audit-tools 0.30.2 → 0.30.4

package/dist/audit/orchestrator/intentCheckpointGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"intentCheckpointGate.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/intentCheckpointGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAkCxF,mEAAmE;AACnE,MAAM,CAAC,MAAM,wBAAwB,GAAoB;IACvD,OAAO,EAAE,gCAAgC;IACzC,cAAc,EAAE,CAAC,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,CAAC;CAC9F,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,mCAAmC,GAAG,mCAAmC,CAAC;AAEvF;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAwC,EACxC,SAA0B,wBAAwB;IAElD,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,2EAA2E;YAC3E,uDAAuD;YACvD,UAAU,CAAC,KAAe,CAAC;gBACzB,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAKlC;IACC,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,wBAAwB,CAAC;IAC1E,MAAM,qBAAqB,GACzB,KAAK,CAAC,qBAAqB,IAAI,mCAAmC,CAAC;IACrE,MAAM,UAAU,GAAG,WAAW,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,GAAG,UAAU,IAAI,KAAK,CAAC,OAAO,IAAI,qBAAqB,EAAE,CAAC;AACnE,CAAC;AAQD,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAC7B,eAAuB,EACvB,aAAqB,EACrB,WAAmB;IAEnB,OAAO,WAAW,CAChB,eAAe,CAAC,CAAC,eAAe,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAQrD;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,eAAe,IAAI,wBAAwB,CAAC;IACjE,MAAM,eAAe,GAAG,wBAAwB,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,WAAW,GAAG,kBAAkB,CAAC;QACrC,eAAe,EAAE,MAAM;QACvB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;KACnD,CAAC,CAAC;IAEH,IAAI,eAAe,KAAK,aAAa,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,eAAe,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC;QACzE,0EAA0E;QAC1E,yDAAyD;QACzD,OAAO,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;IACD,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAChD,CAAC;AAaD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAI,IAShD;IACC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;IAE1C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC1D,gEAAgE;QAChE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QAEpE,mCAAmC;QACnC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEtC,2DAA2D;QAC3D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;YAC7C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,+DAA+D;gBAC/D,OAAO,EAAE,SAAS,EAAE,SAA0B,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;YACtE,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAc,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAC7E,CAAC;QACD,oEAAoE;IACtE,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,gFAAgF;IAChF,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;QAC9B,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpC,0EAA0E;YAC1E,4DAA4D;YAC5D,MAAM,oBAAoB,CACxB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,KAAK,EACV;gBACE,EAAE,EAAE,0CAA0C,IAAI,CAAC,KAAK,EAAE;gBAC1D,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,KAAK;gBACf,IAAI,EAAE,wBAAwB;gBAC9B,IAAI,EACF,iFAAiF;oBACjF,GAAG,WAAW,gGAAgG;aACjH,EACD,YAAY,CACb,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/audit/orchestrator/ledger.d.ts

@@ -0,0 +1,30 @@
+import type { AuditResult } from "../types.js";
+/**
+ * Stamp a result with its seam-derived ledger keys (instance_id, identity_key,
+ * idempotency_key) when they are not already present. Idempotent: a record that
+ * already carries an idempotency_key keeps its identity/idempotency keys (so a
+ * replay hashes identically), and only re-mints an absent instance_id.
+ */
+export declare function stampLedgerKeys(result: AuditResult): AuditResult;
+/**
+ * Append incoming results to the existing ledger, append-only and IDEMPOTENT on
+ * idempotency_key. Each appended record gets a fresh instance_id; a replay (an
+ * incoming result whose idempotency_key already exists in the ledger OR collides
+ * with an earlier record in the same batch) is a no-op. Distinct idempotency_keys
+ * always both persist — never merged, never last-writer-wins (fail-2).
+ *
+ * The existing ledger is returned by reference-extended copy; existing records
+ * are left untouched (append-only).
+ */
+export declare function appendResultsToLedger(existing: AuditResult[] | undefined, incoming: AuditResult[]): AuditResult[];
+/**
+ * Re-associate ledger records to tasks. Groups one-to-many by `identity_key`
+ * (multiple distinct results legitimately share a coordinate — base vs. deepening
+ * / steward) and resolves logical identity by `idempotency_key`. Records are
+ * stamped on read if a legacy entry predates the keys, so a ledger written before
+ * O2 still groups correctly. RETAIN-UNASSIGNED: every record appears in exactly
+ * one group keyed by its identity_key — none is dropped because its task is
+ * absent (INV-3); the caller decides what to do with a group whose task is gone.
+ */
+export declare function groupLedgerByIdentity(ledger: AuditResult[]): Map<string, AuditResult[]>;
+//# sourceMappingURL=ledger.d.ts.map

package/dist/audit/orchestrator/ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/ledger.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAoB/C;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAwBhE;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,WAAW,EAAE,GAAG,SAAS,EACnC,QAAQ,EAAE,WAAW,EAAE,GACtB,WAAW,EAAE,CAkBf;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,WAAW,EAAE,GACpB,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAS5B"}

package/dist/audit/orchestrator/ledger.js

@@ -0,0 +1,126 @@
+/**
+ * O2 — the append-only, instance-keyed, idempotent audit-results ledger.
+ *
+ * `audit_results.jsonl` is the cumulative store of every accepted AuditResult.
+ * This module is the SOLE place the ledger grows, so its three invariants hold
+ * by construction (never by a caller remembering them):
+ *
+ *  - APPEND-ONLY, INSTANCE-KEYED (INV-1 / CE-001 / fail-2): every appended record
+ *    carries a fresh per-record `instance_id` minted from the shared seam
+ *    (`newInstanceId`). The ledger keys on this, so identity_key / idempotency_key
+ *    are grouping/idempotency keys, NEVER primary keys — distinct records are never
+ *    merged or last-writer-wins'd.
+ *
+ *  - IDEMPOTENT ON idempotency_key (INV-2 / CE-001b / fail-4): a record is appended
+ *    only when no existing record shares its `idempotency_key`. A replay of the same
+ *    logical result is therefore a no-op. Two genuinely-different same-coordinate
+ *    results (base vs. deepening / steward / re-dispatch) carry distinct
+ *    discriminators → distinct idempotency_keys → both persist (CE-001).
+ *
+ *  - RETAIN-UNASSIGNED (INV-3): re-association groups records to tasks by
+ *    `identity_key` one-to-many and resolves logical identity by `idempotency_key`.
+ *    A result whose owning task is absent from the active manifest is NEVER pruned —
+ *    it stays in the ledger, just un-associated.
+ *
+ * All three keys are imported from the single content-key seam
+ * (`src/shared/contentKey.ts`); this module never re-derives a key.
+ */
+import { buildResultContentDiscriminator, identityKey, idempotencyKey, newInstanceId, } from "audit-tools/shared";
+/**
+ * Deterministic, TOOL-OWNED mapping from a result's coordinate to its emit
+ * source. The discriminator recipe lives in the seam; the SOURCE selection lives
+ * here because it is audit-domain knowledge: selective-deepening / steward tasks
+ * are minted with `deepening:` / `steward:` task-id prefixes (see
+ * `selectiveDeepening/shared.ts#taskIdFor`), so a deepening or steward result
+ * that shares a base result's {unit_id, lens, pass_id} coordinate legitimately
+ * gets a DISTINCT idempotency_key and both persist (CE-001). Anything else is a
+ * base result. (Re-dispatch attempts are not yet stamped on results; when O3
+ * adds an attempt counter it maps to `source: 'redispatch'` here.)
+ */
+function emitSourceFor(result) {
+    const taskId = result.task_id ?? "";
+    if (taskId.startsWith("steward:"))
+        return "steward";
+    if (taskId.startsWith("deepening:"))
+        return "deepening";
+    return "base";
+}
+/**
+ * Stamp a result with its seam-derived ledger keys (instance_id, identity_key,
+ * idempotency_key) when they are not already present. Idempotent: a record that
+ * already carries an idempotency_key keeps its identity/idempotency keys (so a
+ * replay hashes identically), and only re-mints an absent instance_id.
+ */
+export function stampLedgerKeys(result) {
+    const identity_key = result.identity_key ??
+        identityKey({
+            unit_id: result.unit_id,
+            lens: result.lens,
+            pass_id: result.pass_id,
+        });
+    const idempotency_key = result.idempotency_key ??
+        idempotencyKey({
+            unit_id: result.unit_id,
+            lens: result.lens,
+            pass_id: result.pass_id,
+            result_content_discriminator: buildResultContentDiscriminator({
+                source: emitSourceFor(result),
+            }),
+        });
+    return {
+        ...result,
+        instance_id: result.instance_id ?? newInstanceId(),
+        identity_key,
+        idempotency_key,
+    };
+}
+/**
+ * Append incoming results to the existing ledger, append-only and IDEMPOTENT on
+ * idempotency_key. Each appended record gets a fresh instance_id; a replay (an
+ * incoming result whose idempotency_key already exists in the ledger OR collides
+ * with an earlier record in the same batch) is a no-op. Distinct idempotency_keys
+ * always both persist — never merged, never last-writer-wins (fail-2).
+ *
+ * The existing ledger is returned by reference-extended copy; existing records
+ * are left untouched (append-only).
+ */
+export function appendResultsToLedger(existing, incoming) {
+    const ledger = [...(existing ?? [])];
+    const seen = new Set();
+    for (const record of ledger) {
+        const key = record.idempotency_key;
+        if (typeof key === "string")
+            seen.add(key);
+    }
+    for (const raw of incoming) {
+        const stamped = stampLedgerKeys(raw);
+        const key = stamped.idempotency_key;
+        if (seen.has(key)) {
+            // Replay of an already-ingested logical result — no-op (INV-2).
+            continue;
+        }
+        seen.add(key);
+        ledger.push(stamped);
+    }
+    return ledger;
+}
+/**
+ * Re-associate ledger records to tasks. Groups one-to-many by `identity_key`
+ * (multiple distinct results legitimately share a coordinate — base vs. deepening
+ * / steward) and resolves logical identity by `idempotency_key`. Records are
+ * stamped on read if a legacy entry predates the keys, so a ledger written before
+ * O2 still groups correctly. RETAIN-UNASSIGNED: every record appears in exactly
+ * one group keyed by its identity_key — none is dropped because its task is
+ * absent (INV-3); the caller decides what to do with a group whose task is gone.
+ */
+export function groupLedgerByIdentity(ledger) {
+    const byIdentity = new Map();
+    for (const raw of ledger) {
+        const record = stampLedgerKeys(raw);
+        const group = byIdentity.get(record.identity_key) ?? [];
+        group.push(record);
+        byIdentity.set(record.identity_key, group);
+    }
+    return byIdentity;
+}
+//# sourceMappingURL=ledger.js.map

package/dist/audit/orchestrator/ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAEL,+BAA+B,EAC/B,WAAW,EACX,cAAc,EACd,aAAa,GACd,MAAM,oBAAoB,CAAC;AAG5B;;;;;;;;;;GAUG;AACH,SAAS,aAAa,CAAC,MAAmB;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACpC,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,WAAW,CAAC;IACxD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAmB;IACjD,MAAM,YAAY,GAChB,MAAM,CAAC,YAAY;QACnB,WAAW,CAAC;YACV,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;IACL,MAAM,eAAe,GACnB,MAAM,CAAC,eAAe;QACtB,cAAc,CAAC;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,4BAA4B,EAAE,+BAA+B,CAAC;gBAC5D,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;aAC9B,CAAC;SACH,CAAC,CAAC;IACL,OAAO;QACL,GAAG,MAAM;QACT,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,aAAa,EAAE;QAClD,YAAY;QACZ,eAAe;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAmC,EACnC,QAAuB;IAEvB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC;QACnC,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,OAAO,CAAC,eAAgB,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,gEAAgE;YAChE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAqB;IAErB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,YAAa,CAAC,IAAI,EAAE,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,YAAa,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/audit/orchestrator/nextStep.d.ts

@@ -1,3 +1,4 @@
+import { type FrictionTriageDecision } from "audit-tools/shared";
 import type { ArtifactBundle } from "../io/artifacts.js";
 import type { AuditObligation, AuditState } from "../types/auditState.js";
 export interface NextStepDecision {
@@ -15,35 +16,16 @@ export declare const FRICTION_CAPTURE_OBLIGATION_ID = "friction_capture_current"
 export declare const PRIORITY: string[];
 export declare function findObligation(obligations: AuditObligation[]): AuditObligation | undefined;
 export declare function decideNextStep(bundle: ArtifactBundle): NextStepDecision;
-/** The terminal friction-capture close-out decision for the audit half. */
-export interface AuditFrictionCloseoutDecision {
-    /**
-     * "capture" → the close-out must fire this pass (a friction step is emitted and a
-     * degrade-clean record persisted). "captured" → already recorded for this run_id;
-     * the close-out is satisfied and the run proceeds to its complete/present terminal.
-     */
-    action: "capture" | "captured";
-    /** The run_id-keyed friction record path (always set, for the handoff pointer). */
-    recordPath: string;
-}
 /**
- * Resolve (and, on first fire, satisfy) the terminal friction-capture close-out for
- * the audit half. This is the audit analog of remediate-code's friction gate in
- * `handleComplete`:
- *
- *  - DETERMINISTIC: keyed only off the on-disk record at `(artifactsDir, runId)` via
- *    the SINGLE shared helper — never host discretion or a bundle flag.
- *  - DEGRADE-CLEANLY: on first fire it persists a zero-friction record up front, so
- *    the close-out is immediately satisfiable and can NEVER block completion.
- *  - NEVER RE-LOOP: once a record exists, returns "captured" and the run proceeds —
- *    the close-out fires at most once per run.
- *  - PARITY: identical shape + persist helper to the remediate side (single-sourced
- *    in `audit-tools/shared`), so the two halves cannot drift.
- *  - NEVER couples to any repo's backlog doc — the record lives under the run's own
- *    artifacts dir.
- *
- * Returns "capture" the first time (the host should be prompted to optionally enrich
- * the persisted record), "captured" thereafter.
+ * The terminal friction-TRIAGE close-out for the audit half. Thin delegation to the
+ * single-sourced `decideFrictionTriage` (`audit-tools/shared`) so the triage shape,
+ * disposition vocabulary, blocking semantics, and close-out logic cannot drift from
+ * the remediate half. Drops the former false-green (an empty up-front record no
+ * longer satisfies): the close-out blocks ("dispose") until every captured
+ * mechanical event AND every surfaced agent-feedback reflection carries a
+ * disposition; an empty set (zero events AND zero reflections) is trivially
+ * "disposed". Keyed only off `(artifactsDir, runId)`; never coupled to any repo's
+ * backlog doc.
  */
-export declare function decideAuditFrictionCloseout(artifactsDir: string, runId: string): Promise<AuditFrictionCloseoutDecision>;
+export declare function decideAuditFrictionCloseout(artifactsDir: string, runId: string): Promise<FrictionTriageDecision>;
 //# sourceMappingURL=nextStep.d.ts.map

package/dist/audit/orchestrator/nextStep.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nextStep.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/nextStep.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAI1E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,6BAA6B,CAAC;AAEzE,eAAO,MAAM,QAAQ,EAAE,MAAM,EAwB5B,CAAC;AAMF,wBAAgB,cAAc,CAC5B,WAAW,EAAE,eAAe,EAAE,GAC7B,eAAe,GAAG,SAAS,CAE7B;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,gBAAgB,CAqCvE;AAED,2EAA2E;AAC3E,MAAM,WAAW,6BAA6B;IAC5C;;;;OAIG;IACH,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;IAC/B,mFAAmF;IACnF,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAC/C,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,6BAA6B,CAAC,CAYxC"}
+{"version":3,"file":"nextStep.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/nextStep.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAI1E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,6BAA6B,CAAC;AAEzE,eAAO,MAAM,QAAQ,EAAE,MAAM,EAwB5B,CAAC;AAMF,wBAAgB,cAAc,CAC5B,WAAW,EAAE,eAAe,EAAE,GAC7B,eAAe,GAAG,SAAS,CAE7B;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,gBAAgB,CAqCvE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,2BAA2B,CAC/C,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,sBAAsB,CAAC,CAEjC"}

package/dist/audit/orchestrator/nextStep.js

@@ -1,5 +1,5 @@
 import { findFirstActionableObligation } from "audit-tools/shared";
-import { frictionCaptured, persistFrictionCapture, frictionCapturePath, } from "audit-tools/shared";
+import { decideFrictionTriage, } from "audit-tools/shared";
 import { EXECUTOR_REGISTRY } from "./executors.js";
 import { deriveAuditState } from "./state.js";
 /**
@@ -74,35 +74,17 @@ export function decideNextStep(bundle) {
     };
 }
 /**
- * Resolve (and, on first fire, satisfy) the terminal friction-capture close-out for
- * the audit half. This is the audit analog of remediate-code's friction gate in
- * `handleComplete`:
- *
- *  - DETERMINISTIC: keyed only off the on-disk record at `(artifactsDir, runId)` via
- *    the SINGLE shared helper — never host discretion or a bundle flag.
- *  - DEGRADE-CLEANLY: on first fire it persists a zero-friction record up front, so
- *    the close-out is immediately satisfiable and can NEVER block completion.
- *  - NEVER RE-LOOP: once a record exists, returns "captured" and the run proceeds —
- *    the close-out fires at most once per run.
- *  - PARITY: identical shape + persist helper to the remediate side (single-sourced
- *    in `audit-tools/shared`), so the two halves cannot drift.
- *  - NEVER couples to any repo's backlog doc — the record lives under the run's own
- *    artifacts dir.
- *
- * Returns "capture" the first time (the host should be prompted to optionally enrich
- * the persisted record), "captured" thereafter.
+ * The terminal friction-TRIAGE close-out for the audit half. Thin delegation to the
+ * single-sourced `decideFrictionTriage` (`audit-tools/shared`) so the triage shape,
+ * disposition vocabulary, blocking semantics, and close-out logic cannot drift from
+ * the remediate half. Drops the former false-green (an empty up-front record no
+ * longer satisfies): the close-out blocks ("dispose") until every captured
+ * mechanical event AND every surfaced agent-feedback reflection carries a
+ * disposition; an empty set (zero events AND zero reflections) is trivially
+ * "disposed". Keyed only off `(artifactsDir, runId)`; never coupled to any repo's
+ * backlog doc.
  */
 export async function decideAuditFrictionCloseout(artifactsDir, runId) {
-    const recordPath = frictionCapturePath(artifactsDir, runId);
-    if (await frictionCaptured(artifactsDir, runId)) {
-        return { action: "captured", recordPath };
-    }
-    await persistFrictionCapture({
-        artifactsDir,
-        runId,
-        tool: "audit-code",
-        frictions: [],
-    });
-    return { action: "capture", recordPath };
+    return decideFrictionTriage(artifactsDir, runId, "audit-code");
 }
 //# sourceMappingURL=nextStep.js.map

package/dist/audit/orchestrator/nextStep.js.map

@@ -1 +1 @@
-{"version":3,"file":"nextStep.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/nextStep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAS9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,0BAA0B,CAAC;AAEzE,MAAM,CAAC,MAAM,QAAQ,GAAa;IAChC,uBAAuB;IACvB,eAAe;IACf,kBAAkB;IAClB,oBAAoB;IACpB,iBAAiB;IACjB,qBAAqB;IACrB,0BAA0B;IAC1B,2BAA2B;IAC3B,2BAA2B;IAC3B,kCAAkC;IAClC,oCAAoC;IACpC,oBAAoB;IACpB,uBAAuB;IACvB,wBAAwB;IACxB,4BAA4B;IAC5B,mBAAmB;IACnB,6BAA6B;IAC7B,gFAAgF;IAChF,kFAAkF;IAClF,+EAA+E;IAC/E,yEAAyE;IACzE,mFAAmF;IACnF,8BAA8B;CAC/B,CAAC;AAEF,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,sDAAsD;AACtD,MAAM,UAAU,cAAc,CAC5B,WAA8B;IAE9B,OAAO,6BAA6B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAsB;IACnD,4EAA4E;IAC5E,kEAAkE;IAClE,IAAI,MAAM,CAAC,WAAW,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC9C,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,WAAW;YACzB,mBAAmB,EAAE,IAAI;YACzB,iBAAiB,EAAE,IAAI;YACvB,MAAM,EAAE,gDAAgD;SACzD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAE/C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,KAAK;YACL,mBAAmB,EAAE,IAAI;YACzB,iBAAiB,EAAE,IAAI;YACvB,MAAM,EACJ,KAAK,CAAC,MAAM,KAAK,UAAU;gBACzB,CAAC,CAAC,gDAAgD;gBAClD,CAAC,CAAC,6CAA6C;SACpD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/C,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CACtC,CAAC;IACF,OAAO;QACL,KAAK;QACL,mBAAmB,EAAE,IAAI,CAAC,EAAE;QAC5B,iBAAiB,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI;QACvC,MAAM,EAAE,QAAQ;YACd,CAAC,CAAC,mDAAmD,IAAI,CAAC,EAAE,GAAG;YAC/D,CAAC,CAAC,oCAAoC,IAAI,CAAC,EAAE,8IAA8I;KAC9L,CAAC;AACJ,CAAC;AAcD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,YAAoB,EACpB,KAAa;IAEb,MAAM,UAAU,GAAG,mBAAmB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC5D,IAAI,MAAM,gBAAgB,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,sBAAsB,CAAC;QAC3B,YAAY;QACZ,KAAK;QACL,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,EAAE;KACd,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"nextStep.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/nextStep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EACL,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAS9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,0BAA0B,CAAC;AAEzE,MAAM,CAAC,MAAM,QAAQ,GAAa;IAChC,uBAAuB;IACvB,eAAe;IACf,kBAAkB;IAClB,oBAAoB;IACpB,iBAAiB;IACjB,qBAAqB;IACrB,0BAA0B;IAC1B,2BAA2B;IAC3B,2BAA2B;IAC3B,kCAAkC;IAClC,oCAAoC;IACpC,oBAAoB;IACpB,uBAAuB;IACvB,wBAAwB;IACxB,4BAA4B;IAC5B,mBAAmB;IACnB,6BAA6B;IAC7B,gFAAgF;IAChF,kFAAkF;IAClF,+EAA+E;IAC/E,yEAAyE;IACzE,mFAAmF;IACnF,8BAA8B;CAC/B,CAAC;AAEF,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,sDAAsD;AACtD,MAAM,UAAU,cAAc,CAC5B,WAA8B;IAE9B,OAAO,6BAA6B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAsB;IACnD,4EAA4E;IAC5E,kEAAkE;IAClE,IAAI,MAAM,CAAC,WAAW,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC9C,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,WAAW;YACzB,mBAAmB,EAAE,IAAI;YACzB,iBAAiB,EAAE,IAAI;YACvB,MAAM,EAAE,gDAAgD;SACzD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAE/C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,KAAK;YACL,mBAAmB,EAAE,IAAI;YACzB,iBAAiB,EAAE,IAAI;YACvB,MAAM,EACJ,KAAK,CAAC,MAAM,KAAK,UAAU;gBACzB,CAAC,CAAC,gDAAgD;gBAClD,CAAC,CAAC,6CAA6C;SACpD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/C,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CACtC,CAAC;IACF,OAAO;QACL,KAAK;QACL,mBAAmB,EAAE,IAAI,CAAC,EAAE;QAC5B,iBAAiB,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI;QACvC,MAAM,EAAE,QAAQ;YACd,CAAC,CAAC,mDAAmD,IAAI,CAAC,EAAE,GAAG;YAC/D,CAAC,CAAC,oCAAoC,IAAI,CAAC,EAAE,8IAA8I;KAC9L,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,YAAoB,EACpB,KAAa;IAEb,OAAO,oBAAoB,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;AACjE,CAAC"}

package/dist/audit/orchestrator/resultBaseline.d.ts

@@ -0,0 +1,82 @@
+/**
+ * O2 ↔ F1 residual-risk fix for judge-accepted CE-011: element-staleness for an
+ * already-ingested logical result must compare a FRESHLY-COMPUTED current
+ * `contentKey` (derived from the LIVE `task_content_signature` at advance time)
+ * against a prior BASELINE `contentKey` — and that baseline must live OUTSIDE the
+ * immutable per-record ledger instance.
+ *
+ * Why not read the contentKey off the ledger record? The append-only ledger
+ * (INV-O2-1) keys records on `idempotency_key`, which is signature-STABLE: a
+ * benign content edit (C1 → C2) does NOT move it, so idempotent re-ingest of the
+ * already-ingested result stays a no-op (no duplicate record is appended). If
+ * staleness ALSO read its prior contentKey from that same immutable record, the
+ * record would still carry C1 and a benign edit could never fire staleness — the
+ * exact CE-011 residual hole. So the baseline contentKey is persisted in a
+ * SEPARATE store (`artifact_metadata.result_baselines`, keyed by
+ * `idempotency_key`) that the staleness gate updates as the live signature moves,
+ * while the ledger record itself is never mutated. Append-only ledger invariants
+ * are therefore untouched.
+ *
+ * The comparison driver is the seam's `contentKey` (signature-SENSITIVE), so:
+ *   live C2 != baseline C1  ⟹  staleness FIRES,
+ * while the seam's signature-STABLE `idempotencyKey` keeps idempotent re-ingest a
+ * no-op. The two are reconciled by construction (see src/shared/contentKey.ts).
+ */
+import { type ResultEmitSource } from "audit-tools/shared";
+/**
+ * The baseline store — the per-logical-result contentKey snapshot, keyed by the
+ * signature-STABLE `idempotency_key`. Persisted in `artifact_metadata` OUTSIDE
+ * the per-record ledger, so updating a baseline never mutates an immutable ledger
+ * record (INV-O2-1 untouched).
+ */
+export type ResultBaselineStore = Record<string, string>;
+/** The live coordinate + signature needed to freshly compute the current keys. */
+export interface LiveResultKeyInput {
+    unit_id: string;
+    lens: string;
+    pass_id: string;
+    /** Tool-owned emit source (base | deepening | steward | redispatch). */
+    source: ResultEmitSource;
+    /** Required when `source === 'redispatch'`. */
+    attempt?: number;
+    /**
+     * The LIVE task-content signature derived from the current task content at
+     * advance time — NEVER a value read off a stored ledger record.
+     */
+    task_content_signature: string;
+}
+/**
+ * Freshly derive the {idempotency_key, content_key} pair for a live result from
+ * the seam — both computed from the live `task_content_signature` at advance
+ * time. `idempotency_key` is the baseline-store key (signature-STABLE);
+ * `content_key` is the staleness driver (signature-SENSITIVE).
+ */
+export declare function deriveLiveResultKeys(input: LiveResultKeyInput): {
+    idempotency_key: string;
+    content_key: string;
+};
+/**
+ * Is the already-ingested logical result stale, given its LIVE keys? Stale iff a
+ * baseline exists for the idempotency_key AND the freshly-computed live
+ * content_key differs from it. A result with no recorded baseline is NOT stale —
+ * it has simply never been compared (the first ingest establishes the baseline).
+ *
+ * The caller supplies live keys via `deriveLiveResultKeys` (freshly computed from
+ * the live signature) — this function NEVER reads a contentKey off a ledger
+ * record.
+ */
+export declare function isResultStaleAgainstBaseline(baselines: ResultBaselineStore | undefined, liveKeys: {
+    idempotency_key: string;
+    content_key: string;
+}): boolean;
+/**
+ * Return an updated baseline store with this logical result's baseline set to its
+ * live content_key. Pure: returns a new object, never mutates the input — so a
+ * caller persists the result through the normal artifact_metadata write path.
+ * Idempotent: recording the same content_key again yields an equal store.
+ */
+export declare function recordResultBaseline(baselines: ResultBaselineStore | undefined, liveKeys: {
+    idempotency_key: string;
+    content_key: string;
+}): ResultBaselineStore;
+//# sourceMappingURL=resultBaseline.d.ts.map

package/dist/audit/orchestrator/resultBaseline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resultBaseline.d.ts","sourceRoot":"","sources":["../../../src/audit/orchestrator/resultBaseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAE5B;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEzD,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,MAAM,EAAE,gBAAgB,CAAC;IACzB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,GAAG;IAC/D,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACrB,CAkBA;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,mBAAmB,GAAG,SAAS,EAC1C,QAAQ,EAAE;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACzD,OAAO,CAIT;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,mBAAmB,GAAG,SAAS,EAC1C,QAAQ,EAAE;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACzD,mBAAmB,CAKrB"}

package/dist/audit/orchestrator/resultBaseline.js

@@ -0,0 +1,79 @@
+/**
+ * O2 ↔ F1 residual-risk fix for judge-accepted CE-011: element-staleness for an
+ * already-ingested logical result must compare a FRESHLY-COMPUTED current
+ * `contentKey` (derived from the LIVE `task_content_signature` at advance time)
+ * against a prior BASELINE `contentKey` — and that baseline must live OUTSIDE the
+ * immutable per-record ledger instance.
+ *
+ * Why not read the contentKey off the ledger record? The append-only ledger
+ * (INV-O2-1) keys records on `idempotency_key`, which is signature-STABLE: a
+ * benign content edit (C1 → C2) does NOT move it, so idempotent re-ingest of the
+ * already-ingested result stays a no-op (no duplicate record is appended). If
+ * staleness ALSO read its prior contentKey from that same immutable record, the
+ * record would still carry C1 and a benign edit could never fire staleness — the
+ * exact CE-011 residual hole. So the baseline contentKey is persisted in a
+ * SEPARATE store (`artifact_metadata.result_baselines`, keyed by
+ * `idempotency_key`) that the staleness gate updates as the live signature moves,
+ * while the ledger record itself is never mutated. Append-only ledger invariants
+ * are therefore untouched.
+ *
+ * The comparison driver is the seam's `contentKey` (signature-SENSITIVE), so:
+ *   live C2 != baseline C1  ⟹  staleness FIRES,
+ * while the seam's signature-STABLE `idempotencyKey` keeps idempotent re-ingest a
+ * no-op. The two are reconciled by construction (see src/shared/contentKey.ts).
+ */
+import { buildResultContentDiscriminator, contentKey, idempotencyKey, } from "audit-tools/shared";
+/**
+ * Freshly derive the {idempotency_key, content_key} pair for a live result from
+ * the seam — both computed from the live `task_content_signature` at advance
+ * time. `idempotency_key` is the baseline-store key (signature-STABLE);
+ * `content_key` is the staleness driver (signature-SENSITIVE).
+ */
+export function deriveLiveResultKeys(input) {
+    const discriminator = buildResultContentDiscriminator({
+        source: input.source,
+        attempt: input.attempt,
+    });
+    const coordinate = {
+        unit_id: input.unit_id,
+        lens: input.lens,
+        pass_id: input.pass_id,
+        result_content_discriminator: discriminator,
+    };
+    return {
+        idempotency_key: idempotencyKey(coordinate),
+        content_key: contentKey({
+            ...coordinate,
+            task_content_signature: input.task_content_signature,
+        }),
+    };
+}
+/**
+ * Is the already-ingested logical result stale, given its LIVE keys? Stale iff a
+ * baseline exists for the idempotency_key AND the freshly-computed live
+ * content_key differs from it. A result with no recorded baseline is NOT stale —
+ * it has simply never been compared (the first ingest establishes the baseline).
+ *
+ * The caller supplies live keys via `deriveLiveResultKeys` (freshly computed from
+ * the live signature) — this function NEVER reads a contentKey off a ledger
+ * record.
+ */
+export function isResultStaleAgainstBaseline(baselines, liveKeys) {
+    const baseline = baselines?.[liveKeys.idempotency_key];
+    if (baseline === undefined)
+        return false;
+    return baseline !== liveKeys.content_key;
+}
+/**
+ * Return an updated baseline store with this logical result's baseline set to its
+ * live content_key. Pure: returns a new object, never mutates the input — so a
+ * caller persists the result through the normal artifact_metadata write path.
+ * Idempotent: recording the same content_key again yields an equal store.
+ */
+export function recordResultBaseline(baselines, liveKeys) {
+    return {
+        ...(baselines ?? {}),
+        [liveKeys.idempotency_key]: liveKeys.content_key,
+    };
+}
+//# sourceMappingURL=resultBaseline.js.map

package/dist/audit/orchestrator/resultBaseline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resultBaseline.js","sourceRoot":"","sources":["../../../src/audit/orchestrator/resultBaseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EACL,+BAA+B,EAC/B,UAAU,EACV,cAAc,GAEf,MAAM,oBAAoB,CAAC;AA0B5B;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAyB;IAI5D,MAAM,aAAa,GAAG,+BAA+B,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,MAAM,UAAU,GAAG;QACjB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,4BAA4B,EAAE,aAAa;KAC5C,CAAC;IACF,OAAO;QACL,eAAe,EAAE,cAAc,CAAC,UAAU,CAAC;QAC3C,WAAW,EAAE,UAAU,CAAC;YACtB,GAAG,UAAU;YACb,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;SACrD,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAC1C,SAA0C,EAC1C,QAA0D;IAE1D,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,QAAQ,KAAK,QAAQ,CAAC,WAAW,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAA0C,EAC1C,QAA0D;IAE1D,OAAO;QACL,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;QACpB,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,WAAW;KACjD,CAAC;AACJ,CAAC"}

package/dist/audit/quota/index.d.ts

@@ -105,21 +105,22 @@ export declare const DispatchQuotaSchema: z.ZodObject<{
             captured_at: z.ZodString;
             source: z.ZodString;
         }, "strict", z.ZodTypeAny, {
+            captured_at: string;
             remaining_pct: number | null;
             reset_at: string | null;
             requests_remaining: number | null;
             tokens_remaining: number | null;
-            captured_at: string;
             source: string;
         }, {
+            captured_at: string;
             remaining_pct: number | null;
             reset_at: string | null;
             requests_remaining: number | null;
             tokens_remaining: number | null;
-            captured_at: string;
             source: string;
         }>>>;
         quota_signal_degraded: z.ZodOptional<z.ZodBoolean>;
+        quota_coverage: z.ZodOptional<z.ZodEnum<["established", "reactive_only", "unestablished"]>>;
     }, "strict", z.ZodTypeAny, {
         confidence: "high" | "low" | "medium";
         source: "default" | "explicit_config" | "discovered_capability" | "cli_flags" | "provider_default" | "learned";
@@ -143,14 +144,15 @@ export declare const DispatchQuotaSchema: z.ZodObject<{
         binding_cap: "none" | "learned" | "rpm" | "tpm" | "fallback" | "first_contact" | "cooldown" | "host_concurrency";
         rank?: "deep" | "small" | "standard" | undefined;
         quota_source_snapshot?: {
+            captured_at: string;
             remaining_pct: number | null;
             reset_at: string | null;
             requests_remaining: number | null;
             tokens_remaining: number | null;
-            captured_at: string;
             source: string;
         } | null | undefined;
         quota_signal_degraded?: boolean | undefined;
+        quota_coverage?: "established" | "reactive_only" | "unestablished" | undefined;
     }, {
         confidence: "high" | "low" | "medium";
         source: "default" | "explicit_config" | "discovered_capability" | "cli_flags" | "provider_default" | "learned";
@@ -174,14 +176,15 @@ export declare const DispatchQuotaSchema: z.ZodObject<{
         binding_cap: "none" | "learned" | "rpm" | "tpm" | "fallback" | "first_contact" | "cooldown" | "host_concurrency";
         rank?: "deep" | "small" | "standard" | undefined;
         quota_source_snapshot?: {
+            captured_at: string;
             remaining_pct: number | null;
             reset_at: string | null;
             requests_remaining: number | null;
             tokens_remaining: number | null;
-            captured_at: string;
             source: string;
         } | null | undefined;
         quota_signal_degraded?: boolean | undefined;
+        quota_coverage?: "established" | "reactive_only" | "unestablished" | undefined;
     }>, "many">>;
     /** Echo of the host-reported model roster (lowest rank first), when given. */
     host_model_roster: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -210,18 +213,18 @@ export declare const DispatchQuotaSchema: z.ZodObject<{
         captured_at: z.ZodString;
         source: z.ZodString;
     }, "strict", z.ZodTypeAny, {
+        captured_at: string;
         remaining_pct: number | null;
         reset_at: string | null;
         requests_remaining: number | null;
         tokens_remaining: number | null;
-        captured_at: string;
         source: string;
     }, {
+        captured_at: string;
         remaining_pct: number | null;
         reset_at: string | null;
         requests_remaining: number | null;
         tokens_remaining: number | null;
-        captured_at: string;
         source: string;
     }>>>;
     backoff_state: z.ZodOptional<z.ZodNullable<z.ZodObject<{
@@ -240,6 +243,7 @@ export declare const DispatchQuotaSchema: z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     confidence: "high" | "low" | "medium";
     contract_version: "audit-code-dispatch-quota/v1alpha1" | "audit-code-dispatch-quota/v1alpha2";
+    run_id: string;
     source: "default" | "explicit_config" | "discovered_capability" | "cli_flags" | "provider_default" | "learned";
     cooldown_until: string | null;
     model: string | null;
@@ -255,15 +259,14 @@ export declare const DispatchQuotaSchema: z.ZodObject<{
         active_subagents: number;
         description: string;
     } | null;
-    run_id: string;
     max_concurrent_agents: number;
     binding_cap?: "none" | "learned" | "rpm" | "tpm" | "fallback" | "first_contact" | "cooldown" | "host_concurrency" | undefined;
     quota_source_snapshot?: {
+        captured_at: string;
         remaining_pct: number | null;
         reset_at: string | null;
         requests_remaining: number | null;
         tokens_remaining: number | null;
-        captured_at: string;
         source: string;
     } | null | undefined;
     capacity_pools?: {
@@ -289,14 +292,15 @@ export declare const DispatchQuotaSchema: z.ZodObject<{
         binding_cap: "none" | "learned" | "rpm" | "tpm" | "fallback" | "first_contact" | "cooldown" | "host_concurrency";
         rank?: "deep" | "small" | "standard" | undefined;
         quota_source_snapshot?: {
+            captured_at: string;
             remaining_pct: number | null;
             reset_at: string | null;
             requests_remaining: number | null;
             tokens_remaining: number | null;
-            captured_at: string;
             source: string;
         } | null | undefined;
         quota_signal_degraded?: boolean | undefined;
+        quota_coverage?: "established" | "reactive_only" | "unestablished" | undefined;
     }[] | undefined;
     host_model_roster?: {
         context_tokens: number;
@@ -313,6 +317,7 @@ export declare const DispatchQuotaSchema: z.ZodObject<{
 }, {
     confidence: "high" | "low" | "medium";
     contract_version: "audit-code-dispatch-quota/v1alpha1" | "audit-code-dispatch-quota/v1alpha2";
+    run_id: string;
     source: "default" | "explicit_config" | "discovered_capability" | "cli_flags" | "provider_default" | "learned";
     cooldown_until: string | null;
     model: string | null;
@@ -328,15 +333,14 @@ export declare const DispatchQuotaSchema: z.ZodObject<{
         active_subagents: number;
         description: string;
     } | null;
-    run_id: string;
     max_concurrent_agents: number;
     binding_cap?: "none" | "learned" | "rpm" | "tpm" | "fallback" | "first_contact" | "cooldown" | "host_concurrency" | undefined;
     quota_source_snapshot?: {
+        captured_at: string;
         remaining_pct: number | null;
         reset_at: string | null;
         requests_remaining: number | null;
         tokens_remaining: number | null;
-        captured_at: string;
         source: string;
     } | null | undefined;
     capacity_pools?: {
@@ -362,14 +366,15 @@ export declare const DispatchQuotaSchema: z.ZodObject<{
         binding_cap: "none" | "learned" | "rpm" | "tpm" | "fallback" | "first_contact" | "cooldown" | "host_concurrency";
         rank?: "deep" | "small" | "standard" | undefined;
         quota_source_snapshot?: {
+            captured_at: string;
             remaining_pct: number | null;
             reset_at: string | null;
             requests_remaining: number | null;
             tokens_remaining: number | null;
-            captured_at: string;
             source: string;
         } | null | undefined;
         quota_signal_degraded?: boolean | undefined;
+        quota_coverage?: "established" | "reactive_only" | "unestablished" | undefined;
     }[] | undefined;
     host_model_roster?: {
         context_tokens: number;