audit-tools 0.28.0

package/dist/audit/orchestrator/artifactFreshness.js

@@ -0,0 +1,99 @@
+import { createHash } from "node:crypto";
+export function stableStringify(value) {
+    if (value === undefined) {
+        return "null";
+    }
+    if (value === null || typeof value !== "object") {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map((item) => stableStringify(item ?? null)).join(",")}]`;
+    }
+    const entries = Object.entries(value)
+        .filter(([, item]) => item !== undefined)
+        .sort(([a], [b]) => a.localeCompare(b));
+    return `{${entries.map(([key, item]) => `${JSON.stringify(key)}:${stableStringify(item)}`).join(",")}}`;
+}
+// Non-semantic top-level fields stripped before hashing, per artifact. These
+// are provenance (wall-clock stamps, run ids), NOT content: two rebuilds with
+// identical data but different stamps must hash equal, or the artifact's
+// revision churns every rebuild and perpetually re-stales its downstreams (e.g.
+// audit-report.md depends on design_assessment) — a finalization-oscillation
+// hazard.
+//
+// OBL-C006/CE-005: strip ALL non-semantic fields, not only `generated_at`. The
+// set is per-artifact and extensible; add any field that is provenance rather
+// than meaning. The synthesis-narrative marker carries only semantic counts, so
+// it has no fields to strip — but it (and the narrative-bearing findings
+// contract) get array canonicalization below so a byte-varying-but-
+// semantically-stable narrative still produces a stable content hash, letting
+// the synthesis<->narrative no-progress guard converge.
+const NON_SEMANTIC_FIELDS_BY_ARTIFACT = {
+    "repo_manifest.json": ["generated_at"],
+    "tooling_manifest.json": ["generated_at"],
+    "audit_plan_metrics.json": ["generated_at"],
+    "design_assessment.json": ["generated_at"],
+    // The narrative-bearing machine contract. `generated_at` (when present) is
+    // provenance; the array canonicalization below makes theme/top-risk ordering
+    // non-load-bearing for the content hash.
+    "audit-findings.json": ["generated_at"],
+    // The narrative marker. Carries only semantic counts today, but strip
+    // `generated_at` defensively so a future provenance stamp can never churn the
+    // synthesis<->narrative signature (OBL-C006).
+    "synthesis-narrative.json": ["generated_at"],
+};
+function stripFields(record, fields) {
+    if (fields.length === 0)
+        return record;
+    const drop = new Set(fields);
+    return Object.fromEntries(Object.entries(record).filter(([key]) => !drop.has(key)));
+}
+/**
+ * Canonically order the semantically-unordered narrative arrays so that a host
+ * narrative which differs ONLY in array order (or in stripped non-semantic
+ * fields) hashes identically. Themes are ordered by `theme_id`, each theme's
+ * `finding_ids` lexically, and `top_risks` lexically. Findings keep their
+ * deterministic synthesis order (already stable). Applied to the narrative
+ * fields wherever they appear (`audit-findings.json` after applyNarrative).
+ */
+function canonicalizeNarrativeArrays(record) {
+    const out = { ...record };
+    if (Array.isArray(out.themes)) {
+        out.themes = [...out.themes]
+            .map((theme) => {
+            if (theme && typeof theme === "object" && Array.isArray(theme.finding_ids)) {
+                return {
+                    ...theme,
+                    finding_ids: [...theme.finding_ids].sort(),
+                };
+            }
+            return theme;
+        })
+            .sort((a, b) => String(a?.theme_id ?? "").localeCompare(String(b?.theme_id ?? "")));
+    }
+    if (Array.isArray(out.top_risks)) {
+        out.top_risks = [...out.top_risks].sort();
+    }
+    return out;
+}
+export function normalizeForMetadataHash(artifactName, value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return value;
+    }
+    let record = value;
+    const nonSemantic = NON_SEMANTIC_FIELDS_BY_ARTIFACT[artifactName];
+    if (nonSemantic) {
+        record = stripFields(record, nonSemantic);
+    }
+    if (artifactName === "audit-findings.json" ||
+        artifactName === "synthesis-narrative.json") {
+        record = canonicalizeNarrativeArrays(record);
+    }
+    return record;
+}
+export function hashArtifactValue(artifactName, value) {
+    return createHash("sha256")
+        .update(stableStringify(normalizeForMetadataHash(artifactName, value)))
+        .digest("hex");
+}
+//# sourceMappingURL=artifactFreshness.js.map

package/dist/audit/orchestrator/artifactFreshness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifactFreshness.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/artifactFreshness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7E,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;SACxC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC1G,CAAC;AAED,6EAA6E;AAC7E,8EAA8E;AAC9E,yEAAyE;AACzE,gFAAgF;AAChF,6EAA6E;AAC7E,UAAU;AACV,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,yEAAyE;AACzE,oEAAoE;AACpE,8EAA8E;AAC9E,wDAAwD;AACxD,MAAM,+BAA+B,GAAsC;IACzE,oBAAoB,EAAE,CAAC,cAAc,CAAC;IACtC,uBAAuB,EAAE,CAAC,cAAc,CAAC;IACzC,yBAAyB,EAAE,CAAC,cAAc,CAAC;IAC3C,wBAAwB,EAAE,CAAC,cAAc,CAAC;IAC1C,2EAA2E;IAC3E,6EAA6E;IAC7E,yCAAyC;IACzC,qBAAqB,EAAE,CAAC,cAAc,CAAC;IACvC,sEAAsE;IACtE,8EAA8E;IAC9E,8CAA8C;IAC9C,0BAA0B,EAAE,CAAC,cAAc,CAAC;CAC7C,CAAC;AAEF,SAAS,WAAW,CAClB,MAA+B,EAC/B,MAAyB;IAEzB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,2BAA2B,CAClC,MAA+B;IAE/B,MAAM,GAAG,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IAEnD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,GAAG,CAAC,GAAI,GAAG,CAAC,MAAyC,CAAC;aAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACb,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC3E,OAAO;oBACL,GAAG,KAAK;oBACR,WAAW,EAAE,CAAC,GAAI,KAAK,CAAC,WAAwB,CAAC,CAAC,IAAI,EAAE;iBACzD,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;aACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACb,MAAM,CAAC,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,CACnE,CAAC;IACN,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,SAAS,GAAG,CAAC,GAAI,GAAG,CAAC,SAAsB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,YAAoB,EACpB,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,GAAG,KAAgC,CAAC;IAC9C,MAAM,WAAW,GAAG,+BAA+B,CAAC,YAAY,CAAC,CAAC;IAClE,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC5C,CAAC;IACD,IACE,YAAY,KAAK,qBAAqB;QACtC,YAAY,KAAK,0BAA0B,EAC3C,CAAC;QACD,MAAM,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,YAAoB,EACpB,KAAc;IAEd,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,eAAe,CAAC,wBAAwB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;SACtE,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC"}

package/dist/audit/orchestrator/artifactMetadata.d.ts

@@ -0,0 +1,6 @@
+import type { ArtifactMetadataManifest } from "../types/artifactMetadata.js";
+import type { ArtifactBundle } from "../io/artifacts.js";
+export declare function present(bundle: ArtifactBundle, artifactName: string): boolean;
+export declare function computeArtifactStateSignature(bundle: ArtifactBundle): string;
+export declare function computeArtifactMetadata(bundle: ArtifactBundle, previous?: ArtifactMetadataManifest, updatedArtifacts?: Iterable<string>): ArtifactMetadataManifest;
+//# sourceMappingURL=artifactMetadata.d.ts.map

package/dist/audit/orchestrator/artifactMetadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifactMetadata.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/artifactMetadata.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,wBAAwB,EACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AA+CzD,wBAAgB,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAG7E;AAOD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAO5E;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,cAAc,EACtB,QAAQ,CAAC,EAAE,wBAAwB,EACnC,gBAAgB,GAAE,QAAQ,CAAC,MAAM,CAAM,GACtC,wBAAwB,CAuD1B"}

package/dist/audit/orchestrator/artifactMetadata.js

@@ -0,0 +1,98 @@
+import { createHash } from "node:crypto";
+import { getArtifactValue } from "../io/artifacts.js";
+import { ALL_DAG_ARTIFACTS, ARTIFACT_DEPENDS_ON_MAP } from "./dependencyMap.js";
+import { hashArtifactValue, stableStringify, } from "./artifactFreshness.js";
+// The canonical "X depends on Y" table (ARC-cebe3421). computeArtifactMetadata
+// records each artifact's upstream dependency revisions, so it reads the
+// dependsOn direction directly from the single source of truth.
+const ARTIFACT_DEPENDENCIES_MAP = ARTIFACT_DEPENDS_ON_MAP;
+function computeDependencyFirstOrder(artifactNames) {
+    const target = new Set(artifactNames);
+    const ordered = [];
+    const temporary = new Set();
+    const permanent = new Set();
+    const visit = (artifactName) => {
+        if (permanent.has(artifactName))
+            return;
+        if (temporary.has(artifactName))
+            return;
+        temporary.add(artifactName);
+        const dependencies = (ARTIFACT_DEPENDENCIES_MAP[artifactName] ?? [])
+            .filter((dependencyName) => target.has(dependencyName))
+            .sort();
+        for (const dependencyName of dependencies) {
+            visit(dependencyName);
+        }
+        temporary.delete(artifactName);
+        permanent.add(artifactName);
+        ordered.push(artifactName);
+    };
+    for (const artifactName of Array.from(target).sort()) {
+        visit(artifactName);
+    }
+    return ordered;
+}
+export function present(bundle, artifactName) {
+    const value = getArtifactValue(bundle, artifactName);
+    return value !== undefined && value !== null;
+}
+// Stable signature of the overall artifact state, keyed on per-artifact CONTENT
+// hashes — deliberately NOT revisions, which only ever increment. A
+// deterministic advance loop that revisits a signature it already produced this
+// run is cycling (e.g. a runtime_validation <-> synthesis staleness ping-pong);
+// the content-hash basis catches that even while revisions churn underneath.
+export function computeArtifactStateSignature(bundle) {
+    const metadata = bundle.artifact_metadata;
+    if (!metadata)
+        return "no-metadata";
+    const entries = Object.entries(metadata.artifacts)
+        .map(([name, entry]) => `${name}:${entry.content_hash}`)
+        .sort();
+    return createHash("sha256").update(entries.join("\n")).digest("hex");
+}
+export function computeArtifactMetadata(bundle, previous, updatedArtifacts = []) {
+    const artifacts = {};
+    const updated = new Set(updatedArtifacts);
+    // Enumerate the FULL DAG artifact universe (not just those that depend on
+    // something): a pure-input artifact (scope.json, intent_checkpoint.json, …)
+    // must still get a metadata entry so its dependents can compare revisions.
+    const presentArtifacts = [...ALL_DAG_ARTIFACTS].filter((artifactName) => artifactName !== "artifact_metadata.json" &&
+        present(bundle, artifactName));
+    const orderedArtifacts = computeDependencyFirstOrder(presentArtifacts);
+    for (const artifactName of orderedArtifacts) {
+        if (artifactName === "artifact_metadata.json")
+            continue;
+        const value = getArtifactValue(bundle, artifactName);
+        if (value === undefined || value === null)
+            continue;
+        const previousEntry = previous?.artifacts[artifactName];
+        if (previousEntry && !updated.has(artifactName)) {
+            artifacts[artifactName] = previousEntry;
+            continue;
+        }
+        const contentHash = hashArtifactValue(artifactName, value);
+        const dependencyRevisions = Object.fromEntries((ARTIFACT_DEPENDENCIES_MAP[artifactName] ?? [])
+            .filter((dependencyName) => dependencyName !== "artifact_metadata.json")
+            .sort()
+            .map((dependencyName) => [
+            dependencyName,
+            artifacts[dependencyName]?.revision ??
+                previous?.artifacts[dependencyName]?.revision ??
+                0,
+        ]));
+        const sameContent = previousEntry?.content_hash === contentHash;
+        const sameDependencies = previousEntry &&
+            stableStringify(previousEntry.dependency_revisions) ===
+                stableStringify(dependencyRevisions);
+        const revision = sameContent && sameDependencies
+            ? previousEntry.revision
+            : (previousEntry?.revision ?? 0) + 1;
+        artifacts[artifactName] = {
+            revision,
+            content_hash: contentHash,
+            dependency_revisions: dependencyRevisions,
+        };
+    }
+    return { artifacts };
+}
+//# sourceMappingURL=artifactMetadata.js.map

package/dist/audit/orchestrator/artifactMetadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifactMetadata.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/artifactMetadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAMzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EACL,iBAAiB,EACjB,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAEhC,+EAA+E;AAC/E,yEAAyE;AACzE,gEAAgE;AAChE,MAAM,yBAAyB,GAAqB,uBAAuB,CAAC;AAI5E,SAAS,2BAA2B,CAClC,aAA+B;IAE/B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACtC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,MAAM,KAAK,GAAG,CAAC,YAAoB,EAAE,EAAE;QACrC,IAAI,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,OAAO;QACxC,IAAI,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,OAAO;QACxC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAE5B,MAAM,YAAY,GAAG,CAAC,yBAAyB,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;aACjE,MAAM,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;aACtD,IAAI,EAAE,CAAC;QACV,KAAK,MAAM,cAAc,IAAI,YAAY,EAAE,CAAC;YAC1C,KAAK,CAAC,cAAc,CAAC,CAAC;QACxB,CAAC;QAED,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/B,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC,CAAC;IAEF,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACrD,KAAK,CAAC,YAAY,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,MAAsB,EAAE,YAAoB;IAClE,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AAC/C,CAAC;AAED,gFAAgF;AAChF,oEAAoE;AACpE,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,MAAM,UAAU,6BAA6B,CAAC,MAAsB;IAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC1C,IAAI,CAAC,QAAQ;QAAE,OAAO,aAAa,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;SAC/C,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;SACvD,IAAI,EAAE,CAAC;IACV,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAAsB,EACtB,QAAmC,EACnC,mBAAqC,EAAE;IAEvC,MAAM,SAAS,GAA0C,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC1C,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,gBAAgB,GAAG,CAAC,GAAG,iBAAiB,CAAC,CAAC,MAAM,CACpD,CAAC,YAAY,EAAE,EAAE,CACf,YAAY,KAAK,wBAAwB;QACzC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAChC,CAAC;IACF,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,gBAAgB,CAAC,CAAC;IAEvE,KAAK,MAAM,YAAY,IAAI,gBAAgB,EAAE,CAAC;QAC5C,IAAI,YAAY,KAAK,wBAAwB;YAAE,SAAS;QACxD,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACrD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAEpD,MAAM,aAAa,GAAG,QAAQ,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,aAAa,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAChD,SAAS,CAAC,YAAY,CAAC,GAAG,aAAa,CAAC;YACxC,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,iBAAiB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAC5C,CAAC,yBAAyB,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;aAC5C,MAAM,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,cAAc,KAAK,wBAAwB,CAAC;aACvE,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;YACvB,cAAc;YACd,SAAS,CAAC,cAAc,CAAC,EAAE,QAAQ;gBACjC,QAAQ,EAAE,SAAS,CAAC,cAAc,CAAC,EAAE,QAAQ;gBAC7C,CAAC;SACJ,CAAC,CACL,CAAC;QAEF,MAAM,WAAW,GAAG,aAAa,EAAE,YAAY,KAAK,WAAW,CAAC;QAChE,MAAM,gBAAgB,GACpB,aAAa;YACb,eAAe,CAAC,aAAa,CAAC,oBAAoB,CAAC;gBACjD,eAAe,CAAC,mBAAmB,CAAC,CAAC;QACzC,MAAM,QAAQ,GACZ,WAAW,IAAI,gBAAgB;YAC7B,CAAC,CAAC,aAAa,CAAC,QAAQ;YACxB,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAEzC,SAAS,CAAC,YAAY,CAAC,GAAG;YACxB,QAAQ;YACR,YAAY,EAAE,WAAW;YACzB,oBAAoB,EAAE,mBAAmB;SAC1C,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,CAAC;AACvB,CAAC"}

package/dist/audit/orchestrator/auditTaskUtils.d.ts

@@ -0,0 +1,10 @@
+import type { AuditTask, Lens } from "../types.js";
+/** Lens ordering for task prioritization, derived from {@link LENS_REGISTRY}
+ * (sorted ascending by `order_weight`). Deriving this from the registry ensures
+ * every lens — including `architecture`, which was previously absent from the
+ * hardcoded array — is automatically included when added to the registry. */
+export declare const LENS_ORDER: Lens[];
+export declare function priorityRank(priority: AuditTask["priority"]): number;
+export declare function computeRiskEstimate(task: AuditTask): number;
+export declare function sortLenses(lenses: Iterable<string>): string[];
+//# sourceMappingURL=auditTaskUtils.d.ts.map

package/dist/audit/orchestrator/auditTaskUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditTaskUtils.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/auditTaskUtils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGnD;;;6EAG6E;AAC7E,eAAO,MAAM,UAAU,EAAE,IAAI,EAEV,CAAC;AAEpB,wBAAgB,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC,GAAG,MAAM,CAUpE;AAaD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAmB3D;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAK7D"}

package/dist/audit/orchestrator/auditTaskUtils.js

@@ -0,0 +1,53 @@
+import { LENS_REGISTRY } from "../types.js";
+/** Lens ordering for task prioritization, derived from {@link LENS_REGISTRY}
+ * (sorted ascending by `order_weight`). Deriving this from the registry ensures
+ * every lens — including `architecture`, which was previously absent from the
+ * hardcoded array — is automatically included when added to the registry. */
+export const LENS_ORDER = [...LENS_REGISTRY]
+    .sort((a, b) => a.order_weight - b.order_weight)
+    .map((d) => d.id);
+export function priorityRank(priority) {
+    switch (priority) {
+        case "high":
+            return 3;
+        case "medium":
+            return 2;
+        case "low":
+        default:
+            return 1;
+    }
+}
+/**
+ * Deterministic seed for a task's provider-neutral audit-risk estimate in
+ * [0,1]. Derived from the same signals the (legacy) model-tier hint used —
+ * priority, sensitive lens, critical-flow / analyzer / verification tags — so
+ * planning produces a frozen risk number that just-in-time dispatch can route
+ * on without re-deriving. The estimate-review step (N3) may refine this; it is
+ * never a model/provider decision. See
+ * docs/audit-workflow-design.md.
+ */
+const SENSITIVE_LENSES = new Set(["security", "data_integrity", "reliability"]);
+export function computeRiskEstimate(task) {
+    const base = task.priority === "high" ? 0.7 : task.priority === "medium" ? 0.4 : 0.15;
+    const tags = task.tags ?? [];
+    let bonus = 0;
+    if (tags.some((t) => t === "critical_flow" || t.startsWith("critical_flow:"))) {
+        bonus += 0.15;
+    }
+    if (tags.some((t) => t === "external_analyzer_signal" || t.startsWith("external_tool:"))) {
+        bonus += 0.1;
+    }
+    if (tags.includes("lens_verification"))
+        bonus += 0.1;
+    if (SENSITIVE_LENSES.has(task.lens))
+        bonus += 0.1;
+    const score = base + bonus;
+    return score < 0 ? 0 : score > 1 ? 1 : score;
+}
+export function sortLenses(lenses) {
+    const set = new Set(lenses);
+    const canonical = LENS_ORDER.filter((lens) => set.has(lens));
+    const custom = [...set].filter((l) => !LENS_ORDER.includes(l)).sort();
+    return [...canonical, ...custom];
+}
+//# sourceMappingURL=auditTaskUtils.js.map

package/dist/audit/orchestrator/auditTaskUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditTaskUtils.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/auditTaskUtils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C;;;6EAG6E;AAC7E,MAAM,CAAC,MAAM,UAAU,GAAW,CAAC,GAAG,aAAa,CAAC;KACjD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;KAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEpB,MAAM,UAAU,YAAY,CAAC,QAA+B;IAC1D,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,MAAM;YACT,OAAO,CAAC,CAAC;QACX,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC;QACX,KAAK,KAAK,CAAC;QACX;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC;AAEhF,MAAM,UAAU,mBAAmB,CAAC,IAAe;IACjD,MAAM,IAAI,GACR,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,eAAe,IAAI,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;QAC9E,KAAK,IAAI,IAAI,CAAC;IAChB,CAAC;IACD,IACE,IAAI,CAAC,IAAI,CACP,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,0BAA0B,IAAI,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAC1E,EACD,CAAC;QACD,KAAK,IAAI,GAAG,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAAE,KAAK,IAAI,GAAG,CAAC;IACrD,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,KAAK,IAAI,GAAG,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC;IAC3B,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAwB;IACjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,OAAO,CAAC,GAAG,SAAS,EAAE,GAAG,MAAM,CAAC,CAAC;AACnC,CAAC"}

package/dist/audit/orchestrator/autoFixExecutor.d.ts

@@ -0,0 +1,4 @@
+import type { ArtifactBundle } from "../io/artifacts.js";
+import type { ExecutorRunResult } from "./executorResult.js";
+export declare function runAutoFixExecutor(bundle: ArtifactBundle, root: string): Promise<ExecutorRunResult>;
+//# sourceMappingURL=autoFixExecutor.d.ts.map

package/dist/audit/orchestrator/autoFixExecutor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"autoFixExecutor.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/autoFixExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAyF7D,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,iBAAiB,CAAC,CAiG5B"}

package/dist/audit/orchestrator/autoFixExecutor.js

@@ -0,0 +1,152 @@
+import { access, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { isAuditExcludedStatus } from "../extractors/disposition.js";
+import { resolveNodeTool, runFirstAvailableCommand, } from "./localCommands.js";
+function tryRunConfiguredFormatter(root, candidates) {
+    const result = runFirstAvailableCommand(root, candidates);
+    if (result === null)
+        return "not_found";
+    if (!result.error && result.exitCode === 0)
+        return "success";
+    return "failed";
+}
+const PRETTIER_CONFIG_FILES = [
+    ".prettierrc",
+    ".prettierrc.json",
+    ".prettierrc.yml",
+    ".prettierrc.yaml",
+    ".prettierrc.json5",
+    ".prettierrc.js",
+    ".prettierrc.cjs",
+    ".prettierrc.mjs",
+    "prettier.config.js",
+    "prettier.config.cjs",
+    "prettier.config.mjs",
+];
+async function pathExists(target) {
+    try {
+        await access(target);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function hasPrettierConfig(root) {
+    const configChecks = await Promise.all(PRETTIER_CONFIG_FILES.map((file) => pathExists(join(root, file))));
+    if (configChecks.some(Boolean)) {
+        return true;
+    }
+    const packageJsonPath = join(root, "package.json");
+    try {
+        const packageJson = JSON.parse(await readFile(packageJsonPath, "utf8"));
+        return packageJson.prettier !== undefined;
+    }
+    catch {
+        // Missing package.json or unparseable JSON => no prettier config.
+        return false;
+    }
+}
+function runFormatter(root, toolName, candidates, executedTools, failedTools, toolTimings) {
+    const start = Date.now();
+    const outcome = tryRunConfiguredFormatter(root, candidates);
+    if (outcome === "success") {
+        executedTools.push(toolName);
+        toolTimings.push({ tool: toolName, duration_ms: Date.now() - start });
+    }
+    else if (outcome === "failed") {
+        failedTools.push(toolName);
+        process.stderr.write(JSON.stringify({
+            kind: "auto_fix_formatter_failed",
+            tool: toolName,
+            duration_ms: Date.now() - start,
+            ts: new Date().toISOString(),
+        }) + "\n");
+    }
+}
+export async function runAutoFixExecutor(bundle, root) {
+    if (!bundle.file_disposition) {
+        throw new Error("Cannot run auto fix executor without file_disposition");
+    }
+    const extensions = new Set();
+    for (const file of bundle.file_disposition.files) {
+        if (!isAuditExcludedStatus(file.status)) {
+            const match = file.path.match(/\.([^.]+)$/);
+            if (match) {
+                extensions.add(match[1].toLowerCase());
+            }
+        }
+    }
+    const executedTools = [];
+    const failedTools = [];
+    const toolTimings = [];
+    // JS, TS, HTML, CSS, JSON, YAML, MD
+    if ((await hasPrettierConfig(root)) &&
+        (extensions.has("ts") ||
+            extensions.has("js") ||
+            extensions.has("tsx") ||
+            extensions.has("jsx") ||
+            extensions.has("html") ||
+            extensions.has("css") ||
+            extensions.has("json") ||
+            extensions.has("yml") ||
+            extensions.has("yaml") ||
+            extensions.has("md"))) {
+        runFormatter(root, "prettier", [
+            ...resolveNodeTool(root, join("node_modules", "prettier", "bin", "prettier.cjs"), ["--write", "."], "prettier --write ."),
+            { command: "prettier", args: ["--write", "."], display: "prettier --write ." },
+            { command: "npx", args: ["--yes", "prettier", "--write", "."], display: "npx --yes prettier --write ." },
+        ], executedTools, failedTools, toolTimings);
+    }
+    // Python
+    if (extensions.has("py")) {
+        runFormatter(root, "black", [
+            { command: "black", args: ["."], display: "black ." },
+            { command: "python", args: ["-m", "black", "."], display: "python -m black ." },
+            { command: "uvx", args: ["black", "."], display: "uvx black ." },
+            { command: "pipx", args: ["run", "black", "."], display: "pipx run black ." },
+        ], executedTools, failedTools, toolTimings);
+    }
+    // SQL
+    if (extensions.has("sql")) {
+        runFormatter(root, "sqlfluff", [
+            { command: "sqlfluff", args: ["fix", "--force", "."], display: "sqlfluff fix --force ." },
+            { command: "uvx", args: ["sqlfluff", "fix", "--force", "."], display: "uvx sqlfluff fix --force ." },
+            { command: "pipx", args: ["run", "sqlfluff", "fix", "--force", "."], display: "pipx run sqlfluff fix --force ." },
+        ], executedTools, failedTools, toolTimings);
+    }
+    // Go
+    if (extensions.has("go")) {
+        runFormatter(root, "gofmt", [
+            { command: "gofmt", args: ["-w", "."], display: "gofmt -w ." },
+        ], executedTools, failedTools, toolTimings);
+    }
+    const resultsArtifact = {
+        executed_tools: executedTools,
+        failed_tools: failedTools,
+        tool_timings: toolTimings,
+        timestamp: new Date().toISOString(),
+    };
+    let progressDetail;
+    if (executedTools.length === 0 && failedTools.length === 0) {
+        progressDetail = "Formatters executed: None.";
+    }
+    else if (failedTools.length === 0) {
+        progressDetail = `Formatters executed: ${executedTools.join(", ")}.`;
+    }
+    else if (executedTools.length === 0) {
+        progressDetail = `Formatters executed: None. Formatters failed: ${failedTools.join(", ")}.`;
+    }
+    else {
+        progressDetail = `Formatters executed: ${executedTools.join(", ")}. Formatters failed: ${failedTools.join(", ")}.`;
+    }
+    return {
+        updated: {
+            ...bundle,
+            auto_fixes_applied: resultsArtifact,
+        },
+        artifacts_written: ["auto_fixes_applied.json"],
+        progress_summary: `Phase 1 Deterministic Auto-Fix complete. ${progressDetail}`,
+    };
+}
+//# sourceMappingURL=autoFixExecutor.js.map

package/dist/audit/orchestrator/autoFixExecutor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"autoFixExecutor.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/autoFixExecutor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EACL,eAAe,EACf,wBAAwB,GAEzB,MAAM,oBAAoB,CAAC;AAE5B,SAAS,yBAAyB,CAChC,IAAY,EACZ,UAAmC;IAEnC,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,WAAW,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,qBAAqB,GAAG;IAC5B,aAAa;IACb,kBAAkB;IAClB,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,oBAAoB;IACpB,qBAAqB;IACrB,qBAAqB;CACtB,CAAC;AAEF,KAAK,UAAU,UAAU,CAAC,MAAc;IACtC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CACpC,qBAAqB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAClE,CAAC;IACF,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAErE,CAAC;QACF,OAAO,WAAW,CAAC,QAAQ,KAAK,SAAS,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,IAAY,EACZ,QAAgB,EAChB,UAAmC,EACnC,aAAuB,EACvB,WAAqB,EACrB,WAAoD;IAEpD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC5D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7B,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;SAAM,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC/B,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC,GAAG,IAAI,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAsB,EACtB,IAAY;IAEZ,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QACjD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC5C,IAAI,KAAK,EAAE,CAAC;gBACV,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,WAAW,GAA4C,EAAE,CAAC;IAEhE,oCAAoC;IACpC,IACE,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YACnB,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YACpB,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;YACrB,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;YACrB,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;YACtB,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;YACrB,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;YACtB,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;YACrB,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;YACtB,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EACvB,CAAC;QACD,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE;YAC7B,GAAG,eAAe,CAChB,IAAI,EACJ,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,CAAC,EACvD,CAAC,SAAS,EAAE,GAAG,CAAC,EAChB,oBAAoB,CACrB;YACD,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE;YAC9E,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE;SACzG,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED,SAAS;IACT,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE;YAC1B,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE;YACrD,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE;YAC/E,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE;YAChE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE;SAC9E,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM;IACN,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE;YAC7B,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE;YACzF,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE;YACpG,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE;SAClH,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK;IACL,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE;YAC1B,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE;SAC/D,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,eAAe,GAAG;QACtB,cAAc,EAAE,aAAa;QAC7B,YAAY,EAAE,WAAW;QACzB,YAAY,EAAE,WAAW;QACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,IAAI,cAAsB,CAAC;IAC3B,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,cAAc,GAAG,4BAA4B,CAAC;IAChD,CAAC;SAAM,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,cAAc,GAAG,wBAAwB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACvE,CAAC;SAAM,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,cAAc,GAAG,iDAAiD,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAC9F,CAAC;SAAM,CAAC;QACN,cAAc,GAAG,wBAAwB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACrH,CAAC;IAED,OAAO;QACL,OAAO,EAAE;YACP,GAAG,MAAM;YACT,kBAAkB,EAAE,eAAe;SACpC;QACD,iBAAiB,EAAE,CAAC,yBAAyB,CAAC;QAC9C,gBAAgB,EAAE,4CAA4C,cAAc,EAAE;KAC/E,CAAC;AACJ,CAAC"}

package/dist/audit/orchestrator/chunking.d.ts

@@ -0,0 +1,6 @@
+export interface LineRange {
+    start: number;
+    end: number;
+}
+export declare function chunkLineCount(totalLines: number, chunkSize?: number): LineRange[];
+//# sourceMappingURL=chunking.d.ts.map

package/dist/audit/orchestrator/chunking.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunking.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/chunking.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,SAAS,SAAM,GACd,SAAS,EAAE,CAeb"}

package/dist/audit/orchestrator/chunking.js

@@ -0,0 +1,14 @@
+export function chunkLineCount(totalLines, chunkSize = 200) {
+    if (totalLines <= 0) {
+        return [];
+    }
+    const ranges = [];
+    let start = 1;
+    while (start <= totalLines) {
+        const end = Math.min(start + chunkSize - 1, totalLines);
+        ranges.push({ start, end });
+        start = end + 1;
+    }
+    return ranges;
+}
+//# sourceMappingURL=chunking.js.map

package/dist/audit/orchestrator/chunking.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunking.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/chunking.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,cAAc,CAC5B,UAAkB,EAClB,SAAS,GAAG,GAAG;IAEf,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,OAAO,KAAK,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,SAAS,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5B,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/audit/orchestrator/dependencyMap.d.ts

@@ -0,0 +1,74 @@
+import { ARTIFACT_DEFINITIONS, AUDIT_REPORT_FILENAME } from "../io/artifacts.js";
+import { AGENT_FEEDBACK_FILENAME } from "audit-tools/shared";
+/**
+ * The canonical set of artifact filenames, derived from ARTIFACT_DEFINITIONS
+ * (the single source of truth) plus the two special-cased files that participate
+ * in the staleness DAG but are not writable registry entries.
+ *
+ * Constraining the canonical map to this type means a typo or a stale filename
+ * literal (after a rename) is caught at compile time rather than silently
+ * producing a no-op staleness edge.
+ */
+type ArtifactFileName = (typeof ARTIFACT_DEFINITIONS)[keyof typeof ARTIFACT_DEFINITIONS]["fileName"] | typeof AGENT_FEEDBACK_FILENAME | typeof AUDIT_REPORT_FILENAME;
+type DependencyMap = Partial<Record<ArtifactFileName, ArtifactFileName[]>>;
+/**
+ * THE single canonical staleness DAG (ARC-cebe3421).
+ *
+ * Keyed by an artifact → the list of artifacts it DEPENDS ON (its upstream
+ * inputs). When any upstream input's content hash or revision changes, this
+ * artifact is stale and must be rebuilt. This is the natural direction for
+ * `computeArtifactMetadata` (which records each artifact's dependency
+ * revisions) and reduces stale detection to a single revision/hash compare
+ * against the recorded upstream revisions.
+ *
+ * The forward "X → its dependents" view (`ARTIFACT_DEPENDENTS_MAP`, used by
+ * `computeStaleArtifacts` to propagate staleness downstream) is DERIVED from
+ * this table by `invertDependencyMap` — it is not maintained separately, so the
+ * two can never drift. There is exactly one hand-authored adjacency
+ * representation; everything else is computed from it.
+ *
+ * `satisfies` (rather than a type annotation) keeps the literal's precise keys
+ * for downstream `keyof`-style derivations while still type-checking every key
+ * and value against the known artifact filenames.
+ */
+export declare const ARTIFACT_DEPENDS_ON_MAP: {
+    "repo_manifest.json": string[];
+    "file_disposition.json": string[];
+    "graph_bundle.json": string[];
+    "analyzer_capability.json": string[];
+    "unit_manifest.json": string[];
+    "surface_manifest.json": string[];
+    "critical_flows.json": string[];
+    "risk_register.json": string[];
+    "design_assessment.json": string[];
+    "coverage_matrix.json": string[];
+    "audit_tasks.json": string[];
+    "audit_plan_metrics.json": string[];
+    "task_affinity_graph.json": string[];
+    "flow_coverage.json": string[];
+    "requeue_tasks.json": string[];
+    "runtime_validation_tasks.json": string[];
+    "runtime_validation_report.json": string[];
+    "audit-report.md": string[];
+    "synthesis-narrative.json": string[];
+};
+/**
+ * Forward staleness adjacency: keyed by an UPSTREAM artifact → the list of
+ * DOWNSTREAM artifacts that depend on it (and so become stale when it changes).
+ * DERIVED from `ARTIFACT_DEPENDS_ON_MAP` (the single canonical table) — never
+ * hand-maintained, so it cannot drift from the dependency direction.
+ * `computeStaleArtifacts` uses this view to propagate staleness downstream.
+ */
+export declare const ARTIFACT_DEPENDENTS_MAP: DependencyMap;
+/**
+ * Every artifact participating in the staleness DAG — the union of those that
+ * depend on something (`ARTIFACT_DEPENDS_ON_MAP` keys) and those that are
+ * depended upon (`ARTIFACT_DEPENDENTS_MAP` keys, i.e. leaf inputs like
+ * scope.json / intent_checkpoint.json that have no upstream of their own).
+ * `computeArtifactMetadata` enumerates present artifacts from this set so a
+ * pure-input artifact still gets a metadata entry (and so its dependents can
+ * compare against its revision).
+ */
+export declare const ALL_DAG_ARTIFACTS: ReadonlySet<string>;
+export {};
+//# sourceMappingURL=dependencyMap.d.ts.map

package/dist/audit/orchestrator/dependencyMap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencyMap.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/dependencyMap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D;;;;;;;;GAQG;AACH,KAAK,gBAAgB,GACjB,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAC,UAAU,CAAC,GAC5E,OAAO,uBAAuB,GAC9B,OAAO,qBAAqB,CAAC;AAEjC,KAAK,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;AAE3E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;CAwIX,CAAC;AAkB1B;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAE,aACQ,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAGhD,CAAC"}