audit-tools 0.28.0

package/dist/remediate/contractPipeline/derive.js

@@ -0,0 +1,216 @@
+/**
+ * Deterministic derivers for contract-pipeline artifacts.
+ *
+ * S1 of the contract-authoring determinism design
+ * (`docs/contract-authoring-determinism-design.md`): the contract pipeline
+ * historically had the LLM author every structured artifact and the backend
+ * only validate it afterward. For the artifacts whose *structure* is a pure
+ * function of an upstream artifact, that is wasted generation and a weak-model
+ * failure surface ("emit a large, schema-conforming, internally-consistent JSON
+ * artifact from scratch with correct ids and cross-refs"). This module owns
+ * those derivations so the tool produces the structure and the model is left
+ * only the irreducible judgment.
+ *
+ * `deriveObligationLedger` is the flagship: the obligation ledger is a 1:1
+ * restructuring of the finalized module contracts — every module invariant and
+ * failure mode becomes an obligation, and every module gets a
+ * contract-conformance obligation — so no judgment is lost by generating it in
+ * code. Construction goes through the shared `buildObligationLedger` so the
+ * cycle check, version stamp, and envelope stay single-sourced with the rest of
+ * the codebase (the non-negotiable "derivers and validators share one source —
+ * no parallel logic").
+ */
+import { buildObligationLedger, isRecord, mintUniqueId, } from "audit-tools/shared";
+/**
+ * Derive the obligation ledger deterministically from the finalized module
+ * contracts. Pure function of its input (modulo the `created_at` stamp): the
+ * same contracts always yield the same obligations in the same order, so the
+ * artifact hash / staleness DAG stays well-behaved.
+ *
+ * Mapping (the inverse of the obligation-ledger consumers' expectations):
+ *  - one **structural** obligation per module ("implement this module per its
+ *    finalized contract") — guarantees the ledger is never empty and every
+ *    module has something the implementation DAG must cover, without inventing
+ *    a paired-test burden (structural is not a testable kind);
+ *  - one **invariant** obligation per declared module invariant (testable);
+ *  - one **behavioral** obligation per declared module failure mode (testable).
+ *
+ * `depends_on` is left empty: the validated module-contract shape declares no
+ * inter-obligation ordering, so an honest derivation asserts none (and the
+ * ledger is acyclic by construction — `buildObligationLedger` cannot throw).
+ */
+export function deriveObligationLedger(finalizedModuleContracts, options = {}) {
+    const finalized = readFinalizedContracts(finalizedModuleContracts);
+    const usedIds = new Set();
+    const obligations = [];
+    for (const mod of finalized.module_contracts) {
+        const base = slug(mod.name) || "module";
+        // Contract-conformance obligation — represents the module even when it
+        // declares no invariants/failure modes (structural kind → not testable).
+        obligations.push({
+            id: mintUniqueId(usedIds, `OBL-${base}-contract`),
+            description: `Implement module "${mod.name}" per its finalized contract ` +
+                `(inputs: ${fmtList(mod.inputs)} → outputs: ${fmtList(mod.outputs)}; ` +
+                `validation boundary: ${mod.validation_boundary || "n/a"}).`,
+            kind: "structural",
+            depends_on: [],
+            status: "pending",
+            source: "design_spec",
+        });
+        mod.invariants.forEach((invariant, i) => {
+            obligations.push({
+                id: mintUniqueId(usedIds, `OBL-${base}-inv-${i + 1}`),
+                description: invariant,
+                kind: "invariant",
+                depends_on: [],
+                status: "pending",
+                source: "design_spec",
+            });
+        });
+        mod.failure_modes.forEach((failureMode, j) => {
+            obligations.push({
+                id: mintUniqueId(usedIds, `OBL-${base}-fail-${j + 1}`),
+                description: `Handle failure mode: ${failureMode}`,
+                kind: "behavioral",
+                depends_on: [],
+                status: "pending",
+                source: "design_spec",
+            });
+        });
+    }
+    return buildObligationLedger({
+        goal_id: finalized.goal_id,
+        obligations,
+        created_at: options.created_at,
+    });
+}
+// ── Scaffolds (S3): skeletons for the partially-derivable artifacts ────────────
+//
+// The test plan and implementation DAG have an irreducible judgment slot
+// (assertion text; node title/description/commands) so they cannot be derived
+// in full. Instead the tool derives their SKELETON — structure, ids, and
+// cross-references populated, only the judgment fields blank — and shows it to
+// the model so it fills just those slots and cannot drop, misname, or
+// mis-reference an obligation. These are NOT writable artifacts: the blank
+// fields fail validation by design (that is the point — the model must fill
+// them). They are rendered into the dispatch prompt as a pre-filled skeleton.
+const TESTABLE_KINDS = new Set(["invariant", "behavioral"]);
+/** A short, stable test name from an obligation description. */
+function scaffoldName(obligation) {
+    const text = obligation.description.replace(/\s+/g, " ").trim();
+    if (!text)
+        return obligation.id;
+    return text.length > 64 ? `${text.slice(0, 61)}...` : text;
+}
+/**
+ * Build the test-plan skeleton: one spec per *testable* (invariant/behavioral)
+ * obligation, with `obligation_id`/`name`/`kind` filled and `assertions` left
+ * blank for the model. The model fills only the assertions (each spec needs a
+ * paired positive + negative assertion per the OBL-CO-01 gate).
+ */
+export function buildTestValidatorPlanScaffold(ledger) {
+    const obligations = ledger?.obligations ?? [];
+    return {
+        test_specs: obligations
+            .filter((o) => TESTABLE_KINDS.has(o.kind))
+            .map((o) => ({
+            obligation_id: o.id,
+            name: scaffoldName(o),
+            kind: o.kind === "invariant" ? "invariant" : "unit",
+            assertions: [],
+        })),
+    };
+}
+/** Accepted counterexample ids from a judge_report payload (defensive read). */
+export function acceptedCounterexampleIds(judgeReport) {
+    const record = isRecord(judgeReport) ? judgeReport : {};
+    const classifications = Array.isArray(record.classifications)
+        ? record.classifications
+        : [];
+    const ids = [];
+    for (const cls of classifications) {
+        if (isRecord(cls) &&
+            cls.classification === "accepted" &&
+            typeof cls.counterexample_id === "string") {
+            ids.push(cls.counterexample_id);
+        }
+    }
+    return ids;
+}
+/**
+ * Build the implementation-DAG skeleton: one node per obligation (covering it),
+ * blank title/description/targeted_commands for the model, and accepted
+ * counterexamples attached so coverage holds by construction. Empty edges (the
+ * derived ledger declares no inter-obligation ordering). Advisory: the model
+ * fills the blanks and may merge nodes as long as coverage is preserved.
+ */
+export function buildImplementationDagScaffold(ledger, acceptedCeIds) {
+    const obligations = ledger?.obligations ?? [];
+    const nodes = obligations.map((o, i) => ({
+        id: `CP-NODE-${i + 1}`,
+        title: "",
+        description: "",
+        satisfies_obligations: [o.id],
+        addresses_counterexamples: [],
+        depends_on: [],
+        verification_obligation_ids: [o.id],
+        targeted_commands: [],
+        status: "pending",
+    }));
+    if (acceptedCeIds.length > 0) {
+        if (nodes.length === 0) {
+            nodes.push({
+                id: "CP-NODE-1",
+                title: "",
+                description: "",
+                satisfies_obligations: [],
+                addresses_counterexamples: [...acceptedCeIds],
+                depends_on: [],
+                verification_obligation_ids: [],
+                targeted_commands: [],
+                status: "pending",
+            });
+        }
+        else {
+            nodes[0].addresses_counterexamples = [...acceptedCeIds];
+        }
+    }
+    return { nodes, edges: [] };
+}
+// ── Helpers ───────────────────────────────────────────────────────────────────
+function fmtList(items) {
+    return items.length > 0 ? items.join(", ") : "none";
+}
+/** Lowercase, hyphenate, trim — a stable, readable id fragment from a name. */
+function slug(name) {
+    return name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+}
+function strArray(value) {
+    return Array.isArray(value)
+        ? value.filter((v) => typeof v === "string")
+        : [];
+}
+/** Defensive read of the validated finalized-module-contracts payload. */
+function readFinalizedContracts(payload) {
+    const record = isRecord(payload) ? payload : {};
+    const goalId = typeof record.goal_id === "string" ? record.goal_id : "";
+    const rawModules = Array.isArray(record.module_contracts)
+        ? record.module_contracts
+        : [];
+    const module_contracts = rawModules.map((m) => {
+        const mr = isRecord(m) ? m : {};
+        return {
+            name: typeof mr.name === "string" ? mr.name : "module",
+            inputs: strArray(mr.inputs),
+            outputs: strArray(mr.outputs),
+            invariants: strArray(mr.invariants),
+            failure_modes: strArray(mr.failure_modes),
+            validation_boundary: typeof mr.validation_boundary === "string" ? mr.validation_boundary : "",
+        };
+    });
+    return { goal_id: goalId, module_contracts };
+}
+//# sourceMappingURL=derive.js.map

package/dist/remediate/contractPipeline/derive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive.js","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/derive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACL,qBAAqB,EACrB,QAAQ,EACR,YAAY,GAGb,MAAM,oBAAoB,CAAC;AAuB5B;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CACpC,wBAAiC,EACjC,UAAyB,EAAE;IAE3B,MAAM,SAAS,GAAG,sBAAsB,CAAC,wBAAwB,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,WAAW,GAAsB,EAAE,CAAC;IAE1C,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,gBAAgB,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;QAExC,uEAAuE;QACvE,yEAAyE;QACzE,WAAW,CAAC,IAAI,CAAC;YACf,EAAE,EAAE,YAAY,CAAC,OAAO,EAAE,OAAO,IAAI,WAAW,CAAC;YACjD,WAAW,EACT,qBAAqB,GAAG,CAAC,IAAI,+BAA+B;gBAC5D,YAAY,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI;gBACtE,wBAAwB,GAAG,CAAC,mBAAmB,IAAI,KAAK,IAAI;YAC9D,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,EAAE;YACd,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,aAAa;SACtB,CAAC,CAAC;QAEH,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE;YACtC,WAAW,CAAC,IAAI,CAAC;gBACf,EAAE,EAAE,YAAY,CAAC,OAAO,EAAE,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrD,WAAW,EAAE,SAAS;gBACtB,IAAI,EAAE,WAAW;gBACjB,UAAU,EAAE,EAAE;gBACd,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,aAAa;aACtB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE;YAC3C,WAAW,CAAC,IAAI,CAAC;gBACf,EAAE,EAAE,YAAY,CAAC,OAAO,EAAE,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtD,WAAW,EAAE,wBAAwB,WAAW,EAAE;gBAClD,IAAI,EAAE,YAAY;gBAClB,UAAU,EAAE,EAAE;gBACd,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,aAAa;aACtB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,qBAAqB,CAAC;QAC3B,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,WAAW;QACX,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,yEAAyE;AACzE,+EAA+E;AAC/E,sEAAsE;AACtE,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;AAE9E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;AAE5D,gEAAgE;AAChE,SAAS,YAAY,CAAC,UAA2B;IAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,IAAI,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC,EAAE,CAAC;IAChC,OAAO,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAAoC;IAEpC,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC;IAC9C,OAAO;QACL,UAAU,EAAE,WAAW;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,aAAa,EAAE,CAAC,CAAC,EAAE;YACnB,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;YACrB,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM;YACnD,UAAU,EAAE,EAAE;SACf,CAAC,CAAC;KACN,CAAC;AACJ,CAAC;AAmBD,gFAAgF;AAChF,MAAM,UAAU,yBAAyB,CAAC,WAAoB;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;QAC3D,CAAC,CAAC,MAAM,CAAC,eAAe;QACxB,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IACE,QAAQ,CAAC,GAAG,CAAC;YACb,GAAG,CAAC,cAAc,KAAK,UAAU;YACjC,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ,EACzC,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAAoC,EACpC,aAAuB;IAEvB,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAoC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE;QACtB,KAAK,EAAE,EAAE;QACT,WAAW,EAAE,EAAE;QACf,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,yBAAyB,EAAE,EAAE;QAC7B,UAAU,EAAE,EAAE;QACd,2BAA2B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,iBAAiB,EAAE,EAAE;QACrB,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC,CAAC;IAEJ,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,WAAW;gBACf,KAAK,EAAE,EAAE;gBACT,WAAW,EAAE,EAAE;gBACf,qBAAqB,EAAE,EAAE;gBACzB,yBAAyB,EAAE,CAAC,GAAG,aAAa,CAAC;gBAC7C,UAAU,EAAE,EAAE;gBACd,2BAA2B,EAAE,EAAE;gBAC/B,iBAAiB,EAAE,EAAE;gBACrB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,CAAC,CAAC,CAAC,yBAAyB,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAC9B,CAAC;AAED,iFAAiF;AAEjF,SAAS,OAAO,CAAC,KAAe;IAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACtD,CAAC;AAED,+EAA+E;AAC/E,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO,IAAI;SACR,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACzD,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,0EAA0E;AAC1E,SAAS,sBAAsB,CAAC,OAAgB;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACvD,CAAC,CAAC,MAAM,CAAC,gBAAgB;QACzB,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,gBAAgB,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAA2B,EAAE;QACrE,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;YACtD,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC;YAC3B,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC;YAC7B,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC;YACnC,aAAa,EAAE,QAAQ,CAAC,EAAE,CAAC,aAAa,CAAC;YACzC,mBAAmB,EACjB,OAAO,EAAE,CAAC,mBAAmB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE;SAC3E,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;AAC/C,CAAC"}

package/dist/remediate/contractPipeline/idRegistry.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Single tool-owned authority for the contract-pipeline's id relationships
+ * (S4 of the contract-authoring determinism design).
+ *
+ * Today it owns the one relationship that caused the recurring "Unknown
+ * finding_id" merge trap: the `CP-BLOCK-` block-id <-> bare node-id mapping.
+ * Before this module the prefix was constructed by inline string templates at
+ * several sites (the DAG->plan promotion built it for both node block ids AND
+ * dependency edges; the dispatch alias map built it again), and the reverse was
+ * only ever recovered by the tolerant alias remap. With the prefix minted and
+ * reversed in exactly ONE place each, a node id minted by the planner
+ * round-trips dispatch -> worker result -> merge deterministically, so the
+ * tolerant alias remap is defence-in-depth rather than load-bearing.
+ *
+ * The mapping is a bijection on bare node ids: `fromBlockId(toBlockId(n)) === n`.
+ * It is a pure module — no IO, no model identity — so it is testable in
+ * isolation and feeds the hash/staleness DAG cleanly.
+ */
+/** The one prefix that marks a dispatch block id derived from a DAG node id. */
+export declare const CP_BLOCK_PREFIX = "CP-BLOCK-";
+/**
+ * Mint the canonical bare node id for a DAG node, applying the deterministic
+ * `CP-NNN` fallback when the planner-authored `node.id` is missing (the DAG is
+ * parsed from an LLM envelope via an unchecked cast, so `id` can be absent at
+ * runtime). This is the ONE place the fallback rule lives, so a node's finding
+ * id, block id, `items`, and traceability key can never diverge.
+ *
+ * This closes a merge-trap: when `node.id` was missing, the finding id used this
+ * fallback (`CP-001`) but the block id was built from the raw `node.id`
+ * (`CP-BLOCK-undefined`), so `fromBlockId` could not recover the finding id and
+ * the worker result landed in `unresolved`. Routing every node-id site through
+ * `ensureNodeId` makes `fromBlockId(toBlockId(ensureNodeId(...)))` round-trip.
+ */
+export declare function ensureNodeId(rawId: string | undefined, index: number): string;
+/**
+ * Mint the block id for a bare DAG node id. This is the ONLY place the
+ * `CP-BLOCK-` prefix is applied — every producer of a block id goes through here.
+ */
+export declare function toBlockId(nodeId: string): string;
+/** True when `value` is a `CP-BLOCK-` block id minted by `toBlockId`. */
+export declare function isBlockId(value: string): boolean;
+/**
+ * Recover the bare node id from a block id — the inverse of `toBlockId`. Returns
+ * `null` when `value` is not a `CP-BLOCK-` block id (so callers can fall back to
+ * the tolerant alias remap for non-block aliases such as obligation ids, rather
+ * than silently producing a wrong node id).
+ */
+export declare function fromBlockId(value: string): string | null;
+//# sourceMappingURL=idRegistry.d.ts.map

package/dist/remediate/contractPipeline/idRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idRegistry.d.ts","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/idRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,gFAAgF;AAChF,eAAO,MAAM,eAAe,cAAc,CAAC;AAE3C;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,KAAK,EAAE,MAAM,GACZ,MAAM,CAER;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,yEAAyE;AACzE,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAExD"}

package/dist/remediate/contractPipeline/idRegistry.js

@@ -0,0 +1,57 @@
+/**
+ * Single tool-owned authority for the contract-pipeline's id relationships
+ * (S4 of the contract-authoring determinism design).
+ *
+ * Today it owns the one relationship that caused the recurring "Unknown
+ * finding_id" merge trap: the `CP-BLOCK-` block-id <-> bare node-id mapping.
+ * Before this module the prefix was constructed by inline string templates at
+ * several sites (the DAG->plan promotion built it for both node block ids AND
+ * dependency edges; the dispatch alias map built it again), and the reverse was
+ * only ever recovered by the tolerant alias remap. With the prefix minted and
+ * reversed in exactly ONE place each, a node id minted by the planner
+ * round-trips dispatch -> worker result -> merge deterministically, so the
+ * tolerant alias remap is defence-in-depth rather than load-bearing.
+ *
+ * The mapping is a bijection on bare node ids: `fromBlockId(toBlockId(n)) === n`.
+ * It is a pure module — no IO, no model identity — so it is testable in
+ * isolation and feeds the hash/staleness DAG cleanly.
+ */
+/** The one prefix that marks a dispatch block id derived from a DAG node id. */
+export const CP_BLOCK_PREFIX = "CP-BLOCK-";
+/**
+ * Mint the canonical bare node id for a DAG node, applying the deterministic
+ * `CP-NNN` fallback when the planner-authored `node.id` is missing (the DAG is
+ * parsed from an LLM envelope via an unchecked cast, so `id` can be absent at
+ * runtime). This is the ONE place the fallback rule lives, so a node's finding
+ * id, block id, `items`, and traceability key can never diverge.
+ *
+ * This closes a merge-trap: when `node.id` was missing, the finding id used this
+ * fallback (`CP-001`) but the block id was built from the raw `node.id`
+ * (`CP-BLOCK-undefined`), so `fromBlockId` could not recover the finding id and
+ * the worker result landed in `unresolved`. Routing every node-id site through
+ * `ensureNodeId` makes `fromBlockId(toBlockId(ensureNodeId(...)))` round-trip.
+ */
+export function ensureNodeId(rawId, index) {
+    return rawId ?? `CP-${String(index + 1).padStart(3, "0")}`;
+}
+/**
+ * Mint the block id for a bare DAG node id. This is the ONLY place the
+ * `CP-BLOCK-` prefix is applied — every producer of a block id goes through here.
+ */
+export function toBlockId(nodeId) {
+    return `${CP_BLOCK_PREFIX}${nodeId}`;
+}
+/** True when `value` is a `CP-BLOCK-` block id minted by `toBlockId`. */
+export function isBlockId(value) {
+    return value.startsWith(CP_BLOCK_PREFIX);
+}
+/**
+ * Recover the bare node id from a block id — the inverse of `toBlockId`. Returns
+ * `null` when `value` is not a `CP-BLOCK-` block id (so callers can fall back to
+ * the tolerant alias remap for non-block aliases such as obligation ids, rather
+ * than silently producing a wrong node id).
+ */
+export function fromBlockId(value) {
+    return isBlockId(value) ? value.slice(CP_BLOCK_PREFIX.length) : null;
+}
+//# sourceMappingURL=idRegistry.js.map

package/dist/remediate/contractPipeline/idRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idRegistry.js","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/idRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAyB,EACzB,KAAa;IAEb,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,OAAO,GAAG,eAAe,GAAG,MAAM,EAAE,CAAC;AACvC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC"}

package/dist/remediate/contractPipeline/reviewSnapshot.d.ts

@@ -0,0 +1,52 @@
+import { diffProjections } from "audit-tools/shared";
+export { diffProjections };
+import { type ContractPipelineArtifactName } from "./artifactStore.js";
+/** The verdict-bearing review artifacts whose re-run is expensive (diff-eligible). */
+export declare const REVIEW_ARTIFACTS: ReadonlySet<ContractPipelineArtifactName>;
+export declare function isReviewArtifact(name: ContractPipelineArtifactName): boolean;
+declare const SNAPSHOT_SCHEMA_VERSION: "remediate-code-contract-pipeline/review-snapshot/v1alpha1";
+export interface ReviewSnapshot {
+    schema_version: typeof SNAPSHOT_SCHEMA_VERSION;
+    artifact_name: ContractPipelineArtifactName;
+    /** ISO-8601 capture time (caller-supplied for deterministic tests). */
+    reviewed_at: string;
+    /** The verdict payload this review emitted — what a re-review re-affirms. */
+    prior_payload: unknown;
+    /** Semantic projection of each upstream dependency at review time. */
+    reviewed_inputs: Partial<Record<ContractPipelineArtifactName, unknown>>;
+}
+export declare function reviewSnapshotPath(artifactsDir: string, name: ContractPipelineArtifactName): string;
+export declare function reviewSnapshotExists(artifactsDir: string, name: ContractPipelineArtifactName): boolean;
+export declare function readReviewSnapshot(artifactsDir: string, name: ContractPipelineArtifactName): Promise<ReviewSnapshot | null>;
+/**
+ * Capture a review snapshot for a freshly-produced review artifact: the semantic
+ * projection of each current upstream dependency plus the review's own payload.
+ * No-op for non-review artifacts. The dependency envelopes are read from disk, so
+ * this must run after the upstreams are enveloped (always true post-ingest).
+ */
+export declare function captureReviewSnapshot(artifactsDir: string, name: ContractPipelineArtifactName, payload: unknown, reviewedAt: string): Promise<void>;
+export interface ReReviewDelta {
+    /** Per-dependency diff lines, keyed by dependency name; empty for unchanged. */
+    changedInputs: {
+        dep: ContractPipelineArtifactName;
+        lines: string[];
+    }[];
+    /** True when no upstream projection actually changed (re-affirm verbatim). */
+    allUnchanged: boolean;
+}
+/**
+ * Compute the re-review delta for a review phase against its snapshot: which
+ * upstream dependencies changed (by semantic projection) since the prior verdict,
+ * and the field-level diff for each. Dependencies present now but absent in the
+ * snapshot (or vice-versa) are reported as wholesale add/remove diffs.
+ */
+export declare function computeReReviewDelta(artifactsDir: string, name: ContractPipelineArtifactName, snapshot: ReviewSnapshot): Promise<ReReviewDelta>;
+/**
+ * Render the diff-based re-review section appended to a review phase's re-emit
+ * prompt. Carries the prior verdict and the precise changed-since-last-review
+ * delta, and instructs the worker to re-affirm the prior verdict when the delta
+ * does not affect it, or revise only the affected items otherwise. Delegates the
+ * prompt body to the shared `renderDiffReReviewSection` (single-sourced shape).
+ */
+export declare function renderReReviewSection(_name: ContractPipelineArtifactName, snapshot: ReviewSnapshot, delta: ReReviewDelta): string;
+//# sourceMappingURL=reviewSnapshot.d.ts.map

package/dist/remediate/contractPipeline/reviewSnapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reviewSnapshot.d.ts","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/reviewSnapshot.ts"],"names":[],"mappings":"AAwBA,OAAO,EACL,eAAe,EAIhB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,OAAO,EAKL,KAAK,4BAA4B,EAClC,MAAM,oBAAoB,CAAC;AAG5B,sFAAsF;AACtF,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,4BAA4B,CAKrE,CAAC;AAEH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,4BAA4B,GAAG,OAAO,CAE5E;AAED,QAAA,MAAM,uBAAuB,EAC3B,2DAAoE,CAAC;AAEvE,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,OAAO,uBAAuB,CAAC;IAC/C,aAAa,EAAE,4BAA4B,CAAC;IAC5C,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,aAAa,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,4BAA4B,EAAE,OAAO,CAAC,CAAC,CAAC;CACzE;AAMD,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,GACjC,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAET;AAED,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAMhC;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,EAClC,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAkBf;AAOD,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,aAAa,EAAE;QAAE,GAAG,EAAE,4BAA4B,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IACxE,8EAA8E;IAC9E,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,EAClC,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,aAAa,CAAC,CAYxB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,4BAA4B,EACnC,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,aAAa,GACnB,MAAM,CAUR"}

package/dist/remediate/contractPipeline/reviewSnapshot.js

@@ -0,0 +1,116 @@
+/**
+ * Diff-based re-review for the contract pipeline (B2).
+ *
+ * Friction: when an upstream artifact genuinely changes, the verdict-bearing
+ * review phases (conceptual critique, contract assessment, adversarial critic,
+ * adversarial judge) re-run as FULL passes — the host must burn another ~100-190k
+ * token critic/judge subagent (or hand-re-emit the prior verdict) even when the
+ * change touches only a small part of what the review reasoned about.
+ *
+ * Fix: when a review artifact is produced, snapshot the SEMANTIC PROJECTIONS of
+ * the exact upstreams it reviewed plus its own verdict. On a later staleness
+ * re-emit of that phase, diff the snapshot's inputs against the current upstream
+ * projections and hand the worker (a) its prior verdict and (b) the precise
+ * changed-since-last-review delta — so it confirms "prior verdict still holds"
+ * cheaply when the delta does not affect it, and revises only the affected items
+ * otherwise. This is enforced by the tool (the re-emit prompt carries the delta),
+ * never left to the host to remember.
+ *
+ * Snapshots are bounded to the review phases — the only ones whose re-run is an
+ * expensive verdict, not a deterministic/scaffolded restructuring.
+ */
+import { existsSync } from "node:fs";
+import { mkdir } from "node:fs/promises";
+import { join } from "node:path";
+import { diffProjections, readOptionalJsonFile, renderDiffReReviewSection, writeJsonFile, } from "audit-tools/shared";
+export { diffProjections };
+import { contractPipelineDir, DEPENDENCY_MAP, readContractArtifact, } from "./artifactStore.js";
+import { semanticProjection } from "./semanticProjection.js";
+/** The verdict-bearing review artifacts whose re-run is expensive (diff-eligible). */
+export const REVIEW_ARTIFACTS = new Set([
+    "conceptual_design_critique",
+    "contract_assessment_report",
+    "counterexample",
+    "judge_report",
+]);
+export function isReviewArtifact(name) {
+    return REVIEW_ARTIFACTS.has(name);
+}
+const SNAPSHOT_SCHEMA_VERSION = "remediate-code-contract-pipeline/review-snapshot/v1alpha1";
+function reviewSnapshotDir(artifactsDir) {
+    return join(contractPipelineDir(artifactsDir), "review-snapshots");
+}
+export function reviewSnapshotPath(artifactsDir, name) {
+    return join(reviewSnapshotDir(artifactsDir), `${name}.json`);
+}
+export function reviewSnapshotExists(artifactsDir, name) {
+    return existsSync(reviewSnapshotPath(artifactsDir, name));
+}
+export async function readReviewSnapshot(artifactsDir, name) {
+    return ((await readOptionalJsonFile(reviewSnapshotPath(artifactsDir, name))) ?? null);
+}
+/**
+ * Capture a review snapshot for a freshly-produced review artifact: the semantic
+ * projection of each current upstream dependency plus the review's own payload.
+ * No-op for non-review artifacts. The dependency envelopes are read from disk, so
+ * this must run after the upstreams are enveloped (always true post-ingest).
+ */
+export async function captureReviewSnapshot(artifactsDir, name, payload, reviewedAt) {
+    if (!isReviewArtifact(name))
+        return;
+    const reviewed_inputs = {};
+    for (const dep of DEPENDENCY_MAP[name]) {
+        const depEnvelope = await readContractArtifact(artifactsDir, dep);
+        if (depEnvelope) {
+            reviewed_inputs[dep] = semanticProjection(dep, depEnvelope.payload);
+        }
+    }
+    const snapshot = {
+        schema_version: SNAPSHOT_SCHEMA_VERSION,
+        artifact_name: name,
+        reviewed_at: reviewedAt,
+        prior_payload: payload,
+        reviewed_inputs,
+    };
+    await mkdir(reviewSnapshotDir(artifactsDir), { recursive: true });
+    await writeJsonFile(reviewSnapshotPath(artifactsDir, name), snapshot);
+}
+/**
+ * Compute the re-review delta for a review phase against its snapshot: which
+ * upstream dependencies changed (by semantic projection) since the prior verdict,
+ * and the field-level diff for each. Dependencies present now but absent in the
+ * snapshot (or vice-versa) are reported as wholesale add/remove diffs.
+ */
+export async function computeReReviewDelta(artifactsDir, name, snapshot) {
+    const changedInputs = [];
+    for (const dep of DEPENDENCY_MAP[name]) {
+        const depEnvelope = await readContractArtifact(artifactsDir, dep);
+        const current = depEnvelope
+            ? semanticProjection(dep, depEnvelope.payload)
+            : undefined;
+        const prior = snapshot.reviewed_inputs[dep];
+        const lines = diffProjections(prior, current);
+        if (lines.length > 0)
+            changedInputs.push({ dep, lines });
+    }
+    return { changedInputs, allUnchanged: changedInputs.length === 0 };
+}
+/**
+ * Render the diff-based re-review section appended to a review phase's re-emit
+ * prompt. Carries the prior verdict and the precise changed-since-last-review
+ * delta, and instructs the worker to re-affirm the prior verdict when the delta
+ * does not affect it, or revise only the affected items otherwise. Delegates the
+ * prompt body to the shared `renderDiffReReviewSection` (single-sourced shape).
+ */
+export function renderReReviewSection(_name, snapshot, delta) {
+    return renderDiffReReviewSection({
+        priorPayload: snapshot.prior_payload,
+        changedInputs: delta.changedInputs.map((entry) => ({
+            label: entry.dep,
+            lines: entry.lines,
+        })),
+        allUnchanged: delta.allUnchanged,
+        subjectNoun: "artifact",
+    });
+}
+//# sourceMappingURL=reviewSnapshot.js.map

package/dist/remediate/contractPipeline/reviewSnapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reviewSnapshot.js","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/reviewSnapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,yBAAyB,EACzB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,oBAAoB,GAGrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,sFAAsF;AACtF,MAAM,CAAC,MAAM,gBAAgB,GAA8C,IAAI,GAAG,CAAC;IACjF,4BAA4B;IAC5B,4BAA4B;IAC5B,gBAAgB;IAChB,cAAc;CACf,CAAC,CAAC;AAEH,MAAM,UAAU,gBAAgB,CAAC,IAAkC;IACjE,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,uBAAuB,GAC3B,2DAAoE,CAAC;AAavE,SAAS,iBAAiB,CAAC,YAAoB;IAC7C,OAAO,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,IAAkC;IAElC,OAAO,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,YAAoB,EACpB,IAAkC;IAElC,OAAO,UAAU,CAAC,kBAAkB,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,YAAoB,EACpB,IAAkC;IAElC,OAAO,CACL,CAAC,MAAM,oBAAoB,CACzB,kBAAkB,CAAC,YAAY,EAAE,IAAI,CAAC,CACvC,CAAC,IAAI,IAAI,CACX,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,IAAkC,EAClC,OAAgB,EAChB,UAAkB;IAElB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAAE,OAAO;IACpC,MAAM,eAAe,GAA2D,EAAE,CAAC;IACnF,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAClE,IAAI,WAAW,EAAE,CAAC;YAChB,eAAe,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAmB;QAC/B,cAAc,EAAE,uBAAuB;QACvC,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,UAAU;QACvB,aAAa,EAAE,OAAO;QACtB,eAAe;KAChB,CAAC;IACF,MAAM,KAAK,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,aAAa,CAAC,kBAAkB,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxE,CAAC;AAcD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB,EACpB,IAAkC,EAClC,QAAwB;IAExB,MAAM,aAAa,GAAmC,EAAE,CAAC;IACzD,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,WAAW;YACzB,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC;YAC9C,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,KAAK,GAAG,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAmC,EACnC,QAAwB,EACxB,KAAoB;IAEpB,OAAO,yBAAyB,CAAC;QAC/B,YAAY,EAAE,QAAQ,CAAC,aAAa;QACpC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACjD,KAAK,EAAE,KAAK,CAAC,GAAG;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QACH,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE,UAAU;KACxB,CAAC,CAAC;AACL,CAAC"}

package/dist/remediate/contractPipeline/semanticProjection.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Semantic projection for contract-pipeline staleness (B3).
+ *
+ * The staleness DAG used to key every dependency on the upstream's RAW payload
+ * content hash, so any byte change to an upstream — a reworded rationale, a
+ * regenerated `created_at` stamp, a reordered list — re-staled the entire
+ * downstream chain and forced a full (often LLM-driven) re-authoring of
+ * artifacts whose load-bearing inputs had not actually changed. That is the
+ * exact friction B3 names: "an edit to finalized_module_contracts re-stales
+ * obligation_ledger → test_validator_plan → contract_assessment even when the
+ * obligation set is unchanged."
+ *
+ * The fix is to make staleness content/semantics-aware: a dependency is recorded
+ * and compared by the hash of its *semantic projection* — only the structure a
+ * downstream actually consumes — not its raw bytes. A cosmetic upstream edit
+ * projects to the same value, so downstreams stay fresh; a real change to the
+ * load-bearing structure (a new module invariant, a changed interface) projects
+ * differently and correctly re-stales.
+ *
+ * This mirrors audit-code's `normalizeForMetadataHash`
+ * (`orchestrator/artifactFreshness.ts`): strip non-semantic provenance fields
+ * universally, then apply a per-artifact structural projection. The two
+ * orchestrators stay in conceptual parity (semantic-projection staleness) while
+ * each owns the projection table for its own artifact set.
+ */
+import { stableStringifyProjection } from "audit-tools/shared";
+import type { ContractPipelineArtifactName } from "./artifactStore.js";
+export { stableStringifyProjection };
+/**
+ * Project a contract-pipeline artifact payload to only its load-bearing
+ * structure for downstream-staleness purposes. The universal provenance strip
+ * applies to every artifact; `finalized_module_contracts` additionally projects
+ * its `module_contracts` to the derivable fields. Artifacts with no special case
+ * fall back to the provenance-stripped payload (conservative: behaves like the
+ * raw payload minus stamps).
+ *
+ * Non-object payloads pass through unchanged.
+ */
+export declare function semanticProjection(name: ContractPipelineArtifactName, payload: unknown): unknown;
+/**
+ * The order-independent stable serialization used to hash a projection is the
+ * shared `stableStringifyProjection` (re-exported above) — single-sourced in
+ * `audit-tools/shared` so audit-code and remediate-code hash projections
+ * identically.
+ */
+//# sourceMappingURL=semanticProjection.d.ts.map

package/dist/remediate/contractPipeline/semanticProjection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semanticProjection.d.ts","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/semanticProjection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAY,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAEvE,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAiDrC;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,4BAA4B,EAClC,OAAO,EAAE,OAAO,GACf,OAAO,CAmBT;AAED;;;;;GAKG"}