audit-tools 0.28.0

package/dist/audit/orchestrator/planning.js

@@ -0,0 +1,81 @@
+import { applyUnitCoverage, createCoverageMatrix, markExcludedPath, } from "../coverage.js";
+import { isAuditExcludedStatus } from "../extractors/disposition.js";
+import { hasBrowserExtensionManifestFile } from "../extractors/browserExtension.js";
+import { deriveRequiredLensesForPath } from "./unitBuilder.js";
+const CATEGORY_LENS_TABLE = [
+    [["security", "secret"], ["security", "correctness"]],
+    [["dependency", "vuln"], ["security", "config_deployment"]],
+    [["tests", "coverage"], ["tests"]],
+    [["data"], ["data_integrity", "correctness"]],
+    [["reliability", "concurrency"], ["reliability", "correctness"]],
+    [["maintainability", "lint", "style"], ["maintainability"]],
+];
+function analyzerCategoryToLenses(category) {
+    const normalized = category.toLowerCase();
+    for (const [keywords, lenses] of CATEGORY_LENS_TABLE) {
+        if (keywords.some((kw) => normalized.includes(kw))) {
+            return lenses;
+        }
+    }
+    return ["correctness"];
+}
+function applyAnalyzerCoverage(coverage, externalAnalyzerResults) {
+    if (!externalAnalyzerResults) {
+        return;
+    }
+    const coverageByPath = new Map(coverage.files.map((file) => [file.path, file]));
+    const results = Array.isArray(externalAnalyzerResults.results)
+        ? externalAnalyzerResults.results
+        : [];
+    for (const result of results) {
+        if (!result ||
+            typeof result.path !== "string" ||
+            typeof result.category !== "string") {
+            continue;
+        }
+        const record = coverageByPath.get(result.path);
+        if (!record || record.audit_status === "excluded") {
+            continue;
+        }
+        const extraLenses = analyzerCategoryToLenses(result.category);
+        record.required_lenses = [
+            ...new Set([...record.required_lenses, ...extraLenses]),
+        ];
+        if (record.classification_status === "unclassified") {
+            record.classification_status = "classified";
+        }
+    }
+}
+export function initializeCoverageFromPlan(repoManifest, unitManifest, disposition, externalAnalyzerResults) {
+    const coverage = createCoverageMatrix(repoManifest.files.map((file) => file.path));
+    const isBrowserExtensionProject = hasBrowserExtensionManifestFile(repoManifest);
+    const dispositionMap = new Map(disposition.files.map((item) => [item.path, item.status]));
+    for (const file of repoManifest.files) {
+        const status = dispositionMap.get(file.path);
+        if (status && isAuditExcludedStatus(status)) {
+            markExcludedPath(coverage, file.path, status);
+        }
+    }
+    const unitIdsByPath = new Map();
+    for (const unit of unitManifest.units) {
+        for (const path of unit.files) {
+            const existing = unitIdsByPath.get(path) ?? [];
+            if (!existing.includes(unit.unit_id)) {
+                existing.push(unit.unit_id);
+            }
+            unitIdsByPath.set(path, existing);
+        }
+    }
+    for (const file of repoManifest.files) {
+        const unitIds = unitIdsByPath.get(file.path) ?? [];
+        const requiredLenses = deriveRequiredLensesForPath(file.path, {
+            isBrowserExtensionProject,
+        });
+        for (const unitId of unitIds) {
+            applyUnitCoverage(coverage, file.path, unitId, requiredLenses);
+        }
+    }
+    applyAnalyzerCoverage(coverage, externalAnalyzerResults);
+    return coverage;
+}
+//# sourceMappingURL=planning.js.map

package/dist/audit/orchestrator/planning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"planning.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/planning.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AASxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAI/D,MAAM,mBAAmB,GAAkB;IACzC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACrD,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;IAC3D,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IAChE,CAAC,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC;CAC5D,CAAC;AAEF,SAAS,wBAAwB,CAAC,QAAgB;IAChD,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACrD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACnD,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,aAAa,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAAwB,EACxB,uBAAiD;IAEjD,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC7B,OAAO;IACT,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAChD,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,uBAAuB,CAAC,OAAO,CAAC;QAC5D,CAAC,CAAC,uBAAuB,CAAC,OAAO;QACjC,CAAC,CAAC,EAAE,CAAC;IACP,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IACE,CAAC,MAAM;YACP,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC/B,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EACnC,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YAClD,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9D,MAAM,CAAC,eAAe,GAAG;YACvB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,eAAe,EAAE,GAAG,WAAW,CAAC,CAAC;SACxD,CAAC;QACF,IAAI,MAAM,CAAC,qBAAqB,KAAK,cAAc,EAAE,CAAC;YACpD,MAAM,CAAC,qBAAqB,GAAG,YAAY,CAAC;QAC9C,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,YAA0B,EAC1B,YAA0B,EAC1B,WAA4B,EAC5B,uBAAiD;IAEjD,MAAM,QAAQ,GAAG,oBAAoB,CACnC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAC5C,CAAC;IACF,MAAM,yBAAyB,GAAG,+BAA+B,CAAC,YAAY,CAAC,CAAC;IAChF,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAC1D,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoB,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;YACD,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,cAAc,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,EAAE;YAC5D,yBAAyB;SAC1B,CAAC,CAAC;QAEH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,qBAAqB,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;IACzD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/audit/orchestrator/planningExecutors.d.ts

@@ -0,0 +1,21 @@
+import type { ArtifactBundle } from "../io/artifacts.js";
+import type { AuditScopeManifest } from "../types/auditScope.js";
+import type { ExecutorRunResult } from "./executorResult.js";
+import type { Lens } from "../types.js";
+/**
+ * Interpret a free-form intent string into lenses to priority-boost.
+ *
+ * Single authority: this delegates to the shared clause-aware interpreter via
+ * `interpretFreeFormIntentForAudit` (→ `audit-tools/shared` `interpretIntent`).
+ * There is exactly one keyword/lens map in the codebase — the shared
+ * `LENS_KEYWORD_MAP`. Lens boosts are derived from the `lens_weight` encoded
+ * clauses; unencodable clauses are NOT silently dropped here — they are gated
+ * upstream as blocking checkpoint questions (see `state.ts`
+ * `intent_checkpoint_current` and `confirmIntentStep.ts`).
+ *
+ * Deterministic — no LLM call.
+ * INV-S04: the verbatim intent string never appears in output fields.
+ */
+export declare function interpretFreeFormIntent(text: string): Lens[];
+export declare function runPlanningExecutor(bundle: ArtifactBundle, root: string, lineIndex?: Record<string, number>, sizeIndex?: Record<string, number>, scope?: AuditScopeManifest): Promise<ExecutorRunResult>;
+//# sourceMappingURL=planningExecutors.d.ts.map

package/dist/audit/orchestrator/planningExecutors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"planningExecutors.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/planningExecutors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AA2BjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,EAAa,IAAI,EAAE,MAAM,aAAa,CAAC;AAMnD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,CAU5D;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,EACtC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,KAAK,CAAC,EAAE,kBAAkB,GACzB,OAAO,CAAC,iBAAiB,CAAC,CAkO5B"}

package/dist/audit/orchestrator/planningExecutors.js

@@ -0,0 +1,228 @@
+import { initializeCoverageFromPlan } from "./planning.js";
+import { applyIntentExclusionsToCoverage, applyScopeToCoverage, fullAuditScope, } from "./scope.js";
+import { buildFlowCoverage } from "./flowCoverage.js";
+import { buildRequeuePayload } from "./requeueCommand.js";
+import { buildRuntimeValidationTasks, discoverRuntimeValidationCommand, mergeRuntimeValidationReport, } from "./runtimeValidation.js";
+import { buildChunkedAuditTasks, } from "./taskBuilder.js";
+import { buildAuditPlanMetrics, sizeIndexFromManifest, } from "./reviewPackets.js";
+import { taskContentTokens } from "./reviewPacketSizing.js";
+import { computeRiskEstimate } from "./auditTaskUtils.js";
+import { buildTaskAffinityGraph } from "./taskAffinityGraph.js";
+import { resolveEffectiveLenses } from "./lensSelection.js";
+import { autoCompleteTrivialCoverage } from "./trivialAudit.js";
+import { interpretFreeFormIntentForAudit } from "./intentInterpreter.js";
+// ---------------------------------------------------------------------------
+// Free-form intent interpreter (keyword → lens boost, deterministic, no LLM)
+// ---------------------------------------------------------------------------
+/**
+ * Interpret a free-form intent string into lenses to priority-boost.
+ *
+ * Single authority: this delegates to the shared clause-aware interpreter via
+ * `interpretFreeFormIntentForAudit` (→ `audit-tools/shared` `interpretIntent`).
+ * There is exactly one keyword/lens map in the codebase — the shared
+ * `LENS_KEYWORD_MAP`. Lens boosts are derived from the `lens_weight` encoded
+ * clauses; unencodable clauses are NOT silently dropped here — they are gated
+ * upstream as blocking checkpoint questions (see `state.ts`
+ * `intent_checkpoint_current` and `confirmIntentStep.ts`).
+ *
+ * Deterministic — no LLM call.
+ * INV-S04: the verbatim intent string never appears in output fields.
+ */
+export function interpretFreeFormIntent(text) {
+    if (!text || text.trim().length === 0)
+        return [];
+    const interpretation = interpretFreeFormIntentForAudit(text);
+    const boosts = new Set();
+    for (const clause of interpretation.encoded_clauses) {
+        if (clause.kind === "lens_weight" && clause.lens) {
+            boosts.add(clause.lens);
+        }
+    }
+    return [...boosts];
+}
+export async function runPlanningExecutor(bundle, root, lineIndex = {}, sizeIndex, scope) {
+    if (!bundle.repo_manifest) {
+        throw new Error("Cannot run planning executor without repo_manifest");
+    }
+    const resolvedSizeIndex = sizeIndex ?? sizeIndexFromManifest(bundle.repo_manifest);
+    if (!bundle.file_disposition ||
+        !bundle.unit_manifest ||
+        !bundle.surface_manifest ||
+        !bundle.critical_flows ||
+        !bundle.risk_register) {
+        throw new Error("Cannot run planning executor without current structure artifacts");
+    }
+    const resolvedScope = scope ?? fullAuditScope();
+    const externalAnalyzerResults = bundle.external_analyzer_results;
+    // Apply disposition_overrides before coverage initialization so overridden
+    // files never enter coverage at all (not just filtered after).
+    // Supports exact path match and prefix match (entry.path or entry.path + '/').
+    const dispositionOverrides = bundle.intent_checkpoint?.disposition_overrides;
+    let effectiveFileDisposition = bundle.file_disposition;
+    if (dispositionOverrides && dispositionOverrides.length > 0) {
+        effectiveFileDisposition = {
+            ...bundle.file_disposition,
+            files: bundle.file_disposition.files.map((f) => {
+                for (const override of dispositionOverrides) {
+                    if (f.path === override.path ||
+                        f.path.startsWith(override.path + "/")) {
+                        return { ...f, status: override.status, reason: override.reason };
+                    }
+                }
+                return f;
+            }),
+        };
+    }
+    // Resolve effective lenses from lens_selection (mandatory lenses always
+    // included; resolveEffectiveLenses enforces this invariant).
+    const lensSelectionInclude = bundle.intent_checkpoint?.lens_selection?.include;
+    const lensSelectionExclude = bundle.intent_checkpoint?.lens_selection?.exclude;
+    let effectiveLenses;
+    if (lensSelectionInclude !== undefined || lensSelectionExclude !== undefined) {
+        // Build a selected set: start from include (or all), subtract exclude
+        const baseSelected = lensSelectionInclude ?? undefined;
+        const resolved = resolveEffectiveLenses(baseSelected ?? null);
+        if (lensSelectionExclude && lensSelectionExclude.length > 0) {
+            const excludeSet = new Set(lensSelectionExclude);
+            // resolveEffectiveLenses already enforces mandatory lenses; we just
+            // need to apply the exclude filter after re-resolving
+            const afterExclude = resolved.filter((l) => !excludeSet.has(l));
+            // resolveEffectiveLenses ensures mandatory lenses are always present —
+            // call again with afterExclude so mandatory lenses are re-unioned in
+            effectiveLenses = resolveEffectiveLenses(afterExclude);
+        }
+        else {
+            effectiveLenses = resolved;
+        }
+    }
+    const coverage = initializeCoverageFromPlan(bundle.repo_manifest, bundle.unit_manifest, effectiveFileDisposition, externalAnalyzerResults);
+    const skippedTrivialPaths = autoCompleteTrivialCoverage(coverage, lineIndex, externalAnalyzerResults);
+    // Delta scope: only seed + expanded files stay pending; the rest inherit prior
+    // completion or are excluded from this run. Full scope is a no-op.
+    applyScopeToCoverage(coverage, resolvedScope, bundle.coverage_matrix);
+    // Layer the host-confirmed intent exclusions on top of disposition + scope so
+    // user-pruned scope pollution never becomes an audit task.
+    const intentExcludedPaths = applyIntentExclusionsToCoverage(coverage, bundle.intent_checkpoint?.excluded_scope);
+    const flowCoverage = buildFlowCoverage(bundle.critical_flows, coverage);
+    const runtimeCommand = await discoverRuntimeValidationCommand(root);
+    const runtimeValidationTasks = buildRuntimeValidationTasks({
+        unitManifest: bundle.unit_manifest,
+        criticalFlows: bundle.critical_flows,
+        flowCoverage,
+        command: runtimeCommand,
+    });
+    const runtimeValidationReport = runtimeValidationTasks.tasks.length > 0
+        ? mergeRuntimeValidationReport(runtimeValidationTasks, bundle.runtime_validation_report)
+        : undefined;
+    // Interpret free_form_intent into lens priority boosts via the single shared
+    // clause-aware authority (deterministic, no LLM). Unencodable clauses are NOT
+    // dropped here — they are gated upstream as a blocking checkpoint question
+    // (state.ts intent_checkpoint_current), so by the time planning runs every
+    // clause is either an encoded signal or an explicitly host-answered constraint.
+    const freeFormIntent = bundle.intent_checkpoint?.free_form_intent ?? "";
+    const intentBoostLenses = interpretFreeFormIntent(freeFormIntent);
+    if (freeFormIntent.trim().length > 0) {
+        const interpretation = interpretFreeFormIntentForAudit(freeFormIntent);
+        // INV-S04: derived signal only — never the verbatim free_form_intent. Each
+        // encoded clause's `detail` is a generated description, not the raw input.
+        const encodedSignals = interpretation.encoded_clauses.map((c) => `${c.kind}${c.lens ? `:${c.lens}` : ""}`);
+        process.stderr.write(JSON.stringify({
+            kind: "intent_keyword_interpretation",
+            boosted_lenses: intentBoostLenses,
+            encoded_signals: encodedSignals,
+            ts: new Date().toISOString(),
+        }) + "\n");
+    }
+    const auditTasks = buildChunkedAuditTasks(coverage, lineIndex, {
+        external_analyzer_results: externalAnalyzerResults,
+        critical_flows: bundle.critical_flows,
+        ...(effectiveLenses !== undefined ? { limit_lenses: effectiveLenses } : {}),
+        ...(intentBoostLenses.length > 0 ? { intent_priority_boost: intentBoostLenses } : {}),
+    });
+    const taggedAuditTasks = auditTasks.map((task) => ({
+        ...task,
+        status: task.status ?? "pending",
+    }));
+    const requeuePayload = buildRequeuePayload(coverage, bundle.critical_flows, flowCoverage, externalAnalyzerResults);
+    // Fold pending requeue tasks into the dispatch task list so mandatory coverage
+    // gaps produce actual dispatch packets. Enrich with line-count hints from the
+    // index and dedupe against existing audit tasks by task_id so each task
+    // appears exactly once in the merged list.
+    const existingTaskIds = new Set(taggedAuditTasks.map((t) => t.task_id));
+    const pendingRequeueTasks = requeuePayload.tasks
+        .filter((t) => t.status === "pending")
+        .filter((t) => !existingTaskIds.has(t.task_id))
+        .map((t) => ({
+        ...t,
+        file_line_counts: Object.fromEntries(t.file_paths
+            .filter((p) => lineIndex[p] != null)
+            .map((p) => [p, lineIndex[p]])),
+    }));
+    // Freeze provider-neutral estimates on every dispatch task: a byte-based
+    // token estimate and a deterministic risk seed. These persist on the task and
+    // become the authoritative inputs to just-in-time dispatch packetization /
+    // routing (the estimate-review step may later refine them). See
+    // docs/audit-workflow-design.md.
+    const freezeEstimates = (task) => ({
+        ...task,
+        token_estimate: task.token_estimate ??
+            taskContentTokens(task, resolvedSizeIndex, lineIndex),
+        risk_estimate: task.risk_estimate ?? computeRiskEstimate(task),
+    });
+    const enrichedAuditTasks = taggedAuditTasks.map(freezeEstimates);
+    const allDispatchTasks = [
+        ...enrichedAuditTasks,
+        ...pendingRequeueTasks.map(freezeEstimates),
+    ];
+    // Provider-neutral task-affinity graph (Phase A of the plan/dispatch seam):
+    // frozen task nodes + soft weighted affinity edges. Dispatch partitions this
+    // just-in-time; see docs/audit-workflow-design.md.
+    const taskAffinityGraph = buildTaskAffinityGraph(allDispatchTasks, {
+        graphBundle: bundle.graph_bundle,
+    });
+    const auditPlanMetrics = buildAuditPlanMetrics(allDispatchTasks, {
+        graphBundle: bundle.graph_bundle,
+        lineIndex,
+        sizeIndex: resolvedSizeIndex,
+    });
+    const scopeSummary = resolvedScope.mode === "delta"
+        ? ` Delta scope since ${resolvedScope.since}: ${resolvedScope.seed_files.length} changed file(s) + ${resolvedScope.expanded_files.length} graph neighbour(s) queued; a full audit is advised before release.`
+        : "";
+    return {
+        updated: {
+            ...bundle,
+            scope: resolvedScope,
+            coverage_matrix: coverage,
+            flow_coverage: flowCoverage,
+            runtime_validation_tasks: runtimeValidationTasks,
+            runtime_validation_report: runtimeValidationReport,
+            audit_tasks: enrichedAuditTasks,
+            audit_plan_metrics: auditPlanMetrics,
+            task_affinity_graph: taskAffinityGraph,
+            requeue_tasks: requeuePayload.tasks,
+            audit_report: undefined,
+        },
+        artifacts_written: [
+            "scope.json",
+            "coverage_matrix.json",
+            "flow_coverage.json",
+            "runtime_validation_tasks.json",
+            ...(runtimeValidationReport ? ["runtime_validation_report.json"] : []),
+            "audit_tasks.json",
+            "audit_plan_metrics.json",
+            "requeue_tasks.json",
+        ],
+        progress_summary: `Built planning artifacts; generated ${taggedAuditTasks.length} review tasks (packets partition just-in-time at dispatch) and ${requeuePayload.task_count} requeue tasks.` +
+            scopeSummary +
+            (skippedTrivialPaths.length > 0
+                ? ` Skipped ${skippedTrivialPaths.length} trivial path${skippedTrivialPaths.length === 1 ? "" : "s"} from semantic review.`
+                : "") +
+            (intentExcludedPaths.length > 0
+                ? ` Excluded ${intentExcludedPaths.length} path${intentExcludedPaths.length === 1 ? "" : "s"} per the intent checkpoint.`
+                : "") +
+            (runtimeCommand
+                ? ` Runtime validation will use: ${runtimeCommand.join(" ")}.`
+                : " No deterministic runtime validation command was discovered."),
+    };
+}
+//# sourceMappingURL=planningExecutors.js.map

package/dist/audit/orchestrator/planningExecutors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"planningExecutors.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/planningExecutors.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACL,+BAA+B,EAC/B,oBAAoB,EACpB,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,EAChC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAIzE,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,cAAc,GAAG,+BAA+B,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAQ,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,CAAC;QACpD,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YACjD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAsB,EACtB,IAAY,EACZ,YAAoC,EAAE,EACtC,SAAkC,EAClC,KAA0B;IAE1B,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,iBAAiB,GAAG,SAAS,IAAI,qBAAqB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACnF,IACE,CAAC,MAAM,CAAC,gBAAgB;QACxB,CAAC,MAAM,CAAC,aAAa;QACrB,CAAC,MAAM,CAAC,gBAAgB;QACxB,CAAC,MAAM,CAAC,cAAc;QACtB,CAAC,MAAM,CAAC,aAAa,EACrB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,KAAK,IAAI,cAAc,EAAE,CAAC;IAChD,MAAM,uBAAuB,GAAG,MAAM,CAAC,yBAAyB,CAAC;IAEjE,2EAA2E;IAC3E,+DAA+D;IAC/D,+EAA+E;IAC/E,MAAM,oBAAoB,GAAG,MAAM,CAAC,iBAAiB,EAAE,qBAAqB,CAAC;IAC7E,IAAI,wBAAwB,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACvD,IAAI,oBAAoB,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,wBAAwB,GAAG;YACzB,GAAG,MAAM,CAAC,gBAAgB;YAC1B,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC7C,KAAK,MAAM,QAAQ,IAAI,oBAAoB,EAAE,CAAC;oBAC5C,IACE,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;wBACxB,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC,EACtC,CAAC;wBACD,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACpE,CAAC;gBACH,CAAC;gBACD,OAAO,CAAC,CAAC;YACX,CAAC,CAAC;SACH,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,6DAA6D;IAC7D,MAAM,oBAAoB,GAAG,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,OAAO,CAAC;IAC/E,MAAM,oBAAoB,GAAG,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,OAAO,CAAC;IAC/E,IAAI,eAAqC,CAAC;IAC1C,IAAI,oBAAoB,KAAK,SAAS,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAC7E,sEAAsE;QACtE,MAAM,YAAY,GAAG,oBAAoB,IAAI,SAAS,CAAC;QACvD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC;QAC9D,IAAI,oBAAoB,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,CAAC;YACjD,oEAAoE;YACpE,sDAAsD;YACtD,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,uEAAuE;YACvE,qEAAqE;YACrE,eAAe,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,eAAe,GAAG,QAAQ,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,0BAA0B,CACzC,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,aAAa,EACpB,wBAAwB,EACxB,uBAAuB,CACxB,CAAC;IACF,MAAM,mBAAmB,GAAG,2BAA2B,CACrD,QAAQ,EACR,SAAS,EACT,uBAAuB,CACxB,CAAC;IACF,+EAA+E;IAC/E,mEAAmE;IACnE,oBAAoB,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IACtE,8EAA8E;IAC9E,2DAA2D;IAC3D,MAAM,mBAAmB,GAAG,+BAA+B,CACzD,QAAQ,EACR,MAAM,CAAC,iBAAiB,EAAE,cAAc,CACzC,CAAC;IACF,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,MAAM,gCAAgC,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;QACzD,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,aAAa,EAAE,MAAM,CAAC,cAAc;QACpC,YAAY;QACZ,OAAO,EAAE,cAAc;KACxB,CAAC,CAAC;IACH,MAAM,uBAAuB,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACrE,CAAC,CAAC,4BAA4B,CAC1B,sBAAsB,EACtB,MAAM,CAAC,yBAAyB,CACjC;QACH,CAAC,CAAC,SAAS,CAAC;IACd,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,IAAI,EAAE,CAAC;IACxE,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;IAClE,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,cAAc,GAAG,+BAA+B,CAAC,cAAc,CAAC,CAAC;QACvE,2EAA2E;QAC3E,2EAA2E;QAC3E,MAAM,cAAc,GAAG,cAAc,CAAC,eAAe,CAAC,GAAG,CACvD,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAChD,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,+BAA+B;YACrC,cAAc,EAAE,iBAAiB;YACjC,eAAe,EAAE,cAAc;YAC/B,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC,GAAG,IAAI,CACV,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,EAAE,SAAS,EAAE;QAC7D,yBAAyB,EAAE,uBAAuB;QAClD,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjD,GAAG,IAAI;QACP,MAAM,EAAE,IAAI,CAAC,MAAM,IAAK,SAAmB;KAC5C,CAAC,CAAC,CAAC;IACJ,MAAM,cAAc,GAAG,mBAAmB,CACxC,QAAQ,EACR,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,uBAAuB,CACxB,CAAC;IACF,+EAA+E;IAC/E,8EAA8E;IAC9E,wEAAwE;IACxE,2CAA2C;IAC3C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,MAAM,mBAAmB,GAAG,cAAc,CAAC,KAAK;SAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;SAC9C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,GAAG,CAAC;QACJ,gBAAgB,EAAE,MAAM,CAAC,WAAW,CAClC,CAAC,CAAC,UAAU;aACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;aACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CACjC;KACF,CAAC,CAAC,CAAC;IACN,yEAAyE;IACzE,8EAA8E;IAC9E,2EAA2E;IAC3E,gEAAgE;IAChE,iCAAiC;IACjC,MAAM,eAAe,GAAG,CAAC,IAAe,EAAa,EAAE,CAAC,CAAC;QACvD,GAAG,IAAI;QACP,cAAc,EACZ,IAAI,CAAC,cAAc;YACnB,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,EAAE,SAAS,CAAC;QACvD,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,mBAAmB,CAAC,IAAI,CAAC;KAC/D,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACjE,MAAM,gBAAgB,GAAG;QACvB,GAAG,kBAAkB;QACrB,GAAG,mBAAmB,CAAC,GAAG,CAAC,eAAe,CAAC;KAC5C,CAAC;IAEF,4EAA4E;IAC5E,6EAA6E;IAC7E,mDAAmD;IACnD,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,gBAAgB,EAAE;QACjE,WAAW,EAAE,MAAM,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,gBAAgB,EAAE;QAC/D,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,SAAS;QACT,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CAAC;IAEH,MAAM,YAAY,GAChB,aAAa,CAAC,IAAI,KAAK,OAAO;QAC5B,CAAC,CAAC,sBAAsB,aAAa,CAAC,KAAK,KAAK,aAAa,CAAC,UAAU,CAAC,MAAM,sBAAsB,aAAa,CAAC,cAAc,CAAC,MAAM,qEAAqE;QAC7M,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,OAAO,EAAE;YACP,GAAG,MAAM;YACT,KAAK,EAAE,aAAa;YACpB,eAAe,EAAE,QAAQ;YACzB,aAAa,EAAE,YAAY;YAC3B,wBAAwB,EAAE,sBAAsB;YAChD,yBAAyB,EAAE,uBAAuB;YAClD,WAAW,EAAE,kBAAkB;YAC/B,kBAAkB,EAAE,gBAAgB;YACpC,mBAAmB,EAAE,iBAAiB;YACtC,aAAa,EAAE,cAAc,CAAC,KAAK;YACnC,YAAY,EAAE,SAAS;SACxB;QACD,iBAAiB,EAAE;YACjB,YAAY;YACZ,sBAAsB;YACtB,oBAAoB;YACpB,+BAA+B;YAC/B,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,kBAAkB;YAClB,yBAAyB;YACzB,oBAAoB;SACrB;QACD,gBAAgB,EACd,uCAAuC,gBAAgB,CAAC,MAAM,kEAAkE,cAAc,CAAC,UAAU,iBAAiB;YAC1K,YAAY;YACZ,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC;gBAC7B,CAAC,CAAC,YAAY,mBAAmB,CAAC,MAAM,gBAAgB,mBAAmB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,wBAAwB;gBAC3H,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC;gBAC7B,CAAC,CAAC,aAAa,mBAAmB,CAAC,MAAM,QAAQ,mBAAmB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,6BAA6B;gBACzH,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,cAAc;gBACb,CAAC,CAAC,iCAAiC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;gBAC9D,CAAC,CAAC,8DAA8D,CAAC;KACtE,CAAC;AACJ,CAAC"}

package/dist/audit/orchestrator/providerConfirmation.d.ts

@@ -0,0 +1,21 @@
+/**
+ * audit-code Gate-0 provider confirmation consumer.
+ *
+ * Wraps the audit-tools/shared provider-discovery helpers and produces a
+ * ProviderConfirmationResult conforming to the pinned seam contract (N-X06).
+ */
+import type { SessionConfig } from "audit-tools/shared";
+import type { ProviderConfirmationResult } from "audit-tools/shared";
+/**
+ * Discover and confirm the provider pool for a new audit run.
+ *
+ * Uses auto-resolution only — no interactive gate at this layer. The
+ * conversation-first flow handles the interactive Gate-0 prompt; this function
+ * supplies the deterministic pool it needs as input.
+ *
+ * @param sessionConfig - Current session config; may be an empty `{}`.
+ * @param env           - Process environment snapshot; defaults to `process.env`.
+ * @param exclude       - Provider names to pre-exclude (e.g. user-supplied from a prior gate).
+ */
+export declare function confirmProviders(sessionConfig: SessionConfig, env?: NodeJS.ProcessEnv, exclude?: string[]): ProviderConfirmationResult;
+//# sourceMappingURL=providerConfirmation.d.ts.map

package/dist/audit/orchestrator/providerConfirmation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerConfirmation.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/providerConfirmation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKxD,OAAO,KAAK,EAAE,0BAA0B,EAAsB,MAAM,oBAAoB,CAAC;AAMzF;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,aAAa,EAC5B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,MAAM,EAAO,GACrB,0BAA0B,CAoC5B"}

package/dist/audit/orchestrator/providerConfirmation.js

@@ -0,0 +1,54 @@
+/**
+ * audit-code Gate-0 provider confirmation consumer.
+ *
+ * Wraps the audit-tools/shared provider-discovery helpers and produces a
+ * ProviderConfirmationResult conforming to the pinned seam contract (N-X06).
+ */
+import { discoverProviders, PROVIDER_CONFIRMATION_RESULT_VERSION, } from "audit-tools/shared";
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Discover and confirm the provider pool for a new audit run.
+ *
+ * Uses auto-resolution only — no interactive gate at this layer. The
+ * conversation-first flow handles the interactive Gate-0 prompt; this function
+ * supplies the deterministic pool it needs as input.
+ *
+ * @param sessionConfig - Current session config; may be an empty `{}`.
+ * @param env           - Process environment snapshot; defaults to `process.env`.
+ * @param exclude       - Provider names to pre-exclude (e.g. user-supplied from a prior gate).
+ */
+export function confirmProviders(sessionConfig, env = process.env, exclude = []) {
+    const discovered = discoverProviders(sessionConfig, env);
+    const excludeSet = new Set(exclude);
+    const pool = [];
+    // Always include local-subprocess as a fallback — it's always available.
+    const hasLocalSubprocess = discovered.some((p) => p.name === "local-subprocess");
+    if (!hasLocalSubprocess) {
+        pool.push({
+            name: "local-subprocess",
+            capability_tier: "unknown",
+            excluded: excludeSet.has("local-subprocess"),
+            reason: "always-available fallback; no PATH detection required",
+        });
+    }
+    for (const provider of discovered) {
+        pool.push({
+            name: provider.name,
+            capability_tier: provider.capabilityTier,
+            excluded: excludeSet.has(provider.name),
+            reason: provider.reason,
+        });
+    }
+    // COR-108468ae: the dead-code second guard below was removed — local-subprocess
+    // is unconditionally added before the loop when not discovered, so this check
+    // was always a no-op (the first block already guarantees presence).
+    return {
+        schema_version: PROVIDER_CONFIRMATION_RESULT_VERSION,
+        confirmed_at: new Date().toISOString(),
+        provider_pool: pool,
+        session_level: true,
+    };
+}
+//# sourceMappingURL=providerConfirmation.js.map

package/dist/audit/orchestrator/providerConfirmation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerConfirmation.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/providerConfirmation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,iBAAiB,EACjB,oCAAoC,GACrC,MAAM,oBAAoB,CAAC;AAG5B,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,aAA4B,EAC5B,MAAyB,OAAO,CAAC,GAAG,EACpC,UAAoB,EAAE;IAEtB,MAAM,UAAU,GAAG,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,OAAO,CAAC,CAAC;IAE5C,MAAM,IAAI,GAAyB,EAAE,CAAC;IAEtC,yEAAyE;IACzE,MAAM,kBAAkB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;IACjF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,kBAAkB;YACxB,eAAe,EAAE,SAAS;YAC1B,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC5C,MAAM,EAAE,uDAAuD;SAChE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,eAAe,EAAE,QAAQ,CAAC,cAAc;YACxC,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,8EAA8E;IAC9E,oEAAoE;IAEpE,OAAO;QACL,cAAc,EAAE,oCAAoC;QACpD,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtC,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,IAAI;KACpB,CAAC;AACJ,CAAC"}

package/dist/audit/orchestrator/requeue.d.ts

@@ -0,0 +1,4 @@
+import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
+import type { AuditTask, CoverageMatrix } from "../types.js";
+export declare function buildRequeueTasks(matrix: CoverageMatrix, externalAnalyzerResults?: ExternalAnalyzerResults): AuditTask[];
+//# sourceMappingURL=requeue.d.ts.map

package/dist/audit/orchestrator/requeue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requeue.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/requeue.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAe7D,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,cAAc,EACtB,uBAAuB,CAAC,EAAE,uBAAuB,GAChD,SAAS,EAAE,CAuBb"}

package/dist/audit/orchestrator/requeue.js

@@ -0,0 +1,33 @@
+import { buildRequeueTargets } from "../coverage.js";
+import { getExternalSignalPaths } from "./requeueUtils.js";
+function taskPriority(hasExternalSignal, lens) {
+    if (hasExternalSignal)
+        return "high";
+    if (lens === "security" || lens === "data_integrity" || lens === "reliability") {
+        return "medium";
+    }
+    return "low";
+}
+export function buildRequeueTasks(matrix, externalAnalyzerResults) {
+    const targets = buildRequeueTargets(matrix);
+    const tasks = [];
+    const externalPaths = getExternalSignalPaths(externalAnalyzerResults);
+    for (const target of targets) {
+        for (const lens of target.missing_lenses) {
+            const hasExternalSignal = externalPaths.has(target.path);
+            tasks.push({
+                task_id: `requeue:${lens}:${target.path}`,
+                unit_id: `requeue:${target.path}`,
+                pass_id: `requeue:${lens}`,
+                lens,
+                file_paths: [target.path],
+                rationale: `Mandatory audit coverage is still missing for ${target.path} under the ${lens} lens.`,
+                priority: taskPriority(hasExternalSignal, lens),
+                tags: hasExternalSignal ? ["external_analyzer_signal"] : [],
+                status: "pending",
+            });
+        }
+    }
+    return tasks;
+}
+//# sourceMappingURL=requeue.js.map

package/dist/audit/orchestrator/requeue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requeue.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/requeue.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,SAAS,YAAY,CACnB,iBAA0B,EAC1B,IAAY;IAEZ,IAAI,iBAAiB;QAAE,OAAO,MAAM,CAAC;IACrC,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC/E,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,MAAsB,EACtB,uBAAiD;IAEjD,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,aAAa,GAAG,sBAAsB,CAAC,uBAAuB,CAAC,CAAC;IAEtE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACzC,MAAM,iBAAiB,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,WAAW,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;gBACzC,OAAO,EAAE,WAAW,MAAM,CAAC,IAAI,EAAE;gBACjC,OAAO,EAAE,WAAW,IAAI,EAAE;gBAC1B,IAAI;gBACJ,UAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;gBACzB,SAAS,EAAE,iDAAiD,MAAM,CAAC,IAAI,cAAc,IAAI,QAAQ;gBACjG,QAAQ,EAAE,YAAY,CAAC,iBAAiB,EAAE,IAAI,CAAC;gBAC/C,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC3D,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/audit/orchestrator/requeueCommand.d.ts

@@ -0,0 +1,32 @@
+import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
+import type { CoverageMatrix } from "../types.js";
+import type { FlowCoverageManifest } from "../types/flowCoverage.js";
+import type { CriticalFlowManifest } from "audit-tools/shared";
+export declare function buildRequeuePayload(matrix: CoverageMatrix, criticalFlows?: CriticalFlowManifest, flowCoverage?: FlowCoverageManifest, externalAnalyzerResults?: ExternalAnalyzerResults): {
+    task_count: number;
+    file_task_count: number;
+    flow_task_count: number;
+    tasks: {
+        unit_id: string;
+        lens: string;
+        rationale: string;
+        task_id: string;
+        pass_id: string;
+        file_paths: string[];
+        status?: "complete" | "pending" | undefined;
+        file_line_counts?: Record<string, number> | undefined;
+        line_ranges?: {
+            path: string;
+            end: number;
+            start: number;
+        }[] | undefined;
+        inputs?: Record<string, string> | undefined;
+        priority?: "high" | "low" | "medium" | undefined;
+        token_estimate?: number | undefined;
+        risk_estimate?: number | undefined;
+        tags?: string[] | undefined;
+        completed_at?: string | undefined;
+        completion_reason?: string | undefined;
+    }[];
+};
+//# sourceMappingURL=requeueCommand.d.ts.map

package/dist/audit/orchestrator/requeueCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requeueCommand.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/requeueCommand.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAG5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAiC/D,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,cAAc,EACtB,aAAa,CAAC,EAAE,oBAAoB,EACpC,YAAY,CAAC,EAAE,oBAAoB,EACnC,uBAAuB,CAAC,EAAE,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BlD"}

package/dist/audit/orchestrator/requeueCommand.js

@@ -0,0 +1,45 @@
+import { buildRequeueTasks } from "./requeue.js";
+import { buildFlowRequeueTasks } from "./flowRequeue.js";
+function dedupeTasks(tasks) {
+    const seen = new Set();
+    const deduped = [];
+    for (const task of tasks) {
+        if (seen.has(task.task_id)) {
+            continue;
+        }
+        seen.add(task.task_id);
+        deduped.push(task);
+    }
+    return deduped;
+}
+function dedupeByScope(tasks) {
+    const seen = new Set();
+    const deduped = [];
+    for (const task of tasks) {
+        const signature = `${task.lens}:${[...task.file_paths].sort().join(",")}`;
+        if (seen.has(signature)) {
+            continue;
+        }
+        seen.add(signature);
+        deduped.push(task);
+    }
+    return deduped;
+}
+export function buildRequeuePayload(matrix, criticalFlows, flowCoverage, externalAnalyzerResults) {
+    // Dedupe within each source first — each generator may emit duplicate task_ids independently.
+    const fileTasks = dedupeTasks(buildRequeueTasks(matrix, externalAnalyzerResults));
+    const flowTasks = criticalFlows && flowCoverage
+        ? dedupeTasks(buildFlowRequeueTasks(criticalFlows, flowCoverage, matrix, externalAnalyzerResults))
+        : [];
+    // Two-pass post-merge dedup:
+    //   1. dedupeTasks removes any cross-source task_id collisions (same task emitted by both generators).
+    //   2. dedupeByScope removes tasks that cover the same lens+file_paths scope but carry different task_ids.
+    const tasks = dedupeByScope(dedupeTasks([...fileTasks, ...flowTasks]));
+    return {
+        task_count: tasks.length,
+        file_task_count: fileTasks.length,
+        flow_task_count: flowTasks.length,
+        tasks,
+    };
+}
+//# sourceMappingURL=requeueCommand.js.map

package/dist/audit/orchestrator/requeueCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requeueCommand.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/requeueCommand.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAKzD,SAAS,WAAW,CAAgC,KAAU;IAC5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAQ,EAAE,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CACpB,KAAU;IAEV,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAQ,EAAE,CAAC;IAExB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1E,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAsB,EACtB,aAAoC,EACpC,YAAmC,EACnC,uBAAiD;IAEjD,8FAA8F;IAC9F,MAAM,SAAS,GAAG,WAAW,CAC3B,iBAAiB,CAAC,MAAM,EAAE,uBAAuB,CAAC,CACnD,CAAC;IACF,MAAM,SAAS,GACb,aAAa,IAAI,YAAY;QAC3B,CAAC,CAAC,WAAW,CACT,qBAAqB,CACnB,aAAa,EACb,YAAY,EACZ,MAAM,EACN,uBAAuB,CACxB,CACF;QACH,CAAC,CAAC,EAAE,CAAC;IACT,6BAA6B;IAC7B,uGAAuG;IACvG,2GAA2G;IAC3G,MAAM,KAAK,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAEvE,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,MAAM;QACxB,eAAe,EAAE,SAAS,CAAC,MAAM;QACjC,eAAe,EAAE,SAAS,CAAC,MAAM;QACjC,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/audit/orchestrator/requeueUtils.d.ts

@@ -0,0 +1,14 @@
+import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
+/**
+ * Extract the set of file paths that have at least one external-analyzer
+ * finding. Shared by all requeue generators (file-level requeue, flow requeue)
+ * so the extraction logic never drifts between them.
+ *
+ * Note: `taskPriority` is intentionally NOT shared here — the file-level and
+ * flow-requeue generators apply different priority rules (file requeue treats
+ * any external signal as "high"; flow requeue only does so when the lens is
+ * also sensitive). Each module defines its own `taskPriority` to keep those
+ * rules explicit and independently adjustable.
+ */
+export declare function getExternalSignalPaths(externalAnalyzerResults?: ExternalAnalyzerResults): Set<string>;
+//# sourceMappingURL=requeueUtils.d.ts.map

package/dist/audit/orchestrator/requeueUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requeueUtils.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/requeueUtils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAE5E;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,uBAAuB,CAAC,EAAE,uBAAuB,GAChD,GAAG,CAAC,MAAM,CAAC,CAab"}

package/dist/audit/orchestrator/requeueUtils.js

@@ -0,0 +1,22 @@
+/**
+ * Extract the set of file paths that have at least one external-analyzer
+ * finding. Shared by all requeue generators (file-level requeue, flow requeue)
+ * so the extraction logic never drifts between them.
+ *
+ * Note: `taskPriority` is intentionally NOT shared here — the file-level and
+ * flow-requeue generators apply different priority rules (file requeue treats
+ * any external signal as "high"; flow requeue only does so when the lens is
+ * also sensitive). Each module defines its own `taskPriority` to keep those
+ * rules explicit and independently adjustable.
+ */
+export function getExternalSignalPaths(externalAnalyzerResults) {
+    const results = Array.isArray(externalAnalyzerResults?.results)
+        ? externalAnalyzerResults.results
+        : [];
+    return new Set(results
+        .map((item) => item && typeof item.path === "string" && item.path.length > 0
+        ? item.path
+        : null)
+        .filter((path) => path !== null));
+}
+//# sourceMappingURL=requeueUtils.js.map

package/dist/audit/orchestrator/requeueUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requeueUtils.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/requeueUtils.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,uBAAiD;IAEjD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,uBAAuB,EAAE,OAAO,CAAC;QAC7D,CAAC,CAAC,uBAAuB,CAAC,OAAO;QACjC,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,IAAI,GAAG,CACZ,OAAO;SACJ,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACZ,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAC,IAAI;QACX,CAAC,CAAC,IAAI,CACT;SACA,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CACnD,CAAC;AACJ,CAAC"}