artifact-graph 0.8.3 → 0.8.5

package/dist/cli.js

@@ -316,6 +316,41 @@ var init_glob_matcher = __esm({
   }
 });
 
+// src/file-walker.ts
+import { readdir } from "fs/promises";
+import { join, relative } from "path";
+async function walkFiles(root, current = root, readDirectory = defaultReadDirectory) {
+  let entries;
+  try {
+    entries = await readDirectory(current, { withFileTypes: true });
+  } catch (error) {
+    if (current !== root && error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+  const files = [];
+  for (const entry of entries) {
+    if (entry.name === "node_modules" || entry.name === "dist" || entry.name === ".git" || entry.name === ".artifact-graph") {
+      continue;
+    }
+    const fullPath = join(current, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...await walkFiles(root, fullPath, readDirectory));
+    } else {
+      files.push(relative(root, fullPath).split("\\").join("/"));
+    }
+  }
+  return files;
+}
+var defaultReadDirectory;
+var init_file_walker = __esm({
+  "src/file-walker.ts"() {
+    "use strict";
+    defaultReadDirectory = readdir;
+  }
+});
+
 // src/target-selector.ts
 function parseTargetSelector(value) {
   const separator = value.indexOf(":");
@@ -830,7 +865,7 @@ var init_packet_assembler = __esm({
 
 // src/packet-audit.ts
 import { mkdir, writeFile } from "fs/promises";
-import { join } from "path";
+import { join as join2 } from "path";
 function parseTargetsFile(content, schema) {
   const validTypes = schema ? new Set(getTargetArtifactTypes(schema)) : VALID_TYPES;
   const validTypesLabel = [...validTypes].join(", ");
@@ -921,7 +956,7 @@ async function auditSingleTarget(target, graph, options) {
       const fmt = options.format ?? "markdown";
       const ext = fmt === "json" ? "json" : "md";
       const filename = `${target.type}-${target.id}.packet.${ext}`;
-      const outPath = join(options.outDir, filename);
+      const outPath = join2(options.outDir, filename);
       let content;
       if (fmt === "json") {
         content = JSON.stringify(packet, null, 2) + "\n";
@@ -1001,7 +1036,7 @@ async function auditPackets(root, targets, options, graph) {
     ...isCompact ? { summaryDetail: "compact", countsByType } : {}
   };
   if (options.outDir) {
-    const summaryPath = join(options.outDir, "summary.json");
+    const summaryPath = join2(options.outDir, "summary.json");
     await writeFile(summaryPath, JSON.stringify(summary, null, 2) + "\n", "utf-8");
   }
   return summary;
@@ -1373,7 +1408,7 @@ var init_packet_prompt_validator = __esm({
 import { createHash } from "crypto";
 import { existsSync } from "fs";
 import { mkdir as mkdir2, readFile, writeFile as writeFile2 } from "fs/promises";
-import { dirname, join as join2, relative } from "path";
+import { dirname, join as join3, relative as relative2 } from "path";
 async function buildVersionIndex(root, graph) {
   const scannedGraph = graph ?? await scanArtifacts(root);
   const hashCache = /* @__PURE__ */ new Map();
@@ -1509,7 +1544,7 @@ async function auditVersionLock(root, lockPath = VERSION_LOCK_PATH, graph, confi
   for (const entry of lock.locks) {
     if (entry.kind !== "verifies") continue;
     const sourcePath = entry.source.path;
-    const fullSourcePath = join2(root, sourcePath);
+    const fullSourcePath = join3(root, sourcePath);
     if (!existsSync(fullSourcePath)) continue;
     let liveness = livenessCache.get(sourcePath);
     if (liveness === void 0) {
@@ -1521,6 +1556,7 @@ async function auditVersionLock(root, lockPath = VERSION_LOCK_PATH, graph, confi
         status: "orphan_lock",
         edgeId: entry.edgeId,
         message: `Liveness: ${sourcePath} is not active in any configured runner \u2014 locked verifies edges may reference dead tests`,
+        severity: "warning",
         artifact: entry.artifact,
         source: entry.source
       });
@@ -1603,14 +1639,14 @@ async function auditVersionLock(root, lockPath = VERSION_LOCK_PATH, graph, confi
         currentArtifactHash: targetNode.contentHash
       });
     }
-    if (!existsSync(join2(root, sourceNode.path))) {
+    if (!existsSync(join3(root, sourceNode.path))) {
       entryIssues.push({
         status: "orphan_lock",
         edgeId: relEdgeId,
         message: `Artifact relation source file ${sourceNode.path} no longer exists`
       });
     }
-    if (!existsSync(join2(root, targetNode.path))) {
+    if (!existsSync(join3(root, targetNode.path))) {
       entryIssues.push({
         status: "orphan_lock",
         edgeId: relEdgeId,
@@ -1650,7 +1686,84 @@ async function auditVersionLock(root, lockPath = VERSION_LOCK_PATH, graph, confi
     fresh,
     totalArtifactRelationLocks: artifactRelationLocks.length,
     artifactRelationFresh,
-    issues: sortBy(issues, (issue2) => `${issue2.status}	${issue2.edgeId}	${issue2.verifiedByPath ?? ""}`)
+    issues: sortBy(issues.map(enrichVersionLockIssue), (issue2) => `${issue2.status}	${issue2.edgeId}	${issue2.verifiedByPath ?? ""}`)
+  };
+}
+function isLivenessIssue(issue2) {
+  return issue2.status === "orphan_lock" && issue2.message.startsWith(LIVENESS_MESSAGE_PREFIX);
+}
+function versionLockIssueSeverity(issue2) {
+  if (issue2.severity) {
+    return issue2.severity;
+  }
+  if (issue2.status === "missing_lock") {
+    return "warning";
+  }
+  if (issue2.status === "orphan_lock" && issue2.message.startsWith(LIVENESS_MESSAGE_PREFIX)) {
+    return "warning";
+  }
+  return "error";
+}
+function isVersionLockIssueBlocking(issue2, strictMissingLock) {
+  if (issue2.status === "missing_lock") {
+    return strictMissingLock;
+  }
+  return versionLockIssueSeverity(issue2) === "error";
+}
+function versionLockIssueRemediation(issue2) {
+  switch (issue2.status) {
+    case "artifact_changed":
+      return [
+        "\u786E\u8BA4\u8FD9\u6B21\u5236\u54C1\u53D8\u66F4\uFF08\u5185\u5BB9\u6216\u8DEF\u5F84\uFF09\u662F\u6709\u610F\u7684\u3002",
+        "\u8FD0\u884C `artifact-graph version-lock refresh --changed-only --worktree --format markdown`\uFF08\u65E5\u5E38\u5F00\u53D1\uFF09\u6216 `artifact-graph version-lock refresh --changed-only --staged --format markdown`\uFF08\u63D0\u4EA4\u524D\uFF09\u5237\u65B0\u53D7\u5F71\u54CD\u7684\u9501\u3002",
+        "\u8FD0\u884C `git diff artifacts/traceability-version-lock.json` \u5BA1\u67E5\u9501\u53D8\u66F4\uFF0C\u786E\u8BA4\u540E `git add artifacts/traceability-version-lock.json` \u5E76\u91CD\u65B0\u63D0\u4EA4\u3002"
+      ];
+    case "source_changed":
+      return [
+        "\u786E\u8BA4\u8FD9\u6B21\u6E90\u7801/\u6D4B\u8BD5\u53D8\u66F4\uFF08\u5185\u5BB9\u6216\u8DEF\u5F84\uFF09\u662F\u6709\u610F\u7684\u3002",
+        "\u8FD0\u884C `artifact-graph version-lock refresh --changed-only --worktree --format markdown`\uFF08\u65E5\u5E38\u5F00\u53D1\uFF09\u6216 `artifact-graph version-lock refresh --changed-only --staged --format markdown`\uFF08\u63D0\u4EA4\u524D\uFF09\u5237\u65B0\u53D7\u5F71\u54CD\u7684\u9501\u3002",
+        "\u8FD0\u884C `git diff artifacts/traceability-version-lock.json` \u5BA1\u67E5\u9501\u53D8\u66F4\uFF0C\u786E\u8BA4\u540E `git add artifacts/traceability-version-lock.json` \u5E76\u91CD\u65B0\u63D0\u4EA4\u3002"
+      ];
+    case "verified_by_changed":
+      return [
+        "\u786E\u8BA4\u8FD9\u6B21\u9A8C\u8BC1\u6587\u4EF6\u53D8\u66F4\u662F\u6709\u610F\u7684\u3002",
+        "\u8FD0\u884C `artifact-graph version-lock refresh --changed-only --worktree --format markdown`\uFF08\u65E5\u5E38\u5F00\u53D1\uFF09\u6216 `artifact-graph version-lock refresh --changed-only --staged --format markdown`\uFF08\u63D0\u4EA4\u524D\uFF09\u5237\u65B0\u53D7\u5F71\u54CD\u7684\u9501\u3002",
+        "\u8FD0\u884C `git diff artifacts/traceability-version-lock.json` \u5BA1\u67E5\u9501\u53D8\u66F4\uFF0C\u786E\u8BA4\u540E `git add artifacts/traceability-version-lock.json` \u5E76\u91CD\u65B0\u63D0\u4EA4\u3002"
+      ];
+    case "missing_lock":
+      return [
+        "\u65B0\u589E\u8FFD\u6EAF\u8FB9\u8FD8\u6CA1\u6709\u5BF9\u5E94\u7248\u672C\u9501\uFF1B\u9ED8\u8BA4\u4E0D\u963B\u65AD\uFF0C`--strict-missing-lock` \u4E0B\u4F1A\u963B\u65AD\u3002",
+        "\u8FD0\u884C `artifact-graph version-lock refresh --changed-only --worktree --format markdown` \u4E3A\u53D7\u5F71\u54CD\u8FB9\u8865\u9501\uFF1B\u9996\u6B21\u5EFA\u7ACB\u57FA\u7EBF\u6216\u914D\u7F6E\u53D8\u66F4\u65F6\u7528 `artifact-graph version-lock refresh --all --format markdown`\u3002",
+        "\u8FD0\u884C `git diff artifacts/traceability-version-lock.json` \u5BA1\u67E5\u540E `git add artifacts/traceability-version-lock.json` \u6682\u5B58\u3002"
+      ];
+    case "orphan_lock":
+      if (isLivenessIssue(issue2)) {
+        return [
+          "\u8FD9\u662F liveness \u8B66\u544A\uFF0C\u4E0D\u662F\u6821\u9A8C\u5931\u8D25\uFF1A\u9501\u4ECD\u7136\u4FDD\u7559\uFF0C\u9ED8\u8BA4\u4E0D\u963B\u65AD\u3002",
+          "\u5982\u679C\u6D4B\u8BD5\u5DF2\u5E9F\u5F03\uFF1A\u5220\u9664\u8BE5\u6587\u4EF6\u6216\u79FB\u9664\u5176\u4E2D\u7684\u8FFD\u6EAF\u6CE8\u91CA\uFF0C\u7136\u540E\u8FD0\u884C `artifact-graph version-lock refresh --all --remove-orphans --format markdown` \u6E05\u7406\u5BF9\u5E94\u7684\u9501\u3002",
+          "\u5982\u679C\u6D4B\u8BD5\u4ECD\u7136\u6709\u6548\uFF1A\u628A\u5B83\u52A0\u5165 artifact-graph.config.yaml \u4E2D\u67D0\u4E2A e2e runner \u7684 include\uFF0C\u6216\u68C0\u67E5 exclude/testIgnore \u662F\u5426\u8BEF\u4F24\u3002"
+        ];
+      }
+      return [
+        "\u9501\u5F15\u7528\u7684\u5236\u54C1\u3001\u6E90\u7801\u6216\u8FFD\u6EAF\u8FB9\u5728\u5F53\u524D\u56FE\u4E2D\u5DF2\u4E0D\u5B58\u5728\uFF0C\u5E38\u89C1\u4E8E\u5236\u54C1\u5220\u9664\u6216\u62C6\u5206\u4E4B\u540E\u3002",
+        "\u786E\u8BA4\u5220\u9664\u662F\u6709\u610F\u7684\u540E\uFF0C\u8FD0\u884C `artifact-graph version-lock refresh --all --remove-orphans --format markdown` \u6E05\u7406\u5B64\u7ACB\u9501\u3002",
+        "\u8FD0\u884C `git diff artifacts/traceability-version-lock.json` \u5BA1\u67E5\u88AB\u79FB\u9664\u7684\u9501\u6761\u76EE\uFF0C\u786E\u8BA4\u540E `git add artifacts/traceability-version-lock.json` \u6682\u5B58\u3002",
+        "\u5982\u679C\u5220\u9664\u662F\u8BEF\u64CD\u4F5C\uFF0C\u5148\u6062\u590D\u5BF9\u5E94\u5236\u54C1\u6216\u6E90\u7801\u6587\u4EF6\uFF0C\u518D\u8FD0\u884C\u4E0D\u5E26 `--remove-orphans` \u7684 refresh \u5237\u65B0\u54C8\u5E0C\u3002"
+      ];
+    case "target_not_found":
+      return [
+        "\u68C0\u67E5 `--target` \u7684 `type:id` \u662F\u5426\u62FC\u5199\u6B63\u786E\u3002",
+        "\u5982\u679C\u8BE5\u5236\u54C1\u5DF2\u88AB\u5220\u9664\u6216\u6539\u540D\uFF0C\u6539\u7528\u5F53\u524D\u5B58\u5728\u7684\u5236\u54C1\u6807\u8BC6\u91CD\u8BD5\u3002"
+      ];
+    default:
+      return [];
+  }
+}
+function enrichVersionLockIssue(issue2) {
+  return {
+    ...issue2,
+    severity: versionLockIssueSeverity(issue2),
+    remediation: issue2.remediation ?? versionLockIssueRemediation(issue2)
   };
 }
 async function updateVersionLock(root, options) {
@@ -1948,59 +2061,118 @@ async function traceVersion(root, target, lockPath = VERSION_LOCK_PATH) {
     currentEdges: index.edges.filter((edge2) => edge2.from === targetUid || edge2.to === targetUid),
     locks: lock.locks.filter((entry) => `${entry.artifact.type}:${entry.artifact.id}` === targetUid),
     artifactRelations: targetArtifactRelations,
-    issues: [...targetIssues, ...audit.issues.filter((issue2) => `${issue2.artifact?.type}:${issue2.artifact?.id}` === targetUid || issue2.edgeId.includes(`#${targetUid}`))]
+    issues: [...targetIssues.map(enrichVersionLockIssue), ...audit.issues.filter((issue2) => `${issue2.artifact?.type}:${issue2.artifact?.id}` === targetUid || issue2.edgeId.includes(`#${targetUid}`))]
   };
 }
-function renderVersionLockAuditMarkdown(result) {
+function renderIssueBlockingTag(issue2, strictMissingLock) {
+  return isVersionLockIssueBlocking(issue2, strictMissingLock) ? "\u963B\u65AD" : "\u8B66\u544A";
+}
+function renderIssueBlockingExplanation(issue2, strictMissingLock) {
+  if (!isVersionLockIssueBlocking(issue2, strictMissingLock)) {
+    return "\u5426\uFF08\u4EC5\u63D0\u9192\uFF0C\u4E0D\u963B\u65AD\uFF09";
+  }
+  if (issue2.status === "missing_lock" && versionLockIssueSeverity(issue2) !== "error") {
+    return "\u662F\uFF08\u5DF2\u7531 --strict-missing-lock \u5347\u7EA7\u4E3A\u963B\u65AD\uFF09";
+  }
+  return "\u662F\uFF08\u4F1A\u4F7F\u547D\u4EE4\u4EE5\u975E\u96F6\u9000\u51FA\u7801\u7ED3\u675F\uFF09";
+}
+function appendIssueDetails(lines, issues, strictMissingLock) {
+  issues.forEach((issue2, index) => {
+    const label = VERSION_LOCK_STATUS_LABELS[issue2.status] ?? issue2.status;
+    lines.push(`### ${index + 1}. [${renderIssueBlockingTag(issue2, strictMissingLock)}] ${label}\uFF08\`${issue2.status}\`\uFF09`);
+    lines.push("");
+    lines.push(`- \u8FB9: \`${issue2.edgeId}\``);
+    lines.push(`- \u8BE6\u60C5: ${issue2.message}`);
+    lines.push(`- \u662F\u5426\u963B\u65AD: ${renderIssueBlockingExplanation(issue2, strictMissingLock)}`);
+    const remediation = issue2.remediation ?? [];
+    if (remediation.length > 0) {
+      lines.push("- \u89E3\u51B3\u6B65\u9AA4:");
+      remediation.forEach((step, stepIndex) => {
+        lines.push(`  ${stepIndex + 1}. ${step}`);
+      });
+    }
+    lines.push("");
+  });
+}
+function renderVersionLockAuditMarkdown(result, options = {}) {
+  const strictMissingLock = options.strictMissingLock === true;
+  const blockingCount = result.issues.filter((issue2) => isVersionLockIssueBlocking(issue2, strictMissingLock)).length;
+  const nonBlockingCount = result.issues.length - blockingCount;
   const lines = [
-    "# Version Lock Audit",
+    "# \u7248\u672C\u9501\u5BA1\u8BA1\uFF08version-lock audit\uFF09",
     "",
-    `Root: \`${result.root}\``,
-    `Lock: \`${result.lockPath}\``,
-    `Locks: ${result.totalLocks} | Fresh: ${result.fresh} | Issues: ${result.issues.length}`,
-    `Artifact Relations: ${result.totalArtifactRelationLocks} | Fresh: ${result.artifactRelationFresh}`,
+    `- \u6839\u76EE\u5F55: \`${result.root}\``,
+    `- \u9501\u6587\u4EF6: \`${result.lockPath}\``,
+    `- \u5B9E\u73B0/\u9A8C\u8BC1\u9501: ${result.totalLocks}\uFF08\u65B0\u9C9C ${result.fresh}\uFF09`,
+    `- \u5236\u54C1\u5173\u7CFB\u9501: ${result.totalArtifactRelationLocks}\uFF08\u65B0\u9C9C ${result.artifactRelationFresh}\uFF09`,
+    `- \u963B\u65AD\u7B56\u7565: ${strictMissingLock ? "--strict-missing-lock\uFF08missing_lock \u5347\u7EA7\u4E3A\u963B\u65AD\uFF09" : "\u9ED8\u8BA4\uFF08missing_lock \u4E0D\u963B\u65AD\uFF09"}`,
+    `- \u95EE\u9898: ${result.issues.length}\uFF08\u963B\u65AD ${blockingCount}\uFF0C\u4E0D\u963B\u65AD ${nonBlockingCount}\uFF09`,
     ""
   ];
   if (result.issues.length === 0) {
-    lines.push("No version lock issues.");
+    lines.push("\u672A\u53D1\u73B0\u7248\u672C\u9501\u95EE\u9898\u3002");
     return `${lines.join("\n")}
 `;
   }
-  for (const issue2 of result.issues) {
-    lines.push(`- [${issue2.status}] \`${issue2.edgeId}\` \u2014 ${issue2.message}`);
+  if (blockingCount > 0) {
+    lines.push(`\u5F53\u524D\u7B56\u7565\u4E0B\u5B58\u5728 ${blockingCount} \u4E2A\u963B\u65AD\u95EE\u9898\uFF0C\u547D\u4EE4\u5C06\u4EE5\u975E\u96F6\u9000\u51FA\u7801\u7ED3\u675F\uFF1B\u8BF7\u6309\u4E0B\u65B9\u6B65\u9AA4\u9010\u9879\u5904\u7406\u3002`);
+  } else {
+    lines.push("\u5F53\u524D\u7B56\u7565\u4E0B\u6CA1\u6709\u963B\u65AD\u95EE\u9898\uFF0C\u4EE5\u4E0B\u4EC5\u4E3A\u63D0\u9192\uFF0C\u547D\u4EE4\u4EE5\u96F6\u9000\u51FA\u7801\u7ED3\u675F\u3002");
   }
+  lines.push("");
+  lines.push("## \u95EE\u9898\u6E05\u5355");
+  lines.push("");
+  appendIssueDetails(lines, result.issues, strictMissingLock);
   return `${lines.join("\n")}
 `;
 }
 function renderVersionLockRefreshMarkdown(result) {
+  const strictMissingLock = true;
+  const blockingCount = result.postAudit.issues.filter((issue2) => isVersionLockIssueBlocking(issue2, strictMissingLock)).length;
+  const nonBlockingCount = result.postAudit.issues.length - blockingCount;
   const lines = [
-    "# Version Lock Refresh",
+    "# \u7248\u672C\u9501\u5237\u65B0\uFF08version-lock refresh\uFF09",
+    "",
+    `- \u6839\u76EE\u5F55: \`${result.root}\``,
+    `- \u9501\u6587\u4EF6: \`${result.lockPath}\``,
+    `- \u6A21\u5F0F: \`${result.mode}\`\uFF08\u53D8\u66F4\u8DEF\u5F84 ${result.changedPaths.length} \u4E2A\uFF0C\u53D7\u5F71\u54CD\u8FB9 ${result.affectedEdges.length} \u6761\uFF09`,
+    `- \u5B9E\u73B0/\u9A8C\u8BC1\u9501: \u65B0\u589E ${result.addedLocks.length} | \u66F4\u65B0 ${result.updatedLocks.length} | \u4FDD\u7559\u5B64\u7ACB ${result.retainedOrphans.length} | \u5220\u9664\u5B64\u7ACB ${result.removedOrphans.length}`,
+    `- \u5236\u54C1\u5173\u7CFB\u9501: \u65B0\u589E ${result.addedArtifactRelationLocks.length} | \u66F4\u65B0 ${result.updatedArtifactRelationLocks.length} | \u4FDD\u7559\u5B64\u7ACB ${result.retainedArtifactRelationOrphans.length} | \u5220\u9664 ${result.removedArtifactRelationLocks.length}`,
+    `- \u963B\u65AD\u7B56\u7565: refresh \u56FA\u5B9A\u6309 --strict-missing-lock \u5224\u5B9A\uFF0Cmissing_lock \u4E5F\u4F1A\u963B\u65AD`,
+    `- \u5237\u65B0\u540E\u5BA1\u8BA1\u95EE\u9898: ${result.postAudit.issues.length}\uFF08\u963B\u65AD ${blockingCount}\uFF0C\u4E0D\u963B\u65AD ${nonBlockingCount}\uFF09`,
     "",
-    `Root: \`${result.root}\``,
-    `Lock: \`${result.lockPath}\``,
-    `Mode: \`${result.mode}\``,
-    `Changed paths: ${result.changedPaths.length}`,
-    `Affected edges: ${result.affectedEdges.length}`,
-    `Added: ${result.addedLocks.length} | Updated: ${result.updatedLocks.length} | Retained orphans: ${result.retainedOrphans.length} | Removed orphans: ${result.removedOrphans.length}`,
-    `Artifact Relations \u2014 Added: ${result.addedArtifactRelationLocks.length} | Updated: ${result.updatedArtifactRelationLocks.length} | Retained orphans: ${result.retainedArtifactRelationOrphans.length} | Removed: ${result.removedArtifactRelationLocks.length}`,
-    `Post-audit issues: ${result.postAudit.issues.length}`,
+    "\u9501\u6587\u4EF6\u5DF2\u5199\u5165\u3002\u82E5\u9501\u6587\u4EF6\u76F8\u5BF9\u6682\u5B58\u533A\u6709\u53D8\u5316\uFF08\u4F8B\u5982 pre-commit \u573A\u666F\uFF09\uFF0C\u8BF7\u5148\u5BA1\u67E5\u5E76\u6682\u5B58\uFF1A",
+    "",
+    "1. `git diff artifacts/traceability-version-lock.json`",
+    "2. `git add artifacts/traceability-version-lock.json`",
+    "3. \u91CD\u65B0\u6267\u884C `git commit`",
     ""
   ];
-  appendList(lines, "Added Locks", result.addedLocks);
-  appendList(lines, "Updated Locks", result.updatedLocks);
-  appendList(lines, "Retained Orphans", result.retainedOrphans);
-  appendList(lines, "Removed Orphans", result.removedOrphans);
-  appendList(lines, "Added Artifact Relation Locks", result.addedArtifactRelationLocks);
-  appendList(lines, "Updated Artifact Relation Locks", result.updatedArtifactRelationLocks);
-  appendList(lines, "Retained Artifact Relation Orphans", result.retainedArtifactRelationOrphans);
-  appendList(lines, "Removed Artifact Relation Locks", result.removedArtifactRelationLocks);
-  appendList(lines, "Warnings", result.warnings);
+  appendList(lines, "\u65B0\u589E\u7684\u9501", result.addedLocks);
+  appendList(lines, "\u66F4\u65B0\u7684\u9501", result.updatedLocks);
+  appendList(lines, "\u4FDD\u7559\u7684\u5B64\u7ACB\u9501", result.retainedOrphans);
+  if (result.retainedOrphans.length > 0) {
+    lines.push("> \u4EE5\u4E0A\u662F\u5DF2\u5220\u9664/\u62C6\u5206\u5236\u54C1\u6216\u5931\u6548\u8FFD\u6EAF\u8FB9\u9057\u7559\u7684\u9501\u3002\u786E\u8BA4\u4E0D\u518D\u9700\u8981\u540E\u8FD0\u884C `artifact-graph version-lock refresh --all --remove-orphans --format markdown` \u6E05\u7406\uFF0C\u5BA1\u67E5 `git diff artifacts/traceability-version-lock.json` \u540E\u518D\u6682\u5B58\u3002");
+    lines.push("");
+  }
+  appendList(lines, "\u5220\u9664\u7684\u5B64\u7ACB\u9501", result.removedOrphans);
+  appendList(lines, "\u65B0\u589E\u7684\u5236\u54C1\u5173\u7CFB\u9501", result.addedArtifactRelationLocks);
+  appendList(lines, "\u66F4\u65B0\u7684\u5236\u54C1\u5173\u7CFB\u9501", result.updatedArtifactRelationLocks);
+  appendList(lines, "\u4FDD\u7559\u7684\u5B64\u7ACB\u5236\u54C1\u5173\u7CFB\u9501", result.retainedArtifactRelationOrphans);
+  if (result.retainedArtifactRelationOrphans.length > 0) {
+    lines.push("> \u4EE5\u4E0A\u662F\u5931\u6548\u5236\u54C1\u5173\u7CFB\u9057\u7559\u7684\u9501\u3002\u786E\u8BA4\u540E\u8FD0\u884C `artifact-graph version-lock refresh --all --remove-orphans --format markdown` \u6E05\u7406\uFF0C\u5BA1\u67E5\u9501 diff \u540E\u518D\u6682\u5B58\u3002");
+    lines.push("");
+  }
+  appendList(lines, "\u5220\u9664\u7684\u5236\u54C1\u5173\u7CFB\u9501", result.removedArtifactRelationLocks);
+  appendList(lines, "\u63D0\u9192", result.warnings);
   if (result.postAudit.issues.length > 0) {
-    lines.push("## Post-Audit Issues");
-    for (const issue2 of result.postAudit.issues) {
-      lines.push(`- [${issue2.status}] \`${issue2.edgeId}\` \u2014 ${issue2.message}`);
+    if (blockingCount > 0) {
+      lines.push(`## \u5237\u65B0\u540E\u5BA1\u8BA1\u95EE\u9898\uFF08\u963B\u65AD ${blockingCount}\uFF0C\u4E0D\u963B\u65AD ${nonBlockingCount}\uFF09`);
+    } else {
+      lines.push(`## \u5237\u65B0\u540E\u5BA1\u8BA1\u95EE\u9898\uFF08\u5F53\u524D\u7B56\u7565\u4E0B\u5168\u90E8\u4E0D\u963B\u65AD\uFF09`);
     }
     lines.push("");
+    appendIssueDetails(lines, result.postAudit.issues, strictMissingLock);
   }
   return `${lines.join("\n")}
 `;
@@ -2047,7 +2219,7 @@ function renderTraceVersionMarkdown(result) {
 async function readVersionLock(root, lockPath) {
   const safeLockPath = normalizeRelativePath(root, lockPath);
   try {
-    const raw = await readFile(join2(root, safeLockPath), "utf-8");
+    const raw = await readFile(join3(root, safeLockPath), "utf-8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -2206,7 +2378,7 @@ function requireSafeRelativePath(value, path) {
 }
 async function writeVersionLock(root, lockPath, lock) {
   const safeLockPath = normalizeRelativePath(root, lockPath);
-  const fullPath = join2(root, safeLockPath);
+  const fullPath = join3(root, safeLockPath);
   await mkdir2(dirname(fullPath), { recursive: true });
   await writeFile2(fullPath, `${JSON.stringify(lock, null, 2)}
 `);
@@ -2389,14 +2561,14 @@ async function hashRelativePath(root, path, cache) {
   const normalized = normalizeRelativePath(root, path);
   const cached = cache.get(normalized);
   if (cached) return cached;
-  const content = await readFile(join2(root, normalized));
+  const content = await readFile(join3(root, normalized));
   const hash = `sha256:${createHash("sha256").update(content).digest("hex")}`;
   cache.set(normalized, hash);
   return hash;
 }
 function normalizeRelativePath(root, path) {
   const normalized = path.replace(/\\/g, "/");
-  const relativePath = normalized.startsWith("/") ? relative(root, normalized).replace(/\\/g, "/") : normalized.replace(/^\.\//, "");
+  const relativePath = normalized.startsWith("/") ? relative2(root, normalized).replace(/\\/g, "/") : normalized.replace(/^\.\//, "");
   if (relativePath === ".." || relativePath.startsWith("../")) {
     throw new Error(`Path is outside root: ${path}`);
   }
@@ -2412,7 +2584,7 @@ async function getTestFileRunnerLiveness(root, filePath, config) {
     if (!/e2e/i.test(filePath) && !/\.e2e\./i.test(filePath)) {
       return "active";
     }
-    const fullSourcePath = join2(root, filePath);
+    const fullSourcePath = join3(root, filePath);
     if (!existsSync(fullSourcePath)) return "inactive";
     try {
       const content = await readFile(fullSourcePath, "utf-8");
@@ -2455,7 +2627,7 @@ async function isFileActiveInRunner(root, filePath, runner) {
 function sortUnique(items) {
   return [...new Set(items)].sort((left, right) => left.localeCompare(right));
 }
-var VERSION_LOCK_PATH, VERSION_INDEX_SCHEMA_VERSION, VERSION_LOCK_SCHEMA_VERSION;
+var VERSION_LOCK_PATH, VERSION_INDEX_SCHEMA_VERSION, VERSION_LOCK_SCHEMA_VERSION, LIVENESS_MESSAGE_PREFIX, VERSION_LOCK_STATUS_LABELS;
 var init_versioned_traceability = __esm({
   "src/versioned-traceability.ts"() {
     "use strict";
@@ -2464,6 +2636,16 @@ var init_versioned_traceability = __esm({
     VERSION_LOCK_PATH = "artifacts/traceability-version-lock.json";
     VERSION_INDEX_SCHEMA_VERSION = "1.0";
     VERSION_LOCK_SCHEMA_VERSION = "1.0";
+    LIVENESS_MESSAGE_PREFIX = "Liveness:";
+    VERSION_LOCK_STATUS_LABELS = {
+      fresh: "\u65B0\u9C9C",
+      target_not_found: "\u76EE\u6807\u5236\u54C1\u4E0D\u5B58\u5728",
+      artifact_changed: "\u5236\u54C1\u5DF2\u53D8\u5316",
+      source_changed: "\u6E90\u7801/\u6D4B\u8BD5\u5DF2\u53D8\u5316",
+      verified_by_changed: "\u9A8C\u8BC1\u6587\u4EF6\u5DF2\u53D8\u5316",
+      missing_lock: "\u7F3A\u5C11\u7248\u672C\u9501",
+      orphan_lock: "\u5B64\u7ACB\u9501"
+    };
   }
 });
 
@@ -2471,7 +2653,7 @@ var init_versioned_traceability = __esm({
 import { execFile } from "child_process";
 import { constants } from "fs";
 import { access } from "fs/promises";
-import { isAbsolute, join as join3, resolve } from "path";
+import { isAbsolute, join as join4, resolve } from "path";
 import { promisify } from "util";
 async function resolveArtifactGraphCli(root, options = {}) {
   const pathCli = await findCommandOnPath("artifact-graph");
@@ -2479,7 +2661,7 @@ async function resolveArtifactGraphCli(root, options = {}) {
   const candidates = [
     {
       source: "node_modules",
-      path: join3(root, "node_modules/.bin/artifact-graph"),
+      path: join4(root, "node_modules/.bin/artifact-graph"),
       exists: false
     },
     {
@@ -2512,8 +2694,8 @@ async function resolveArtifactGraphCli(root, options = {}) {
 }
 async function doctorArtifactChain(root, options = {}) {
   const cli = await resolveArtifactGraphCli(root, options);
-  const configPath = join3(root, "artifact-graph.config.yaml");
-  const lockPath = join3(root, VERSION_LOCK_PATH);
+  const configPath = join4(root, "artifact-graph.config.yaml");
+  const lockPath = join4(root, VERSION_LOCK_PATH);
   const supportedCommands = cli.path ? await detectSupportedCommands(cli.path) : [];
   const nodeCompatible = isNodeCompatible(process.versions.node);
   const warnings = [
@@ -2738,7 +2920,7 @@ var init_git_hook_path = __esm({
 import { constants as constants2 } from "fs";
 import { randomUUID } from "crypto";
 import { lstat, mkdir as mkdir3, open, readlink, rename, unlink } from "fs/promises";
-import { basename, dirname as dirname2, join as join4 } from "path";
+import { basename, dirname as dirname2, join as join5 } from "path";
 function detectHookInterpreter(content) {
   if (content.trim().length === 0) {
     return "empty";
@@ -3046,7 +3228,7 @@ async function removeHookAtomically(hookPath, snapshot) {
 }
 async function writeHookAtomically(hookPath, content, snapshot, mode) {
   await mkdir3(dirname2(hookPath), { recursive: true });
-  const temporaryPath = join4(dirname2(hookPath), `.${basename(hookPath)}.${randomUUID()}.tmp`);
+  const temporaryPath = join5(dirname2(hookPath), `.${basename(hookPath)}.${randomUUID()}.tmp`);
   let temporaryExists = false;
   try {
     const temporary = await open(temporaryPath, "wx", mode);
@@ -3511,8 +3693,8 @@ __export(contract_kernel_exports, {
   verifyDigest: () => verifyDigest
 });
 import { createHash as createHash2 } from "crypto";
-import { readFile as readFile2, readdir } from "fs/promises";
-import { join as join5 } from "path";
+import { readFile as readFile2, readdir as readdir2 } from "fs/promises";
+import { join as join6 } from "path";
 import _AjvModule from "ajv";
 function isOfficialNamespace(namespace) {
   return OFFICIAL_NAMESPACE_PATTERN.test(namespace);
@@ -3922,10 +4104,10 @@ async function loadContract(contractPath, options) {
 }
 async function loadContractsFromDirectory(contractsDir, options) {
   const contracts = [];
-  const entries = await readdir(contractsDir, { withFileTypes: true });
+  const entries = await readdir2(contractsDir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isDirectory()) {
-      const schemaPath = join5(contractsDir, entry.name, "schema.json");
+      const schemaPath = join6(contractsDir, entry.name, "schema.json");
       const contract = await loadContract(schemaPath, options);
       contracts.push(contract);
     }
@@ -4417,8 +4599,8 @@ import Database from "better-sqlite3";
 import matter from "gray-matter";
 import yaml from "js-yaml";
 import { accessSync, constants as fsConstants, existsSync as existsSync2, statSync } from "fs";
-import { mkdir as mkdir4, readFile as readFile3, readdir as readdir2, writeFile as writeFile3 } from "fs/promises";
-import { basename as basename3, dirname as dirname3, extname, isAbsolute as isAbsolute3, join as join6, relative as relative2, resolve as resolve3 } from "path";
+import { mkdir as mkdir4, readFile as readFile3, readdir as readdir3, writeFile as writeFile3 } from "fs/promises";
+import { basename as basename3, dirname as dirname3, extname, isAbsolute as isAbsolute3, join as join7, relative as relative3, resolve as resolve3 } from "path";
 function isTargetArtifactType(type) {
   return isPacketTargetType(type);
 }
@@ -4460,7 +4642,7 @@ function resolveArtifactTypeName(schema, token) {
   return void 0;
 }
 async function loadConfig(root) {
-  const configPath = join6(root, "artifact-graph.config.yaml");
+  const configPath = join7(root, "artifact-graph.config.yaml");
   let parsed = {};
   try {
     const raw = await readFile3(configPath, "utf-8");
@@ -4637,7 +4819,7 @@ async function scanArtifacts(root, schema) {
         continue;
       }
       scannedFiles.set(file, type);
-      const raw = await readFile3(join6(root, file), "utf-8");
+      const raw = await readFile3(join7(root, file), "utf-8");
       const parsed = parseFile(type, file, raw, config);
       nodes.push(...parsed.nodes);
       edges.push(...parsed.edges);
@@ -4949,7 +5131,7 @@ async function validateScenarioPrdLinkIndex(root, graph) {
   const indexPath = "artifacts/prd/feature-index.md";
   let raw = "";
   try {
-    raw = await readFile3(join6(root, indexPath), "utf-8");
+    raw = await readFile3(join7(root, indexPath), "utf-8");
   } catch (error) {
     if (error.code === "ENOENT") {
       return [];
@@ -5139,11 +5321,11 @@ function nextId(graph, schema, type, rangeName) {
   throw new Error(`ID range ${type}.${rangeName} is exhausted`);
 }
 async function writeGraphCache(root, graph) {
-  const cacheDir = join6(root, ".artifact-graph");
+  const cacheDir = join7(root, ".artifact-graph");
   await mkdir4(cacheDir, { recursive: true });
-  await writeFile3(join6(cacheDir, "index.json"), `${JSON.stringify(graph, null, 2)}
+  await writeFile3(join7(cacheDir, "index.json"), `${JSON.stringify(graph, null, 2)}
 `);
-  const db = new Database(join6(cacheDir, "graph.sqlite"));
+  const db = new Database(join7(cacheDir, "graph.sqlite"));
   try {
     db.exec(`
       DROP TABLE IF EXISTS nodes;
@@ -6826,10 +7008,10 @@ function validateE2eRegistry(graph) {
 async function validateExecutableTraceability(root, config) {
   const issues = [];
   const schema = config ?? await loadConfig(root);
-  const e2eDir = join6(root, "artifacts", "tests", "e2e");
+  const e2eDir = join7(root, "artifacts", "tests", "e2e");
   let e2eFiles;
   try {
-    e2eFiles = (await readdir2(e2eDir)).filter((name) => /^test-.*\.md$/.test(name)).map((name) => join6(e2eDir, name));
+    e2eFiles = (await readdir3(e2eDir)).filter((name) => /^test-.*\.md$/.test(name)).map((name) => join7(e2eDir, name));
   } catch {
     return [];
   }
@@ -6839,7 +7021,7 @@ async function validateExecutableTraceability(root, config) {
   const mdBatches = /* @__PURE__ */ new Set();
   for (const filePath of e2eFiles) {
     const raw = await readFile3(filePath, "utf-8");
-    const relPath = relative2(root, filePath).split("\\").join("/");
+    const relPath = relative3(root, filePath).split("\\").join("/");
     const parsed = matter(raw);
     const data = parsed.data;
     const batch = String(data.test_batch ?? basename3(filePath, extname(filePath))).trim();
@@ -6867,7 +7049,7 @@ async function validateExecutableTraceability(root, config) {
       }
     }
   }
-  const allFiles = await walk(root);
+  const allFiles = await walkFiles(root);
   const specFiles = /* @__PURE__ */ new Set();
   const configuredRunners = schema.e2e?.runners ?? [];
   if (configuredRunners.length > 0) {
@@ -6887,7 +7069,7 @@ async function validateExecutableTraceability(root, config) {
   const tcAnnotationRegex = /\/\/!?\s*@(?:e2e_test|tc)\s+(\S+?)\s+\[(\w+)\]/;
   const tcAnnotationNoLevelRegex = /\/\/!?\s*@(?:e2e_test|tc)\s+(\S+)/;
   for (const specFile of specFiles) {
-    const fullSpecPath = join6(root, specFile);
+    const fullSpecPath = join7(root, specFile);
     let content;
     try {
       content = await readFile3(fullSpecPath, "utf-8");
@@ -6896,14 +7078,16 @@ async function validateExecutableTraceability(root, config) {
     }
     const level = detectTestLevel(specFile, content);
     const specLines = content.split(/\r?\n/);
-    for (let lineIndex = 0; lineIndex < specLines.length; lineIndex += 1) {
-      const line = specLines[lineIndex];
-      let match = tcAnnotationRegex.exec(line);
+    const lineComments = scanCodeComments(content).filter((comment) => comment.kind === "line" && comment.standalone);
+    for (const comment of lineComments) {
+      const lineIndex = comment.lineNumber - 1;
+      const commentText = comment.text.replace(/^!/, "");
+      let match = tcAnnotationRegex.exec(`//${commentText}`);
       let annotatedLevel = "";
       if (match) {
         annotatedLevel = match[2];
       } else {
-        match = tcAnnotationNoLevelRegex.exec(line);
+        match = tcAnnotationNoLevelRegex.exec(`//${commentText}`);
       }
       if (!match) {
         continue;
@@ -6930,7 +7114,7 @@ async function validateExecutableTraceability(root, config) {
         level: effectiveLevel,
         file: specFile,
         testName,
-        line: lineIndex + 1
+        line: comment.lineNumber
       };
       const key = `${batch}:${tcId}`;
       const existing = refToSource.get(key) ?? [];
@@ -6967,7 +7151,7 @@ async function validateExecutableTraceability(root, config) {
       if (entry.testId) {
         let content;
         try {
-          content = await readFile3(join6(root, normalizedRefFile), "utf-8");
+          content = await readFile3(join7(root, normalizedRefFile), "utf-8");
         } catch {
           continue;
         }
@@ -7144,11 +7328,11 @@ async function computeE2eCoverageStats(graph, root, thresholds = {}) {
   let withExecutableRef = 0;
   const statusBreakdown = {};
   const chainTypeBreakdown = {};
-  const e2eDir = join6(root, "artifacts", "tests", "e2e");
+  const e2eDir = join7(root, "artifacts", "tests", "e2e");
   const tcFieldsMap = /* @__PURE__ */ new Map();
   let e2eFiles;
   try {
-    e2eFiles = (await readdir2(e2eDir)).filter((name) => /^test-.*\.md$/.test(name)).map((name) => join6(e2eDir, name));
+    e2eFiles = (await readdir3(e2eDir)).filter((name) => /^test-.*\.md$/.test(name)).map((name) => join7(e2eDir, name));
   } catch {
     e2eFiles = [];
   }
@@ -7215,7 +7399,7 @@ async function computeE2eCoverageStats(graph, root, thresholds = {}) {
     }
   }
   const runners = (await loadConfig(root)).e2e?.runners ?? [];
-  const allProjectFiles = await walk(root);
+  const allProjectFiles = await walkFiles(root);
   for (const node of e2eNodes) {
     const fields = tcFieldsMap.get(node.code) ?? asRecord(node.attrs?.tcFields);
     const status = String(fields["status"] ?? "").trim().toLowerCase();
@@ -7226,7 +7410,7 @@ async function computeE2eCoverageStats(graph, root, thresholds = {}) {
     let hasActiveE2eRef = false;
     for (const entry of parseExecutableRefLines(execRef)) {
       const normalized = resolveExecutableRefFile(entry.file, allProjectFiles);
-      if (!normalized || !existsSync2(join6(root, normalized))) continue;
+      if (!normalized || !existsSync2(join7(root, normalized))) continue;
       const accepting = await getAcceptingRunners(root, normalized, runners);
       if (accepting.some((runner) => runner.kind === "e2e")) {
         hasActiveE2eRef = true;
@@ -7285,7 +7469,7 @@ async function computeE2eCoverageStats(graph, root, thresholds = {}) {
   const acCoverageRateByFeature = {};
   const featureAcMap = /* @__PURE__ */ new Map();
   for (const node of featureNodes) {
-    const acs = parseAcceptanceCriteria(await readFile3(join6(root, node.path), "utf-8"));
+    const acs = parseAcceptanceCriteria(await readFile3(join7(root, node.path), "utf-8"));
     featureAcMap.set(node.code, new Set(acs));
   }
   const coveredAcByFeature = /* @__PURE__ */ new Map();
@@ -7327,10 +7511,10 @@ async function computeE2eCoverageStats(graph, root, thresholds = {}) {
   };
 }
 async function generateE2eRegistry(root, opts) {
-  const e2eDir = join6(root, "artifacts", "tests", "e2e");
+  const e2eDir = join7(root, "artifacts", "tests", "e2e");
   let files;
   try {
-    files = (await readdir2(e2eDir)).filter((name) => /^test-.*\.md$/.test(name)).sort();
+    files = (await readdir3(e2eDir)).filter((name) => /^test-.*\.md$/.test(name)).sort();
   } catch {
     return {
       registry_version: "1.0",
@@ -7343,7 +7527,7 @@ async function generateE2eRegistry(root, opts) {
   const batches = [];
   let totalTestCases = 0;
   for (const file of files) {
-    const filePath = join6(e2eDir, file);
+    const filePath = join7(e2eDir, file);
     const raw = await readFile3(filePath, "utf-8");
     const parsed = matter(raw);
     const data = parsed.data;
@@ -7471,7 +7655,7 @@ async function validatePartialRustEvidence(tcFields, tcKey, root, allFiles) {
     if (!normalizedPath) {
       return { hasValidPartialRust: false, detail: `partial_rust file not found: ${ref.file}` };
     }
-    const fullPath = join6(root, normalizedPath);
+    const fullPath = join7(root, normalizedPath);
     let content;
     try {
       content = await readFile3(fullPath, "utf-8");
@@ -7583,7 +7767,7 @@ function escapeRegExp(value) {
 }
 async function hasMarkdownTc(tcKey, e2eDir) {
   const [batch, tcId] = tcKey.split(":");
-  const filePath = join6(e2eDir, `${batch}.md`);
+  const filePath = join7(e2eDir, `${batch}.md`);
   try {
     const raw = await readFile3(filePath, "utf-8");
     const tcRegex = new RegExp(`^#{2,3}\\s+${escapeRegExp(tcId)}\\s*[:\uFF1A]?`, "m");
@@ -7593,7 +7777,7 @@ async function hasMarkdownTc(tcKey, e2eDir) {
   }
 }
 async function findFiles(root, patterns) {
-  const all = await walk(root);
+  const all = await walkFiles(root);
   const matched = /* @__PURE__ */ new Set();
   for (const pattern of patterns) {
     for (const file of all) {
@@ -7604,21 +7788,9 @@ async function findFiles(root, patterns) {
   }
   return [...matched].sort();
 }
-async function walk(root, current = root) {
-  const entries = await readdir2(current, { withFileTypes: true });
-  const files = [];
-  for (const entry of entries) {
-    if (entry.name === "node_modules" || entry.name === "dist" || entry.name === ".git" || entry.name === ".artifact-graph") {
-      continue;
-    }
-    const fullPath = join6(current, entry.name);
-    if (entry.isDirectory()) {
-      files.push(...await walk(root, fullPath));
-    } else {
-      files.push(relative2(root, fullPath).split("\\").join("/"));
-    }
-  }
-  return files;
+function matchesConfiguredArtifactPath(path, schema) {
+  const normalizedPath = path.replace(/\\/g, "/").replace(/^\.\//, "");
+  return Object.values(schema.types).some((definition) => definition.paths.some((pattern) => matchesPattern(normalizedPath, pattern)));
 }
 function matchesPattern(file, pattern) {
   if (!pattern.includes("*")) {
@@ -8095,7 +8267,7 @@ function resolveArtifactContext(graph, opts) {
     }
     if (root) {
       for (const ap of ALWAYS_PRESENT_ITEMS) {
-        const fullPath = join6(root, ap.path);
+        const fullPath = join7(root, ap.path);
         let stat;
         try {
           stat = statSync(fullPath);
@@ -8332,6 +8504,7 @@ var init_index = __esm({
     init_packet_constants();
     init_packet_validator();
     init_glob_matcher();
+    init_file_walker();
     init_packet_constants();
     init_target_selector();
     init_packet_assembler();
@@ -8436,7 +8609,7 @@ var init_index = __esm({
 
 // src/packet-prompt-audit.ts
 import { mkdir as mkdir5, writeFile as writeFile4 } from "fs/promises";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 function promptFilename(target) {
   return `prompt-${target.type}-${target.id}.md`;
 }
@@ -8488,7 +8661,7 @@ async function auditSinglePromptTarget(target, graph, options) {
     }
     if (options.outDir) {
       const filename = promptFilename(target);
-      const outPath = join7(options.outDir, filename);
+      const outPath = join8(options.outDir, filename);
       await writeFile4(outPath, prompt, "utf-8");
       entry.outputPath = outPath;
     }
@@ -8594,9 +8767,9 @@ async function auditPromptBatch(root, targets, options, graph) {
   };
   if (options.outDir) {
     await mkdir5(options.outDir, { recursive: true });
-    const jsonPath = join7(options.outDir, "prompt-audit-summary.json");
+    const jsonPath = join8(options.outDir, "prompt-audit-summary.json");
     await writeFile4(jsonPath, JSON.stringify(summary, null, 2) + "\n", "utf-8");
-    const mdPath = join7(options.outDir, "prompt-audit-summary.md");
+    const mdPath = join8(options.outDir, "prompt-audit-summary.md");
     await writeFile4(mdPath, renderPromptAuditSummaryMarkdown(summary), "utf-8");
   }
   return summary;
@@ -8638,7 +8811,7 @@ __export(cli_exports, {
 import yaml2 from "js-yaml";
 import { realpathSync } from "fs";
 import { access as access2, mkdir as mkdir6, readFile as readFile4, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname4, isAbsolute as isAbsolute4, join as join8 } from "path";
+import { dirname as dirname4, isAbsolute as isAbsolute4, join as join9 } from "path";
 import { fileURLToPath } from "url";
 async function runCli(argv, io = {}) {
   const parsed = parseArgs(argv);
@@ -8655,7 +8828,7 @@ async function runCli(argv, io = {}) {
     switch (parsed.command) {
       case "init": {
         await initConfig(root);
-        out(`Created ${join8(root, "artifact-graph.config.yaml")}
+        out(`Created ${join9(root, "artifact-graph.config.yaml")}
 `);
         return 0;
       }
@@ -9408,7 +9581,7 @@ async function runCli(argv, io = {}) {
             out(`${JSON.stringify(result, null, 2)}
 `);
           } else {
-            out(renderVersionLockAuditMarkdown(result));
+            out(renderVersionLockAuditMarkdown(result, { strictMissingLock: parsed.flags["strict-missing-lock"] === true }));
           }
           return hasBlockingVersionIssues(result.issues, parsed.flags["strict-missing-lock"] === true) && !parsed.flags["warning-only"] ? 1 : 0;
         }
@@ -9484,7 +9657,8 @@ async function runCli(argv, io = {}) {
               err("Stage or stash the unstaged changes before running changed-only staged refresh.\n");
               return 1;
             }
-            const unstagedGraphPaths = changeResult.unstagedPaths.filter(isGraphRelevantPath);
+            const schema = await loadConfig(root);
+            const unstagedGraphPaths = changeResult.unstagedPaths.filter((path) => isGraphRelevantPath(path, schema));
             if (unstagedGraphPaths.length > 0) {
               err("Cannot refresh staged version locks because graph-relevant unstaged changes may affect working-tree hashes:\n");
               for (const conflictPath of unstagedGraphPaths) {
@@ -9593,7 +9767,7 @@ async function runCli(argv, io = {}) {
           err("Usage: artifact-graph validate-review-result --file <path> [--format json]\n");
           return 1;
         }
-        const resolvedPath = isAbsolute4(filePath) ? filePath : join8(root, filePath);
+        const resolvedPath = isAbsolute4(filePath) ? filePath : join9(root, filePath);
         let content;
         try {
           content = await readFile4(resolvedPath, "utf-8");
@@ -9631,7 +9805,7 @@ async function runCli(argv, io = {}) {
         const deterministic = checkMode || parsed.flags.deterministic === true;
         const registry = await generateE2eRegistry(root, { deterministic });
         const output = JSON.stringify(registry, null, 2) + "\n";
-        const outPath = typeof parsed.flags.out === "string" ? parsed.flags.out : join8(root, "artifacts/tests/e2e/e2e-test-registry.json");
+        const outPath = typeof parsed.flags.out === "string" ? parsed.flags.out : join9(root, "artifacts/tests/e2e/e2e-test-registry.json");
         if (checkMode) {
           let existing = "";
           try {
@@ -9668,7 +9842,7 @@ async function runCli(argv, io = {}) {
           return 1;
         }
         const packageDir = dirname4(fileURLToPath(import.meta.url));
-        const contractsDir = typeof parsed.flags["contracts-dir"] === "string" ? parsed.flags["contracts-dir"] : join8(packageDir, "..", "contracts");
+        const contractsDir = typeof parsed.flags["contracts-dir"] === "string" ? parsed.flags["contracts-dir"] : join9(packageDir, "..", "contracts");
         const revisionDigest = typeof parsed.flags["revision-digest"] === "string" ? parsed.flags["revision-digest"] : void 0;
         async function resolveContract(contractId) {
           const catalog = await loadContractCatalog(contractsDir);
@@ -9925,13 +10099,17 @@ async function runCli(argv, io = {}) {
   }
 }
 function hasBlockingVersionIssues(issues, strictMissingLock) {
-  return issues.some((issue2) => issue2.status !== "missing_lock" || strictMissingLock);
+  return issues.some((issue2) => isVersionLockIssueBlocking({
+    status: issue2.status,
+    message: issue2.message ?? "",
+    severity: issue2.severity
+  }, strictMissingLock));
 }
-function isGraphRelevantPath(path) {
-  return path === "artifact-graph.config.yaml" || path === VERSION_LOCK_PATH || path.startsWith("artifacts/") || /\.(md|mdx|json|ya?ml|ts|tsx|js|jsx|mts|cts|rs|py|go)$/.test(path);
+function isGraphRelevantPath(path, schema) {
+  return path === "artifact-graph.config.yaml" || path === VERSION_LOCK_PATH || matchesConfiguredArtifactPath(path, schema);
 }
 async function initConfig(root) {
-  const configPath = join8(root, "artifact-graph.config.yaml");
+  const configPath = join9(root, "artifact-graph.config.yaml");
   try {
     await access2(configPath);
     throw new Error(`Config already exists: ${configPath}`);
@@ -9988,6 +10166,12 @@ Commands:
   version-lock update --target <type:id> --source <path> [--verified-by <path,path>] [--lock-path <path>]
   version-lock bootstrap [--force] [--lock-path <path>]
   version-lock refresh (--all | --changed-only (--staged | --worktree | --base <ref>)) [--remove-orphans] [--format json|markdown] [--lock-path <path>]
+      --remove-orphans  delete locks whose artifact, source, or traceability edge no longer
+                        exists (default: retain them). Typical cleanup after deleting or
+                        splitting artifacts:
+                          artifact-graph version-lock refresh --all --remove-orphans --format markdown
+                          git diff artifacts/traceability-version-lock.json   # review
+                          git add artifacts/traceability-version-lock.json    # stage, then commit
   trace-version --target <type:id> [--format json|markdown] [--warning-only] [--strict-missing-lock] [--lock-path <path>]
   hooks install-git [--hook pre-commit|pre-push|all] [--uninstall]
   next-id <type> --range <name>