argus-reviewer-e2e 0.3.0 → 0.4.0

package/dist/report/manifest.d.ts

@@ -32,6 +32,14 @@ export interface BudgetSummary {
     maxTasks: number | undefined;
     tasks: number;
 }
+export interface CacheSummary {
+    hits: number;
+    misses: number;
+    heals: number;
+    staleEntries: number;
+    assertionHits: number;
+    assertionMisses: number;
+}
 export interface LaneManifest {
     lane: LaneId;
     selected: boolean;
@@ -45,6 +53,8 @@ export interface LaneManifest {
     usage: UsageSummary;
     budget: BudgetSummary;
     headBinding: HeadBinding | undefined;
+    /** Flow-lane replay economics — defined only when the lane produced a run.json. */
+    cache: CacheSummary | undefined;
 }
 export interface RunIdentity {
     repo: string | undefined;
@@ -52,6 +62,15 @@ export interface RunIdentity {
     intendedHeadSha: string | undefined;
     checkoutSha: string | undefined;
     baseSha: string | undefined;
+    /**
+     * Run-scoped nonce (GITHUB_RUN_ID) — not knowable when a commit or a
+     * planted file is authored, so residue and plants fail the post step's
+     * freshness gate even when their head sha happens to match. A freshness
+     * marker, not a secret: it is public once the run exists. RUN_ATTEMPT is
+     * deliberately excluded — a re-run of failed jobs would otherwise
+     * invalidate evidence the same run produced. Undefined for local runs.
+     */
+    runNonce: string | undefined;
 }
 export interface RunManifest {
     schemaVersion: typeof MANIFEST_SCHEMA_VERSION;
@@ -85,3 +104,13 @@ export declare function aggregateLanes(lanes: Record<LaneId, LaneManifest>): {
     tokens: number;
 };
 export declare function addProviderUsage(usage: UsageSummary, calls: CallCost[] | undefined): UsageSummary;
+/** Run manifests are archived under `<reportDir>/manifests/<runId>.json`. */
+export declare const MANIFEST_HISTORY_DIR = "manifests";
+/**
+ * Archive a completed verify manifest into local history and prune to the
+ * retention bound — the dashboard/TUI run list reads this directory.
+ * runIds are timestamp-prefixed, so name sort is chronological; pruning
+ * drops the oldest names beyond `keep`. `keep <= 0` writes nothing and
+ * clears nothing existing (retention governs new archives, not deletes).
+ */
+export declare function archiveManifest(reportDir: string, manifest: RunManifest, keep: number): Promise<void>;

package/dist/report/manifest.js

@@ -1,4 +1,7 @@
+import { readdir, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
 import { defaultExec } from '../detect.js';
+import { writeAtomicJson } from '../fsutil.js';
 export const LANE_IDS = ['review', 'flow', 'app', 'a0'];
 export const LANE_STATUSES = [
     'passed',
@@ -102,6 +105,7 @@ export function emptyLane(lane, selected) {
         usage: emptyUsage(),
         budget: emptyBudget(),
         headBinding: undefined,
+        cache: undefined,
     };
 }
 export function aggregateLanes(lanes) {
@@ -141,3 +145,36 @@ export function addProviderUsage(usage, calls) {
         metered: true,
     };
 }
+/** Run manifests are archived under `<reportDir>/manifests/<runId>.json`. */
+export const MANIFEST_HISTORY_DIR = 'manifests';
+/**
+ * Archive a completed verify manifest into local history and prune to the
+ * retention bound — the dashboard/TUI run list reads this directory.
+ * runIds are timestamp-prefixed, so name sort is chronological; pruning
+ * drops the oldest names beyond `keep`. `keep <= 0` writes nothing and
+ * clears nothing existing (retention governs new archives, not deletes).
+ */
+export async function archiveManifest(reportDir, manifest, keep) {
+    if (keep <= 0)
+        return;
+    const dir = join(reportDir, MANIFEST_HISTORY_DIR);
+    // runId becomes a filename — never trust it as a path component.
+    const safeName = manifest.runId.replace(/[^\w.-]/g, '-');
+    await writeAtomicJson(join(dir, `${safeName}.json`), manifest);
+    let names;
+    try {
+        names = (await readdir(dir)).filter((n) => n.endsWith('.json')).sort();
+    }
+    catch {
+        return;
+    }
+    const excess = names.length - keep;
+    for (const name of names.slice(0, Math.max(0, excess))) {
+        try {
+            await unlink(join(dir, name));
+        }
+        catch {
+            // already gone — pruning is best-effort
+        }
+    }
+}

package/dist/report/run.d.ts

@@ -1,4 +1,6 @@
 import type { HealEvent, TdAssertRecord, TdStepRecord } from '../api.js';
+import type { PageCapture } from '../driver/browser.js';
+import type { ExploreStopReason } from '../engine/explore.js';
 import type { CacheStats } from '../engine/loop.js';
 import type { CallCost } from '../vision/cost.js';
 /**
@@ -25,6 +27,13 @@ export interface TestReport {
     cache?: CacheStats;
     /** Agent Zero's autonomous second opinion on a failure (heal: 'a0'). */
     a0Diagnosis?: string;
+    /**
+     * Exploratory captures from this file's browser session (U4a):
+     * console errors, page errors, and failed same-origin requests observed
+     * while the tests ran. `observed` findings — never verdict-changing.
+     * Present only when explore.enabled and anomalies occurred.
+     */
+    captures?: PageCapture[];
 }
 export interface RunTotals {
     tests: number;
@@ -32,6 +41,8 @@ export interface RunTotals {
     failed: number;
     visionCalls: number;
     visionCostUsd: number;
+    /** Token rollup across per-test calls AND lane-level extraCalls. */
+    visionTokens: number;
     sandboxSeconds: number;
     budgetExceeded: boolean;
     /** OpenRouter spend grouped by model id. */
@@ -51,10 +62,52 @@ export interface RunReport {
     durationMs: number;
     ok: boolean;
     totals: RunTotals;
+    /** Workflow-run nonce (GITHUB_RUN_ID) — freshness binding for post steps. */
+    runNonce?: string;
     tests: TestReport[];
     artifacts: {
         videos: string[];
     };
+    /**
+     * Exploratory-lane summary (U4). Present only when `explore.enabled` —
+     * the comment renders an Exploratory section for it. `skipped` carries an
+     * explicit reason when the lane was on but could not observe anything
+     * (e.g. the target URL was unreachable), so a silent no-op is impossible.
+     * `steps`/`visited`/`stopReason`/`visionCalls`/`visionCostUsd`/`captures`
+     * describe the bounded free-explore act pass (U4b) when it ran; they are
+     * `observed` evidence, never verdict-changing.
+     */
+    explore?: {
+        enabled: boolean;
+        skipped?: string;
+        steps?: number;
+        visited?: number;
+        stopReason?: ExploreStopReason;
+        visionCalls?: number;
+        visionCostUsd?: number;
+        captures?: PageCapture[];
+        /** Video of the explore session itself (also in `artifacts.videos`). */
+        videoPath?: string;
+    };
 }
-export declare function buildRunReport(tests: TestReport[], startedAt: Date, durationMs: number): RunReport;
+export declare function buildRunReport(tests: TestReport[], startedAt: Date, durationMs: number, 
+/**
+ * Model calls outside the per-test sessions (the explore act pass bills
+ * its own ledger). Folded into the run totals so `run.json` spend is
+ * complete even though no TestReport owns these calls.
+ */
+extraCalls?: CallCost[], 
+/**
+ * An explore lane that actually ran makes a zero-test run a legitimate
+ * shape — the act pass is the evidence source for repos with no recorded
+ * flows. A configured-but-skipped/errored pass is not evidence: the run
+ * fails closed instead of reading a silent no-op as green.
+ */
+exploreEvidence?: boolean, 
+/**
+ * Workflow-run nonce (GITHUB_RUN_ID). The run manifests bind evidence to
+ * a run via `identity.runNonce`; run.json carries the same stamp so the
+ * serialized-verdict fallback in the post step is bound too.
+ */
+runNonce?: string): RunReport;
 export declare function writeRunReport(path: string, report: RunReport): Promise<void>;

package/dist/report/run.js

@@ -1,25 +1,49 @@
 import { writeAtomicJson } from '../fsutil.js';
-export function buildRunReport(tests, startedAt, durationMs) {
+export function buildRunReport(tests, startedAt, durationMs, 
+/**
+ * Model calls outside the per-test sessions (the explore act pass bills
+ * its own ledger). Folded into the run totals so `run.json` spend is
+ * complete even though no TestReport owns these calls.
+ */
+extraCalls = [], 
+/**
+ * An explore lane that actually ran makes a zero-test run a legitimate
+ * shape — the act pass is the evidence source for repos with no recorded
+ * flows. A configured-but-skipped/errored pass is not evidence: the run
+ * fails closed instead of reading a silent no-op as green.
+ */
+exploreEvidence = false, 
+/**
+ * Workflow-run nonce (GITHUB_RUN_ID). The run manifests bind evidence to
+ * a run via `identity.runNonce`; run.json carries the same stamp so the
+ * serialized-verdict fallback in the post step is bound too.
+ */
+runNonce) {
     const failed = tests.filter((t) => !t.ok).length;
     const callsByModel = {};
     const costByModel = {};
-    for (const t of tests) {
-        for (const c of t.calls) {
-            callsByModel[c.model] = (callsByModel[c.model] ?? 0) + 1;
-            costByModel[c.model] = (costByModel[c.model] ?? 0) + c.costUsd;
-        }
+    for (const c of [...tests.flatMap((t) => t.calls), ...extraCalls]) {
+        callsByModel[c.model] = (callsByModel[c.model] ?? 0) + 1;
+        costByModel[c.model] = (costByModel[c.model] ?? 0) + c.costUsd;
     }
+    const extraVisionCost = extraCalls.reduce((s, c) => s + c.costUsd, 0);
+    const visionTokens = [...tests.flatMap((t) => t.calls), ...extraCalls].reduce((s, c) => s + c.tokens, 0);
     return {
         tool: 'argus-reviewer',
         startedAt: startedAt.toISOString(),
         durationMs,
-        ok: failed === 0,
+        // Zero executed tests is not a pass — an empty suite produces no evidence,
+        // so the report fails closed rather than letting a misconfigured testsDir
+        // or a non-matching pattern read as green. A completed explore pass is
+        // the exception: its observation is the evidence.
+        ok: (tests.length > 0 || exploreEvidence) && failed === 0,
         totals: {
             tests: tests.length,
             passed: tests.length - failed,
             failed,
-            visionCalls: tests.reduce((sum, t) => sum + t.visionCalls, 0),
-            visionCostUsd: tests.reduce((sum, t) => sum + t.visionCostUsd, 0),
+            visionCalls: tests.reduce((sum, t) => sum + t.visionCalls, 0) + extraCalls.length,
+            visionCostUsd: tests.reduce((sum, t) => sum + t.visionCostUsd, 0) + extraVisionCost,
+            visionTokens,
             sandboxSeconds: tests.reduce((sum, t) => sum + t.sandboxSeconds, 0),
             budgetExceeded: tests.some((t) => t.budgetExceeded),
             callsByModel,
@@ -32,6 +56,7 @@ export function buildRunReport(tests, startedAt, durationMs) {
             assertionMisses: tests.reduce((sum, t) => sum + (t.cache?.assertionMisses ?? 0), 0),
         },
         tests,
+        ...(runNonce !== undefined ? { runNonce } : {}),
         artifacts: {
             videos: tests.map((t) => t.videoPath).filter((p) => p !== undefined),
         },

package/dist/report/viewmodel.d.ts

@@ -0,0 +1,91 @@
+import { type BudgetSummary, type CacheSummary, type HeadBinding, type LaneId, type LaneManifest, type LaneStatus, type RunManifest, type UsageSummary } from './manifest.js';
+/**
+ * Manifest → view model. One contract for the three evidence surfaces —
+ * sticky PR comment, TUI, and Electron dashboard — so lane names, status
+ * labels, model/cost fields, and head identity agree by construction, not
+ * by convention (R15, AE-C).
+ *
+ * Everything here is a pure function over an already-parsed RunManifest:
+ * no fs, no fetch — the collector owns reading, this owns shaping.
+ */
+/** One display label per status — surfaces may color it, never rename it. */
+export declare const LANE_STATUS_LABEL: Record<LaneStatus, string>;
+/** Status glyph per lane status; no two statuses share one. */
+export declare const STATUS_GLYPH: Record<LaneStatus, string>;
+/** Proof strength, weakest to strongest (A4 ladder). */
+export declare const PROOF_LEVELS: readonly ["suspected", "corroborated", "exercised", "reproduced"];
+export type ProofLevel = (typeof PROOF_LEVELS)[number];
+/**
+ * Four-notch meter: one filled notch per ladder step reached. Any other
+ * value (an evidence status outside the ladder, a missing level) is the
+ * empty meter, so a renderer never throws on unexpected input.
+ */
+export declare function proofMeter(level: string | undefined): string;
+/** Finding severities as the review pipeline emits them (`q` is a question). */
+export declare const SEVERITIES: readonly ["bug", "risk", "nit", "q"];
+export type Severity = (typeof SEVERITIES)[number];
+/** Geometric, shape-only severity glyphs (A5). */
+export declare const SEVERITY_GLYPH: Record<Severity, string>;
+export declare const SEVERITY_LABEL: Record<Severity, string>;
+/** Review verdicts as the synthesis step emits them. */
+export declare const VERDICTS: readonly ["approve", "needs_changes", "pass"];
+export type Verdict = (typeof VERDICTS)[number];
+/** Verdicts reuse status glyphs, so there is no third vocabulary. */
+export declare const VERDICT_STATUS: Record<Verdict, LaneStatus>;
+export declare const VERDICT_LABEL: Record<Verdict, string>;
+export declare function verdictGlyph(verdict: Verdict): string;
+export interface LaneView {
+    lane: LaneId;
+    selected: boolean;
+    status: LaneStatus;
+    statusLabel: string;
+    statusIcon: string;
+    summary: string | undefined;
+    reason: string | undefined;
+    reportPath: string | undefined;
+    model: string | undefined;
+    usage: UsageSummary;
+    budget: BudgetSummary;
+    cache: CacheSummary | undefined;
+    headBinding: HeadBinding | undefined;
+    startedAt: string | undefined;
+    finishedAt: string | undefined;
+    durationMs: number | undefined;
+}
+export interface RunView {
+    runId: string;
+    schemaVersion: number;
+    startedAt: string;
+    finishedAt: string;
+    status: LaneStatus;
+    statusLabel: string;
+    statusIcon: string;
+    ok: boolean;
+    costUsd: number;
+    calls: number;
+    tokens: number;
+    repo: string | undefined;
+    pr: string | undefined;
+    intendedHeadSha: string | undefined;
+    checkoutSha: string | undefined;
+    /** Review lane's head binding — the run-level binding contract. */
+    headBinding: HeadBinding | undefined;
+    /** All lanes in LANE_IDS order — selection state included. */
+    lanes: LaneView[];
+    /** Only the lanes that ran or were asked to — the matrix surfaces show. */
+    selectedLanes: LaneView[];
+}
+export declare function laneView(lane: LaneManifest): LaneView;
+export declare function manifestToRunView(manifest: RunManifest): RunView;
+/** Structural validation — a manifest the view-model can trust enough to render. */
+export declare function isRunManifest(value: unknown): value is RunManifest;
+/**
+ * One lane record the view-model can render. Exported so a surface that
+ * degrades per lane (the HTML report) applies the same check as the whole-
+ * manifest guard.
+ */
+export declare function isLaneManifest(value: unknown, id: LaneId): value is LaneManifest;
+export declare function maskSecrets(s: string): string;
+export declare function formatUsd(n: number | undefined): string;
+export declare function formatDuration(ms: number | undefined): string;
+export declare function shortSha(sha: string | undefined): string | undefined;

package/dist/report/viewmodel.js

@@ -0,0 +1,241 @@
+import { LANE_IDS, LANE_STATUSES, } from './manifest.js';
+/**
+ * Manifest → view model. One contract for the three evidence surfaces —
+ * sticky PR comment, TUI, and Electron dashboard — so lane names, status
+ * labels, model/cost fields, and head identity agree by construction, not
+ * by convention (R15, AE-C).
+ *
+ * Everything here is a pure function over an already-parsed RunManifest:
+ * no fs, no fetch — the collector owns reading, this owns shaping.
+ */
+/** One display label per status — surfaces may color it, never rename it. */
+export const LANE_STATUS_LABEL = {
+    passed: 'passed',
+    failed: 'failed',
+    skipped: 'skipped',
+    blocked: 'blocked',
+    unavailable: 'unavailable',
+    inconclusive: 'inconclusive',
+};
+/*
+ * Ocellus vocabulary (DESIGN.md section 6.7, A4, A5). Text surfaces use these
+ * glyphs: each is a single-cell, text-presentation code point, never emoji.
+ * A status is always shown as glyph plus its LANE_STATUS_LABEL word.
+ * `action/sticky-comment.cjs` keeps its own copy, guarded by parity tests.
+ */
+/** Status glyph per lane status; no two statuses share one. */
+export const STATUS_GLYPH = {
+    passed: '●',
+    failed: '⊘',
+    skipped: '–',
+    blocked: '⊖',
+    unavailable: '◌',
+    inconclusive: '◐',
+};
+/** Proof strength, weakest to strongest (A4 ladder). */
+export const PROOF_LEVELS = ['suspected', 'corroborated', 'exercised', 'reproduced'];
+const PROOF_NOTCH_FILLED = '▰';
+const PROOF_NOTCH_EMPTY = '▱';
+/**
+ * Four-notch meter: one filled notch per ladder step reached. Any other
+ * value (an evidence status outside the ladder, a missing level) is the
+ * empty meter, so a renderer never throws on unexpected input.
+ */
+export function proofMeter(level) {
+    const filled = PROOF_LEVELS.indexOf(level ?? '') + 1;
+    return PROOF_NOTCH_FILLED.repeat(filled) + PROOF_NOTCH_EMPTY.repeat(PROOF_LEVELS.length - filled);
+}
+/** Finding severities as the review pipeline emits them (`q` is a question). */
+export const SEVERITIES = ['bug', 'risk', 'nit', 'q'];
+/** Geometric, shape-only severity glyphs (A5). */
+export const SEVERITY_GLYPH = {
+    bug: '◆',
+    risk: '◈',
+    nit: '○',
+    q: '□',
+};
+export const SEVERITY_LABEL = {
+    bug: 'bug',
+    risk: 'risk',
+    nit: 'nit',
+    q: 'question',
+};
+/** Review verdicts as the synthesis step emits them. */
+export const VERDICTS = ['approve', 'needs_changes', 'pass'];
+/** Verdicts reuse status glyphs, so there is no third vocabulary. */
+export const VERDICT_STATUS = {
+    approve: 'passed',
+    needs_changes: 'failed',
+    pass: 'passed',
+};
+export const VERDICT_LABEL = {
+    approve: 'approve',
+    needs_changes: 'needs changes',
+    pass: 'clean',
+};
+export function verdictGlyph(verdict) {
+    return STATUS_GLYPH[VERDICT_STATUS[verdict]];
+}
+function laneDurationMs(lane) {
+    if (lane.startedAt === undefined || lane.finishedAt === undefined)
+        return undefined;
+    const ms = Date.parse(lane.finishedAt) - Date.parse(lane.startedAt);
+    return Number.isFinite(ms) && ms >= 0 ? ms : undefined;
+}
+export function laneView(lane) {
+    return {
+        lane: lane.lane,
+        selected: lane.selected,
+        status: lane.status,
+        statusLabel: LANE_STATUS_LABEL[lane.status],
+        statusIcon: STATUS_GLYPH[lane.status],
+        summary: lane.summary,
+        reason: lane.reason,
+        reportPath: lane.reportPath,
+        model: lane.model ?? lane.usage?.model,
+        usage: lane.usage,
+        budget: lane.budget,
+        cache: lane.cache,
+        headBinding: lane.headBinding,
+        startedAt: lane.startedAt,
+        finishedAt: lane.finishedAt,
+        durationMs: laneDurationMs(lane),
+    };
+}
+export function manifestToRunView(manifest) {
+    const lanes = LANE_IDS.map((id) => laneView(manifest.lanes[id]));
+    return {
+        runId: manifest.runId,
+        schemaVersion: manifest.schemaVersion,
+        startedAt: manifest.startedAt,
+        finishedAt: manifest.finishedAt,
+        status: manifest.aggregate.status,
+        statusLabel: LANE_STATUS_LABEL[manifest.aggregate.status],
+        statusIcon: STATUS_GLYPH[manifest.aggregate.status],
+        ok: manifest.aggregate.ok,
+        costUsd: manifest.aggregate.costUsd,
+        calls: manifest.aggregate.calls,
+        tokens: manifest.aggregate.tokens,
+        repo: manifest.identity.repo,
+        pr: manifest.identity.pr,
+        intendedHeadSha: manifest.identity.intendedHeadSha,
+        checkoutSha: manifest.identity.checkoutSha,
+        headBinding: manifest.lanes.review.headBinding,
+        lanes,
+        selectedLanes: lanes.filter((lane) => lane.selected),
+    };
+}
+/** Structural validation — a manifest the view-model can trust enough to render. */
+export function isRunManifest(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const m = value;
+    if (m.schemaVersion !== 1)
+        return false;
+    if (typeof m.runId !== 'string' || typeof m.startedAt !== 'string')
+        return false;
+    if (m.identity === undefined ||
+        typeof m.identity !== 'object' ||
+        m.identity === null ||
+        Array.isArray(m.identity)) {
+        return false;
+    }
+    for (const v of [
+        m.identity.repo,
+        m.identity.pr,
+        m.identity.intendedHeadSha,
+        m.identity.checkoutSha,
+        m.identity.baseSha,
+        m.identity.runNonce,
+    ]) {
+        if (v !== undefined && typeof v !== 'string')
+            return false;
+    }
+    const aggregate = m.aggregate;
+    if (aggregate === undefined || aggregate === null || typeof aggregate !== 'object') {
+        return false;
+    }
+    // aggregate.status feeds LANE_STATUS_LABEL lookups and ok the verdict —
+    // a type-confused aggregate must degrade to last-valid, not reach a
+    // renderer that throws mid-post.
+    if (typeof aggregate.status !== 'string')
+        return false;
+    if (!LANE_STATUSES.includes(aggregate.status))
+        return false;
+    if (typeof aggregate.ok !== 'boolean')
+        return false;
+    for (const n of [aggregate.calls, aggregate.tokens, aggregate.costUsd]) {
+        if (typeof n !== 'number' || !Number.isFinite(n))
+            return false;
+    }
+    if (m.lanes === undefined || m.lanes === null || typeof m.lanes !== 'object')
+        return false;
+    return LANE_IDS.every((id) => isLaneManifest(m.lanes[id], id));
+}
+/**
+ * One lane record the view-model can render. Exported so a surface that
+ * degrades per lane (the HTML report) applies the same check as the whole-
+ * manifest guard.
+ */
+export function isLaneManifest(value, id) {
+    if (value === undefined || value === null || typeof value !== 'object')
+        return false;
+    const lane = value;
+    if (lane.lane !== id || typeof lane.status !== 'string')
+        return false;
+    if (!LANE_STATUSES.includes(lane.status))
+        return false;
+    if (typeof lane.selected !== 'boolean')
+        return false;
+    // usage/budget are dereferenced by laneView — a guard that certifies a
+    // shape it doesn't check is a lying guard. `typeof null === 'object'`,
+    // so a null here must be rejected before the field reads, not crash
+    // inside the guard.
+    if (lane.usage === null || lane.usage === undefined || typeof lane.usage !== 'object') {
+        return false;
+    }
+    for (const n of [lane.usage.calls, lane.usage.tokens, lane.usage.costUsd]) {
+        if (typeof n !== 'number' || !Number.isFinite(n))
+            return false;
+    }
+    if (lane.budget === null || lane.budget === undefined || typeof lane.budget !== 'object') {
+        return false;
+    }
+    return true;
+}
+/**
+ * Evidence strings pass through a secret-shaped-token mask before render —
+ * a lane summary that captured a credential must not re-emit it onto a PR
+ * comment or dashboard (R16's sanitized-evidence surface).
+ */
+const SECRET_PATTERNS = [
+    /sk-or-[A-Za-z0-9_-]{4,}/g,
+    /sk-[A-Za-z0-9_-]{8,}/g,
+    /gh[pousr]_[A-Za-z0-9_]{8,}/g,
+    /github_pat_[A-Za-z0-9_]{8,}/g,
+    /xox[baprs]-[A-Za-z0-9-]{8,}/g,
+    /AKIA[A-Z0-9]{16}/g,
+    /npm_[A-Za-z0-9]{8,}/g,
+    /Bearer\s+[A-Za-z0-9._~+/=-]{10,}/gi,
+    /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,}/g,
+    /:\/\/[^/\s:@]{1,64}:[^/\s:@]{6,}@/g,
+];
+export function maskSecrets(s) {
+    let out = s;
+    for (const re of SECRET_PATTERNS)
+        out = out.replace(re, '•••');
+    return out;
+}
+export function formatUsd(n) {
+    return `$${(n ?? 0).toFixed(6)}`;
+}
+export function formatDuration(ms) {
+    if (ms === undefined || !Number.isFinite(ms))
+        return '–';
+    if (ms < 1000)
+        return `${Math.round(ms)}ms`;
+    return `${(ms / 1000).toFixed(1)}s`;
+}
+export function shortSha(sha) {
+    return sha === undefined || sha === '' ? undefined : sha.slice(0, 7);
+}

package/dist/review/adjudicate.d.ts

@@ -1,12 +1,12 @@
 import { DecisionClient } from '../vision/decisions.js';
 /**
- * U8 finding adjudication — one batched Jev decide() scores each
+ * U8 finding adjudication — one batched confidence-model decide() scores each
  * synthesized finding's true-positive probability before posting. Same
- * posture as the secrets lane: Jev annotates/routes, never gates.
+ * posture as the secrets lane: the confidence model annotates/routes, never gates.
  * `p` lands on the finding record and the sticky confidence column;
  * suppression is scoped to `nit`/`q` severities whose false-positive
  * confidence exceeds `findingThreshold` — `bug`/`risk` are never
- * suppressed, and a Jev outage leaves every finding unadjudicated and
+ * suppressed, and a confidence-model outage leaves every finding unadjudicated and
  * unsuppressed (degrade open).
  *
  * `findingThreshold` is the required P(false positive): a nit/q is
@@ -28,7 +28,7 @@ export interface FindingAdjudicationRecord {
     /** Finding text — capped; suppressed findings keep their message in audit. */
     message: string;
     adjudicated: boolean;
-    /** Jev P(true positive) for this finding. */
+    /** Confidence-model P(true positive) for this finding. */
     p?: number;
     /** nit/q below the FP bar — kept for audit, removed from findings. */
     suppressed?: boolean;
@@ -49,13 +49,13 @@ export interface FindingAdjudicationResult<T extends AdjudicableFinding> extends
 }
 export declare function adjudicateFindings<T extends AdjudicableFinding>(opts: {
     findings: T[];
-    /** PR file patches keyed by filename — Jev state context. */
+    /** PR file patches keyed by filename — confidence-model state context. */
     patchByFile?: Map<string, string>;
     threshold: number;
     /**
      * User-configured blocking severities — a severity listed here drives
      * the verdict, so it must never be suppressed even if it is nit/q
-     * (otherwise Jev suppression could flip the commit-status gate).
+     * (otherwise confidence-model suppression could flip the commit-status gate).
      */
     blockSeverities?: string[];
     client: DecisionClient;

package/dist/review/adjudicate.js

@@ -63,11 +63,11 @@ export async function adjudicateFindings(opts) {
         }
         catch (e) {
             adjudicationFailed = true;
-            debug('adjudicate', `decision call failed — no suppression: ${describeDecisionError(e)}`);
+            debug('adjudicate', `decision call failed – no suppression: ${describeDecisionError(e)}`);
         }
     }
     const blocking = new Set(opts.blockSeverities ?? []);
-    // Only Jev may attach p — a model-emitted p on an unadjudicated
+    // Only the confidence model may attach p — a model-emitted p on an unadjudicated
     // finding is spoofed confidence, so strip it.
     const stripP = (f) => {
         const out = { ...f };