audit-tools 0.28.0

package/dist/remediate/steps/providerNodeDispatch.js

@@ -0,0 +1,100 @@
+import { dirname, join } from "node:path";
+import { readOptionalJsonFile, writeJsonFile, } from "audit-tools/shared";
+import { createFreshSessionProvider } from "../providers/index.js";
+import { createRemediationWorkerTask, createLaunchInputForTask, } from "../phases/workerTasks.js";
+/**
+ * Build the live, provider-backed per-node dispatcher — the programmatic worker
+ * the rolling engine (`driveRollingImplementDispatch`) drives. It resolves the
+ * configured `FreshSessionProvider` and launches it with the node's
+ * worktree-rooted prompt and `repoRoot` set to the node's isolated worktree.
+ *
+ * The provider IS the worker: `spawnLoggedCommand` spawns the headless LLM CLI
+ * (claude -p / codex / opencode run) with `cwd = input.repoRoot`, so pointing
+ * `repoRoot` at the worktree confines every edit there — the worktree branch diff
+ * is then the write-scope ground truth. The worker edits files and writes its
+ * result JSON to `resultPath` (the prompt instructs the exact path); the engine
+ * wrapper owns the create/commit/verify/merge lifecycle around this call, and the
+ * deterministic `mergeImplementResults` is the authority on the result contents.
+ *
+ * No `worker-run` indirection: the remediation implement prompt is self-contained
+ * for a fresh session, so the provider launch alone is the worker.
+ */
+export function makeProviderNodeDispatcher(params) {
+    const orchestratorOptions = {
+        root: params.root,
+        artifactsDir: params.artifactsDir,
+    };
+    return async ({ block, slot, worktreeRoot, resultPath }) => {
+        const packet = {
+            id: block.block_id,
+            payload: { block_id: block.block_id },
+            estimatedTokens: 0,
+            complexity: 0.5,
+        };
+        const promptPath = params.promptPathByBlock.get(block.block_id);
+        if (!promptPath) {
+            return {
+                packet,
+                outcome: "error",
+                error: new Error(`no dispatch prompt for node ${block.block_id}`),
+            };
+        }
+        // Resolve the provider the scheduler SELECTED for this slot, not a fixed
+        // configured one: that is what makes cross-pool spill (INV-QD-14) actually
+        // route a node to a peer pool's backend (e.g. an openai-compatible/NIM pool
+        // when the primary pool is quota-degraded). Falls back to the configured
+        // provider when no slot provider is present.
+        const resolveProvider = params.createProvider ?? createFreshSessionProvider;
+        const provider = resolveProvider(slot?.providerName || params.sessionConfig?.provider, params.sessionConfig ?? {});
+        const dir = dirname(resultPath);
+        const taskPath = join(dir, `${block.block_id}.task.json`);
+        const stdoutPath = join(dir, `${block.block_id}.stdout.txt`);
+        const stderrPath = join(dir, `${block.block_id}.stderr.txt`);
+        const task = createRemediationWorkerTask({
+            runId: `${params.runId}:${block.block_id}`,
+            options: orchestratorOptions,
+            obligationId: block.block_id,
+            preferredExecutor: provider.name,
+            resultPath,
+            timeoutMs: params.sessionConfig?.timeout_ms,
+        });
+        await writeJsonFile(taskPath, task);
+        try {
+            const launch = await provider.launch({
+                ...createLaunchInputForTask(orchestratorOptions, task, {
+                    promptPath,
+                    taskPath,
+                    stdoutPath,
+                    stderrPath,
+                }),
+                // Confine the worker to its isolated worktree (cwd = repoRoot in
+                // spawnLoggedCommand). CLAUDECODE / CLAUDE_CODE_* are scrubbed from the
+                // child env there, so the worker is graded on its own state.
+                repoRoot: worktreeRoot,
+            });
+            if (!launch.accepted) {
+                return {
+                    packet,
+                    outcome: "error",
+                    error: new Error(launch.error ??
+                        `provider ${provider.name} rejected node ${block.block_id}`),
+                };
+            }
+            // The worker writes its result file per the prompt; confirm it landed and
+            // parses. Contents are adjudicated by the deterministic merge downstream.
+            const result = await readOptionalJsonFile(resultPath);
+            if (!result) {
+                return {
+                    packet,
+                    outcome: "error",
+                    error: new Error(`worker for node ${block.block_id} wrote no result at ${resultPath}`),
+                };
+            }
+            return { packet, outcome: "success" };
+        }
+        catch (err) {
+            return { packet, outcome: "error", error: err };
+        }
+    };
+}
+//# sourceMappingURL=providerNodeDispatch.js.map

package/dist/remediate/steps/providerNodeDispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerNodeDispatch.js","sourceRoot":"","sources":["../../../src/remediate/steps/providerNodeDispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,oBAAoB,EACpB,aAAa,GAKd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAsBlC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAoC;IAOpC,MAAM,mBAAmB,GAAG;QAC1B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC;IACF,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,KAAK,CAAC,QAAQ;YAClB,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;YACrC,eAAe,EAAE,CAAC;YAClB,UAAU,EAAE,GAAG;SAChB,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,MAAM;gBACN,OAAO,EAAE,OAAO;gBAChB,KAAK,EAAE,IAAI,KAAK,CAAC,+BAA+B,KAAK,CAAC,QAAQ,EAAE,CAAC;aAClE,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,6CAA6C;QAC7C,MAAM,eAAe,GAAG,MAAM,CAAC,cAAc,IAAI,0BAA0B,CAAC;QAC5E,MAAM,QAAQ,GAAG,eAAe,CAC9B,IAAI,EAAE,YAAY,IAAI,MAAM,CAAC,aAAa,EAAE,QAAQ,EACpD,MAAM,CAAC,aAAa,IAAI,EAAE,CAC3B,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,YAAY,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,aAAa,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,aAAa,CAAC,CAAC;QAE7D,MAAM,IAAI,GAAG,2BAA2B,CAAC;YACvC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE;YAC1C,OAAO,EAAE,mBAAmB;YAC5B,YAAY,EAAE,KAAK,CAAC,QAAQ;YAC5B,iBAAiB,EAAE,QAAQ,CAAC,IAAI;YAChC,UAAU;YACV,SAAS,EAAE,MAAM,CAAC,aAAa,EAAE,UAAU;SAC5C,CAAC,CAAC;QACH,MAAM,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;gBACnC,GAAG,wBAAwB,CAAC,mBAAmB,EAAE,IAAI,EAAE;oBACrD,UAAU;oBACV,QAAQ;oBACR,UAAU;oBACV,UAAU;iBACX,CAAC;gBACF,iEAAiE;gBACjE,wEAAwE;gBACxE,6DAA6D;gBAC7D,QAAQ,EAAE,YAAY;aACvB,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrB,OAAO;oBACL,MAAM;oBACN,OAAO,EAAE,OAAO;oBAChB,KAAK,EAAE,IAAI,KAAK,CACd,MAAM,CAAC,KAAK;wBACV,YAAY,QAAQ,CAAC,IAAI,kBAAkB,KAAK,CAAC,QAAQ,EAAE,CAC9D;iBACF,CAAC;YACJ,CAAC;YACD,0EAA0E;YAC1E,0EAA0E;YAC1E,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAwB,UAAU,CAAC,CAAC;YAC7E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;oBACL,MAAM;oBACN,OAAO,EAAE,OAAO;oBAChB,KAAK,EAAE,IAAI,KAAK,CACd,mBAAmB,KAAK,CAAC,QAAQ,uBAAuB,UAAU,EAAE,CACrE;iBACF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAClD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/remediate/steps/rollingSession.d.ts

@@ -0,0 +1,84 @@
+import { prepareImplementDispatch, type DispatchOptions } from "./dispatch.js";
+/**
+ * Host-subagent rolling driver (A8). One shared rolling core
+ * (`acceptNodeWorktree`) driven by host-spawned subagents via a per-completion
+ * `accept-node` callback — the conversation-first co-equal of the in-process
+ * provider engine (`driveRollingImplementDispatch`). The tool owns ALL the
+ * rolling bookkeeping (eligibility, bounded JIT worktree creation, the
+ * commit/verify/merge lifecycle, write-scope); the host only spawns a subagent
+ * per node and relays `accept-node` on each completion.
+ *
+ * Scope: one eligible frontier per next-step cycle (every node here has its deps
+ * already verified-complete, so they are mutually independent). Cross-level
+ * progression rides the existing merge-implement-results -> next-step cadence
+ * (the next frontier is planned after this one merges). Within the frontier this
+ * is FULL rolling: ~`slots` worktrees live at once, and each completion JIT
+ * dispatches the next undispatched node.
+ *
+ * Isolation is per-node-worktree (hard between nodes). Binding a host subagent to
+ * its worktree is SOFT (the orchestrator cannot cwd-confine the host's subagent),
+ * enforced by detection: a worktree-rooted prompt + the branch-diff write-scope
+ * gate at merge ⇒ a strayed subagent's node simply fails to land, never silent
+ * corruption of the main tree.
+ */
+export interface RollingFrontierNode {
+    block_id: string;
+    prompt_path: string;
+    result_path: string;
+}
+export interface RollingSession {
+    run_id: string;
+    /** Concurrency target N (from the quota scheduler), not a wave cap. */
+    slots: number;
+    /** Every eligible node in this frontier. */
+    frontier: RollingFrontierNode[];
+    /** Block ids whose worktree was created + handed to the host. */
+    dispatched: string[];
+    /** Block ids whose `acceptNodeWorktree` lifecycle has run. */
+    accepted: string[];
+}
+export type RollingDirective = {
+    kind: "dispatch";
+    node: RollingFrontierNode;
+    worktree_root: string;
+    in_flight: number;
+    accepted: number;
+    total: number;
+} | {
+    kind: "wait";
+    in_flight: number;
+    accepted: number;
+    total: number;
+} | {
+    kind: "done";
+    accepted: number;
+    total: number;
+};
+/**
+ * Prepare the host-subagent rolling dispatch for the current eligible frontier:
+ * write the worktree-rooted dispatch plan + quota, pre-create up to `slots`
+ * worktrees, and persist the rolling session. Returns the initial nodes for the
+ * host to spawn plus the artifact paths.
+ */
+export declare function prepareHostRollingDispatch(options: DispatchOptions, runId: string, waveOptions: NonNullable<Parameters<typeof prepareImplementDispatch>[3]>): Promise<{
+    session: RollingSession;
+    initial: Array<RollingFrontierNode & {
+        worktree_root: string;
+    }>;
+    planPath: string;
+    quotaPath: string;
+}>;
+/**
+ * The `accept-node` per-completion callback. Runs the shared accept lifecycle for
+ * the finished node, then JIT-dispatches the next undispatched frontier node (if
+ * any). Lock-guarded so concurrent completions don't race the session's
+ * read-modify-write (which would double-dispatch or lose an acceptance).
+ * Idempotent on a re-run for the same node (skips the lifecycle if already accepted).
+ */
+export declare function advanceHostRolling(opts: {
+    root: string;
+    artifactsDir: string;
+    runId: string;
+    blockId: string;
+}): Promise<RollingDirective>;
+//# sourceMappingURL=rollingSession.d.ts.map

package/dist/remediate/steps/rollingSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollingSession.d.ts","sourceRoot":"","sources":["../../../src/remediate/steps/rollingSession.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,wBAAwB,EAQxB,KAAK,eAAe,EACrB,MAAM,eAAe,CAAC;AAOvB;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,iEAAiE;IACjE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,MAAM,gBAAgB,GACxB;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,mBAAmB,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AA2CtD;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC,GACvE,OAAO,CAAC;IACT,OAAO,EAAE,cAAc,CAAC;IACxB,OAAO,EAAE,KAAK,CAAC,mBAAmB,GAAG;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAyCD;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0D5B"}

package/dist/remediate/steps/rollingSession.js

@@ -0,0 +1,147 @@
+import { join } from "node:path";
+import { readOptionalJsonFile, writeJsonFile, withFileLock } from "audit-tools/shared";
+import { StateStore } from "../state/store.js";
+import { prepareImplementDispatch, createWorktree, removeWorktree, ensureWorktreeNodeModules, worktreePath, worktreeBranchForBlock, acceptNodeWorktree, recordNodeAcceptOutcome, } from "./dispatch.js";
+function implementDir(artifactsDir, runId) {
+    return join(artifactsDir, "runs", runId, "implement");
+}
+function sessionPath(artifactsDir, runId) {
+    return join(implementDir(artifactsDir, runId), "rolling-session.json");
+}
+function sessionLockPath(artifactsDir, runId) {
+    return join(implementDir(artifactsDir, runId), "rolling-session.lock");
+}
+/** Remove any stale worktree, then create a fresh isolated one with node_modules linked. */
+function createNodeWorktree(root, blockId, runId) {
+    const wt = worktreePath(root, blockId, runId);
+    removeWorktree(root, wt);
+    createWorktree(root, wt, worktreeBranchForBlock(blockId, runId));
+    ensureWorktreeNodeModules(root, wt);
+}
+/** Targeted verify commands for a block (deduped), from its findings. */
+function computeTargeted(state, blockId) {
+    const block = state?.plan?.blocks.find((b) => b.block_id === blockId);
+    if (!block)
+        return [];
+    const cmds = block.items.flatMap((id) => {
+        const finding = state?.plan?.findings.find((f) => f.id === id);
+        return finding?.targeted_commands ?? [];
+    });
+    return [...new Set(cmds.filter((c) => typeof c === "string" && c.length > 0))];
+}
+/**
+ * Map a finished subagent's result file to a worker transport outcome. A node
+ * with no result, an unparseable result, or one that resolved nothing (all
+ * blocked) is treated as "error" so `acceptNodeWorktree` drops its worktree
+ * rather than landing speculative edits; the merge then routes it to triage.
+ */
+async function resultOutcome(resultPath) {
+    const result = await readOptionalJsonFile(resultPath);
+    if (!result || !Array.isArray(result.item_results))
+        return "error";
+    return result.item_results.some((r) => r.status === "resolved") ? "success" : "error";
+}
+/**
+ * Prepare the host-subagent rolling dispatch for the current eligible frontier:
+ * write the worktree-rooted dispatch plan + quota, pre-create up to `slots`
+ * worktrees, and persist the rolling session. Returns the initial nodes for the
+ * host to spawn plus the artifact paths.
+ */
+export async function prepareHostRollingDispatch(options, runId, waveOptions) {
+    const plan = await prepareImplementDispatch(options, runId, undefined, {
+        ...waveOptions,
+        // Each node runs in its own worktree, so its prompt is rooted there.
+        worktreeRootedPrompts: true,
+    });
+    const frontier = plan.items
+        .filter((i) => typeof i.block_id === "string")
+        .map((i) => ({ block_id: i.block_id, prompt_path: i.prompt_path, result_path: i.result_path }));
+    const dir = implementDir(options.artifactsDir, runId);
+    const quotaPath = join(dir, "dispatch-quota.json");
+    const quota = await readOptionalJsonFile(quotaPath);
+    const slots = Math.max(1, quota?.max_concurrent_agents ?? 1);
+    // Pre-create worktrees only for the initial bounded batch (≤ slots); the rest
+    // are JIT-created by `accept-node` as nodes complete — so ~slots worktrees
+    // exist at any time, never the whole frontier at once.
+    const initialNodes = frontier.slice(0, Math.min(slots, frontier.length));
+    for (const node of initialNodes) {
+        createNodeWorktree(options.root, node.block_id, runId);
+    }
+    const session = {
+        run_id: runId,
+        slots,
+        frontier,
+        dispatched: initialNodes.map((n) => n.block_id),
+        accepted: [],
+    };
+    await writeJsonFile(sessionPath(options.artifactsDir, runId), session);
+    return {
+        session,
+        initial: initialNodes.map((n) => ({
+            ...n,
+            worktree_root: worktreePath(options.root, n.block_id, runId),
+        })),
+        planPath: join(dir, "dispatch-plan.json"),
+        quotaPath,
+    };
+}
+/**
+ * The `accept-node` per-completion callback. Runs the shared accept lifecycle for
+ * the finished node, then JIT-dispatches the next undispatched frontier node (if
+ * any). Lock-guarded so concurrent completions don't race the session's
+ * read-modify-write (which would double-dispatch or lose an acceptance).
+ * Idempotent on a re-run for the same node (skips the lifecycle if already accepted).
+ */
+export async function advanceHostRolling(opts) {
+    return withFileLock(sessionLockPath(opts.artifactsDir, opts.runId), async () => {
+        const session = await readOptionalJsonFile(sessionPath(opts.artifactsDir, opts.runId));
+        if (!session) {
+            throw new Error(`No rolling session found for run ${opts.runId}`);
+        }
+        const node = session.frontier.find((n) => n.block_id === opts.blockId);
+        if (!node) {
+            throw new Error(`Block ${opts.blockId} is not in the rolling frontier for run ${opts.runId}`);
+        }
+        if (!session.accepted.includes(opts.blockId)) {
+            const state = await new StateStore(opts.artifactsDir).loadState();
+            const accept = acceptNodeWorktree({
+                root: opts.root,
+                runId: opts.runId,
+                blockId: opts.blockId,
+                worktreeRoot: worktreePath(opts.root, opts.blockId, opts.runId),
+                branch: worktreeBranchForBlock(opts.blockId, opts.runId),
+                workerOutcome: await resultOutcome(node.result_path),
+                targetedCommands: computeTargeted(state, opts.blockId),
+            });
+            // Persist the tool-owned verify/merge outcome so finalization (mergeImplementResults)
+            // blocks a node that self-reported resolved but never actually landed (OBL-DS-06).
+            await recordNodeAcceptOutcome(opts.artifactsDir, opts.runId, opts.blockId, accept);
+            session.accepted.push(opts.blockId);
+        }
+        const next = session.frontier.find((n) => !session.dispatched.includes(n.block_id));
+        if (next) {
+            createNodeWorktree(opts.root, next.block_id, opts.runId);
+            session.dispatched.push(next.block_id);
+            await writeJsonFile(sessionPath(opts.artifactsDir, opts.runId), session);
+            return {
+                kind: "dispatch",
+                node: next,
+                worktree_root: worktreePath(opts.root, next.block_id, opts.runId),
+                in_flight: session.dispatched.length - session.accepted.length,
+                accepted: session.accepted.length,
+                total: session.frontier.length,
+            };
+        }
+        await writeJsonFile(sessionPath(opts.artifactsDir, opts.runId), session);
+        if (session.accepted.length >= session.frontier.length) {
+            return { kind: "done", accepted: session.accepted.length, total: session.frontier.length };
+        }
+        return {
+            kind: "wait",
+            in_flight: session.dispatched.length - session.accepted.length,
+            accepted: session.accepted.length,
+            total: session.frontier.length,
+        };
+    });
+}
+//# sourceMappingURL=rollingSession.js.map

package/dist/remediate/steps/rollingSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollingSession.js","sourceRoot":"","sources":["../../../src/remediate/steps/rollingSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,UAAU,EAAyB,MAAM,mBAAmB,CAAC;AACtE,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,cAAc,EACd,yBAAyB,EACzB,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,uBAAuB,GAExB,MAAM,eAAe,CAAC;AA4DvB,SAAS,YAAY,CAAC,YAAoB,EAAE,KAAa;IACvD,OAAO,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;AACxD,CAAC;AACD,SAAS,WAAW,CAAC,YAAoB,EAAE,KAAa;IACtD,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,sBAAsB,CAAC,CAAC;AACzE,CAAC;AACD,SAAS,eAAe,CAAC,YAAoB,EAAE,KAAa;IAC1D,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,sBAAsB,CAAC,CAAC;AACzE,CAAC;AAED,4FAA4F;AAC5F,SAAS,kBAAkB,CAAC,IAAY,EAAE,OAAe,EAAE,KAAa;IACtE,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9C,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzB,cAAc,CAAC,IAAI,EAAE,EAAE,EAAE,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,yBAAyB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,yEAAyE;AACzE,SAAS,eAAe,CAAC,KAA8B,EAAE,OAAe;IACtE,MAAM,KAAK,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,OAAO,OAAO,EAAE,iBAAiB,IAAI,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAAC,UAAkB;IAC7C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAwB,UAAU,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;QAAE,OAAO,OAAO,CAAC;IACnE,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAwB,EACxB,KAAa,EACb,WAAwE;IAOxE,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE;QACrE,GAAG,WAAW;QACd,qEAAqE;QACrE,qBAAqB,EAAE,IAAI;KAC5B,CAAC,CAAC;IACH,MAAM,QAAQ,GAA0B,IAAI,CAAC,KAAK;SAC/C,MAAM,CAAC,CAAC,CAAC,EAAgD,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;SAC3F,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAElG,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAA2B,SAAS,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,qBAAqB,IAAI,CAAC,CAAC,CAAC;IAE7D,8EAA8E;IAC9E,2EAA2E;IAC3E,uDAAuD;IACvD,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,OAAO,GAAmB;QAC9B,MAAM,EAAE,KAAK;QACb,KAAK;QACL,QAAQ;QACR,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC/C,QAAQ,EAAE,EAAE;KACb,CAAC;IACF,MAAM,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IAEvE,OAAO;QACL,OAAO;QACP,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChC,GAAG,CAAC;YACJ,aAAa,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC;SAC7D,CAAC,CAAC;QACH,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC;QACzC,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAKxC;IACC,OAAO,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAC3C,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,CAAC,OAAO,2CAA2C,IAAI,CAAC,KAAK,EAAE,CAC7E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,SAAS,EAAE,CAAC;YAClE,MAAM,MAAM,GAAG,kBAAkB,CAAC;gBAChC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC;gBAC/D,MAAM,EAAE,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC;gBACxD,aAAa,EAAE,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC;gBACpD,gBAAgB,EAAE,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;aACvD,CAAC,CAAC;YACH,sFAAsF;YACtF,mFAAmF;YACnF,MAAM,uBAAuB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACnF,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpF,IAAI,IAAI,EAAE,CAAC;YACT,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACzD,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvC,MAAM,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;YACzE,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,IAAI;gBACV,aAAa,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC;gBACjE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAC9D,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;gBACjC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;aAC/B,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACvD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7F,CAAC;QACD,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM;YAC9D,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;YACjC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;SAC/B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/remediate/steps/stepUtils.d.ts

@@ -0,0 +1,63 @@
+import type { Finding, ItemSpec, RemediationBlock } from "../state/types.js";
+import type { RemediationState } from "../state/store.js";
+export type FindingRiskTier = "safe" | "substantive" | "context_dependent";
+/** One-line explanation of why the risk rule matched, shown to the reviewing LLM. */
+export interface FindingClassification {
+    tier: FindingRiskTier;
+    reason: string;
+}
+export declare const NO_CHANGE_RE: RegExp;
+/**
+ * A block is ready to implement only once every dependency block is fully
+ * resolved (all of its items terminal). Host-dispatched workers edit the main
+ * tree, so a dependent dispatched before its prerequisite would build on stale
+ * code — dependency-ordered blocks must land in separate waves. A `blocked`
+ * dependency item is NOT terminal here, so a failed prerequisite correctly
+ * leaves its dependents un-ready (they are marked blocked downstream).
+ */
+export declare function dependenciesSatisfied(block: RemediationBlock, state: RemediationState): boolean;
+/**
+ * Rolling-scheduler eligibility (INV-RS-01): a node/block is eligible to dispatch
+ * iff EVERY dependency block reached a VERIFIED-COMPLETE disposition — every dep
+ * item is `resolved` / `resolved_no_change`. This is strictly stronger than
+ * {@link dependenciesSatisfied}, which treats any terminal status (including a
+ * user SKIP) as satisfied. Under the rolling scheduler a SKIP
+ * (`ignored` / `deemed_inappropriate`) or a `blocked` dependency NEVER satisfies
+ * the edge, so a dependent of a skipped/blocked prerequisite stays ineligible and
+ * is later marked blocked rather than dispatched against a missing upstream
+ * surface.
+ *
+ * An unknown dependency id is not waited on forever (mirrors
+ * `dependenciesSatisfied`): a dangling edge cannot strand the whole DAG.
+ */
+export declare function dependencyVerifiedComplete(block: RemediationBlock, state: RemediationState): boolean;
+/**
+ * Decide whether an item spec represents a no-op (no source changes planned).
+ *
+ * The structured `no_change` flag is authoritative when the worker set it
+ * explicitly: an explicit `false` must win even when `concrete_change` happens
+ * to mention a no-change phrase about a sub-part (e.g. "no change is required in
+ * constants.ts" inside a finding that does change other files). The heuristic
+ * regex over the free-text spec is only a fallback for when `no_change` is
+ * unspecified.
+ */
+export declare function specIndicatesNoChange(spec: {
+    no_change?: boolean;
+    concrete_change?: string;
+} | undefined): boolean;
+/**
+ * A line of worker evidence that proves behavior with an EXECUTABLE assertion —
+ * a test/build/check command or a test-result count — rather than prose.
+ */
+export declare const EXECUTABLE_EVIDENCE_RE: RegExp;
+/**
+ * Whether worker evidence carries an executable verification signal (see
+ * EXECUTABLE_EVIDENCE_RE) rather than prose only. A "verified-already-satisfied"
+ * (no-change) closure must prove the behavior with an executable assertion; prose
+ * claiming "already correct" is not sufficient proof and must route to triage
+ * rather than silently closing the obligation.
+ */
+export declare function hasExecutableEvidence(evidence: readonly string[] | undefined): boolean;
+export declare function rationaleAsksForRetry(rationale: string | undefined): boolean;
+export declare function classifyFindingRisk(finding: Finding, spec: ItemSpec): FindingClassification;
+//# sourceMappingURL=stepUtils.d.ts.map

package/dist/remediate/steps/stepUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stepUtils.d.ts","sourceRoot":"","sources":["../../../src/remediate/steps/stepUtils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,aAAa,GAAG,mBAAmB,CAAC;AAE3E,qFAAqF;AACrF,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,YAAY,QAAuF,CAAC;AAEjH;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAUT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAUT;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GAClE,OAAO,CAIT;AAED;;;GAGG;AACH,eAAO,MAAM,sBAAsB,QAC2K,CAAC;AAE/M;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACtC,OAAO,CAGT;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAK5E;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,qBAAqB,CAiC3F"}

package/dist/remediate/steps/stepUtils.js

@@ -0,0 +1,117 @@
+import { isTerminalStatus, isVerifiedCompleteStatus } from "../state/itemStatus.js";
+export const NO_CHANGE_RE = /\b(already correct|no.?op|no change|nothing to (change|do|fix)|code is correct)\b/i;
+/**
+ * A block is ready to implement only once every dependency block is fully
+ * resolved (all of its items terminal). Host-dispatched workers edit the main
+ * tree, so a dependent dispatched before its prerequisite would build on stale
+ * code — dependency-ordered blocks must land in separate waves. A `blocked`
+ * dependency item is NOT terminal here, so a failed prerequisite correctly
+ * leaves its dependents un-ready (they are marked blocked downstream).
+ */
+export function dependenciesSatisfied(block, state) {
+    for (const depId of block.dependencies ?? []) {
+        const depBlock = state.plan?.blocks.find((b) => b.block_id === depId);
+        if (!depBlock)
+            continue; // unknown dependency: don't wait on it forever
+        for (const findingId of depBlock.items) {
+            const status = state.items?.[findingId]?.status;
+            if (!status || !isTerminalStatus(status))
+                return false;
+        }
+    }
+    return true;
+}
+/**
+ * Rolling-scheduler eligibility (INV-RS-01): a node/block is eligible to dispatch
+ * iff EVERY dependency block reached a VERIFIED-COMPLETE disposition — every dep
+ * item is `resolved` / `resolved_no_change`. This is strictly stronger than
+ * {@link dependenciesSatisfied}, which treats any terminal status (including a
+ * user SKIP) as satisfied. Under the rolling scheduler a SKIP
+ * (`ignored` / `deemed_inappropriate`) or a `blocked` dependency NEVER satisfies
+ * the edge, so a dependent of a skipped/blocked prerequisite stays ineligible and
+ * is later marked blocked rather than dispatched against a missing upstream
+ * surface.
+ *
+ * An unknown dependency id is not waited on forever (mirrors
+ * `dependenciesSatisfied`): a dangling edge cannot strand the whole DAG.
+ */
+export function dependencyVerifiedComplete(block, state) {
+    for (const depId of block.dependencies ?? []) {
+        const depBlock = state.plan?.blocks.find((b) => b.block_id === depId);
+        if (!depBlock)
+            continue; // unknown dependency: don't strand the DAG on it
+        for (const findingId of depBlock.items) {
+            const status = state.items?.[findingId]?.status;
+            if (!isVerifiedCompleteStatus(status))
+                return false;
+        }
+    }
+    return true;
+}
+/**
+ * Decide whether an item spec represents a no-op (no source changes planned).
+ *
+ * The structured `no_change` flag is authoritative when the worker set it
+ * explicitly: an explicit `false` must win even when `concrete_change` happens
+ * to mention a no-change phrase about a sub-part (e.g. "no change is required in
+ * constants.ts" inside a finding that does change other files). The heuristic
+ * regex over the free-text spec is only a fallback for when `no_change` is
+ * unspecified.
+ */
+export function specIndicatesNoChange(spec) {
+    if (spec?.no_change === true)
+        return true;
+    if (spec?.no_change === false)
+        return false;
+    return NO_CHANGE_RE.test(spec?.concrete_change ?? "");
+}
+/**
+ * A line of worker evidence that proves behavior with an EXECUTABLE assertion —
+ * a test/build/check command or a test-result count — rather than prose.
+ */
+export const EXECUTABLE_EVIDENCE_RE = /\b(?:npm|npx|pnpm|yarn|vitest|tsc|node)\b[^\n]*\b(?:test|run|check|build|--test|--import)\b|\b\d+\s+(?:pass(?:ed)?|fail(?:ed)?|tests?)\b|\btests?\s+pass(?:ed|ing)?\b|\b\d+\s*\/\s*\d+\s+(?:pass|green)\b/i;
+/**
+ * Whether worker evidence carries an executable verification signal (see
+ * EXECUTABLE_EVIDENCE_RE) rather than prose only. A "verified-already-satisfied"
+ * (no-change) closure must prove the behavior with an executable assertion; prose
+ * claiming "already correct" is not sufficient proof and must route to triage
+ * rather than silently closing the obligation.
+ */
+export function hasExecutableEvidence(evidence) {
+    if (!evidence || evidence.length === 0)
+        return false;
+    return evidence.some((line) => EXECUTABLE_EVIDENCE_RE.test(line));
+}
+export function rationaleAsksForRetry(rationale) {
+    if (!rationale)
+        return false;
+    return /\b(deferred?|retry|rerun|requeue|later|dedicated pass|follow-?up|after .*lands?|depends on|blocked)\b/i.test(rationale);
+}
+export function classifyFindingRisk(finding, spec) {
+    const lens = finding.lens.toLowerCase();
+    const change = spec.concrete_change.toLowerCase();
+    // Context-dependent: low confidence, breaking/compat/removal signals.
+    const lensIsBreaking = /\b(compat|api[-_]?break|interface|breaking|deprecat|remov)\b/.test(lens);
+    const changeIsDestructive = /\b(removes?|deletes?|disables?|no longer|replaces?.*incompatible|breaks?)\b/.test(change);
+    if (finding.confidence === "low") {
+        return { tier: "context_dependent", reason: "confidence is low" };
+    }
+    if (lensIsBreaking) {
+        return { tier: "context_dependent", reason: `lens "${finding.lens}" signals a breaking/compat concern` };
+    }
+    if (changeIsDestructive) {
+        return { tier: "context_dependent", reason: "concrete_change contains a removal or disabling verb" };
+    }
+    // Safe: style / formatting / cosmetic / low-severity config with high confidence.
+    const lensIsSafe = /\b(style|format|lint|typo|whitespace|cosmetic|config)\b/.test(lens);
+    const lowRisk = (finding.severity === "low" || finding.severity === "info") &&
+        finding.confidence === "high";
+    if (lensIsSafe) {
+        return { tier: "safe", reason: `lens "${finding.lens}" is a style/format/config lens` };
+    }
+    if (lowRisk) {
+        return { tier: "safe", reason: `severity=${finding.severity} + confidence=high indicates minimal risk` };
+    }
+    return { tier: "substantive", reason: `lens "${finding.lens}", severity=${finding.severity} — no safe/breaking signal matched` };
+}
+//# sourceMappingURL=stepUtils.js.map

package/dist/remediate/steps/stepUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stepUtils.js","sourceRoot":"","sources":["../../../src/remediate/steps/stepUtils.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAUpF,MAAM,CAAC,MAAM,YAAY,GAAG,oFAAoF,CAAC;AAEjH;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAuB,EACvB,KAAuB;IAEvB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ;YAAE,SAAS,CAAC,+CAA+C;QACxE,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAChD,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAuB,EACvB,KAAuB;IAEvB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ;YAAE,SAAS,CAAC,iDAAiD;QAC1E,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAChD,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAmE;IAEnE,IAAI,IAAI,EAAE,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,EAAE,SAAS,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,4MAA4M,CAAC;AAE/M;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAuC;IAEvC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAA6B;IACjE,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,wGAAwG,CAAC,IAAI,CAClH,SAAS,CACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,IAAc;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;IAElD,sEAAsE;IACtE,MAAM,cAAc,GAAG,8DAA8D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjG,MAAM,mBAAmB,GACvB,6EAA6E,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAE7F,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,OAAO,CAAC,IAAI,qCAAqC,EAAE,CAAC;IAC3G,CAAC;IACD,IAAI,mBAAmB,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;IACvG,CAAC;IAED,kFAAkF;IAClF,MAAM,UAAU,GAAG,yDAAyD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxF,MAAM,OAAO,GACX,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC;QAC3D,OAAO,CAAC,UAAU,KAAK,MAAM,CAAC;IAEhC,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,OAAO,CAAC,IAAI,iCAAiC,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,OAAO,CAAC,QAAQ,2CAA2C,EAAE,CAAC;IAC3G,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,OAAO,CAAC,IAAI,eAAe,OAAO,CAAC,QAAQ,oCAAoC,EAAE,CAAC;AACnI,CAAC"}

package/dist/remediate/steps/stepWriter.d.ts

@@ -0,0 +1,27 @@
+import { type RemediationStep, type RemediationStepKind, type RemediationStepStatus } from "./types.js";
+export interface WriteStepInput {
+    stepKind: RemediationStepKind;
+    status: RemediationStepStatus;
+    runId: string;
+    repoRoot: string;
+    artifactsDir: string;
+    prompt: string;
+    allowedCommands?: string[];
+    stopCondition: string;
+    artifactPaths?: Record<string, string>;
+}
+/** `<artifactsDir>/steps` — re-exported from the shared path authority. */
+export declare function stepsDir(artifactsDir: string): string;
+export declare function currentStepPath(artifactsDir: string): string;
+export declare function currentPromptPath(artifactsDir: string): string;
+/**
+ * Write the remediation step contract. Delegates to the shared
+ * `writeStepContract` (drift-plan R3) which owns the steps/ filenames, mkdir,
+ * prompt write, atomic current-step.json write, the forward-slash normalization
+ * of ALL host-facing path fields, and the canonical-paths-win merge. This
+ * wrapper only supplies the remediation contract version, the remediation
+ * `step_kind` enum, and the trim-leading-whitespace behaviour remediation
+ * prompts rely on.
+ */
+export declare function writeCurrentStep({ stepKind, status, runId, repoRoot, artifactsDir, prompt, allowedCommands, stopCondition, artifactPaths, }: WriteStepInput): Promise<RemediationStep>;
+//# sourceMappingURL=stepWriter.d.ts.map

package/dist/remediate/steps/stepWriter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stepWriter.d.ts","sourceRoot":"","sources":["../../../src/remediate/steps/stepWriter.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC3B,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,2EAA2E;AAC3E,wBAAgB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,QAAQ,EACR,MAAM,EACN,KAAK,EACL,QAAQ,EACR,YAAY,EACZ,MAAM,EACN,eAAoB,EACpB,aAAa,EACb,aAAkB,GACnB,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAc3C"}

package/dist/remediate/steps/stepWriter.js

@@ -0,0 +1,37 @@
+import { writeStepContract, stepsDir as sharedStepsDir, currentStepPath as sharedCurrentStepPath, currentPromptPath as sharedCurrentPromptPath, } from "audit-tools/shared";
+import { REMEDIATION_STEP_CONTRACT_VERSION, } from "./types.js";
+/** `<artifactsDir>/steps` — re-exported from the shared path authority. */
+export function stepsDir(artifactsDir) {
+    return sharedStepsDir(artifactsDir);
+}
+export function currentStepPath(artifactsDir) {
+    return sharedCurrentStepPath(artifactsDir);
+}
+export function currentPromptPath(artifactsDir) {
+    return sharedCurrentPromptPath(artifactsDir);
+}
+/**
+ * Write the remediation step contract. Delegates to the shared
+ * `writeStepContract` (drift-plan R3) which owns the steps/ filenames, mkdir,
+ * prompt write, atomic current-step.json write, the forward-slash normalization
+ * of ALL host-facing path fields, and the canonical-paths-win merge. This
+ * wrapper only supplies the remediation contract version, the remediation
+ * `step_kind` enum, and the trim-leading-whitespace behaviour remediation
+ * prompts rely on.
+ */
+export async function writeCurrentStep({ stepKind, status, runId, repoRoot, artifactsDir, prompt, allowedCommands = [], stopCondition, artifactPaths = {}, }) {
+    return writeStepContract({
+        contractVersion: REMEDIATION_STEP_CONTRACT_VERSION,
+        stepKind,
+        status,
+        runId,
+        repoRoot,
+        artifactsDir,
+        prompt,
+        allowedCommands,
+        stopCondition,
+        artifactPaths,
+        trimPromptStart: true,
+    });
+}
+//# sourceMappingURL=stepWriter.js.map

package/dist/remediate/steps/stepWriter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stepWriter.js","sourceRoot":"","sources":["../../../src/remediate/steps/stepWriter.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,QAAQ,IAAI,cAAc,EAC1B,eAAe,IAAI,qBAAqB,EACxC,iBAAiB,IAAI,uBAAuB,GAC7C,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,iCAAiC,GAIlC,MAAM,YAAY,CAAC;AAcpB,2EAA2E;AAC3E,MAAM,UAAU,QAAQ,CAAC,YAAoB;IAC3C,OAAO,cAAc,CAAC,YAAY,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,YAAoB;IAClD,OAAO,qBAAqB,CAAC,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,YAAoB;IACpD,OAAO,uBAAuB,CAAC,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,QAAQ,EACR,MAAM,EACN,KAAK,EACL,QAAQ,EACR,YAAY,EACZ,MAAM,EACN,eAAe,GAAG,EAAE,EACpB,aAAa,EACb,aAAa,GAAG,EAAE,GACH;IACf,OAAO,iBAAiB,CAA+C;QACrE,eAAe,EAAE,iCAAiC;QAClD,QAAQ;QACR,MAAM;QACN,KAAK;QACL,QAAQ;QACR,YAAY;QACZ,MAAM;QACN,eAAe;QACf,aAAa;QACb,aAAa;QACb,eAAe,EAAE,IAAI;KACtB,CAAC,CAAC;AACL,CAAC"}