";
+import { duplicateFindingMessages, duplicateWaiverMessages } from "./finding-messages.ts";
 import { getGitSha } from "./project-revision.ts";
 import { measureDuplicateDetection, type DuplicateMeasurementResult } from "./measurement.ts";
 import type {
   DuplicateDetectionAreaInput,
   DuplicateDetectionExactInputSet
 } from "./measurement-model.ts";
-import type { ResolvedDuplicateDetectionOptions } from "./options.ts";
+import type {
+  DuplicateDetectionFindingWaiver,
+  ResolvedDuplicateDetectionOptions
+} from "./options.ts";
 import { validResolvedDuplicateDetectionOptions } from "./options-validation.ts";
-import { buildDuplicateRecordCandidates } from "./records.ts";
+import {
+  buildDuplicateRecordCandidates,
+  duplicateDetectionFindingIdentity,
+  duplicateDetectionWaiverAuditRecord,
+  type DuplicateRecordCandidate
+} from "./records.ts";
 import type { DuplicateDetectionFinalData } from "./final-data.ts";
 
 export const DUPLICATE_DETECTION_CHECK_DEFINITION = {
@@ -43,7 +61,7 @@ export async function executeDuplicateDetection(
     return unavailable("source-unavailable");
   }
   if (exactInput.approvedExactPaths.length < 2) {
-    return Object.freeze({ status: "not-applicable", reason: { code: "no-eligible-input" } });
+    return noEligibleDuplicateInputResult(context);
   }
   const measurement = await measureDuplicateDetection({
     cache: context.options.cache,
@@ -56,11 +74,52 @@ export async function executeDuplicateDetection(
     context.options.codeAreas
   );
   if (candidates === undefined) return unavailable("external-result-invalid");
-  for (const candidate of candidates) {
-    context.records.report({ id: candidate.id }, candidate.data);
-  }
-  return settleFindings(
-    candidates.map((candidate) => ({ actionable: true, blocking: candidate.data.blocking }))
+  const reconciliation = reconcileDuplicateFindingWaivers(
+    candidates,
+    context.options.findingWaivers
+  );
+  reportReconciledCodeQualityFindingRecords(context, reconciliation);
+  reportFindingWaiverAudits(context, reconciliation, duplicateDetectionWaiverAuditRecord);
+  return settleDuplicateFindings(reconciliation);
+}
+
+function noEligibleDuplicateInputResult(
+  context: CheckExecutionContext<ResolvedDuplicateDetectionOptions>
+): CheckResult<DuplicateDetectionFinalData> {
+  const reconciliation = reconcileDuplicateFindingWaivers([], context.options.findingWaivers);
+  reportFindingWaiverAudits(context, reconciliation, duplicateDetectionWaiverAuditRecord);
+  return appendCheckMessages(
+    Object.freeze({ status: "not-applicable", reason: { code: "no-eligible-input" } }),
+    duplicateWaiverMessages(reconciliation)
+  );
+}
+
+function reconcileDuplicateFindingWaivers(
+  candidates: readonly DuplicateRecordCandidate[],
+  waivers: readonly DuplicateDetectionFindingWaiver[]
+): FindingWaiverReconciliation<DuplicateRecordCandidate> {
+  return reconcileFindingWaivers({
+    findings: candidates,
+    identify: duplicateDetectionFindingIdentity,
+    waivers
+  });
+}
+
+function settleDuplicateFindings(
+  reconciliation: FindingWaiverReconciliation<DuplicateRecordCandidate>
+): CheckResult<DuplicateDetectionFinalData> {
+  const settlement = settleFindings(
+    reconciliation.findings.map((finding) => ({
+      actionable: finding.disposition !== "waived",
+      blocking: finding.finding.data.blocking
+    }))
+  );
+  const actionableCandidates = reconciliation.findings
+    .filter(({ disposition }) => disposition !== "waived")
+    .map(({ finding }) => finding);
+  return appendCheckMessages(
+    appendCheckMessages(settlement, duplicateFindingMessages(actionableCandidates)),
+    duplicateWaiverMessages(reconciliation)
   );
 }
 
@@ -88,7 +147,6 @@ function collectAreaInputs(
   rootDir: string,
   codeAreas: ResolvedDuplicateDetectionOptions["codeAreas"]
 ): readonly DuplicateDetectionAreaInput[] {
-  const areas: DuplicateDetectionAreaInput[] = [];
   const orderedPolicies = Object.entries(codeAreas).sort(([left], [right]) =>
     compareText(left, right)
   );
@@ -96,19 +154,21 @@ function collectAreaInputs(
     rootDir,
     Object.fromEntries(orderedPolicies.map(([areaId, policy]) => [areaId, policy.files]))
   );
-  for (const [codeArea, policy] of orderedPolicies) {
-    const approvedExactPaths = requireProjectFileSet(filesByArea, codeArea);
-    if (approvedExactPaths.length === 0) continue;
-    areas.push(
-      Object.freeze({
-        approvedExactPaths: Object.freeze(approvedExactPaths),
-        codeArea,
-        minimumLines: policy.minimumLines,
-        minimumTokens: policy.minimumTokens
-      })
-    );
-  }
-  return Object.freeze(areas);
+  return Object.freeze(
+    orderedPolicies.flatMap(([codeArea, policy]) => {
+      const approvedExactPaths = requireProjectFileSet(filesByArea, codeArea);
+      return approvedExactPaths.length === 0
+        ? []
+        : [
+            Object.freeze({
+              approvedExactPaths: Object.freeze(approvedExactPaths),
+              codeArea,
+              minimumLines: policy.minimumLines,
+              minimumTokens: policy.minimumTokens
+            })
+          ];
+    })
+  );
 }
 
 function uniqueSorted(values: readonly string[]): string[] {
@@ -134,8 +194,6 @@ function directMeasurementFailure(
     case "unavailable":
       return unavailable("external-dependency-unavailable");
   }
-  const exhaustiveMeasurement: never = measurement;
-  return exhaustiveMeasurement;
 }
 
 function unavailable(