audit-tools 0.30.3 → 0.30.5

package/dist/shared/repair/emitValidateRepair.d.ts

@@ -0,0 +1,124 @@
+import type { FrictionCaptureArtifact } from '../io/frictionCapture.js';
+/** A normalized validation error the seam reasons over (validator-agnostic). */
+export interface RepairValidationError {
+    /** Dotted path to the offending field (validator's own path token). */
+    path: string;
+    /** Human-readable message. */
+    message: string;
+    /**
+     * Whether this error sits on a REQUIRED field. Only REQUIRED errors gate stage
+     * escalation; an OPTIONAL-field error is something stage1 coercion is allowed
+     * to clear by dropping the sub-object.
+     */
+    required: boolean;
+}
+/** Outcome of running the canonical validator over a payload. */
+export interface RepairValidationResult {
+    /** All errors (required + optional). Empty ⟹ clean. */
+    errors: RepairValidationError[];
+}
+/**
+ * Classification + deterministic coercion for one contract. The seam asks the
+ * contract to coerce its own OPTIONAL sub-objects and backfill its own
+ * recoverable identity — the seam owns the staging policy, the contract owns the
+ * field semantics.
+ */
+export interface RepairCoercion {
+    /**
+     * Deterministically coerce the payload in a NON-DESTRUCTIVE, OPTIONAL-only way:
+     * drop/empty optional sub-objects that fail validation, and backfill tool-owned
+     * identity that is RECOVERABLE PER ELEMENT. Must NEVER mutate a required
+     * identity coordinate by homogenizing across elements.
+     *
+     * Returns the (possibly new) payload plus the structured record of what it did,
+     * so the seam can emit one friction event per change and decide escalation.
+     */
+    coerce(payload: unknown): RepairCoercionResult;
+}
+/** What stage1 coercion did to a payload. */
+export interface RepairCoercionResult {
+    /** The coerced payload (same reference allowed if nothing changed). */
+    payload: unknown;
+    /** OPTIONAL sub-objects dropped/emptied, by path. */
+    drops: string[];
+    /** Tool-owned identity fields backfilled per element, by path. */
+    backfills: string[];
+    /**
+     * Set true when a REQUIRED identity field is missing on a MULTI-element array
+     * and is NOT recoverable per element — the payload must escalate straight to
+     * `unrepairable` rather than be homogenized (INV-o3-2, fail-2).
+     */
+    unrecoverableIdentity: boolean;
+}
+/**
+ * The errors-only bounded LLM patcher (stage2). Everything-agnostic: the caller
+ * wires whatever provider/model it likes. Receives ONLY the current payload and
+ * the remaining errors; returns a patched payload (or the same payload if it
+ * could not help). MUST be invoked outside any held artifact-tree lock — the seam
+ * holds none and does no artifact-tree IO.
+ */
+export type RepairPatcher = (payload: unknown, errors: RepairValidationError[]) => Promise<unknown>;
+/** A registered contract: one validator, one classification/coercion policy. */
+export interface RepairContract {
+    /** Stable contract id (e.g. 'audit_results', 'implement_worker_result'). */
+    contractId: string;
+    /** The ONE canonical validator, re-run after every stage. Never forked. */
+    validate(payload: unknown): RepairValidationResult;
+    /** Deterministic OPTIONAL-only coercion + recoverable-identity backfill. */
+    coercion: RepairCoercion;
+}
+export type RepairStatus = 'clean' | 'coerced' | 'patched' | 'unrepairable';
+/** A repair stage actually applied, in order. */
+export type RepairStage = 'validate' | 'coerce' | 'llm_patch' | 'redispatch';
+/** Re-dispatch signal surfaced when the seam exhausts cheaper stages. */
+export interface RepairRedispatch {
+    /**
+     * The 1-based attempt counter for the NEXT dispatch. The caller feeds this to
+     * `buildResultContentDiscriminator({ source: 'redispatch', attempt })` so the
+     * re-dispatched result carries a distinct discriminator (and idempotencyKey).
+     */
+    attempt: number;
+}
+/** The single result shape of the seam (OBL-...-o3-contract). */
+export interface RepairOutcome {
+    /** The repaired payload (identity-preserving for clean/coerced/patched). */
+    repaired_payload: unknown;
+    /** Terminal status. */
+    status: RepairStatus;
+    /** Non-empty whenever status !== 'clean'. */
+    warnings: string[];
+    /** Remaining REQUIRED-field errors after the last stage (empty unless unrepairable). */
+    remaining_errors: RepairValidationError[];
+    /** Stages applied, in order. Always begins with 'validate'. */
+    stages_applied: RepairStage[];
+    /** Present only when status === 'unrepairable': the re-dispatch signal. */
+    redispatch?: RepairRedispatch;
+}
+/** Options for one repair run. */
+export interface RunEmitValidateRepairOptions {
+    /** The registered contract (validator + coercion). */
+    contract: RepairContract;
+    /** The worker payload to repair. */
+    payload: unknown;
+    /** Artifacts dir for friction capture (best-effort). */
+    artifactsDir: string;
+    /** Per-run id for friction capture keying. */
+    runId: string;
+    /** Which orchestrator is calling (friction record `tool` field). */
+    tool?: FrictionCaptureArtifact['tool'];
+    /** Optional bounded LLM patcher (stage2). Omitted ⟹ stage2 is skipped. */
+    patcher?: RepairPatcher;
+    /** Max bounded LLM attempts (default 1). */
+    maxLlmAttempts?: number;
+    /**
+     * 1-based current attempt counter (default 1). The re-dispatch signal advances
+     * it by one so the next attempt carries a distinct discriminator.
+     */
+    attempt?: number;
+}
+/**
+ * Run the cheapest-first monotonic emit-validate-repair pipeline over one
+ * payload. See the module header for the full stage contract.
+ */
+export declare function runEmitValidateRepair(opts: RunEmitValidateRepairOptions): Promise<RepairOutcome>;
+//# sourceMappingURL=emitValidateRepair.d.ts.map

package/dist/shared/repair/emitValidateRepair.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emitValidateRepair.d.ts","sourceRoot":"","sources":["../../../src/shared/repair/emitValidateRepair.ts"],"names":[],"mappings":"AAuDA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAExE,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,iEAAiE;AACjE,MAAM,WAAW,sBAAsB;IACrC,uDAAuD;IACvD,MAAM,EAAE,qBAAqB,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;;;OAQG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,oBAAoB,CAAC;CAChD;AAED,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAC;IACjB,qDAAqD;IACrD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,kEAAkE;IAClE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;OAIG;IACH,qBAAqB,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,qBAAqB,EAAE,KAC5B,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,sBAAsB,CAAC;IACnD,4EAA4E;IAC5E,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,cAAc,CAAC;AAE5E,iDAAiD;AACjD,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,YAAY,CAAC;AAE7E,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,gBAAgB,EAAE,OAAO,CAAC;IAC1B,uBAAuB;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,wFAAwF;IACxF,gBAAgB,EAAE,qBAAqB,EAAE,CAAC;IAC1C,+DAA+D;IAC/D,cAAc,EAAE,WAAW,EAAE,CAAC;IAC9B,2EAA2E;IAC3E,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,kCAAkC;AAClC,MAAM,WAAW,4BAA4B;IAC3C,sDAAsD;IACtD,QAAQ,EAAE,cAAc,CAAC;IACzB,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,IAAI,CAAC,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACvC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA2BD;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,aAAa,CAAC,CAyIxB"}

package/dist/shared/repair/emitValidateRepair.js

@@ -0,0 +1,179 @@
+/**
+ * The shared emit-validate-repair seam (O3) — the SOLE definition of the
+ * cheapest-first monotonic repair pipeline that every contract's worker result
+ * passes through before it is accepted (OBL-emit-validate-repair-seam-o3-contract).
+ *
+ * The seam is EVERYTHING-AGNOSTIC: it hardcodes no contract id, no validator, no
+ * field classification, no model, and no provider. A caller registers a
+ * {@link RepairContract} — `{ validate, classifyError, identity }` — for a
+ * contract id, then drives a payload through {@link runEmitValidateRepair}. A new
+ * contract id therefore registers a validator + classification WITHOUT editing the
+ * seam (INV-o3-3 / everything-agnostic).
+ *
+ * CHEAPEST-FIRST MONOTONIC STAGES (a stage runs only if the prior left a
+ * REQUIRED-field error; no LLM call when coercion alone yields clean):
+ *
+ *   stage1 — deterministic coercion (INV-o3-1):
+ *     - drops/empties OPTIONAL sub-objects ONLY (never touches a REQUIRED field);
+ *     - backfills tool-owned identity that is RECOVERABLE PER ELEMENT (e.g. the
+ *       coordinate is uniform across a single-element array);
+ *     - a missing per-element `unit_id` (or any non-recoverable required identity)
+ *       on a MULTI-element array escalates the whole payload to `unrepairable` —
+ *       it is NEVER homogenized by copying a sibling's id (INV-o3-2, fail-2).
+ *
+ *   stage2 — bounded ~1-attempt errors-only LLM patch (INV-o3-4):
+ *     - runs ONLY if stage1 left REQUIRED-field errors and a patcher is supplied;
+ *     - the patch prompt carries ONLY the remaining errors + the payload, never
+ *       the whole contract — cheapest viable LLM touch;
+ *     - bounded to a single attempt (the caller may set `maxLlmAttempts`, default
+ *       1); the validator re-runs after it.
+ *     - The patcher MUST run OUTSIDE any held artifact-tree `withFileLock`: the
+ *       seam holds no lock and performs no artifact-tree IO, so a caller that
+ *       holds the lock must release it before invoking the seam (enforced by the
+ *       lock-free contract of this module — it never imports the file lock).
+ *
+ *   stage3 — re-dispatch signal (INV-o3-5):
+ *     - if REQUIRED-field errors remain after stage2, the seam returns
+ *       `status: 'unrepairable'` with `stages_applied` ending in `redispatch`,
+ *       the SIGNAL the caller turns into a fresh dispatch. The re-dispatched
+ *       attempt carries a DISTINCT `result_content_discriminator` (the seam
+ *       surfaces the next discriminator via {@link RepairOutcome.redispatch}),
+ *       so its idempotencyKey differs from the attempt it replaces.
+ *
+ * ONE VALIDATOR (INV-o3-6): the seam re-runs the SAME injected canonical
+ * `validate` after every stage — it never forks or re-implements validation.
+ *
+ * IDENTITY PRESERVATION (INV-o3-7): coercion only drops/backfills; it never
+ * rewrites the emitted tool-owned identity coordinate, so identityKey /
+ * idempotencyKey computed off the repaired payload are UNCHANGED. Only a stage3
+ * re-dispatch changes identity, and only via a distinct discriminator.
+ *
+ * FRICTION (fail-1..7): every drop, backfill, escalation, LLM patch, and repeated
+ * repair is recorded through the O1 `captureFrictionEvent` sink (best-effort,
+ * never fatal). `warnings` is non-empty whenever `status !== 'clean'`.
+ */
+import { captureFrictionEvent } from '../friction/captureFrictionEvent.js';
+function requiredErrors(result) {
+    return result.errors.filter((e) => e.required);
+}
+/** Emit one best-effort, de-duped friction event for a repair action. */
+async function captureRepair(opts, idSuffix, note, severity) {
+    await captureFrictionEvent(opts.artifactsDir, opts.runId, {
+        id: `repair:${opts.contract.contractId}:attempt-${opts.attempt ?? 1}:${idSuffix}`,
+        note,
+        severity,
+        category: 'trap',
+        area: opts.contract.contractId,
+    }, opts.tool ?? 'remediate-code');
+}
+/**
+ * Run the cheapest-first monotonic emit-validate-repair pipeline over one
+ * payload. See the module header for the full stage contract.
+ */
+export async function runEmitValidateRepair(opts) {
+    const { contract } = opts;
+    const attempt = opts.attempt ?? 1;
+    const maxLlmAttempts = Math.max(0, opts.maxLlmAttempts ?? 1);
+    const stages_applied = ['validate'];
+    const warnings = [];
+    // A repeated repair (attempt > 1) is itself friction worth recording (fail-7).
+    if (attempt > 1) {
+        await captureRepair(opts, 'repeated', `Repeated repair pass (attempt ${attempt}) for ${contract.contractId}.`, 'low');
+    }
+    // --- stage0: validate as emitted. Clean ⟹ no work, identity untouched. ---
+    let payload = opts.payload;
+    let validation = contract.validate(payload);
+    if (requiredErrors(validation).length === 0 && validation.errors.length === 0) {
+        return {
+            repaired_payload: payload,
+            status: 'clean',
+            warnings,
+            remaining_errors: [],
+            stages_applied,
+        };
+    }
+    // --- stage1: deterministic OPTIONAL-only coercion + recoverable backfill. ---
+    const coerced = contract.coercion.coerce(payload);
+    stages_applied.push('coerce');
+    if (coerced.unrecoverableIdentity) {
+        // Multi-element missing required identity → escalate; never homogenize.
+        await captureRepair(opts, 'unrecoverable-identity', `Unrecoverable per-element identity in ${contract.contractId}; escalating to re-dispatch rather than homogenizing.`, 'high');
+        warnings.push('Required per-element identity missing on a multi-element payload; cannot be recovered deterministically.');
+        const remaining = requiredErrors(contract.validate(coerced.payload));
+        stages_applied.push('redispatch');
+        return {
+            repaired_payload: coerced.payload,
+            status: 'unrepairable',
+            warnings,
+            remaining_errors: remaining,
+            stages_applied,
+            redispatch: { attempt: attempt + 1 },
+        };
+    }
+    payload = coerced.payload;
+    for (const drop of coerced.drops) {
+        warnings.push(`Dropped invalid OPTIONAL sub-object at ${drop}.`);
+        await captureRepair(opts, `drop:${drop}`, `Dropped invalid OPTIONAL sub-object at ${drop} in ${contract.contractId}.`, 'low');
+    }
+    for (const backfill of coerced.backfills) {
+        warnings.push(`Backfilled recoverable tool-owned identity at ${backfill}.`);
+        await captureRepair(opts, `backfill:${backfill}`, `Backfilled recoverable tool-owned identity at ${backfill} in ${contract.contractId}.`, 'info');
+    }
+    validation = contract.validate(payload);
+    let remaining = requiredErrors(validation);
+    if (remaining.length === 0) {
+        // Coercion alone cleared every REQUIRED error → NO LLM call (cheapest-first).
+        return {
+            repaired_payload: payload,
+            status: 'coerced',
+            warnings: warnings.length > 0
+                ? warnings
+                : ['Payload required deterministic coercion to validate.'],
+            remaining_errors: [],
+            stages_applied,
+        };
+    }
+    // --- stage2: bounded errors-only LLM patch (lock-free). ---
+    if (opts.patcher && maxLlmAttempts > 0) {
+        let llmRound = 0;
+        while (llmRound < maxLlmAttempts && remaining.length > 0) {
+            llmRound += 1;
+            stages_applied.push('llm_patch');
+            await captureRepair(opts, `llm-patch-${llmRound}`, `Bounded errors-only LLM patch (round ${llmRound}) for ${contract.contractId}.`, 'medium');
+            let patched;
+            try {
+                patched = await opts.patcher(payload, remaining);
+            }
+            catch {
+                // A failed patch leaves the payload as-is; fall through to re-dispatch.
+                break;
+            }
+            payload = patched;
+            validation = contract.validate(payload);
+            remaining = requiredErrors(validation);
+        }
+        if (remaining.length === 0) {
+            warnings.push('Payload required a bounded LLM patch to validate.');
+            return {
+                repaired_payload: payload,
+                status: 'patched',
+                warnings,
+                remaining_errors: [],
+                stages_applied,
+            };
+        }
+    }
+    // --- stage3: re-dispatch signal. ---
+    stages_applied.push('redispatch');
+    warnings.push(`Repair exhausted coercion${opts.patcher ? ' and bounded LLM patch' : ''}; ${remaining.length} required error(s) remain — re-dispatch required.`);
+    await captureRepair(opts, 'redispatch', `Repair exhausted cheaper stages for ${contract.contractId}; signalling re-dispatch (next attempt ${attempt + 1}).`, 'high');
+    return {
+        repaired_payload: payload,
+        status: 'unrepairable',
+        warnings,
+        remaining_errors: remaining,
+        stages_applied,
+        redispatch: { attempt: attempt + 1 },
+    };
+}
+//# sourceMappingURL=emitValidateRepair.js.map

package/dist/shared/repair/emitValidateRepair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emitValidateRepair.js","sourceRoot":"","sources":["../../../src/shared/repair/emitValidateRepair.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAsI3E,SAAS,cAAc,CAAC,MAA8B;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,aAAa,CAC1B,IAAkC,EAClC,QAAgB,EAChB,IAAY,EACZ,QAA4C;IAE5C,MAAM,oBAAoB,CACxB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,KAAK,EACV;QACE,EAAE,EAAE,UAAU,IAAI,CAAC,QAAQ,CAAC,UAAU,YAAY,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,QAAQ,EAAE;QACjF,IAAI;QACJ,QAAQ;QACR,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU;KAC/B,EACD,IAAI,CAAC,IAAI,IAAI,gBAAgB,CAC9B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAkC;IAElC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;IAClC,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAkB,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,+EAA+E;IAC/E,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,MAAM,aAAa,CACjB,IAAI,EACJ,UAAU,EACV,iCAAiC,OAAO,SAAS,QAAQ,CAAC,UAAU,GAAG,EACvE,KAAK,CACN,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC3B,IAAI,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,OAAO;YACL,gBAAgB,EAAE,OAAO;YACzB,MAAM,EAAE,OAAO;YACf,QAAQ;YACR,gBAAgB,EAAE,EAAE;YACpB,cAAc;SACf,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE9B,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;QAClC,wEAAwE;QACxE,MAAM,aAAa,CACjB,IAAI,EACJ,wBAAwB,EACxB,yCAAyC,QAAQ,CAAC,UAAU,uDAAuD,EACnH,MAAM,CACP,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,0GAA0G,CAC3G,CAAC;QACF,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACrE,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAClC,OAAO;YACL,gBAAgB,EAAE,OAAO,CAAC,OAAO;YACjC,MAAM,EAAE,cAAc;YACtB,QAAQ;YACR,gBAAgB,EAAE,SAAS;YAC3B,cAAc;YACd,UAAU,EAAE,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,EAAE;SACrC,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,0CAA0C,IAAI,GAAG,CAAC,CAAC;QACjE,MAAM,aAAa,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE,0CAA0C,IAAI,OAAO,QAAQ,CAAC,UAAU,GAAG,EAAE,KAAK,CAAC,CAAC;IAChI,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,iDAAiD,QAAQ,GAAG,CAAC,CAAC;QAC5E,MAAM,aAAa,CAAC,IAAI,EAAE,YAAY,QAAQ,EAAE,EAAE,iDAAiD,QAAQ,OAAO,QAAQ,CAAC,UAAU,GAAG,EAAE,MAAM,CAAC,CAAC;IACpJ,CAAC;IAED,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,SAAS,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,8EAA8E;QAC9E,OAAO;YACL,gBAAgB,EAAE,OAAO;YACzB,MAAM,EAAE,SAAS;YACjB,QAAQ,EACN,QAAQ,CAAC,MAAM,GAAG,CAAC;gBACjB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,CAAC,sDAAsD,CAAC;YAC9D,gBAAgB,EAAE,EAAE;YACpB,cAAc;SACf,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,IAAI,IAAI,CAAC,OAAO,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QACvC,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,OAAO,QAAQ,GAAG,cAAc,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,QAAQ,IAAI,CAAC,CAAC;YACd,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjC,MAAM,aAAa,CACjB,IAAI,EACJ,aAAa,QAAQ,EAAE,EACvB,wCAAwC,QAAQ,SAAS,QAAQ,CAAC,UAAU,GAAG,EAC/E,QAAQ,CACT,CAAC;YACF,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,wEAAwE;gBACxE,MAAM;YACR,CAAC;YACD,OAAO,GAAG,OAAO,CAAC;YAClB,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACxC,SAAS,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;YACnE,OAAO;gBACL,gBAAgB,EAAE,OAAO;gBACzB,MAAM,EAAE,SAAS;gBACjB,QAAQ;gBACR,gBAAgB,EAAE,EAAE;gBACpB,cAAc;aACf,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAClC,QAAQ,CAAC,IAAI,CACX,4BAA4B,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,MAAM,mDAAmD,CACjJ,CAAC;IACF,MAAM,aAAa,CACjB,IAAI,EACJ,YAAY,EACZ,uCAAuC,QAAQ,CAAC,UAAU,0CAA0C,OAAO,GAAG,CAAC,IAAI,EACnH,MAAM,CACP,CAAC;IACF,OAAO;QACL,gBAAgB,EAAE,OAAO;QACzB,MAAM,EAAE,cAAc;QACtB,QAAQ;QACR,gBAAgB,EAAE,SAAS;QAC3B,cAAc;QACd,UAAU,EAAE,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,EAAE;KACrC,CAAC;AACJ,CAAC"}

package/dist/shared/repair/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `audit-tools/shared/repair` — the single-sourced emit-validate-repair seam (O3).
+ * Both orchestrators import the seam from here so the staged repair policy cannot
+ * drift between the two halves of the pipeline.
+ */
+export type { RepairValidationError, RepairValidationResult, RepairCoercion, RepairCoercionResult, RepairPatcher, RepairContract, RepairStatus, RepairStage, RepairRedispatch, RepairOutcome, RunEmitValidateRepairOptions, } from './emitValidateRepair.js';
+export { runEmitValidateRepair } from './emitValidateRepair.js';
+export type { BrokeredDispatchSlot, BrokerAdmission, BrokeredDispatchDecision, BrokeredCompletion, BrokerDispatchInput, BrokeredRepairDispatch, } from './brokeredDispatch.js';
+export { createBrokeredRepairDispatch, estimateSlotTokens, classifyCapableHost, } from './brokeredDispatch.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/shared/repair/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/shared/repair/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,YAAY,EACV,qBAAqB,EACrB,sBAAsB,EACtB,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,YAAY,EACV,oBAAoB,EACpB,eAAe,EACf,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC"}

package/dist/shared/repair/index.js

@@ -0,0 +1,3 @@
+export { runEmitValidateRepair } from './emitValidateRepair.js';
+export { createBrokeredRepairDispatch, estimateSlotTokens, classifyCapableHost, } from './brokeredDispatch.js';
+//# sourceMappingURL=index.js.map

package/dist/shared/repair/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/shared/repair/index.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAWhE,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC"}

package/dist/shared/stableStringify.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The single deterministic JSON serializer for content hashing across the
+ * codebase (INV-CK-2 / content-key-seam-fail-2). Object keys are sorted, so two
+ * structurally-equal values with differently-ordered keys serialize identically.
+ * `undefined` is normalized to `null` (both top-level and inside arrays) so a
+ * present-but-undefined field can never change the hash.
+ *
+ * There must be exactly ONE such serializer — never write a second. Both the
+ * artifact-freshness metadata hash (`src/audit/orchestrator/artifactFreshness.ts`,
+ * which re-exports this) and the content-key seam (`src/shared/contentKey.ts`)
+ * route through this function.
+ */
+export declare function stableStringify(value: unknown): string;
+//# sourceMappingURL=stableStringify.d.ts.map

package/dist/shared/stableStringify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stableStringify.d.ts","sourceRoot":"","sources":["../../src/shared/stableStringify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CActD"}

package/dist/shared/stableStringify.js

@@ -0,0 +1,28 @@
+/**
+ * The single deterministic JSON serializer for content hashing across the
+ * codebase (INV-CK-2 / content-key-seam-fail-2). Object keys are sorted, so two
+ * structurally-equal values with differently-ordered keys serialize identically.
+ * `undefined` is normalized to `null` (both top-level and inside arrays) so a
+ * present-but-undefined field can never change the hash.
+ *
+ * There must be exactly ONE such serializer — never write a second. Both the
+ * artifact-freshness metadata hash (`src/audit/orchestrator/artifactFreshness.ts`,
+ * which re-exports this) and the content-key seam (`src/shared/contentKey.ts`)
+ * route through this function.
+ */
+export function stableStringify(value) {
+    if (value === undefined) {
+        return "null";
+    }
+    if (value === null || typeof value !== "object") {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map((item) => stableStringify(item ?? null)).join(",")}]`;
+    }
+    const entries = Object.entries(value)
+        .filter(([, item]) => item !== undefined)
+        .sort(([a], [b]) => a.localeCompare(b));
+    return `{${entries.map(([key, item]) => `${JSON.stringify(key)}:${stableStringify(item)}`).join(",")}}`;
+}
+//# sourceMappingURL=stableStringify.js.map

package/dist/shared/stableStringify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stableStringify.js","sourceRoot":"","sources":["../../src/shared/stableStringify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7E,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;SACxC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC1G,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "audit-tools",
-  "version": "0.30.3",
+  "version": "0.30.5",
   "private": false,
   "description": "Portable hybrid code auditing + remediation orchestrators for arbitrary repositories.",
   "type": "module",

package/schemas/audit_result.schema.json

@@ -496,6 +496,15 @@
     "submitted_at": {
       "type": "string",
       "format": "date-time"
+    },
+    "instance_id": {
+      "type": "string"
+    },
+    "identity_key": {
+      "type": "string"
+    },
+    "idempotency_key": {
+      "type": "string"
     }
   },
   "required": [

package/schemas/audit_results.schema.json

@@ -498,6 +498,15 @@
       "submitted_at": {
         "type": "string",
         "format": "date-time"
+      },
+      "instance_id": {
+        "type": "string"
+      },
+      "identity_key": {
+        "type": "string"
+      },
+      "idempotency_key": {
+        "type": "string"
       }
     },
     "required": [