audit-tools 0.28.0

package/dist/audit/orchestrator/rollingDispatch.js

@@ -0,0 +1,103 @@
+/**
+ * audit-code rolling dispatch consumer.
+ *
+ * Wraps the audit-tools/shared createRollingDispatcher with a higher-level
+ * runRollingDispatch function that:
+ * 1. Accepts the RollingDispatchEngineContract interface (pinned seam, N-X06).
+ * 2. Resolves the provider pool to CapacityPool entries.
+ * 3. Delegates livelock detection to detectLivelock from audit-tools/shared.
+ * 4. Returns a typed RollingRunResult with termination status.
+ */
+import { createRollingDispatcher, detectLivelock, ROLLING_DISPATCH_ENGINE_VERSION, } from "audit-tools/shared";
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Run the rolling dispatch engine for a set of audit packets.
+ *
+ * Bridges the pinned RollingDispatchEngineContract (seam contract) to
+ * createRollingDispatcher from audit-tools/shared.
+ *
+ * @param packets          - Items to dispatch (must satisfy RollingDispatchPacket).
+ * @param confirmedPools   - Provider pool from provider confirmation (Gate-0).
+ * @param sessionConfig    - Active session config.
+ * @param contract         - Seam contract override (dispatchItems / onResult / livelockGuard / consumerTerminal).
+ * @param dispatchPacket   - The actual per-packet dispatch function (provider-specific).
+ */
+export async function runRollingDispatch(packets, confirmedPools, sessionConfig, contract, dispatchPacket) {
+    const livelockLimit = contract.livelockGuard ?? 3;
+    const allResults = [];
+    let consecutiveNoProgress = 0;
+    // Pool filtering happens upstream (providerConfirmation). Trust the caller's
+    // pool list — a filter that always returns true is a contract lie (INV-07).
+    const activePools = confirmedPools;
+    if (activePools.length === 0) {
+        const strandedIds = packets.map((p) => p.id);
+        const status = "partial";
+        contract.consumerTerminal?.(status, []);
+        return {
+            schema_version: ROLLING_DISPATCH_ENGINE_VERSION,
+            status,
+            results: [],
+            stranded_ids: strandedIds,
+            partial_reason: "empty_pool",
+        };
+    }
+    let dispatchedCount = 0;
+    const dispatcher = createRollingDispatcher({
+        confirmedPools: activePools,
+        sessionConfig,
+        dispatchPacket,
+        onResult: (result) => {
+            allResults.push(result);
+            contract.onResult?.(result);
+            // Reset no-progress counter on any result.
+            consecutiveNoProgress = 0;
+            // FND-OBS-99e3a861: emit a structured progress line on each result so
+            // operators can monitor dispatch execution without waiting for terminal state.
+            dispatchedCount++;
+            process.stderr.write(JSON.stringify({
+                ts: new Date().toISOString(),
+                source: "audit-code:rollingDispatch",
+                event: "packet_result",
+                packet_id: result.packet.id,
+                outcome: result.outcome,
+                completed: dispatchedCount,
+                total: packets.length,
+            }) + "\n");
+        },
+    });
+    dispatcher.enqueue(packets);
+    // Run the engine — it drives all packets to completion.
+    const results = await dispatcher.run();
+    // Check for livelock post-run (packets that never completed).
+    const completedIds = new Set(results.map((r) => r.packet.id));
+    const pendingIds = packets.map((p) => p.id).filter((id) => !completedIds.has(id));
+    // Re-check for stranded packets via the livelock guard.
+    // If pendingIds is non-empty after run(), the engine got stuck.
+    const terminal = pendingIds.length > 0
+        ? detectLivelock({
+            pendingIds,
+            consecutiveNoProgressWaves: livelockLimit, // treat any residual as livelock
+            noProgressLimit: livelockLimit,
+        })
+        : null;
+    if (terminal) {
+        contract.consumerTerminal?.("partial", results);
+        return {
+            schema_version: ROLLING_DISPATCH_ENGINE_VERSION,
+            status: "partial",
+            results,
+            stranded_ids: terminal.stranded_ids,
+            partial_reason: terminal.reason,
+        };
+    }
+    contract.consumerTerminal?.("complete", results);
+    return {
+        schema_version: ROLLING_DISPATCH_ENGINE_VERSION,
+        status: "complete",
+        results,
+        stranded_ids: [],
+    };
+}
+//# sourceMappingURL=rollingDispatch.js.map

package/dist/audit/orchestrator/rollingDispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollingDispatch.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/rollingDispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,+BAA+B,GAChC,MAAM,oBAAoB,CAAC;AA0B5B,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAyC,EACzC,cAA8B,EAC9B,aAA4B,EAC5B,QAAyD,EACzD,cAG4C;IAE5C,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,IAAI,CAAC,CAAC;IAClD,MAAM,UAAU,GAAqC,EAAE,CAAC;IACxD,IAAI,qBAAqB,GAAG,CAAC,CAAC;IAE9B,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,WAAW,GAAG,cAAc,CAAC;IAEnC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,SAAkB,CAAC;QAClC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxC,OAAO;YACL,cAAc,EAAE,+BAA+B;YAC/C,MAAM;YACN,OAAO,EAAE,EAAE;YACX,YAAY,EAAE,WAAW;YACzB,cAAc,EAAE,YAAY;SAC7B,CAAC;IACJ,CAAC;IAED,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,MAAM,UAAU,GAAG,uBAAuB,CACxC;QACE,cAAc,EAAE,WAAW;QAC3B,aAAa;QACb,cAAc;QACd,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;YACnB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;YAC5B,2CAA2C;YAC3C,qBAAqB,GAAG,CAAC,CAAC;YAC1B,sEAAsE;YACtE,+EAA+E;YAC/E,eAAe,EAAE,CAAC;YAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;gBACb,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,MAAM,EAAE,4BAA4B;gBACpC,KAAK,EAAE,eAAe;gBACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,eAAe;gBAC1B,KAAK,EAAE,OAAO,CAAC,MAAM;aACtB,CAAC,GAAG,IAAI,CACV,CAAC;QACJ,CAAC;KACF,CACF,CAAC;IAEF,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5B,wDAAwD;IACxD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC;IAEvC,8DAA8D;IAC9D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAElF,wDAAwD;IACxD,gEAAgE;IAChE,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC;QACpC,CAAC,CAAC,cAAc,CAAC;YACb,UAAU;YACV,0BAA0B,EAAE,aAAa,EAAE,iCAAiC;YAC5E,eAAe,EAAE,aAAa;SAC/B,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IAET,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO;YACL,cAAc,EAAE,+BAA+B;YAC/C,MAAM,EAAE,SAAS;YACjB,OAAO;YACP,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,cAAc,EAAE,QAAQ,CAAC,MAAM;SAChC,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,gBAAgB,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACjD,OAAO;QACL,cAAc,EAAE,+BAA+B;QAC/C,MAAM,EAAE,UAAU;QAClB,OAAO;QACP,YAAY,EAAE,EAAE;KACjB,CAAC;AACJ,CAAC"}

package/dist/audit/orchestrator/runtimeCommand.d.ts

@@ -0,0 +1,10 @@
+export declare function runCommand(command: string[], cwd: string): Promise<{
+    status: "confirmed" | "not_confirmed" | "inconclusive";
+    summary: string;
+    evidence: string[];
+}>;
+export declare function resolveRuntimeValidationSpawnCommand(command: string[], platform?: NodeJS.Platform, shellCommand?: string): {
+    command: string;
+    args: string[];
+};
+//# sourceMappingURL=runtimeCommand.d.ts.map

package/dist/audit/orchestrator/runtimeCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeCommand.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/runtimeCommand.ts"],"names":[],"mappings":"AAkBA,wBAAsB,UAAU,CAC9B,OAAO,EAAE,MAAM,EAAE,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IACT,MAAM,EAAE,WAAW,GAAG,eAAe,GAAG,cAAc,CAAC;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC,CAsED;AAED,wBAAgB,oCAAoC,CAClD,OAAO,EAAE,MAAM,EAAE,EACjB,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,YAAY,SAAmC,GAC9C;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CA4CrC"}

package/dist/audit/orchestrator/runtimeCommand.js

@@ -0,0 +1,129 @@
+import { spawn } from "node:child_process";
+import { quoteForShellInterpreterCmd, stripClaudeCodeEnv } from "audit-tools/shared";
+// Deterministic runtime-validation command execution: resolve a command to a
+// platform-correct spawn invocation (Windows package-manager shims need a
+// cmd.exe wrapper) and run it capturing a confirmed/not_confirmed/inconclusive
+// outcome. Hoisted out of internalExecutors.ts as a shared, side-effect-only
+// helper module.
+//
+// The cmd.exe quoting for the package-manager batch path reuses the canonical
+// exec.ts helpers so the safe-character set stays unified.
+// CLAUDECODE and CLAUDE_CODE_* stripping is now owned by shared.stripClaudeCodeEnv
+// (OBL-SEAM-ACL-02 / atomic-replace: runtimeValidationEnv deleted, stripClaudeCodeEnv used).
+// This strips the host-signaling env vars so a runtime-validation command sees a
+// clean environment — a suite that branches on CLAUDECODE would otherwise be graded
+// against the host's interactive-session state, marking healthy code "not_confirmed".
+export async function runCommand(command, cwd) {
+    // COR-4a8d9779: fast-fail before spawn so an empty command array produces a
+    // descriptive error instead of an ENOENT from spawn("", ...).
+    if (command.length === 0 || !command[0]) {
+        return {
+            status: "inconclusive",
+            summary: "Runtime validation command is empty — no command to execute",
+            evidence: [],
+        };
+    }
+    const spawnCommand = resolveRuntimeValidationSpawnCommand(command);
+    const displayCommand = command.join(" ");
+    return await new Promise((resolve) => {
+        const child = spawn(spawnCommand.command, spawnCommand.args, {
+            cwd,
+            env: stripClaudeCodeEnv(),
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (chunk) => {
+            stdout += String(chunk);
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr += String(chunk);
+        });
+        let exitCode = null;
+        let exitSignal = null;
+        child.on("error", (error) => {
+            const output = `${stdout}\n${stderr}`.trim();
+            const lines = output.length > 0 ? output.split(/\r?\n/) : [];
+            const truncated = lines.length > 10;
+            const evidence = truncated
+                ? [`[... truncated: showing last 10 of ${lines.length} lines ...]`, ...lines.slice(-10)]
+                : lines;
+            resolve({
+                status: "inconclusive",
+                summary: `Failed to execute ${displayCommand}: ${error.message}`,
+                evidence,
+            });
+        });
+        child.on("exit", (code, signal) => {
+            exitCode = code;
+            exitSignal = signal;
+        });
+        child.on("close", () => {
+            const output = `${stdout}\n${stderr}`.trim();
+            const lines = output.length > 0 ? output.split(/\r?\n/) : [];
+            const truncated = lines.length > 10;
+            const evidence = truncated
+                ? [`[... truncated: showing last 10 of ${lines.length} lines ...]`, ...lines.slice(-10)]
+                : lines;
+            const succeeded = exitCode === 0;
+            let summary;
+            if (succeeded) {
+                summary = `Deterministic runtime command succeeded: ${displayCommand}`;
+            }
+            else if (exitCode !== null) {
+                summary = `Deterministic runtime command failed with exit code ${exitCode}: ${displayCommand}`;
+            }
+            else if (exitSignal !== null) {
+                summary = `Deterministic runtime command terminated by signal ${exitSignal}: ${displayCommand}`;
+            }
+            else {
+                summary = `Deterministic runtime command exited with unknown status: ${displayCommand}`;
+            }
+            resolve({
+                status: succeeded ? "confirmed" : "not_confirmed",
+                summary,
+                evidence,
+            });
+        });
+    });
+}
+export function resolveRuntimeValidationSpawnCommand(command, platform = process.platform, shellCommand = process.env.ComSpec ?? "cmd.exe") {
+    const [executable, ...args] = command;
+    if (!executable) {
+        return { command: "", args: [] };
+    }
+    if (platform !== "win32") {
+        process.stderr.write(JSON.stringify({
+            kind: "runtime_spawn_resolved",
+            wrap: "none",
+            executable,
+            platform,
+            ts: new Date().toISOString(),
+        }) + "\n");
+        return { command: executable, args };
+    }
+    const packageManager = executable.replace(/\.(cmd|bat)$/i, "").toLowerCase();
+    if (["npm", "npx", "pnpm", "yarn"].includes(packageManager)) {
+        process.stderr.write(JSON.stringify({
+            kind: "runtime_spawn_resolved",
+            wrap: "cmd.exe",
+            executable,
+            shell_command: shellCommand,
+            platform,
+            ts: new Date().toISOString(),
+        }) + "\n");
+        return {
+            command: shellCommand,
+            args: ["/d", "/s", "/c", command.map(quoteForShellInterpreterCmd).join(" ")],
+        };
+    }
+    process.stderr.write(JSON.stringify({
+        kind: "runtime_spawn_resolved",
+        wrap: "none",
+        executable,
+        platform,
+        ts: new Date().toISOString(),
+    }) + "\n");
+    return { command: executable, args };
+}
+//# sourceMappingURL=runtimeCommand.js.map

package/dist/audit/orchestrator/runtimeCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeCommand.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/runtimeCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAErF,6EAA6E;AAC7E,0EAA0E;AAC1E,+EAA+E;AAC/E,6EAA6E;AAC7E,iBAAiB;AACjB,EAAE;AACF,8EAA8E;AAC9E,2DAA2D;AAE3D,mFAAmF;AACnF,6FAA6F;AAC7F,iFAAiF;AACjF,oFAAoF;AACpF,sFAAsF;AAEtF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAiB,EACjB,GAAW;IAMX,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,6DAA6D;YACtE,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,EAAE;YAC3D,GAAG;YACH,GAAG,EAAE,kBAAkB,EAAE;YACzB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,UAAU,GAA0B,IAAI,CAAC;QAC7C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,MAAM,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,SAAS;gBACxB,CAAC,CAAC,CAAC,sCAAsC,KAAK,CAAC,MAAM,aAAa,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxF,CAAC,CAAC,KAAK,CAAC;YACV,OAAO,CAAC;gBACN,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,qBAAqB,cAAc,KAAK,KAAK,CAAC,OAAO,EAAE;gBAChE,QAAQ;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAChC,QAAQ,GAAG,IAAI,CAAC;YAChB,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,MAAM,MAAM,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,SAAS;gBACxB,CAAC,CAAC,CAAC,sCAAsC,KAAK,CAAC,MAAM,aAAa,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxF,CAAC,CAAC,KAAK,CAAC;YACV,MAAM,SAAS,GAAG,QAAQ,KAAK,CAAC,CAAC;YACjC,IAAI,OAAe,CAAC;YACpB,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,GAAG,4CAA4C,cAAc,EAAE,CAAC;YACzE,CAAC;iBAAM,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC7B,OAAO,GAAG,uDAAuD,QAAQ,KAAK,cAAc,EAAE,CAAC;YACjG,CAAC;iBAAM,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC/B,OAAO,GAAG,sDAAsD,UAAU,KAAK,cAAc,EAAE,CAAC;YAClG,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,6DAA6D,cAAc,EAAE,CAAC;YAC1F,CAAC;YACD,OAAO,CAAC;gBACN,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe;gBACjD,OAAO;gBACP,QAAQ;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,OAAiB,EACjB,WAA4B,OAAO,CAAC,QAAQ,EAC5C,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS;IAE/C,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;IACtC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,MAAM;YACZ,UAAU;YACV,QAAQ;YACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC,GAAG,IAAI,CACV,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7E,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,SAAS;YACf,UAAU;YACV,aAAa,EAAE,YAAY;YAC3B,QAAQ;YACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC,GAAG,IAAI,CACV,CAAC;QACF,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SAC7E,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;QACb,IAAI,EAAE,wBAAwB;QAC9B,IAAI,EAAE,MAAM;QACZ,UAAU;QACV,QAAQ;QACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7B,CAAC,GAAG,IAAI,CACV,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC"}

package/dist/audit/orchestrator/runtimeValidation.d.ts

@@ -0,0 +1,13 @@
+import type { UnitManifest } from "../types.js";
+import type { FlowCoverageManifest } from "../types/flowCoverage.js";
+import type { CriticalFlowManifest } from "audit-tools/shared";
+import type { RuntimeValidationReport, RuntimeValidationTaskManifest } from "../types/runtimeValidation.js";
+export declare function discoverRuntimeValidationCommand(root: string): Promise<string[] | undefined>;
+export declare function buildRuntimeValidationTasks(params: {
+    unitManifest: UnitManifest;
+    criticalFlows?: CriticalFlowManifest;
+    flowCoverage?: FlowCoverageManifest;
+    command?: string[];
+}): RuntimeValidationTaskManifest;
+export declare function mergeRuntimeValidationReport(tasks: RuntimeValidationTaskManifest, existing?: RuntimeValidationReport): RuntimeValidationReport;
+//# sourceMappingURL=runtimeValidation.d.ts.map

package/dist/audit/orchestrator/runtimeValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeValidation.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/runtimeValidation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,KAAK,EACV,uBAAuB,EAEvB,6BAA6B,EAC9B,MAAM,+BAA+B,CAAC;AAmBvC,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAI/B;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB,GAAG,6BAA6B,CAgEhC;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,6BAA6B,EACpC,QAAQ,CAAC,EAAE,uBAAuB,GACjC,uBAAuB,CAkBzB"}

package/dist/audit/orchestrator/runtimeValidation.js

@@ -0,0 +1,94 @@
+import { discoverProjectCommands } from "audit-tools/shared";
+function checksForFlow(requiredLenses) {
+    const checks = [];
+    if (requiredLenses.includes("security")) {
+        checks.push("Exercise malformed or unauthorized inputs against the flow.");
+    }
+    if (requiredLenses.includes("reliability")) {
+        checks.push("Exercise retries or repeated submissions.");
+    }
+    if (requiredLenses.includes("correctness")) {
+        checks.push("Exercise representative success and edge-case behavior.");
+    }
+    if (requiredLenses.includes("data_integrity")) {
+        checks.push("Verify state transitions and persistence invariants.");
+    }
+    return checks;
+}
+export async function discoverRuntimeValidationCommand(root) {
+    // Shared discovery (Node test script → Go → Python) is the single source of
+    // truth; the runtime-validation command is the discovered test command.
+    return discoverProjectCommands(root).test;
+}
+export function buildRuntimeValidationTasks(params) {
+    if (!params.command) {
+        return { tasks: [] };
+    }
+    const tasks = [];
+    const seen = new Set();
+    const highRiskUnits = params.unitManifest.units.filter((unit) => (unit.risk_score ?? 0) >= 5 ||
+        unit.required_lenses.includes("security") ||
+        unit.required_lenses.includes("data_integrity"));
+    for (const unit of highRiskUnits) {
+        const id = `runtime:unit:${unit.unit_id}`;
+        if (seen.has(id))
+            continue;
+        seen.add(id);
+        tasks.push({
+            id,
+            kind: "unit-risk-check",
+            target_paths: unit.files,
+            reason: `Unit ${unit.unit_id} is high risk or touches sensitive concerns.`,
+            priority: (unit.risk_score ?? 0) >= 7 ? "high" : "medium",
+            command: params.command,
+            suggested_checks: [
+                "Run the deterministic runtime command for the repository.",
+                "Confirm the affected unit does not regress under the command output.",
+            ],
+            source_artifacts: ["unit_manifest.json", "risk_register.json"],
+        });
+    }
+    if (params.criticalFlows && params.flowCoverage) {
+        const flowMap = new Map(params.criticalFlows.flows.map((flow) => [flow.id, flow]));
+        for (const record of params.flowCoverage.flows) {
+            if (record.status === "complete") {
+                continue;
+            }
+            const flow = flowMap.get(record.flow_id);
+            if (!flow) {
+                continue;
+            }
+            const id = `runtime:flow:${record.flow_id}`;
+            if (seen.has(id))
+                continue;
+            seen.add(id);
+            tasks.push({
+                id,
+                kind: "critical-flow-check",
+                target_paths: flow.paths,
+                reason: `Critical flow ${record.flow_id} is still ${record.status} and needs deterministic runtime validation.`,
+                priority: record.status === "pending" ? "high" : "medium",
+                command: params.command,
+                suggested_checks: checksForFlow(record.required_lenses),
+                source_artifacts: ["critical_flows.json", "flow_coverage.json"],
+            });
+        }
+    }
+    return { tasks };
+}
+export function mergeRuntimeValidationReport(tasks, existing) {
+    const existingMap = new Map((existing?.results ?? []).map((result) => [result.task_id, result]));
+    return {
+        results: tasks.tasks.map((task) => {
+            const prior = existingMap.get(task.id);
+            return (prior ?? {
+                task_id: task.id,
+                status: "pending",
+                summary: `Deterministic runtime validation has not executed yet for ${task.id}.`,
+                evidence: [],
+                notes: [],
+            });
+        }),
+    };
+}
+//# sourceMappingURL=runtimeValidation.js.map

package/dist/audit/orchestrator/runtimeValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeValidation.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/runtimeValidation.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAO7D,SAAS,aAAa,CAAC,cAAwB;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,cAAc,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,cAAc,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,cAAc,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,IAAY;IAEZ,4EAA4E;IAC5E,wEAAwE;IACxE,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAK3C;IACC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CACpD,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC;QAC3B,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAClD,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,gBAAgB,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,KAAK,CAAC,IAAI,CAAC;YACT,EAAE;YACF,IAAI,EAAE,iBAAiB;YACvB,YAAY,EAAE,IAAI,CAAC,KAAK;YACxB,MAAM,EAAE,QAAQ,IAAI,CAAC,OAAO,8CAA8C;YAC1E,QAAQ,EAAE,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;YACzD,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,gBAAgB,EAAE;gBAChB,2DAA2D;gBAC3D,sEAAsE;aACvE;YACD,gBAAgB,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAC1D,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACjC,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,SAAS;YACX,CAAC;YAED,MAAM,EAAE,GAAG,gBAAgB,MAAM,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE;gBACF,IAAI,EAAE,qBAAqB;gBAC3B,YAAY,EAAE,IAAI,CAAC,KAAK;gBACxB,MAAM,EAAE,iBAAiB,MAAM,CAAC,OAAO,aAAa,MAAM,CAAC,MAAM,8CAA8C;gBAC/G,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBACzD,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC;gBACvD,gBAAgB,EAAE,CAAC,qBAAqB,EAAE,oBAAoB,CAAC;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,KAAoC,EACpC,QAAkC;IAElC,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CACpE,CAAC;IACF,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAChC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvC,OAAO,CACL,KAAK,IAAI;gBACP,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,6DAA6D,IAAI,CAAC,EAAE,GAAG;gBAChF,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,EAAE;aACV,CACF,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/audit/orchestrator/runtimeValidationUpdate.d.ts

@@ -0,0 +1,3 @@
+import type { RuntimeValidationReport, RuntimeValidationTaskManifest } from "../types/runtimeValidation.js";
+export declare function updateRuntimeValidationReport(tasks: RuntimeValidationTaskManifest, existing: RuntimeValidationReport, updates: RuntimeValidationReport): RuntimeValidationReport;
+//# sourceMappingURL=runtimeValidationUpdate.d.ts.map

package/dist/audit/orchestrator/runtimeValidationUpdate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeValidationUpdate.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/runtimeValidationUpdate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EAEvB,6BAA6B,EAC9B,MAAM,+BAA+B,CAAC;AAYvC,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,6BAA6B,EACpC,QAAQ,EAAE,uBAAuB,EACjC,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CA6DzB"}

package/dist/audit/orchestrator/runtimeValidationUpdate.js

@@ -0,0 +1,57 @@
+function normalizeResult(result) {
+    return {
+        ...result,
+        evidence: [...new Set(result.evidence ?? [])],
+        notes: [...new Set(result.notes ?? [])],
+    };
+}
+export function updateRuntimeValidationReport(tasks, existing, updates) {
+    const validTaskIds = new Set(tasks.tasks.map((task) => task.id));
+    const merged = new Map();
+    const staleIds = new Set();
+    for (const result of existing.results) {
+        if (!validTaskIds.has(result.task_id)) {
+            staleIds.add(result.task_id);
+            continue;
+        }
+        merged.set(result.task_id, normalizeResult(result));
+    }
+    for (const update of updates.results) {
+        if (!validTaskIds.has(update.task_id)) {
+            staleIds.add(update.task_id);
+            continue;
+        }
+        const prior = merged.get(update.task_id);
+        if (!prior) {
+            merged.set(update.task_id, normalizeResult(update));
+            continue;
+        }
+        merged.set(update.task_id, {
+            task_id: update.task_id,
+            status: update.status,
+            summary: update.summary,
+            evidence: [
+                ...new Set([...(prior.evidence ?? []), ...(update.evidence ?? [])]),
+            ],
+            notes: [...new Set([...(prior.notes ?? []), ...(update.notes ?? [])])],
+        });
+    }
+    if (staleIds.size > 0) {
+        console.warn("[runtimeValidationUpdate] Dropped %d stale result(s) not in task manifest: %s", staleIds.size, [...staleIds].join(", "));
+    }
+    for (const task of tasks.tasks) {
+        if (!merged.has(task.id)) {
+            merged.set(task.id, {
+                task_id: task.id,
+                status: "pending",
+                summary: `Deterministic runtime validation has not executed yet for ${task.id}.`,
+                evidence: [],
+                notes: [],
+            });
+        }
+    }
+    return {
+        results: [...merged.values()].sort((a, b) => a.task_id.localeCompare(b.task_id)),
+    };
+}
+//# sourceMappingURL=runtimeValidationUpdate.js.map

package/dist/audit/orchestrator/runtimeValidationUpdate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeValidationUpdate.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/runtimeValidationUpdate.ts"],"names":[],"mappings":"AAMA,SAAS,eAAe,CACtB,MAA+B;IAE/B,OAAO;QACL,GAAG,MAAM;QACT,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC7C,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAAoC,EACpC,QAAiC,EACjC,OAAgC;IAEhC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE;gBACR,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;aACpE;YACD,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;SACvE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CACV,+EAA+E,EAC/E,QAAQ,CAAC,IAAI,EACb,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACzB,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE;gBAClB,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,6DAA6D,IAAI,CAAC,EAAE,GAAG;gBAChF,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,EAAE;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC1C,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CACnC;KACF,CAAC;AACJ,CAAC"}

package/dist/audit/orchestrator/scope.d.ts

@@ -0,0 +1,75 @@
+import type { GraphBundle } from "audit-tools/shared";
+import type { ArtifactBundle } from "../io/artifacts.js";
+import type { CoverageMatrix } from "../types.js";
+import type { AuditScopeBudget, AuditScopeManifest } from "../types/auditScope.js";
+/** Default cap on in-scope files (seeds + expanded) before expansion stops. */
+export declare const DEFAULT_SCOPE_MAX_FILES = 200;
+/** Graph edges below this confidence are never traversed during expansion. */
+export declare const SCOPE_EDGE_CONFIDENCE_FLOOR = 0.5;
+/**
+ * Expansion stops along a path once the accumulated path-confidence (the product
+ * of the traversed edge confidences) drops below this floor. With no fixed hop
+ * count, this — together with hub-skipping and the file budget — bounds the
+ * frontier deterministically.
+ */
+export declare const SCOPE_MIN_FRONTIER_CONFIDENCE = 0.5;
+export interface ComputeAuditScopeInput {
+    /** The git ref the delta is measured against. */
+    since: string;
+    /** Raw changed paths (git output, posix-relative). */
+    changed: string[];
+    /** Canonical auditable file paths (repo-manifest paths, non-excluded). */
+    includedFiles: string[];
+    /** Dependency graph used to expand from seeds to neighbours. */
+    graphBundle?: GraphBundle;
+    budget?: AuditScopeBudget;
+}
+/**
+ * Deterministic priority-frontier expansion (Phase 3). Starting from the changed
+ * files (seeds), walk the dependency graph outward, always visiting the neighbour
+ * with the highest accumulated path-confidence first (tie-broken by path). High
+ * fan-in/out hubs are skipped so a single change near a hub does not drag the
+ * whole repo into scope, low-confidence edges are dropped, and expansion halts at
+ * the file budget or when the best remaining frontier confidence falls below the
+ * floor. Same inputs → identical scope.
+ */
+export declare function computeAuditScope(input: ComputeAuditScopeInput): AuditScopeManifest;
+/** A full-audit scope (the default, and every fallback). */
+export declare function fullAuditScope(budget?: AuditScopeBudget, droppedNote?: string): AuditScopeManifest;
+export interface ResolveAuditScopeInput {
+    root?: string;
+    /** The `--since` ref, if any. Absent/empty → full audit. */
+    since?: string;
+    bundle: ArtifactBundle;
+    budget?: AuditScopeBudget;
+}
+/**
+ * Resolve the scope for a planning run. Returns a full-audit scope unless a
+ * `--since` ref was supplied against a real git repository; an unusable ref or
+ * missing root degrades to a full audit with an honest note. Reads the auditable
+ * file set from the repo manifest + disposition (the same lookup the graph
+ * extractor uses) and the dependency graph from the bundle.
+ */
+export declare function resolveAuditScope(input: ResolveAuditScopeInput): AuditScopeManifest;
+/**
+ * Apply a delta scope to a freshly-built coverage matrix. In-scope files (seeds
+ * + expanded neighbours) keep their fresh `pending` status to be re-audited.
+ * Out-of-scope files inherit a prior `complete` record verbatim when present (so
+ * previously-finished work is preserved, not re-run), and are otherwise excluded
+ * from this run with `classification_status: "out_of_scope_delta"`. Deterministic
+ * exclusions (non-auditable/trivial) are left untouched. A full scope is a no-op.
+ */
+export declare function applyScopeToCoverage(coverage: CoverageMatrix, scope: AuditScopeManifest, priorCoverage?: CoverageMatrix): CoverageMatrix;
+/**
+ * Apply the intent checkpoint's `excluded_scope` to a coverage matrix: any file
+ * whose path matches an exclusion (exact or directory-prefix) is marked excluded
+ * so it never becomes an audit task. The user's exclusions layer on top of the
+ * deterministic disposition — they catch scope pollution the automatic pass
+ * missed. Returns the newly-excluded paths (for the run summary / report); a
+ * checkpoint with no exclusions is a no-op.
+ */
+export declare function applyIntentExclusionsToCoverage(coverage: CoverageMatrix, excludedScope: Array<{
+    path: string;
+    reason: string;
+}> | undefined): string[];
+//# sourceMappingURL=scope.d.ts.map

package/dist/audit/orchestrator/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/scope.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAWnF,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,8EAA8E;AAC9E,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD,MAAM,WAAW,sBAAsB;IACrC,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gEAAgE;IAChE,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,sBAAsB,GAC5B,kBAAkB,CA0IpB;AAED,4DAA4D;AAC5D,wBAAgB,cAAc,CAC5B,MAAM,CAAC,EAAE,gBAAgB,EACzB,WAAW,CAAC,EAAE,MAAM,GACnB,kBAAkB,CASpB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,sBAAsB,GAC5B,kBAAkB,CAwCpB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,kBAAkB,EACzB,aAAa,CAAC,EAAE,cAAc,GAC7B,cAAc,CAmChB;AASD;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,cAAc,EACxB,aAAa,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,GACjE,MAAM,EAAE,CAiBV"}