audit-tools 0.32.18 → 0.32.20

package/docs/audit-pkg/development.md

@@ -40,13 +40,14 @@ workflow semantics.
 
 The system separates deterministic extraction from bounded LLM judgment:
 
-1. intake and file disposition
-2. surface, flow, graph, unit, risk, and coverage artifacts
-3. audit task planning
-4. review packet construction
-5. semantic review through the active conversation or fallback provider bridge
-6. result ingestion, selective deepening, runtime validation, and synthesis
-7. final `audit-report.md`
+1. a one-time provider-confirmation gate (discover, cost-order, and confirm the provider pool)
+2. intake and file disposition
+3. surface, flow, graph, unit, risk, and coverage artifacts
+4. audit task planning
+5. review packet construction
+6. semantic review through the active conversation or fallback provider bridge
+7. result ingestion, selective deepening, runtime validation, and synthesis
+8. final `audit-report.md`
 
 Portability rules:
 

package/docs/audit-pkg/product.md

@@ -38,12 +38,15 @@ The intended workflow is:
 
 1. The user invokes `/audit-code`.
 2. The prompt runs `audit-code ensure --quiet`.
-3. Deterministic backend steps build or refresh artifacts.
-4. The active conversation dispatches bounded review packets when semantic
+3. The conversation confirms (or accepts by default) the discovered provider
+   pool and cost ordering (`provider_confirmation`) — the pipeline's first
+   gated step.
+4. Deterministic backend steps build or refresh artifacts.
+5. The active conversation dispatches bounded review packets when semantic
    judgment is required.
-5. Packet workers submit validated `AuditResult` objects through backend-owned
+6. Packet workers submit validated `AuditResult` objects through backend-owned
    commands.
-6. The backend ingests results, performs selective deepening and runtime
+7. The backend ingests results, performs selective deepening and runtime
    validation when needed, and writes the final `audit-report.md`.
 
 Semantic review belongs to the active host conversation by default. Backend

package/docs/audit-pkg/release.md

@@ -42,11 +42,13 @@ Workflow:
 .github/workflows/publish-package.yml
 ```
 
-The workflow:
+The release gate is split into two parallel jobs — `gate` (`npm run verify:checks`) and `test` (the
+vitest suite, sharded 4 ways) — so publish latency is bounded by the slowest gate job rather than their
+sum. The `publish` job needs both, then:
 
 - requests `id-token: write` for npm OIDC exchange
 - pins the Node and npm versions declared in `.github/workflows/publish-package.yml`
-- runs `npm run verify:release`
+- rebuilds `dist/` for packing (the `gate`/`test` jobs already ran the full verify chain)
 - previews the packed tarball with `npm pack --dry-run`
 - publishes with public access and provenance
 - defaults semver prerelease versions to the `next` dist-tag unless overridden

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "audit-tools",
-  "version": "0.32.18",
+  "version": "0.32.20",
   "private": false,
   "license": "ISC",
   "description": "Portable hybrid code auditing + remediation orchestrators for arbitrary repositories.",